PNC FINANCIAL SERVICES GROUP INC

A summary of our equity investments follows:

Table 33: Equity Investments Summary

Tax Credit Investments

Included in our equity investments are direct tax credit investments and equity investments held by consolidated entities. These tax credit investment balances included unfunded commitments totaling $2.5 billion at both December 31, 2023 and 2022. These unfunded commitments are included in Other liabilities on our Consolidated Balance Sheet.

Note 4 Loan Sale and Servicing Activities and Variable Interest Entities has further information on tax credit investments.

Private Equity and Other

The largest component of our other equity investments is our private equity portfolio. The private equity portfolio is an illiquid portfolio consisting of mezzanine and equity investments that vary by industry, stage and type of investment. Private equity investments carried at estimated fair value totaled $2.2 billion at December 31, 2023 and $1.8 billion at December 31, 2022, respectively. As of December 31, 2023, $2.0 billion was invested directly in a variety of companies, and $0.2 billion was invested indirectly through various private equity funds. See the Supervision and Regulation section in Item 1 of this Report for discussion of the Volcker Rule limitations on our interests in and relationships with private funds.

Included in our other equity investments are Visa Class B common shares, which are recorded at cost. Visa Class B common shares that we own are transferable only under limited circumstances until they can be converted into shares of the publicly-traded Class A common shares. Based upon the December 31, 2023 per share closing price of $260.35 for a Visa Class A common share, the estimated value of our total investment in the Class B common shares was approximately $1.5 billion at the current conversion rate of Visa B shares to Visa A shares, while our cost basis was insignificant. See Note 14 Fair Value and Note 20 Legal Proceedings for additional information regarding our Visa agreements, and Visa’s amendments to its Certificate of Incorporation to institute a conversion and exchange offer program that would release transfer restrictions on portions of the Visa Class B common shares. The estimated value does not represent fair value of the Visa B common shares given the shares’ limited transferability and the lack of observable transactions in the marketplace.

We also have certain other equity investments, the majority of which represent investments in affiliated and non-affiliated funds with both traditional and alternative investment strategies. Net gains related to these investments were $18 million in 2023 and $45 million in 2022.

Impact of Inflation

Our assets and liabilities are primarily financial in nature and typically have varying maturity dates. Accordingly, future changes in

prices do not affect the obligations to pay or receive fixed and determinable amounts of money. However, during periods of inflation,

there may be a subsequent impact affecting certain fixed costs or expenses, an erosion of consumer and customer purchasing power,

and fluctuations in the need or demand for our products and services. When significant levels of inflation occur, our business could

potentially be impacted by, among other things, reducing our tolerance for extending credit or causing us to incur additional credit

losses resulting from possible increased default rates. Throughout 2023, the Federal Reserve monetary policy has tightened with the intent to slow inflation, which has led to larger increases in interest rates. See Risk Factors in Item 1A, our Executive Summary and Cautionary Statement Regarding Forward-Looking statements in this Item 7 for further discussion of inflation and its overall impact to the economy, our borrowers’ ability to repay their obligations and certain costs and expenses to PNC.

Financial Derivatives

We use a variety of financial derivatives as part of the overall asset and liability risk management process to help manage exposure to market (primarily interest rate) and credit risk inherent in our business activities. We also enter into derivatives with customers to facilitate their risk management activities.

Financial derivatives involve, to varying degrees, market and credit risk. Derivatives represent contracts between parties that usually require little or no initial net investment and result in one party delivering cash or another type of asset to the other party based on a

The PNC Financial Services Group, Inc. –2023 Form 10-K 75 notional and an underlying as specified in the contract. Therefore, cash requirements and exposure to credit risk are significantly less than the notional amount on these instruments.

Further information on our financial derivatives is presented in Note 1 Accounting Policies, Note 14 Fair Value and Note 15 Financial Derivatives.

Not all elements of market and credit risk are addressed through the use of financial derivatives, and such instruments may be ineffective for their intended purposes due to unanticipated market changes, among other reasons.

Operational Risk Management

Operational risk is the risk to the current or projected financial condition and resilience arising from inadequate or failed internal processes or systems, human errors or misconduct or adverse external events. Operational risk is inherent to the entire organization.

Operational risk management is embedded in our culture and decision-making processes through a systematic approach whereby operational risks and exposures are: (i) identified and assessed; (ii) managed through the design and implementation of controls; (iii) measured and evaluated against our risk tolerance limits; and (iv) appropriately reported to management and the Risk Committee of the Board of Directors. Strong operational risk management and well-informed risk-based decisions benefit us by improving the customer experience, enhancing compliance, reducing reputational risk, minimizing losses and establishing an appropriate amount of required operational risk capital held by us.

The Operational Risk Management Framework is designed to provide effective and consistent management of operational risk. The primary purpose of the framework is to enable us to understand our operational risks and manage them to the desired risk profile, in line with our Risk Appetite. Additionally, the guidance established within the framework assists management in making well-informed risk-based business decisions.

The framework provides a disciplined and structured process for us to manage operational risk across eight operational risk domains. These domains provide a comprehensive view of operational risk and allow us to discuss operational risk in a standard way, facilitating reporting and ongoing risk mitigation.

The operational risk domains are:

•Operations: Risk resulting from inadequate or failed internal processes, misconduct or errors of people or fraud.

•Compliance: Risk of legal or regulatory sanctions, financial loss, or damage to reputation resulting from failure to comply with laws, regulations, rules, self-regulatory standards or other regulatory requirements.

•Data Management: Risk associated with incomplete or inaccurate data.

•Model: Risk associated with the design, implementation and ongoing use and management of models.

•Technology and Systems: Risk associated with the use, operation and adoption of technology.

•Information Security: Risk resulting from the failure to protect information and ensure appropriate access to, and use and handling of, information assets.

•Business Continuity: Risk of potential disruptive events to business activities.

•Third Party: Risk arising from failure of third-party providers to conduct activity in a safe and sound manner and in compliance with contract provisions and applicable laws and regulations.

We utilize operational risk management programs within the framework, including Risk and Control Self-Assessments, scenario analysis, and internal and external loss event reviews and analysis, to assess existing risks, determine potential/emerging risks and evaluate the effectiveness of internal controls. Program tools and methodology assist our business managers in identifying potential risks and control gaps.

Lines of business are responsible for identifying, owning, managing and monitoring the operational risks and controls associated with their business activities and product or service offerings to within acceptable levels. Centralized functions, such as Business Continuity, Enterprise Third Party Management and Information Security, are responsible for the development, implementation and management of their individual programs and for the development and maintenance of the policies, procedures, methodologies, tools and technology utilized across the enterprise to identify, assess, monitor and report program risks. Additionally, independent risk management reviews and challenges line of business adherence to the framework to help ensure proper controls are in place and appropriate risk mitigation plans are established as necessary.

Conduct, Reputational and Strategic Risk

PNC’s risk culture seeks to reinforce the appropriate protocols for responsible and ethical behavior through sound processes and controls. In order to promote a robust risk culture, the Board and executive management establish code of conduct and professional standards to which all employees must adhere. A strong risk culture discourages misconduct and supports conduct risk management at PNC. Conduct risk is defined as the risk that employees fail to comply with the ethical standards expected of them. Strong conduct

76 The PNC Financial Services Group, Inc. –2023 Form 10-K risk management is important in supporting PNC’s reputation, and PNC maintains a corporate culture that emphasizes complying with laws, regulations, and managing reputational risks. Reputational risk is the risk to the franchise and/or shareholder value based on a negative perception of PNC by its stakeholders and/or the changing expectations of its stakeholders. Strategic risk is another component of the ERM Framework that is also critical to optimizing shareholder returns. Strategic risk is the risk to earnings that may arise from adverse business decisions, improper implementation of business decisions and/or inadequate response to changes in the business environment. Strategic risk is considered and assessed by our businesses in the annual strategic planning processes and monitored on an on-going basis as those plans are carried out.

Compliance Risk

Enterprise Compliance is responsible for oversight of compliance risk for the organization. Compliance issues are identified and tracked through enterprise-wide monitoring and testing activities. Compliance risk issues are escalated through a comprehensive risk reporting process at both a business and enterprise level and incorporated, as appropriate, into the development and assessment of our operational risk profile. A management committee, chaired by the Chief Compliance Officer, is responsible for oversight of compliance and fiduciary risk management programs across PNC. Enterprise Compliance, through the Regulatory Change Program, helps PNC understand and proactively address emerging regulatory topics and risks as well as respond to changes in applicable laws and regulations. To understand emerging issues impacting the industry, Enterprise Compliance communicates regularly with various regulators having supervisory or regulatory responsibilities with respect to us, our subsidiaries, or businesses and participates in forums focused on regulatory and compliance matters in the financial services industry.

Information Security Risk

The Information Security component of our Operational Risk Management Framework is responsible for protecting information assets to achieve business objectives, which includes cybersecurity. PNC’s cybersecurity program is designed to identify risks to sensitive information, protect that information, detect threats and events and maintain an appropriate response and recovery capability to help ensure resilience against information security incidents. The program includes, among other things, annual security and privacy training for all PNC employees and quarterly phishing exercises to raise employee awareness. Our security program is also regularly examined by federal regulators for compliance with financial regulations and standards. The program also establishes expectations for information asset management, system development security, identity and access management, incident management, threat and vulnerability management, security operations management and third- and fourth-party security. For additional information, see Item 1C Cybersecurity of this Report.