PNC FINANCIAL SERVICES GROUP INC

Enterprise Risk Management

We encounter risk as part of the normal course of operating our business. Accordingly, we design our risk governance framework, referred to as the ERM Framework, and risk management processes to help manage this risk. We manage risk in light of our risk appetite to optimize long-term shareholder value while supporting our employees, customers and communities.

Our ERM Framework is structurally aligned with regulatory enhanced prudential standards and heightened standards promulgated by the Federal Reserve and OCC, respectively, which establish minimum requirements for the design and implementation of a risk governance framework. This Risk Management section describes our ERM Framework, which consists of seven core components that provide executive management and the Board of Directors with an aggregate view of significant risks impacting the organization. The seven core components are risk culture, enterprise strategy (including risk appetite, strategic planning, capital planning and stress testing), risk governance and oversight, risk identification, risk assessments, risk controls and monitoring, and risk aggregation and reporting (see the figure below). The overall Risk Management section of this Item 7 also provides an analysis of the firm’s Capital Management and our key areas of risk, which include, but are not limited to Credit, Market, Liquidity and Operational (including Compliance and Information Security). Our use of financial derivatives as part of our overall asset and liability risk management process is also addressed within this Risk Management section.

We operate within a rapidly evolving regulatory and financial services environment. Accordingly, we are actively focused on the timely incorporation of applicable regulatory pronouncements and emerging risks into our ERM Framework.

54 The PNC Financial Services Group, Inc. –2023 Form 10-K

Risk Culture

A strong risk culture helps us make well informed decisions, helps ensure individuals conform to the established culture, reduces an individual’s ability to do something for personal gain, and rewards employees for working toward a common goal rather than individual interests. Our risk culture reinforces the appropriate protocols for responsible and ethical behavior. These protocols are especially critical in terms of our risk awareness, risk-taking behavior and risk management practices.

Managing risk is every employee’s responsibility. All of our employees, individually and collectively, are responsible for ensuring the organization is performing with the utmost integrity, is applying sound risk management practices and is striving to achieve our stated objectives. All employees are also responsible for understanding our Enterprise Risk Appetite Statement, the ERM Framework and how risk management applies to their respective roles and responsibilities. Employees are encouraged to collaborate across groups to identify and mitigate risks and elevate issues as required. We reinforce risk management responsibilities through a performance management system where employee performance goals include risk management objectives and incentives for employees to reinforce balanced measures of risk-adjusted performance.

Proactive and open communication, between groups and up to the Board of Directors, facilitates timely identification and resolution of risk issues. Our multi-level risk committee structure provides formal channels to identify and report risk.

Enterprise Strategy

We seek to ensure that our overall enterprise strategy is within acceptable risk parameters through our risk appetite, strategic planning, capital planning and stress testing processes. These components are reviewed and approved at least annually by the Board of Directors or one of its committees.

Risk Appetite: Our risk appetite represents the organization’s desired enterprise risk position, set within our capital-based risk and liquidity capacity to achieve our strategic objectives and business plans. The Enterprise Risk Appetite Statement qualitatively describes the aggregate level of risk we are willing to accept in order to execute our business strategies. Qualitative guiding principles further define each of the risks within our taxonomy to support the risk appetite statement. Risk appetite metrics and limits, including forward-looking metrics, quantitatively measure whether we are operating within our stated Risk Appetite. Our risk appetite metrics reflect material risks, align with our established Risk Appetite Framework, balance risk and reward, leverage analytics, and are adjusted to changes in the external and internal risk environments.

Strategic Planning: Our enterprise and line of business strategic plans outline major objectives, strategies and goals which are expected to be achieved over the next five years while seeking to ensure we remain compliant with all capital, risk appetite and liquidity targets and guidelines. Our chief executive officer and chief financial officer lead the development of the corporate strategic plan.

Capital Planning and Stress Testing: Capital planning helps to ensure we are maintaining safe and sound operations and viability. The capital planning process and the resulting capital plan evolve as our overall risks, activities and risk management practices change. Capital planning aligns with our strategic planning process. Stress testing is an essential element of the macroeconomic capital planning process. Effective stress testing enables us to consider the estimated effect on capital of various hypothetical macroeconomic scenarios.

Risk Governance and Oversight

We employ a comprehensive risk management governance framework to help ensure that risks are identified, balanced decisions are made that consider risk and return, and risks are adequately monitored and managed. Risk committees established within this risk governance and oversight framework provide oversight for risk management activities at the Board of Directors, executive, corporate

The PNC Financial Services Group, Inc. –2023 Form 10-K 55 and business levels. Committee composition is designed to provide effective oversight balanced across the three lines of defense in accordance with the OCC’s heightened standards and the Federal Reserve Board’s enhanced prudential standards. See the Supervision and Regulation section in Item 1 of this Report for more information.

To help ensure appropriate risks are being taken and effectively managed and controlled, risk is managed across three lines of defense. A summary of the Board of Directors’ and each line of defense’s responsibilities is provided below:

Board of Directors – The Board of Directors oversees our risk-taking activities, holds management accountable for adhering to the ERM Framework and is responsible for exercising sound, independent judgment when assessing risk.

First line of defense – The front line units are accountable for identifying, owning and managing risks to within acceptable levels while adhering to the ERM Framework. Our businesses strive to enhance risk management and internal control processes within their areas. Integrated and comprehensive processes are designed to adequately manage the business’ risk profile and risk appetite through identifying, assessing, monitoring and reporting risks that may significantly impact each business.

Second line of defense – The second line of defense is independent from the first line of defense and is responsible for establishing the risk governance framework and the standards within each independent risk area for identifying, measuring, monitoring, controlling and reporting aggregate risks. As the second line of defense, the independent risk areas monitor the risks generated by the first line of defense, review and challenge the implementation of effective risk management practices, perform independent assessment of risk, and report on issues or exceptions. The risk areas help to ensure processes and controls owned by the businesses are designed and operating as intended.

Third line of defense – As the third line of defense, Internal Audit is independent from the first and second lines of defense. Internal Audit provides the Board of Directors and executive management comprehensive assurance on the effectiveness of the ERM Framework and the risk management practices across the organization.

Within the three lines of defense, the independent risk organization has sufficient authority to influence material decisions. Our business oversight and decision-making is supported through a governance structure at the Board of Directors and management level. Specific responsibilities include:

Board of Directors – Our Board of Directors oversees our business and affairs as managed by our officers and employees. The Board of Directors may receive assistance in carrying out its duties and may delegate authority through standing or special committees. The following provides a summary of some of the key responsibilities of the Board’s standing committees:

•Audit Committee: monitors the integrity of our consolidated financial statements; monitors internal control over financial reporting; monitors compliance with our code of ethics; evaluates and monitors the qualifications and independence of our independent auditors; and evaluates and monitors the performance of our Internal Audit function and our independent auditors.

•Nominating and Governance Committee: oversees the implementation of sound corporate governance principles and practices while promoting our best interests and those of our shareholders.

•Human Resources Committee: oversees the compensation of our executive officers and other specified responsibilities related to talent and human capital matters affecting us. The committee is also responsible for evaluating the relationship between risk-taking activities and incentive compensation plans.

•Risk Committee: oversees our enterprise-wide risk structure and the processes established to identify, measure, monitor and manage the organization’s risks and evaluates and approves our risk governance framework. The Risk Committee has formed a Compliance Subcommittee to facilitate Board-level oversight of risk management in the compliance area.

•Corporate Responsibility Committee: oversees management’s corporate responsibility efforts, internally and externally, to the extent such corporate responsibility efforts are not specifically within the purview of another Board committee (e.g., climate-related risks overseen by the Risk Committee and climate-related financial disclosures overseen by the Audit Committee), and implementation of PNC's publicly-announced Community Benefits Plan to provide loans, investments and other financial support to bolster economic opportunity for low- and moderate-income individuals and communities and other underserved individuals and communities, and to help remove historic barriers in the banking system.

•Technology Committee: oversees technology strategy and significant technology initiatives and programs, including those that can position the use of technology to drive strategic advantages, and fulfills the oversight responsibilities delegated from the Risk Committee with respect to technology risk, technology risk management, data risk, cybersecurity, information security, business continuity and significant technology initiatives and programs.

Management Level Executive Committee– The Management Level Executive Committee is responsible for guiding the creation and execution of our business strategy across PNC. With this responsibility, the Management Level Executive Committee executes various strategic approval and review activities, with a focus on capital deployment, business performance and risk management. This Committee also helps ensure PNC is staffed with sufficient resources and talent to operate within its risk appetite.

56 The PNC Financial Services Group, Inc. –2023 Form 10-K

Corporate Committees – The Corporate Committees generally operate based on the delegated approval authority from a Board-level Committee, the Management Level Executive Committee or other Corporate Committees. These Committees operate at the senior management level and are designed to facilitate the review, evaluation, oversight and approval of key business and risk activities.

Working Committees – Working Committees generally operate on delegated approval authority from a Corporate Committee or other Working Committees. Working Committees are intended to provide oversight of regulatory/legal matters, assist in the implementation of key enterprise-level activities within a business or function and support the oversight of key risk activities.

Transactional Committees – Transactional Committees generally operate based on delegated approval authority from a Corporate or Working Committee to approve individual transactions, transactional related activities or movements on the organization’s balance sheet.

Policies and Procedures – We have established risk management Policies and Procedures to support our ERM Framework, articulate our risk culture, define the parameters and processes within which employees are to manage risk and conduct our business activities and to provide direction, guidance and clarity on roles and responsibilities to management and the Board of Directors. These Policies and Procedures are organized in a multi-tiered framework and require periodic review and approval by relevant Committees, including where appropriate Committees of the Board of Directors, or management.

Risk Identification

Risk identification takes place across a variety of risk types throughout the organization. These risk types include, but are not limited to, credit, liquidity and capital, market and operational (which includes, among other types of risk, compliance and information security). Risks are identified based on a balanced use of analytical tools and management judgment for both on- and off-balance sheet exposures. Our governance structure supports risk identification by facilitating assessment of key risk issues, emerging risks and idiosyncratic risks and implementation of mitigation strategies as appropriate. These risks are prioritized based on quantitative and qualitative analysis and assessed against our risk appetite. Multiple tools and approaches are used to help identify and prioritize risks, including Risk Appetite Metrics, Key Risk Indicators, Key Performance Indicators, Risk and Control Self-Assessments, scenario analysis, stress testing and special assessments.

Risks are aggregated and assessed within and across risk functions and businesses. The aggregated risk information is reviewed and reported at an enterprise level to the Board of Directors or appropriate committees. This enterprise aggregation and reporting approach promotes the identification and appropriate escalation of material risks across the organization and supports an understanding of the cumulative impact of risk in relation to our risk appetite.

Risk Assessment

Once risks are identified, they are evaluated based on quantitative and qualitative analysis to determine whether they are material. Risk assessments support the overall management of an effective ERM Framework and help us to control and monitor our actual risk level and risk management effectiveness. Comprehensive, accurate and timely assessments of risk are essential to an effective ERM Framework. Effective risk measurement practices are designed to uncover recurring risks that have been experienced in the past; facilitate the monitoring, understanding, analysis and reporting of known risks; and reveal unanticipated risks that may not be easy to understand or predict.

Risk Controls and Monitoring

Our ERM Framework consists of policies, procedures, processes, personnel and control systems. Risk controls and limits provide the linkage from our Risk Appetite Statement and associated guiding principles to the risk-taking activities of our businesses. In addition to risk appetite limits, a system of more detailed internal controls exists which oversees and monitors our various processes and functions. These control systems measure performance, help employees make correct decisions, help ensure information is accurate and reliable and facilitate compliance with laws and regulations.

We design our monitoring and evaluation of risks and controls to provide assurance that policies, procedures and controls are effective and also to result in the identification of control improvement recommendations. Risk monitoring is a daily, ongoing process used by both the first and second line of defense to help ensure compliance with our ERM Framework. Risk monitoring is accomplished in many ways, including performing risk assessments at the business and risk assessment unit level, monitoring an area’s key controls, the timely reporting of issues and establishing a quality control and/or quality assurance function, as applicable.

Risk Aggregation and Reporting

Risk reporting is a comprehensive way to: (i) communicate aggregate risks, including identified concentrations; (ii) escalate instances where we are outside of our risk appetite; (iii) monitor our risk profile in relation to our risk appetite; and (iv) communicate risks and views on the effectiveness of our risk management activities to the Board of Directors and executive management.

Risk reports are produced at the line of business, functional risk and enterprise levels. Each individual risk report includes an assessment of inherent risk, quality of risk management, residual risk, risk appetite and risk outlook. The enterprise level risk report

The PNC Financial Services Group, Inc. –2023 Form 10-K 57 aggregates material risks identified in the risk area reports and in the business reports to define the enterprise risk profile. The enterprise risk profile is a point-in-time assessment of enterprise risk and represents our overall risk position in relation to the desired enterprise risk appetite. The determination of the enterprise risk profile is based on analysis of quantitative reporting of risk limits and other measures along with qualitative assessments. Quarterly aggregation of risk reports from the risk areas and lines of business is designed to provide a clear view of our risk level relative to our risk appetite. The enterprise level report is provided through the governance structure to the Risk Committee of the Board of Directors.

Credit Risk Management

Credit risk represents the possibility that a customer, counterparty or issuer may not perform in accordance with the contractual terms of their loan, extension of credit or other financial obligation with PNC. Credit risk is inherent in the financial services business and results from extending credit to customers, purchasing securities and entering into financial derivative transactions and certain guarantee contracts. Credit risk is one of our most significant risks. Our processes for managing credit risk are designed to be embedded in our risk culture and in our decision-making processes using a systematic approach whereby credit risks and related exposures are identified and assessed, managed through specific policies and processes, measured and evaluated against our risk appetite and credit concentration limits, and reported, along with specific mitigation activities, to management and the Board of Directors through our governance structure. Our most significant concentration of credit risk is in our loan portfolio.

Credit Risk Management is working to understand and incorporate into our credit risk management framework the impacts to credit risk that may accelerate or be introduced as a result of climate change, including impacts from physical risk events and risks associated with the transition to a low-carbon economy. These risk events may impact a borrower’s income, cash flow or collateral due to the frequency or severity of weather events, changing market conditions, consumer preferences and demand for products, or changes to the legislative and regulatory landscape. As disruptive events occur, PNC follows a process to determine if enhanced portfolio monitoring, reporting and executive communication is warranted to ensure appropriate oversight and action.

To address issues that are important to the various stakeholders we serve, Corporate & Institutional Banking transactions may be subjected to an industry-agnostic Environmental and Social Risk Management assessment designed to help us better identify and mitigate environmental, human rights and other reputational risks early in the credit application process. Transactions identified as having a potential environmental, human rights or other reputational risk are evaluated to determine whether additional due diligence is warranted. Credit Risk Management employs a governance, policy and monitoring framework for environmental and social risk topics that may include updates to PNC’s Credit Portfolio Strategy Committee. Outcomes from those updates may be incorporated into credit policies and risk procedures that govern our risk appetite, credit decisioning, portfolio management and reserve processes. Additionally, PNC has procedures designed to ensure that flood insurance is present for properties as required by applicable regulations, while also monitoring other water-related risks (such as the increased shoreline and coastal erosion) and weather-related events (such as hurricanes and wildfires).