PNC FINANCIAL SERVICES GROUP INC

Previous wording

We are subject to a number of risks potentially impacting our business, financial condition, results of operations and cash flows. As a financial services company, certain elements of risk are inherent in what we do and the business decisions we make. Thus, we encounter risk as part of the normal course of our business, and we design risk management processes to help manage these risks. For more information about how we manage risks, see the Risk Management section of this Report.

Current wording

We are subject to a number of risks potentially impacting our business, financial condition, results of operations and cash flows. As a financial services company, certain elements of risk are inherent in what we do and the business decisions we make. Thus, we encounter risk as part of the normal course of our business, and we design risk management processes to help manage these risks. For more information about how we manage risks, see the Risk Management section in Item 7 of this Report.

Previous wording

Given the nature of our business, our business and overall financial performance are affected to a significant extent by economic conditions, primarily in the U.S. Declining or adverse economic conditions and adverse changes in investor, consumer and business sentiment generally result in reduced business activity, which may decrease the demand for our products and services or reduce the number of creditworthy borrowers. The ability of borrowers to repay loans is often weakened as a result of economic downturns, higher inflation and unemployment. This may be further exacerbated by a deterioration in households’ finances, particularly if consumers also continue to face high inflation. In addition, adverse economic conditions, including periods of inflation, may limit the availability of, or increase the costs of, capital and labor, erode consumer and customer purchasing power, confidence and spending and may also reduce our tolerance for extending credit. Increases in costs or expenses impacting our customers’ operations and financial performance, such as the interest rates payable on their debt obligations, could increase our credit risk or decrease the demand for our products and services.

Current wording

Our business and overall financial performance are affected to a significant extent by economic conditions, primarily in the U.S. Declining or adverse economic conditions and adverse changes in investor, consumer and business sentiment generally result in reduced business activity, which may decrease the demand for our products and services or reduce the number of creditworthy borrowers. The ability of borrowers to repay loans is often weakened as a result of economic downturns, higher inflation and unemployment. In addition, adverse economic conditions may limit the availability of, or increase the costs of, capital and labor, erode consumer and customer purchasing power, confidence and spending and may also reduce our tolerance for extending credit. Increases in costs or expenses impacting our customers’ operations and financial performance, such as the interest rates payable on their debt obligations, could increase our credit risk or decrease the demand for our products and services.

Previous wording

We operate in an uncertain economic environment due to structural and secular changes triggered by the pandemic for certain sectors of the economy combined with increased interest rates, inflation and geopolitical tensions. These conditions may not abate in the near term, and their continuation could materially adversely affect our operations and financial performance. Such economic conditions also have led and may continue to lead to turmoil and volatility in financial markets, often with at least some financial asset categories losing value. Any of these effects would likely have an adverse impact on our operations and financial performance, with the significance of the impact generally depending on the nature and severity of the adverse economic conditions.

Current wording

We operate in an uncertain economic environment due to sustained inflationary pressures, including higher prices and lower housing affordability, and structural and secular changes arising from the pandemic for certain sectors of the economy combined with geopolitical tensions. These conditions have led and may continue to lead to turmoil and volatility in financial markets, often with at least some financial asset categories losing value. Financial market volatility could also result from uncertainty about the timing and extent of rate cuts by the Federal Reserve. Any of these effects would likely have an adverse impact on our operations and financial performance, with the significance of the impact generally depending on the nature and severity of the adverse economic conditions. Even when economic conditions are relatively good or stable, specific economic factors can negatively affect our business and performance. This can be especially true when the factors relate to particular segments of the economy and impact our customers whose operations or financial conditions are directly or indirectly dependent on good or stable conditions in those segments. For example, given the fundamental change in office demand driven by the acceptance of remote work, commercial real estate space remains underutilized. This, combined with higher interest rates, likely decreases demand for financial services in that sector and may make it more difficult for borrowers to refinance maturing loans, contributes to decreased property values and harms the creditworthiness of some of our office commercial real estate customers, as well as businesses whose customers have historically been office workers.

Previous wording

Given the geographic scope of our business and operations, we are most exposed to issues within the U.S. economy and financial markets. Our foreign business activities continue to be a relatively small part of our overall business. As a result, the direct impact on our business and financial performance from economic conditions outside the U.S. is not likely to be significant, although the impact would increase if we expanded our foreign business more than nominally. We are, however, susceptible to the risk that foreign economic conditions and geopolitical tensions could negatively affect our business and financial performance. Primarily, this risk results from the possibility that poor economic conditions or financial market disruptions affecting other major economies would also affect the U.S.

Current wording

Our foreign business activities and operations continue to be a relatively small part of our overall business. As a result, the direct impact on our business and financial performance from economic conditions outside the U.S. is not likely to be significant, although the impact would increase if we expanded our foreign business and operations more than nominally. We are, however, susceptible to the risk that foreign economic conditions and geopolitical tensions could negatively affect our business and financial performance. Primarily, this risk results from the possibility that poor economic conditions or financial market disruptions affecting other major economies would also affect the U.S. Throughout the remainder of this Risk Factors section, we address specific ways in which economic issues could create risk for us and result in adverse impacts on our business and financial performance.

Previous wording

Changes in law or governmental policy affecting the economy, business activity, or personal spending, investing or saving activities may cause consumers and businesses to alter their behavior in ways that impact demand for our products and services. Such changes may also alter the profitability of the transactions in which we engage or result in increased regulatory burden and associated costs. PNC may alter the types or terms of the products and services we offer to reflect such changes. Uncertainty regarding future law or policy may have similar impacts. In addition, the application of some laws may be uncertain, require significant judgment and be

Current wording

Changes in law or governmental policy affecting the economy, business activity, or personal spending, investing or saving activities may cause consumers and businesses to alter their behavior in ways that impact demand for our products and services. Such changes may also alter the profitability of the transactions in which we engage or result in increased regulatory burden and associated costs. PNC may alter the types or terms of the products and services we offer to reflect such changes. Uncertainty regarding future law or policy may have similar impacts.

Previous wording

16 The PNC Financial Services Group, Inc. –2023 Form 10-K subject to differing interpretations. Congress and the agencies that regulate us have changed and may continue to change the laws and policies that are applicable to us, including their interpretations of rules and guidelines, which has subjected and may continue to subject financial institutions like us to heightened levels of regulation and supervision and more stringent enforcement and potentially severe penalties. For example, the increased time frames and difficulty in obtaining regulatory approvals for acquisitions and other activities could affect our ability to make acquisitions or introduce new products and services. As another example, tax laws and tax rates may be subject to significant change and an increase in our effective tax rates could adversely affect our business, results of operation and financial condition. In addition, these changes may adversely impact our operations or financial condition as discussed in more detail in the Risk Factor headed “As a regulated financial services firm, we are subject to numerous governmental regulations and comprehensive oversight by a variety of regulatory agencies and enforcement authorities. These regulations and their implementation can have a significant impact on our businesses and operations and our ability to grow and expand.”

Current wording

The impact that these changes may have on our operations or financial condition are discussed in more detail in the Risk Factor headed “As a regulated financial services firm, we are subject to numerous governmental regulations and comprehensive oversight by a variety of regulatory agencies and enforcement authorities. These regulations and their implementation can have a significant impact on our businesses and operations and our ability to grow and expand.”

Previous wording

Concern regarding the ability of Congress and the President collectively to reach agreement on federal budgetary matters (including the debt ceiling), or prolonged stalemates leading to total or partial governmental shutdowns, also can have adverse economic consequences and create the risk of economic instability or market volatility, with potential adverse consequences to our business and financial performance. Divided control of the U.S. government increases concern over the inability of Congress and the President to reach necessary agreements and make government shutdowns or defaults in government obligations more likely.

Current wording

Concern regarding high and rising federal debt levels and federal budgetary matters (including the debt ceiling) also can have adverse economic consequences and create the risk of economic instability or market volatility, with potential adverse consequences to our business and financial performance.

Previous wording

The monetary policies of the Federal Reserve, including changes in the federal funds rate, open market operations and balance sheet management, have a significant impact on interest rates, the value of financial instruments and other assets and liabilities, and overall financial market performance and volatility. These policies can thus affect the activities and results of operations of financial companies such as PNC. An important function of the Federal Reserve is to monitor the national supply of bank credit and set certain interest rates. The actions of the Federal Reserve influence the rates of interest that we charge on loans and that we pay on borrowings and interest-bearing deposits. Rates of interest can also affect the value of our on-balance sheet and off-balance sheet financial instruments. Since 2022, the Federal Reserve’s quantitative tightening and increases in benchmark rates to reduce high rates of inflation has and may continue to adversely affect the value of financial instruments and other assets and liabilities, including securities and interest-bearing deposits, impact borrowers, increase market volatility and result in a flattening or inversion of the yield curve. In addition, actions by governmental authorities in other countries, including with respect to monetary policy, could impact financial markets and global interest rates, which could affect rates in the U.S. as well as rates on instruments denominated in currencies other than the U.S. dollar, any of which could have potential effects on us as described above.

Current wording

An important function of the Federal Reserve is to monitor the national supply of bank credit and set certain interest rates. The actions of the Federal Reserve influence the rates of interest that we charge on loans and that we pay on borrowings and interest-bearing deposits. Rates of interest can also affect the value of our on-balance sheet and off-balance sheet financial instruments. Although we may not accurately predict the nature or timing of future changes in monetary policies or the precise effects that they may have on our activities and financial results, we anticipate that the FOMC will cut the federal funds rate 25 basis points twice in 2025, once in May and once in July. In addition, actions by governmental authorities in other countries, including with respect to monetary policy, could impact financial markets and global interest rates, which could affect rates in the U.S. as well as rates on instruments denominated in currencies other than the U.S. dollar, any of which could have potential effects on us as described above. Some of the potential impacts on our business and results of governmental monetary policy are described in Risk Factors under the heading “Risks Related to the Business of Banking.”

Previous wording

The PNC Financial Services Group, Inc. is a BHC and a financial holding company, with the Federal Reserve as its primary regulator. PNC Bank is a federally chartered bank, with the OCC as its primary regulator. In addition, our businesses are subject to regulation by multiple other banking, consumer protection, securities and derivatives regulatory bodies. We are also subject to the jurisdiction of criminal and civil enforcement authorities. As a result, we are subject to numerous laws and regulations, with multiple regulators or agencies having supervisory or enforcement oversight over aspects of our business activities. These laws, regulations and supervisory activities are intended to promote the safety and soundness of financial institutions, financial market stability, the transparency and liquidity of financial markets, consumer protection and to prevent money laundering and terrorist financing and are not primarily intended to protect PNC security holders. In addition to regulation in the U.S., we are also subject to foreign regulation to a limited extent as a result of our business activities outside the U.S.

Current wording

The PNC Financial Services Group, Inc. is a BHC and a financial holding company, with the Federal Reserve as its primary regulator. PNC Bank is a federally chartered bank, with the OCC as its primary regulator. In addition, our businesses are subject to regulation by multiple other banking, consumer protection, securities and derivatives regulatory bodies. We are also subject to the jurisdiction of criminal and civil enforcement authorities. As a result, we are subject to numerous laws and regulations, with multiple regulators or agencies having supervisory or enforcement oversight over aspects of our business activities. These laws, regulations and supervisory activities are intended to promote the safety and soundness of financial institutions, financial market stability, the transparency and liquidity of financial markets, consumer protection and to prevent money laundering and terrorist financing and are not primarily

Previous wording

Applicable laws and regulations restrict our permissible activities and investments and require compliance with provisions designed to protect loan, deposit, brokerage, fiduciary, and other customers, and for the protection of customer information, among other things. We also are subject to laws and regulations designed to combat money laundering, terrorist financing, and transactions with persons, companies or foreign governments designated by U.S. authorities. Over time, the scope of the laws and regulations affecting our businesses, as well as the number of requirements or limitations imposed by legislative or regulatory actions, has increased, and we expect to continue to face substantial regulatory oversight and new or revised regulatory requirements or initiatives. Legislative or regulatory actions have resulted and will likely continue to result in increased compliance costs, reduced business opportunities, or requirements and limitations on how we conduct our business. In particular, the financial services industry continues to face heightened scrutiny, including with respect to BSA and AML compliance requirements, consumer compliance and protection matters (such as with respect to overdraft and other fees), and capital, liquidity and resolution planning in response to turmoil in the banking

Current wording

Applicable laws and regulations restrict our permissible activities and require compliance with provisions designed to protect loan, deposit, brokerage, fiduciary, and other customers, and for the protection of customer information, among other things. We also are subject to laws and regulations designed to combat money laundering, terrorist financing, and transactions with persons, companies or foreign governments designated by U.S. authorities. Over time, the scope of the laws and regulations affecting our businesses, as well as the number of requirements or limitations imposed by legislative or regulatory actions, has increased, and we expect to continue to face substantial regulatory oversight and new or revised regulatory requirements or initiatives, including those related to requirements for the orderly resolution of financial institutions. As we expand our product and service offerings into additional markets, domestic or foreign, either through organic growth or acquisition, we have faced and will continue to face increases in state or foreign regulation affecting our operations. Different approaches to regulation by different jurisdictions, including potentially conflicting state-level regulation, could materially increase our compliance costs or risks of non-compliance. Legislative or regulatory actions can result in increased compliance costs, reduced business opportunities, or requirements and limitations on how we conduct our business. In particular, the financial services industry continues to face heightened scrutiny, including with respect to BSA/AML, know-your-customer and export and sanctions compliance requirements, consumer compliance and protection matters (such as with respect to overdraft and other fees), and capital, liquidity and resolution planning in response to systemic events in the banking industry. In addition, heightened standards under proposed and recently finalized rules, such as those implementing the Community Reinvestment Act, may result in increased obligations and compliance costs, and may factor into our ability to expand and engage in new actions. Although the new presidential administration has indicated an intent to pursue the regulation of the financial services industry differently than was the case under the previous administration, there is significant uncertainty regarding the direction this administration will take and its ability to implement its policies and objectives, as well as the ultimate impact on potential new regulatory initiatives and the enforcement of existing laws and regulations.

Previous wording

Federal law grants substantial supervisory and enforcement powers to federal banking regulators, and they have assumed an active oversight, examination and enforcement role across the financial services industry. The results of supervisory or examination activities by our regulators, including actual or perceived compliance failures, could result in limitations on our ability to enter into certain transactions, engage in new activities, expand geographically, make acquisitions or obtain necessary regulatory approvals in connection therewith, or otherwise require us to modify our businesses practices in a manner that materially impacts our financial condition or results of operations. These activities also could result in significant fines, penalties or required corrective actions, some of which could be expensive and difficult to implement. In addition, another financial institution’s violation of law or regulation may give rise to an investigation of the same or similar activities of PNC.

Current wording

Federal law grants substantial supervisory and enforcement powers to federal banking regulators, and they have assumed an active oversight, examination and enforcement role across the financial services industry. The results of supervisory or examination activities by our regulators, including actual or perceived compliance failures, could result in limitations on our ability to enter into certain transactions, engage in new activities, expand geographically, make acquisitions or obtain necessary regulatory approvals in connection therewith, or otherwise require us to modify our businesses practices in a manner that materially impacts our financial condition or results of operations. These activities also could result in significant fines, penalties or required corrective actions, some of which could be expensive, difficult to implement or materially impact our business or financial condition. In addition, another financial institution’s violation of law or regulation may give rise to an investigation of the same or similar activities of PNC. Further, the Federal Reserve requires a BHC to act as a source of financial and managerial strength for its subsidiary banks. The Federal Reserve could require PNC to commit resources to PNC Bank when doing so is not otherwise in the interests of PNC or its shareholders or creditors.

Previous wording

A failure to comply, or to have adequate policies and procedures designed to comply, with regulatory requirements and expectations exposes us to the risk of damages, fines and regulatory penalties and other regulatory or enforcement actions or consequences, such as limitations on activities otherwise permissible for us or additional requirements for engaging in new activities and could also injure our reputation with customers and others with whom we do business. We also rely on third parties who may expose us to compliance risk. A failure to comply with regulatory requirements or deficiencies in risk management practices could be incorporated in our confidential supervisory ratings, which could limit PNC’s ability to expand or require additional approvals before engaging in certain business activities.

Current wording

A failure to comply, or to have adequate policies and procedures designed to comply, with regulatory requirements and expectations exposes us to the risk of damages, fines and regulatory penalties and other regulatory or enforcement actions or consequences, such as limitations on activities otherwise permissible for us or additional requirements for engaging in new activities and could also injure our reputation with customers and others with whom we do business. We also rely on third parties who may expose us to compliance risk. A failure to comply with regulatory requirements or deficiencies in risk management practices could be incorporated in our confidential supervisory ratings, which could limit PNC’s ability to expand or require additional approvals before engaging in certain business activities. See the immediately following Risk Factor for a discussion of risks associated with capital and liquidity regulation. Also see the Supervision and Regulation section in Item 1 of this Report and Note 19 Regulatory Matters for more information concerning the regulation of PNC, including those areas that have been receiving a high level of regulatory focus.

Previous wording

Requirements to maintain specified levels of capital and liquidity, and regulatory expectations as to the quality of our capital and liquidity, impact our business activities and may prevent us from taking advantage of opportunities in the best interest of shareholders or force us to take actions contrary to their interests. For example, PNC’s ability to pay or increase dividends or otherwise return capital to shareholders is subject to PNC’s compliance with its SCB, which is determined at least annually through the Federal Reserve’s CCAR process. The Federal Reserve can also impose additional limitations on capital distributions, such as the limitations on distributions imposed in response to the COVID-19 pandemic and the 2007-2008 financial crisis. In addition, dividends from PNC Bank and, to a lesser extent, non-bank subsidiaries are PNC’s principal source of funds to, among other things, pay dividends on and make repurchases of its capital stock. Many of our subsidiaries are subject to laws that restrict dividend payments or authorize regulatory bodies to prohibit or limit dividends to PNC. Limitations on PNC’s ability to receive dividends from its subsidiaries, including PNC Bank, could have a material adverse effect on its liquidity and ability to pay dividends on and make repurchases of its capital stock, especially to the extent that PNC must first service any outstanding debt obligations.

Current wording

Requirements to maintain specified levels of capital and liquidity, and regulatory expectations as to the quality of our capital and liquidity, impact our business activities and may prevent us from taking advantage of opportunities in the best interest of shareholders or force us to take actions contrary to their interests. For example, PNC’s ability to pay or increase dividends or otherwise return capital to shareholders is subject to PNC’s compliance with its SCB, which is determined at least annually through the Federal Reserve’s CCAR process. The Federal Reserve can also impose additional limitations on capital distributions, such as limitations on distributions during times of economic stress. In addition, dividends or other capital distributions from PNC Bank and, to a lesser extent, non-bank subsidiaries are PNC’s principal source of funds to, among other things, pay dividends on and make repurchases of its capital stock. Many of our subsidiaries are subject to laws that restrict dividend payments or authorize regulatory bodies to prohibit

Previous wording

Capital and liquidity requirements may also impact the amount and type of loans we make. We may be constrained in our ability to expand, either organically or through acquisitions. We may be forced to sell or refrain from acquiring assets where the capital requirements appear inconsistent with the assets’ underlying risks. In addition, liquidity standards require us to maintain holdings of highly liquid short-term investments, thereby reducing our ability to invest in longer-term or less liquid assets, even if more desirable from an earnings, balance sheet or interest rate risk management perspective.

Current wording

The PNC Financial Services Group, Inc. –2024 Form 10-K 17 or limit dividends to PNC. Limitations on PNC’s ability to receive dividends from its subsidiaries, including PNC Bank, could have a material adverse effect on its liquidity and ability to pay dividends on and make repurchases of its capital stock, especially to the extent that PNC must first service any outstanding debt obligations. Capital and liquidity requirements may also impact the amount and type of loans we make. We may be constrained in our ability to expand, either organically or through acquisitions. We may be forced to sell or refrain from acquiring assets where the capital requirements appear inconsistent with the assets’ underlying risks. In addition, liquidity standards require us to maintain holdings of highly liquid short-term investments, thereby reducing our ability to invest in longer-term or less liquid assets, even if more desirable from an earnings, balance sheet or interest rate risk management perspective.

Previous wording

The regulatory capital and liquidity frameworks, as well as certain other prudential requirements and standards that are applicable to PNC, including related proposed rules, are discussed in the Supervision and Regulation section of this Report and the Liquidity and Capital Management portion of the Risk Management section of this Report.

Current wording

Regulatory capital and liquidity requirements are subject to regular review and revision by the Basel Committee and the U.S. banking agencies. Although the federal banking agencies issued a proposed rule in July 2023 to implement the final components of the Basel III framework, the status of this rule, and potential revisions to the rule, remain uncertain. The regulatory capital and liquidity frameworks, as well as certain other prudential requirements and standards that are applicable to PNC, including related proposed rules, are discussed in the Supervision and Regulation section in Item 1 of this Report and the Liquidity and Capital Management portion of the Risk Management section in Item 7 of this Report.

Previous wording

Our liquidity could be impaired as a result of unanticipated outflows of cash or collateral, unexpected loss of consumer deposits or higher than anticipated draws on lending-related commitments, an inability to sell assets (or to sell assets at favorable times or prices), a default by a counterparty or other market participant, our inability to access other sources of liquidity, including through the capital markets due to unforeseen market dislocations or interruptions, or a lack of market or customer confidence in PNC or financial institutions in general. Many of the above conditions and factors may be caused by events over which we have little or no control. The increased speed with which information is disseminated, through official or social media, could increase the speed or severity of liquidity pressures caused by, for example, negative news about PNC’s or other financial institutions’ financial prospects or safety and soundness. A negative impact on our liquidity would likely limit our ability to support our operations and fund outstanding liabilities as well as meet regulatory expectations, which would adversely affect our financial condition and results of operations. For information on our liquidity management, see the Liquidity and Capital Management portion of the Risk Management section of this Report.

Current wording

Our liquidity could be impaired as a result of unanticipated outflows of cash or collateral, unexpected loss of consumer deposits or higher than anticipated draws on lending-related commitments, an inability to sell assets (or to sell assets at favorable times or prices), a default by a counterparty or other market participant, our inability to access other sources of liquidity, including from sources that have historically been available or through the capital markets due to unforeseen market dislocations or interruptions, or a lack of market or customer confidence in PNC or financial institutions in general. Many of the above conditions and factors may be caused by events over which we have little or no control. In addition, if access to stable and lower-cost sources of funding is reduced, alternative sources of funding could be more expensive and limited in availability. The increased speed with which information is disseminated, through official or social media, could increase the speed or severity of liquidity pressures caused by, for example, negative news about PNC’s or other financial institutions’ financial prospects or safety and soundness. A negative impact on our liquidity would likely limit our ability to support our operations and fund outstanding liabilities as well as meet regulatory expectations, which would adversely affect our financial condition and results of operations. For information on our liquidity management, see the Liquidity and Capital Management portion of the Risk Management section in Item 7 of this Report.

Previous wording

Our credit ratings are based on a number of factors, including the financial strength of PNC and PNC Bank, and factors outside of our control, such as conditions affecting the financial services industry generally. Reductions in one or more of our credit ratings could adversely affect our ability to borrow funds and increase our cost of capital and limit the number of investors or counterparties willing to do business with or lend to us. For example, downgrades could negatively impact our right to continue to service mortgages and hold related escrows and reserves. Downgrades could also adversely affect our ability to attract or retain customers, including deposits. In addition, a downgrade in our credit ratings could trigger obligations to make cash or collateral payments under derivative contracts with certain counterparties. There can be no assurance that we will maintain our current ratings and outlooks. For information on our credit ratings, see the Liquidity and Capital Management portion of the Risk Management section of this Report.

Current wording

Our credit ratings are based on a number of factors, including the financial strength of PNC and PNC Bank, and factors outside of our control, such as conditions affecting the financial services industry generally. Reductions in one or more of our credit ratings could adversely affect our ability to borrow funds, increase our cost of capital and limit the number of investors or counterparties willing to do business with or lend to us. For example, downgrades could negatively impact our right to continue to service mortgages and hold related escrows and reserves. Downgrades could also adversely affect our ability to attract or retain customers, including deposits. In addition, a downgrade in our credit ratings could trigger obligations to make cash or collateral payments under derivative contracts with certain counterparties. There can be no assurance that we will maintain our current ratings and outlooks. For information on our credit ratings and outlooks, see the Liquidity and Capital Management portion of the Risk Management section in Item 7 of this Report.

Previous wording

Over time, there has been an increase in legislative and regulatory efforts to protect the privacy and enhance the portability of personal data, including enhanced data privacy laws regulating the use of health and biometric data. Individuals whose personal information may be protected by law may include our customers, prospective customers, job applicants, employees and third parties. These initiatives, among other things, limit how companies can use personal data and impose obligations on companies in their management of such data, including requiring companies like PNC to make available to consumers and authorized third parties certain data relating to transactions and accounts and establishing obligations for accessing such data. Financial services companies such as PNC necessarily gather, maintain and use a significant amount of personal data. These types of initiatives increase compliance complexity and related costs, may result in significant financial penalties for compliance failures, and may limit our ability to develop new products or respond to technological changes. This is particularly true as we continue to expand our business into new markets. We are, or may become, subject to regularly evolving and developing data privacy and data security laws and regulations in other jurisdictions, including certain foreign jurisdictions even where our presence in such jurisdictions is minimal. Such legal requirements also could heighten the reputational impact of perceived misuses of personal data by us, our vendors or others who gain unauthorized access to our personal data. Other jurisdictions may adopt similar requirements that impose different and potentially inconsistent compliance burdens. The impacts will be greater to the extent requirements vary across jurisdictions.

Current wording

Over time, there has been an increase in legislative and regulatory efforts to protect the privacy and enhance the portability of personal data. Individuals whose personal information may be protected by law may include our customers, prospective customers, job applicants, employees and third parties. These initiatives, among other things, limit how companies can use personal data and impose obligations on companies in their management of such data, including requiring companies like PNC to make available to consumers and authorized third parties certain data relating to transactions and accounts and establishing obligations for accessing such data. Financial services companies such as PNC necessarily gather, maintain and use a significant amount of personal data. These types of initiatives increase compliance complexity and related costs, may result in significant financial penalties for compliance failures, and may limit our ability to develop new products or respond to technological changes. This is particularly true as we expand our business and operations into new markets. We are, or may become, subject to regularly evolving and developing data privacy and security laws and regulations in other jurisdictions, including foreign jurisdictions even where our presence in such jurisdictions is minimal. Such legal requirements also could heighten the reputational impact of perceived misuses of personal data by us, our vendors or others who gain unauthorized access to our personal data. Other jurisdictions may adopt similar requirements that impose different and potentially inconsistent compliance burdens. The impacts will be greater to the extent requirements vary across jurisdictions.

Previous wording

The PNC Financial Services Group, Inc. –2023 Form 10-K 19 may face cost increases, asset value reductions, the reduced availability of insurance, operations disruptions and changes and the like because of climate change (including because of the increased frequency or severity of acute weather events and long-term shifts in the climate) and governmental actions or societal responses to climate change. The impact on our customers will likely vary depending on their specific attributes, including their reliance on or role in carbon intensive activities and their transition plans, as well as their exposure to the effects of climate change. Consumers and businesses are also changing their behaviors because of these concerns. Changed consumer and business behavior because of climate change concerns creates transition risk for PNC arising from the process of adjusting to these concerns. PNC and its customers will need to respond to new laws and regulations as well as consumer and business preferences as a result. Among the impacts to PNC could be a drop in demand for our products and services, particularly in certain sectors if our products or services do not support the environmental goals of our customers, or increased losses due to the impact of climate change on the collateral that secures customer borrowings. In addition, we could face reductions in creditworthiness on the part of some customers or in the value of assets securing loans.

Current wording

There continues to be concern, including on the part of certain regulators and in certain jurisdictions where we do business or have operations, regarding climate change and its impacts over the short-, medium- and long-term horizons. These concerns over the impacts of climate change (including physical risk and transition risk) have led and may continue to lead to efforts to mitigate those impacts. We and our customers may face cost increases, asset value reductions, the reduced availability of insurance or sufficient insurance to cover losses, operations disruptions and changes and other impacts because of climate change (including because of the increased frequency or severity of acute weather events and long-term shifts in the climate) and governmental actions or societal responses to climate change. The impact on our customers will likely vary depending on their specific attributes, including their reliance on or role in carbon intensive activities and their transition plans, as well as their exposure to the effects of climate change. Consumers and businesses may also change their behaviors because of these concerns. Changed consumer and business behavior because of climate change concerns creates transition risk for PNC arising from the process of adjusting to these concerns. PNC and its customers will need to respond to any new laws and regulations as well as any changes in consumer and business preferences related to climate change. Among the impacts to PNC could be a drop in demand for our products and services, particularly in certain sectors if our products or services do not support the environmental goals of our customers, or increased losses due to the impact of climate change on the collateral that secures customer borrowings. In addition, we could face reductions in creditworthiness on the part of some customers or in the value of assets securing loans.

Previous wording

We are currently subject to climate-related regulatory expectations and could be subject to additional regulatory restrictions or costs associated with providing products or services to certain companies or sectors. Environmental regulations or changes in the supply, demand or available sources of energy or other resources may affect the availability or cost of goods and services necessary to run our business. Our efforts to take these risks into account in making lending and other decisions may not be effective in protecting us from the negative impact of new laws and regulations or changes in consumer or business behavior, including those resulting from activist pressure. Our risk management needs to continue to evolve, or it may not be effective in identifying, measuring, monitoring and controlling climate risk exposure, particularly given that the timing, nature and severity of the impacts of climate change may not be predictable.

Current wording

We are currently subject to climate-related regulatory expectations and could be subject to additional regulatory restrictions or costs associated with providing products or services to certain companies or sectors. Additionally, the federal government may alter climate policies or requirements in a way that significantly conflicts with certain state-level policies or investor expectations. Such changes may present risk to PNC due to inconsistent expectations, requirements or costs. Environmental regulations or changes in the supply, demand or available sources of energy or other resources may affect the availability or cost of goods and services necessary to run our business. Our efforts to take these risks into account in making lending and other decisions may not be effective in protecting us from the negative impact of any new laws and regulations or any changes in consumer or business behavior, including those resulting from activist pressure. Our risk management needs to continue to evolve, or it may not be effective in identifying, measuring, monitoring and controlling climate risk exposure, particularly given that the timing, nature and severity of the impacts of climate change may not be predictable.

Previous wording

We also have been and may continue to be subject to conflicting pressure from individuals, groups and/or governmental entities to cease doing business, or to maintain business, with certain companies or sectors, in particular those involved with fossil fuels, because of concerns related to climate change. Further, there is increased scrutiny of climate change-related policies, goals and disclosures, which could result in litigation and regulatory investigations and actions. Our stakeholders may disagree with these policies and goals or, conversely, believe that these policies and goals are, and our related progress in accomplishing such goals and implementing such policies is, insufficient. This may lead to a decrease in demand for our products and services or damage to our reputation. We may also incur additional costs and require additional resources as we evolve our strategy, practices and related disclosures with respect to these matters. In addition, there are and will continue to be challenges related to capturing, verifying, analyzing and disclosing climate-related data that is subject to measurement uncertainties. The Risk Factor headed “We are at risk for an adverse impact on our business due to damage to our reputation” further discusses risks associated with our management of these matters, including related activist pressure.

Current wording

We have been and may continue to be subject to conflicting pressure from individuals, groups and governmental entities to cease doing business, or to maintain business, with certain companies or sectors, in particular those involved with fossil fuels, because of concerns related to climate change. Further, there is increased scrutiny of climate change-related policies, goals and disclosures, including with regard to inaccurate or misleading statements regarding these practices (often referred to as “greenwashing”), which could result in litigation and regulatory investigations and actions. Our stakeholders may disagree with these policies and goals or, conversely, believe that these policies and goals are, and our related progress in accomplishing such goals and implementing such policies is, insufficient. This may lead to a decrease in demand for our products and services or damage to our reputation. We may also incur additional costs and require additional resources as we evolve our strategy, practices and related disclosures with respect to these matters. In addition, there are and will continue to be challenges related to capturing, verifying, analyzing and disclosing climate-related data that is subject to measurement uncertainties. The Risk Factor headed “We are at risk for an adverse impact on our business due to damage to our reputation” further discusses risks associated with our management of these matters, including related activist pressure.

Previous wording

As a large financial services company, we handle a substantial volume of customer and other financial transactions. As a result, we rely heavily on information systems to conduct our business and to process, record, monitor and report on our transactions and those of our customers. Over time, we have seen more customer usage of technological solutions for financial needs as well as higher expectations of customers and regulators regarding effective and safe systems operation. In many cases, the effective use of technology increases efficiency and enables financial institutions to better serve customers. As a result of these factors, the financial services industry continues to undergo rapid technological change with frequent introductions of new technology-driven products and services. Examples include expanded use of cloud computing, artificial intelligence and machine learning, biometric authentication, voice and natural language, data protection enhancements and increased online and mobile device interaction with customers, including innovative ways that customers can view, access and aggregate financial data, make payments or manage their accounts.

Current wording

As a large financial services company, we handle a substantial volume of customer and other financial transactions. As a result, we rely heavily on information systems to conduct our business and to process, record, monitor and report on our transactions and those of our customers. Over time, we have seen more customer usage of technological solutions for financial needs as well as higher expectations of customers and requirements of regulators regarding effective and safe systems operation. In many cases, the effective use of technology increases efficiency and enables financial institutions to better serve customers. As a result of these factors, the financial services industry continues to undergo rapid technological change with frequent introductions of new technology-driven products and services. Examples include expanded use of cloud computing, artificial intelligence (AI) and machine learning, biometric authentication, voice and natural language, data protection enhancements and increased online and mobile device interaction with customers, including innovative ways that customers can manage their accounts.

Previous wording

In response to actual and anticipated customer behavior and expectations, as well as competitive pressures, we have been investing in technology and connectivity. We are seeking to automate functions previously performed manually, facilitate the ability of customers to engage in financial transactions and otherwise enhance the customer experience with respect to our products and services. This effort has involved and is likely to continue to involve the expenditure of considerable amounts of funds and other resources, which could be constrained to the extent that sustained adverse economic conditions and other factors described elsewhere in these Risk Factors negatively impact our business or financial performance. A failure to maintain or enhance our competitive position with respect to technology, whether because we fail to anticipate customer expectations, because our technological developments fail to perform as desired or are not rolled out in a timely manner, or because we fail to keep pace with our competitors, would likely cause us to lose market share or incur additional expense. Our ability to maintain or enhance our relative technological position is in part dependent on our ability to attract and retain talented employees in these fields, which, due to overall demand, is increasingly difficult.

Current wording

In response to actual and anticipated customer behavior and expectations, as well as competitive pressures, we continue to invest in technology and connectivity. We are seeking to automate functions previously performed manually, facilitate the ability of customers to engage in financial transactions and otherwise enhance the customer experience with respect to our products and services. This effort has involved and is likely to continue to involve the expenditure of considerable amounts of funds and other resources, which could be constrained to the extent that sustained adverse economic conditions and other factors described elsewhere in these Risk Factors negatively impact our business or financial performance. A failure to maintain or enhance our competitive position with

Previous wording

In some cases, we develop internally the intellectual property embedded in the technology we use. In others, we or our vendors license the use of intellectual property from others. Where we rely on access to third-party intellectual property, it may not be available to us on commercially reasonably terms or at all. Regardless of the source of the intellectual property, if another person or entity were deemed to own intellectual property rights infringed by our activities, we could be responsible for significant damages covering past activities and substantial fees to continue to engage in these types of activities. It also is possible that we could be prevented from using technology important to our business for at least some period of time. In such circumstances, there may be no alternative technology for us to use or an appropriate alternative technology might be expensive to obtain. Protections offered by those from whom we license technology against these risks may be inadequate to cover any losses in full. Over time, there have been and continue to be instances where technology used by PNC has been alleged to have infringed patents held by others, and, in some cases, we have suffered related losses.

Current wording

In some cases, we develop internally the intellectual property embedded in the technology we use. In others, we or our vendors license the use of intellectual property from others. Where we rely on access to third-party intellectual property, it may not be available to us on commercially reasonably terms or at all. Regardless of the source of the intellectual property, if another person or entity were deemed to own intellectual property rights infringed by our activities, we could be responsible for significant damages covering past activities and substantial fees to continue to engage in these types of activities. It also is possible that we could be prevented from using technology important to our business for at least some period of time. In such circumstances, there may be no alternative technology for us to use or an appropriate alternative technology might be expensive to obtain. We could also suffer significant reputational damage in these circumstances. Protections offered by those from whom we license technology against these risks may be inadequate to cover any losses in full. Over time, there have been and continue to be instances where technology used by PNC has been alleged to have infringed patents held by others, and, in some cases, we have suffered related losses.

Previous wording

The need to ensure proper functioning and resiliency of our information systems and other technology has become more important and more challenging, and the costs involved in that effort continue to be high. Our ability to create, obtain, maintain and report on information in an accurate, timely and secure manner is a foundational component of our business. Effective management of our expanded digital products and services, geographic footprint and continued remote work environment heightens our need for secure, reliable and adequate information systems and technology. The risks of operational failures in the use of these systems result from a variety of factors. We are vulnerable to the impact of failures of our systems to operate as needed or intended. Failures leading to materially adverse impacts could include those resulting from human error, unexpected transaction volumes, or overall security, design or performance issues. In addition, our ability to use our technology effectively could be impacted due to electrical or telecommunications outages, bad weather, disasters, bad actors, terrorism and the like. Such events could affect our systems directly or limit our ability to use our technology due to effects on key underlying infrastructure. Although we regularly update and replace systems that we depend on as our needs evolve and technology improves, we continue to utilize some older systems that may not be as reliable as newer ones. In addition, the implementation of and transition to new or updated systems creates risks related to associated timing and costs, disruptions in functionality for customers and longer-term failures to achieve desired improvements. In some cases, the risk results from the potential for bad acts on the part of others, discussed in more detail in the Risk Factor headed “We are vulnerable to the risk of breaches of data security affecting the functioning of systems or the confidentiality of information that could adversely affect our customers and our business.”

Current wording

The need to ensure proper functioning and resiliency of our information systems and other technology has become more important and challenging, and the costs involved in that effort continue to be high. Our ability to create, obtain, maintain and report on information in an accurate, timely and secure manner is a foundational component of our business. Effective management of our expanded digital products and services, geographic footprint and continued remote work environment heightens our need for secure, reliable and adequate information systems and technology. The risks of operational failures in the use of these systems result from a variety of factors. We are vulnerable to the impact of failures of our systems to operate as needed or intended. Failures leading to materially adverse impacts could include those resulting from human error, unexpected transaction volumes, or overall security, design or performance issues. In addition, our ability to use our technology effectively could be impacted due to outages, bad weather, disasters, bad actors, terrorism and the like. Such events could affect our systems directly or limit our ability to use our technology due to effects on key underlying infrastructure. Although we regularly update and replace systems that we depend on as our needs evolve and technology improves, we continue to utilize some older systems that may not be as reliable as newer ones. In addition, the implementation of and transition to new or updated systems creates risks related to associated timing and costs, disruptions in functionality for us or for customers, including the ability to perform functions critical to our business and operations, and longer-term failures to achieve desired improvements. Our ability to maintain, timely update and replace systems can become more challenging as the speed, frequency, volume, interconnectivity and complexity of information on these systems increases. In some cases, the risk results from the potential for bad acts on the part of others, discussed in more detail in the Risk Factor headed “We are vulnerable to the risk of breaches of data security affecting the functioning of systems or the confidentiality of information that could adversely affect our customers and our business.”

Previous wording

We also rely on information systems maintained by other companies. We use other companies both to provide products and services directly to us and to assist us in providing products and services to our customers. Others provide the infrastructure that supports, for example, communications, payment, clearing and settlement systems, or information processing and storage. These companies range from those providing highly sophisticated information processing to those that provide fundamental services, such as electric power and telecommunications. In some cases, these other companies themselves utilize third parties to support their delivery of products and services to us and our customers. Systems maintained by or for these other companies are generally subject to many of the same risks we face with respect to our systems and thus their issues could have a negative impact on PNC. We necessarily have less ability to provide oversight over other companies’ information systems.

Current wording

We rely on information systems maintained by other companies. We use other companies both to provide products and services directly to us and to assist us in providing products and services to our customers. Others provide the infrastructure that supports, for example, communications, payment, clearing and settlement systems, or information processing and storage. These companies range from those providing highly sophisticated information processing to those that provide fundamental services, such as electric power and telecommunications. In some cases, these other companies themselves utilize third parties to support their delivery of products and services to us and our customers. Systems maintained by or for these other companies are generally subject to many of the same risks we face with respect to our systems and thus their issues could have a negative impact on PNC. We necessarily have less ability to provide oversight over other companies’ information systems.

Previous wording

The occurrence of any failure, interruption or security breach of any of our information or communications systems, or the systems of other companies on which we rely, could result in a wide variety of adverse consequences to us. This risk is greater if the issue is widespread, extends for a significant period of time, or results in financial losses to our customers. The consequences of failures to operate systems properly can result in disruptions to our critical business operations, including our ability to use our accounting, deposit, loan, payment and other systems. Such events could also cause errors in transactions or impair system functionality with customers, vendors or other parties. Possible adverse consequences also include damage to our reputation or a loss of customer business, which could occur even if the negative impact on customers was de minimis. We also could face litigation or additional regulatory scrutiny. This in turn could lead to liability or other sanctions, including fines and penalties or reimbursement of adversely affected customers. Even if we do not suffer any material adverse consequences as a result of events affecting us directly, information systems issues at other financial institutions could lead to a general loss of customer confidence in financial institutions, including us. Also, system problems, including those resulting from third-party attacks, whether at PNC or at our competitors, may broadly increase legislative, regulatory and customer concerns regarding the functioning, safety and security of such systems. In that case, we would expect to incur even higher levels of costs with respect to prevention and mitigation of these risks.

Current wording

The occurrence of any failure, interruption or security breach of any of our information or communications systems, or the systems of other companies on which we rely, including those where there is not a reasonably available alternative, could result in a wide variety of adverse consequences to us. This risk is greater if the issue is widespread, extends for a significant period of time, or results in financial losses to our customers. The consequences of failures to operate systems properly can result in disruptions to our critical business operations, including our ability to use our accounting, deposit, loan, payment and other systems. Such events could also cause errors in transactions or impair system functionality with customers, vendors or other parties. Possible adverse consequences also include damage to our reputation or a loss of customer business, which could occur even if the negative impact on customers was de minimis. We also could face litigation or additional regulatory scrutiny relating to such events. This in turn could lead to liability or other sanctions, including fines and penalties or reimbursement of adversely affected customers. Even if we do not suffer any material adverse consequences as a result of events affecting us directly, information systems issues at other financial institutions could lead to a general loss of customer confidence in financial institutions, including us. Also, system problems, including those resulting from third-party attacks, whether at PNC or at our competitors, may broadly increase legislative, regulatory and customer concerns regarding the functioning, safety and security of such systems. In that case, we would expect to incur even higher levels of costs with respect to prevention and mitigation of these risks.

Previous wording

The same risks are presented by attacks potentially affecting information held by third parties on our behalf or accessed by third parties, including those offering financial applications, on behalf of our customers. These risks also arise to the extent that third parties with whom we do business, or their vendors or other entities with whom they do business, are themselves subject to breaches and attacks, which may impact our systems or operations. Our ability to protect confidential or proprietary information is even more limited with respect to information held by these parties. For example, we are likely to be limited in our ability to identify and quickly resolve breaches and attacks that may impact our business the further removed an entity is from our business, such as when a breach or attack occurs at vendors of our vendors. We may suffer reputational damage or legal liability for unauthorized access to customer information held by other parties, even if we were not responsible for preventing such access and had no reasonable way of preventing it.

Current wording

We are faced with ongoing, nearly continual, efforts by others to breach data security at financial institutions or with respect to financial transactions. The effectiveness of these efforts may be enhanced using AI. These efforts may be to obtain access to confidential or proprietary information, often with the intent of stealing from or defrauding us or our customers, or to disrupt our ability to conduct our business, including by destroying or impairing access to information maintained by us. Some of these involve efforts to enter our systems directly by going through or around our security protections. Others involve the use of social engineering schemes to gain access to confidential information from our employees, customers or vendors. Our risk and exposure to data security breaches is heightened because of our expanded digital products and services, geographic footprint and continued remote work environment, which results in more access points to our network. The same risks are presented by attacks potentially affecting information held by third parties on our behalf or accessed by third parties, including those offering financial applications, on behalf of our customers. These risks also arise when third parties with whom we do business, or their vendors or other entities with whom they do business, are themselves subject to breaches and attacks, which has impacted our business and may do so in the future. Our ability to protect confidential or proprietary information is even more limited with respect to information held by these parties. For example, we are likely to be limited in our ability to identify and quickly resolve breaches and attacks that may impact our business the further removed an entity is from our business, such as when a breach or attack occurs at vendors of our vendors. We may suffer reputational damage or legal liability for unauthorized access to customer information held by other parties, even if we were not responsible for preventing such access and had no reasonable way of preventing it.

Previous wording

Our customers often use their own devices, such as computers, smartphones and tablets, to do business with us and may provide their PNC customer information (including passwords) to a third party in connection with obtaining services from that third party, including those offering financial applications. Although we take steps to provide safety and security for our customers’ transactions with us and their customer information, to the extent they utilize their own devices or provide third parties access to their accounts, our ability to assure such safety and security is necessarily limited. These risks are heightened as we and others continue to expand mobile applications, cloud solutions, and other internet-based financial product offerings. For example, a number of our customers choose to use financial applications that allow them to view, access and aggregate banking and other financial account information, often held at different financial institutions, on a single platform, to monitor the performance of their investments, to compare financial and investment products, to make payments or transfer funds, and otherwise to help manage their finances and investments. Financial applications often ask users to provide their secure banking log-in information and credentials so the applications can link to users’ accounts at financial institutions. Companies offering these applications frequently use third-party data aggregators, which are behind-the-scenes technology companies that serve as data-gathering service providers, to deliver customer financial data that is then used by the financial applications. To do this, data aggregators frequently are provided with customers’ log-in information and credentials, which allow the aggregators to access the customers’ online accounts and “scrape” the customers’ data, often on a daily or even more frequent basis. That same information has the potential to facilitate fraud if it is not properly protected. This has resulted in incidences of fraud, including automated clearing house fraud, credit card fraud, and wire fraud, enabled through the use of synthetic identities and through account takeovers via these platforms. In addition, transactions by customers on financial applications that facilitate payments and fund transfers have also been fraudulently induced. These transactions occur when a customer authorizes payment to a recipient that fraudulently induced the customer into transferring a payment to such recipient. PNC has and may continue to face increased financial exposure due to activity associated with the increased use of these applications and data aggregators. Even where PNC does not have financial exposure for losses, PNC could suffer increased reputational harm when such losses occur.

Current wording

Our customers often use their own devices, such as computers, smartphones and tablets, to do business with us and may provide their PNC customer information (including passwords) to a third party in connection with obtaining services from that third party, including those offering financial applications. Although we take steps to provide safety and security for our customers’ transactions with us and their customer information, to the extent they utilize their own devices or provide third parties access to their accounts, our ability to assure such safety and security is necessarily limited. These risks are heightened as we and others continue to expand mobile applications, cloud solutions, and other internet-based financial product offerings. For example, a number of our customers choose to use financial applications that allow them to view, access and aggregate banking and other financial account information on a single platform, to monitor the performance of their investments, to compare financial and investment products, to make payments or transfer funds, and otherwise to help manage their finances and investments. Some financial applications ask users to provide their secure banking log-in information, credentials or other account-identifying information so the applications can link to users’ accounts at financial institutions. Companies offering these applications frequently use third-party data aggregators, which are behind-the-scenes technology companies that serve as data-gathering service providers, to deliver customer financial data that is then used by the financial applications. To do this, data aggregators may be obtaining customers’ log-in information, credentials or other account-identifying information, which allow the aggregators to access the customers’ account information and “scrape” or obtain the customers’ data, often on a daily or even more frequent basis. That same information has the potential to facilitate fraud if it is not properly protected. This has resulted in incidences of fraud, including automated clearing house fraud, credit card fraud, and wire fraud, enabled through the use of synthetic identities and through account takeovers via these platforms. In addition, transactions by customers on financial applications that facilitate payments and fund transfers have also been fraudulently induced. These transactions occur when a customer authorizes payment to a recipient that fraudulently induced the customer into transferring a payment to such recipient. PNC has and may continue to face increased financial exposure due to activity associated with the increased use of these applications and data aggregators. Even where PNC does not have financial exposure for losses, PNC and the third parties with whom we do business could suffer increased reputational harm or regulatory scrutiny when such losses occur.

Previous wording

As our customers regularly use PNC-issued credit and debit cards to pay for transactions with retailers and other businesses, there is also the risk of data security breaches at those other businesses covering PNC account information. When our customers use PNC-issued cards to make purchases from those businesses, card account information often is provided to such businesses. If a business’s systems that process or store card account information are subject to a data security breach, holders of our cards who have made purchases from that business may experience fraud on their card accounts. We can be responsible for reimbursing our customers for such fraudulent transactions on customers’ card accounts, as well as for other costs related to data security compromise events, such as replacing cards associated with compromised card accounts. In addition, we provide card transaction processing services to some merchant customers under agreements we have with payment networks such as Visa and Mastercard. Under these agreements, we may

Current wording

As our customers regularly use PNC-issued credit and debit cards to pay for transactions with retailers and other businesses, there is also the risk of data security breaches at those other businesses covering PNC account information. When our customers use PNC-issued cards to make purchases from those businesses, card account information often is provided to such businesses. If a business’s systems that process or store card account information are subject to a data security breach, holders of our cards who have made purchases from that business may experience fraud on their card accounts. We can be responsible for reimbursing our customers for such fraudulent transactions on customers’ card accounts, as well as for other costs related to data security compromise events, such as replacing cards associated with compromised card accounts. In addition, we provide card transaction processing services to some merchant customers under agreements we have with payment networks such as Visa and Mastercard. Under these agreements, we may be responsible for certain losses and penalties if one of our merchant customers suffers a data security breach. Moreover, to the extent

Previous wording

22 The PNC Financial Services Group, Inc. –2023 Form 10-K be responsible for certain losses and penalties if one of our merchant customers suffers a data security breach. Moreover, to the extent more consumer confidential information becomes available to bad actors through the cumulative effect of data breaches at companies generally, bad actors may find it easier to use such information to gain access to our customer accounts.

Current wording

The PNC Financial Services Group, Inc. –2024 Form 10-K 21 more consumer confidential information becomes available to bad actors through the cumulative effect of data breaches at companies generally, bad actors may find it easier to use such information to gain access to our customer accounts.

Previous wording

Other cyber attacks are not focused on gaining access to credit card or user credential information, but instead seek access to a range of other types of confidential information, such as internal emails and other forms of customer financial information, and this information may be used to support a ransomware attack. Ransomware attacks have sought to deny access to data and possibly shut down systems and devices maintained by target companies. In a ransomware attack, system data is encrypted, stolen or extorted, or access is otherwise denied, accompanied by a demand for ransom to restore access to the data or to prevent public disclosure of confidential information. Attacks have also been conducted through business email compromise scams that involve using social engineering to cause employees to wire funds to the perpetrators in the mistaken belief that the requests were made by a company executive or established vendor. These types of phishing attacks have increased over time, and they have evolved to include other types of attacks like vishing (through voice messages) and smishing (through SMS text). Other attacks have included distributed denial of service cyber attacks, in which individuals or organizations flood commercial websites with extraordinarily high volumes of traffic with the goal of disrupting the ability of commercial enterprises to process transactions and possibly making their websites unavailable to customers for extended periods of time. Similarly, attacks have been conducted through application program interfaces where cyber attackers seek to exploit the interfaces between mobile or web applications. We (as well as other financial services companies) have been subject to such attacks. Recent cyber attacks have also included the insertion of malware into software updates and the infection of software while it is under assembly, known as a “supply chain attack.” Attacks on our customers may put these relationships at risk, particularly if customers’ ability to continue operations is impaired due to the losses suffered.

Current wording

Other cyber attacks are not focused on gaining access to credit card or user credential information, but instead seek access to a range of other types of confidential information, such as internal emails and other forms of customer financial information, and this information may be used to support a ransomware attack. Ransomware attacks have sought to deny access to data and possibly shut down systems and devices maintained by target companies. In a ransomware attack, system data is encrypted, stolen or extorted, or access is otherwise denied, accompanied by a demand for ransom to restore access to the data or to prevent public disclosure of confidential information. Attacks have also been conducted through business email compromise scams that involve using social engineering to cause employees to wire funds to the perpetrators in the mistaken belief that the requests were made by a company executive or established vendor. These types of phishing attacks have increased over time, and they have evolved to include other types of attacks like vishing (through voice messages) and smishing (through SMS text). Other attacks have included distributed denial of service cyber attacks, in which individuals or organizations flood commercial websites with extraordinarily high volumes of traffic with the goal of disrupting the ability of commercial enterprises to process transactions and possibly making their websites unavailable to customers for extended periods of time. Similarly, attacks have been conducted through application program interfaces where cyber attackers seek to exploit the interfaces between mobile or web applications. We (as well as other financial services companies) have been subject to such attacks. Recent cyber attacks have also included the insertion of malware into software updates and the infection of software while it is under assembly, known as a “supply chain attack.” Attacks on our customers may put these relationships at risk, particularly if customers’ ability to continue operations is impaired due to the losses suffered. The techniques used in cyber attacks change rapidly and are increasingly sophisticated, including through the use of generative AI and deepfakes, and we expect in the future through the use of quantum computing, and we may not be able to anticipate cyber attacks or data security breaches.

Previous wording

In addition to threats from external sources, insider threats represent a significant risk to us. Insiders, including those having legitimate access to our systems and the information contained in them, have the easiest opportunity to make inappropriate use of the systems and information. Addressing that risk requires understanding not only how to protect us from unauthorized use and disclosure of data, but also how to engage behavioral analytics and other tools to identify potential internal threats before any damage is done. In addition, due to the increase in the number of employees who work remotely, the opportunity for insiders to grant access to third parties or to disclose confidential information of PNC or its customers has increased. As more work is conducted outside of PNC’s facilities, the risk of improper access to PNC’s network or confidential information has increased, including for reasons such as a failure by an employee or contractor to secure a device with PNC access.

Current wording

In addition to threats from external sources, insider threats represent a significant risk to us. Insiders, including those having legitimate access to our systems and the information contained in them, have the easiest opportunity to make inappropriate use of the systems and information. Addressing that risk requires understanding not only how to protect us from unauthorized use and disclosure of data, but also how to engage behavioral analytics and other tools to identify potential internal threats before any damage is done. In addition, due to the number of employees who work remotely, the opportunity for insiders to grant access to third parties or to disclose confidential information of PNC or its customers has increased. As more work is conducted outside of PNC’s facilities, the risk of improper access to PNC’s network or confidential information has increased, including for reasons such as a failure by an employee or contractor to secure a device with PNC access.

Previous wording

Methods used by others to attack information systems change frequently (with generally increasing sophistication). A new method of attack often is not recognized until launched against a target. Attacks in some cases appear to be supported by foreign governments or other well-financed entities and often originate from less regulated and remote areas around the world. We have seen a higher volume

Current wording

Methods used by others to attack information systems change frequently (with generally increasing sophistication). A new method of attack often is not recognized until launched against a target. Attacks in some cases appear to be supported by foreign governments or other well-financed entities and often originate from less regulated and remote areas around the world. We have seen a higher volume and complexity of attacks during times of increased geopolitical tensions. As a result, we may be unable to implement adequate preventive measures to address these methods in advance of attacks. Even with our proactive and defensive measures in place, adverse events are likely to occur, and there remains the risk that one or more such events would be material to PNC. Our ability to mitigate the adverse consequences of such occurrences is in part dependent on the quality of our business continuity planning, our ability to identify and understand threats to us from a holistic perspective, our ability to anticipate the timing and nature of any such event that

Previous wording

Even with our proactive and defensive measures in place, adverse events are likely to occur, and there remains the risk that one or more such events would be material to PNC. Our ability to mitigate the adverse consequences of such occurrences is in part dependent on the quality of our business continuity planning, our ability to identify and understand threats to us from a holistic perspective, our ability to anticipate the timing and nature of any such event that occurs, with novel or unusual events posing a greater risk, and our ability to identify and quickly resolve vulnerabilities in our information systems and those of third parties upon which we rely. It is also the case that a vulnerability or an adverse event may go undetected for a period of time, with the adverse consequences likely greater the longer it takes to discover the problem. In many cases, it also depends on the preparedness and responses of national or regional governments, including emergency responders, or on the part of other organizations and businesses with which we deal. Additionally, our failure to communicate cyber incidents appropriately to relevant parties could result in regulatory, legal, operational and reputational risk.

Current wording

22 The PNC Financial Services Group, Inc. –2024 Form 10-K occurs, with novel or unusual events posing a greater risk, and our ability to identify and quickly resolve vulnerabilities in our information systems and those of third parties upon which we rely. It is also the case that a vulnerability or an adverse event may go undetected for a period of time, with the adverse consequences likely greater the longer it takes to discover the problem. In many cases, it also depends on the preparedness and responses of national or regional governments, including emergency responders, or on the part of other organizations and businesses with which we deal. Additionally, our failure to communicate cyber incidents appropriately to relevant parties could result in regulatory, legal, operational and reputational risk.

Previous wording

A borrower’s ability to repay a loan can be adversely affected by many factors. Individual borrowers can be affected, for example, by declines in income, job losses, health issues or family issues. For example, the recent resumption in federal student loan payments could impact a borrower’s ability to repay a loan, such as a mortgage, because of the financial pressure from student loan payments. Commercial borrowers can be affected, for example, by poor business performance, changes in customer behavior or catastrophic losses. Weakness in the economy or in financial markets typically adversely impact the ability of our borrowers to repay outstanding loans. We are exposed to increased credit risk if we fail to evaluate properly at origination the likely ability of a borrower to repay a loan. Properly estimating the current and potential value of any collateral pledged to support the loan also is critical to effectively managing credit risk. A failure to identify declining creditworthiness of a borrower or declining collateral value at a time when remedial actions could reduce our exposure also increases credit risk. Any decrease in our borrowers’ ability to repay loans likely would result in higher levels of nonperforming loans, net charge-offs, provision for credit losses and valuation adjustments on loans held for sale. Managing credit risk effectively also relies on forecasts of future overall economic conditions, which are inherently imperfect.

Current wording

A borrower’s ability to repay a loan can be adversely affected by many factors. Individual borrowers can be affected, for example, by declines in income, job losses, health issues or family issues. Commercial borrowers can be affected, for example, by poor business performance, changes in customer behavior or catastrophic losses. Weakness in the economy or in financial markets typically adversely impacts the ability of our borrowers to repay outstanding loans. We are exposed to increased credit risk if we fail to evaluate properly at origination the likely ability of a borrower to repay a loan. Properly estimating the current and potential value of any collateral pledged to support the loan also is critical to effectively managing credit risk. A failure to identify declining creditworthiness of a borrower or declining collateral value at a time when remedial actions could reduce our exposure increases credit risk. Any decrease in our borrowers’ ability to repay loans likely would result in higher levels of nonperforming loans, net charge-offs, provision for credit losses and valuation adjustments on loans held for sale. Managing credit risk effectively also relies on forecasts of future overall economic conditions, which are inherently imperfect. We also have credit risk arising from many other types of business relationships. Routine transactions give us credit exposure to brokers and dealers, commercial banks, investment banks, mutual and hedge funds, other institutional clients, as well as vendors and other non-financial entities.

Previous wording

We reserve for credit losses on our loan and lease portfolio through our ACL estimated under CECL. Under CECL, the ACL reflects expected lifetime losses, which has led and could continue to lead to volatility in the allowance and the provision for credit losses as economic forecasts, actual credit performance and other factors used in the loss estimating process change. We also have reserves for unfunded loan commitments and letters of credit. Changes to expected losses are reflected in net income through provision for credit losses. A worsening of economic conditions or our economic outlook or an increase in credit risk, particularly following a period of good economic conditions, would likely lead to an increase in provision for credit losses with a resulting reduction in our net income and an increase to our allowance. Conversely, an improvement of economic conditions or our economic outlook, particularly following a period of poor economic conditions, could result in a recapture of provision for credit losses for a period of time with a resulting increase in our net income and decrease in our allowance. Either set of conditions is not likely to be sustained and may obscure actual current operations and financial performance. The Risk Factor headed “There are risks resulting from the extensive use of models, some of which use artificial intelligence (AI), in our business” further discusses risks associated with estimating expected losses under CECL.

Current wording

We reserve for credit losses on our loan and lease portfolio through our ACL estimated under CECL. Under CECL, the ACL reflects expected lifetime losses, which has led and could continue to lead to volatility in the allowance and the provision for credit losses as economic forecasts, actual credit performance and other factors used in the loss estimating process change. We also have reserves for unfunded loan commitments and letters of credit. Changes to expected losses are reflected in net income through provision for credit losses. A worsening of economic conditions or our economic outlook or an increase in credit risk, particularly following a period of good economic conditions, would likely lead to an increase in provision for credit losses with a resulting reduction in our net income and an increase to our allowance. Conversely, an improvement of economic conditions or our economic outlook, particularly following a period of poor economic conditions, could result in a recapture of provision for credit losses for a period of time with a resulting increase in our net income and decrease in our allowance. Either set of conditions is not likely to be sustained and may obscure actual current operations and financial performance. The section headed “Risks Related to Estimates and Assumptions” further discusses risks associated with estimating expected losses under CECL.

Previous wording

In the ordinary course of business, we often have heightened credit exposure to a particular industry, geography, asset class or financial market. As an example, loans secured by commercial and residential real estate typically represent a significant percentage of our overall credit portfolio. They also represent a portion of the assets underlying our investment securities. While there are limitations on the extent of total exposure to an individual consumer or business borrower, events adversely affecting some of our clients or counterparties, based on individual factors or the nature or location of their business, or asset classes or financial markets in which we are involved, could materially and adversely affect us. For example, any downturn in the condition of the U.S. housing market could result in significant write-downs of asset values tied to residential real estate. Declining economic conditions also may impact commercial borrowers more than consumer borrowers, or vice versa. In addition, we execute transactions with counterparties in the financial services industries. Financial services institutions are interrelated because of trading, funding, clearing or other relationships. As a result, uncertainty about the stability of other financial services institutions could lead to market-wide losses and defaults. Thus, the concentration and mix of our assets may affect the severity of the impact of recessions or other economic downturns on us.

Current wording

In the ordinary course of business, we often have heightened credit exposure to a particular industry, geography, asset class or financial market. As an example, loans secured by real estate typically represent a significant percentage of our overall credit portfolio. It also represents a portion of the assets underlying our investment securities. While there are limitations on the extent of total exposure to an individual consumer or business borrower, events adversely affecting some of our clients or counterparties, based on individual factors or the nature or location of their business, or asset classes or financial markets in which we are involved, could materially and adversely affect us. As described elsewhere in these Risk Factors, the fundamental shift in office demand combined with higher interest rates contributes to decreased property values and harms the creditworthiness of some of our office commercial real estate customers. Declining economic conditions also may impact commercial borrowers more than consumer borrowers, or vice versa. In addition, we execute transactions with counterparties in the financial services industries. Financial services institutions are interrelated because of trading, funding, clearing or other relationships. As a result, uncertainty about the stability of other financial services institutions could lead to market-wide losses and defaults. Thus, the concentration and mix of our assets may affect the severity of the impact of recessions or other economic downturns on us.

Previous wording

The PNC Financial Services Group, Inc. –2023 Form 10-K 23 and complexity of attacks during times of increased geopolitical tensions. As a result, we may be unable to implement adequate preventive measures to address these methods in advance of attacks.

Current wording

The PNC Financial Services Group, Inc. –2024 Form 10-K 23

Previous wording

The rates on some interest-bearing instruments adjust promptly in accordance with changes in market rates, while others adjust only periodically or are fixed throughout a defined term. As a result, the impact of changes in interest rates can be either increased or diluted due to differences in the relative variability of the rates paid on our liabilities in relation to the rates received on our assets. The extent to which we have elected to hedge interest rate risk through interest rate swaps also affects the impact of rate changes. We attempt to manage the balance sheet to increase our benefit or reduce negative impacts from future movements in interest rates, but failures to anticipate actual movements may have the opposite result. In addition, we do not generally hedge all of our risk and the fact that we attempt to hedge any risk does not mean we will be successful.

Current wording

The rates on some interest-bearing instruments adjust promptly in accordance with changes in market rates, while others adjust only periodically or are fixed throughout a defined term. As a result, the impact of changes in interest rates can be either increased or diluted due to differences in the relative variability of the rates paid on our liabilities in relation to the rates received on our assets. The extent to which we have elected to hedge interest rate risk through interest rate swaps also affects the impact of rate changes. We attempt to manage the balance sheet to increase our benefit or reduce negative impacts from future movements in interest rates, but failures to anticipate actual movements may have the opposite result. In addition, we do not generally hedge all of our risk and our attempt to hedge any risk does not mean we will be successful.