PNC FINANCIAL SERVICES GROUP INC

A summary of our equity investments follows:

Table 37: Equity Investments Summary

Tax Credit Investments

Included in our equity investments are direct tax credit investments and equity investments held by consolidated entities. These tax credit investment balances included unfunded commitments totaling $2.9 billion and $2.5 billion at December 31, 2024 and 2023, respectively. These unfunded commitments are included in Other liabilities on our Consolidated Balance Sheet.

Note 4 Loan Sale and Servicing Activities and Variable Interest Entities has further information on tax credit investments.

Private Equity and Other

The largest component of our other equity investments is our private equity portfolio. The private equity portfolio is an illiquid portfolio consisting of mezzanine and equity investments that vary by industry, stage and type of investment. Private equity investments carried at estimated fair value totaled $2.3 billion at December 31, 2024 and $2.2 billion at December 31, 2023, respectively. As of December 31, 2024, $2.1 billion was invested directly in a variety of companies, and $0.2 billion was invested indirectly through various private equity funds. See the Supervision and Regulation section in Item 1 of this Report for discussion of the Volcker Rule limitations on our interests in and relationships with private funds.

During the second quarter of 2024, PNC participated in the Visa exchange program, allowing PNC to convert its Visa Class B-1

common shares into approximately equal amounts of Visa Class B-2 common shares and Visa Class C common shares. This

conversion event resulted in a gain of $754 million related to the Visa Class C common shares received. PNC retained the Visa Class

B-2 common shares. The Visa Class B-2 common shares, which are included in our other equity investments at cost, remain subject to

the same restrictions that were imposed on the Visa Class B-1 common shares. Participation in the exchange required PNC to agree to

a make-whole agreement that subjects PNC to the same indemnity obligations to Visa as prior to participation in the exchange

program.

The Visa Class B-2 common shares that we own are transferable only under limited circumstances until either the resolution of the pending interchange litigation or Visa launches another exchange program allowing PNC to convert a portion of its Visa Class B-2 common shares into freely transferable Visa Class C common shares. At December 31, 2024, the estimated value of our total investment in the Visa Class B-2 common shares was approximately $0.9 billion while our cost basis was insignificant. The estimated value does not represent fair value of the Visa Class B-2 common shares given the shares’ limited transferability and the lack of observable transactions in the marketplace. See Note 14 Fair Value and Note 20 Legal Proceedings for additional information regarding our Visa agreements.

We also have certain other equity investments, the majority of which represent investments in affiliated and non-affiliated funds with both traditional and alternative investment strategies. Net gains related to these investments were $33 million in 2024 and $18 million in 2023.

78 The PNC Financial Services Group, Inc. –2024 Form 10-K

Impact of Inflation

Our assets and liabilities are primarily financial in nature and typically have varying maturity dates. Accordingly, future changes in

prices do not affect the obligations to pay or receive fixed and determinable amounts of money. However, during periods of inflation,

there may be a subsequent impact affecting certain fixed costs or expenses, an erosion of consumer and customer purchasing power,

and fluctuations in the need or demand for our products and services. When significant levels of inflation occur, our business could

potentially be impacted by, among other things, reducing our tolerance for extending credit or causing us to incur additional credit

losses resulting from possible increased default rates. While interest rates remained high in 2024, inflation has started to slow, leading to an easing of the Federal Reserve’s monetary policy. See Item 1A Risk Factors, our Executive Summary and Cautionary Statement Regarding Forward-Looking Information in this Item 7 for further discussion of inflation and its overall impact to the economy, our borrowers’ ability to repay their obligations and certain costs and expenses to PNC.

Financial Derivatives

Financial derivatives involve, to varying degrees, market and credit risk. Derivatives represent contracts between parties that usually require little or no initial net investment and result in one party delivering cash or another type of asset to the other party based on a notional and an underlying as specified in the contract. Therefore, cash requirements and exposure to credit risk are significantly less than the notional amount on these instruments.

We use a variety of financial derivatives as part of the overall asset and liability risk management process to help manage exposure to market (primarily interest rate) and credit risk inherent in our business activities. We also enter into derivatives with customers to facilitate their risk management activities.

Further information on our financial derivatives is presented in Note 1 Accounting Policies, Note 14 Fair Value and Note 15 Financial Derivatives.

Not all elements of market and credit risk are addressed through the use of financial derivatives, and such instruments may be ineffective for their intended purposes due to unanticipated market changes, among other reasons.

Operational Risk Management

Operational risk is the risk to PNC’s current or projected financial condition and resilience arising from inadequate or failed internal processes or systems, human errors or misconduct or adverse external events. Operational risk is inherent to the entire organization.

Operational risk management is embedded in our culture and decision-making processes through a systematic approach whereby operational risks and exposures are: (i) identified and assessed; (ii) managed through the design and implementation of controls; (iii) measured and evaluated against our risk tolerance limits; and (iv) reported to management and the Risk Committee of the Board of Directors. Strong operational risk management and well-informed risk-based decisions benefit us by improving the customer experience, enhancing compliance, reducing reputational risk, minimizing losses, and supporting robust stress testing and capital planning.

The Operational Risk Management Framework is designed to provide effective and consistent management of operational risk. The primary purpose of the framework is to enable us to understand our operational risks and manage them to the desired risk profile, in line with our Risk Appetite. Additionally, the guidance established within the framework assists management in making well-informed risk-based business decisions.

The framework provides a disciplined and structured process for us to manage operational risk across eight operational risk domains. These domains provide a comprehensive view of operational risk and allow us to discuss operational risk in a standard way, facilitating reporting and ongoing risk mitigation.

The operational risk domains are:

•Operations: Risk resulting from inadequate or failed internal processes, misconduct or errors of people or fraud.

•Compliance: Risk arising from violations of laws, rules or regulations including nonconformance with prescribed practices and industry standards driven by self-regulatory organizations.

•Data Management: Risk associated with data accuracy, integrity or quality.

•Model: Risk associated with the design, implementation and ongoing use and management of models.

•Technology and Systems: Risk associated with the use, operation and adoption of technology.

•Information Security: Risk resulting from the failure to protect information and ensure appropriate access to, and use and handling of, information assets.

•Business Continuity: Risk of potential disruptive events to business activities.

•Third Party: Risk arising from failure of third-party providers to conduct activity in a safe and sound manner and in compliance with contract provisions and applicable laws and regulations.

The PNC Financial Services Group, Inc. –2024 Form 10-K 79

We utilize operational risk management programs within the framework, including Risk and Control Self-Assessments, scenario analysis, and internal and external loss event reviews and analysis, to assess existing risks, determine potential/emerging risks and evaluate the effectiveness of internal controls. Program tools and methodology assist our business managers in identifying potential risks and control gaps.

Lines of business are responsible for identifying, owning, managing and monitoring the operational risks and controls associated with their business activities and product or service offerings to within acceptable levels. Centralized functions, such as Business Continuity, Enterprise Third Party Management and Information Security, are responsible for the development, implementation and management of their individual programs and for the development and maintenance of the policies, procedures, methodologies, tools and technology utilized across the enterprise to identify, assess, monitor and report program risks. Additionally, independent risk management reviews and challenges line of business adherence to the framework to help ensure proper controls are in place and appropriate risk mitigation plans are established as necessary.

Compliance Risk

Enterprise Compliance is responsible for oversight of compliance risk for the organization. Compliance issues are identified and tracked through enterprise-wide monitoring and testing activities. Compliance risk issues are escalated through a comprehensive risk reporting process at both a business and enterprise level and incorporated, as appropriate, into the development and assessment of our operational risk profile. A management committee, chaired by the Chief Compliance Officer, is responsible for oversight of compliance and fiduciary risk management programs across PNC. Enterprise Compliance, through the Regulatory Change Program, helps PNC understand and proactively address emerging regulatory topics and risks as well as respond to changes in applicable laws and regulations. To understand emerging issues impacting the industry, Enterprise Compliance communicates regularly with various regulators having supervisory or regulatory responsibilities with respect to us, our subsidiaries, or businesses and participates in forums focused on regulatory and compliance matters in the financial services industry.

Information Security Risk

The Information Security component of our Operational Risk Management Framework is responsible for protecting information assets to achieve business objectives, which includes cybersecurity. PNC’s cybersecurity program is designed to identify risks to sensitive information, protect that information, detect threats and events and maintain an appropriate response and recovery capability to help ensure resilience against information security incidents. The program includes, among other things, annual security and privacy training for all PNC employees and quarterly phishing exercises to raise employee awareness. Our security program is also regularly examined by federal regulators for compliance with financial regulations and standards. The program also establishes expectations for information asset management, system development security, identity and access management, incident management, threat and vulnerability management, security operations management and third- and fourth-party security. For additional information, see Item 1C Cybersecurity of this Report.

Conduct, Reputational and Strategic Risk

PNC’s risk culture seeks to reinforce the appropriate protocols for responsible and ethical behavior through sound processes and controls. In order to promote a robust risk culture, the Board and executive management establish code of conduct and professional standards to which all employees must adhere. A strong risk culture discourages misconduct and supports conduct risk management at PNC. Conduct risk is defined as the risk that employees fail to comply with the ethical standards expected of them. Strong conduct risk management is important in supporting PNC’s reputation, and PNC maintains a corporate culture that emphasizes complying with laws, regulations, and managing reputational risks. Reputational risk is the risk to the franchise and/or shareholder value based on a negative perception of PNC by its stakeholders and/or the changing expectations of its stakeholders. As part of assessing those risks, transactions and potential customers may be subjected to an industry-agnostic reputation risk assessment designed to help us better identify and mitigate environmental, human rights and other reputational risks early in the on-boarding process. Transactions and potential customers identified as having these risks are evaluated to determine whether additional due diligence is warranted. Strategic risk is another component of the ERM Framework that is also critical to optimizing shareholder returns. Strategic risk is the risk to earnings, capital, or liquidity that may arise from adverse business decisions, improper implementation of business decisions and/or inadequate response to changes in the business environment. Strategic risk is considered and assessed by our businesses in the annual strategic planning processes and monitored on an on-going basis as those plans are carried out.

80 The PNC Financial Services Group, Inc. –2024 Form 10-K