FIFTH THIRD BANCORP

Risk Management Oversight. An important role of the Board of Directors is to provide oversight to ensure an enterprise risk management program is implemented and operating effectively, including an appropriate enterprise risk management framework and related governance structure. The Bancorp establishes a risk appetite in alignment with its strategic, financial, and capital plans. The Bancorp’s risk appetite is defined using quantitative metrics and qualitative statements to ensure prudent risk taking and drive balanced decision making. The Bancorp’s goal is to ensure that aggregate residual risks do not exceed the Bancorp’s risk appetite, and that risks taken are supportive of the Bancorp’s portfolio diversification and profitability objectives. The Board and executive management approve the risk appetite, which is considered in the development of business strategies. Through their oversight role, directors also ensure that the risk management processes defined in the framework are functioning as intended. The Board also considers the optimal organizational structure at both the Board and management levels. This may include delegating responsibility through Board committees, management committees, the Chief Executive Officer, and the Chief Risk Officer.

The Board’s risk oversight responsibility is primarily carried out through its standing Committees, as follows:

The Risk and Compliance Committee currently consists of independent directors and has responsibility for the oversight of risk management, including credit, interest rate, liquidity, price, operational, legal and regulatory compliance, reputational, and strategic risks. The Risk and Compliance Committee also has responsibility to ensure that risks are properly controlled and quantified and are within our risk appetite. The Chief Risk Officer has a direct reporting relationship to the Chief Executive Officer and the Risk and Compliance Committee.

The Chief Risk Officer has separate, regular executive sessions with the Risk and Compliance Committee without other members of management present. In addition, the Director of Credit Risk Review provides reporting and has direct access to the Risk and Compliance Committee.

The Bancorp’s risk governance structure ensures proper oversight of risk across the Company and provides a path for escalation of risks and issues to management and Board-level Committees to drive effective risk decisioning. The Risk and Compliance Committee oversees a robust management-level risk committee structure which allows the Board and management to assess the Company’s risk exposure and to ensure it is aligned with the Bancorp’s appetite for risk.

During times when there may be elevated levels of risk, the Board monitors the impact on the risk profile by regularly reviewing reports on management’s response and actions taken to mitigate risks, including financial and non-financial risks, business continuity, and human capital risks.

The Enterprise Risk Management Committee is the executive-level management committee chaired by the Chief Risk Officer. Membership includes the Chief Executive Officer and senior level management, including individuals from both the first and second lines of defense, as well as the Chief Audit Executive (non-voting). The Enterprise Risk Management Committee is responsible for reviewing and approving the Enterprise Risk Management Framework, overseeing the management of all risk types to ensure that residual risks remain within our risk appetite, and fostering a culture that supports risk management objectives. To fulfill these responsibilities, the Enterprise Risk Management Committee reviews information on risk levels and trends, capital adequacy, and top and emerging risks during each quarterly meeting. The Enterprise Risk Management Committee has several subordinate management committees and councils which oversee specific areas of risk, including oversight of front-line unit risk-taking activities, to determine if risk management practices are aligned with the Enterprise Risk Management Framework, including monitoring risk appetite, review of key risk indicators, concentration risk limits, and other risk metrics and reporting.

Oversight of Cybersecurity. The Technology Committee oversees Fifth Third’s information security and privacy programs. The Technology Committee is comprised of Board members with extensive technology backgrounds. Its primary purpose is to assist the Board in its oversight of technology and innovation strategies, plans, and operations related to information technology, cybersecurity, and data privacy. In 2024, the Technology Committee held sessions with the Chief Technology Officer and Chief Information Officer to ensure the Bank’s approach to safeguarding customer data and other sensitive information was adequate, appropriate, and reflective of best practices in order to stay ahead of emerging cyber threats. The Risk and Compliance Committee oversees risks related to information security, technology, cyber security, and data privacy and receives reports from the Technology Committee on the same. The Technology and Risk and Compliance Committees meet jointly at least once per year to discuss the Company’s programs and risks. The full Board also directly received reports on Fifth Third’s cybersecurity and organizational defense.