TRUIST FINANCIAL CORP (TFC) Risk Factors

ITEM 1A. RISK FACTORS

Summary of Risk Factors

Market Risks

•Changes in monetary, fiscal, and other policies, and changes in the U.S. political environment, could adversely affect us.

•Our financial results, the value of loans and debt securities we hold, and lending and other business activities have in the past, and may in the future, be adversely affected by weak or deteriorating economic conditions.

•Geopolitical conditions, the outbreak or escalation of hostilities, acts or threats of terrorism, and related volatility and instability in global economic and market conditions could adversely affect us.

•Changes in interest rates have affected our net interest income and other financial results in the past and could in the future adversely affect us.

•The Company’s hedging strategies may not be successful in mitigating our interest rate, foreign exchange, and market risks, which could adversely affect our results of operations and financial condition.

Credit Risks

•The Company is subject to credit risk, and the Company’s allowance for credit losses may not be adequate to cover realized and future losses.

•The Company could have more credit risk and higher credit losses if our underwriting standards and practices are inadequate, we adopt more liberal underwriting standards for competitive or other reasons, information provided to us by clients and counterparties is inaccurate, or our concentration and other risk limits are not well-calibrated.

•The Company may suffer losses if the value of collateral declines in weak, deteriorating, or stressed economic or market conditions.

Liquidity Risks

•Our inability to retain and grow deposits or a change in deposit costs or mix could negatively impact our funding strategy and financial results.

•Truist’s liquidity could be impaired by an inability to access short-term funding, an unforeseen outflow of cash, or an inability to monetize liquid assets.

•A disruption in our access to the mortgage secondary market and GSEs for liquidity could negatively affect us.

•The Company’s cost of funding or access to the banking and capital markets could be adversely affected if our credit ratings are downgraded or otherwise fail to meet investor expectations.

•The Parent Company relies on dividends from Truist Bank for its liquidity needs, the payment of which is limited by statutes and regulations, and the Parent Company could have less access to funding sources and its liquidity could be constrained if Truist Bank becomes unable to pay dividends.

•The financial system is highly interrelated, and financial or systemic shocks or the failure of even a single financial institution or other participant in the financial system could adversely impact us.

Technology and Data Risks

•The Company’s applications, operating systems, and infrastructure, as well as operational capabilities managed or supplied by third parties on whom we rely, could fail or be interrupted, which could adversely impact the Company’s business, operations, financial condition, prospects, and reputation and cause significant legal and financial exposure.

•Truist is heavily reliant on technology, and a failure to effectively anticipate, develop, and implement new or enhanced technology could negatively impact our financial results, business, operations, security, or ability to compete effectively.

•The Company and its clients, suppliers, service providers, and other third parties face a wide array of cybersecurity risks, which could result in the loss, alteration, or disclosure of confidential, proprietary, personal, and other sensitive information; adversely impact the Company’s business, operations, financial condition, results of operations, prospects, and reputation; and cause significant legal and financial exposure.

•The Company faces risks associated with the privacy, quality, availability, and retention of key data for operational, strategic, regulatory, and compliance purposes.

•Truist faces substantial risks in safeguarding personal and other sensitive information, which may negatively impact the Company’s business, financial condition, results of operations, prospects, or reputation.

•The use of AI in our products and services, as well as our business and the industry more broadly, may negatively impact our business, operations, financial condition, results of operations, prospects, and reputation.

Truist Financial Corporation 19

Operational Risks

•Truist relies on third parties to support key components of the Company’s business and operational infrastructure, and their failure to perform to our standards or our failure to appropriately assess and manage these relationships could adversely affect us.

•The Company’s risk and control framework may fail to identify, assess, monitor, and mitigate the risks we face and cause us to suffer unexpected losses that could adversely affect our business, financial condition, results of operations, prospects, and reputation.

•Truist can be negatively affected if it fails to identify and address operational and compliance risks associated with the introduction of or changes to products, services, and delivery platforms.

•Truist is subject to risks related to originating and selling loans, including repurchase and indemnification obligations, which may adversely affect our business, results of operations, and financial condition.

•Truist faces loan servicing risks that could adversely impact the Company’s business, operations, liquidity, and results of operations.

Compliance, Regulatory, and Legal Risks

•Truist is subject to extensive and evolving government regulation and supervision, which could adversely affect our business, financial condition, results of operations, and prospects.

•The Company may incur damages, fines, and penalties and face other negative consequences from supervisory actions and regulatory or other legal violations, including inadvertent or unintentional violations.

•Pending or threatened legal proceedings and other matters may adversely affect the Company’s business, financial condition, results of operations, prospects, and reputation.

•Regulatory capital and liquidity standards applicable to large banking organizations and future revisions to existing standards may negatively impact our business, financial results, financial condition, growth, profitability, or our ability to return capital to shareholders.

•Differences in, or changes to, regulation and supervision and industry disruption can affect the Company’s ability to compete effectively, which may adversely affect our business, financial condition, financial results, or growth.

•Truist faces risks of non-compliance and may incur additional operational and compliance costs under laws relating to anti-money laundering, economic sanctions, embargo programs, anti-bribery, and anti-corruption.

Strategic Risks

•Ineffective execution of strategic initiatives could adversely affect investor sentiment and the Company’s business, financial condition, results of operations, prospects, and reputation.

•Competition may reduce Truist’s client base or cause Truist to modify the pricing or other terms for products and services, or require significant investments to maintain competitiveness, which could have an adverse impact on our business and financial results.

•Acquisitions, mergers, and divestitures introduce a broad range of anticipated and unanticipated risks, including unforeseen or negative consequences from supervisory or regulatory action that may limit Truist’s ability to pursue and complete them, which may impair the Company’s ability to expand or grow its client base, or execute on its strategic initiatives and compete effectively.

•Truist has businesses other than banking that are subject to a variety of risks that may affect our financial condition and results of operations.

Risks Related to Estimates and Assumptions

•Truist’s business and operations rely significantly on the use of models, and any deficiencies in the design, implementation, or use of models could adversely affect our business, results of operations, and financial condition.

•Truist employs estimates and assumptions to determine the value or amount of many of our assets and liabilities, and if these estimates or assumptions prove inaccurate, our business, financial condition, results of operations, and prospects could be adversely affected.

•Depressed market values for the Company’s stock and adverse economic conditions sustained over a period of time may require the Company to write down all or some portion of the Company’s goodwill.

Additional Risks

•Negative public opinion, whether or not warranted, could damage the Company’s brand in the market and relationships with stakeholders, and adversely impact our business, financial condition, results of operations, and prospects.

•We could be harmed by an inability to attract, develop, retain, and motivate qualified teammates while effectively managing recruiting and compensation costs amid highly competitive and rapidly changing market conditions.

•The Company relies on its ability, and the ability of key external parties, to maintain appropriately staffed workforces and on the competence, trustworthiness, health, and safety of teammates.

•The Company is at risk of losses from fraud which could result in financial loss and reputational harm.

•Physical, transition, and other risks associated with climate change, together with governmental responses to such risks, may negatively impact our business, financial condition, operations, reputation, and clients.

•Natural disasters, pandemics, extreme weather events, and other catastrophic events could adversely affect our financial condition and results of operations.

20 Truist Financial Corporation

Risk Factors

The following discussion sets forth material risk factors that could affect Truist’s financial condition, results of operations, business, or prospects. When a risk factor spans more than one risk category, the risk factor has been listed by its primary risk category. Any of the risk factors discussed below, either by itself or together with other risk factors, could materially and adversely affect Truist’s financial condition, results of operations, business, prospects, or reputation. These risk factors do not identify all risks that we face; additional risks that are not presently known to us or risks that we currently deem immaterial may have an adverse effect on Truist’s financial condition, results of operations, business, prospects, or reputation.

Market Risks

Changes in monetary, fiscal, and other policies, and changes in the U.S. political environment, could adversely affect us.

Changes in monetary and fiscal policies, including monetary policies established by the Federal Reserve System and other central banks, and uncertainty concerning the future path of interest rates, government shutdowns, debt ceilings or funding for the government, and tariffs and other trade policies can cause dislocations and volatility in the financial markets and adversely affect our business and operations—including, for example, the conditions for commercial and consumer lending, the creditworthiness of our clients, the cost of our deposits and other interest-bearing liabilities, and the yield on our earning assets. Truist cannot control or make firm predictions with respect to the nature or timing of future changes in monetary, fiscal, or other policies or the precise effects such changes may have on the Company’s business, financial results, and financial condition. These policies can:

•Meaningfully influence the availability and demand for loans and deposits, the rates and other terms for loans and deposits, and the conditions in equity, fixed-income, currency, and other markets;

•Significantly impact the cost of funds and, the return on assets, both of which can have an impact on interest income;

•Adversely affect borrowers through higher debt servicing costs and potentially increase the risk they may fail to repay their loan obligations; and

•Artificially inflate asset values during prolonged periods of accommodative policy, which could in turn cause volatile markets and rapidly declining collateral values during times of restrictive monetary and fiscal policies.

A fractious or volatile political environment in the U.S., including any related social unrest, could negatively impact business and market conditions, economic growth, financial stability, and business, consumer, investor, and regulatory sentiments, any one or more of which in turn could cause our business, financial results, and financial condition to suffer. Concern about the ability of the U.S. government to effectively respond to high and rising debt levels and other budgetary matters also can have adverse economic consequences and create market volatility with potential adverse consequences to our business and financial performance. We could be negatively impacted as well by political scrutiny of the financial services industry in general, such as criticisms involving fair access to financial services and the affordability of financial products and services, or our business or operations in particular.

Our financial results, the value of loans and debt securities we hold, and lending and other business activities have in the past, and may in the future, be adversely affected by weak or deteriorating economic conditions.

Our businesses are driven by robust economic and market activity, monetary and fiscal stability, and positive investor, business, and consumer sentiment. Any prolonged period of slow growth in the U.S. economy as a whole or in any regional markets that Truist serves, or any deterioration in economic conditions or the financial markets, may disrupt or dampen the economy, which has in the past and may in the future adversely affect the Company’s business, financial results, and financial condition.

If economic conditions deteriorate, the Company could see lower demand for loans by creditworthy clients, reducing the Company’s interest income. In addition, if unemployment or underemployment levels increase or if real estate prices decrease, the Company could incur higher charge-offs and could incur higher expenses due to increased credit loss provisions. These conditions may adversely affect not only consumer borrowers but also commercial and industrial and commercial real estate borrowers, especially for those businesses reliant on industries or properties that suffer from deteriorating economic conditions. The ability of these borrowers to repay their loans may be reduced, causing the Company to incur higher credit losses. In addition, inflation may lead to a decrease in the purchasing power of clients and their customers and adversely affect demand for our products and services, reducing the Company’s income.

Truist Financial Corporation 21

A weakening or deterioration of economic conditions has in the past and may in the future adversely affect financial results for the Company’s fee-based businesses. Truist earns fee income from, among other activities, investment banking, managing assets for clients, and providing brokerage and other investment advisory and wealth management services. Investment management fees are often based on the value of assets under management and a decrease in the market prices of those assets could reduce the Company’s fee income. Changes in stock or fixed income market prices or client preferences could affect investor trading activity, reducing commissions and other fees earned from the Company’s brokerage businesses. Poor economic conditions and volatile or unstable financial markets would likely adversely affect the Company’s financial advisory and capital markets-related businesses. Sustained market weakness and lower client activity could adversely affect our financial condition, results of operations, and prospects.

In addition, the large bank failures in 2023 focused market attention on the industry’s interest rate and deposit risks due to rapidly rising interest rates in an inflationary environment, which, among other things, resulted in unrealized losses on longer duration securities and loans held by banks. When weak or deteriorating economic conditions result in a decrease in the supply of deposits or significant increase in competition for deposits, substantial increases in our costs to retain and service deposits have in the past and may in the future arise. Such an impact can be exacerbated by the continued adoption of banking technology that enables deposits to be transferred with relative ease to a different depository institution or other competitor if Truist Bank’s products and services are less competitive or confidence is lost in Truist Bank. These dynamics could constrain lending and other business activities, adversely affecting our financial condition and results of operations. The cost of resolving the large bank failures in 2023 also prompted the FDIC to issue a special assessment to recover costs to the DIF. Refer to the “Regulatory and Supervisory Considerations” section in “Item 1. Business” for additional details related to the FDIC’s special assessment.

Geopolitical conditions, the outbreak or escalation of hostilities, acts or threats of terrorism, and related volatility and instability in global economic and market conditions could adversely affect us.

Instability in global economic conditions and geopolitical matters, as well as volatility in financial markets, could have an adverse effect on the Company’s results of operations, financial condition, business, and prospects. In addition, disruptions in foreign relations of the U.S. could adversely affect industries and markets on which our business depends. The macroeconomic environment in the U.S. is susceptible to geopolitical events and volatility in financial markets. For example, trade and other negotiations between the U.S. and other nations remain uncertain and could adversely impact economic and market conditions for the Company and its clients, counterparties, and service providers.

Geopolitical conditions, including tensions in foreign relations of the U.S., the outbreak or escalation of hostilities between countries or within a country or region, and acts or threats of terrorism, could have an adverse effect on the global economy, financial markets, and Truist’s business and operations. Aggressive actions by hostile governments or groups, including armed conflict or intensified cyber-attacks, could expand or escalate in unpredictable ways, with potentially catastrophic consequences, particularly if one or more combatants possess nuclear weapons. Geopolitical events and instability could result in worldwide economic disruption, heightened volatility in financial markets, severe declines in asset values, disruption of global trade and supply chains, higher and more volatile commodity and food prices, and diminished consumer, business, and investor confidence. Any of these consequences could have significant negative effects on the economy and, as a result, Truist’s operations and earnings. Truist, its service providers, and participants in the financial system could also experience more aggressive and increasing levels of cyber-attacks launched by or under the sponsorship of one or more of the adversaries in a conflict.

Changes in interest rates have affected our net interest income and other financial results in the past and could in the future adversely affect us.

We are highly dependent on net interest income, which is the difference between interest income on earning assets, such as loans and investments, and interest expense on deposits and borrowings. Net interest income is significantly affected by market interest rates, which in turn are influenced by monetary and fiscal policies, general economic and market conditions, including inflation levels, the political and regulatory environments, business and consumer sentiment, competitive pressures, and expectations about the future, including future changes in interest rates and the frequency and timing of such changes. Our net interest income and other financial results have been in the past and could be in the future adversely affected by policies, laws, and events that have the effect of flattening or inverting the yield curve (that is, the difference between long-term and short-term interest rates), depressing the interest rates associated with our earning assets to levels near the rates associated with our interest expense, increasing the volatility of market rates of interest, including the rate of change, or changing the spreads among different interest rate indices.

Changes in interest rates could adversely affect us beyond our net interest income, including by increasing the cost or decreasing the availability of deposits or other variable-rate funding instruments, reducing the yield on or demand for loans or increasing the prepayment speed of loans, increasing client or counterparty delinquencies or defaults, and reducing the value of our loans, retained interests in securitizations, and fixed-income securities in our investment portfolio and the efficacy of our hedging strategies. Certain of our investment securities, notably MBS, are sensitive to changes in rates. Generally, when rates rise, market values will decline, prepayments of principal will decrease, and the duration of MBS will increase. Conversely, when rates fall, market values will rise, prepayments of principal will increase, and the duration of MBS will decrease.

22 Truist Financial Corporation

The levels of and changes in market interest rates, and the related risks and uncertainties, are beyond our control. The dynamics among these risks and uncertainties are also challenging to assess and manage. For example, while an accommodative monetary policy may benefit us to some degree by spurring economic activity among our clients, such a policy may ultimately have an adverse effect on us by inhibiting our ability to grow or sustain net interest income. A restrictive monetary policy can pose different challenges, such as potentially slowing the demand for credit, increasing delinquencies and defaults, and reducing the values of our loans and fixed income securities. Interest rate volatility, including the rate of change, can create particularly difficult conditions. Refer to the “Market Risk” section in MD&A and “Note 19. Derivative Financial Instruments.”

The Company’s hedging strategies may not be successful in mitigating our interest rate, foreign exchange, and market risks, which could adversely affect our results of operations and financial condition.

The Company employs various hedging strategies to mitigate the interest rate, foreign exchange, and market risks inherent in many of our assets and liabilities. The Company’s hedging strategies rely considerably on assumptions and projections regarding our assets and liabilities as well as general market factors. If any of these assumptions or projections prove to be incorrect or our hedges do not adequately mitigate the impact of changes in interest rates, foreign exchange rates, and other market factors, the Company may experience volatility in our earnings that could adversely affect our profitability and financial condition. In addition, the Company may not be able to find market participants that are willing to act as its hedging counterparties on acceptable terms or at all, which could have an adverse effect on the success of our hedging strategies. The Company’s hedging strategies are not designed to eliminate all interest rate, foreign exchange, and market risks.

Credit Risks

The Company is subject to credit risk, and the Company’s allowance for credit losses may not be adequate to cover realized and future losses.

Truist incurs credit risk, which is the risk to current or anticipated earnings or capital arising when a borrower, obligor, issuer, or counterparty has a decline in creditworthiness or does not meet its financial obligations to us. Credit risk is primarily incurred through lending activities in the Company’s WB and CSBB operating segments. The Company may have higher credit risk, or experience higher credit losses, to the extent its loan exposures increase or are concentrated by loan type, industry segment, borrower type, or location of the borrower or collateral, including with respect to any increase in its nonbank financial institution lending activities. A number of products expose the Company to credit risk, including loans and leases, lending commitments, derivatives, trading assets, and investment securities. Changes in credit quality can have a significant impact on the Company’s earnings and capital position. The Company estimates and establishes contractual lifetime reserves for credit risks and credit losses inherent in its determination of credit exposure. This process, which is critical to the Company’s financial results and condition, requires complex calculations and extensive use of judgment, considering both external and borrower-specific factors that might impair the ability of borrowers to repay their loans. If the Company fails to identify all pertinent factors, or fails to accurately estimate the impacts of factors identified, the Company’s allowance for credit losses may not be adequate to cover realized and future losses.

Credit losses may exceed the amount of the Company’s reserves due to changing economic conditions, falling collateral values, falling commodity prices, higher unemployment, losses on a client or sector where Truist has an outsized exposure, or other factors such as changes in borrower behavior or borrower composition. We have a significant consumer loan portfolio, including indirect auto and credit card loans, which may present higher credit risks during economic downturns and market fluctuations. There is no assurance that reserves will be sufficient to cover all credit losses. In the event of significant deterioration in current or projected future economic conditions, the Company could experience reduced demand for credit and increased delinquencies or defaults. In addition, the Company could be required to increase reserves in future periods, which would reduce the Company’s earnings and potentially impact its capital.

Truist Financial Corporation 23

The Company could have more credit risk and higher credit losses if our underwriting standards and practices are inadequate, we adopt more liberal underwriting standards for competitive or other reasons, information provided to us by clients and counterparties is inaccurate, or our concentration and other risk limits are not well-calibrated.

The Company’s credit risk and credit losses can increase if the Company’s loans are concentrated in borrowers engaged in the same or similar activities or in borrowers who as a group may be uniquely or disproportionately affected by economic or market conditions, including as a result of climate change or natural disasters or their particular industries. Increased delinquencies or defaults could also result from our failing to appropriately underwrite loans and other products that we originate or purchase or from our adopting—for strategic, competitive, or other reasons—more liberal underwriting standards. There can be no assurance that our forecasts of economic conditions, our assessments and monitoring of credit risk, and our efforts to mitigate credit risk through risk-based pricing, appropriate underwriting and investment policies, loss-mitigation strategies, and diversification are or will be sufficient to prevent an adverse impact to our business and financial results. Additionally, in deciding whether to extend credit or enter into other transactions with clients and counterparties, the Company relies on the completeness and accuracy of representations made by and information furnished by or on behalf of clients and counterparties, including financial statements and other financial information. If the information provided is not complete or accurate, the Company could make misjudgments about extending credit or entering into other transactions with clients or counterparties, and the Company could suffer defaults, credit losses, or other negative consequences as a result.

The Company may suffer losses if the value of collateral declines in weak, deteriorating, or stressed economic or market conditions.

During periods of market stress or illiquidity, the Company’s credit risk may be further increased if it fails to realize the expected value of the collateral it holds, collateral is liquidated at prices that are not sufficient to recover the full amount owed to Truist, or counterparties are unable to post collateral, whether for operational or other reasons. Furthermore, disputes with counterparties concerning the valuation of collateral or contractual agreements may increase in times of significant market stress, volatility, or illiquidity, and Truist could suffer losses during these periods if it is unable to effectively handle counterparty disputes, obtain additional collateral from counterparties, manage declines in the value of collateral, or realize the expected value of collateral.

Liquidity Risks

Our inability to retain and grow deposits or a change in deposit costs or mix could negatively impact our funding strategy and financial results.

Deposits are a relatively low cost and stable source of funding. Truist competes for deposit funding with banks and other financial institutions and with money market funds and other providers of deposit equivalents. If we are unable to compete effectively, deposits can be lost. In addition, our funding costs can increase if we are required to raise interest rates to avoid deposit attrition or to replace deposits with wholesale funding. Higher funding costs reduce Truist’s net interest margin, net interest income, and net income. For example, in 2025, maintaining and growing client deposits continued to be challenging as the Federal Reserve System reduced the size of its balance sheet through quantitative tightening. The future direction of the Federal Reserve System balance sheet and the level of excess reserves in the banking system may have implications for deposit gathering and competition. Our ability to maintain, grow, or favorably price deposits also may be constrained by gaps in our product and service offerings, changes in client trends, our scale relative to other financial institutions, competition from financial technology companies and emerging financial-services providers, any failures or deterioration in our client service, or any loss of confidence in our brand or our business. For example, deposits and other traditional banking products could be significantly disrupted by an increase in the adoption and use of digital assets, stablecoins, cryptocurrencies, tokenization, and similar products, services, and technologies that enable financial services and transactions without or with less intermediation by commercial banks.

24 Truist Financial Corporation

Truist’s liquidity could be impaired by an inability to access short-term funding, an unforeseen outflow of cash, or an inability to monetize liquid assets.

Liquidity is the ability to fund increases in assets and meet obligations as they come due, all without incurring unacceptable costs. Banks are especially vulnerable to liquidity risk because of their reliance on demand or short-term deposits to fund longer-term loans or other extensions of credit. We, like other financial-services companies, rely to a significant extent on external sources of funding, such as deposits and borrowings, for the liquidity needed to conduct our business and operations. A number of factors beyond our control, however, could have a detrimental impact on the availability or cost of that funding and thus on our liquidity. When volatility or disruptions occur in the wholesale funding markets, the Company’s ability to access short-term liquidity could be impaired. In addition, idiosyncratic factors affecting the Company, including realization of other risks described herein, as well as other factors outside of the Company’s control, such as a general market disruption or an operational problem that affects service providers or intermediaries, could impair the Company’s ability to access short-term or contingent funding sources or create an unforeseen outflow of cash due to, among other factors, draws on unfunded commitments or attrition of non-FDIC-insured and other deposits. Refer to the “Funding Activities“ section in MD&A for additional discussion of deposits. The Company’s inability to monetize liquid assets without unacceptable losses or to access short-term funding or capital markets could constrain the Company’s ability to make new loans or meet existing lending commitments and could ultimately jeopardize the Company’s overall liquidity and capitalization. While our policies and controls are designed to enable us to maintain adequate liquidity to conduct our business in the ordinary course even in a stressed environment, our liquidity position could still become compromised. Such an event could damage the performance and value of our business, prompt regulatory intervention and private litigation, harm our reputation, and cause a loss of client and investor confidence, and if the condition were to persist for any appreciable period of time, our viability as a going concern could be threatened.

A disruption in our access to the mortgage secondary market and GSEs for liquidity could negatively affect us.

Truist sells a portion of the mortgage loans that it originates to reduce the Company’s retained credit risk and to provide funding capacity for originating additional loans. The GSEs could limit their purchases of conforming loans due to capital constraints or other changes in their eligibility criteria for conforming loans, such as maximum loan amounts or borrower eligibility. This potential reduction in purchases could limit the Company’s ability to fund new loans and other financial products and services.

Proposals are presented from time to time to reform the housing finance market in the U.S., including the role of the GSEs in the housing finance market. The extent and timing of any such regulatory reform of the housing finance market and the GSEs, as well as any effect on the Company’s business and financial results, are uncertain.

The Company’s cost of funding or access to the banking and capital markets could be adversely affected if our credit ratings are downgraded or otherwise fail to meet investor expectations.

Credit ratings are influenced by many factors, including the Company’s profitability, asset quality, capital levels, liquidity, business mix, operations, and risk management practices. Credit ratings may also be influenced by other factors, some of which are outside the Company’s control, such as recent and anticipated economic trends, geopolitical risk, legislative and regulatory developments, perceptions of the banking industry and U.S. financial stability, environmental, social, and governance considerations, litigation, and changes to the rating agency methodologies. There can be no assurance we will be able to maintain our current credit ratings and outlooks. Truist’s failure to maintain credit ratings could adversely affect funding costs and increase the Company’s cost of capital. A ratings downgrade could affect the Company’s ability to attract or retain funding, including deposits from commercial and corporate clients. Additionally, a downgrade to Truist’s credit ratings may adversely impact the Company’s ability to conduct derivatives business with certain clients and counterparties and could trigger obligations to make cash or collateral payments to certain clients and counterparties.

The Parent Company relies on dividends from Truist Bank for its liquidity needs, the payment of which is limited by statutes and regulations, and the Parent Company could have less access to funding sources and its liquidity could be constrained if Truist Bank becomes unable to pay dividends.

The Parent Company relies upon capital markets access and dividends from subsidiaries for funding and has less access to contingent funding sources than Truist Bank. If Truist Bank were subject to financial stress, its dividends to the Parent Company could be reduced or eliminated in order to support Truist Bank’s capital position or its satisfaction of other regulatory requirements. This would increase the Parent Company’s reliance on capital markets and other wholesale funding at a time when credit spreads and funding costs are likely to be elevated due to the stress impacting Truist Bank and would also impair the Parent Company’s ability to serve as a source of strength to its subsidiaries.

Truist Financial Corporation 25

The financial system is highly interrelated, and financial or systemic shocks or the failure of even a single financial institution or other participant in the financial system could adversely impact us.

Adverse developments affecting the overall strength and soundness of other financial institutions, the financial services industry as a whole, the macroeconomic climate, and the U.S. Treasury market could have a negative impact on perceptions about the strength and soundness of Truist even if we are not subject to the same adverse developments. In addition, adverse developments with respect to counterparties, intermediaries, and other third parties with whom we have important relationships could also negatively impact perceptions about us. These perceptions about us could cause our business and operations to be negatively affected and exacerbate the other risks that we face.

Truist may be impacted by the actual or perceived soundness of other financial institutions, including as a result of the financial or operational failure of a major financial institution or concerns about the creditworthiness of such a financial institution or its ability to fulfill its obligations, which can cause substantial and cascading disruption within the financial markets. Such an event may negatively affect our financial results due to increased expenses, including FDIC insurance assessments or special assessments, and challenges in attracting and retaining funding from depositors, the capital markets, and other sources. The measures taken by governments, businesses, and other organizations in response to such an event also could adversely impact the Company’s business, financial condition, and results of operations.

The Company’s ability to engage in routine funding transactions could be adversely affected by the actions and commercial soundness of other financial institutions. Financial institutions are interrelated as a result of trading, clearing, counterparty, and other relationships. Truist routinely executes transactions with brokers and dealers, central counterparties, commercial banks, investment banks, mutual and hedge funds, and other counterparties in the financial industry. Defaults by or even rumors or questions about the soundness of one or more of these counterparties or the financial services industry generally have led to market-wide liquidity constraints and could lead to losses or defaults by Truist or other financial institutions. These liquidity challenges and credit losses, together with related consequences, could adversely affect the Company.

Technology and Data Risks

The Company’s applications, operating systems, and infrastructure, as well as operational capabilities managed or supplied by third parties on whom we rely, could fail or be interrupted, which could adversely impact the Company’s business, operations, financial condition, prospects, and reputation and cause significant legal and financial exposure.

The Company’s ability to perform and succeed depends on applications, operating systems, and infrastructure, including computer systems and networks, software, security systems, data management, and internal processes. These may be owned or controlled by the Company or by clients, suppliers, service providers, or other third parties. We rely on the secure collection, transmission, storage, use, retrieval, and other processing of confidential, proprietary, personal, and other sensitive information in the Company’s systems and networks as well as those of its clients and other third parties. To access the Company’s systems, networks, products, and services, the Company’s clients and other third parties may use personal devices or other computing devices that are outside of the Company’s control and network environments. The Company’s operating systems and infrastructure are vulnerable to damage or interruption from, among other things, software bugs, server malfunctions, software or hardware failure, and human error that originate inside or outside its control and network environment. These risks may increase in the future as Truist continues to evolve its use of, interactions with, and dependence on internal and external operating systems and infrastructure.

The Company has experienced, and may continue to experience, failures and disruptions affecting the stability, performance, security, and availability of its applications, operating systems, and infrastructure. These include degraded processing performance, data quality issues, loss of network connectivity, software malfunctions and misconfigurations, and interruptions in the availability and reliability of cloud-based and other third-party systems and services. The Company’s substantial and increasing reliance on cloud service providers and other external technology vendors heightens exposure to risks outside of its control, including system outages, downtime, cyber-attacks, and adverse financial and operating conditions at those providers and vendors. The Company’s expanding use of AI tools and related technologies introduces additional operational risks, including reliance on data integrity and model performance as well as third-party AI services that may fail, degrade, or produce inaccurate or unexpected outputs.

The Company regularly updates and modifies its applications, operating systems, and infrastructure to support business and operations, including growth initiatives and regulatory compliance requirements. These activities involve significant costs and create additional risks related to the implementation, integration, and effectiveness of new or modified applications, systems, and infrastructure. The introduction, updating, or retraining of AI models and other methods of automation may amplify these risks. Changes in model behavior or configuration may produce unintended outcomes, increase susceptibility to operational errors, or reduce the effectiveness of existing controls. Failures associated with upgrades, configuration changes, system conversions, AI model deployment, integration efforts, and related activities may result in operational interruptions, system failures, or reduced control effectiveness.

26 Truist Financial Corporation

Failures to properly maintain, upgrade, or secure applications, operating systems, and infrastructure may increase the Company’s susceptibility to cybersecurity threats, including supply chain attacks, and may impair the Company’s ability to meet business continuity and resiliency objectives. AI-enabled technologies may further expand the cyber-attack surface and velocity, including exposure to adversarial manipulation, data poisoning, and vulnerabilities in third-party AI and other platforms. These events have resulted in adverse client impacts, including the inability to access account information or conduct transactions through ATM, online, or mobile channels, the exposure of confidential, proprietary, personal, and other sensitive information, the posting of duplicative or delayed transactions, and delays in obtaining assistance through call centers. The Company cannot assure that similar or more severe operational or technology failures and disruptions, including AI-related failures or third-party service interruptions, will not occur in the future or that their effects can be prevented, contained, or remediated in a timely manner.

The potential for operational risk exposure exists throughout the Company and, because of the Company’s interactions with and reliance on third parties, is not limited to the Company’s own internal operational functions. Truist’s clients, service providers, intermediaries, and other third parties may expose the Company to risk as a result of human error, misconduct, malfeasance, or a failure or breach of applications, systems, and infrastructure. In addition, third-party breakdowns or failures could affect their ability to deliver a product or service to the Company or its clients or result in lost or compromised information of the Company or its clients. Truist cannot be certain that it will receive timely notification of such incidents or be able to exert any meaningful control or influence over how and when they are addressed. The Company’s ability to conduct its business and operations may be adversely affected by these kinds of disruptions to third parties whom the Company interacts with or relies upon.

In addition, as a result of increasing consolidation, interconnectivity, and complexity of financial entities and operating systems and infrastructure, a technology failure that significantly degrades, deletes, or compromises the applications, systems, infrastructure, or data of one or more financial entities could have an adverse impact on counterparties or other market participants. This consolidation, interconnectivity, and complexity increases the risk of operational failure, on both individual and industry-wide bases, as disparate systems need to be integrated, often on an accelerated basis, for transactions and other business to be conducted in the ordinary course. Any third-party technology failure, other information or security breach, termination, or constraint could, among other things, adversely affect the Company’s ability to conduct transactions and other business, service the Company’s clients, manage the Company’s exposure to risk, or expand the Company’s business. Such an event affecting the Company could likewise negatively impact its counterparties and other market participants and, as a result, create reputational damage as well as legal and financial exposure.

Truist is heavily reliant on technology, and a failure to effectively anticipate, develop, and implement new or enhanced technology could negatively impact our financial results, business, operations, security, or ability to compete effectively.

The financial services industry is undergoing rapid technological change with frequent introductions of new technology-driven products and services, including those related to AI and cloud migration as well as blockchain and other distributed ledger technologies such as those underpinning digital assets, tokenization, cryptocurrencies, and stablecoins. Truist has invested in technology to automate functions previously performed manually, to facilitate the ability of clients to engage in financial transactions, and otherwise to enhance the client experience with respect to the Company’s products and services. As a result of these developments and investments, Truist is heavily reliant on technology, and any inability to effectively anticipate, develop, or implement new or enhanced technology could have an adverse effect on Truist’s business.

Truist expects to make additional investments in innovation and technology to address technological disruption in the industry, improve client offerings and service, and streamline and automate operations. Although these and future investments are designed to enable the Company to better serve its clients and to reduce costs, many of these initiatives take a significant amount of time to develop and implement, are tied to critical systems, and require substantial financial, human, and other resources. Although we take steps to mitigate the risks and uncertainties associated with these initiatives, they have not been in the past and may not be in the future implemented on time, within budget, or without negative financial, operational, or client impact. In addition, these initiatives have not in the past and may not in the future always perform as we or our clients expect. Changes in our business, including the use of new technologies, may require us to modify our workforce strategies and training programs, which could negatively impact our ability to attract, develop, retain, and motivate qualified teammates and ultimately our operations and financial results.

The Company’s continued success depends, in part, upon its ability to use technology to provide products and services that satisfy client needs and preferences, including demands for faster, simpler, more cost-effective, and more secure payment services and settlement, to create efficiencies in the Company’s operations, and to integrate new or enhanced client offerings with legacy platforms or to update those legacy platforms. A failure to maintain or enhance the Company’s competitive position with respect to technology, whether because of a failure to anticipate client expectations or keep pace with new or enhanced product or service offerings by competitors, a failure in the performance or reception of technological enhancements, or an untimely rollout of technological enhancements, may cause the Company to lose market share, miss growth opportunities, or adversely affect our financial results.

Truist Financial Corporation 27

Our use of systems and other technologies also depends on rights or interests in the underlying intellectual property, which we or our service providers may own or license. If we or a service provider were alleged or found to be infringing on the intellectual-property rights of another person or entity, we could incur significant damages for past infringement, substantial fees for continued use, deprivation of access to or use of such intellectual property for limited or extended periods of time without the practical availability of an alternative, or considerable expense to settle or otherwise resolve the matter. For example, in 2023 we settled a lawsuit brought by another financial institution alleging that our mobile remote deposit capture systems infringed patents owned by the other financial institution.

The Company and its clients, suppliers, service providers, and other third parties face a wide array of cybersecurity risks, which could result in the loss, alteration, or disclosure of confidential, proprietary, personal, and other sensitive information; adversely impact the Company’s business, operations, financial condition, results of operations, prospects, and reputation; and cause significant legal and financial exposure.

The Company’s applications, operating systems, and infrastructure and those of its clients, suppliers, service providers, and other third parties are continuously targeted in cyber-attacks and vulnerable to damage or interruption from, among other things, fraud, denial of service attacks, social engineering schemes (such as phishing and smishing), hacking, malware or ransomware intrusion, data corruption attempts, terrorist activities, or identity theft. Such incidents have in the past exposed and may in the future expose security vulnerabilities in the Company’s applications, systems, and infrastructure and those of third parties, resulting in the unauthorized access, gathering, monitoring, misuse, release, loss, or destruction of confidential, proprietary, or other sensitive information, including personal information. Such incidents could also damage the Company’s applications, systems, and infrastructure by significantly disrupting access or the business or operations of the Company or third parties.

In addition, Truist’s clients, regulators, and other third parties, including other financial institutions and companies engaged in data processing, have been subject to and will continue to be the target of cyber-attacks and similar incidents. As our clients regularly transact using our Truist-issued debit and credit cards, data is distributed across multiple platforms and networks, and card and other information is stored on these external platforms and networks. When these external platforms and networks are compromised, our clients’ information and accounts may be exposed to fraud and other data security and privacy-related issues. As a result, the Company has incurred, and expects to continue to incur, losses related to the reimbursement of clients for fraudulent transactions and other costs associated with data security incidents affecting these platforms and networks. The Company also faces cybersecurity risks relating to third parties that the Company relies upon to facilitate or enable business activities, including vendors, providers of outsourced software, services, and infrastructure, payment networks, card processors, merchants, and providers of critical infrastructure such as internet access and electrical power. While the Company performs varying degrees of cybersecurity due diligence on many of these third parties, the Company does not control third parties and our ability to monitor their cybersecurity is limited. Therefore, the Company cannot ensure that the cybersecurity measures they take will be sufficient to protect information the Company shares with them or prevent disruption arising from a cyber-attack. In addition, the existence, nature, or extent of cyber-attacks or security breaches at third parties with access to the Company’s data and systems may not be disclosed to the Company in a timely manner.

Cybersecurity risks for financial institutions have significantly increased in recent years and will likely continue to increase, in part because of the proliferation of new technologies to facilitate and conduct financial transactions and the increased sophistication and activities of organized crime affiliates, terrorist organizations, hostile foreign governments, state-sponsored actors, disgruntled teammates or vendors, hackers, activists, and other third parties, including those involved in corporate espionage. The risk of a security breach due to a cyber-attack could increase in the future due to factors such as the financial industry’s ongoing expansion of digital banking and other internet-based client offerings and the internal use of internet-based products and applications, including those that use cloud computing services; advances in AI, such as the use of machine learning, generative AI, and quantum computing by malicious actors to develop more advanced social engineering attacks on the Company or its clients, including targeted phishing and smishing attacks; the inability to maintain the security of information transmitted by financial institutions due to advances in quantum computing and other technology that may counteract or nullify existing information protections; and the acquisition and integration of new businesses. Even the most advanced internal control environment may be vulnerable to compromise. Persistent attackers may succeed in penetrating defenses given enough resources, time, and motive. The techniques used by cybersecurity threat actors change frequently and may not be recognized until launched or well after a breach has occurred.

28 Truist Financial Corporation

A successful penetration or circumvention of the security for our applications, operating systems, or infrastructure or those of third parties could cause serious negative consequences, including loss of clients and business opportunities; costs associated with maintaining client and business relationships after a cyber-attack or security breach; a loss of investor confidence; significant disruption to the Company’s operations and business; misappropriation, exposure, or destruction of the Company’s confidential, proprietary, and other sensitive information, including personal information, and the funds of the Company and its clients; damage to the Company’s or third-parties’ computers, systems, or networks; and a violation of applicable statutes and regulations, including those related to data privacy, data protection, and cybersecurity. Additional impacts include litigation exposure, regulatory fines, penalties, loss of confidence in the Company’s security measures, significant investment of management time, reputational damage, reimbursement or other compensatory costs, and additional compliance costs. Any of these consequences or impacts could adversely impact the Company’s business, operations, financial condition, results of operations, prospects, and reputation. In addition, the Company may not have adequate insurance coverage to compensate for losses from any of the foregoing, its existing insurance coverage may not continue to be available on acceptable terms or at all, and its insurers may deny coverage as to any future claims.

Cybersecurity and data-privacy risks have received heightened legislative, regulatory, and supervisory attention. Legislation and regulations on cybersecurity and data privacy, as well as related supervisory expectations, can compel us to enhance or modify our applications, systems, and infrastructure, invest in new applications, systems, and infrastructure, change our service providers, augment our scenario and vulnerability testing, and alter our business practices or our policies on security, data governance, and privacy. Any of these, in turn, can cause a significant increase in the complexity and costs of our operations and expose us to enforcement and other supervisory actions, related litigation by private plaintiffs, reputational damage, and a loss of client or investor confidence.

The Company faces risks associated with the privacy, quality, availability, and retention of key data for operational, strategic, regulatory, and compliance purposes.

The Company’s financial and regulatory reporting, public disclosures, and key business decisions are reliant on the quality, availability, and retention of data, including personal information. A control failure, for example, may lead to data breaches, data loss, data misuse, and data integrity and quality risks. These failures may result in inaccuracies in financial and regulatory reports, inhibited management decision-making, financial loss, brand and stakeholder risk, and regulatory compliance risk, including data privacy, data protection, and cybersecurity compliance risks. We also can experience enforcement and supervisory actions, damage to our reputation, and private litigation as a result of these failures.

Truist faces substantial risks in safeguarding personal and other sensitive information, which may negatively impact the Company’s business, financial condition, results of operations, prospects, or reputation.

Truist’s businesses are subject to complex and evolving statutes, rules, and regulations governing data privacy, data protection, and cybersecurity, particularly with respect to the privacy and protection of personal information of individuals. Individuals whose personal information may be protected by law can include the Company’s clients (and in some cases its clients’ clients), prospective clients, job applicants, teammates, and the employees of the Company’s vendors and other third parties. Complying with the statutes, rules, and regulations applicable to the Company’s disclosure, collection, use, sharing, storage, and other processing of personal information can increase operating costs, impact the development of new products or services, and reduce operational efficiency. Any mishandling or misuse of personal information by the Company or a third party affiliated with the Company could expose the Company to reputational damage, litigation, or regulatory fines, penalties, or other sanctions.

Additional risks could arise from the failure of the Company or third parties to provide adequate disclosure or transparency to the Company’s clients about the personal information collected from them and the use of such information; to receive, document, and honor the privacy preferences expressed by the Company’s clients; to protect personal information from unauthorized disclosure; or to maintain training on data privacy, data protection, or cybersecurity practices for all teammates or third parties who have access to personal information. Concerns regarding the effectiveness of Truist’s measures to safeguard personal information, or even the perception that those measures are inadequate, could cause Truist to lose existing or potential clients and negatively affect its business, financial results, and prospects. Furthermore, any failure or perceived failure by the Company to comply with applicable data privacy, data protection, or cybersecurity statutes, rules, or regulations may subject it to inquiries, examinations, and investigations that could result in requirements to modify or cease certain operations or practices, significant liabilities, or regulatory fines, penalties, or other sanctions. Any of these could damage Truist’s reputation and otherwise adversely affect its business, financial results, and financial condition.

Truist Financial Corporation 29

In recent years, well-publicized incidents involving the inappropriate disclosure, collection, use, sharing, storage, and other processing of personal information have led to expanded governmental scrutiny of practices relating to the safeguarding of personal information by companies. That scrutiny has in some cases resulted in, and could in the future lead to, the adoption of stricter statutes, rules, and regulations relating to the disclosure, collection, use, sharing, storage, and other processing of personal information. Truist will likely be subject to new and evolving data privacy, data protection, and cybersecurity statutes, rules, and regulations in the U.S. and abroad, which could result in additional costs of compliance, litigation, regulatory fines, and enforcement actions. These types of statutes, rules, and regulations could prohibit or significantly restrict financial services firms such as Truist from sharing information among affiliates or with third parties or could restrict Truist’s use of personal information when developing, offering, or marketing products or services to clients.

For more information concerning our legal and regulatory obligations with respect to data privacy, data protection, and cybersecurity, please see “Privacy, Data Protection, and Cybersecurity” in Item 1 “Business.”

The use of AI in our products and services, as well as our business and the industry more broadly, may negatively impact our business, operations, financial condition, results of operations, prospects, and reputation.

Our industry is subject to rapid and significant technological change. To compete effectively, the Company uses new and evolving technologies, including AI, to help improve our marketing, referrals, products, services, and client service, to increase productivity for internal code and software development and testing, and to automate certain business decisions and risk management practices, such as fraud identification. The Company's use of AI is subject to risks that models, prompts, algorithms, and datasets, as well as related decisions, predictions, analysis, and other output, are flawed, inaccurate, of poor quality, insufficient, biased, or otherwise erroneous or inadequate, any of which may not be easily detectable. In addition, the models and processes relating to AI are not always transparent, which could increase the risk of unintended deficiencies. Ineffective implementation of AI by us or our third-party providers could subject us to additional risks that we cannot adequately predict or mitigate. Further, inappropriate or controversial data practices by developers and end-users, or other factors adversely affecting public opinion of AI and machine learning, could impair the acceptance and use of AI. If any of these risks are realized, we could suffer business and operational disruptions, operational inefficiencies, competitive harm, legal liability, increased regulatory scrutiny, reputational harm, or other consequences that the Company cannot predict, any of which could negatively affect the Company's financial condition and results of operations.

Regulatory and other legal frameworks surrounding AI continue to evolve and remain uncertain. If we do not have sufficient rights to use models, prompts, algorithms, and datasets on which our AI technologies rely or the related decisions, predictions, analysis, or other output, we could incur significant damages, substantial fees, deprivation of access, or considerable expense through a violation of applicable law, third-party intellectual property, privacy, or other rights, or other violations. New or changing statutes, regulations, or industry standards and practices may increase costs, restrict use cases, or require significant changes to our deployment or our existing systems and controls. If we fail to appropriately respond to changes within the AI landscape, including changing public sentiment, we could face legal, regulatory, or brand and stakeholder risk that may negatively impact our business, operations, financial results, financial condition, or reputation. In addition, the use of AI by companies has resulted in, and may in the future result in, cybersecurity breaches, attacks, and other similar incidents as well as data privacy violations.

Operational Risks

Truist relies on third parties to support key components of the Company’s business and operational infrastructure, and their failure to perform to our standards or our failure to appropriately assess and manage these relationships could adversely affect us.

Third parties support key components of the Company’s business and operational infrastructure, including certain aspects of our technology functions, and while we have implemented a third-party risk management program designed to identify, assess, monitor, and mitigate third-party risks, we do not control our third-party service providers, their actions, or their businesses. No assurance can be provided that third-party service providers will perform to our standards, adequately represent our brand, comply with applicable law, appropriately manage their own risks, including cybersecurity, remain financially or operationally viable, abide by their contractual obligations, or continue to provide us with the services that we require.

Our use of third-party service providers exposes us to the risk that such third parties may not comply with their contractual obligations to us and to the risk that we may not satisfy applicable regulatory responsibilities regarding the management and oversight of third parties. We may need to incur substantial expenses to address risks or issues with a service provider, and if such risks or issues cannot be acceptably resolved, we may not be able to timely or effectively replace the service provider due to contractual restrictions, the unavailability of acceptable alternative providers, or other reasons. In addition, a failure to appropriately assess and manage our relationships with third parties, especially those supporting significant banking functions, shared services, or other critical activities, could adversely affect Truist by resulting in potential harm to clients and any liability associated with that harm; supervisory actions, regulatory fines, penalties, or other sanctions; lower revenues and the opportunity cost from lost revenues; increased operational costs; or harm to Truist’s reputation.

30 Truist Financial Corporation

The Company is not insured against all types of losses as a result of third-party-related failures, and the insurance coverage that does exist may be inadequate to protect the Company from all resulting losses, including business or operational interruptions or increased costs of doing business.

The Company’s risk and control framework may fail to identify, assess, monitor, and mitigate the risks we face and cause us to suffer unexpected losses that could adversely affect our business, financial condition, results of operations, prospects, and reputation.

Truist has policies, processes, and procedures intended to identify, assess, monitor, and mitigate risks impacting the Company and to evaluate mitigating controls in place. Our risk and control framework, however, cannot guarantee that we will adequately or effectively identify, assess, monitor, and mitigate current business, operational, or other risks, or that we will adequately or effectively identify, assess, monitor, and mitigate such risks in the future. For example, some of the Company’s methods of identifying, assessing, monitoring, and mitigating risk are based upon the Company’s use of observed market behavior and management’s judgment. These methods may not accurately predict future exposures, which could be significantly greater than historical measures indicate. Moreover, as the risks we face continue to evolve, despite our ongoing efforts to improve the design and implementation of our risk framework, those efforts may not be adequate or effective. If the Company’s risk and control framework fails to enable us to identify, assess, monitor, and mitigate the risks we face, we could suffer unexpected losses and our business, financial condition, results of operations, prospects, and reputation could be materially and adversely affected.

Truist can be negatively affected if it fails to identify and address operational and compliance risks associated with the introduction of or changes to products, services, and delivery platforms.

When Truist launches a new product or service (including digital offerings), introduces a new platform for the delivery or distribution of products or services (including mobile connectivity, electronic trading, and cloud computing), acquires or invests in a business or makes changes to an existing product, service, or delivery platform, it may not fully appreciate or identify new operational and compliance risks that may arise from those changes or may fail to implement adequate controls to mitigate the risks associated with those changes. Any significant failure in this regard could diminish Truist’s ability to operate one or more of its businesses or result in potential liability to clients and counterparties, increased operating expenses, or lost revenue. The Company could also experience higher compliance or litigation costs, including regulatory fines, penalties and other sanctions, reputational harm, impairment of its financial condition, regulatory scrutiny, or weaker competitive standing. Any of the foregoing consequences could adversely affect Truist’s business and results of operations.

Truist is subject to risks related to originating and selling loans, including repurchase and indemnification obligations, which may adversely affect our business, results of operations, and financial condition.

When loans are sold or securitized, including to GSEs, it is customary to make representations and warranties to the purchaser about the loans—including their quality, the manner in which they were originated and underwritten, and compliance with applicable law—and to agree to repurchase the loans or indemnify the purchaser in the event of a breach of the representations or warranties or other provisions of the sale agreement. An increase in the number of repurchase and indemnity demands from purchasers on sold loans could result in an increase in the amount of losses for loan repurchases, which may adversely affect our business, results of operations, and financial condition. Truist also bears a risk of loss from borrower defaults for multi-family commercial mortgage loans sold to FNMA.

The ability to manage these risks is expected to affect whether Truist sells and securitizes loans and receivables in the future. Other factors influencing such a decision may include the overall credit quality of its loans and receivables, the costs of selling or securitizing its loans and receivables, the demand for bulk sales and asset-backed securities, and the legal, regulatory, accounting, or tax rules affecting these transactions. In addition, proposals regarding reform to the U.S. housing finance market could impact our decisions regarding which loans should be sold or securitized in the future.

Truist faces loan servicing risks that could adversely impact the Company’s business, operations, liquidity, and results of operations.

The Company acts as servicer for a range of assets, primarily loans in securitizations and unsecuritized loans owned by investors. As servicer for loans, the Company has certain contractual obligations to the securitization trusts, investors, or other third parties, including foreclosing on collateral that secure defaulted loans or, to the extent consistent with the applicable securitization or other investor agreement, considering alternatives to foreclosure such as loan modifications or short sales. Generally, the Company’s servicing obligations are set by contract, for which the Company receives a contractual fee. However, GSEs can amend their servicing guidelines unilaterally for certain government guaranteed mortgages, which can increase the scope or costs of the services required without any corresponding increase in the Company’s servicing fee. Federal and state laws that impose additional servicing requirements could increase the scope and cost of the Company’s servicing obligations. As a servicer, the Company also advances expenses on behalf of securitization trusts and investors, which it may be unable to collect. Any increase in servicing obligations without a corresponding increase in servicing fees or required advances of expenses that are not reimbursed could reduce liquidity and increase operational strain.

Truist Financial Corporation 31

A material breach of the Company’s obligations as servicer may result in contract termination if the breach is not cured within a specified period of time following notice, causing the Company to lose servicing income. In addition, the Company may be required to indemnify the securitization trust or other holder of the loan against losses from any failure by the Company to perform its servicing obligations or any act or omission on the Company’s part that involves willful misfeasance, bad faith, or gross negligence. For certain securitization trusts or investors and certain transactions, Truist may be contractually obligated to repurchase a loan or reimburse the securitization trust or the investor for credit losses incurred on the loan as a remedy for servicing errors with respect to the loan. Such indemnification or repurchase obligations could require significant cash outflows, reduce liquidity, and increase earnings volatility. The Company may be subject to increased repurchase or indemnity obligations as a result of claims made that the Company did not satisfy its obligations as a servicer. The Company may also experience increased loss severity on repurchases, which may require a significant increase to the Company’s repurchase reserve and negatively affect results of operations. While the number of such indemnification claims has been small, these could increase in the future.

Compliance, Regulatory, and Legal Risks

Truist is subject to extensive and evolving government regulation and supervision, which could adversely affect our business, financial condition, results of operations, and prospects.

The banking and financial services industries are highly regulated. Truist is subject to supervision, regulation, and examination by the FRB, the FDIC, the NCCOB, the SEC, the CFTC, the CFPB, FINRA, the MSRB, the NFA, and various other federal and state regulatory agencies. The regulatory and supervisory framework applicable to banking organizations is intended primarily for the protection of depositors and other customers, the DIF, and the role and stability of the U.S. financial system, rather than for the protection of shareholders and non-deposit creditors. In addition to banking statutes and regulations, Truist is subject to various other laws that directly or indirectly affect its business and operations, including the products and services it may offer and the manner in which it may offer them and its ability to make distributions to shareholders.

The regulation and supervision of Truist significantly affects the way that we conduct our business and operations. Statutes and regulations that are applicable to us, and Truist’s inability to act in certain instances without receiving prior regulatory approval, affect Truist’s lending and deposit practices, capital structure, investment practices, dividend policy, ability to repurchase common stock, ability to pursue strategic acquisitions, and other activities. Regulatory policies and supervisory expectations can have this effect as well. Changes to statutes, regulations, or regulatory policies or their interpretation or implementation by supervisors or other governmental authorities can affect Truist in substantial and unpredictable ways. We have in the past and may in the future be subject to formal or informal enforcement or supervisory actions as a result of one or more of our supervisors determining that we have failed to comply with applicable law, comport with safe and sound practices, or meet supervisory expectations. These actions, some of which are considered confidential supervisory information, can result in higher capital and liquidity requirements, higher deposit insurance premiums, higher compliance expenses, changes to our business or operations, and monetary penalties. These actions also can negatively impact the products and services that we offer and our ability to engage in business opportunities. The restrictions imposed by any of these actions could have an adverse effect on our strategy, profitability, and reputation.

Truist has elected to be treated as an FHC, which permits us to engage in a number of financial and related activities beyond banking such as securities underwriting and merchant banking. FHCs and their IDI subsidiaries are subject to ongoing requirements to continue to qualify as an FHC. If an FHC or any of its IDIs were found not to be well-capitalized or well managed as defined by applicable law, the FRB may impose corrective capital and managerial requirements on the FHC, which could impact resources and limit amounts otherwise available to creditors and shareholders. In such a situation, the FRB may also place limitations on the ability of the FHC to conduct certain business activities that FHCs are generally permitted to conduct as well as the FHC’s ability to make certain acquisitions. If the failure to meet these standards persists, the FHC may be required to divest its IDI subsidiaries or cease all activities other than those activities that may be conducted by BHCs that are not FHCs. Furthermore, if an IDI subsidiary of an FHC has not maintained a satisfactory CRA rating, the FHC would not be able to commence any new financial activities or acquire a company that engages in such activities, although the FHC would still be allowed to engage in activities closely related to banking and make investments in the ordinary course of conducting banking activities.

U.S. BHCs, including Truist, are subject to a range of prudential standards and requirements based on their size and complexity. Truist is subject to more stringent liquidity and capital requirements, leverage limits, internal and supervisory stress testing requirements, single-counterparty credit limits, resolution planning requirements, and enhanced risk management standards compared to smaller institutions, while certain larger or more complex banking organizations are subject to even more stringent prudential standards and requirements than Truist. These differing standards and requirements can put Truist at a competitive disadvantage compared to other banking organizations.

32 Truist Financial Corporation

Financial regulators’ prudential and supervisory authority gives them broad power and discretion to direct Truist’s actions, and they have assumed an active oversight, examination, and enforcement role across the financial services industry on both the federal and state levels. Areas of focus in the recent past have included fair access to banking, deposits, interest-rate risk management, commercial real estate, risk governance and controls, capital, liquidity, long-term debt requirements, consumer loan practices, data privacy, data protection, cybersecurity, overdraft and other fees, retention and recordkeeping of electronic communications, reimbursement for fraudulent transactions, and other compliance matters.

The content of the regulatory framework and the intensity of supervision have in the past and are likely in the future to vary over time based on factors such as prevailing economic and political conditions, the policy preferences of the relevant government agencies, the perceived performance of the financial services industry, the size of the company, and the jurisdiction in which a company is organized or operates. This variation has in the recent past and may in the future be frequent and volatile. In times of heightened legislative, regulatory, or supervisory focus on the financial services industry, the Company and other large financial institutions are subject to increased scrutiny, more intense supervision and regulation, and more supervisory findings and actions, with increased operational and compliance costs as well as impacts on business and geographic expansion and acquisitions. The financial services industry also has faced and may continue to face varying degrees of enforcement of laws at federal, state, and local levels—particularly in connection with business and other practices that may harm or appear to harm consumers or affect the financial system more broadly.

Truist expects to remain subject to extensive regulation and supervision. Our regulatory and supervisory environments, whether at federal, state, or local levels, are not static. No assurance can be given that applicable laws and policies will not be amended or construed differently, that new laws and policies will not be adopted, or that any of these laws and policies will not be enforced more aggressively, including as a result of changes to control of branches of the U.S. government. Moreover, political and policy goals of elected and appointed officials may change over time, which could impact the rulemaking, supervision, examination, and enforcement priorities of federal and state regulators. It is possible that expected changes in law and policy do not occur or are reversed subsequently or that the regulatory measures ultimately adopted deliver fewer or no competitive advantages to us and significant competitive advantages to financial services providers that are larger or smaller, are structured differently, or serve different markets than us. Truist could become subject to future legislation and regulatory requirements beyond those currently proposed, adopted, or contemplated in the U.S. or abroad, including limits on acquisitions, more stringent capital and liquidity requirements, and policies and rulemaking related to emerging technologies such as stablecoins and digital assets, cybersecurity, and AI and data. The cumulative effect of such legislation and regulations on Truist’s business, operations, and profitability cannot be accurately predicted, but any of these impacts would likely necessitate changes to Truist’s existing regulatory compliance and risk management infrastructure and could result in increased compliance costs. Such legislation and regulation also may reduce Truist’s revenues, limit the types of financial services and products it may offer, alter the investments it makes, affect the manner in which it operates its businesses, increase its litigation and regulatory costs, and enhance the ability of nonbanks to offer competitive financial services and products. Further, our noncompliance with applicable laws, whether as a result of changes in interpretation or enforcement, system or human errors, or otherwise and, in some cases, regardless of whether noncompliance was inadvertent, can result in the suspension or revocation of authority to conduct business operations and in the initiation of supervisory actions, enforcement proceedings, or private litigation.

Truist also relies upon third parties who may expose the Company to compliance and legal risk.

The Company may incur damages, fines, and penalties and face other negative consequences from supervisory actions and regulatory or other legal violations, including inadvertent or unintentional violations.

Truist’s compliance risks relate to a wide variety of statutes, rules, regulations, and other laws spanning its lines of business, corporate functions, and jurisdictions, including risks related to financial products and services, relationships and interactions with clients, teammate activities, anti-money laundering compliance, trading activities, and market conduct. Compliance risk is also inherent in Truist’s fiduciary activities, including applicable requirements to act in the best interest of fiduciary clients and to treat fiduciary clients fairly.

Truist maintains systems and procedures designed to support its compliance with applicable statutes, regulations, and other laws, but there can be no assurance that these systems and procedures will be effective. In addition to fines and penalties, the Company may suffer other negative consequences from supervisory actions and regulatory violations, including restrictions on certain activities and damage to the Company’s reputation, which in turn might adversely affect the Company’s business and results of operations.

Truist Financial Corporation 33

Federal and state law grants substantial enforcement and supervisory powers to federal and state regulators and law enforcement agencies if they determine that regulated entities have failed to comply with applicable law, comport with safe and sound practices, or meet supervisory expectations. This enforcement and supervisory authority includes the ability to assess significant civil or criminal monetary penalties, fines, or restitution; to issue cease and desist or removal orders; to issue formal and informal enforcement orders; and to initiate injunctive actions against banking organizations and institution-affiliated parties. Additionally, actual or alleged misconduct by teammates, including unethical, fraudulent, improper, or illegal conduct, or unfair, deceptive, abusive, or discriminatory practices, can result in litigation, government investigations, and enforcement actions and cause significant reputational harm to Truist, even if allegations are ultimately unsubstantiated. In addition, governmental authorities have, at times, sought criminal penalties against companies in the financial services sector for violations, and, at times, have required an admission of wrongdoing, criminal pleas, or other extraordinary terms from financial institutions in connection with resolving such matters. Criminal convictions or criminal pleas or admissions of wrongdoing in a settlement with the government can lead to greater exposure in civil litigation, reputational harm, and other significant collateral consequences, such as restrictions on engaging in new activities or acquisitions, loss of clients, restrictions on the ability to access the capital markets, and the inability to operate certain businesses or offer certain products for a period of time.

The Company is regularly subject to regulatory investigations, examinations, and other initiatives by governmental authorities that, if adversely determined against the Company, may subject us to litigation, settlements, fines, penalties, or other sanctions and may require us to engage in remediation, provide restitution to clients, restructure our operations and activities, or cease offering certain products or services. Any of these potential outcomes could harm the Company’s business, financial condition, results of operations, prospects, or reputation or could result in collateral or ancillary consequences. In addition, our exposure to legal and regulatory matters can be unpredictable and could, in some cases, exceed the Company’s accruals for those matters.

Pending or threatened legal proceedings and other matters may adversely affect the Company’s business, financial condition, results of operations, prospects, and reputation.

In the ordinary course of its business, the Company is subject to lawsuits, claims, and formal and informal enforcement activity, including regulatory investigations, either directly or indirectly through our ownership interests in other entities. The volume of legal proceedings against participants in the financial services industry, including the Company, is substantial, and enforcement actions by regulatory authorities can vary with the regulatory environment. Legal proceedings against financial services firms may increase depending on factors such as prevailing economic and political conditions, the policy preferences of the relevant government agencies, and changes in law.

Heightened regulatory scrutiny or the results of an investigation or examination may lead to additional regulatory investigations or enforcement actions. Those actions could result in regulatory settlements or enforcement orders against Truist. Furthermore, a single event involving a potential violation of law may give rise to numerous and overlapping investigations and proceedings by multiple federal and state agencies and officials. In addition, if one or more financial institutions are found to have violated a law relating to certain business activities, this could lead to investigations by regulators or other governmental agencies of the same or similar activities by other financial institutions, including Truist, and large fines and remedial measures that may have been imposed in resolving earlier investigations for the same or similar activities at other financial institutions may be used as the basis for future settlements.

Truist can also be subject to lawsuits, claims, and enforcement activity indirectly through its ownership of interests in other entities. These other entities can themselves be subject to government regulation, supervision, and examination, and determinations that they have failed to comply with applicable law, comport with safe and sound practices, or meet supervisory expectations could have negative consequences for Truist, including a decrease in the value of Truist’s investment in the other entity, damage to Truist’s reputation from being an owner or otherwise associated with the other entity, or a requirement for Truist and the other owners to contribute funds to pay for judgments, settlements, fines, or client redress arising from the lawsuits, claims, or enforcement activity. In addition, these determinations could lead to lawsuits, claims, or enforcement activity directly against the owners of the other entity, including Truist.

Claims and legal actions, including class action lawsuits and enforcement proceedings, could involve large monetary amounts and significant defense costs and could result in settlements, judgments, or orders that include penalties, fines, injunctions, or other forms of relief that are adverse to the Company. Responding to inquiries, investigations, lawsuits, and other proceedings is time-consuming and expensive and can divert management attention from Truist’s business and operations.

The outcome of any claims and legal actions, as well as the timing of any ultimate resolutions, may be difficult to predict or estimate. Actual legal and other costs arising from claims and legal actions may be greater than the Company’s accruals. Further, the Company may not have accruals for all claims and legal actions where we face a risk of significant loss. The ultimate resolution of a pending claim or legal action could adversely affect the Company’s results of operations and financial condition or cause significant reputational harm, which may adversely impact the Company’s business and prospects. Further, the Company may be exposed to substantial uninsured liabilities, which could adversely affect the Company’s results of operations and financial condition. Refer to the “Legal Proceedings and Other Legal Matters” section in “Note 16. Commitments and Contingencies” for additional information.

34 Truist Financial Corporation

Regulatory capital and liquidity standards applicable to large banking organizations and future revisions to existing standards may negatively impact our business, financial results, financial condition, growth, profitability, or our ability to return capital to shareholders.

Truist and Truist Bank are subject to risk-based and leverage regulatory capital requirements, which are established by the FRB for Truist and by the FDIC for Truist Bank. Failure of an FHC or an IDI to be well-capitalized as defined by applicable law or to meet minimum capital requirements can result in enforcement and other supervisory actions and have a significantly adverse impact on the institution’s business and operations. Certain BHCs and their bank subsidiaries, including Truist and Truist Bank, are subject to a minimum LCR and NSFR.

The U.S. risk-based regulatory capital rules are based on the Basel Framework developed by the BCBS for strengthening the regulation, supervision, and risk management of banks as well as certain provisions of the Dodd-Frank Act. These rules prescribe minimum capital levels and allow the FRB and the FDIC to impose incremental capital requirements on a banking organization based on its size, complexity, or risk profile to enhance its ability to operate in a safe and sound manner. In several instances, the U.S. banking agencies have applied stricter capital and liquidity standards to U.S. banking organizations.

Requirements to maintain specified levels of capital and liquidity and regulatory expectations as to the quality of the Company’s capital and liquidity may prevent the Company from taking advantage of opportunities in the best interest of shareholders or force the Company to take actions contrary to their interests. For example, Truist may be required to take steps to increase its capital, increase its investment security holdings, or otherwise change aspects of its capital or liquidity measures, including in ways that could be dilutive to shareholders or could limit our ability to pay or increase dividends or to engage in share repurchases. In addition, these requirements may impact the amount and type of loans the Company is able to make. Truist may also be constrained in its ability to expand, either organically or through mergers and acquisitions. These requirements may cause the Company to sell or refrain from acquiring assets where the capital requirements appear inconsistent with the assets’ underlying risks. In addition, liquidity standards require the Company to maintain holdings of highly liquid investments, thereby reducing the Company’s ability to invest in less liquid assets, even if more desirable from a balance sheet return or interest rate risk management perspective. As a Category III banking organization, Truist is subject to additional capital and liquidity requirements. For example, Truist is subject to a requirement to submit capital plans to the FRB for review that include, among other things, projected dividend payments and repurchases of capital stock. As part of the capital planning and stress testing processes, our planned capital actions are assessed against our projected ability to satisfy applicable capital requirements under a hypothetical scenario reflecting severe stress in the broader economy. If we are projected to fail to satisfy applicable capital requirements over the stress test horizon, including the SCB, our ability to undertake capital actions may be restricted.

In addition to the regulatory capital and liquidity requirements applicable to Truist and Truist Bank, the Company’s broker-dealer subsidiaries are subject to capital requirements established by the SEC. Regulatory capital and liquidity requirements receive periodic review and revision by the BCBS and the U.S. banking agencies.

Differences in, or changes to, regulation and supervision and industry disruption can affect the Company’s ability to compete effectively, which may adversely affect our business, financial condition, financial results, or growth.

Because prudential standards and requirements are typically based on the size and complexity of the firm, large institutions, such as the Company, often are subject to more stringent regulatory requirements and supervision than smaller and less complex institutions. Changes in capital requirements, including any easing of capital requirements for our larger bank competitors, may result in increased competition and challenge our ability to execute on our growth strategies and branch expansion.

Competition is arising from limited purpose banks and nonbanks involved in digital assets, stablecoins, cryptocurrencies, tokenization, and similar products, services, and technologies that enable financial services and transactions without or with less intermediation by commercial banks. Stablecoins, digital assets, and distributed ledger technologies are being designed to enable lower-cost payments and transactions, with quicker settlement, that may shift deposits, lending, and payment flows to limited purpose banks and nonbanks. These limited purpose bank and nonbank competitors may not be subject to banking regulation, may be subject to less stringent regulation, or may be supervised by a federal or state regulatory agency that does not have the same regulatory priorities or supervisory requirements as the Company’s regulators. These differences in regulation can impair the Company’s ability to compete effectively with competitors that are less regulated and do not have similar compliance costs.

Actions or initiatives by federal and state governmental authorities, including the U.S. banking agencies, may also provide competitors with increased opportunities to derive competitive advantages and may create new competitors. These actions or initiatives may include more accommodative positions on the processing and approval of traditional bank charters and deposit insurance, expanded access to the banking and payments systems through the approval of competitors, including competitors with novel business models, to hold specialized charters, or more accommodative positions on novel activities performed by banks or nonbanks.

Truist Financial Corporation 35

Truist faces risks of non-compliance and may incur additional operational and compliance costs under laws relating to anti-money laundering, economic sanctions, embargo programs, anti-bribery, and anti-corruption.

Truist must comply with statutes and regulations relating to anti-money laundering, economic sanctions, embargo programs, anti-bribery, and anti-corruption, which increases the risk of non-compliance with applicable law and costs associated with the implementation and maintenance of complex compliance programs. The rapid evolution of technology, including the growth of digital assets, stablecoins, cryptocurrencies, tokenization, and blockchain and other distributed ledger technologies, introduce additional challenges to traditional client due diligence, transaction monitoring, and suspicious activity reporting required by applicable law. The BSA, as amended by the Patriot Act, and its implementing regulations require financial institutions, including IDIs such as Truist Bank, broker-dealers, and other financial institutions, to develop and implement BSA/AML compliance programs that detect and report financial crimes. The BSA and its implementing regulations also strengthen the ability of U.S. law enforcement agencies and the intelligence community to disrupt and prevent money laundering, the financing of terrorism, and related crimes. In addition, U.S. persons, including entities like Truist, must comply with sanctions programs administered by OFAC and the U.S. Department of State. These sanctions programs prohibit, among other things, financial transactions involving certain individuals, entities, countries, and territories that are the subject of U.S. economic sanctions and impose other restrictions on certain investments and dealings, including requirements to block assets.

Federal law grants substantial enforcement powers to U.S. banking agencies, FinCEN, OFAC, the U.S. DOJ, and other government agencies with respect to BSA and OFAC compliance, including through examination and ongoing monitoring. This enforcement authority includes the ability to assess significant civil and criminal monetary penalties, fines, and restitution; to issue cease and desist or prohibition orders; to initiate injunctive actions against financial institutions and institution-affiliated parties; and to impose restrictions on business, including bank and BHC mergers and acquisitions. These enforcement actions may be initiated for violations of statutes and regulations or for unsafe and unsound practices and could result in substantial negative shareholder reaction, reputational damage, and adverse effects on our financial condition and results. Given the rapid development and cross-border nature of these criminal activities that are enabled by evolving technologies, any failure to adapt and modernize our BSA/AML compliance program, processes, and procedures may result in material compliance gaps, adverse enforcement actions, and civil and legal penalties.

Strategic Risks

Ineffective execution of strategic initiatives could adversely affect investor sentiment and the Company’s business, financial condition, results of operations, prospects, and reputation.

There is no guarantee that our strategic initiatives, including initiatives to drive focused growth, deepen relationships with clients, increase client acquisition, and enhance digital engagement with clients, will be successful and improve profitability or allow us to return capital to shareholders. Our execution of strategic initiatives may be impacted by internal factors, such as maintaining a level of earnings appropriate to support growth objectives, the ability to maintain dividends in various economic cycles, or the successful delivery of innovation and technology strategies. In addition, the execution of our strategies may be impacted by our response to external factors, including geopolitical, macroeconomic, social, cultural, competitive, and regulatory factors. To the extent we are impeded or unable to execute effective strategic initiatives, our business, results of operations, financial condition, prospects, and reputation could be adversely affected.

Competition may reduce Truist’s client base or cause Truist to modify the pricing or other terms for products and services, or require significant investments to maintain competitiveness, which could have an adverse impact on our business and financial results.

Truist operates in a highly competitive industry that is expected to become even more competitive with growth in areas such as digital financial service providers and other nonbank platforms. In many cases, Truist competes against larger banks with greater scale and deposits than Truist. These advantages can enable competitors to more aggressively price, reduce costs, and invest in new technology. Increased competition also arises from technological advancements, legislative and regulatory changes, as well as competition from other financial services companies, some of which may be subject to less extensive regulation than Truist. The Company’s success depends, in part, on the Company’s ability to adapt its offering of products and services to evolving industry standards and client expectations, including with respect to digital offerings and assets, such as stablecoins, cryptocurrencies, and tokenized assets more broadly. The widespread adoption of new technologies has required and will continue to require substantial investments to modify existing products and services or to develop new products and services. In addition, there is increasing pressure to provide products and services at lower prices further reducing contribution margins. The Company may not be successful in introducing new products and services in response to industry trends or developments in technology or those new products may not achieve market acceptance.

36 Truist Financial Corporation

Truist also competes with nonbank companies and, in some cases, with companies other than those traditionally considered financial sector participants. In particular, fintechs are increasingly focusing on the financial sector, either in partnership with competitor banking organizations or on their own, including potentially through limited-purpose bank or trust company subsidiaries, and competition from such companies has grown in recent years and is expected to continue growing. In some cases, fintechs have and may continue to offer bank-like products. These companies generally are not subject to the same regulatory oversight as main street financial institutions and may accordingly realize certain cost efficiencies and offer bank and bank-like products and services at more favorable rates and with greater convenience to the client. This competition could result in the loss of clients, deposits, and revenue in areas where fintechs are operating. As the pace of technology and change advance, continuous innovation is expected to exert long-term pressure on the financial services industry.

The adoption of new technologies by competitors, including internet banking services, mobile applications, advanced ATM functionality, digital assets, tokenization, stablecoins and cryptocurrencies, and similar products, services, and technologies that enable financial services and transactions without or with less intermediation by commercial banks, is likely to require the Company to make substantial investments to modify or adapt the Company’s existing products and services or even radically alter the way Truist conducts business. These and other capital investments in the Company’s business may not produce expected growth in earnings anticipated at the time of the expenditure. If we are unable to successfully adopt and implement new technologies in a way that meets customer and industry demand, we may lose market share or deposits, including as a result of financial disintermediation.

Acquisitions, mergers, and divestitures introduce a broad range of anticipated and unanticipated risks, including unforeseen or negative consequences from supervisory or regulatory action that may limit Truist’s ability to pursue and complete them, which may impair the Company’s ability to expand or grow its client base, or execute on its strategic initiatives and compete effectively.

We may from time to time seek to acquire other financial-services companies or businesses. Acquisitions involve numerous risks and uncertainties, including inaccurate financial and operational assumptions, incomplete or failed due diligence, lower than expected performance or synergies, higher than expected costs, difficulties related to integration, diversion of management’s attention from other business activities, adverse market or other reactions, changes in relationships with clients or counterparties, the potential loss of key personnel, and the possibility of litigation and other disputes. An acquisition also could be dilutive to our existing shareholders if we were to issue common stock to fully or partially pay or fund the purchase price. We, moreover, may not be successful in identifying appropriate acquisition candidates, integrating acquired companies or businesses, or realizing expected value from acquisitions. There is significant competition for valuable acquisition targets, and we may not be able to acquire other companies or businesses on attractive terms. No assurance can be given that we will pursue future acquisitions, and our ability to grow and successfully compete may be impaired if we choose not to pursue or are unable to successfully make acquisitions.

Under the BHCA, a BHC may not directly or indirectly acquire ownership or control of more than 5% of the voting shares or substantially all of the assets of any BHC or bank or merge or consolidate with another BHC without the prior approval of the FRB. The BHCA and other federal laws enumerate the factors the FRB must consider when reviewing the merger of BHCs, the acquisition of banks, or the acquisition of voting securities of a bank or BHC. These factors include the competitive effects of the transaction in the relevant geographic markets; the financial and managerial resources and future prospects of the companies and banks involved in the transaction; the effect of the transaction on the financial stability of the U.S.; the organizations’ compliance with anti-money laundering statutes and regulations; the convenience and needs of the communities to be served; and the records of performance under the CRA of the IDIs involved in the transaction. In addition, U.S. regulators must take systemic risk to the U.S. financial system into account when evaluating whether to approve a potential acquisition transaction involving a large financial institution like Truist. There is no certainty as to when or if or on what terms and conditions any required regulatory approvals will be granted for any potential acquisition. In specific cases, Truist may be required to divest certain operations, including branches, or take other actions as a condition to receiving regulatory approval. The standards by which bank and financial institution acquisitions are evaluated may be subject to change, and it may be unclear how revised guidelines and frameworks for reviewing such acquisitions will be applied. Refer to the “Regulatory and Supervisory Considerations” section in “Item 1. Business” for additional details related to other factors and limitations related to potential BHC acquisitions. An inability to satisfy other conditions necessary to consummate an acquisition transaction, such as third-party litigation, a judicial order blocking the transaction, or lack of shareholder approval, could also prevent the Company from completing an announced acquisition.

Truist Financial Corporation 37

In addition, we may decide to divest certain businesses or assets. Divestitures of businesses involve a number of risks, including significant costs and expenses, and any divestiture we undertake could adversely affect our business, financial condition, results of operations, and cash flows. Divestitures may involve significant uncertainty and execution complexity, which may cause us not to achieve our strategic objectives, realize expected cost savings, or obtain other benefits from the divestiture. The significant risks and uncertainties involved in divestitures may include:

•the inability to sell such businesses or assets at satisfactory prices and terms and in a timely manner, including potentially long and costly sales processes and unsuccessful attempts by a buyer to receive required regulatory approvals, satisfy other conditions to closing, or obtain equity or debt financing in order to satisfy its payment obligations related to the transaction,

•disruption to other parts of our business and distraction of management,

•loss of key teammates or clients,

•exposure to contingencies, including, among other things, those arising from representations and warranties made to a buyer regarding the businesses being sold, or

•ongoing obligations to support the businesses following such divestitures, including through transition services arrangements, and other adverse financial impacts.

Whether such divestitures are completed or not, their pendency could have a number of negative effects on our current business, including potentially disrupting our regular operations and diverting the attention of our workforce and management team. Divestitures could also disrupt existing business relationships, make it harder to develop new business relationships, or otherwise negatively impact the way that we operate our business. If a divestiture transaction is terminated before it is consummated, the payment of a termination fee by the purchaser may not fully compensate us for our losses.

Truist has businesses other than banking that are subject to a variety of risks that may affect our financial condition and results of operations.

Truist is a diversified financial services company. This diversity subjects the Company’s earnings to a broader variety of risks and uncertainties. Other businesses in addition to banking that the Company operates include investment banking, securities underwriting and market making, loan syndications, investment management and advice, and retail and wholesale brokerage services offered through the Company’s subsidiaries. These businesses entail significant market, operational, credit, compliance, technology, legal, and other risks that could adversely impact the Company’s financial condition and results of operations.

Risks Related to Estimates and Assumptions

Truist’s business and operations rely significantly on the use of models, and any deficiencies in the design, implementation, or use of models could adversely affect our business, results of operations, and financial condition.

Truist relies on models to measure risks, estimate certain financial values, and inform certain business decisions, including AI models. Models may be used in such processes as determining the pricing of various products, grading loans and extending credit, measuring interest rate and other market risks, predicting or estimating losses, assessing capital adequacy and calculating economic and regulatory capital levels, as well as estimating the value of financial instruments and balance sheet items.

Models involve significant judgment and have inherent limitations. Poorly designed, implemented, monitored, used, or interpreted models have in the past and may in the future negatively affect our business and results of operations. For example, models can be ineffective due to erroneous or inadequate data, flawed formulas or algorithms, limited or inapt historical patterns, changes in correlations, extreme or unanticipated market movements, or unexpected client behavior or illiquidity, especially during severe market downturns or stress events (e.g., geopolitical or pandemic events). Also, information Truist provides to the public or to its regulators based on poorly designed, implemented, or incorrectly used models could be inaccurate or misleading. Certain decisions that the regulators make, including those related to capital distributions to Truist’s shareholders, could be adversely affected due to the perception of insufficient model quality or incorrect model use.

Truist employs estimates and assumptions to determine the value or amount of many of our assets and liabilities, and if these estimates or assumptions prove inaccurate, our business, financial condition, results of operations, and prospects could be adversely affected.

Accounting policies and processes are fundamental to how the Company records and reports its financial condition and results of operations. Some of these policies require the use of estimates and assumptions that may affect the value of the Company’s assets or liabilities and financial results. Several of the Company’s accounting policies are critical because they require management to make difficult, subjective, and complex judgments about matters that are inherently uncertain and because it is likely that materially different amounts would be reported under different conditions or using different assumptions. If assumptions or estimates underlying the Company’s financial statements are incorrect or are adjusted periodically, the Company may experience material losses.

38 Truist Financial Corporation

Management has identified certain accounting policies as being critical because they require management’s judgment to ascertain the valuations of assets, liabilities, commitments, and contingencies. A variety of factors could affect the realization of income and expense or the recognition of assets and liabilities in the Company’s financial statements. Truist has established policies and procedures that are intended to provide for these critical accounting estimates and judgments to be well-controlled and applied consistently. In addition, the policies and procedures are intended to establish a process for changing methodologies in an appropriate manner. Due to the uncertainty surrounding the Company’s judgments and the estimates pertaining to these matters, the Company cannot guarantee that adjustments to accounting policies or restatement of prior period financial statements will not be required.

Further, from time to time, the FASB and SEC adopt new accounting standards or change existing financial accounting and reporting standards that govern the preparation of the Company’s financial statements. In addition, accounting standard setters and those who interpret the accounting standards may change or even reverse their previous interpretations or positions on how these standards should be applied. Changes in financial accounting and reporting standards and changes in current interpretations may be beyond the Company’s control, can be hard to predict, and could materially affect how the Company reports its financial results and condition. In some cases, the Company could be required to apply a new or revised standard retroactively, resulting in the restatement of prior period financial statements.

Depressed market values for the Company’s stock and adverse economic conditions sustained over a period of time may require the Company to write down all or some portion of the Company’s goodwill.

Goodwill is periodically tested for impairment by comparing the fair value of each reporting unit to its carrying amount. If the fair value is greater than the carrying amount, then the reporting unit’s goodwill is deemed not to be impaired. The fair value of a reporting unit is impacted by, among other factors, the reporting unit’s expected financial performance and susceptibility to adverse economic, regulatory, and legislative changes. The Company incurred a $6.1 billion non-cash, nondeductible goodwill impairment charge for the year ended December 31, 2023 based on the carrying values of certain reporting units being in excess of their respective fair values. Future adverse changes in economic conditions or expected financial performance, a sustained decrease in Truist’s stock price, a decline in industry peer multiples, an increase in the applicable discount rate, or a deterioration in a reporting unit’s forecast may cause the fair value of a reporting unit to be below its carrying amount, resulting in an additional goodwill impairment charge. The estimated fair values of the individual reporting units are assessed for reasonableness by reviewing a variety of indicators, including comparing these estimated fair values to the Company’s market capitalization over a reasonable period of time. While this comparison provides some relative market information about the estimated fair value of the reporting units, it is not determinative and needs to be evaluated in the context of the current economic environment. However, significant and sustained declines in the Company’s market capitalization could be an indication of potential goodwill impairment. Refer to the “Critical Accounting Policies” section in MD&A for additional details related to the Company’s intangible assets and goodwill.

Additional Risks

Negative public opinion, whether or not warranted, could damage the Company’s brand in the market and relationships with stakeholders, and adversely impact our business, financial condition, results of operations, and prospects.

Truist’s earnings, capital, and stock price are subject to risks associated with negative public opinion. Negative public opinion could result from the Company’s actual or alleged conduct or activities, including lending, sales, training, quality assurance, client complaint resolution, and other operating practices, incentive compensation design and governance, corporate governance, acquisitions, the disclosure, collection, use, sharing, storage, and other processing of client or teammate information, client expectations regarding any product or service provided by the Company, and the Company’s ability to comply with applicable statutes or regulatory requirements or related to new or changed business activities. There can be no assurance that the Company’s conduct and activities will meet regulatory or other stakeholders’ standards or expectations. Negative public opinion could result based on allegations that are factually incorrect or arise from isolated incidents.

In addition, the public perception that a cyber-attack on the Company’s systems has been successful, whether or not this perception is correct, may damage the Company’s reputation with clients and third parties with whom the Company does business. Any cybersecurity breaches, attacks, and other similar incidents, including the compromise of personal information, could significantly harm Truist’s reputation, which could adversely affect the Company’s financial condition and results of operations.

Negative public opinion could also result from heightened and differing stakeholder expectations regarding environmental and social considerations that may affect Truist and clients of Truist. Standards and expectations relating to environmental and social matters are evolving and often inconsistent across regulators, investors, clients, and other stakeholders. Actions taken by the Company in these areas may be viewed favorably by some groups and criticized by others, creating tradeoffs that increase compliance, legal, and regulatory risk or cause reputational harm.

Truist Financial Corporation 39

The proliferation of social media and the speed at which information spreads on social media may increase the likelihood that negative public opinion from any real or perceived events relating to the Company could impact our reputation and business. Negative public opinion could adversely affect the Company’s ability to attract and retain clients and teammates and can result in litigation and regulatory actions. Actual or alleged conduct by one of the Company’s businesses can result in negative public opinion about the Company’s other businesses. Actual or alleged conduct by another financial services company can result in negative public opinion about the financial services industry in general and, as a result, adversely affect Truist.

Our efforts to identify, measure, and monitor brand and stakeholder risk and communicate, internally and externally, such risks to key stakeholders may be ineffective, untimely, or otherwise result in adverse effects on the Company.

We could be harmed by an inability to attract, develop, retain, and motivate qualified teammates while effectively managing recruiting and compensation costs amid highly competitive and rapidly changing market conditions.

The Company’s success depends, to a large degree, upon the continued services of executive officers and other key teammates who have extensive experience and expertise in the industry, and the Company’s ability to attract, develop, and retain high performing and well-qualified teammates, particularly those in critical, high-demand roles or possessing specialized skills. The Company faces significant competition in the recruitment of highly motivated teammates who can deliver Truist’s purpose, mission, and values. Changes in Truist’s expectations regarding workstyles and teammate preferences for work environments, including the desire of some teammates to work remotely for some or all of their hours, have been associated with and may continue to be associated with challenges in attracting and retaining teammates. The Company’s business or its ability to execute its strategic initiatives may suffer due to the loss of key or highly-skilled teammates or a failure to successfully transition key roles; if the Company is unable to recruit, develop, or retain a sufficient number of qualified teammates; or if the costs of teammate compensation or benefits increase substantially. The U.S. banking agencies have jointly issued comprehensive guidance to support incentive compensation policies and practices that do not undermine the safety and soundness of banking organizations by encouraging teammates to take imprudent risks. This guidance significantly affects the amount, form, and other terms of incentive compensation that may be provided to teammates and could negatively affect Truist’s ability to compete for talent relative to nonbanking companies or those with different applicable regulations.

In addition, advances in technology, such as automation and AI, may lead us to modify our workforce strategy. This could require Truist to invest in additional teammate training, manage impacts on morale and retention, and compete for candidates who possess more advanced technological skills, all of which could have a negative impact on Truist’s business and operations.

The Company relies on its ability, and the ability of key external parties, to maintain appropriately staffed workforces and on the competence, trustworthiness, health, and safety of teammates.

Truist’s ability to operate its businesses efficiently and profitably, to offer products and services that meet the expectations of its clients, and to maintain an effective risk management framework is highly dependent on its ability to staff its operations appropriately and on the competence, integrity, health, and safety of its teammates. Truist is similarly dependent on the workforces of other parties which support its operations, including vendors and other service providers. Changes in law in jurisdictions in which our operations are located that affect teammates may also adversely affect our ability to hire, develop, and retain qualified teammates in those jurisdictions. In addition, the Company’s business could be adversely impacted by a significant operational breakdown or failure, theft, fraud, or other unlawful conduct, or other negative outcomes caused by human error or misconduct by a teammate of Truist or a teammate of another party which supports Truist’s operations. Truist’s operations could also be impaired if the measures taken by it or by governmental authorities to support the health and safety of its teammates are ineffective, or if any external party which supports Truist fails to take appropriate and effective actions to protect the health and safety of its teammates.

40 Truist Financial Corporation

The Company is at risk of losses from fraud which could result in financial loss and reputational harm.

Increased and evolving activity perpetrated by bad actors intending to defraud, misappropriate property, or circumvent the law using different channels, products, and means may outpace and outmaneuver the Truist control environment and monitoring activities impacting clients, teammates, and stakeholders. Fraud attacks in the banking sector have surged in recent years, driven by increasingly sophisticated and rapid techniques. Many bad actors, often linked to large criminal organizations, share strategies to execute schemes, such as debit and credit card fraud, peer-to-peer payment fraud, counterfeit checks, social engineering attacks (such as phishing and smishing), and ATM skimming, and recent advances in AI may make it easier to engage in such schemes and more difficult to detect fraud. Fraudulent schemes exploit products like real-time payments, ACH, and wire transfers to steal funds. Fraudsters impersonate legitimate clients using stolen identities, employ other individuals to interact with Truist, or create fraudulent identities. In some cases, fraud is even committed by existing clients. The increasing sophistication of AI technologies poses heightened risk of identity fraud as malicious actors may exploit AI to create convincing false identities or manipulate verification processes. A failure to detect, prevent, and address fraud has in the past and could in the future result in financial loss to the Company or its clients, loss of confidence in the Company’s security measures, client dissatisfaction, litigation exposure, regulatory investigations, fines, penalties or intervention, reimbursement, or other compensatory costs (including the costs of credit monitoring services), additional compliance costs, and harm to the Company’s reputation, all of which could adversely affect the Company.

Physical, transition, and other risks associated with climate change, together with governmental responses to such risks, may negatively impact our business, financial condition, operations, reputation, and clients.

Climate change presents physical risks from the direct impacts of changing climate patterns and acute weather events, such as damage to physical assets and service disruptions, and transition risks from changes in regulations, disruptive technologies, and shifting market dynamics towards a lower-carbon economy. The physical risks of climate change include discrete events, such as flooding, hurricanes, tornadoes, and wildfires, and longer-term shifts in climate patterns, such as extreme heat, sea level rise, and more frequent and prolonged drought. Physical risks may alter the Company’s strategic direction in order to mitigate certain financial risks. Such events could also disrupt the Company’s operations or those of its clients or third parties the Company relies on, not only through direct damage to assets, but also from indirect impacts due to supply chain disruption and market volatility. Physical risks ultimately could result in declines in asset values (which could be exacerbated by specific portfolio or geographic concentrations), reduced availability and therefore increased costs of insurance for our clients and third parties, interruptions of supply chains and business operations, and population migration or depressed economies and increased unemployment in affected regions, any or all of which could result in increased credit risk to Truist or have other negative impacts.

Transition risks, including changes in consumer preferences, longer-term shifts in market dynamics, changes in or additional regulatory requirements or taxes, and additional counterparty or client requirements, could have an adverse impact on asset values and the financial performance of Truist’s businesses, and those of its clients, and could be exacerbated in specific industries that may be more sensitive or vulnerable to a transition to a lower-carbon economy. Climate change could also present incremental risks to the execution of the Company’s long-term strategy. While material impact from climate change is expected to occur over a longer time horizon, the acceleration of a transition to a lower-carbon economy could present idiosyncratic risks for individual companies. Additionally, transitioning to a lower-carbon economy will entail extensive policy, legal, technology, and market initiatives. Transition risks could result in the sudden devaluation of assets, increased costs for energy and operations, and therefore could have unforeseen and negative consequences on business models for us, our clients, and other third parties.

Governments have been focused on the effects of climate change and environmental issues, and how they act to mitigate related risks could have an adverse effect on our business and financial results. This focus could ultimately result in legislation or regulations that could, among other things: directly or indirectly compel us to alter our businesses or operations in ways that would be detrimental to our results of operations and prospects; negatively impact our capital plans; or cause us to incur additional capital, compliance, and other costs.

Additionally, the Company faces potential brand and stakeholder risks as a result of its practices related to climate change, including as a result of the Company’s direct or indirect involvement, or lack of involvement, in certain industries, in particular those involved in fossil fuels, as well as any decisions management makes in response to managing climate risk, especially as views on climate-related matters become subject to increased polarization. Conflicting state-level regulation, including with respect to fair access laws, could increase Truist’s compliance costs or risks of non-compliance. Further, there is increased scrutiny of climate change-related policies, goals, and disclosures, which could result in litigation and regulatory investigations and actions or reputational damage. Truist may incur additional costs and require additional resources as it evolves its strategy, practices, and related disclosures with respect to these matters.

Truist Financial Corporation 41

Natural disasters, pandemics, extreme weather events, and other catastrophic events could adversely affect our financial condition and results of operations.

Natural disasters, pandemics, extreme weather events, and other catastrophic events, as well as government actions or other restrictions in connection with such events, could adversely affect the Company’s financial condition and results of operations. The frequency and severity of natural disasters, pandemics, extreme weather events, and other catastrophic events could interrupt Truist’s operations, damage facilities, impair technology and data availability, disrupt third parties and service providers, or limit client access to services. Such events may also strain critical dependencies, including power, telecommunications, transportation, and workforce ability, and reduce loan performance or collateral values. Truist has significant operations and clients along the Gulf and Atlantic coasts as well as other regions of the U.S., which could be adversely impacted by hurricanes, wildfires, flooding, tornadoes, and other severe weather. Rising insurance costs, as well as decreasing insurance provider options and insurance program coverage resulting from natural disasters, extreme weather events, and other catastrophic events could also lead to population migration, or the weakening of economic conditions in certain regions. These events could reduce the Company’s earnings and cause volatility in the Company’s financial results and have an adverse effect on the Company’s business, financial condition, and results of operations. While Truist maintains an enterprise resilience program and other safeguards designed to mitigate the impact of natural disasters, pandemics, extreme weather events, and other catastrophic events, no resilience measures can fully eliminate risk or assure uninterrupted operations during such events.