PNC 10-K & 10-Q changes, risk factors and insider trading

Our business and overall financial performance are affected to a significant extent by economic conditions, primarily in the U.S. Declining or adverse economic conditions and adverse changes in investor, consumer and business sentiment generally result in reduced business activity, which may decrease the demand for our products and services or reduce the number of creditworthy borrowers. The ability of borrowers to repay loans is often weakened as a result of economic downturns, higher inflation and unemployment. In addition, adverse economic conditions may limit the availability of, or increase the costs of, capital and labor, erode consumer and customer purchasing power, confidence and spending and may also reduce our tolerance for extending credit. Increases in costs or expenses impacting our customers’ operations and financial performance, such as the interest rates payable on their debt obligations, could increase our credit risk or decrease the demand for our products and services.

We operate in an uncertain economic environment due to sustained inflationary pressures, including higher prices and lower housing affordability, and structuralfluctuating andtrade secularpolicies changes(including arising from the pandemic for certain sectors of the economytariffs), combined with geopolitical tensions. These conditions have led and may continue to lead to turmoil and volatility in financial markets, often with at least some financial asset categories losing value. Financial market volatility could also result from uncertainty about the timing and extent of rate cuts by the Federal Reserve. Any of these effects would likely have an adverse impact on our operations and financial performance, with the significance of the impact generally The PNC Financial Services Group, Inc. – 2025 Form 10-K 11 depending on the nature and severity of the adverse economic conditions. Even when economic conditions are relatively good or stable, specific economic factors can negatively affect our business and performance. This can be especially true when the factors relate to particular segments of the economy and impact our customers whose operations or financial conditions are directly or indirectly dependentdepend on good or stable conditions in those segments. For example, given the fundamental change in office demand driven by the acceptanceunderutilization of remote work, commercial real estate space remains underutilized. This,space, combined with higher interest rates, likelyhas decreasesharmed some customers’ creditworthiness and ability to refinance maturing loans, and decreased the demand for financial services in that sector and may make it more difficult for borrowers to refinance maturing loans, contributes to decreased property values and harms the creditworthiness of some of our office commercial real estate customers, as well as businesses whose customers have historically been office workers.sector.

Our foreign business activities and operations continue to be a relatively small part of our overall business. As a result, the direct impact on our business and financial performance from economic conditions outside the U.S. is not likely to be significant, although the impact would increase if we expanded our foreign business and operations more than nominally. We are, however, susceptible to the risk that foreign economic conditionsconditions, trade policies (including tariffs) and geopolitical tensions could negatively affect our business and financial performance. Primarily, this risk results from the possibility that poor economic conditions or financial market disruptions affecting other major economies would also affect the U.S. Throughout the remainder of this Risk Factors section, we address specific ways in which economic issues could create risk for us and result in adverse impacts on our business and financial performance.

TheCongress election of a new President together with changes inand the membershipcurrent ofpresidential Congress,administration includinghave changeintroduced inand controlmay of the Senate, will likely leadcontinue to introduce changes in the laws or policies applicable to us and the agencies that regulate us, including their interpretations of rules and guidelines. These changes may subject financial institutions like us to changes in regulation, supervision and enforcement that are difficult to predict and uncertain for a period of time and may create the possibility of significant impacts on business activity in the U.S. and globally, including impacts relating to the trade policies (including tariffs) of the U.S. or other countries.globally. In addition, the application of some laws may require significant judgment and be subject to differing interpretations. Further, some of the laws and regulations finalized in the prior administration that are applicable to financial institutions were modified, rescinded or withdrawn or are subject to ongoing litigationreevaluation, creating further uncertainty.

Concern regarding high and rising federal debt levels and federal budgetary matters (including the debt ceiling), or prolonged stalemates leading to total or partial government shutdowns, also can have adverse economic consequences and create the risk of economic instability or market volatility, with potential adverse consequences to our business and financial performance.

The monetary policies of the Federal Reserve, including changes in the federal funds rate, open market operations and balance sheet management, have a significant impact on interest rates, the value of financial instruments and other assets and liabilities, and overall financial market performance and volatility. These policies, including any resulting changes in economic conditions or in investor sentiment or perceptions,sentiment, can thus affect the activities and results of operations of financial services companies such as PNC.

An important function of the Federal Reserve is to monitor the national supply of bank credit and set certain interest rates. The actions of the Federal Reserve influence the rates of interest that we charge on loans and that we pay on borrowings and interest-bearing deposits. Rates of interest can also affect the value of our on-balance sheet and off-balance sheet financial instruments. AlthoughWe wecannot control and may not accurately predict the nature or timing of future changes in monetary policies or the precise effects that they may have on our activities and financial results,outlook weor anticipate that the FOMC will cut the federal funds rate 25 basis points twice in 2025, once in May and once in July.results. In addition, actions by governmental authorities in other countries, including with respect to monetary policy, could impact financial markets and global interest rates, which could affect rates in the U.S. as well as rates on instruments denominated in currencies other than the U.S. dollar, any of which could have potential effects on us as described above. Some of the potential impacts on our business and results of governmental monetary policy are described in Risk Factors under the heading “Risks Related to the Business of Banking.”

The PNC Financial Services Group, Inc. is a BHC and aan financial holding company,FHC, with the Federal Reserve as its primary regulator. PNC Bank is a federally chartered bank, with the OCC as its primary regulator. In addition, our businesses are subject to regulation by multiple other banking, consumer protection, securities and derivatives regulatory bodies. We are also subject to the jurisdiction of criminal and civil 12 The PNC Financial Services Group, Inc. – 2025 Form 10-K enforcement authorities. As a result, we are subject to numerous laws and regulations, with multiple regulators or agencies having supervisory or enforcement oversight over aspects of our business activities. These laws, regulations and supervisory activities are intended to promote the safety and soundness of financial institutions, the stability of the U.S. banking and financial marketsystem stability,(including protection of the DIF)), the transparency and liquidity of financial markets, and consumer protection and to prevent money laundering and terrorist financing andthat are not primarily 16 The PNC Financial Services Group, Inc. – 2024 Form 10-K intended to protect PNC security holders. In addition to regulation in the U.S., weWe are also subject to foreign regulation to a limited extent as a result of our business activities outside the U.S.

Applicable laws and regulations restrict our permissible activities and require compliance with provisions designed to protect loan, deposit, brokerage, fiduciary, and other customers, and for the protection of customer information, among other things. We also are subject to laws and regulations designed to combat money laundering,laundering and terrorist financing, and restrict transactions with persons, companies or foreign governments designated by U.S. authorities. Over time, the scope of the laws and regulations affecting our businesses, as well as the number of requirements or limitations imposed by legislative or regulatory actions, has increased, and we expect to continue to face substantial regulatory oversight and new or revised regulatory requirements or initiatives, including those related to requirements for the orderly resolution of financial institutions.initiatives. As we expand our product and service offerings into additional markets, domestic or foreign, either through organic growth or acquisition, we have faced and will continue to face increases in state or foreign regulation affecting our operations. Different approaches to regulation by different jurisdictions, including potentially conflicting state-levelfederal regulation,and state regulations or state level regulations where we operate, could materially increase our compliance costs or risks of non-compliance. Legislative or regulatory actions can result in increased compliance costs, reduced business opportunities, or requirements and limitations on how we conduct our business. In particular, the financial services industry continues to face heightened scrutiny, including with respect to BSA/AML, know-your-customer and export and sanctions compliance requirements, consumer compliance and protection matters (such as with respect to overdraft and other fees),matters, and capital, liquidity and resolution planning in response to systemic events in the banking industry. In addition, heightened standards under proposed and recently finalized rules, such as those implementing the Community Reinvestment Act, may result in increased obligations and compliance costs, and may factor into our ability to expand and engage in new actions.planning. Although the new presidential administration has indicated an intent to pursue the regulation of the financial services industry differently than was the case under the previous administration, there is significant uncertainty regarding the direction this administration will continue to take and its ability to implement its policies and objectives, as well as the ultimate impact on potential new regulatory initiatives and the enforcement of existing laws and regulations. It is possible the expected changes in regulation do not occur or are reversed by a subsequent administration, or the regulatory measures that are ultimately enacted deliver significant competitive advantages to financial services that are structured differently or serve different markets than PNC.

Federal lawbanking grantsregulators possess substantial supervisory and enforcement powers to federal banking regulators, and they have assumed an active oversight, examination and enforcement role across the financial services industry. The results of supervisory or examination activities by our regulators, including actual or perceived compliance failures, could result in limitations on our ability to enter into certain transactions, engage in new activities, expand geographically, make acquisitions or obtain necessary regulatory approvals in connection therewith, or otherwise require us to modify our businesses practices in a manner that materially impacts our financial condition or results of operations. These activities also could result in significant fines, penalties or required corrective actions, some of which could be expensive, difficult to implement or materially impact our business or financial condition. In addition, another financial institution’s violation of law or regulation may give rise to an investigation of the same or similar activities of PNC. Further, the Federal Reserve requires a BHC to act as a source of financial and managerial strength for its subsidiary banks. The Federal Reserve could require PNC to commit resources to PNC Bank when doing so is not otherwise in the interests of PNC or its shareholders or creditors.

A failure to comply, or to have adequate policies and procedures designed to comply, with regulatory requirements and expectations exposes us to the risk of damages, fines and regulatory penalties and other regulatory or enforcement actions or consequences, such as limitations on activities otherwise permissible for us or additional requirements for engaging in new activities and could also injure our reputation with customers and others with whom we do business. We also rely on third parties who may expose us to compliance risk. A failure to comply with regulatory requirements or deficiencies in risk management practices could be incorporated in our confidential supervisory ratings, which could limit PNC’s ability to expand or require additional approvals before engaging in certain business activities. See the immediately following Risk Factor for a discussion of risks associated with capital and liquidity regulation.regulation Also seeand the Supervision and Regulation section in Item 1 of this Report and Note 19 Regulatory Matters for more information concerning the regulation of PNC, including those areas that have been receiving a high level of regulatory focus.PNC.

PNC and PNC Bank are subject to regulatory capital and liquidity requirements established by the Federal Reserve and the OCC, respectively. Requirements to maintain specified levels of capital and liquidity, and regulatory expectations as to the quality of our capital and liquidity, impact our business activities and may prevent us from taking advantage of opportunities in the best interest of shareholders or force us to take actions contrary to their interests. For example, PNC’s ability to pay or increase dividends or otherwise return capital to shareholders is subject to PNC’s compliance with its SCB, which is determined at least annually through the Federal Reserve’s CCAR process. The Federal Reserve can also impose additional limitations on capital distributions, such as limitations on distributions during times of economic stress. In addition, dividends or other capital distributions from PNC Bank and, to a lesser extent, non-bank subsidiaries are PNC’s principal source of funds to, among other things, pay dividends on and make repurchases of its capital stock. Many of our subsidiaries are subject to laws that restrict dividend payments or authorize regulatory bodies to prohibit The PNC Financial Services Group, Inc. – 2024 Form 10-K 17 or limit dividends to PNC. Limitations on PNC’s ability to receive dividends from its subsidiaries, including PNC Bank, could have a material adverse effect on its liquidity and ability to pay dividends on and make repurchases of its capital stock, especially to the extent that PNC must first service any outstanding debt obligations. Capital and liquidity requirements may also impact the amount and type of loans we make. We may be constrained in our ability to expand, either organically or through acquisitions. We may be forced to sell or refrain from acquiring assets where the capital requirements appear inconsistent with the assets’ underlying risks. In addition, liquidity standards require us to maintain holdings of highly liquid short-term investments, thereby reducing our ability to invest in longer-term or less liquid assets, even if more desirable from an earnings, balance sheet or interest rate risk management perspective.

Regulatory capital and liquidity requirements are subject to regular review and revision by the Basel Committee and the U.S. banking agencies. Although the federal banking agencies issued a proposed rule in July 2023 to implement the final components of the Basel III framework, the status of this rule, and potential revisions to the rule, remain uncertain. TheMore regulatoryinformation capital and liquidity frameworks, as well as certain other prudential requirements and standards that are applicable to PNC, including related proposed rules, areis discussed in the Supervision and Regulation section in Item 1 of this Report and the Liquidity and Capital Management portion of the Risk Management section in Item 7 of this Report.

Our liquidity could be impaired as a result of unanticipated outflows of cash or collateral, unexpected loss of consumer deposits or higher than anticipated draws on lending-related commitments, an inability to sell assets (or to sell assets at favorable times or prices), a default by a counterparty or other market participant,counterparty, our inability to access other sources of liquidity, including from sources that have historically been available or through the capital markets due to unforeseen market dislocations or interruptions, or a lack of market or customer confidence in PNC or financial institutions in general. Many of the above conditions and factors may be caused by events overfor which we have little or no control. In addition, if access to stable and lower-cost sources of funding is reduced, alternative sources of funding could be more expensive and limited in availability. The increased speed with which information is disseminated, through officialtraditional or social media, could increase the speed or severity of liquidity pressures caused by, for example, negative news about PNC’s or other financial institutions’ actual or alleged financial prospects or safety and soundness. A negative impact on our liquidity would likely limit our ability to support our operations and fund outstanding liabilities as well as meet regulatory expectations, which would adversely affect our financial condition and results of operations. For information on our liquidity management, see the Liquidity and Capital Management portion of the Risk Management section in Item 7 of this Report.

Our credit ratings are based on a number of factors, including the financial strength of PNC and PNC Bank, and factors outside of our control, such as conditions affecting the financial services industry generally. Reductions in one or more of our credit ratings could adversely affect our ability to borrow funds, increase our cost of capital and limit the number of investors or counterparties willing to do business with or lend to us. For example, downgrades could negatively impact our right to continue to service mortgages and hold related escrows and reserves. Downgrades could also adversely affect our ability to attract or retain customers, including deposits. In addition, a downgrade in our credit ratings could trigger obligations to make cash or collateral payments under derivative contracts with certain counterparties. There can be no assurance that we will maintain our current ratings and outlooks. For information on our credit ratings and outlooks, see the Liquidity and Capital Management portion of the Risk Management section in Item 7 of this Report.

Privacy and consumerpersonal data rights initiatives have imposed and will continue to impose additional operational burdens on PNC, and they may limit our ability to pursue desirable business initiatives and increase the risks associated with any future usegathering, maintenance, use, transmission and other processing of personal data.information.

Over time, there has been an increase in legislativeLegislative and regulatory efforts to protect the privacy and enhance the portability of personal data.data have evolved over time. Individuals whose personal information may be protected by law may include our customers, prospective customers, job applicants, employees and third parties. These initiatives, among other things, limit how companies can usegather, maintain, use, transmit and otherwise process personal data and impose obligations on companies in their management of such data, including requiring companies like PNC to make available to consumers and authorized third parties certain data relating to transactions and accounts and establishing obligations for accessing such data. Financial services companies such as PNC necessarily gather, maintainmaintain, use, transmit and useotherwise process a significant amount of personal data. These types of initiatives increase compliance complexity and related costs, may result in significant financial penalties for compliance failures, and may limit our ability to develop new products or respond to technological changes. This is particularly true as we expand our business and operations into new markets. WeAlso, we are, or may become, subject to regularly evolving and developing data privacy and security laws and regulations in other jurisdictions, including foreign jurisdictions even where our presence in such jurisdictions is minimal. Such legal and regulatory requirements also could heighten the reputational impact of actual or perceived misuses of personal data by us, our vendors or others who gain unauthorized access to our personal data. Other jurisdictions may adopt similar requirements that impose different and potentially inconsistent compliance burdens. The impacts will be greater to the extent requirements vary across jurisdictions.

Climate change-relatedClimate-related risks could adversely affect our business and performance, including indirectly through impacts on our customers.

There continues to be concern, including on the part of certain regulatorsstakeholders and in certain jurisdictions where we do business or have operations, regarding climateclimate-related changerisks and its impacts over the short-, medium- and long-term horizons. These concerns over the impacts of climate change (including physical risk and transition risk). These concerns have led and may continue to lead to efforts to mitigate those impacts. We and our customers may face cost increases, asset value reductions, the reduced availability of insurance or sufficient insurance to cover losses, operations disruptions and changes and other impacts because of climate change (including because of the increased frequency or severity of acute weather events and long-term shifts in the climate) and related governmental actions or societal responses to climate change. The impact on our customers will likely vary depending on their specific attributes, including their reliance on or role in carbon intensive activities and their transition plans, as well as their exposure to the effects of climate change. Consumers and businesses may also change their behaviors because of these concerns.concerns Changed consumer and business behavior because of climate change concernswhich creates transition risk for PNC arising from the process of adjusting to these concerns. PNC and its customers will need to respond to any new laws and regulations as well as any changes in consumer and business preferences related to climate change. Among the impacts to PNC could be a drop in demand for our products and services, particularly in certain sectors if our products or services do 14 The PNC Financial Services Group, Inc. – 2025 Form 10-K not support the environmental goals of our customers, or increased losses due to the impact of climate change on the collateral that secures customer borrowings. InOur addition,risk wemanagement couldneeds faceto reductionscontinue to evolve, or it may not be effective in creditworthinessidentifying, onmeasuring, monitoring and controlling climate risk exposure, particularly given that the parttiming, nature and severity of some customers or in the valueimpacts of assetsclimate securingchange loans.may not be predictable.

We are currently subject to climate-related regulatory expectations and could be subject to additional regulatory restrictions or costs associated with providing products or services to certain companies or sectors. Additionally, the federal government has altered and may continue to alter climate policies or requirements in a way that significantly conflicts with certain state-level policies or investor expectations. Such changes may present risk to PNC due to inconsistent expectations, requirements or costs. Environmental regulations or changes in the supply, demand or available sources of energy or other resources may affect the availability or cost of goods and services necessary to run our business. Our efforts to take these risks into account in making lendingbusiness and otherour decisionscustomers’ may not be effective in protecting us from the negative impact of any new laws and regulations or any changes in consumer or business behavior, including those resulting from activist pressure. Our risk management needs to continue to evolve, or it may not be effective in identifying, measuring, monitoring and controlling climate risk exposure, particularly given that the timing, nature and severity of the impacts of climate change may not be predictable.businesses.

As a large financial services company, we handle a substantial volume of customer and other financial transactions. As a result, we rely heavily on information systems to conduct our business and to process, record, monitor and report on our transactions and those of our customers. Over time, we have seen more customer usage of technological solutions for financial needs as well as higher expectations of customers and regulatory requirements of regulators regarding effective and safe systems operation. In many cases, the effective use of technology increases efficiency and enables financial institutions to better serve customers.systems. As a result of these factors, the financial services industry continues to undergo rapid technological change with frequent introductions of new technology-driven products and services. Examples include expanded use of cloud computing, artificial intelligence (AI) and machine learning, biometric authentication, voice and natural language, data protectionprivacy and security enhancements and increased online and mobile device interaction with customers, including innovative ways that customers can manage their accounts.

In response to actual and anticipated customer behavior and expectations, as well as competitive pressures, we continue to invest in technology and connectivity.technology. We are seekingseek to automate functions previously performed manually, facilitate the ability of customers to engage in financial transactions and otherwise enhance the customer experience with respect to our products and services. This effort has involved and is likely to continue to involve the expenditure of considerable amounts of funds and other resources, which could be constrained to the extent that sustained adverse economic conditions and other factors described elsewhere in these Risk Factors negatively impact our business or financial performance. A failure to maintain or enhance our competitive position with The PNC Financial Services Group, Inc. – 2024 Form 10-K 19 respect to technology, whether because we fail to anticipate customer expectations, because our technological developments fail to perform as desired or are not rolled out in a timely manner, or because we fail to keep pace with our competitors, would likely cause us to lose market share or incur additional expense. Our ability to maintain or enhance our relative technological position is in part dependent on our ability to attract and retain talented employees in these fields.employees.

In some cases, we develop internally the intellectual property embedded in the technology we use. In others, we or our vendors license the use of intellectual property from others. Where we rely on access to third-party intellectual property, whether now or in the future, it may not be available to us on commercially reasonablyreasonable terms or at all. RegardlessIf ofwe thefail sourceto ofcomply thewith intellectualany property,applicable ifobligations under our license agreements, or another person or entity were deemed to own intellectual property rights infringedinfringed, misappropriated or otherwise violated by our activities, we could be responsible for significant damages covering past activities and substantial fees to continue to engage in these types of activities. Our third-party licensors may also have the right to terminate the license, which may cause us to lose valuable rights, and could disrupt our operations. It also is possible that we could be prevented from using technology important to our business for at least some period of time. In such circumstances, there may be no alternative technology for us to use or an appropriate alternative technologyit might be expensive to obtain. We could also suffer significant reputational damage in these circumstances. Protections offered by those from whom we license technology against these risks may be inadequate to cover any losses in full.full, and the measures we take to obtain, enforce and defend our intellectual property rights may not be successful in every jurisdiction or prevent infringement, misappropriation or other violation of our intellectual property rights. Over time, there have been and continue to be instances where technology used by PNC has been alleged to have infringedinfringed, patentsmisappropriated or otherwise violated intellectual property rights held by others, and, in some cases, we have suffered related losses. In certain situations, we may be compelled to engage in intellectual property-related litigation to enforce or defend our intellectual property rights, which may incur significant expenses and may be perceived negatively by customers or industry peers.

20 The PNC Financial Services Group, Inc. – 20242025 Form 10-K 15

We are vulnerable to the risk of cyber attacks and breaches of data security affecting the functioning of systemstechnology or the confidentiality of information that could adversely affect our customers and our business.

Most corporate and commercial financial transactions are now handled electronically, and our commercial and retail customers increasingly use online access as well as mobile and cloud technologies to bankaccess withour us.products and services. The ability to conduct business with us in this manner depends on the gathering, maintenance, use, transmission and storageother processing of confidentialvast amounts of digital information in electronic form. As a result, in the ordinary course of business, we maintaingather, maintain, use, transmit and otherwise process vast amounts of digital information about us, our customers and our employees. This information tends to be confidential or proprietary and much of it is highly sensitive.sensitive and personal. Such highlyconfidential, proprietary, sensitive and personal information includes information sufficient 16 The PNC Financial Services Group, Inc. – 2025 Form 10-K to support identity theft and includes personal health information, as well as information regarding business plans and financial performance that has not been made public. As a result, efforts by bad actors to engage in various types of cyber attacks and breaches, including by way of computer viruses, hacking, ransomware and other malware, denial of service attacks, credential staffing, phishing, social engineering, account takeovers, insider threats and supply chain attacks pose serious risks to our business and reputation.

We are faced with ongoing, nearly continual, efforts by others to breach data security at financial institutions or with respect to financial transactions. The effectiveness of these efforts may be enhanced using AI. These efforts may be to obtain access to confidential or proprietary information, often with the intent of stealing from or defrauding us or our customers, or to disrupt our ability to conduct our business, including by destroying or impairing access to information maintainedgathered, maintained, used, transmitted or otherwise processed by us. Some of these involve efforts to enter our systemstechnology directly by going through or around our security protections. Others involve the use of social engineering schemes to gain access to confidential information from our employees, customers or vendors. The modernization of the payment systems, including near real-time movement solutions, increases the complexity of preventing and detecting these attacks and recovering fraudulent transactions. Our risk and exposure to datacyber securityattacks and breaches is heightened because of our expanded digital products and services, geographic footprint and continueddispersed remote work environment,workforce, which results in more access points to our network. The same risks are presented by attacks potentially affecting information held by third parties on our behalf or accessed by third parties, including those offering financial applications, on behalf of our customers. These risks also arise when third parties with whom we do business, or their vendors or other entities with whom they do business, are themselves subject to breachescyber attacks and attacks,breaches, which has impacted our business and may do so in the future. Our ability to protect confidential or proprietary information is even more limited with respect to such information heldgathered, maintained, used, transmitted or otherwise processed by these parties. For example, we are likely to be limited in our ability to identify and quickly resolve breachescyber attacks and attacksbreaches that may impact our business the further removed an entity is from our business, such as when a breachcyber attack or attackother data security breach occurs at vendors of our vendors. We may suffer reputational damage or legal liability for unauthorized access to customer information heldgathered, maintained, used, transmitted or otherwise processed by other parties, even if we were not responsible for preventing such access and had no reasonable way of preventing it.

Our customers often use their own devices, such as computers, smartphones and tablets, to do business with us and may provide their PNC customer information (including passwords and other confidential information) to a third party in connection with obtaining services from that third party, including those offering financial applications. Although we take steps to provide safety and security for our customers’ transactions with us and their customer information, to the extent they utilize their own devices or provide third parties access to their accounts, our ability to assure such safety and security is necessarily limited. These risks are heightened as we and others continue to expand mobile applications, cloud solutions,solutions and other internet-based financial product offerings. For example, a number of our customers choose to use financial applications that allow them to view, access and aggregate banking and other financial account information on a single platform, to monitor the performance of their investments, to compare financial and investment products, to make payments or transfer funds, and otherwise to help manage their finances and investments.investments, Someincluding through the aggregation of banking or other financial applicationsinformation askthat usersmay require our customer to provide their secure banking log-in information, credentials or other account-identifying information soto the applicationsfinancial can linkapplication to users’aggregate accounts atthis financial institutions.data. CompaniesIn offeringsome these applications frequently useinstances, third-party data aggregators, whichaggregators are behind-the-scenes technology companies that serve as data-gathering service providers, to deliver customer financial data that is then used by the financial applications.application Toto doaccess this,customers’ accounts and obtain the customers’ data aggregatorsand may be obtaining customers’secure log-in information,banking credentials or other account-identifying information, which allow the aggregators to access the customers’ account information andfrom “scrape”our orcustomers obtain the customers’ data, often on a daily or even more frequent basis. That same informationwhich has the potential to facilitate fraud if it is not properly protected. This has resulted in incidences of fraud, including automated clearing house fraud, credit card fraud,fraud and wire fraud, enabled through the use of synthetic identities and through account takeovers via these platforms. In addition, transactions by customers on financial applications that facilitate payments and fund transfers have also been fraudulently induced. These transactions occur when a customer authorizes payment to a recipient that fraudulently induced the customer into transferring a payment to such recipient. PNC has and may continue to face increased financial exposure due to activity associated with the increased use of these applications and data aggregators. Even where PNC does not have financial exposure for losses, PNC and the third parties with whom we do business could suffer increased reputational harm or regulatory scrutiny when such losses occur.

As our customers regularly use PNC-issued credit and debit cards to pay for transactions with retailers and other businesses, there is also the risk of cyber attacks and other data security breaches at those other businesses covering PNC account information. When our customers use PNC-issued cards to make purchases from those businesses, card account information often is provided to such businesses. If a business’s systems that gather, maintain, use, transmit and otherwise process or store card account information are subject to a cyber attack or other data security breach, holders of our cards who have made purchases from that business may experience fraud on their card accounts. We can be responsible for reimbursing our customers for such fraudulent transactions on customers’ card accounts, as well as for other costs related to datacyber securityattacks compromiseand events,breaches, such as replacing cards associated with compromised card accounts. In addition, we provide card transaction processing services to some merchant customers under agreements we have with payment networks such as Visa and Mastercard. Under these agreements, we may be responsible for certain losses and penalties if one of our merchant customers suffers a cyber attack or other data security breach. Moreover, to the extent The PNC Financial Services Group, Inc. – 2024 Form 10-K 21 more consumer confidential information becomes available to bad actors through the cumulative effect of datacyber attacks breaches at companies generally, bad actors may find it easier to use such information to gain access to our customer accounts.

Other cyber attacks and data security breaches are not focused on gaining access to credit card or user credential information, but instead seek access to a range of other types of confidential information, such as internal emails and other forms of customer financial information, and this information may be used to support a ransomware attack. Ransomware attacks have sought to deny access to data and possibly shut down systems and devices maintained by target companies. In a ransomware attack, system data is encrypted, stolen or extorted, or access is otherwise denied, accompanied by a demand for ransom to restore access to the data or to prevent The PNC Financial Services Group, Inc. – 2025 Form 10-K 17 public disclosure of confidential information. AttacksCyber attacks and data security breaches have also been conducted through business email compromise scams that involve using social engineering to cause employees to wire funds to the perpetrators in the mistaken belief that the requests were made by a company executive or established vendor. These types of phishing attacks have increased over time, and they have evolved to include other types of attacks like vishing (through voice messages) and smishing (through SMS text). Other cyber attacks and data security breaches have included distributed denial of service cyber attacks, in which individuals or organizations flood commercial websites with extraordinarily high volumes of traffic with the goal of disrupting the ability of commercial enterprises to process transactions and possibly making their websites unavailable to customers for extended periods of time. Similarly, cyber attacks and breaches have been conducted through application program interfaces where cyberbad attackersactors seek to exploit the interfaces between mobile or web applications. We (as well as other financial services companies) have been subject to such attacks.cyber attacks and breaches. Recent cyber attacks and breaches have also included the insertion of malware into software updates and the infection of software while it is under assembly, known as a “supply chain attack.” AttacksCyber onattacks and breaches affecting our customers may put these relationships at risk, particularly if customers’ ability to continue operations is impaired due to the losses suffered. The techniques used in cyber attacks and breaches change rapidly and are increasingly sophisticated, including through the use of generative AI and deepfakes, and we expect in the future through the use of quantum computing, and we may not be able to anticipate cyber attacks or other data security breaches. Additionally, cyber attacks and breaches in some cases appear to be supported by foreign governments or other well-financed entities and often originate from less regulated and remote areas of the world. We have seen a higher volume and complexity of attacks during times of increased geopolitical tensions.

In addition to threats from external sources, insider threats represent a significant risk to us. Insiders, including those having legitimate access to our information, communications systems and other technology and the information contained in them,therein, have the easiest opportunity to make inappropriate use of thetheir systems and information.access. Addressing that risk requires understanding not only how to protect us from unauthorized use and disclosure of data, but also how to engage behavioral analytics and other tools to identify potential internal threats before any damage is done. In addition, due to the number of employees who work remotely, the opportunity for insiders to grant access to third parties or to disclose confidential information of PNC or its customers has increased. As more work is conducted outside of PNC’s facilities, the risk of improper access to PNC’s network or confidential information has increased, including for reasons such as a failure by an employee or contractor to secure a device with PNC access.

Cyber attacks and breaches often are not recognized until launched against a target and may go undetected for a period of time (or remain undetected), with the adverse consequences likely greater the longer it takes to discover the problem. As a result, we may be unable to implement adequate preventative measures to address these methods in advance of such cyber attacks and breaches. We have been and expect to continue to be the target of some of these types of cyber attacks.attacks and breaches. To date, none of these types of cyber attacks or other data security breaches has had a material impact on us. Nonetheless, we cannot entirely block efforts by bad actors to harm us, and there can be no assurance that future cyber attacks or other data security breaches will not be material. While we maintain insurance coverage that may cover certain aspects of cyber risks, such insurance coverage may be insufficient to cover all losses. As a result, we could suffer material financial and reputational losses in the future from any of these or other types of attacks or the public perception that such an attack on our systems has been successful, whether or not this perception is correct. Attacks on others, some of which have led to serious adverse consequences, demonstrate the risks posed by new and evolving types of cyber attacks.attacks and breaches.

We need effective programs to limit the risk of failuresfailures, orinterruptions and security breaches occurring in our information systemstechnology and to mitigate and remediate the impact when they do.

We have policies, proceduresprocedures, systems and systemsprograms (including cybersecurity and business continuity programs) designed to preventprevent, ormitigate limitand remediate the effect of possible failures, interruptions orand security breaches in securityour of information systems.technology. We continue to devote appropriate resources toward improving the reliability of our policies, procedures, systems and programs and their security against external and internal threats and expect to continue to do so in the future. We design our business continuity and other information and technology risk management programs to allow us to provide services in the case of an event resulting in material disruptions of business activities affecting our employees, facilities, technology or suppliers. We cannot guarantee the effectiveness of our policies, proceduresprocedures, systems and systemsprograms to protect us in any future situation, nor can we guarantee the effectiveness of our oversight of risk atarising from third parties.parties upon whom we rely. Although we have policies, proceduresprocedures, systems and systemsprograms designed to mitigate third-party risk, our ability to implement policies, proceduresprocedures, systems and systemsprograms designed to prevent or limit the effect of possible failures, interruptions or security breaches in security of information systems with respect toimpacting third-party systemstechnology, andincluding the financial services industry infrastructure generally, is necessarily limited. Should such an adverse event affecting another company’s systems occur, we may not have financial protection from the other companythird-party sufficient to compensate us or otherwise protect us from the consequences. While we maintain insurance coverage that may cover certain aspects of cyber risks, such insurance coverage may be insufficient to cover all losses or any losses at all, and there can be no guarantee that our insurer will not deny coverage to any particular claim in the future or that such insurance will continue to be available on commercially reasonable terms or at all. As a result, we could suffer material financial and reputational losses in the future from any failures, interruptions or security breaches or the perceptions thereof, whether or not this perception is correct.

Methods used by others to attack information systems change frequently (with generally increasing sophistication). A new method of attack often is not recognized until launched against a target. Attacks in some cases appear to be supported by foreign governments or other well-financed entities and often originate from less regulated and remote areas around the world. We have seen a higher volume and complexity of attacks during times of increased geopolitical tensions. As a result, we may be unable to implement adequate preventive or mitigating measures to address thesefailures, methodsinterruptions and security breaches in advance of attacks.advance. Even with our proactive and defensive measures in place, such adverse events are likely to occur, and there remains the risk that one or more such events would be material to PNC. Our ability to mitigate and remediate the adverse consequences of such occurrencesevents is in part dependent on the quality of our business continuity planning, our ability to identify and understand threats to us from a holistic perspective, our ability to anticipate the timing and nature of any such event that 22 The PNC Financial Services Group, Inc. – 2024 Form 10-K occurs, with novel or unusual events posing a greater risk, and our ability to identify and quickly resolve vulnerabilities in our information systemstechnology and those of third parties upon which we rely. ItCyber isattacks alsoand thebreaches caseoften thatare not recognized until launched against a vulnerabilitytarget or an adverse eventand may go undetected for a period of time, 18 The PNC Financial Services Group, Inc. – 2025 Form 10-K with the adverse consequences likely greater the longer it takes to discover the problem. In many cases, it also depends on the preparedness and responses of national or regional governments, including emergency responders, or on the part of other organizations and businesses with which we deal. Additionally, our failure to communicate cyberfailures, incidentsinterruptions and security breaches appropriately to relevant parties could result in regulatory, legal, operational and reputational risk. See Item 1C Cybersecurity of this Report for more information on our cybersecurity risk management program.

Our credit risk may be exacerbated when the value of collateral held by us to secure obligations to us cannot be realized, including because of legal or regulatory changes, or is liquidated at prices that are not sufficient to recover the full amount of the loan or derivativederivatives exposure due to us. In addition, credit risk may be exacerbated when counterparties are unable to post collateral, whether for operational or other reasons.

In the ordinary course of business, we often have heightened credit exposure to a particular industry, geography, asset class or financial market. As an example, loans secured by real estate typically represent a significant percentage of our overall credit portfolio. It also represents a portion of the assets underlying our investment securities. While there are limitations on the extent of total exposure to an individual consumer or business borrower, events adversely affecting some of our clients or counterparties, based on individual factors or the nature or location of their business, or asset classes or financial markets in which we are involved, could materially and adversely affect us. As described elsewhere in these Risk Factors, the fundamental shift in office demand combined with higher interest rates contributes to decreased property values and harms the creditworthiness of some of our office commercial real estate customers. Declining economic conditions also may impact commercial borrowers more than consumer borrowers, or vice versa. In addition, we execute transactions with counterparties in the financial services industries.industry. Financial services institutions are interrelatedinterconnected because of trading, funding, clearing or other relationships. As a result, uncertainty about the stability of other financial services institutions could lead to market-wide losses and defaults. Thus, the concentration and mix of our assets may affect the severity of the impact of recessions or other economic downturns on us.

As a result of the high percentage of our assets and liabilities that are in the form of interest-bearing or interest-related instruments, changes in interest rates, in the shape of the yield curve,curve or in spreads between different market interest rates can have a material effect on our business, our profitability and the value of our financial assets and liabilities. For example:

The rates on some interest-bearing instruments adjust promptly in accordance with changes in market rates, while others adjust only periodically or are fixed throughout a defined term. As a result, the impact of changes in interest rates can be either increased or diluted due to differences in the relative variability of the rates paid on our liabilities in relation to the rates received on our assets. The extent to which we have elected to hedge interest rate risk through interest rate swaps also affects the impact of rate changes. We attempt to manage the balance sheet to increase our benefit or reduce negative impacts from future movements in interest rates, but failures to anticipate actual movements may have the opposite result. In addition, we do not generally hedge all of our risk and our attempt to hedge any risk does not mean we will be successful.

While higher interest rates generally enhance our ability to grow our net interest income, there are risks associated with a rising interest rate environment. As a general matter, increasing rates tend to decrease the value of fixed-rate financial instruments held on our balance sheet, as discussed in the Risk Factor headed “Our business and financial performance are vulnerable to the impact of changes in the values of financial assets.” Also, customers have and may continue to be less willing or able to borrow at higher rates. Higher interest rates also have hindered and may continue to hinder the ability of borrowers to support interest payments on variable rate loans. Higher interest rates have and may continue to indirectly affect the value of asset classes such as real estate typically financed through secured loans, with a resulting negative effect on collateral securing such loans. As another example, there are increased competitive pressures as rates on deposit products rise. The benefits of higher interest rates are best achieved if we can increase the rates on loans and other assets faster than the rates on deposits and other liabilities increase. We may not be able to achieve this result in a rising rate environment, especially if central banks introduce rate increases more quickly than anticipated. On the other hand, lower interest rates tend to have a negative impact on our net interest margin, and, unless offset by higher earning assets, on our net interest income. We discuss the impact of governmental monetary policy on interest rates in the Risk Factor headed “The policies of the Federal Reserve and other governmental agencies have a significant impact on interest rates and overall financial market performance, which are important to our business and financial performance.”

Our accounting policies are key to how we report our financial condition and results of operations. We must exercise judgment in selecting and applying many of these policies and methods to comply with GAAP and reflect management’s judgment regarding the most appropriate manner to report PNC’s financial condition and results of operations. Management’s selection of a particular accounting policy to apply, while reasonable and appropriate, could result in PNC reporting different results than would have been reported under a different alternative. In addition, the Financial Accounting Standards Board, SEC and other regulatory agencies may issue new or amend existing accounting and reporting standards or change existing interpretations of those standards that could 20 The PNC Financial Services Group, Inc. – 2025 Form 10-K materially affect our financial statements. In some cases, PNC may be required to retrospectively apply a new or amended standard resulting in changes to previously reported financial results.

We use financial and statistical models throughout many areas of our business, relying on them to inform decision making, automate processes, and estimate many financial values. Although it currently impacts a minority of the overall number of models that we use, we increasingly use models related to how we do business with customers and for internal process automation that leverage AI/machine learning algorithms. These models can be more predictive, but because of the complex way in which the many variables in AI/machine learning models interact, the results of these models are often less interpretable than traditional statistical models. Examples of model usesuse include determining the pricing of various products, identifying potentially fraudulent or suspicious transactions, marketing to potential customers, grading loans and extending credit, measuring interest rate and other market risks, predicting or estimating losses, and assessing capital adequacy. We depend significantly on models for credit loss accounting under CECL, capital stress testing and estimating the value of items in our financial statements.

Models generally predict or infer certain financial outcomes, leveraging historical data and assumptions as to the future, often with respect to macroeconomic conditions. Development and implementation of some of these models, such as the models for credit loss accounting under CECL, require us to make difficult, subjective and complex judgments. Other models are used to support decisions made regarding how we do business with customers. Poorly designed or implemented models present the risk that our business decisions based on information incorporating model output will be adversely affected due to the inadequacy of that information. For example, our models may not be effective if historical data does not accurately represent future events or environments or if our models rely on erroneouserroneous, incomplete, biased, or otherwise flawed data, formulas, algorithms or assumptions and our internal model review processes fail to detect and address these flaws. Models, if flawed, could cause information we provide to the public or to our regulators to be inaccurateinaccurate, incomplete or misleading. Some of the decisions that our regulators make, including those related to capital distribution to our shareholders, would likely be affected adversely if they perceive that the quality of the relevant models we use is insufficient. Finally, flaws in our models that The PNC Financial Services Group, Inc. – 2024 Form 10-K 25 negatively impact our customers or our ability to comply with applicable laws and regulations could negatively affect our reputation or result in fines and penalties from our regulators. Moreover, our use of AI/machine learning algorithms is subject to a variety of existing laws and regulations, including intellectual property, privacy (including with respect to automated decision making), consumer protection and federal equal opportunity laws and regulations, and additional new laws and regulations, and new applications or interpretations of existing laws and regulations, related to AI/machine learning algorithms may impact our ability to develop, use and commercialize AI/machine learning algorithms.

•The ability of customers, counterparties and issuers to perform in accordance with contractual terms, 32 The PNC Financial Services Group, Inc. – 2025 Form 10-K

In November 2023, the FDIC approved a final rule to implement a special assessment to recover the loss to the Deposit Insurance FundDIF associated with protecting uninsured depositors following the closures of Silicon Valley Bank and Signature Bank.Bank, Assubject ato result,periodic adjustments based on the estimated total loss amount. In December 2025, the FDIC adopted an interim final rule allowing for potential offsets to assessments if the amount collected exceeds losses to the DIF. Based on these rules, PNC incurred a pre-tax expenseexpenses of $515 million duringin 2023 and $112 million in 2024. Additionally, in 2025, PNC benefited from changes in the FDIC's expected losses which led to an accrual release of $60 million in the fourth quarter ofand 2023. In the first quarter of 2024, PNC incurred an additional pre-tax expense of $130$48 million related to the increase in the FDIC’sthird expectedquarter, losses.resulting Thein fourtha quarter of 2024 included an $18$108 million pre-taxaccrual reductionrelease for the full year. For additional information about the impact of the FDICFDIC’s special assessment.assessment, see the Supervision and Regulation section in Item 1 Business.

The following tables include selected financial data which should be reviewed in conjunction with the Consolidated Financial Statements and Notes included in Item 8 of this Report as well as the other disclosures in this Report concerning our historical financial performance, our future prospects and the risks associated with our business and financial performance.performance:

Net income for 20242025 was $6.0$7.0 billion or $13.74$16.59 per diluted common share, an increase of $0.4$1.0 billion, or 5%,18%, compared to net income of $5.6$6.0 billion, or $12.79$13.74 per diluted common share, for 2023.2024. The increase was primarily due to lowerhigher noninterestnet expenseinterest income and higher noninterest income, partially offset by lowerhigher netnoninterest interest income.expense.

•Total revenue wasincreased stable$1.5 atbillion, $21.6or 7%, to $23.1 billion.

•NoninterestNet interest income increased $0.5$0.9 billion, or 6%,7%, to $8.1$14.4 billion primarilyand drivenreflected bylower higherfunding capitalcosts, marketsthe continued benefit of fixed rate asset repricing and advisoryloan fees.growth.

•Provision for credit losses of $779 million for 2025 was driven by a net increase in the ACL, primarily due to commercial and industrial portfolio activity and changes to macroeconomic scenarios, partially offset by commercial real estate portfolio activity. Provision for credit losses was $789 million in 2024 reflecting the impact of net charge-offs, primarily in our commercial real estate, commercial and industrial and credit card loan classes, and a net decline in the ACL due to improved macroeconomic factors and portfolio activity. Provision for credit losses was $742 million in 2023.2024.

•Total assets wereincreased stableprimarily anddue includedto higher securitiesloan balances, partially offset by lower loans outstanding and lower balances held with the Federal Reserve Bank.FRB.

•Total loans decreasedincreased $5.0$15.0 billion, or 2%,5%, to $316.5$331.5 billion.

•Total commercial loans decreasedincreased $3.4$16.3 billion, or 2%,8%, to $216.2$232.5 billion, duedriven toby growth in the commercial and industrial portfolio, reflecting new production, partially offset by lower utilization of loan commitments and commercial real estate paydowns.loans.

•Total consumer loans decreased $1.6$1.3 billion, or 2%,1%, to $100.3$99.0 billion, asprimarily growthdue into automobilelower residential real estate loans was more than offset by declines in the remaining portfolios as paydowns outpaced originations.originations, partially offset by growth in the auto loan portfolio.

•InterestInvestment earning deposits with banks, primarily with the Federal Reserve Bank,securities decreased $4.5$1.5 billion, or 10%,1%, to $39.3$138.2 billion, primarily due to lowernet borrowed fundspaydowns and highermaturities securitiesin balances,the held-to-maturity portfolio, partially offset by highernet depositspurchase andactivity lowerin loanthe balances.available-for-sale portfolio.

•Total deposits increased $5.3$14.1 billion, or 1%,3%, to $426.7$440.9 billion, reflectingas higher interest-bearing deposits,deposits were partially offset by lower noninterest-bearing deposits. Interest-bearingThe increase in interest-bearing deposits increasedwas due to higher commercial and consumer deposits, partially offset by lower brokered time deposits. The decrease in noninterest-bearing deposits reflected lower commercial balances, partially offset by lowerhigher consumer balances. Noninterest-bearing deposit balances decreased due to a decline in both commercial and consumer balances.

•Borrowed funds of $61.7$57.1 billion decreased $11.1$4.6 billion, or 15%,7%, primarily due to lower FHLB advances, partially offset by parent companyhigher senior debt issuances.outstanding.

•The ACL related to loans, which consists of the ALLL and the allowance for unfunded lending related commitments, totaled $5.2 billion andat $5.5 billion atboth December 31, 2024,2025 and 2023, respectively. The reserve change was driven by improved macroeconomic factors as well as portfolio activity.2024. ACL to total loans was 1.64%1.58% and 1.70%1.64% at December 31, 20242025 and 2023,2024, respectively.

•NonperformingOverall assetsloan of $2.4 billiondelinquencies increased $141$61 million, or 6%, primarily due4%, to $1.4 billion, as a result of higher commercial realloan estatedelinquencies, nonperformingpartially loans.offset by lower consumer loan delinquencies.

•Net charge-offs of $0.7 billion or 0.23% of average loans in 2025 decreased $297 million compared to net charge-offs of $1.0 billion or 0.33% of average loans in 2024 increased $331 million compared to net charge-offs of $710 million or 0.22% of average loans for 2023,2024, reflecting higherlower commercial and consumer net loan charge-offs.

•In 2024,2025, we returned $3.1$3.9 billion of capital to shareholders through dividends on common shares of $2.5more than $2.6 billion and repurchases of 3.56.8 million common shares for $0.6$1.2 billion.

•On January 3,5, 2025,2026, the PNC Board of Directors declared a quarterly cash dividend on common stock of $1.60$1.70 per share to be paid on February 5, 20252026 to shareholders of record at the close of business January 15,20, 2025.2026.

•The Basel IIIOur CET1 capital ratio increased to 10.6% at December 31, 2025 from 10.5% at December 31, 2024 from 9.9% at December 31, 2023.2024.

PNC’s ability to take certain capital actions, including returning capital to shareholders, is subject to PNC meeting or exceeding an SCB established by the Federal Reserve Board in connection with the Federal Reserve Board’s CCAR process. PNC’s SCB for the four-quarter period beginning October 1, 2025 is the regulatory minimum of 2.5%. See additional discussion of the CCAR process in the Supervision and Regulation section of Item 1 Business and Item 1A Risk Factors of this Report.Report and the Liquidity and Capital Management portion of the Risk Management section of this Item 7 for more detail on our 2025 capital and liquidity actions as well as our capital ratios.

•The labor market remains strong, and job and income gains will continue to support consumer spending growth in the near term. PNC’s baseline forecast isremains for continued expansion, but slower economic growth in 20252026 than in 2024.2024 Highand interest2025. ratesTariffs remain a drag on theconsumer economy,spending consumerand business investment, while AI-related capex and wealth effects have been key supports to growth. Consumer spending growth willis slowslowing to a pace more consistent with household income growth,growth. andThe government’sOne contributionBig toBeautiful Bill will be a net positive for economic growth willin be smaller.2026.

•Average loans to be downup approximately 1%,8%,

•Net interest income to be downup 2%approximately to 3%,14%,

•FeeNoninterest income to be stable,up approximately 6%,