TFC, §1A diff (2020 → 2021)

ITEM 1A. RISK FACTORS

Summary of Risk Factors

Merger-Related Risks

•Truist may not be able to successfully integrate the companies or to realize the anticipated benefits of the Merger.

•Truist will continue to incur substantial expenses related to the Merger and the integration.

COVID-19 Risks

•The effects of COVID-19 have adversely impacted the Company’s operations; the duration and impact of these effects is still unknown.

Climate Risks

•Physical, transition, or other risks associated with climate change have the potential to negatively impact operations, business results, and clients.

Market Risks

•Changes in interest rates could adversely affect revenue and expenses, the value of assets and liabilities, as well as the availability and cost of capital, and liquidity.

•The monetary and fiscal policies of the U.S. federal government could have a material adverse effect on profitability.

•Financial results, lending or other business activities could be materially affected by a deterioration of economic conditions.

•Instability in global economic conditions and geopolitical matters, as well as volatility in financial markets, could have a material adverse effect on the Company’s results of operations and financial condition.

•The replacement of LIBOR could adversely affect Truist’s profitability and financial condition.

Credit Risks

•The Company is subject to credit risk by lending or committing to lend money, or entering into a letter of credit or other types of contracts with counterparties.

•The Company may have more credit risk and higher credit losses to the extent that loans are concentrated by loan type, industry segment, borrower type, or location of the borrower or collateral.

Liquidity Risks

•Loss of deposits or a change in deposit mix could increase Truist’s funding costs.

•Truist’s liquidity could be impaired by an inability to access short-term funding, an unforeseen outflow of cash, or the inability to monetize liquid assets.

•Truist relies on the mortgage secondary market and GSEs for some of the Company’s liquidity.

•Any reduction in the Company’s credit ratings could increase the Company’s cost of funding or reduce its access to the capital markets.

•The Parent Company could have less access to funding sources and its liquidity could be constrained if the Bank becomes unable to pay dividends during a time of stress.

Compliance Risks

•Truist is subject to extensive and evolving government regulation and supervision, which could increase the cost of doing business, limit Truist’s ability to make investments and generate revenue, and lead to costly enforcement actions.

•Truist is subject to regulatory capital and liquidity standards that affect the Company’s business, operations, and ability to pay dividends, or otherwise return capital to shareholders.

•Truist is subject to certain risks related to originating and selling mortgages and may be required to repurchase mortgage loans or indemnify mortgage loan purchasers.

•Truist faces risks as a servicer of loans.

Strategic Risks

•Truist may face the risk of financial loss or negative impact resulting from ineffective strategy setting and execution, adverse business decisions, or lack of responsiveness to changes in the external environment.

•Competition may reduce Truist’s client base or cause Truist to modify pricing for products and services.

•Truist may not be able to complete future mergers or acquisitions.

•Truist has businesses other than banking that are subject to a variety of risks.

Truist Financial Corporation 19

Reputational Risks

•Negative public opinion could damage the Company’s reputation and adversely impact business and revenues.

•Scrutiny of the Company’s sales, training, and incentive compensation practices could damage the Company’s reputation and adversely impact business and revenues.

Operational Risks

•Litigation may adversely affect the Company’s results.

•The Company may incur fines, penalties and other negative consequences from regulatory violations, including inadvertent or unintentional violations.

•Truist relies on other companies to provide key components of the Company’s business infrastructure.

•Truist depends on the expertise of key teammates. If these individuals leave or change their roles without effective replacements, operations may suffer.

•The Company may not be able to hire or retain additional qualified teammates and recruiting and compensation costs may increase as a result of changes in the marketplace, which may increase costs and adversely impact the Company’s ability to implement business strategies.

•The Company’s framework for managing risks may not be effective.

•There are risks resulting from the extensive use of models in Truist’s business, which may impact decisions made by Management and regulators.

•The Company is at risk of increased losses from fraud.

•The Company’s operational or security systems or infrastructure or those of third parties, could fail or be breached, which could disrupt the Company’s business and adversely impact the Company’s results of operations, liquidity and financial condition, as well as cause legal or reputational harm.

•Natural disasters and other catastrophic events, which may increase in frequency and intensity due to climate change, could have a material adverse impact on the Company’s operations or the Company’s financial condition and results.

•Truist may be impacted by the soundness of other financial institutions.

•Truist depends on the accuracy and completeness of information about clients and counterparties.

•The Company’s accounting policies and processes are critical to how the Company reports its financial condition and results of operations and require management to make estimates about matters that are uncertain.

•Depressed market values for the Company’s stock and adverse economic conditions sustained over a period of time may require the Company to write down all or some portion of the Company’s goodwill.

•Certain banking laws and certain provisions of the Company’s articles of incorporation may have an anti-takeover effect.

Technology Risks

•The Company faces cybersecurity risks, including denial of service, hacking, and malware or ransomware attacks, which could result in the disclosure of confidential information, adversely affect the Company’s operations or reputation, and create significant legal and financial exposure.

•Truist will continually encounter technological change and must effectively anticipate, develop, and implement new technology.

•The Company faces risks associated with quality, availability and retention of key data for operational, strategic, and compliance purposes.

The following discussion sets forth some of the more important risk factors that could materially affect Truist's financial condition and operations. When a risk factor spans several risk categories, the risks have been listed by their primary risk category. The risks described are not all inclusive. Additional risks that are not presently known or risks deemed immaterial may have a material adverse effect on Truist's financial condition, results of operations, business, and prospects.

Merger-Related Risks

Truist may not be able to successfully integrate the companies or to realize the anticipated benefits of the Merger.

The Company was formed by the Merger of BB&T and SunTrust on December 6, 2019. Since the closing of the Merger, Truist has expended significant time and resources, and incurred substantial expenses, in the integration of systems, operations, and teammates of BB&T and SunTrust. Although many integration milestones have been achieved, important integration steps remain to be completed. In addition, the core bank conversion of heritage SunTrust clients occurred in February 2022. Conversion activities remain subject to validation, and issues related to this and other conversions may not be discovered until a later date. Additionally, systems that are no longer being used may still need to be retained for a period of time.

20 Truist Financial Corporation

Truist may encounter difficulties as it completes integration activities, such as:

•the loss of key teammates and clients;

•the disruption of operations and businesses;

•loan, deposit, and revenue attrition;

•inconsistencies in standards, control procedures and policies;

•unexpected issues with planned branch and other facilities closures;

•unexpected issues with costs, operations, teammates, technology; and

•problems with the assimilation of new operations, sites, or teammates.

Integration activities have and will continue to divert resources from regular operations. In addition, general market and economic conditions or governmental actions affecting the financial industry may inhibit the Company’s continued integration of the heritage entities.

BB&T and SunTrust merged with the expectation that the Merger would result in various synergies, including benefits relating to enhanced revenues, a strengthened and expanded market position for the combined organization, technology efficiencies, cost savings, and operating efficiencies. Achieving the anticipated benefits of the Merger is subject to a number of uncertainties, including whether the Company continues the integration of the institutions in an efficient and effective manner, as well as general competitive factors in the marketplace. Failure to achieve or delays in achieving these anticipated benefits could result in a share price reduction as well as increased costs, decreases in the amount of expected revenues, and diversion of management's time and energy and could materially and adversely affect the Company’s financial condition, results of operations, business and prospects.

Truist will continue to incur substantial expenses related to the Merger and the integration.

There continue to be processes, policies, procedures, operations, technologies, and systems that must be integrated or decommissioned. In addition, the Merger may increase the Company’s compliance and legal risks, including increased litigation or regulatory actions such as fines or restrictions related to the business practices or operations of the combined business.

While the Company has assumed that a certain level of expenses would be incurred, there are many factors beyond the Company’s control that could affect the total amount or the timing of the integration expenses. Moreover, many of the expenses that will be incurred are, by their nature, difficult to estimate accurately. The amount and timing of future charges to earnings as a result of Merger or integration expenses remain uncertain.

COVID-19 Risks

The effects of COVID-19 have adversely impacted the Company’s operations; the duration and impact of these effects is still unknown.

Although the global economy has begun to recover from the COVID-19 pandemic, as many health and safety restrictions have been lifted and vaccine distribution has increased, certain adverse consequences of the pandemic continue to impact the macroeconomic environment and may persist, including labor shortages and disruptions of global supply chains. The growth in economic activity and demand for goods and services, alongside labor shortages and supply chain complications, has also contributed to rising inflationary pressures.

Since the onset of the pandemic, the majority of the Company’s workforce has been working remotely, which may increase cybersecurity risks to the Company. Commercial clients are experiencing varying levels of disruptions or restrictions on their business activity and supply chains, closures of facilities or decreases in demand for their products and services. Consumer clients are experiencing interrupted income or unemployment. Certain industries have been particularly susceptible to the effects of the pandemic, including industries where Truist has outstanding loans to clients. The duration of this severe economic disruption and its related financial impact cannot be reasonably estimated at this time.

The effects of the pandemic initially resulted in an increase in the allowance for credit losses, a reduction of fee income, a reduction of net interest margin, a decrease in demand for certain types of loans, and an increase in expenses. A resurgence of the pandemic could reintroduce or continue to worsen these impacts and also affect the Company’s capital and liquidity position, impair the ability of borrowers to repay outstanding loans, impair the value of collateral securing loans, cause an outflow of deposits, influence the recognition of credit losses on loans and securities and further increase the allowance for credit losses, result in additional lost revenue, cause additional increases in expenses, result in goodwill impairment charges, result in the impairment of other financial and nonfinancial assets, and increase the Company’s cost of capital.

Truist Financial Corporation 21

Since the inception of the COVID-19 pandemic governmental authorities enacted regulations, and protocols, including governmental programs to provide economic relief to businesses and individuals. The application of forbearance and payment deferral policies beyond any statutory requirements may impact Truist’s interest income. Truist participated in the SBA's PPP as an eligible lender with the benefit of a government guaranty of loans to small business clients, many of whom may face difficulties even after being granted such a loan. The Company faces increased risks, in terms of credit, fraud risk, and litigation, in light of participation in this program.

The extent to which the consequences of the COVID-19 pandemic affect the Company’s financial condition, results of operation, and liquidity and capital position will depend on future developments, which are highly uncertain and cannot be predicted, including the rate of distribution and administration of vaccines globally, the severity and duration of any resurgence of COVID-19 variants, future actions taken by governmental authorities, central banks and other third parties in response to the pandemic, and the effects on customers, counterparties, employees and third-party service providers. Moreover, the effects of the COVID-19 pandemic will heighten the other risks described in this Annual Report on Form 10-K.

Climate Risks

Physical, transition, or other risks associated with climate change have the potential to negatively impact operations, business results, and clients.

There is an increasing concern over the risks of climate change and related environmental sustainability matters. Climate change presents (i) physical risks from the direct impacts of changing climate patterns and acute weather events, such as damage to physical assets and service disruptions, and (ii) transition risks from changes in regulations, disruptive technologies, and shifting market dynamics towards a lower carbon economy. The physical risks of climate change include discrete events, such as flooding, hurricanes, tornadoes, and wildfires, and longer-term shifts in climate patterns, such as extreme heat, sea level rise, and more frequent and prolonged drought. Physical risks may alter the Company’s strategic direction in order to mitigate certain financial risks. Such events could also disrupt the Company’s operations or those of its clients or third parties the Company relies on, not only through direct damage to assets, but also from indirect impacts due to supply chain disruption and market volatility. While material impact from climate change is expected to occur over a longer time horizon, the acceleration of a transition to a low-carbon economy could present idiosyncratic risks for individual companies. Additionally, transitioning to a low-carbon economy will entail extensive policy, legal, technology, and market initiatives.

Transition risks, including changes in consumer preferences, additional regulatory requirements or taxes and additional counterparty or customer requirements, could have a material adverse impact on asset values and the financial performance of Truist’s businesses, and those of its clients. Climate change could also present incremental risks to the execution of the Company’s long-term strategy.

Additionally, the Company faces potential reputational risks as a result of its practices related to climate change, including as a result of the Company’s direct or indirect involvement in certain industries, as well as any decisions management makes in response to managing climate risk. As climate risk is interconnected with all key risk types, Truist continues to embed climate risk considerations into risk management strategies. Due to the level of uncertainty around the future path of climate change, the Company’s risk management strategies may not be effective in fully mitigating climate risk exposures.

Market Risks

Changes in interest rates could adversely affect revenue and expenses, the value of assets and liabilities, as well as the availability and cost of capital, and liquidity.

Truist’s balance sheet can be sensitive to movements in market interest rates and spreads. In addition to the impact of the general economy, changes in interest rates or in valuations in the debt or equity markets could directly impact the Company in one or more of the following ways:

•The yield on earning assets and rates paid on interest-bearing liabilities may change in disproportionate ways; or

•The value of financial instruments held could change adversely.

Regional and local economic conditions, competitive pressures and the policies of regulatory authorities affect interest income and interest expense. When interest rates rise, funding costs may rise faster than the yield the Company earns on assets, causing interest margin to contract. Higher interest rates may also result in lower mortgage production income and elevated charge-offs in certain categories of the loan portfolio. Conversely, when interest rates fall, the yield the Company earns on assets may fall faster than the Company’s ability to lower rates paid on deposits or borrowings.

22 Truist Financial Corporation

Certain investment securities, notably MBS, are very sensitive to changes in rates. Generally, when rates rise, prepayments will decrease and the duration of MBS will increase. Conversely, when rates fall, prepayments of principal and interest will increase and the duration of MBS will decrease.

The monetary and fiscal policies of the U.S. federal government could have a material adverse effect on profitability.

Changes in monetary and fiscal policies, including FRB policies, can adversely affect profitability and cannot be controlled or predicted by the Company. FRB policies can:

•significantly impact the cost of funds, as well as the return on assets, both of which can have an impact on interest income;

•materially affect the value of financial assets and liabilities;

•adversely affect borrowers through higher debt servicing costs and potentially increase the risk that they may fail to repay their loan obligations; and

•artificially inflate asset values during prolonged periods of accommodative policy, which could in turn cause volatile markets and rapidly declining collateral values during times of restrictive monetary and fiscal policies.

While interest rates remain low, the FRB is expected to begin raising interest rates during 2022. Truist cannot predict the nature or timing of future changes in monetary policies or the precise effects that they may have on the Company’s activities and financial results.

Elevated inflation and expectations for elevated future inflation can adversely impact economic growth, consumer and business confidence, and the Company’s financial condition and results. In addition, elevated inflation may cause unexpected changes in monetary policies and actions which may adversely affect confidence, the economy, and the Company’s financial condition and results.

Financial results, lending or other business activities could be materially affected by a deterioration of economic conditions.

A prolonged period of slow growth in the U.S. economy as a whole or in any regional markets that Truist serves, or any deterioration in economic conditions or the financial markets may disrupt or dampen the economy, which could materially adversely affect the Company’s financial condition and results.

If economic conditions deteriorate, the Company may see lower demand for loans by creditworthy clients, reducing the Company’s interest income. In addition, if unemployment levels increase or if real estate prices decrease, the Company would expect to incur higher charge-offs and may incur higher expenses in connection with adjustments to the reasonable and supportable forecasts used to estimate the allowance for credit losses in accordance with CECL requirements. These conditions may adversely affect not only consumer loan performance but also commercial and industrial and commercial real estate loans, especially for those businesses that rely on the health of industries or properties that may suffer from deteriorating economic conditions. The ability of these borrowers to repay their loans may be reduced, causing the Company to incur higher credit losses.

The deterioration of economic conditions also could adversely affect financial results for the Company’s fee-based businesses. Truist earns fee income from, among other activities, managing assets for clients, and providing brokerage and other investment advisory and wealth management services. Investment management fees are often based on the value of assets under management and a decrease in the market prices of those assets could reduce the Company’s fee income. Changes in stock or fixed income market prices or client preferences could affect the trading activity of investors, reducing commissions and other fees earned from the Company’s brokerage business. Poor economic conditions and volatile or unstable financial markets would likely adversely affect the Company’s capital markets-related businesses.

Instability in global economic conditions and geopolitical matters, as well as volatility in financial markets, could have a material adverse effect on the Company’s results of operations and financial condition.

Instability in global economic conditions and geopolitical matters, as well as volatility in financial markets, could have a material adverse effect on the Company’s results of operations and financial condition. The macroeconomic environment in the United States is susceptible to global events and volatility in financial markets. For example, trade negotiations between the U.S. and other nations remains uncertain and could adversely impact economic and market conditions for the Company and its clients and counterparties. In addition, global demand for products may exceed supply during the economic recovery from the COVID-19 pandemic, and such shortages may cause inflation, adversely impact consumer and business confidence, and adversely affect the economy as well as the Company’s financial condition and results.

Truist Financial Corporation 23

The replacement of LIBOR could adversely affect Truist’s profitability and financial condition.

LIBOR and certain other interest rate benchmarks are the subject of recent national, international, and other regulatory guidance and proposals for reform. These reforms have caused and may continue to cause such benchmarks to perform differently than in the past, disappear entirely, or have other consequences which cannot be predicted.

A transition away from the widespread use of LIBOR to alternative rates and other potential interest rate benchmark reforms will continue over the course of the next few years. The publication of the one-week and two-month U.S. dollar LIBOR settings ceased as of December 31, 2021, while certain U.S. dollar LIBOR tenors are expected to continue to be published until June 30, 2023. The U.S. federal banking agencies have encouraged banks to cease entering into new contracts that use U.S. dollar LIBOR by December 31, 2021.

A group of market participants convened by the FRB, the ARRC, has selected SOFR as its recommended alternative to U.S. dollar LIBOR. Truist offers SOFR-based lending solutions to wholesale and consumer clients, and enters into SOFR-based derivative contracts. Truist will also support “credit sensitive” alternatives, such as Bloomberg Short Term Bank Yield and other alternatives as they develop in the market. At this time, it is impossible to predict whether SOFR will become an accepted alternative to LIBOR.

SOFR or other alternative reference rates may perform differently than LIBOR in response to changing market conditions. For example, SOFR could experience greater decreases during times of economic stress, which could require the Company to lend at lower rates at times when the Company’s borrowing costs are increasing.

The market transition away from LIBOR to alternative reference rates is complex and could have a range of adverse effects on the Company’s business, financial condition, and results of operations. In particular, any such transition could:

•adversely affect the interest rates received or paid on the revenue and expenses associated with or the value of the Company’s LIBOR-based assets and liabilities;

•adversely affect the interest rates received or paid on the revenue and expenses associated with or the value of other securities or financial arrangements, given LIBOR's role in determining market interest rates globally;

•prompt inquiries or other actions from regulators in respect of the Company’s preparation and readiness for the replacement of LIBOR with an alternative reference rate; and

•result in disputes, litigation, or other actions with borrowers or counterparties about the interpretation and enforceability of certain fallback language in LIBOR-based contracts and securities.

The transition away from LIBOR to an alternative reference rate or rates will require the transition to or development of appropriate systems, models, and analytics to effectively transition the Company’s risk management and other processes from LIBOR-based products to those based on the applicable alternative reference rate, such as SOFR. Truist has developed a LIBOR transition team and project plan that outlines timelines and priorities to prepare its processes, systems, and people to support this transition. There can be no guarantee that these efforts will successfully mitigate the operational risks associated with the transition away from LIBOR to an alternative reference rate.

The manner and impact of the transition from LIBOR to an alternative reference rate, as well as the effect of these developments on the Company’s funding costs, loan, investment and trading securities portfolios, and ALM, is uncertain.

Credit Risks

The Company is subject to credit risk by lending or committing to lend money, or entering into a letter of credit or other types of contracts with counterparties.

Truist incurs credit risk, which is the risk of loss if the Company’s borrowers or counterparties fail to perform according to the terms of their contracts. A number of products expose the Company to credit risk, including loans and leases, lending commitments, derivatives, trading assets and investment securities. Changes in credit quality can have a significant impact on the Company’s earnings and capital position. The Company estimates and establishes contractual lifetime reserves for credit risks and credit losses inherent in its determination of credit exposure. This process, which is critical to the Company’s financial results and condition, requires complex calculations and extensive use of judgment, considering both external and borrower-specific factors that might impair the ability of borrowers to repay their loans. As is the case with any such assessments, there is always the chance that the Company will fail to identify all pertinent factors or that the Company will fail to accurately estimate the impacts of factors identified.

Credit losses may exceed the amount of the Company’s reserves as a result of changing economic conditions, including falling real estate or commodity prices and higher unemployment or other factors such as changes in borrower behavior. There is no assurance that reserves will be sufficient to cover all credit losses. In the event of significant deterioration in current or projected future economic conditions, the Company may be required to increase reserves in future periods, which would reduce the Company’s earnings and potentially impact its capital.

24 Truist Financial Corporation

The Company may have more credit risk and higher credit losses to the extent that loans are concentrated by loan type, industry segment, borrower type, or location of the borrower or collateral.

The Company’s credit risk and credit losses can increase if the Company’s loans are concentrated in borrowers engaged in the same or similar activities or in borrowers who as a group may be uniquely or disproportionately affected by economic, market conditions, or climate change.

Deterioration in economic conditions, housing conditions, or real estate values, including as a result of climate change or natural disasters, in the markets in which the Company operates could result in materially higher credit losses. The Company is also subject to physical risks of climate change, which could manifest in the form of asset quality deterioration and could be exacerbated by specific portfolio concentrations, and transition risks of climate change, which could manifest through longer-term shifts in market dynamics and consumer preferences and could be exacerbated in specific industries that may be more sensitive or vulnerable to a transition to a low carbon economy.

Liquidity Risks

Loss of deposits or a change in deposit mix could increase Truist’s funding costs.

Deposits are a low cost and stable source of funding. Truist competes with banks and other financial institutions for deposits and as a result, could lose deposits in the future or see an increase in costs associated with maintaining deposits. Clients may shift their deposits into higher cost products or the Company may need to raise interest rates to avoid deposit attrition. Funding costs may also increase if deposits lost are replaced with wholesale funding. Higher funding costs reduce Truist’s net interest margin, net interest income, and net income.

Truist’s liquidity could be impaired by an inability to access short-term funding, an unforeseen outflow of cash, or the inability to monetize liquid assets.

Liquidity is essential to Truist’s businesses. When volatility or disruptions occur in the wholesale funding markets, the Company’s ability to access short-term liquidity could be materially impaired. In addition, idiosyncratic factors, as well as other factors outside of the Company’s control, such as a general market disruption or an operational problem that affects third parties, could impair the Company’s ability to access short-term funding or create an unforeseen outflow of cash due to, among other factors, draws on unfunded commitments or deposit attrition. The Company’s inability to monetize liquid assets or to access short-term funding or capital markets could constrain the Company’s ability to make new loans or meet existing lending commitments and could ultimately jeopardize the Company’s overall liquidity and capitalization.

Truist relies on the mortgage secondary market and GSEs for some of the Company’s liquidity.

Truist sells a portion of the mortgage loans that it originates to reduce the Company’s retained credit risk and to provide funding capacity for originating additional loans. GSEs could limit their purchases of conforming loans due to capital constraints or other changes in their criteria for conforming loans (e.g., maximum loan amount or borrower eligibility). This potential reduction in purchases could limit the Company’s ability to fund new loans.

Proposals have been presented to reform the housing finance market in the U.S., including the role of the GSEs in the housing finance market. The extent and timing of any such regulatory reform of the housing finance market and the GSEs, as well as any effect on the Company’s business and financial results, are uncertain.

Any reduction in the Company’s credit ratings could increase the Company’s cost of funding or reduce its access to the capital markets.

Credit ratings are influenced by many factors, including the Company’s profitability, asset quality, capital levels, liquidity, business mix, operations, and risk management practices. Credit ratings may also be influenced by other factors, some of which are outside the Company’s control, such as recent and anticipated economic trends, geopolitical risk, legislative and regulatory developments, including implied levels of government support during a crisis, environmental, social, and governance considerations, and litigation, as well as changes to the rating agencies’ methodologies, among others. Truist’s failure to maintain credit ratings could adversely affect funding costs and increase the Company’s cost of capital. A downgrade to Truist’s credit ratings might also adversely impact the Company’s ability to conduct derivatives business with certain clients and counterparties and could trigger obligations to make cash or collateral payments to certain clients and counterparties. Additionally, a ratings downgrade could affect the Company’s ability to attract or retain funding, including deposits from commercial and corporate clients.

Truist Financial Corporation 25

The Parent Company could have less access to funding sources and its liquidity could be constrained if the Bank becomes unable to pay dividends during a time of stress.

The Parent Company relies upon capital markets access and dividends from affiliates for funding and has less access to contingent funding sources than the Bank. If the Bank were subject to a financial stress, its dividends to the Parent Company could be reduced or eliminated in order to support Bank capital ratios or other regulatory requirements. This would increase the Parent Company’s reliance on capital markets at a time when spreads and funding costs are likely elevated due the stress impacting the Bank.

Compliance Risks

Truist is subject to extensive and evolving government regulation and supervision, which could increase the cost of doing business, limit Truist’s ability to make investments and generate revenue, and lead to costly enforcement actions.

The banking and financial services industries are highly regulated. Truist is subject to supervision, regulation, and examination by regulators, including the FRB, FDIC, NCCOB, SEC, CFTC, CFPB, FINRA, NFA, and various state regulatory agencies. The statutory and regulatory framework governing Truist is generally intended to protect depositors, the DIF, clients, and the U.S. financial system as a whole, and not Truist’s debt holders or shareholders. Reform of the financial services industry resulting from the Dodd-Frank Act, including the EGRRCPA and other legislative, regulatory, and technological changes, affect the Company’s operations.

These laws and regulations and Truist's inability to act in certain instances without receiving prior regulatory approval affect Truist’s lending practices, capital structure, investment practices, dividend policy, ability to repurchase common stock and ability to pursue strategic acquisitions, among other activities. Changes to statutes, regulations or regulatory policies or their interpretation or implementation and the continued heightening of regulatory requirements could affect Truist in substantial and unpredictable ways. Federal and state banking regulators also possess broad powers to take supervisory actions as they deem appropriate. These supervisory actions may result in higher capital requirements, higher deposit insurance premiums, and limitations on the Company’s activities that could have a material adverse effect on operations or profitability.

In recent years, both Congress and the federal banking regulators have engaged in a rebalancing of the post financial crisis legal and regulatory framework, particularly by tailoring enhanced prudential standards to the size, risk profile, and complexity of the banking organization. Under the current presidential administration and Congress, the Company and other large financial institutions are becoming subject to increased scrutiny, more intense supervision and regulation, and a higher risk of enforcement action. Truist expects that its businesses will remain subject to extensive regulation and supervision. Any potential new regulations or modifications to existing regulations would likely necessitate changes to Truist’s existing regulatory compliance and risk management infrastructure. Compliance with new regulations and supervisory initiatives may increase costs. In addition, concerns over climate change may prompt changes in regulations that, in turn, could have a material adverse impact on asset values and the financial performance of Truist’s businesses and its clients.

Truist is subject to heightened requirements under the enhanced prudential standards and expects increased supervisory scrutiny, including, for example, single counterparty credit limits, heightened expectations with respect to governance, risk management and internal controls and additional capital and liquidity requirements.

Financial regulators’ prudential and supervisory authority gives them broad power and discretion to direct Truist’s actions, and they have assumed an active oversight, examination, and enforcement role across the financial services industry on both the federal and state levels. Areas of focus in the recent past have been with respect to mortgage-related practices, student lending practices, auto lending practices, sales practices and related incentive compensation programs, consumer privacy, fair banking, overdraft fees, and other consumer compliance matters. During November 2019, SunTrust Bank entered into a consent order with the FRB, relating to certain identified legacy compliance issues, and requiring certain remediation actions and the verification of such actions regarding the identified issues. In June 2021, the FDIC terminated this consent order. Truist continues to be subject to examinations and ongoing monitoring to assess compliance with BSA/AML laws and regulations, as well as sanctions compliance administered by the OFAC. Additionally, misconduct by teammates, including unethical, fraudulent, improper, or illegal conduct, or other unfair, deceptive, abusive, or discriminatory practices, can result in litigation, or government investigations and enforcement actions, and cause significant reputational harm. See additional disclosures in the "Regulatory Considerations" section.

26 Truist Financial Corporation

The Company is subject to laws, rules, and regulations regarding compliance with privacy policies and the disclosure, collection, use, sharing and safeguarding of personal identifiable information of certain parties. There has recently been an increase in legislative and regulatory efforts to protect the privacy of consumer data. Truist will likely be subject to new and evolving data privacy laws in the U.S. and abroad, which could result in additional costs of compliance, litigation, regulatory fines, and enforcement actions. These laws may limit how companies can use customer data and may increase compliance complexity and related costs, result in significant financial penalties for compliance failures, and limit the Company’s ability to develop new products or respond to technological changes. Truist also relies upon third parties who may expose the Company to compliance and legal risk. New or existing legal requirements also could heighten the reputational impact of perceived misuses of customer data by the Company and third parties.

Heightened regulatory scrutiny or the results of an investigation or examination may lead to additional regulatory investigations or enforcement actions. There is no assurance that those actions will not result in regulatory settlements or other enforcement actions against Truist. Furthermore, a single event involving a potential violation of law or regulation may give rise to numerous and overlapping investigations and proceedings, either by multiple federal and state agencies and officials in the United States or, in some instances, regulators and other governmental officials in foreign jurisdictions. In addition, if another financial institution is found to have violated a law or regulation relating to certain business activities, this could lead to investigations by regulators or other governmental agencies of the same or similar activities by other financial institution, including Truist. Responding to inquiries, investigations, lawsuits, and proceedings is time-consuming and expensive and can divert senior management attention from Truist’s business. The outcome of such proceedings, which may last a number of years, may be difficult to predict or estimate.

Federal law grants substantial enforcement powers to federal banking regulators and law enforcement agencies. This enforcement authority includes, among other things, the ability to assess significant civil or criminal monetary penalties, fines, or restitution; to issue cease and desist or removal orders; and to initiate injunctive actions against banking organizations and institution-affiliated parties. These enforcement actions may be initiated for violations of laws and regulations and unsafe or unsound practices.

A failure to comply with regulatory requirements and expectations could expose the Company to fines, regulatory penalties, other costs, reputational damage and regulatory or enforcement actions, such as limitations on engaging in new activities or expanding geographically. In some cases, governmental authorities have required criminal pleas or other extraordinary terms as part of such settlements, which could have significant consequences for a financial institution, including loss of clients, restrictions on the ability to access the capital markets and the inability to operate certain businesses or offer certain products for a period of time. Violations of laws and regulations or deemed deficiencies in risk management practices also may be incorporated into Truist’s confidential supervisory ratings. A downgrade in these ratings or these or other regulatory actions and settlements, could limit Truist’s ability to conduct expansionary activities for a period of time and require new or additional regulatory approvals before engaging in certain other business activities. Any future enforcement action could have a material adverse impact.

Truist could become subject to future legislation and regulatory requirements beyond those currently proposed, adopted, or contemplated, including policies and rulemaking related to Dodd-Frank Act, limits on acquisitions, the COVID-19 pandemic, and climate change. The cumulative effect of such legislation and regulations on Truist’s’ business, operations, and profitability remains uncertain. Such regulatory changes may reduce Truist’s revenues, limit the types of financial services and products it may offer, alter the investments it makes, affect the manner in which it operates its businesses, increase its litigation and regulatory costs should it fail to appropriately comply with new or modified laws and regulatory requirements and increase the ability of non-banks to offer competing financial services and products.

Truist is subject to regulatory capital and liquidity standards that affect the Company’s business, operations, and ability to pay dividends, or otherwise return capital to shareholders.

Truist is subject to regulatory capital and liquidity requirements established by the FRB and the FDIC. These regulatory capital and liquidity requirements are typically developed at an international level by the BCBS and then applied, with adjustments, in each country by the appropriate domestic regulatory bodies. Domestic regulatory agencies have the ability to apply stricter capital and liquidity standards than those developed by the BCBS. In several instances, the U.S. banking agencies have done so with respect to U.S. banking organizations.

Requirements to maintain specified levels of capital and liquidity and regulatory expectations as to the quality of the Company’s capital and liquidity may prevent the Company from taking advantage of opportunities in the best interest of shareholders or force the Company to take actions contrary to their interests. For example, Truist may be limited in its ability to pay or increase dividends or otherwise return capital to shareholders. In addition, these requirements may impact the amount and type of loans the Company is able to make. Truist may be constrained in its ability to expand, either organically or through mergers and acquisitions. These requirements may cause the Company to sell or refrain from acquiring assets where the capital requirements appear inconsistent with the assets' underlying risks. In addition, liquidity standards require the Company to maintain holdings of highly liquid investments, thereby reducing the Company’s ability to invest in less liquid assets, even if more desirable from a balance sheet or interest rate risk management perspective. As a Category III banking organization, Truist is subject to additional capital and liquidity requirements.

Truist Financial Corporation 27

The liquidity standards applicable to large U.S. banking organizations have been supplemented in recent years. The NSFR rule, which is designed to ensure that banking organizations maintain a stable funding profile in relation to their asset composition and off-balance sheet activities, became effective on July 1, 2021. Public disclosure of the NSFR will begin in 2023.

In addition to the regulatory capital and liquidity requirements applicable to Truist and Truist Bank, the Company’s broker-dealer subsidiaries are subject to capital requirements established by the SEC.

Regulatory capital and liquidity requirements receive periodic review and revision by the BCBS and the U.S. banking agencies. Changes to capital and liquidity requirements may require Truist or Truist Bank to maintain more or higher quality capital or greater liquidity and could increase some of the potential adverse effects described above.

Truist is subject to certain risks related to originating and selling mortgages and may be required to repurchase mortgage loans or indemnify mortgage loan purchasers.

Truist is required to make customary representations and warranties to the purchaser about the mortgage loans and the manner in which they were originated when selling mortgage loans or loan securitizations. An increase in the number of repurchase and indemnity demands from purchasers related to representations and warranties on loans sold could result in an increase in the amount of losses for loan repurchases. Truist also bears a risk of loss from borrower defaults for multi-family commercial mortgage loans sold to FNMA.

In addition to repurchase claims from GSEs, Truist could be subject to indemnification claims from non-GSE purchasers of the Company’s loans. Claims could be made if Truist fails to conform to statements about the quality of the mortgage loans sold, the manner in which the loans were originated and underwritten or their compliance with state and federal law.

Truist faces risks as a servicer of loans.

The Company acts as servicer and master servicer for mortgage loans included in securitizations and for unsecuritized mortgage loans owned by investors. As a servicer or master servicer for those loans, the Company has certain contractual obligations to the securitization trusts, investors, or other third parties. As a servicer, Truist’s obligations include foreclosing on defaulted mortgage loans or, to the extent consistent with the applicable securitization or other investor agreement, considering alternatives to foreclosure such as loan modifications or short sales. In the Company’s capacity as a master servicer, obligations include overseeing the servicing of mortgage loans by the servicer. Generally, the Company’s servicing obligations are set by contract, for which the Company receives a contractual fee. However, GSEs can amend their servicing guidelines, which can increase the scope or costs of the services required without any corresponding increase in the Company’s servicing fee. Further, the CFPB has implemented national servicing standards which have increased the scope and costs of services which the Company is required to perform. In addition, there has been a significant increase in state laws that impose additional servicing requirements that increase the scope and cost of the Company’s servicing obligations. As a servicer, the Company also advances expenses on behalf of investors which it may be unable to collect.

A material breach of the Company’s obligations as servicer or master servicer may result in contract termination if the breach is not cured within a specified period of time following notice, which can generally be given by the securitization trustee or a specified percentage of security holders, causing the Company to lose servicing income. In addition, the Company may be required to indemnify the securitization trustee against losses from any failure by the Company, as a servicer or master servicer, to perform the Company’s servicing obligations or any act or omission on the Company’s part that involves willful misfeasance, bad faith, or gross negligence. For certain investors and certain transactions, Truist may be contractually obligated to repurchase a mortgage loan or reimburse the investor for credit losses incurred on the loan as a remedy for servicing errors with respect to the loan. The Company may be subject to increased repurchase obligations as a result of claims made that the Company did not satisfy its obligations as a servicer or master servicer. The Company may also experience increased loss severity on repurchases, which may require a material increase to the Company’s repurchase reserve.

The Company has and may continue to receive indemnification requests related to the Company’s servicing of loans owned or insured by other parties, primarily GSEs. Typically, such a claim seeks to impose a compensatory fee on the Company for departures from GSE service levels. In most cases, this is related to delays in the foreclosure process. Additionally, the Company has received indemnification requests where an investor or insurer has suffered a loss due to a breach of the servicing agreement. While the number of such claims has been small, these could increase in the future.

28 Truist Financial Corporation

Strategic Risks

Truist may face the risk of financial loss or negative impact resulting from ineffective strategy setting and execution, adverse business decisions, or lack of responsiveness to changes in the external environment.

Embedded within strategic risks are risks associated with:

•maintaining a level of earnings appropriate to support growth objectives and the ability to maintain dividends in various economic cycles,

•successful delivery of innovation and technology strategies that transform the client experience as well as the way Truist conducts business,

•changes and events within the external environment, including geopolitical, macroeconomic, social, cultural, competitive, and regulatory factors, and

•implementation and execution of climate risk management related programs.

Any of the foregoing may impact the successful execution of Truist’s strategy.

Competition may reduce Truist’s client base or cause Truist to modify pricing for products and services.

Truist operates in a highly competitive industry that could become even more competitive with growth in areas such as neo-banks, fintechs, and other non-bank platforms. Increased competition could arise from technological advancements, legislative and regulatory changes, as well as competition from other financial services companies, some of which may be subject to less extensive regulation than Truist. The Company’s success depends, in part, on the Company’s ability to adapt its offering of products and services to evolving industry standards and client expectations. The widespread adoption of new technologies has required and will continue to require substantial investments to modify existing products and services or to develop new products and services. In addition, there is increasing pressure to provide products and services at lower prices further reducing contribution margins. The Company may not be successful in introducing new products and services in response to industry trends or developments in technology or those new products may not achieve market acceptance.

Truist also competes with nonbank companies inside and outside of the Company’s market area and, in some cases, with companies other than those traditionally considered financial sector participants. In particular, technology companies are increasingly focusing on the financial sector, either in partnership with competitor banking organizations or on their own. These companies generally are not subject to the same regulatory oversight as main street financial institutions and may accordingly realize certain cost strategies and offer products and services at more favorable rates and with greater convenience to the client. This competition could result in the loss of clients and revenue in areas where fintechs are operating. As the pace of technology and change advance, continuous innovation is expected to exert long-term pressure on the financial services industry.

The adoption of new technologies by competitors, including internet banking services, mobile applications, advanced ATM functionality and cryptocurrencies could require the Company to make substantial investments to modify or adapt the Company’s existing products and services or even radically alter the way Truist conducts business. These and other capital investments in the Company’s business may not produce expected growth in earnings anticipated at the time of the expenditure.

Truist may not be able to complete future mergers or acquisitions.

The Company must generally satisfy a number of meaningful conditions before completing an acquisition of another bank or BHC, including federal and state regulatory approvals. In determining whether to approve a proposed bank or BHC acquisition, bank regulators will consider, among other factors, the effect of the acquisition on competition; financial condition and future prospects, including current and projected capital ratios and levels; the competence, experience and integrity of management; record of compliance with laws and regulations; the convenience and needs of the communities to be served, including the acquiring institution's record of compliance under the CRA; the effectiveness of the acquiring institution in combating money laundering activities; and protests from various stakeholders. In addition, U.S. regulators must take systemic risk to the U.S. financial system into account when evaluating whether to approve a potential acquisition transaction involving a large financial institution like Truist. There is no certainty as to when or if or on what terms and conditions, any required regulatory approvals will be granted for any potential acquisition. In specific cases, Truist may be required to sell banks or branches or take other actions as a condition to receiving regulatory approval. An inability to satisfy other conditions necessary to consummate an acquisition transaction, such as third party litigation, a judicial order blocking the transaction or lack of shareholder approval, could also prevent the Company from completing an announced acquisition. There has been increased scrutiny of bank and financial institution acquisitions from regulators and government entities in recent years. Refer to the “Acquisitions” section within Item 1 “Business” for additional discussion.

Truist Financial Corporation 29

Truist has businesses other than banking that are subject to a variety of risks.

Truist is a diversified financial services company and this diversity subjects the Company’s earnings to a broader variety of risks and uncertainties. Other businesses in addition to banking that the Company operates include insurance, investment banking, securities underwriting and market making, loan syndications, investment management and advice and retail and wholesale brokerage services offered through the Company’s subsidiaries. These businesses entail significant market, operational, credit, compliance, technology, legal and other risks that could materially adversely impact the Company’s results of operations.

Reputational Risks

Negative public opinion could damage the Company’s reputation and adversely impact business and revenues.

Truist’s earnings and capital are subject to risks associated with negative public opinion. Negative public opinion could result from the Company’s actual or alleged conduct in any number of activities, including lending, sales and other operating practices, corporate governance, acquisitions, a breach of client or teammate information, the failure of any product or service sold to meet clients' expectations or applicable regulatory requirements. Negative public opinion could also result from an increase in the level of social and environmental activism surrounding Truist or other financial services companies. Negative public opinion could adversely affect the Company’s ability to attract and retain clients and teammates and can result in litigation and regulatory actions. Actual or alleged conduct by one of the Company’s businesses can result in negative public opinion about the Company’s other businesses. Actual or alleged conduct by another financial services company can result in negative public opinion about the financial services industry in general and, as a result, adversely affect Truist.

Scrutiny of the Company’s sales, training, and incentive compensation practices could damage the Company’s reputation and adversely impact business and revenues.

The Company may face increased scrutiny of the Company’s sales and other business practices, training practices, incentive compensation design and governance, and quality assurance and client complaint resolution practices. There can be no assurance that the Company’s processes and actions will meet regulatory standards or expectations. Findings from self-identified or regulatory reviews may require responsive actions, including increased investments in compliance systems and teammates or the payment of fines, penalties, increased regulatory assessments or client redress and may increase legal or reputational risk exposures.

Operational Risks

Litigation may adversely affect the Company’s results.

The Company is subject to litigation in the ordinary course of business. Claims and legal actions, including class action lawsuits and enforcement actions by the Company’s regulators, which are becoming more common in the current regulatory environment, could involve large monetary amounts, significant defense costs, and result in settlements, judgments, penalties, fines, injunctions, or other forms of relief that are adverse to the Company. The outcome of litigation and regulatory matters as well as the timing of ultimate resolution are inherently difficult to predict.

Actual legal and other costs arising from claims and legal actions may be greater than the Company’s legal reserves. The ultimate resolution of a pending legal proceeding could materially adversely affect the Company’s results of operations and financial condition.

In addition, governmental authorities have, at times, sought criminal penalties against companies in the financial services sector for violations, and, at times, have required an admission of wrongdoing from financial institutions in connection with resolving such matters. Criminal convictions or admissions of wrongdoing in a settlement with the government can lead to greater exposure in civil litigation and reputational harm.

Substantial legal liability or significant regulatory or government action against the Company could have material adverse financial effects or cause significant reputational harm, which adversely impact the Company’s business prospects. Further, the Company may be exposed to substantial uninsured liabilities, which could adversely affect the Company’s results of operations and financial condition.

30 Truist Financial Corporation

The Company may incur fines, penalties and other negative consequences from regulatory violations, including inadvertent or unintentional violations.

Truist maintains systems and procedures designed to ensure that it complies with applicable laws and regulations, but there can be no assurance that these will be effective. In addition to fines and penalties, the Company may suffer other negative consequences from regulatory violations including restrictions on certain activities, such as the Company’s mortgage business, which may affect the Company’s relationship with the GSEs and may also damage the Company’s reputation and this in turn might materially affect the Company’s business and results of operations.

Further, some legal frameworks provide for the imposition of fines or penalties for noncompliance even when the noncompliance was inadvertent or unintentional and even when there were systems and procedures in place designed to ensure compliance. For example, Truist is subject to regulations issued by OFAC that prohibit financial institutions from participating in the transfer of property belonging to the governments of certain foreign countries and designated nationals of those countries. OFAC may impose penalties for inadvertent or unintentional violations even if reasonable processes are in place to prevent the violations. Courts may uphold significant additional penalties on financial institutions, even where the financial institution had already reimbursed the government or other counterparties for actual losses.

Truist relies on other companies to provide key components of the Company’s business infrastructure.

Third parties provide key components of the Company’s business infrastructure, such as banking services, data processing, business processes, internet connections, and network access. Any disruption in such services provided by these third parties or any failure of these third parties to handle current or higher volumes of use could adversely affect the Company’s ability to deliver products and services to clients, to support teammates and otherwise to conduct business. Technological or financial difficulties of a third party service provider could adversely affect the Company’s business to the extent those difficulties result in the interruption or discontinuation of services provided by that party. Further, in some instances, the Company may be responsible for failures of such third parties to comply with government regulations. The Company is not insured against all types of losses as a result of third party failures, and the insurance coverage that does exist may be inadequate to protect the Company from all losses resulting from system failures or other disruptions. Failures in the Company’s business infrastructure could interrupt the operations or increase the costs of doing business.

Truist depends on the expertise of key teammates. If these individuals leave or change their roles without effective replacements, operations may suffer.

The Company’s success depends, to a large degree, on the continued services of executive officers and other key teammates who have extensive experience in the industry. The Company’s business could be adversely impacted from the loss of key persons or failure to manage a smooth transition to new teammates. These risks may be exacerbated as the Company continues to integrate processes and systems subsequent to the Merger.

The Company may not be able to hire or retain additional qualified teammates and recruiting and compensation costs may increase as a result of changes in the marketplace, which may increase costs and adversely impact the Company’s ability to implement business strategies.

The Company’s success depends upon the ability to attract and retain high performing, diverse and well-qualified teammates. The Company faces significant competition in the recruitment of highly motivated teammates who can deliver Truist’s purpose, mission, and values, which has recently intensified as a result of changes in the labor market caused by COVID-19. The Company’s ability to execute its business strategy and provide high quality service may suffer if the Company is unable to recruit or retain a sufficient number of qualified teammates or if the costs of employee compensation or benefits increase substantially. The U.S. banking agencies have jointly issued comprehensive guidance designed to ensure that incentive compensation policies do not undermine the safety and soundness of banking organizations by encouraging teammates to take imprudent risks. This guidance significantly affects the amount, form, and context of incentive compensation to teammates. The FRB, FDIC, SEC, and other federal regulatory agencies have jointly proposed rules, which would affect incentive compensation. These rules were included on the SEC's regulatory agenda in 2021 for proposed rulemaking. If finalized, these rules may result in additional costs and restrictions on the form of the Company’s incentive compensation. These risks may be intensified in the increased work-from-home environment caused by the COVID-19 pandemic as job opportunities may be less constrained by physical geography.

Truist Financial Corporation 31

The Company’s framework for managing risks may not be effective.

The Company’s risk management framework seeks to mitigate risk and loss. Truist has established policies, processes, and procedures intended to identify, measure, monitor, report, and analyze the types of risk to which the Company is subject, including liquidity, credit, market, operational, technology, reputational, legal, model, and compliance risk, among others. However, the Company’s risk management measures may not be fully effective in identifying and mitigating the Company’s risk exposure in all market environments or against all types of risk, including risks that are unidentified or unanticipated, even if the models for assessing risk are properly designed and implemented. Some of the Company’s methods of managing risk are based upon the Company’s use of observed historical market behavior and management's judgment. These methods may not accurately predict future exposures, which could be significantly greater than historical measures indicate. If the Company’s risk management framework proves ineffective, it could suffer unexpected losses and could be materially adversely affected.

There are risks resulting from the extensive use of models in Truist’s business, which may impact decisions made by Management and regulators.

Truist relies on quantitative models to measure risks and to estimate certain financial values. Models may be used in such processes as determining the pricing of various products, grading loans and extending credit, measuring interest rate and other market risks, predicting or estimating losses, assessing capital adequacy and calculating economic and regulatory capital levels, as well as estimating the value of financial instruments and balance sheet items.

Poorly designed or implemented models present the risk that Truist’s business decisions based on information incorporating model output would be adversely affected due to the inadequacy of that information. Also, information Truist provides to the public or to its regulators based on poorly designed or implemented models could be inaccurate or misleading. Some of the decisions that the regulators make, including those related to capital distributions to Truist’s shareholders, could be adversely affected due to the perception that the quality of the models used to generate the relevant information is insufficient.

The Company is at risk of increased losses from fraud.

Criminals committing fraud increasingly are using more sophisticated techniques and in some cases, are a part of larger criminal organizations, which allow them to be more effective. Fraudulent activity has taken many forms and escalates as more tools for accessing financial services emerge, such as real-time payments. Fraud schemes are broad and continuously evolving and include such things as debit card/credit card fraud, check fraud, mechanical devices attached to ATM machines, social engineering, and phishing attacks to obtain personal information or impersonation of the Company’s clients through the use of falsified or stolen credentials.

In addition, individuals or business entities may properly identify themselves, yet seek to establish a business relationship for the purpose of perpetrating fraud. Increased deployment of technologies, such as chip card technology, defray and reduce aspects of fraud; however, criminals are turning to other sources to steal personally identifiable information, such as unaffiliated healthcare providers and government entities, in order to impersonate the consumer to commit fraud. Further, as a result of the increased sophistication of fraud activity, the Company has increased spending on systems, resources and controls to detect and prevent fraud, as well as increased spending to provide certain credit monitoring and identity theft protection services to the Company’s consumer clients. This will result in continued ongoing investments in the future.

The Company’s operational or security systems or infrastructure or those of third parties, could fail or be breached, which could disrupt the Company’s business and adversely impact the Company’s results of operations, liquidity and financial condition, as well as cause legal or reputational harm.

The potential for operational risk exposure exists throughout the Company’s business and, as a result of the Company’s interactions with and reliance on third parties, is not limited to the Company’s own internal operational functions. The Company’s operational and security systems and infrastructure, including computer systems, data management and internal processes, as well as those of third parties, are integral to the Company’s performance. Truist teammates and third parties may expose the Company to risk as a result of human error, misconduct, malfeasance, or a failure or breach of systems and infrastructure. For example, the Company’s ability to conduct business may be adversely affected by any significant disruptions, including to third parties with whom the Company interacts or relies upon.

32 Truist Financial Corporation

Natural disasters and other catastrophic events, which may increase in frequency and intensity due to climate change, could have a material adverse impact on the Company’s operations or the Company’s financial condition and results.

The occurrence of catastrophic weather events or pandemics could adversely affect the Company’s financial condition or results of operations. Truist has significant operations and clients along the Gulf and Atlantic coasts as well as other regions of the U.S., which could be adversely impacted by hurricanes, tornadoes and other severe weather in those areas. Truist and its clients could also be disrupted by the physical effects of climate change, which may become more frequent and severe. Natural and other types of disasters, including as a result of climate change, could have an adverse impact on Truist’s businesses in that such events could materially disrupt the Company’s operations or the ability or willingness of the Company’s clients to access the financial services offered by Truist, including adverse impacts on the Company’s borrowers to timely repay their loans and the value of any collateral held. These events could reduce the Company’s earnings and cause volatility in the Company’s financial results for any fiscal quarter or year and have a material adverse effect on the Company’s financial condition and results of operations.

Although Truist has business continuity plans and other safeguards in place, the Company’s operations and communications may be adversely affected by natural disasters or other catastrophic events, and there can be no assurance that such business continuity plans will be effective.

Truist may be impacted by the soundness of other financial institutions.

The Company’s ability to engage in routine funding transactions could be adversely affected by the actions and commercial soundness of other financial institutions. Financial services institutions are interrelated as a result of trading, clearing, counterparty and other relationships. Truist has exposure to many different industries and counterparties and routinely executes transactions with counterparties in the financial industry, including brokers and dealers, central counterparties, commercial banks, investment banks, mutual and hedge funds and other institutional investors and clients. As a result, defaults by, or even rumors or questions about, one or more financial services institutions or the financial services industry generally, in the past have led to market-wide liquidity problems and could lead to losses or defaults by Truist or by other institutions. Many of these transactions expose the Company to credit risk in the event of default of the Company’s counterparty or client. In addition, the Company’s credit risk may be exacerbated when the collateral held by Truist cannot be liquidated or is liquidated at prices not sufficient to recover the full amount of the Company’s exposure. Any such losses could materially and adversely affect the Company’s results of operations and financial condition.

Truist depends on the accuracy and completeness of information about clients and counterparties.

In deciding whether to extend credit or enter into other transactions with clients and counterparties, Truist relies on the completeness and accuracy of representations made by and information furnished by or on behalf of clients and counterparties, including financial statements and other financial information. If the information provided is not accurate or complete, the Company’s decisions about extending credit or entering into other transactions with clients or counterparties could be adversely affected and the Company could suffer defaults, credit losses or other negative consequences as a result.

The Company’s accounting policies and processes are critical to how the Company reports its financial condition and results of operations and require management to make estimates about matters that are uncertain.

Accounting policies and processes are fundamental to how the Company records and reports its financial condition and results of operations. Some of these policies require the use of estimates and assumptions that may affect the value of the Company’s assets or liabilities and financial results. Several of the Company’s accounting policies are critical because they require management to make difficult, subjective, and complex judgments about matters that are inherently uncertain and because it is likely that materially different amounts would be reported under different conditions or using different assumptions. If assumptions or estimates underlying the Company’s financial statements are incorrect or are adjusted periodically, the Company may experience material losses.

Management has identified certain accounting policies as being critical because they require management’s judgment to ascertain the valuations of assets, liabilities, commitments, and contingencies. A variety of factors could affect the realization of income and expense or the recognition of assets and liabilities in the Company’s financial statements. Truist has established detailed policies and control procedures that are intended to ensure these critical accounting estimates and judgments are well controlled and applied consistently. In addition, the policies and procedures are intended to ensure that the process for changing methodologies occurs in an appropriate manner. Due to the uncertainty surrounding the Company’s judgments and the estimates pertaining to these matters, the Company cannot guarantee that adjustments to accounting policies or restatement of prior period financial statements will not be required.

Truist Financial Corporation 33

Further, from time to time, the FASB and SEC change the financial accounting and reporting standards that govern the preparation of the Company’s financial statements. In addition, accounting standard setters and those who interpret the accounting standards may change or even reverse their previous interpretations or positions on how these standards should be applied. Changes in financial accounting and reporting standards and changes in current interpretations may be beyond the Company’s control, can be hard to predict and could materially affect how the Company reports its financial results and condition. In some cases, the Company could be required to apply a new or revised standard retroactively, resulting in the restatement of prior period financial statements.

Depressed market values for the Company’s stock and adverse economic conditions sustained over a period of time may require the Company to write down all or some portion of the Company’s goodwill.

Goodwill is periodically tested for impairment by comparing the fair value of each reporting unit to its carrying amount. If the fair value is greater than the carrying amount, then the reporting unit’s goodwill is deemed not to be impaired. The fair value of a reporting unit is impacted by the reporting unit’s expected financial performance and susceptibility to adverse economic, regulatory, and legislative changes. Future adverse changes in economic conditions or expected financial performance may cause the fair value of a reporting unit to be below its carrying amount, resulting in goodwill impairment. The estimated fair values of the individual reporting units are assessed for reasonableness by reviewing a variety of indicators, including comparing these estimated fair values to the Company’s market capitalization over a reasonable period of time. While this comparison provides some relative market information about the estimated fair value of the reporting units, it is not determinative and needs to be evaluated in the context of the current economic environment. However, significant and sustained declines in the Company’s market capitalization could be an indication of potential goodwill impairment. Refer to the "Critical Accounting Policies" section for additional details related to the Company’s intangible assets policy.

Certain banking laws and certain provisions of the Company’s articles of incorporation may have an anti-takeover effect.

Provisions of federal banking laws, including regulatory approval requirements, could make it difficult for a third party to acquire the Company, even if doing so would be perceived to be beneficial to the Company’s owners. Acquisition of certain amounts of any class of voting stock of a BHC or depository institution, including shares of the Company’s common stock, may create a rebuttable presumption that the acquirer "controls" the BHC or depository institution and thus, unless the acquirer is able to rebut this presumption, it would be subject to various laws and regulations applicable to a BHC. Also, a BHC must obtain the prior approval of the FRB before, among other things, acquiring direct or indirect ownership or control of more than 5% of the voting shares of any bank, including Truist Bank.

There also are provisions in the Company’s amended and restated articles of incorporation and amended and restated bylaws, such as limitations on the ability to call a special meeting of the Company’s shareholders, that may be used to delay or block a takeover attempt. In addition, the Company’s Board will be authorized under the Company’s amended and restated articles of incorporation to issue shares of the Company’s preferred stock and to determine the rights, terms, conditions and privileges of such preferred stock, without shareholder approval. These provisions may effectively inhibit a non-negotiated merger or other business combination.

Technology Risks

The Company faces cybersecurity risks, including denial of service, hacking, and malware or ransomware attacks, which could result in the disclosure of confidential information, adversely affect the Company’s operations or reputation, and create significant legal and financial exposure.

The Company’s computer systems and network infrastructure and those of third parties are frequently targeted in cyber-attacks, such as denial of service attacks, hacking, malware or ransomware intrusion, data corruption attempts, terrorist activities, or identity theft. The Company’s business relies on the secure processing, transmission, storage, and retrieval of confidential, proprietary, and other information in the Company’s information systems and that of third parties. In addition, to access the Company’s network, products, and services, the Company’s clients and other third parties may use personal mobile devices or computing devices that are outside of the Company’s network environment and can introduce added cybersecurity risks.

Truist and Truist’s clients, regulators and other third parties, including other financial services institutions and companies engaged in data processing, have been subject to and are likely to continue to be the target of, cyber-attacks and similar incidents. Cyber-attacks may expose security vulnerabilities in the Company’s systems or the systems of third parties or other security measures that could result in the unauthorized gathering, monitoring, misuse, release, loss, or destruction of confidential, proprietary, or sensitive information. A cyber-attack could also damage the Company’s systems by introducing material disruptions to the Company’s or the Company’s clients’ or other third parties’ network access or business operations. As cyber threats continue to evolve, the Company may be required to expend significant additional resources to continue to modify or enhance the Company’s protective measures or to investigate and remediate any information security vulnerabilities or incidents. Despite efforts to ensure the integrity of the Company’s systems and implement controls, processes, policies and other protective measures, the Company may not be able to anticipate all security breaches, nor may the Company be able to implement sufficient preventive measures against such security breaches, which may result in material losses or consequences to Truist.

34 Truist Financial Corporation

Cybersecurity risks for financial institutions have significantly increased in recent years in part because of the proliferation of new technologies to facilitate and conduct financial transactions. For example, cybersecurity risks may increase in the future as Truist continues to evolve its internal and external digital offerings and capabilities. In addition, cybersecurity risks have significantly increased in recent years in part due to the increased sophistication and activities of organized crime affiliates, terrorist organizations, hostile foreign governments, disgruntled teammates or vendors, activists and other external parties, including those involved in corporate espionage. Even the most advanced internal control environment may be vulnerable to compromise. Persistent attackers may succeed in penetrating defenses given enough resources, time, and motive. The techniques used by cyber criminals change frequently, and may not be recognized until launched or well after a breach has occurred. In addition, the existence of cyber-attacks or security breaches at third party vendors with access to the Company’s data may not be disclosed in a timely manner.

The Company also faces indirect technology, cybersecurity and other operational risks relating to clients and other third parties that the Company relies upon to facilitate or enable business activities, including, financial counterparties, regulators, and providers of critical infrastructure such as internet access and electrical power. In addition, Truist faces cybersecurity and other operational risks relating to the Merger, including increased phishing attacks on teammates, increased network perimeter scanning by attackers searching for vulnerabilities and domain name squatting. Further, as a result of increasing consolidation, interdependence, and complexity of financial entities and technology systems, a technology failure, cyber-attack or other information or security breach that significantly degrades, deletes, or compromises the systems or data of one or more financial entities could have a material impact on counterparties or other market participants. This consolidation, interconnectivity, and complexity increases the risk of operational failure, on both individual and industry-wide bases, as disparate systems need to be integrated, often on an accelerated basis. Any third party technology failure, cyber-attack, other information or security breach, termination, or constraint could, among other things, adversely affect the Company’s ability to conduct transactions, service the Company’s clients, manage the Company’s exposure to risk or expand the Company’s business.

The public perception that a cyber-attack on the Company’s systems has been successful, whether or not this perception is correct, may damage the Company’s reputation with clients and third parties with whom the Company does business. The compromise of personal information, in particular, could result in identify theft and cause serious reputational harm. A successful penetration or circumvention of system security could cause serious negative consequences, including loss of clients and business opportunities; costs associated with maintaining business relationships after an attack or breach; significant disruption to the Company’s operations and business; misappropriation, exposure or destruction of the Company’s confidential information, intellectual property, funds and those of the Company’s clients; damage to the Company’s or the Company’s clients’ or third parties’ computers or systems; or a violation of applicable privacy laws and other laws. This could result in litigation exposure, regulatory fines, penalties, loss of confidence in the Company’s security measures, reputational damage, reimbursement or other compensatory costs, and additional compliance costs, which could adversely impact the Company’s results of operations, liquidity, and financial condition. In addition, the Company may not have adequate insurance coverage to compensate for losses from a cybersecurity event.

Truist will continually encounter technological change and must effectively anticipate, develop, and implement new technology.

The financial services industry is undergoing rapid technological change with frequent introductions of new technology-driven products and services. Truist has invested in technology to automate functions previously performed manually, to facilitate the ability of clients to engage in financial transactions and otherwise to enhance the client experience with respect to the Company’s products and services. Truist expects to make additional investments in innovation and technology to address technological disruption in the industry and improve client offerings and service. These changes allow the Company to better serve the Company’s clients and to reduce costs.

The Company’s continued success depends, in part, upon the Company’s ability to address clients’ needs by using technology to provide products and services that satisfy client demands, including demands for faster and more secure payment services, to create efficiencies in the Company’s operations and to integrate those offerings with legacy platforms or to update those legacy platforms. A failure to maintain or enhance the Company’s competitive position with respect to technology, whether because of a failure to anticipate client expectations, a failure in the performance of technological developments or an untimely roll out of developments, may cause the Company to lose market share or incur additional expense.

The Company faces risks associated with quality, availability and retention of key data for operational, strategic, and compliance purposes.

The Company’s financial and regulatory reporting and key business decisions are reliant on the quality, availability and retention of data. While Truist has implemented a robust data management control framework to mitigate the risks associated with data while at rest, in motion, and in use, a control failure may lead to data loss, data misuse, and data quality risks. These failures may ultimately result in inaccuracies in financial and regulatory reports, inhibited management decision-making, financial loss, reputational risk, and regulatory compliance risk, including privacy compliance risks to the extent that the Company has ineffective or flawed consumer data management processes and monitoring.

Truist Financial Corporation 35