TFC, §1A diff (2021 → 2022)

ITEM 1A. RISK FACTORS

Summary of Risk Factors

Market Risks

•Changes in interest rates could adversely affect revenue and expenses, the value of assets and liabilities, as well as the availability and cost of capital, and liquidity.

•The monetary and fiscal policies of the U.S. federal government could have a material adverse effect on profitability.

•Inflation could negatively impact our business, our profitability, and our stock price.

•Financial results, lending or other business activities could be materially affected by a deterioration of economic conditions.

•Instability in global economic conditions and geopolitical matters, as well as volatility in financial markets, could have a material adverse effect on the Company’s results of operations and financial condition.

•The replacement of LIBOR could adversely affect Truist’s profitability and financial condition.

Credit Risks

•The Company is subject to credit risk by lending, committing to lend money, or entering into a letter of credit or other types of contracts with counterparties.

•The Company may have more credit risk and higher credit losses to the extent that loans are concentrated by loan type, industry segment, borrower type, or location of the borrower or collateral.

•The Company may suffer losses if the value of collateral declines in stressed market conditions.

Liquidity Risks

•Loss of deposits or a change in deposit mix could increase Truist’s funding costs.

•Truist’s liquidity could be impaired by an inability to access short-term funding, an unforeseen outflow of cash, or the inability to monetize liquid assets.

•Truist relies on the mortgage secondary market and GSEs for some of the Company’s liquidity.

•Any reduction in the Company’s credit ratings could increase the Company’s cost of funding or reduce its access to the capital markets.

•The Parent Company could have less access to funding sources and its liquidity could be constrained if the Bank becomes unable to pay dividends during a time of stress.

•Truist may be impacted by the soundness of other financial institutions.

Technology Risks

•The Company faces cybersecurity risks, including denial of service, phishing, malware and ransomware attacks, potential insider threats, and third-party cybersecurity incidents, which could result in the disclosure of confidential information, adversely affect the Company’s operations, cause reputational damage, and create significant legal and financial exposure.

•The Company’s operational capabilities managed or supplied by third parties could fail, be compromised, or be breached, which could disrupt the Company’s business and adversely impact the Company’s results of operations, and financial condition, as well as cause legal exposure or reputational harm.

•Truist will continually encounter technological change and must effectively anticipate, develop, and implement new technology.

•The Company faces risks associated with quality, availability, and retention of key data for operational, strategic, regulatory, and compliance purposes.

Other External Risks

•The effects of COVID-19 adversely impacted the Company’s operations and financial performance and similar adverse impacts resulting from pandemics could occur in future periods.

•Physical, transition, or other risks associated with climate change have the potential to negatively impact operations, business results, and clients.

•The Company is at risk of increased losses from fraud.

•Natural disasters and other catastrophic events, which may increase in frequency and intensity due to climate change, could have a material adverse impact on the Company’s operations or the Company’s financial condition and results.

•An outbreak or escalation of hostilities between countries or within a country or region could have a material adverse effect on the U.S. economy and on Truist’s businesses.

18 Truist Financial Corporation

Compliance Risks

•Truist is subject to extensive and evolving government regulation and supervision, which could increase the cost of doing business, limit Truist’s ability to make investments and generate revenue, and lead to costly enforcement actions.

•Truist is subject to regulatory capital and liquidity standards that affect the Company’s business, operations, and ability to pay dividends, or otherwise return capital to shareholders.

•Truist is subject to certain risks related to originating and selling mortgages and may be required to repurchase mortgage loans or indemnify mortgage loan purchasers.

•Truist faces risks as a servicer of loans.

•Truist faces substantial legal and operational risks in safeguarding personal information.

•Differences in regulation can affect the Company’s ability to compete effectively.

•The Company can face risks of non-compliance and incur higher operational and compliance costs under laws and regulations relating to anti-money laundering, economic sanctions, embargo programs, and anti-corruption.

Strategic Risks

•Truist may face the risk of financial loss or negative impact resulting from ineffective strategy setting and execution, adverse business decisions, or lack of responsiveness to changes in the external environment.

•Competition may reduce Truist’s client base or cause Truist to modify pricing for products and services.

•Truist may not be able to complete future mergers or acquisitions.

•Truist has businesses other than banking that are subject to a variety of risks.

Regulatory and Legal Risks

•The Company may incur fines, penalties and other negative consequences from regulatory violations, including inadvertent or unintentional violations.

•Legal proceedings may adversely affect the Company’s results, reputation, and business operations.

Reputational Risks

•Negative public opinion could damage the Company’s reputation and adversely impact business and revenues.

•Scrutiny of the Company’s sales, training, and incentive compensation practices could damage the Company’s reputation and adversely impact business and revenues.

Talent Management Risks

•Truist depends on the expertise of key teammates. If these individuals leave or change their roles without effective replacements, operations may suffer.

•The Company depends on the ability to attract and retain qualified teammates while effectively managing recruiting and compensation costs amid highly competitive and rapidly changing market conditions in order to implement and execute upon business strategies.

•The Company’s operations rely on its ability, and the ability of key external parties, to maintain appropriately staffed workforces, and on the competence, trustworthiness, health and safety of employees.

Risks Related to Estimates and Assumptions

•There are risks resulting from the extensive use of models in Truist’s business, which may impact decisions made by Management and regulators.

•The Company’s accounting policies and processes are critical to how the Company reports its financial condition and results of operations and require management to make estimates about matters that are uncertain.

•Depressed market values for the Company’s stock and adverse economic conditions sustained over a period of time may require the Company to write down all or some portion of the Company’s goodwill.

Truist Financial Corporation 19

Operational Risks

•Truist relies on other companies to provide key components of the Company’s business infrastructure.

•The Company’s framework for managing risks may not be effective.

•Truist depends on the accuracy and completeness of information about clients and counterparties.

•Truist can be negatively affected if it fails to identify and address operational risks associated with the introduction of or changes to products, services, and delivery platforms.

•Enhanced regulatory and other standards for the oversight of vendors and other service providers can result in higher costs and other potential exposures.

The following discussion sets forth some of the more important risk factors that could materially affect Truist’s financial condition and operations. When a risk factor spans several risk categories, the risks have been listed by their primary risk category. The risks described are not all inclusive. Additional risks that are not presently known or risks deemed immaterial may have a material adverse effect on Truist’s financial condition, results of operations, business, and prospects.

Market Risks

Changes in interest rates could adversely affect revenue and expenses, the value of assets and liabilities, as well as the availability and cost of capital, and liquidity.

Truist’s balance sheet can be sensitive to movements in market interest rates and spreads. In addition to the impact of the general economy, changes in interest rates or in valuations in the debt or equity markets could directly impact the Company in one or more of the following ways:

•The yield on earning assets and rates paid on interest-bearing liabilities may change in disproportionate ways; or

•The value of financial instruments held could change adversely.

National, regional, and local economic conditions, competitive pressures and the policies of regulatory authorities affect interest income and interest expense. When interest rates rise, funding costs may rise faster than the yield the Company earns on assets, causing net interest margin to contract. Higher interest rates may also result in lower mortgage production income and elevated charge-offs in certain categories of the loan portfolio. Conversely, when interest rates fall, the yield the Company earns on assets may fall faster than the Company’s ability to lower rates paid on deposits or borrowings.

Certain investment securities, notably MBS, are very sensitive to changes in rates. Generally, when rates rise, market values will decline, prepayments will decrease and the duration of MBS will increase. Conversely, when rates fall, market values will rise, prepayments of principal and interest will increase and the duration of MBS will decrease.

The monetary and fiscal policies of the U.S. federal government could have a material adverse effect on profitability.

Changes in monetary and fiscal policies, including FRB policies, can adversely affect profitability and cannot be controlled or predicted by the Company. FRB policies can:

•significantly impact the cost of funds, as well as the return on assets, both of which can have an impact on interest income;

•materially affect the value of financial assets and liabilities;

•adversely affect borrowers through higher debt servicing costs and potentially increase the risk that they may fail to repay their loan obligations; and

•artificially inflate asset values during prolonged periods of accommodative policy, which could in turn cause volatile markets and rapidly declining collateral values during times of restrictive monetary and fiscal policies.

The FRB raised interest rates significantly and began shrinking its balance sheet during 2022 in response to inflation measures that were well above the FRB’s two percent target. The Federal Reserve may further increase interest rates in the near term. Sustained higher interest rates and continued FRB asset reductions may adversely affect market stability, market liquidity and the Company’s financial performance and condition. Truist cannot predict the nature or timing of future changes in monetary policies or the precise effects such changes may have on the Company’s activities and financial results.

20 Truist Financial Corporation

Inflation could negatively impact our business, our profitability, and our stock price.

Prolonged periods of inflation may impact our profitability by negatively impacting our fixed costs and expenses, including increasing funding costs and expense related to talent acquisition and retention. Additionally, inflation may lead to a decrease in consumer and clients’ purchasing power and negatively affect the need or demand for our products and services. If significant inflation continues, our business could be negatively affected by, among other things, increased default rates leading to credit losses which could decrease our appetite for new credit extensions. These inflationary pressures could result in missed earnings and budgetary projections causing our stock price to suffer.

Financial results, lending or other business activities could be materially affected by a deterioration of economic conditions.

A prolonged period of slow growth in the U.S. economy as a whole or in any regional markets that Truist serves, or any deterioration in economic conditions or the financial markets may disrupt or dampen the economy, which could adversely affect the Company’s financial condition and results.

If economic conditions deteriorate, the Company may see lower demand for loans by creditworthy clients, reducing the Company’s interest income. In addition, if unemployment levels increase or if real estate prices decrease, the Company could incur higher charge-offs and may incur higher expenses in connection with adverse conditions in the reasonable and supportable forecasts used to estimate the allowance for credit losses in accordance with CECL requirements. These conditions may adversely affect not only consumer borrowers but also commercial and industrial and commercial real estate borrowers, especially for those businesses that rely on the health of industries or properties that may suffer from deteriorating economic conditions. The ability of these borrowers to repay their loans may be reduced, causing the Company to incur higher credit losses.

The deterioration of economic conditions also could adversely affect financial results for the Company’s fee-based businesses. Truist earns fee income from, among other activities, managing assets for clients, and providing brokerage and other investment advisory and wealth management services. Investment management fees are often based on the value of assets under management and a decrease in the market prices of those assets could reduce the Company’s fee income. Changes in stock or fixed income market prices or client preferences could affect the trading activity of investors, reducing commissions and other fees earned from the Company’s brokerage business. Poor economic conditions and volatile or unstable financial markets would likely adversely affect the Company’s capital markets-related businesses.

Instability in global economic conditions and geopolitical matters, as well as volatility in financial markets, could have a material adverse effect on the Company’s results of operations and financial condition.

Instability in global economic conditions and geopolitical matters, as well as volatility in financial markets, could have a material adverse effect on the Company’s results of operations and financial condition. The macroeconomic environment in the United States is susceptible to global events and volatility in financial markets. For example, trade negotiations between the U.S. and other nations remain uncertain and could adversely impact economic and market conditions for the Company and its clients and counterparties. The war in Ukraine presents destabilizing forces, including higher and more volatile commodity and food prices, which may cause international and domestic economic deterioration. In addition, global demand for products may exceed supply during the economic recovery from the COVID-19 pandemic, and such shortages may cause inflation, adversely impact consumer and business confidence, and adversely affect the economy as well as the Company’s financial condition and results. Financial markets may be adversely affected by the current or anticipated impact of military conflict, including the war in Ukraine, terrorism, or other geopolitical events. This could magnify inflationary pressure resulting from the pandemic and other sources and extend any prolonged period of higher inflation.

The replacement of LIBOR could adversely affect Truist’s profitability and financial condition.

A transition away from the widespread use of LIBOR to alternative rates and other potential interest rate benchmark reforms will continue over the course of the next year. The publication of the one-week and two-month U.S. dollar LIBOR settings ceased as of December 31, 2021, while certain U.S. dollar LIBOR tenors are expected to continue to be published until June 30, 2023.

A group of market participants convened by the FRB, the ARRC, has selected SOFR as its recommended alternative to U.S. dollar LIBOR. Truist offers SOFR-based lending solutions to wholesale and consumer clients and enters into SOFR-based derivative contracts. The passage of the Adjustable Interest Rate (LIBOR) Act by Congress, and the Federal Reserve’s implementing rule, should decrease the risk of contracts that are not remediated prior to the cessation deadline by providing the terms for a transition to SOFR. Truist is also supporting “credit sensitive” alternatives, such as Bloomberg Short-Term Bank Yield and other alternatives as they develop in the market.

Truist Financial Corporation 21

SOFR or other alternative reference rates may perform differently than LIBOR in response to changing market conditions. For example, SOFR could experience greater decreases during times of economic stress, which could require the Company to lend at lower rates at times when the Company’s borrowing costs are increasing.

The market transition away from LIBOR to alternative reference rates is complex and could have a range of adverse effects on the Company’s business, financial condition, and results of operations. In particular, any such transition could:

•adversely affect the interest rates received or paid on the revenue and expenses associated with or the value of the Company’s LIBOR-based assets and liabilities;

•adversely affect the interest rates received or paid on the revenue and expenses associated with or the value of other securities or financial arrangements, given LIBOR’s role in determining market interest rates globally;

•prompt inquiries or other actions from regulators in respect of the Company’s preparation and readiness for the replacement of LIBOR with an alternative reference rate; and

•result in disputes, litigation, or other actions with borrowers or counterparties about the interpretation and enforceability of certain fallback language in LIBOR-based contracts and securities.

The transition away from LIBOR to alternative reference rates has required the transition to or development of appropriate systems, models, and analytics to effectively transition the Company’s risk management and other processes from LIBOR-based products to those based on the applicable alternative reference rate, such as SOFR. Truist has developed a LIBOR transition team and project plan to address the transition. Truist has largely completed its assessment of risks related to the transition from LIBOR and continues its remediation efforts. There can be no guarantee that these efforts will successfully mitigate the operational risks associated with the transition away from LIBOR to an alternative reference rate.

The manner and impact of the transition from LIBOR to an alternative reference rate, as well as the effect of these developments on the Company’s funding costs, loan, investment securities, and derivative portfolios, as well as ALM, is uncertain.

Credit Risks

The Company is subject to credit risk by lending, committing to lend money, or entering into a letter of credit or other types of contracts with counterparties.

Truist incurs credit risk, which is the risk of loss if the Company’s borrowers or counterparties fail to perform according to the terms of their contracts. A number of products expose the Company to credit risk, including loans and leases, lending commitments, derivatives, trading assets, and investment securities. Changes in credit quality can have a significant impact on the Company’s earnings and capital position. The Company estimates and establishes contractual lifetime reserves for credit risks and credit losses inherent in its determination of credit exposure. This process, which is critical to the Company’s financial results and condition, requires complex calculations and extensive use of judgment, considering both external and borrower-specific factors that might impair the ability of borrowers to repay their loans. As is the case with any such assessments, there is always the chance that the Company will fail to identify all pertinent factors or that the Company will fail to accurately estimate the impacts of factors identified.

Credit losses may exceed the amount of the Company’s reserves due to changing economic conditions, falling real estate prices, falling commodity prices, higher unemployment, or other factors such as changes in borrower behavior. There is no assurance that reserves will be sufficient to cover all credit losses. In the event of significant deterioration in current or projected future economic conditions, the Company may be required to increase reserves in future periods, which would reduce the Company’s earnings and potentially impact its capital.

The Company may have more credit risk and higher credit losses to the extent that loans are concentrated by loan type, industry segment, borrower type, or location of the borrower or collateral.

The Company’s credit risk and credit losses can increase if the Company’s loans are concentrated in borrowers engaged in the same or similar activities or in borrowers who as a group may be uniquely or disproportionately affected by economic, market conditions, or climate change.

Deterioration in economic conditions, housing conditions, or real estate values, including as a result of climate change or natural disasters, in the markets in which the Company operates could result in materially higher credit losses. The Company is also subject to physical risks of climate change, which could manifest in the form of asset quality deterioration and could be exacerbated by specific portfolio concentrations, and transition risks of climate change, which could manifest through longer-term shifts in market dynamics and consumer preferences and could be exacerbated in specific industries that may be more sensitive or vulnerable to a transition to a low carbon economy.

22 Truist Financial Corporation

The Company may suffer losses if the value of collateral declines in stressed market conditions.

During periods of market stress or illiquidity, the Company’s credit risk may be further increased when it fails to realize the expected value of the collateral it holds; collateral is liquidated at prices that are not sufficient to recover the full amount owed to Truist; or counterparties are unable to post collateral, whether for operational or other reasons. Furthermore, disputes with counterparties concerning the valuation of collateral may increase in times of significant market stress, volatility or illiquidity, and Truist could suffer losses during these periods if it is unable to realize the expected value of collateral or to manage declines in the value of collateral.

Liquidity Risks

Loss of deposits or a change in deposit mix could increase Truist’s funding costs.

Deposits are a low cost and stable source of funding. Truist competes with banks and other financial institutions for deposits and as a result, the Company could lose deposits in the future, clients may shift their deposits into higher cost products, or the Company may need to raise interest rates to avoid deposit attrition. Funding costs may also increase if deposits lost are replaced with wholesale funding. Higher funding costs reduce Truist’s net interest margin, net interest income, and net income. In recent months, the environment for maintaining and growing deposits has become more challenging as the FRB reduces the size of its balance sheet through quantitative tightening and continues to increase interest rates giving clients an incentive to move deposits to money market funds and other higher-yielding alternatives, which could lead to an increase in the reliance on higher cost wholesale funding.

Truist’s liquidity could be impaired by an inability to access short-term funding, an unforeseen outflow of cash, or the inability to monetize liquid assets.

Liquidity is essential to Truist’s businesses. When volatility or disruptions occur in the wholesale funding markets, the Company’s ability to access short-term liquidity could be materially impaired. In addition, idiosyncratic factors, as well as other factors outside of the Company’s control, such as a general market disruption or an operational problem that affects third parties, could impair the Company’s ability to access short-term funding or create an unforeseen outflow of cash due to, among other factors, draws on unfunded commitments or deposit attrition. The Company’s inability to monetize liquid assets or to access short-term funding or capital markets could constrain the Company’s ability to make new loans or meet existing lending commitments and could ultimately jeopardize the Company’s overall liquidity and capitalization.

Truist relies on the mortgage secondary market and GSEs for some of the Company’s liquidity.

Truist sells a portion of the mortgage loans that it originates to reduce the Company’s retained credit risk and to provide funding capacity for originating additional loans. GSEs could limit their purchases of conforming loans due to capital constraints or other changes in their criteria for conforming loans (e.g., maximum loan amount or borrower eligibility). This potential reduction in purchases could limit the Company’s ability to fund new loans.

Proposals have been presented to reform the housing finance market in the U.S., including the role of the GSEs in the housing finance market. The extent and timing of any such regulatory reform of the housing finance market and the GSEs, as well as any effect on the Company’s business and financial results, are uncertain.

Any reduction in the Company’s credit ratings could increase the Company’s cost of funding or reduce its access to the capital markets.

Credit ratings are influenced by many factors, including the Company’s profitability, asset quality, capital levels, liquidity, business mix, operations, and risk management practices. Credit ratings may also be influenced by other factors, some of which are outside the Company’s control, such as recent and anticipated economic trends, geopolitical risk, legislative and regulatory developments, including implied levels of government support during a crisis, environmental, social, and governance considerations, and litigation, as well as changes to the rating agencies’ methodologies, among others. Truist’s failure to maintain credit ratings could adversely affect funding costs and increase the Company’s cost of capital. A downgrade to Truist’s credit ratings might also adversely impact the Company’s ability to conduct derivatives business with certain clients and counterparties and could trigger obligations to make cash or collateral payments to certain clients and counterparties. Additionally, a ratings downgrade could affect the Company’s ability to attract or retain funding, including deposits from commercial and corporate clients.

Truist Financial Corporation 23

The Parent Company could have less access to funding sources and its liquidity could be constrained if the Bank becomes unable to pay dividends during a time of stress.

The Parent Company relies upon capital markets access and dividends from affiliates for funding and has less access to contingent funding sources than the Bank. If the Bank were subject to a financial stress, its dividends to the Parent Company could be reduced or eliminated in order to support Bank capital ratios or other regulatory requirements. This would increase the Parent Company’s reliance on capital markets at a time when spreads and funding costs are likely elevated due the stress impacting the Bank.

Truist may be impacted by the soundness of other financial institutions.

The Company’s ability to engage in routine funding transactions could be adversely affected by the actions and commercial soundness of other financial institutions. Financial services institutions are interrelated as a result of trading, clearing, counterparty and other relationships. Truist has exposure to many different industries and counterparties and routinely executes transactions with counterparties in the financial industry, including brokers and dealers, central counterparties, commercial banks, investment banks, mutual and hedge funds and other institutional investors and clients. As a result, defaults by, or even rumors or questions about, one or more financial services institutions or the financial services industry generally, in the past have led to market-wide liquidity problems and could lead to losses or defaults by Truist or by other institutions. Many of these transactions expose the Company to credit risk in the event of default of the Company’s counterparty or client. In addition, the Company’s credit risk may be exacerbated when the collateral held by Truist cannot be liquidated or is liquidated at prices not sufficient to recover the full amount of the Company’s exposure. Any such losses could materially and adversely affect the Company’s results of operations and financial condition.

Technology Risks

The Company faces cybersecurity risks, including denial of service, phishing, malware and ransomware attacks, potential insider threats, and third-party cybersecurity incidents, which could result in the disclosure of confidential information, adversely affect the Company’s operations, cause reputational damage, and create significant legal and financial exposure.

The Company’s computer systems and network infrastructure and those of third parties are targeted in cyberattacks, such as denial of service attacks, hacking, malware or ransomware intrusion, data corruption attempts, terrorist activities, or identity theft. The Company’s business relies on the secure processing, transmission, storage, and retrieval of confidential, proprietary, and other information in the Company’s information systems and that of third parties. In addition, to access the Company’s network, products, and services, the Company’s clients and other third parties may use personal mobile devices or computing devices that are outside of the Company’s network environment and can introduce added cybersecurity risks.

Truist and Truist’s clients, regulators and other third parties, including other financial services institutions and companies engaged in data processing, have been subject to and are likely to continue to be the target of cyberattacks and similar incidents. Cyberattacks may expose security vulnerabilities in the Company’s systems or the systems of third parties or other security measures that could result in the unauthorized gathering, monitoring, misuse, release, loss, or destruction of confidential, proprietary, or sensitive information. A cyberattack could also damage the Company’s systems by introducing material disruptions to the Company’s or the Company’s clients’ or other third parties’ network access or business operations. As cyber threats continue to evolve, the Company may be required to expend significant additional resources to continue to modify or enhance the Company’s protective measures or to investigate and remediate any information security vulnerabilities or incidents. Despite efforts to ensure the integrity of the Company’s systems and implement controls, processes, policies and other protective measures, the Company may not be able to anticipate all security breaches, nor may the Company be able to implement sufficient preventive measures against such security breaches, which may result in material losses or consequences to Truist.

Cybersecurity risks for financial institutions have significantly increased in recent years in part because of the proliferation of new technologies to facilitate and conduct financial transactions. For example, cybersecurity risks may increase in the future as Truist continues to evolve its internal and external digital offerings and capabilities. In addition, cybersecurity risks have significantly increased in recent years in part due to the increased sophistication and activities of organized crime affiliates, terrorist organizations, hostile foreign governments, disgruntled teammates or vendors, activists and other external parties, including those involved in corporate espionage. Even the most advanced internal control environment may be vulnerable to compromise. Persistent attackers may succeed in penetrating defenses given enough resources, time, and motive. The techniques used by cyber criminals change frequently and may not be recognized until launched or well after a breach has occurred. In addition, the existence of cyberattacks or security breaches at third-party vendors with access to the Company’s data may not be disclosed to the Company in a timely manner.

24 Truist Financial Corporation

The Company also faces indirect technology, cybersecurity and other operational risks relating to clients and other third parties that the Company relies upon to facilitate or enable business activities, including, financial counterparties, regulators, and providers of critical infrastructure such as internet access and electrical power. As a result of increasing consolidation, interdependence, and complexity of financial entities and technology systems, a technology failure, cyberattack or other information or security breach that significantly degrades, deletes, or compromises the systems or data of one or more financial entities could have a material impact on counterparties or other market participants. This consolidation, interconnectivity, and complexity increases the risk of operational failure, on both individual and industry-wide bases, as disparate systems need to be integrated, often on an accelerated basis. Any third-party technology failure, cyberattack, other information or security breach, termination, or constraint could, among other things, adversely affect the Company’s ability to conduct transactions, service the Company’s clients, manage the Company’s exposure to risk or expand the Company’s business.

A successful penetration or circumvention of system security could cause serious negative consequences, including loss of clients and business opportunities; costs associated with maintaining business relationships after an attack or breach; significant disruption to the Company’s operations and business; misappropriation, exposure or destruction of the Company’s confidential information, intellectual property, funds and those of the Company’s clients; damage to the Company’s or the Company’s clients’ or third parties’ computers or systems; or a violation of applicable privacy laws and other laws. This could result in litigation exposure, regulatory fines, penalties, loss of confidence in the Company’s security measures, reputational damage, reimbursement or other compensatory costs, and additional compliance costs, which could adversely impact the Company’s results of operations, liquidity, and financial condition. In addition, the Company may not have adequate insurance coverage to compensate for losses from a cybersecurity event.

The Company’s operational capabilities managed or supplied by third parties could fail, be compromised, or be breached, which could disrupt the Company’s business and adversely impact the Company’s results of operations, and financial condition, as well as cause legal exposure or reputational harm.

The potential for operational risk exposure exists throughout the Company’s business and, as a result of the Company’s interactions with and reliance on third parties, is not limited to the Company’s own internal operational functions. The Company’s operational and security systems and infrastructure, including computer systems, data management and internal processes, as well as those of third parties, are integral to the Company’s performance. Truist relies on numerous third-party service providers to conduct aspects of its business operations and faces operational risks relating to them. Third-party cybersecurity incidents, such as system breakdowns or failures, misconduct by the employees of such parties, or cyberattacks, including ransomware, and supply-chain compromises, could affect their ability to deliver a product or service to the Company or result in lost or compromised information of the Company or its clients. Truist cannot be certain that we will receive timely notification of such cyberattacks or other security breaches. Like other large enterprises, Truist experiences malicious cyber activity directed at our vendors and other service providers. There is no guarantee that the measures the Company takes will provide absolute security or recoverability given that the techniques used in cyberattacks are complex and frequently change and are difficult to anticipate. Truist teammates and third parties may expose the Company to risk as a result of human error, misconduct, malfeasance, or a failure or breach of systems and infrastructure. For example, the Company’s ability to conduct business may be adversely affected by any significant disruptions, including to third parties with whom the Company interacts or relies upon.

Truist will continually encounter technological change and must effectively anticipate, develop, and implement new technology.

The financial services industry is undergoing rapid technological change with frequent introductions of new technology-driven products and services. Truist has invested in technology to automate functions previously performed manually, to facilitate the ability of clients to engage in financial transactions and otherwise to enhance the client experience with respect to the Company’s products and services. Truist expects to make additional investments in innovation and technology to address technological disruption in the industry and improve client offerings and service. These changes allow the Company to better serve the Company’s clients and to reduce costs.

The Company’s continued success depends, in part, upon the Company’s ability to address clients’ needs by using technology to provide products and services that satisfy client demands, including demands for faster and more secure payment services, to create efficiencies in the Company’s operations and to integrate those offerings with legacy platforms or to update those legacy platforms. A failure to maintain or enhance the Company’s competitive position with respect to technology, whether because of a failure to anticipate client expectations, a failure in the performance of technological developments or an untimely roll out of developments, may cause the Company to lose market share or incur additional expense.

Truist Financial Corporation 25

The Company faces risks associated with quality, availability, and retention of key data for operational, strategic, regulatory, and compliance purposes.

The Company’s financial and regulatory reporting and key business decisions are reliant on the quality, availability, and retention of data. While Truist has implemented a robust data management control framework to mitigate the risks associated with data while at rest, in motion, and in use, a control failure may lead to data loss, data misuse, and data quality risks. These failures may ultimately result in inaccuracies in financial and regulatory reports, inhibited management decision-making, financial loss, reputational risk, and regulatory compliance risk, including privacy compliance risks to the extent that the Company has ineffective or flawed consumer data management processes and monitoring.

Other External Risks

The effects of COVID-19 adversely impacted the Company’s operations and financial performance and similar adverse impacts resulting from pandemics could occur in future periods.

Although the global economy has begun to recover from the COVID-19 pandemic, as many health and safety restrictions have been lifted and vaccine distribution has increased, certain adverse consequences of the pandemic, including labor shortages, disruptions of global supply chains and inflationary pressures, continue to impact the macroeconomic environment and could adversely affect our business.

In addition, a significant portion of the Company’s workforce continues to work remotely at least on a part-time basis, which may increase cybersecurity risks to the Company. Commercial clients have experienced varying levels of disruptions on their supply chains or decreases in demand for their products and services. Consumer clients have experienced interrupted income or unemployment. Certain industries have been particularly susceptible to the effects of the pandemic, including industries where Truist has outstanding loans to clients.

The effects of the pandemic initially resulted in an increase in the allowance for credit losses, a reduction of fee income, a reduction of net interest margin, a decrease in demand for certain types of loans, and an increase in expenses. A resurgence of pandemic conditions could reintroduce these impacts and also affect the Company’s capital and liquidity position, impair the ability of borrowers to repay outstanding loans, impair the value of collateral securing loans, cause an outflow of deposits, influence the recognition of credit losses on loans and securities and increase the allowance for credit losses, result in additional lost revenue, cause additional increases in expenses, result in goodwill impairment charges, result in the impairment of other financial and nonfinancial assets, and increase the Company’s cost of capital.

Physical, transition, or other risks associated with climate change have the potential to negatively impact operations, business results, and clients.

There is an increasing concern over the risks of climate change and related environmental sustainability matters. Climate change presents (i) physical risks from the direct impacts of changing climate patterns and acute weather events, such as damage to physical assets and service disruptions, and (ii) transition risks from changes in regulations, disruptive technologies, and shifting market dynamics towards a lower carbon economy. The physical risks of climate change include discrete events, such as flooding, hurricanes, tornadoes, and wildfires, and longer-term shifts in climate patterns, such as extreme heat, sea level rise, and more frequent and prolonged drought. Physical risks may alter the Company’s strategic direction in order to mitigate certain financial risks. Such events could also disrupt the Company’s operations or those of its clients or third parties the Company relies on, not only through direct damage to assets, but also from indirect impacts due to supply chain disruption and market volatility.

Transition risks, including changes in consumer preferences, additional regulatory requirements or taxes and additional counterparty or client requirements, could have a material adverse impact on asset values and the financial performance of Truist’s businesses, and those of its clients. Climate change could also present incremental risks to the execution of the Company’s long-term strategy. While material impact from climate change is expected to occur over a longer time horizon, the acceleration of a transition to a low-carbon economy could present idiosyncratic risks for individual companies. Additionally, transitioning to a low-carbon economy will entail extensive policy, legal, technology, and market initiatives.

Additionally, the Company faces potential reputational risks as a result of its practices related to climate change, including as a result of the Company’s direct or indirect involvement in certain industries, as well as any decisions management makes in response to managing climate risk, especially as views on climate-related matters become subject to increased polarization. As climate risk is interconnected with all key risk types, Truist continues to embed climate risk considerations into risk management strategies. Due to the level of uncertainty around the future path of climate change, the Company’s risk management strategies may not be effective in fully mitigating climate risk exposures.

26 Truist Financial Corporation

The Company is at risk of increased losses from fraud.

Fraud attacks across the banking sector have significantly increased in recent years. Bad actors have industrialized the execution of fraud attacks with ever increasing sophistication and speed. Bad actors increasingly use sophisticated applications and techniques to perpetrate the fraud. In some cases, these individuals are associated with large criminal organizations that share tactics and strategies. Fraud schemes are wide ranging, including: counterfeit and forged checks; debit and credit card fraud; social engineering; ATM attacks through the use of skimmers to obtain client data; and phishing to obtain client account credentials. These schemes make use of a variety of products and services to steal funds, such as real-time payments, ACH and wire transfers. Bad actors perpetuate fraudulent activity by impersonating real clients with stolen identities and account credentials, use other individuals, known as mules, to interact with Truist, or create new identities, referred to as synthetic identities. In some instances, the fraud is committed by existing clients.

Natural disasters and other catastrophic events, which may increase in frequency and intensity due to climate change, could have a material adverse impact on the Company’s operations or the Company’s financial condition and results.

The occurrence of catastrophic weather events or pandemics could adversely affect the Company’s financial condition or results of operations. Truist has significant operations and clients along the Gulf and Atlantic coasts as well as other regions of the U.S., which could be adversely impacted by hurricanes, tornadoes and other severe weather in those areas. Truist and its clients could also be disrupted by the physical effects of climate change, which may become more frequent and severe. Natural and other types of disasters, including as a result of climate change, could have an adverse impact on Truist’s businesses in that such events could materially disrupt the Company’s operations or the ability or willingness of the Company’s clients to access the financial services offered by Truist, including adverse impacts on the Company’s borrowers to timely repay their loans and the value of any collateral held. These events could reduce the Company’s earnings and cause volatility in the Company’s financial results for any fiscal quarter or year and have a material adverse effect on the Company’s financial condition and results of operations.

Although Truist has business continuity plans and other safeguards in place, the Company’s operations and communications may be adversely affected by natural disasters or other catastrophic events, and there can be no assurance that such business continuity plans will be effective.

An outbreak or escalation of hostilities between countries or within a country or region could have a material adverse effect on the U.S. economy and on Truist’s businesses.

Aggressive actions by hostile governments or groups, including armed conflict or intensified cyberattacks, could expand in unpredictable ways by drawing in other countries or escalating into full-scale war with potentially catastrophic consequences, particularly if one or more of the combatants possess nuclear weapons. Depending on the scope of the conflict, the hostilities could result in worldwide economic disruption, heightened volatility in financial markets, severe declines in asset values, disruption of global trade and supply chains, and diminished consumer, business and investor confidence. Any of the above consequences could have significant negative effects on the U.S. economy, and, as a result, Truist’s operations and earnings. Truist could also experience more numerous and aggressive cyberattacks launched by or under the sponsorship of one or more of the adversaries in such a conflict.

Compliance Risks

Truist is subject to extensive and evolving government regulation and supervision, which could increase the cost of doing business, limit Truist’s ability to make investments and generate revenue, and lead to costly enforcement actions.

The banking and financial services industries are highly regulated. Truist is subject to supervision, regulation, and examination by regulators, including the FRB, FDIC, NCCOB, SEC, CFTC, CFPB, FINRA, NFA, and various other federal and state regulatory agencies. The statutory and regulatory framework governing Truist is generally intended to protect depositors, the DIF, clients, and the U.S. financial system as a whole, and not Truist’s debt holders or shareholders. Truist is also subject to heightened requirements under the enhanced prudential standards and expects increased supervisory scrutiny, including, for example, single counterparty credit limits, heightened expectations with respect to governance, risk management and internal controls and additional capital and liquidity requirements. Reform of the financial services industry resulting from the Dodd-Frank Act, including the EGRRCPA and other legislative, regulatory, and technological changes, affect the Company’s operations.

Truist Financial Corporation 27

These laws and regulations and Truist’s inability to act in certain instances without receiving prior regulatory approval affect Truist’s lending practices, capital structure, investment practices, dividend policy, ability to repurchase common stock and ability to pursue strategic acquisitions, among other activities. Changes to statutes, regulations or regulatory policies or their interpretation or implementation and the continued heightening of regulatory requirements could affect Truist in substantial and unpredictable ways. Federal and state banking regulators also possess broad powers to take supervisory actions as they deem appropriate. These supervisory actions may result in higher capital requirements, higher deposit insurance premiums, higher compliance expenses, and limitations on the Company’s activities that could have a material adverse effect on operations or profitability.

In recent years, both Congress and the federal banking regulators have engaged in a rebalancing of the post financial crisis legal and regulatory framework, particularly by tailoring enhanced prudential standards to the size, risk profile, and complexity of the banking organization. Under the current presidential administration and Congress, the Company and other large financial institutions are becoming subject to increased scrutiny, more intense supervision and regulation, and a higher risk of enforcement action, with increased fines and penalties which we expect to continue. Truist expects that its businesses will remain subject to extensive regulation and supervision. Any potential new regulations or modifications to existing regulations would likely necessitate changes to Truist’s existing regulatory compliance and risk management infrastructure. Compliance with new regulations and supervisory initiatives may increase costs. In addition, concerns over climate change may prompt changes in regulations that, in turn, could have a material adverse impact on asset values and the financial performance of Truist’s businesses and its clients.

Financial regulators’ prudential and supervisory authority gives them broad power and discretion to direct Truist’s actions, and they have assumed an active oversight, examination, and enforcement role across the financial services industry on both the federal and state levels. Areas of focus in the recent past have been with respect to mortgage-related practices, student lending practices, auto lending practices, complaints management, sales practices and related incentive compensation programs, consumer privacy, fair banking, overdraft and other fees, retention and recordkeeping of electronic communications, and other consumer compliance matters. Truist continues to be subject to examinations and ongoing monitoring to assess compliance with BSA/AML laws and regulations, as well as sanctions compliance administered by the OFAC. Additionally, actual or alleged misconduct by teammates, including unethical, fraudulent, improper, or illegal conduct, or unfair, deceptive, abusive, or discriminatory practices, can result in litigation, or government investigations and enforcement actions, and cause significant reputational harm, even if ultimately unsubstantiated.

Truist also relies upon third parties who may expose the Company to compliance and legal risk. New or existing legal requirements also could heighten the reputational impact of perceived misuses of customer data by the Company and third parties. See additional disclosures in the “Regulatory Considerations” section.

Truist could become subject to future legislation and regulatory requirements beyond those currently proposed, adopted, or contemplated, including policies and rulemaking related to the Dodd-Frank Act, limits on acquisitions, and more stringent capital and liquidity requirements. The cumulative effect of such legislation and regulations on Truist’s’ business, operations, and profitability cannot be accurately predicted. Such regulatory changes may reduce Truist’s revenues, limit the types of financial services and products it may offer, alter the investments it makes, affect the manner in which it operates its businesses, increase its litigation and regulatory costs should it fail to appropriately comply with new or modified laws and regulatory requirements and increase the ability of non-banks to offer competing financial services and products.

Truist is subject to regulatory capital and liquidity standards that affect the Company’s business, operations, and ability to pay dividends, or otherwise return capital to shareholders.

Truist is subject to regulatory capital and liquidity requirements established by the FRB and the FDIC. These regulatory capital and liquidity requirements are typically developed at an international level by the BCBS and then applied, with adjustments, in each country by the appropriate domestic regulatory bodies. Domestic regulatory agencies have the ability to apply stricter capital and liquidity standards than those developed by the BCBS. In several instances, the U.S. banking agencies have done so with respect to U.S. banking organizations.

Requirements to maintain specified levels of capital and liquidity and regulatory expectations as to the quality of the Company’s capital and liquidity may prevent the Company from taking advantage of opportunities in the best interest of shareholders or force the Company to take actions contrary to their interests. For example, Truist may be limited in its ability to pay or increase dividends or otherwise return capital to shareholders. In addition, these requirements may impact the amount and type of loans the Company is able to make. Truist may be constrained in its ability to expand, either organically or through mergers and acquisitions. These requirements may cause the Company to sell or refrain from acquiring assets where the capital requirements appear inconsistent with the assets’ underlying risks. In addition, liquidity standards require the Company to maintain holdings of highly liquid investments, thereby reducing the Company’s ability to invest in less liquid assets, even if more desirable from a balance sheet return or interest rate risk management perspective. As a Category III banking organization, Truist is subject to additional capital and liquidity requirements.

28 Truist Financial Corporation

The liquidity standards applicable to large U.S. banking organizations have been supplemented in recent years. The NSFR rule, which is designed to ensure that banking organizations maintain a stable funding profile in relation to their asset composition and off-balance sheet activities, became effective on July 1, 2021. Public disclosure of the NSFR will begin in 2023.

In addition to the regulatory capital and liquidity requirements applicable to Truist and Truist Bank, the Company’s broker-dealer subsidiaries are subject to capital requirements established by the SEC.

Regulatory capital and liquidity requirements receive periodic review and revision by the BCBS and the U.S. banking agencies. Changes to capital and liquidity requirements may require Truist or Truist Bank to maintain more or higher quality capital or greater liquidity and could increase some of the potential adverse effects described above.

Truist is subject to certain risks related to originating and selling mortgages and may be required to repurchase mortgage loans or indemnify mortgage loan purchasers.

Truist is required to make customary representations and warranties to the purchaser about the mortgage loans and the manner in which they were originated when selling mortgage loans or loan securitizations. An increase in the number of repurchase and indemnity demands from purchasers related to representations and warranties on loans sold could result in an increase in the amount of losses for loan repurchases. Truist also bears a risk of loss from borrower defaults for multi-family commercial mortgage loans sold to FNMA.

In addition to repurchase claims from GSEs, Truist could be subject to indemnification claims from non-GSE purchasers of the Company’s loans. Claims could be made if the loans sold fail to conform to statements about their quality, the manner in which the loans were originated and underwritten or their compliance with state and federal law.

Truist faces risks as a servicer of loans.

The Company acts as servicer and master servicer for mortgage loans included in securitizations and for unsecuritized mortgage loans owned by investors. As a servicer or master servicer for those loans, the Company has certain contractual obligations to the securitization trusts, investors, or other third parties. As a servicer, Truist’s obligations include foreclosing on defaulted mortgage loans or, to the extent consistent with the applicable securitization or other investor agreement, considering alternatives to foreclosure such as loan modifications or short sales. In the Company’s capacity as a master servicer, obligations include overseeing the servicing of mortgage loans by the servicer. Generally, the Company’s servicing obligations are set by contract, for which the Company receives a contractual fee. However, GSEs can amend their servicing guidelines unilaterally, which can increase the scope or costs of the services required without any corresponding increase in the Company’s servicing fee. Further, the CFPB has implemented national servicing standards, which have increased the scope and cost of services that the Company is required to perform. In addition, there has been a significant increase in state laws that impose additional servicing requirements that increase the scope and cost of the Company’s servicing obligations. As a servicer, the Company also advances expenses on behalf of investors, which it may be unable to collect.

A material breach of the Company’s obligations as servicer or master servicer may result in contract termination if the breach is not cured within a specified period of time following notice, which can generally be given by the securitization trustee or a specified percentage of security holders, causing the Company to lose servicing income. In addition, the Company may be required to indemnify the securitization trustee against losses from any failure by the Company, as a servicer or master servicer, to perform the Company’s servicing obligations or any act or omission on the Company’s part that involves willful misfeasance, bad faith, or gross negligence. For certain investors and certain transactions, Truist may be contractually obligated to repurchase a mortgage loan or reimburse the investor for credit losses incurred on the loan as a remedy for servicing errors with respect to the loan. The Company may be subject to increased repurchase obligations as a result of claims made that the Company did not satisfy its obligations as a servicer or master servicer. The Company may also experience increased loss severity on repurchases, which may require a material increase to the Company’s repurchase reserve.

The Company has and may continue to receive indemnification requests related to the Company’s servicing of loans owned or insured by other parties, primarily GSEs. Typically, such a claim seeks to impose a compensatory fee on the Company for departures from GSE service levels. In most cases, this is related to delays in the foreclosure process. Additionally, the Company has received indemnification requests where an investor or insurer has suffered a loss due to a breach of the servicing agreement. While the number of such claims has been small, these could increase in the future.

Truist Financial Corporation 29

Truist faces substantial legal and operational risks in safeguarding personal information.

Truist’s businesses are subject to complex and evolving laws and regulations governing the privacy and protection of personal information of individuals. Individuals whose personal information may be protected by law can include the Company’s clients (and in some cases its clients’ clients), prospective clients, job applicants, teammates, and the employees of the Company’s vendors, and third parties. Complying with the laws, rules and regulations applicable to the Company’s disclosure, collection, use, sharing and storage of personal information can increase operating costs, impact the development of new products or services, and reduce operational efficiency. Any mishandling or misuse of personal information by the Company or a third-party affiliated with the Company could expose the Company to litigation or regulatory fines, penalties or other sanctions.

Additional risks could arise from the failure of the Company or third parties to provide adequate disclosure or transparency to the Company’s clients about the personal information collected from them and the use of such information; to receive, document, and honor the privacy preferences expressed by the Company’s clients; to protect personal information from unauthorized disclosure; or to maintain proper training on privacy practices for all teammates or third parties who have access to personal information. Concerns regarding the effectiveness of Truist’s measures to safeguard personal information, or even the perception that those measures are inadequate, could cause Truist to lose existing or potential clients, and thereby reduce Truist’s revenues. Furthermore, any failure or perceived failure by the Company to comply with applicable privacy or data protection laws, rules and regulations may subject it to inquiries, examinations and investigations that could result in requirements to modify or cease certain operations or practices, significant liabilities or regulatory fines, penalties or other sanctions. Any of these could damage Truist’s reputation and otherwise adversely affect its businesses.

In recent years, well-publicized incidents involving the inappropriate collection, use, sharing or storage of personal information have led to expanded governmental scrutiny of practices relating to the safeguarding of personal information by companies. That scrutiny has in some cases resulted in, and could in the future lead to, the adoption of stricter laws, rules and regulations relating to the collection, use, sharing and storage of personal information. Truist will likely be subject to new and evolving data privacy laws in the U.S. and abroad, which could result in additional costs of compliance, litigation, regulatory fines, and enforcement actions. These types of laws, rules and regulations could prohibit or significantly restrict financial services firms such as Truist from sharing information among affiliates or with third parties such as vendors, and thereby increase compliance costs, or could restrict Truist’s use of personal data when developing or offering products or services to clients. These restrictions could also inhibit Truist’s development or marketing of certain products or services or increase the costs of offering them to clients.

Differences in regulation can affect the Company’s ability to compete effectively.

The content and application of laws and regulations affecting financial services firms sometimes vary according to factors such as the size of the firm, the jurisdiction in which it is organized or operates, and other criteria. Large institutions, such as the Company, often are subject to more stringent regulatory requirements and supervision than smaller institutions. In addition, financial technology companies and other non-traditional competitors may not be subject to banking regulation or may be supervised by a national or state regulatory agency that does not have the same regulatory priorities or supervisory requirements as the Company’s regulators. These differences in regulation can impair the Company’s ability to compete effectively with competitors that are less regulated and do not have similar compliance costs.

The Company can face risks of non-compliance and incur higher operational and compliance costs under laws and regulations relating to anti-money laundering, economic sanctions, embargo programs, and anti-corruption.

Truist must comply with laws and regulations relating to anti-money laundering, economic sanctions, embargo programs and anti-corruption, which can increase its risks of non-compliance and costs associated with the implementation and maintenance of complex compliance programs. A violation of any of these legal and regulatory requirements could subject Truist or individual employees to regulatory enforcement actions as well as significant civil and criminal penalties.

30 Truist Financial Corporation

Strategic Risks

Truist may face the risk of financial loss or negative impact resulting from ineffective strategy setting and execution, adverse business decisions, or lack of responsiveness to changes in the external environment.

Embedded within strategic risks are risks associated with:

•maintaining a level of earnings appropriate to support growth objectives and the ability to maintain dividends in various economic cycles,

•successful delivery of innovation and technology strategies that transform the client experience as well as the way Truist conducts business,

•changes and events within the external environment, including geopolitical, macroeconomic, social, cultural, competitive, and regulatory factors, and

•implementation and execution of climate risk management related programs.

Any of the foregoing may impact the successful execution of Truist’s strategy.

Competition may reduce Truist’s client base or cause Truist to modify pricing for products and services.

Truist operates in a highly competitive industry that could become even more competitive with growth in areas such as neo-banks, fintechs, and other non-bank platforms. Increased competition could arise from technological advancements, legislative and regulatory changes, as well as competition from other financial services companies, some of which may be subject to less extensive regulation than Truist. The Company’s success depends, in part, on the Company’s ability to adapt its offering of products and services to evolving industry standards and client expectations. The widespread adoption of new technologies has required and will continue to require substantial investments to modify existing products and services or to develop new products and services. In addition, there is increasing pressure to provide products and services at lower prices further reducing contribution margins. The Company may not be successful in introducing new products and services in response to industry trends or developments in technology or those new products may not achieve market acceptance.

Truist also competes with nonbank companies inside and outside of the Company’s market area and, in some cases, with companies other than those traditionally considered financial sector participants. In particular, technology companies are increasingly focusing on the financial sector, either in partnership with competitor banking organizations or on their own. These companies generally are not subject to the same regulatory oversight as main street financial institutions and may accordingly realize certain cost strategies and offer products and services at more favorable rates and with greater convenience to the client. This competition could result in the loss of clients and revenue in areas where fintechs are operating. As the pace of technology and change advance, continuous innovation is expected to exert long-term pressure on the financial services industry.

The adoption of new technologies by competitors, including internet banking services, mobile applications, advanced ATM functionality and cryptocurrencies could require the Company to make substantial investments to modify or adapt the Company’s existing products and services or even radically alter the way Truist conducts business. These and other capital investments in the Company’s business may not produce expected growth in earnings anticipated at the time of the expenditure.

Truist may not be able to complete future mergers or acquisitions.

The Company must generally satisfy a number of meaningful conditions before completing an acquisition of another bank or BHC, including federal and state regulatory approvals. In determining whether to approve a proposed bank or BHC acquisition, bank regulators will consider, among other factors, the effect of the acquisition on competition; financial condition and future prospects, including current and projected capital ratios and levels; the competence, experience and integrity of management; record of compliance with laws and regulations; the convenience and needs of the communities to be served, including the acquiring institution’s record of compliance under the CRA; the effectiveness of the acquiring institution in combating money laundering activities; and public comments from various stakeholders. In addition, U.S. regulators must take systemic risk to the U.S. financial system into account when evaluating whether to approve a potential acquisition transaction involving a large financial institution like Truist. There is no certainty as to when or if or on what terms and conditions, any required regulatory approvals will be granted for any potential acquisition. In specific cases, Truist may be required to sell banks or branches or take other actions as a condition to receiving regulatory approval. An inability to satisfy other conditions necessary to consummate an acquisition transaction, such as third-party litigation, a judicial order blocking the transaction or lack of shareholder approval, could also prevent the Company from completing an announced acquisition. There has been increased scrutiny of bank and financial institution acquisitions from regulators and government entities in recent years. Refer to the “Acquisitions” section within Item 1 “Business” for additional discussion.

Truist Financial Corporation 31

Truist has businesses other than banking that are subject to a variety of risks.

Truist is a diversified financial services company. This diversity subjects the Company’s earnings to a broader variety of risks and uncertainties. Other businesses in addition to banking that the Company operates include insurance brokerage, investment banking, securities underwriting and market making, loan syndications, investment management and advice and retail and wholesale brokerage services offered through the Company’s subsidiaries. These businesses entail significant market, operational, credit, compliance, technology, legal and other risks that could materially adversely impact the Company’s results of operations.

Regulatory and Legal Risks

The Company may incur fines, penalties and other negative consequences from regulatory violations, including inadvertent or unintentional violations.

Truist maintains systems and procedures designed to ensure that it complies with applicable laws and regulations, but there can be no assurance that these will be effective. In addition to fines and penalties, the Company may suffer other negative consequences from regulatory violations including restrictions on certain activities, such as the Company’s mortgage business, which may affect the Company’s relationship with the GSEs and may also damage the Company’s reputation and this in turn might materially affect the Company’s business and results of operations.

Federal law grants substantial enforcement powers to federal banking regulators and law enforcement agencies. This enforcement authority includes, among other things, the ability to assess significant civil or criminal monetary penalties, fines, or restitution; to issue cease and desist or removal orders; and to initiate injunctive actions against banking organizations and institution-affiliated parties. These enforcement actions may be initiated for violations of laws and regulations and unsafe or unsound practices. Any future enforcement action could have a material adverse impact. In addition, governmental authorities have, at times, sought criminal penalties against companies in the financial services sector for violations, and, at times, have required an admission of wrongdoing from financial institutions in connection with resolving such matters. Criminal convictions or admissions of wrongdoing in a settlement with the government can lead to greater exposure in civil litigation, reputational harm, and other significant collateral consequences such as restrictions on engaging in new activities or acquisitions.

A failure to comply with regulatory requirements and expectations could expose the Company to fines, regulatory penalties, other costs, reputational damage, civil litigation, and regulatory or enforcement actions which may, in turn, result in limitations on engaging in new activities or expanding geographically and lead to higher operational and compliance costs. In some cases, governmental authorities have required criminal pleas or other extraordinary terms as part of settlements, which could have significant consequences for a financial institution, including loss of clients, restrictions on the ability to access the capital markets and the inability to operate certain businesses or offer certain products for a period of time. Violations of laws and regulations or deemed deficiencies in risk management practices also may be incorporated into Truist’s confidential supervisory ratings. A downgrade in these ratings, or these or other regulatory actions and settlements, could limit Truist’s ability to conduct expansionary activities for a period of time and require new or additional regulatory approvals before Truist can engage in certain other business activities.

Further, some legal frameworks provide for the imposition of fines or penalties for noncompliance even when the noncompliance was inadvertent or unintentional and even when there were controls in place designed to ensure compliance. For example, Truist is subject to orders and regulations issued by OFAC that prohibit financial institutions from engaging with prohibited parties, including certain foreign governments, legal entities and individuals. OFAC has the authority to impose penalties for any violation of the prohibitions, whether the violation is intentional or unintentional, even if there were appropriate controls and Truist acted in good faith.

Legal proceedings may adversely affect the Company’s results, reputation, and business operations.

In the ordinary course of its business, the Company is subject to lawsuits, claims, and formal and informal enforcement activity, including regulatory investigations. The volume of legal proceedings against participants in the financial services industry, including the Company, is substantial, and enforcement actions by regulatory authorities are becoming more common in the current regulatory environment. Legal proceedings against financial services firms may increase depending on factors such as market downturn, changes in law and increased regulatory scrutiny.

32 Truist Financial Corporation

Heightened regulatory scrutiny or the results of an investigation or examination may lead to additional regulatory investigations or enforcement actions. There is no assurance that those actions will not result in regulatory settlements or other enforcement actions against Truist. Furthermore, a single event involving a potential violation of law or regulation may give rise to numerous and overlapping investigations and proceedings by multiple federal and state agencies and officials. In addition, if one or more financial institutions are found to have violated a law or regulation relating to certain business activities, this could lead to investigations by regulators or other governmental agencies of the same or similar activities by other financial institutions, including Truist, and large fines and remedial measures that may have been imposed in resolving earlier investigations for the same or similar activities at other financial institutions may be used as the basis for future settlements.

Claims and legal actions, including class action lawsuits and enforcement proceedings, could involve large monetary amounts, significant defense costs, and result in settlements, judgments, penalties, fines, injunctions, or other forms of relief that are adverse to the Company. Responding to inquiries, investigations, lawsuits, and other proceedings is time-consuming and expensive and can divert senior management attention from Truist’s business.

The outcome of any such legal proceedings, as well as the timing of any ultimate resolutions, may be difficult to predict or estimate. Actual legal and other costs arising from claims and legal actions may be greater than the Company’s legal accruals. Further, the Company may not have accruals for all legal proceedings where we face a risk of loss where the loss cannot be reasonably estimated. The ultimate resolution of a pending legal proceeding or significant regulatory or government action against the Company could materially adversely affect the Company’s results of operations and financial condition or cause significant reputational harm, which may adversely impact the Company’s business prospects. Further, the Company may be exposed to substantial uninsured liabilities, which could adversely affect the Company’s results of operations and financial condition.

Reputational Risks

Negative public opinion could damage the Company’s reputation and adversely impact business and revenues.

Truist’s earnings and capital are subject to risks associated with negative public opinion. Negative public opinion could result from the Company’s actual or alleged conduct in any number of activities, including lending, sales and other operating practices, corporate governance, acquisitions, a breach of client or teammate information, the failure of any product or service sold to meet clients’ expectations or applicable regulatory requirements. In addition, the public perception that a cyber-attack on the Company’s systems has been successful, whether or not this perception is correct, may damage the Company’s reputation with clients and third parties with whom the Company does business. The compromise of personal information, in particular, could result in identify theft and cause serious reputational harm. Any cybersecurity breaches, attacks and other similar incidents could significantly harm Truist’s reputation, which could adversely affect the Company’s financial condition and results of operation.

Negative public opinion could also result from increased polarization of environmental and social considerations that may affect Truist and clients of Truist. Negative public opinion could adversely affect the Company’s ability to attract and retain clients and teammates and can result in litigation and regulatory actions. Actual or alleged conduct by one of the Company’s businesses can result in negative public opinion about the Company’s other businesses. Actual or alleged conduct by another financial services company can result in negative public opinion about the financial services industry in general and, as a result, adversely affect Truist.

Scrutiny of the Company’s sales, training, and incentive compensation practices could damage the Company’s reputation and adversely impact business and revenues.

The Company may face increased scrutiny of its sales and other business practices, training practices, incentive compensation design and governance, and quality assurance and client complaint resolution practices. There can be no assurance that the Company’s processes and actions will meet regulatory standards or expectations. Findings from self-identified or regulatory reviews may require responsive actions, including increased investments in compliance systems and teammates or the payment of fines, penalties, increased regulatory assessments or client redress and may increase legal or reputational risk exposures.

Talent Management Risks

Truist depends on the expertise of key teammates. If these individuals leave or change their roles without effective replacements, operations may suffer.

The Company’s success depends, to a large degree, on the continued services of executive officers and other key teammates who have extensive experience in the industry. The Company’s business could be adversely impacted from the loss of key persons or failure to manage a smooth transition to new teammates.

Truist Financial Corporation 33

The Company depends on the ability to attract and retain qualified teammates while effectively managing recruiting and compensation costs amid highly competitive and rapidly changing market conditions in order to implement and execute upon business strategies.

The Company’s success depends upon the ability to attract and retain high performing, diverse and well-qualified teammates. The Company faces significant competition in the recruitment of highly motivated teammates who can deliver Truist’s purpose, mission, and values, which has recently intensified as a result of changes in the labor market caused by COVID-19, broader economic factors and evolving expectations of the workforce. Changes in employee preferences for work environments, in particular the desire of teammates to work remotely for many or all of their hours, may impact our ability to attract and retain qualified teammates in those areas of our operations that require a concentration of onsite personnel (e.g., call centers). The Company’s ability to execute its business strategy and provide high quality service may suffer if the Company is unable to recruit or retain a sufficient number of qualified teammates or if the costs of employee compensation or benefits increase substantially. The U.S. banking agencies have jointly issued comprehensive guidance designed to ensure that incentive compensation policies do not undermine the safety and soundness of banking organizations by encouraging teammates to take imprudent risks. This guidance significantly affects the amount, form, and context of incentive compensation that may be provided to teammates and could negatively affect Truist’s ability to compete for talent relative to non-banking companies. The SEC finalized its incentive compensation clawback rule which may result in additional costs and restrictions on the form of the Company’s incentive compensation.

The Company’s operations rely on its ability, and the ability of key external parties, to maintain appropriately staffed workforces, and on the competence, trustworthiness, health and safety of employees.

Truist’s ability to operate its businesses efficiently and profitably, to offer products and services that meet the expectations of its clients, and to maintain an effective risk management framework is highly dependent on its ability to staff its operations appropriately and on the competence, integrity, health and safety of its teammates. Truist is similarly dependent on the workforces of other parties on which its operations rely, including vendors and other service providers. Truist’s businesses could be materially and adversely affected by the ineffective implementation of business decisions; any failure to institute controls that appropriately address risks associated with business activities; or to appropriately train teammates with respect to those risks and controls; or staffing shortages, particularly in tight labor markets. Changes in law or regulation in jurisdictions in which our operations are located that affect employees may also adversely affect our ability to hire and retain qualified teammates in those jurisdictions. In addition, the Company’s business could be adversely impacted by a significant operational breakdown or failure, theft, fraud or other unlawful conduct, or other negative outcomes caused by human error or misconduct by a teammate of Truist or an employee of another party on which Truist’s operations depend. Truist’s operations could also be impaired if the measures taken by it or by governmental authorities to help ensure the health and safety of its teammates are ineffective, or if any external party on which Truist relies fails to take appropriate and effective actions to protect the health and safety of its employees.

Risks Related to Estimates and Assumptions

There are risks resulting from the extensive use of models in Truist’s business, which may impact decisions made by Management and regulators.

Truist relies on models to measure risks, estimate certain financial values, and inform certain business decisions. Models may be used in such processes as determining the pricing of various products, grading loans and extending credit, measuring interest rate and other market risks, predicting or estimating losses, assessing capital adequacy and calculating economic and regulatory capital levels, as well as estimating the value of financial instruments and balance sheet items.

Poorly designed, implemented, or incorrectly used models present the risk that certain Truist business decisions may be adversely affected by inappropriate model output. Also, information Truist provides to the public or to its regulators based on poorly designed, implemented, or incorrectly used models could be inaccurate or misleading. Certain decisions that the regulators make, including those related to capital distributions to Truist’s shareholders, could be adversely affected due to the perception of insufficient model quality or incorrect model use.

The Company’s accounting policies and processes are critical to how the Company reports its financial condition and results of operations and require management to make estimates about matters that are uncertain.

Accounting policies and processes are fundamental to how the Company records and reports its financial condition and results of operations. Some of these policies require the use of estimates and assumptions that may affect the value of the Company’s assets or liabilities and financial results. Several of the Company’s accounting policies are critical because they require management to make difficult, subjective, and complex judgments about matters that are inherently uncertain and because it is likely that materially different amounts would be reported under different conditions or using different assumptions. If assumptions or estimates underlying the Company’s financial statements are incorrect or are adjusted periodically, the Company may experience material losses.

34 Truist Financial Corporation

Management has identified certain accounting policies as being critical because they require management’s judgment to ascertain the valuations of assets, liabilities, commitments, and contingencies. A variety of factors could affect the realization of income and expense or the recognition of assets and liabilities in the Company’s financial statements. Truist has established detailed policies and procedures that are intended to ensure these critical accounting estimates and judgments are well controlled and applied consistently. In addition, the policies and procedures are intended to ensure that the process for changing methodologies occurs in an appropriate manner. Due to the uncertainty surrounding the Company’s judgments and the estimates pertaining to these matters, the Company cannot guarantee that adjustments to accounting policies or restatement of prior period financial statements will not be required.

Further, from time to time, the FASB and SEC change the financial accounting and reporting standards that govern the preparation of the Company’s financial statements. In addition, accounting standard setters and those who interpret the accounting standards may change or even reverse their previous interpretations or positions on how these standards should be applied. Changes in financial accounting and reporting standards and changes in current interpretations may be beyond the Company’s control, can be hard to predict and could materially affect how the Company reports its financial results and condition. In some cases, the Company could be required to apply a new or revised standard retroactively, resulting in the restatement of prior period financial statements.

Depressed market values for the Company’s stock and adverse economic conditions sustained over a period of time may require the Company to write down all or some portion of the Company’s goodwill.

Goodwill is periodically tested for impairment by comparing the fair value of each reporting unit to its carrying amount. If the fair value is greater than the carrying amount, then the reporting unit’s goodwill is deemed not to be impaired. The fair value of a reporting unit is impacted by the reporting unit’s expected financial performance and susceptibility to adverse economic, regulatory, and legislative changes. Future adverse changes in economic conditions or expected financial performance may cause the fair value of a reporting unit to be below its carrying amount, resulting in goodwill impairment. The estimated fair values of the individual reporting units are assessed for reasonableness by reviewing a variety of indicators, including comparing these estimated fair values to the Company’s market capitalization over a reasonable period of time. While this comparison provides some relative market information about the estimated fair value of the reporting units, it is not determinative and needs to be evaluated in the context of the current economic environment. However, significant and sustained declines in the Company’s market capitalization could be an indication of potential goodwill impairment. Refer to the “Critical Accounting Policies” section for additional details related to the Company’s intangible assets policy.

Operational Risks

Truist relies on other companies to provide key components of the Company’s business infrastructure.

Third parties provide key components of the Company’s business infrastructure, such as banking services, data processing, business processes, internet connections, and network access. Any disruption in such services provided by these third parties or any failure of these third parties to handle current or higher volumes of use could adversely affect the Company’s ability to deliver products and services to clients, to support teammates and otherwise to conduct business. Technological or financial difficulties of a third-party service provider could adversely affect the Company’s business to the extent those difficulties result in the interruption or discontinuation of services provided by that party. Further, in some instances, the Company may be responsible for failures of such third parties to comply with government regulations. The Company is not insured against all types of losses as a result of third-party failures, and the insurance coverage that does exist may be inadequate to protect the Company from all losses resulting from system failures or other disruptions. Failures in the Company’s business infrastructure could interrupt its operations or increase the costs of doing business.

The Company’s framework for managing risks may not be effective.

The Company’s risk management framework seeks to mitigate risk and loss. Truist has established policies, processes, and procedures intended to identify, measure, monitor, report, and analyze the types of risk to which the Company is subject, including liquidity, credit, market, operational, technology, reputational, strategic, and compliance risk, among others. However, the Company’s risk management measures may not be fully effective in identifying and mitigating the Company’s risk exposure in all market environments or against all types of risk, including risks that are unidentified or unanticipated, even if the frameworks for assessing risk are properly designed and implemented. Some of the Company’s methods of managing risk are based upon the Company’s use of observed historical market behavior and management’s judgment. These methods may not accurately predict future exposures, which could be significantly greater than historical measures indicate. If the Company’s risk management framework proves ineffective, it could suffer unexpected losses and could be materially adversely affected.

Truist Financial Corporation 35

Truist depends on the accuracy and completeness of information about clients and counterparties.

In deciding whether to extend credit or enter into other transactions with clients and counterparties, Truist relies on the completeness and accuracy of representations made by and information furnished by or on behalf of clients and counterparties, including financial statements and other financial information. If the information provided is not accurate or complete, the Company’s decisions about extending credit or entering into other transactions with clients or counterparties could be adversely affected and the Company could suffer defaults, credit losses or other negative consequences as a result.

Truist can be negatively affected if it fails to identify and address operational risks associated with the introduction of or changes to products, services, and delivery platforms.

When Truist launches a new product or service, introduces a new platform for the delivery or distribution of products or services (including mobile connectivity, electronic trading and cloud computing), acquires or invests in a business or makes changes to an existing product, service or delivery platform, it may not fully appreciate or identify new operational risks that may arise from those changes, or may fail to implement adequate controls to mitigate the risks associated with those changes. Any significant failure in this regard could diminish Truist’s ability to operate one or more of its businesses or result in potential liability to clients and counterparties, and result in increased operating expenses. The Company could also experience higher litigation costs, including regulatory fines, penalties and other sanctions, reputational damage, impairment of Truist’s liquidity, regulatory intervention, or weaker competitive standing. Any of the foregoing consequences could materially and adversely affect Truist’s businesses and results of operations.

Enhanced regulatory and other standards for the oversight of vendors and other service providers can result in higher costs and other potential exposures.

The Company must comply with enhanced regulatory and other standards associated with doing business with vendors and other service providers, including standards relating to the outsourcing of functions as well as the performance of significant banking and other functions by subsidiaries. Truist incurs significant costs and expenses in connection with its initiatives to address the risks associated with oversight of its internal and external service providers. Truist’s failure to appropriately assess and manage these relationships, especially those involving significant banking functions, shared services or other critical activities, could materially adversely affect Truist. Specifically, any such failure could result in: potential harm to clients, and any liability associated with that harm; regulatory fines, penalties or other sanctions; lower revenues, and the opportunity cost from lost revenues; increased operational costs, or harm to Truist’s reputation.