PNC Financial Services Group

•PNC’s baseline forecast remains for continued expansion in 2026, with economic growth expected to remain resilient despite oil prices that are up from early 2026, supported by strong AI-related capex, tax refunds, and an improving labor market. We expect real GDP growth of 2.1% in 2026, with continued modest job gains and the unemployment rate holding roughly steady, ending the year at around 4.3%. Inflation risks have eased somewhat but we still expect inflation to remain elevated, with CPI inflation staying above 3% through year-end. Risks to our growth and inflation outlook include a sudden reversal in AI-related sentiment, which would have knock-on effects on both capex and wealth-driven consumer spending, as well as any further sharp rise in oil prices.

AI Artificial intelligence LCR Liquidity coverage ratio

•PNC’s baseline forecast remains for continued expansion in 2026, but slower economic growth in 2026 than in 2025 and 2024. The baseline forecast anticipates real GDP growth slowing to around 1.7% in 2026, with continued modest job gains and the unemployment rate moving slightly higher, to around 4.6% at year’s end. CPI inflation will peak at around 3.5% in mid-2026, with core CPI inflation at around 2.6%. An extended conflict with Iran and higher energy prices are significant risks to the outlook, both for inflation and growth, and a reversal in sentiment around AI or a large decline in equity prices would be drags. Weaker labor force growth could lead to weaker long-run growth.

As a large financial services company, we handle a substantial volume of customer and other financial transactions. As a result, we rely heavily on information systems to conduct our business and to process, record, monitor and report on our transactions and those of our customers. Over time, we have seen more customer usage of technological solutions for financial needs as well as higher expectations of customers and regulatory requirements regarding effective and safe systems. As a result of these factors, the financial services industry continues to undergo rapid technological change with frequent introductions of new technology-driven products and services. Examples include expanded use of cloud computing, artificial intelligence (AI) and machine learning, biometric authentication, voice and natural language, data privacy and security enhancements and increased online and mobile device interaction with customers, including innovative ways that customers can manage their accounts.

We are faced with ongoing, nearly continual, efforts by others to breach data security at financial institutions or with respect to financial transactions. The effectiveness of these efforts may be enhanced using AI. These efforts may be to obtain access to confidential information, often with the intent of stealing from or defrauding us or our customers, or to disrupt our ability to conduct our business, including by destroying or impairing access to information gathered, maintained, used, transmitted or otherwise processed by us. Some of these involve efforts to enter our technology directly by going through or around our security protections. Others involve the use of social engineering schemes to gain access to confidential information from our employees, customers or vendors. The modernization of the payment systems, including near real-time movement solutions, increases the complexity of preventing and detecting these attacks and recovering fraudulent transactions. Our risk and exposure to cyber attacks and breaches is heightened because of our expanded digital products and services, geographic footprint and dispersed workforce, which results in more access points to our network. The same risks are presented by attacks potentially affecting information held by third parties on our behalf or accessed by third parties, including those offering financial applications, on behalf of our customers. These risks also arise when third parties with whom we do business, or their vendors or other entities with whom they do business, are themselves subject to cyber attacks and breaches, which has impacted our business and may do so in the future. Our ability to protect confidential information is even more limited with respect to such information gathered, maintained, used, transmitted or otherwise processed by these parties. For example, we are likely to be limited in our ability to identify and quickly resolve cyber attacks and breaches that may impact our business the further removed an entity is from our business, such as when a cyber attack or other data security breach occurs at vendors of our vendors. We may suffer reputational damage or legal liability for unauthorized access to customer information gathered, maintained, used, transmitted or otherwise processed by other parties, even if we were not responsible for preventing such access and had no reasonable way of preventing it.

public disclosure of confidential information. Cyber attacks and data security breaches have also been conducted through business email compromise scams that involve using social engineering to cause employees to wire funds to the perpetrators in the mistaken belief that the requests were made by a company executive or established vendor. These types of phishing attacks have increased over time, and they have evolved to include other types of attacks like vishing (through voice messages) and smishing (through SMS text). Other cyber attacks and data security breaches have included distributed denial of service attacks, in which individuals or organizations flood commercial websites with extraordinarily high volumes of traffic with the goal of disrupting the ability of commercial enterprises to process transactions and possibly making their websites unavailable to customers for extended periods of time. Similarly, cyber attacks and breaches have been conducted through application program interfaces where bad actors seek to exploit the interfaces between mobile or web applications. We (as well as other financial services companies) have been subject to such cyber attacks and breaches. Recent cyber attacks and breaches have also included the insertion of malware into software updates and the infection of software while it is under assembly, known as a “supply chain attack.” Cyber attacks and breaches affecting our customers may put these relationships at risk, particularly if customers’ ability to continue operations is impaired due to the losses suffered. The techniques used in cyber attacks and breaches change rapidly and are increasingly sophisticated, including through the use of generative AI and deepfakes, and we expect in the future through the use of quantum computing, and we may not be able to anticipate cyber attacks or other data security breaches. Additionally, cyber attacks and breaches in some cases appear to be supported by foreign governments or other well-financed entities and often originate from less regulated and remote areas of the world. We have seen a higher volume and complexity of attacks during times of increased geopolitical tensions.

There are risks resulting from the extensive use of models, some of which use AI, in our business.

We use financial and statistical models throughout many areas of our business, relying on them to inform decision making, automate processes, and estimate many financial values. Although it currently impacts a minority of the overall number of models that we use, we increasingly use models related to how we do business with customers and for internal process automation that leverage AI/machine learning algorithms. These models can be more predictive, but because of the complex way in which the many variables in AI/machine learning models interact, the results of these models are often less interpretable than traditional statistical models. Examples of model use include determining the pricing of various products, identifying potentially fraudulent or suspicious transactions, marketing to potential customers, grading loans and extending credit, measuring interest rate and other market risks, predicting or estimating losses, and assessing capital adequacy. We depend significantly on models for credit loss accounting under CECL, capital stress testing and estimating the value of items in our financial statements.

Models generally predict or infer certain financial outcomes, leveraging historical data and assumptions as to the future, often with respect to macroeconomic conditions. Development and implementation of some of these models, such as the models for credit loss accounting under CECL, require us to make difficult, subjective and complex judgments. Other models are used to support decisions made regarding how we do business with customers. Poorly designed or implemented models present the risk that our business decisions based on information incorporating model output will be adversely affected due to the inadequacy of that information. For example, our models may not be effective if historical data does not accurately represent future events or environments or if our models rely on erroneous, incomplete, biased, or otherwise flawed data, formulas, algorithms or assumptions and our internal model review processes fail to detect and address these flaws. Models, if flawed, could cause information we provide to the public or to our regulators to be inaccurate, incomplete or misleading. Some of the decisions that our regulators make, including those related to capital distribution to our shareholders, would likely be affected adversely if they perceive that the quality of the relevant models we use is insufficient. Finally, flaws in our models that negatively impact our customers or our ability to comply with applicable laws and regulations could negatively affect our reputation or result in fines and penalties from our regulators. Moreover, our use of AI/machine learning algorithms is subject to a variety of existing laws and regulations, including intellectual property, privacy (including with respect to automated decision making), consumer protection and federal equal opportunity laws and regulations, and additional new laws and regulations, and new applications or interpretations of existing laws and regulations, related to AI/machine learning algorithms may impact our ability to develop, use and commercialize AI/machine learning algorithms.

We use automation, machine learning, AI and robotic process automation tools to help reduce some risks of human error. Nonetheless, we continue to rely on many manual processes to conduct our business and manage our risks. In addition, use of automation tools does not eliminate the need for effective design and monitoring of their operation to make sure they operate as intended. Enhanced use of automation may present its own risks. Automated systems may themselves experience outages or problems. Some tools are dependent on the quality of the data used by the tool to learn and enhance the process for which it is responsible. Bad, missing or anomalous data can adversely affect the functioning of such tools. It is possible that humans in some cases are better able than highly automated tools to identify that anomalous data is being used or that results are themselves anomalous.

The Chief Information Security Officer’s organization includes managers who have led cybersecurity programs in other industries such as robotics and AI, consulting, telecommunications, healthcare and manufacturing, which brings together a multi-faceted approach to managing cybersecurity threats and risks. The Information Security department leadership and personnel hold degrees in Information Security, Management Information Systems, Computer Science, Engineering Management and other professional majors. They also hold multiple professional certifications inclusive of vendor-issued security credentials from CISCO, Microsoft and F5, and industry certifications including but not limited to: Certified Information Systems Security Professional issued by the International Information System Security Certification Consortium; the Cybersecurity and Infrastructure Security Agency and Certified Information Security Manager issued by the Information Systems Audit and Control Association; and the Certificate of Cloud Security Knowledge issued by the Cloud Security Association.

•PNC’s baseline forecast remains for continued expansion, but slower economic growth in 2026 than in 2024 and 2025. Tariffs remain a drag on consumer spending and business investment, while AI-related capex and wealth effects have been key supports to growth. Consumer spending growth is slowing to a pace more consistent with household income growth. The One Big Beautiful Bill will be a net positive for economic growth in 2026.

•The baseline forecast anticipates real GDP growth slowing to around 2% in 2026, with continued modest job gains and the unemployment rate at around 4.5%. Tariffs remain a risk to the outlook, and a reversal in sentiment around AI or a large decline in equity prices would be drags. Weaker labor force growth could lead to weaker long-run growth.

AI Artificial intelligence GDP Gross domestic product

•PNC’s baseline forecast remains for continued expansion, but slower economic growth in 2025 and 2026 than in 2024. The government shutdown will weaken growth, but the economy should regain that growth once the shutdown ends. Tariffs are a drag on consumer spending and business investment, while AI-related capex and wealth effects have been key supports to growth. Consumer spending growth is slowing to a pace more consistent with household income growth, and government’s contribution to economic growth will be smaller.

•The baseline forecast anticipates real GDP growth slowing to below 2% in both 2025 and 2026, accompanied by a modest increase in the unemployment rate, which is expected to peak above 4.5% in mid-2026. Tariffs remain a risk to the outlook, and a reversal in sentiment around AI would be a drag. Additionally, a prolonged government shutdown has emerged as a downside risk.

As a large financial services company, we handle a substantial volume of customer and other financial transactions. As a result, we rely heavily on information systems to conduct our business and to process, record, monitor and report on our transactions and those of our customers. Over time, we have seen more customer usage of technological solutions for financial needs as well as higher expectations of customers and requirements of regulators regarding effective and safe systems operation. In many cases, the effective use of technology increases efficiency and enables financial institutions to better serve customers. As a result of these factors, the financial services industry continues to undergo rapid technological change with frequent introductions of new technology-driven products and services. Examples include expanded use of cloud computing, artificial intelligence (AI) and machine learning, biometric authentication, voice and natural language, data protection enhancements and increased online and mobile device interaction with customers, including innovative ways that customers can manage their accounts.

We are faced with ongoing, nearly continual, efforts by others to breach data security at financial institutions or with respect to financial transactions. The effectiveness of these efforts may be enhanced using AI. These efforts may be to obtain access to confidential or proprietary information, often with the intent of stealing from or defrauding us or our customers, or to disrupt our ability to conduct our business, including by destroying or impairing access to information maintained by us. Some of these involve efforts to enter our systems directly by going through or around our security protections. Others involve the use of social engineering schemes to gain access to confidential information from our employees, customers or vendors. Our risk and exposure to data security breaches is heightened because of our expanded digital products and services, geographic footprint and continued remote work environment, which results in more access points to our network. The same risks are presented by attacks potentially affecting information held by third parties on our behalf or accessed by third parties, including those offering financial applications, on behalf of our customers. These risks also arise when third parties with whom we do business, or their vendors or other entities with whom they do business, are themselves subject to breaches and attacks, which has impacted our business and may do so in the future. Our ability to protect confidential or proprietary information is even more limited with respect to information held by these parties. For example, we are likely to be limited in our ability to identify and quickly resolve breaches and attacks that may impact our business the further removed an entity is from our business, such as when a breach or attack occurs at vendors of our vendors. We may suffer reputational damage or legal liability for unauthorized access to customer information held by other parties, even if we were not responsible for preventing such access and had no reasonable way of preventing it.

Other cyber attacks are not focused on gaining access to credit card or user credential information, but instead seek access to a range of other types of confidential information, such as internal emails and other forms of customer financial information, and this information may be used to support a ransomware attack. Ransomware attacks have sought to deny access to data and possibly shut down systems and devices maintained by target companies. In a ransomware attack, system data is encrypted, stolen or extorted, or access is otherwise denied, accompanied by a demand for ransom to restore access to the data or to prevent public disclosure of confidential information. Attacks have also been conducted through business email compromise scams that involve using social engineering to cause employees to wire funds to the perpetrators in the mistaken belief that the requests were made by a company executive or established vendor. These types of phishing attacks have increased over time, and they have evolved to include other types of attacks like vishing (through voice messages) and smishing (through SMS text). Other attacks have included distributed denial of service cyber attacks, in which individuals or organizations flood commercial websites with extraordinarily high volumes of traffic with the goal of disrupting the ability of commercial enterprises to process transactions and possibly making their websites unavailable to customers for extended periods of time. Similarly, attacks have been conducted through application program interfaces where cyber attackers seek to exploit the interfaces between mobile or web applications. We (as well as other financial services companies) have been subject to such attacks. Recent cyber attacks have also included the insertion of malware into software updates and the infection of software while it is under assembly, known as a “supply chain attack.” Attacks on our customers may put these relationships at risk, particularly if customers’ ability to continue operations is impaired due to the losses suffered. The techniques used in cyber attacks change rapidly and are increasingly sophisticated, including through the use of generative AI and deepfakes, and we expect in the future through the use of quantum computing, and we may not be able to anticipate cyber attacks or data security breaches.

There are risks resulting from the extensive use of models, some of which use AI, in our business.

We use financial and statistical models throughout many areas of our business, relying on them to inform decision making, automate processes, and estimate many financial values. Although it currently impacts a minority of the overall number of models that we use, we increasingly use models related to how we do business with customers and for internal process automation that leverage AI/machine learning algorithms. These models can be more predictive, but because of the complex way in which the many variables in AI/machine learning models interact, the results of these models are often less interpretable than traditional statistical models. Examples of model uses include determining the pricing of various products, identifying potentially fraudulent or suspicious transactions, marketing to potential customers, grading loans and extending credit, measuring interest rate and other market risks, predicting or estimating losses, and assessing capital adequacy. We depend significantly on models for credit loss accounting under CECL, capital stress testing and estimating the value of items in our financial statements.

We use automation, machine learning, AI and robotic process automation tools to help reduce some risks of human error. Nonetheless, we continue to rely on many manual processes to conduct our business and manage our risks. In addition, use of automation tools does not eliminate the need for effective design and monitoring of their operation to make sure they operate as intended. Enhanced use of automation may present its own risks. Automated systems may themselves experience outages or problems. Some tools are dependent on the quality of the data used by the tool to learn and enhance the process for which it is responsible. Bad, missing or anomalous data can adversely affect the functioning of such tools. It is possible that humans in some cases are better able than highly automated tools to identify that anomalous data is being used or that results are themselves anomalous.

The Chief Information Security Officer’s organization includes managers who have led cybersecurity programs in other industries such as robotics and AI, consulting, telecommunications, healthcare and manufacturing, which brings together a multi-faceted approach to managing cybersecurity threats and risks. The Information Security department leadership and personnel hold degrees in Information Security, Management Information Systems, Computer Science, Engineering Management and other professional majors. They also hold multiple professional certifications inclusive of vendor-issued security credentials from CISCO, Microsoft and F5, and industry certifications including but not limited to: Certified Information Systems Security Professional issued by the International Information System Security Certification Consortium; the Cybersecurity and Infrastructure Security Agency and Certified Information Security Manager issued by the Information Systems Audit and Control Association; and the Certificate of Cloud Security Knowledge issued by the Cloud Security Association.

AI Artificial intelligence GNMA Government National Mortgage Association

As a large financial services company, we handle a substantial volume of customer and other financial transactions. As a result, we rely heavily on information systems to conduct our business and to process, record, monitor and report on our transactions and those of our customers. Over time, we have seen more customer usage of technological solutions for financial needs as well as higher expectations of customers and regulators regarding effective and safe systems operation. In many cases, the effective use of technology increases efficiency and enables financial institutions to better serve customers. As a result of these factors, the financial services industry continues to undergo rapid technological change with frequent introductions of new technology-driven products and services. Examples include expanded use of cloud computing, artificial intelligence and machine learning, biometric authentication, voice and natural language, data protection enhancements and increased online and mobile device interaction with customers, including innovative ways that customers can view, access and aggregate financial data, make payments or manage their accounts.

The techniques used in cyber attacks change rapidly and are increasingly sophisticated, including through the use of generative artificial intelligence and deepfakes, and we expect in the future through the use of quantum computing, and we may not be able to anticipate cyber attacks or data security breaches.

We reserve for credit losses on our loan and lease portfolio through our ACL estimated under CECL. Under CECL, the ACL reflects expected lifetime losses, which has led and could continue to lead to volatility in the allowance and the provision for credit losses as economic forecasts, actual credit performance and other factors used in the loss estimating process change. We also have reserves for unfunded loan commitments and letters of credit. Changes to expected losses are reflected in net income through provision for credit losses. A worsening of economic conditions or our economic outlook or an increase in credit risk, particularly following a period of good economic conditions, would likely lead to an increase in provision for credit losses with a resulting reduction in our net income and an increase to our allowance. Conversely, an improvement of economic conditions or our economic outlook, particularly following a period of poor economic conditions, could result in a recapture of provision for credit losses for a period of time with a resulting increase in our net income and decrease in our allowance. Either set of conditions is not likely to be sustained and may obscure actual current operations and financial performance. The Risk Factor headed “There are risks resulting from the extensive use of models, some of which use artificial intelligence (AI), in our business” further discusses risks associated with estimating expected losses under CECL.

There are risks resulting from the extensive use of models, some of which use artificial intelligence (AI), in our business.

We use financial and statistical models throughout many areas of our business, relying on them to inform decision making, automate processes, and estimate many financial values. We increasingly use models related to how we do business with customers and for internal process automation that leverage AI/machine learning algorithms. These models can be more predictive, but because of the complex way in which the many variables in AI/machine learning models interact, the results of these models are often less interpretable than traditional statistical models. Examples of model uses include determining the pricing of various products, identifying potentially fraudulent or suspicious transactions, marketing to potential customers, grading loans and extending credit, measuring interest rate and other market risks, predicting or estimating losses, and assessing capital adequacy. We depend significantly on models for credit loss accounting under CECL, capital stress testing and estimating the value of items in our financial statements.

We use automation, machine learning, artificial intelligence and robotic process automation tools to help reduce some risks of human error. Nonetheless, we continue to rely on many manual processes to conduct our business and manage our risks. In addition, use of automation tools does not eliminate the need for effective design and monitoring of their operation to make sure they operate as intended. Enhanced use of automation may present its own risks. Automated systems may themselves experience outages or problems. Some tools are dependent on the quality of the data used by the tool to learn and enhance the process for which it is responsible. Bad, missing or anomalous data can adversely affect the functioning of such tools. It is possible that humans in some cases are better able than highly automated tools to identify that anomalous data is being used or that results are themselves anomalous.

The Chief Information Security Officer’s organization includes managers who have led cybersecurity programs in other industries such as robotics and artificial intelligence, consulting, telecommunications, healthcare, and manufacturing, which brings together a multi-faceted approach to managing cybersecurity threats and risks. The Information Security department leadership and personnel hold degrees in Information Security, Management Information Systems, Computer Science, Engineering Management and other professional majors. They also hold multiple professional certifications inclusive of vendor-issued security credentials from CISCO,

As a large financial services company, we handle a substantial volume of customer and other financial transactions. As a result, we rely heavily on information systems to conduct our business and to process, record, monitor and report on our transactions and those of our customers. Over time, we have seen more customer usage of technological solutions for financial needs as well as higher expectations of customers and regulators regarding effective and safe systems operation. In many cases, the effective use of technology increases efficiency and enables financial institutions to better serve customers. As a result of these factors, the financial services industry is undergoing rapid technological change with frequent introductions of new technology-driven products and services. Examples include expanded use of cloud computing, artificial intelligence and machine learning, virtual and augmented reality, biometric authentication, voice and natural language, data protection enhancements and increased online and mobile device interaction with customers, including innovative ways that customers can make payments or manage their accounts. The emergence of many of these technologies was accelerated as a result of the COVID-19 pandemic and the shift to increased digital activity. We expect these trends to continue for the foreseeable future.

We use automation, machine learning, artificial intelligence and robotic process automation tools to help reduce some risks of human error. Nonetheless, we continue to rely on many manual processes to conduct our business and manage our risks. In addition, use of automation tools does not eliminate the need for effective design and monitoring of their operation to make sure they operate as intended. Enhanced use of automation may present its own risks. Automated systems may themselves experience outages or problems. Some tools are dependent on the quality of the data used by the tool to learn and enhance the process for which it is responsible. Not only bad or missing data but also anomalous data can adversely affect the functioning of such tools. It is possible that humans in some cases are better able than highly automated tools to identify that anomalous data is being used or that results are themselves anomalous.