Truist Financial Corp

AI Artificial intelligence, including machine learning and other types of artificial intelligence

AI Artificial intelligence, including machine learning

AI Artificial intelligence, including machine learning and other types of artificial intelligence

AI Artificial intelligence, including machine learning and other types of artificial intelligence

In addition to career development opportunities, Truist provides learning experiences to new and existing teammates to help build the skills needed now and in the future, including role skill preparedness, upskilling for advancements, including the responsible use of emerging technologies such as AI, and access to skill building content for teammate-led learning. Truist Learning and Development also prioritizes and integrates regulatory-related training to mitigate risk across the organization. Truist has invested in innovative talent marketplace and learning technologies and believes that skill development leads to healthy and robust career mobility, which furthers our teammate value proposition and retention efforts.

•The use of AI in our products and services, as well as our business and the industry more broadly, may negatively impact our business, operations, financial condition, results of operations, prospects, and reputation.

The Company has experienced, and may continue to experience, failures and disruptions affecting the stability, performance, security, and availability of its applications, operating systems, and infrastructure. These include degraded processing performance, data quality issues, loss of network connectivity, software malfunctions and misconfigurations, and interruptions in the availability and reliability of cloud-based and other third-party systems and services. The Company’s substantial and increasing reliance on cloud service providers and other external technology vendors heightens exposure to risks outside of its control, including system outages, downtime, cyber-attacks, and adverse financial and operating conditions at those providers and vendors. The Company’s expanding use of AI tools and related technologies introduces additional operational risks, including reliance on data integrity and model performance as well as third-party AI services that may fail, degrade, or produce inaccurate or unexpected outputs.

The Company regularly updates and modifies its applications, operating systems, and infrastructure to support business and operations, including growth initiatives and regulatory compliance requirements. These activities involve significant costs and create additional risks related to the implementation, integration, and effectiveness of new or modified applications, systems, and infrastructure. The introduction, updating, or retraining of AI models and other methods of automation may amplify these risks. Changes in model behavior or configuration may produce unintended outcomes, increase susceptibility to operational errors, or reduce the effectiveness of existing controls. Failures associated with upgrades, configuration changes, system conversions, AI model deployment, integration efforts, and related activities may result in operational interruptions, system failures, or reduced control effectiveness.

Failures to properly maintain, upgrade, or secure applications, operating systems, and infrastructure may increase the Company’s susceptibility to cybersecurity threats, including supply chain attacks, and may impair the Company’s ability to meet business continuity and resiliency objectives. AI-enabled technologies may further expand the cyber-attack surface and velocity, including exposure to adversarial manipulation, data poisoning, and vulnerabilities in third-party AI and other platforms. These events have resulted in adverse client impacts, including the inability to access account information or conduct transactions through ATM, online, or mobile channels, the exposure of confidential, proprietary, personal, and other sensitive information, the posting of duplicative or delayed transactions, and delays in obtaining assistance through call centers. The Company cannot assure that similar or more severe operational or technology failures and disruptions, including AI-related failures or third-party service interruptions, will not occur in the future or that their effects can be prevented, contained, or remediated in a timely manner.

The financial services industry is undergoing rapid technological change with frequent introductions of new technology-driven products and services, including those related to AI and cloud migration as well as blockchain and other distributed ledger technologies such as those underpinning digital assets, tokenization, cryptocurrencies, and stablecoins. Truist has invested in technology to automate functions previously performed manually, to facilitate the ability of clients to engage in financial transactions, and otherwise to enhance the client experience with respect to the Company’s products and services. As a result of these developments and investments, Truist is heavily reliant on technology, and any inability to effectively anticipate, develop, or implement new or enhanced technology could have an adverse effect on Truist’s business.

Cybersecurity risks for financial institutions have significantly increased in recent years and will likely continue to increase, in part because of the proliferation of new technologies to facilitate and conduct financial transactions and the increased sophistication and activities of organized crime affiliates, terrorist organizations, hostile foreign governments, state-sponsored actors, disgruntled teammates or vendors, hackers, activists, and other third parties, including those involved in corporate espionage. The risk of a security breach due to a cyber-attack could increase in the future due to factors such as the financial industry’s ongoing expansion of digital banking and other internet-based client offerings and the internal use of internet-based products and applications, including those that use cloud computing services; advances in AI, such as the use of machine learning, generative AI, and quantum computing by malicious actors to develop more advanced social engineering attacks on the Company or its clients, including targeted phishing and smishing attacks; the inability to maintain the security of information transmitted by financial institutions due to advances in quantum computing and other technology that may counteract or nullify existing information protections; and the acquisition and integration of new businesses. Even the most advanced internal control environment may be vulnerable to compromise. Persistent attackers may succeed in penetrating defenses given enough resources, time, and motive. The techniques used by cybersecurity threat actors change frequently and may not be recognized until launched or well after a breach has occurred.

The use of AI in our products and services, as well as our business and the industry more broadly, may negatively impact our business, operations, financial condition, results of operations, prospects, and reputation.

Our industry is subject to rapid and significant technological change. To compete effectively, the Company uses new and evolving technologies, including AI, to help improve our marketing, referrals, products, services, and client service, to increase productivity for internal code and software development and testing, and to automate certain business decisions and risk management practices, such as fraud identification. The Company's use of AI is subject to risks that models, prompts, algorithms, and datasets, as well as related decisions, predictions, analysis, and other output, are flawed, inaccurate, of poor quality, insufficient, biased, or otherwise erroneous or inadequate, any of which may not be easily detectable. In addition, the models and processes relating to AI are not always transparent, which could increase the risk of unintended deficiencies. Ineffective implementation of AI by us or our third-party providers could subject us to additional risks that we cannot adequately predict or mitigate. Further, inappropriate or controversial data practices by developers and end-users, or other factors adversely affecting public opinion of AI and machine learning, could impair the acceptance and use of AI. If any of these risks are realized, we could suffer business and operational disruptions, operational inefficiencies, competitive harm, legal liability, increased regulatory scrutiny, reputational harm, or other consequences that the Company cannot predict, any of which could negatively affect the Company's financial condition and results of operations.

Regulatory and other legal frameworks surrounding AI continue to evolve and remain uncertain. If we do not have sufficient rights to use models, prompts, algorithms, and datasets on which our AI technologies rely or the related decisions, predictions, analysis, or other output, we could incur significant damages, substantial fees, deprivation of access, or considerable expense through a violation of applicable law, third-party intellectual property, privacy, or other rights, or other violations. New or changing statutes, regulations, or industry standards and practices may increase costs, restrict use cases, or require significant changes to our deployment or our existing systems and controls. If we fail to appropriately respond to changes within the AI landscape, including changing public sentiment, we could face legal, regulatory, or brand and stakeholder risk that may negatively impact our business, operations, financial results, financial condition, or reputation. In addition, the use of AI by companies has resulted in, and may in the future result in, cybersecurity breaches, attacks, and other similar incidents as well as data privacy violations.

Truist expects to remain subject to extensive regulation and supervision. Our regulatory and supervisory environments, whether at federal, state, or local levels, are not static. No assurance can be given that applicable laws and policies will not be amended or construed differently, that new laws and policies will not be adopted, or that any of these laws and policies will not be enforced more aggressively, including as a result of changes to control of branches of the U.S. government. Moreover, political and policy goals of elected and appointed officials may change over time, which could impact the rulemaking, supervision, examination, and enforcement priorities of federal and state regulators. It is possible that expected changes in law and policy do not occur or are reversed subsequently or that the regulatory measures ultimately adopted deliver fewer or no competitive advantages to us and significant competitive advantages to financial services providers that are larger or smaller, are structured differently, or serve different markets than us. Truist could become subject to future legislation and regulatory requirements beyond those currently proposed, adopted, or contemplated in the U.S. or abroad, including limits on acquisitions, more stringent capital and liquidity requirements, and policies and rulemaking related to emerging technologies such as stablecoins and digital assets, cybersecurity, and AI and data. The cumulative effect of such legislation and regulations on Truist’s business, operations, and profitability cannot be accurately predicted, but any of these impacts would likely necessitate changes to Truist’s existing regulatory compliance and risk management infrastructure and could result in increased compliance costs. Such legislation and regulation also may reduce Truist’s revenues, limit the types of financial services and products it may offer, alter the investments it makes, affect the manner in which it operates its businesses, increase its litigation and regulatory costs, and enhance the ability of nonbanks to offer competitive financial services and products. Further, our noncompliance with applicable laws, whether as a result of changes in interpretation or enforcement, system or human errors, or otherwise and, in some cases, regardless of whether noncompliance was inadvertent, can result in the suspension or revocation of authority to conduct business operations and in the initiation of supervisory actions, enforcement proceedings, or private litigation.

Truist relies on models to measure risks, estimate certain financial values, and inform certain business decisions, including AI models. Models may be used in such processes as determining the pricing of various products, grading loans and extending credit, measuring interest rate and other market risks, predicting or estimating losses, assessing capital adequacy and calculating economic and regulatory capital levels, as well as estimating the value of financial instruments and balance sheet items.

In addition, advances in technology, such as automation and AI, may lead us to modify our workforce strategy. This could require Truist to invest in additional teammate training, manage impacts on morale and retention, and compete for candidates who possess more advanced technological skills, all of which could have a negative impact on Truist’s business and operations.

Increased and evolving activity perpetrated by bad actors intending to defraud, misappropriate property, or circumvent the law using different channels, products, and means may outpace and outmaneuver the Truist control environment and monitoring activities impacting clients, teammates, and stakeholders. Fraud attacks in the banking sector have surged in recent years, driven by increasingly sophisticated and rapid techniques. Many bad actors, often linked to large criminal organizations, share strategies to execute schemes, such as debit and credit card fraud, peer-to-peer payment fraud, counterfeit checks, social engineering attacks (such as phishing and smishing), and ATM skimming, and recent advances in AI may make it easier to engage in such schemes and more difficult to detect fraud. Fraudulent schemes exploit products like real-time payments, ACH, and wire transfers to steal funds. Fraudsters impersonate legitimate clients using stolen identities, employ other individuals to interact with Truist, or create fraudulent identities. In some cases, fraud is even committed by existing clients. The increasing sophistication of AI technologies poses heightened risk of identity fraud as malicious actors may exploit AI to create convincing false identities or manipulate verification processes. A failure to detect, prevent, and address fraud has in the past and could in the future result in financial loss to the Company or its clients, loss of confidence in the Company’s security measures, client dissatisfaction, litigation exposure, regulatory investigations, fines, penalties or intervention, reimbursement, or other compensatory costs (including the costs of credit monitoring services), additional compliance costs, and harm to the Company’s reputation, all of which could adversely affect the Company.

For the fiscal year ended December 31, 2025, Truist has not identified any cybersecurity incidents that have materially affected, or are reasonably likely to materially affect, its business strategy, results of operations, or financial condition. We expect to continue to be the target of cybersecurity threats with increased frequency and severity due to the evolving threat environment, including the increasing use of machine learning and generative AI, and there can be no assurance that future cybersecurity incidents, including incidents experienced by third parties, will not have a material adverse impact on Truist, including our business strategy, results of operations, or financial condition.

Data Analytics, AI, and Generative AI Risks

Truist’s AI program is foundationally based on the National Institute of Standards and Technology AI Risk Management Framework Core, which provides outcomes and actions that enable dialogue, understanding, and activities to manage AI risks and develop trustworthy AI systems. Oversight of Truist’s AI program is a regular focus of the Board, the BRC, and the BTC.

AI Artificial Intelligence

The financial services industry is undergoing rapid technological change with frequent introductions of new technology-driven products and services, including those related to AI and migration to the cloud. Truist has invested in technology to automate functions previously performed manually, to facilitate the ability of clients to engage in financial transactions and otherwise to enhance the client experience with respect to the Company’s products and services.

Cybersecurity risks for financial institutions have significantly increased in recent years and will likely continue to increase, in part because of the proliferation of new technologies to facilitate and conduct financial transactions. In addition, cybersecurity risks have significantly increased in recent years in part due to the increased sophistication and activities of organized crime affiliates, terrorist organizations, hostile foreign governments, state-sponsored actors, disgruntled teammates or vendors, hackers, activists, and other external parties, including those involved in corporate espionage, any of which may see their effectiveness enhanced by the use of AI, including the use of generative AI to conduct more sophisticated social engineering attacks on the Company or its clients. Even the most advanced internal control environment may be vulnerable to compromise. Persistent attackers may succeed in penetrating defenses given enough resources, time, and motive. The techniques used by cybersecurity threat actors change frequently and may not be recognized until launched or well after a breach has occurred.

Increased and evolving activity perpetrated by bad actors intending to defraud, misappropriate property, or circumvent the law using different channels, products. and means may outpace and outmaneuver the Truist control environment and monitoring activities impacting clients, teammates, and stakeholders. Fraud attacks in the banking sector have surged in recent years, driven by increasingly sophisticated and rapid techniques. Many bad actors, often linked to large criminal organizations, share strategies to execute schemes, such as debit and credit card fraud, peer-to-peer payment fraud, counterfeit checks, social engineering, ATM skimming, and phishing, and recent advances in artificial intelligence may make it more difficult to detect fraud. Fraudulent schemes exploit products like real-time payments, ACH, and wire transfers to steal funds. Fraudsters impersonate legitimate clients using stolen identities, employ other individuals to interact with Truist, or create fraudulent identities. In some cases, fraud is even committed by existing clients. A failure to detect, prevent, and address fraud could result in financial loss to the Company or its clients, loss of confidence in the Company’s security measures, client dissatisfaction, litigation exposure, regulatory investigations, fines, penalties or intervention, reimbursement, or other compensatory costs (including the costs of credit monitoring services), additional compliance costs, and harm to the Company’s reputation, all of which could adversely affect the Company.

The adoption of new technologies by competitors, including internet banking services, mobile applications, advanced ATM functionality, AI, and cryptocurrencies, could require the Company to make substantial investments to modify or adapt the Company’s existing products and services or even radically alter the way Truist conducts business. These and other capital investments in the Company’s business may not produce expected growth in earnings anticipated at the time of the expenditure.

Data Analytics, AI, and Generative AI Risks

Truist’s AI program is foundationally based on the National Institute of Standards and Technology AI Risk Management Framework Core, which provides outcomes and actions that enable dialogue, understanding, and activities to manage AI risks and develop trustworthy AI systems.

Cybersecurity risks for financial institutions have significantly increased in recent years in part because of the proliferation of new technologies to facilitate and conduct financial transactions. For example, cybersecurity risks may increase in the future as Truist continues to evolve its internal and external digital offerings and capabilities. In addition, cybersecurity risks have significantly increased in recent years in part due to the increased sophistication and activities of organized crime affiliates, terrorist organizations, hostile foreign governments, state-sponsored actors, disgruntled teammates or vendors, hackers, activists and other external parties, including those involved in corporate espionage, any of which may see their effectiveness enhanced by the use of artificial intelligence, including the use of generative artificial intelligence to conduct more sophisticated social engineering attacks on the Company or clients. Even the most advanced internal control environment may be vulnerable to compromise. Persistent attackers may succeed in penetrating defenses given enough resources, time, and motive. The techniques used by cybersecurity threat actors change frequently and may not be recognized until launched or well after a breach has occurred. In addition, the existence of cyberattacks or security breaches at third-party vendors and service providers with access to the Company’s data may not be disclosed to the Company in a timely manner.

The financial services industry is undergoing rapid technological change with frequent introductions of new technology-driven products and services, including those related to artificial intelligence. Truist has invested in technology to automate functions previously performed manually, to facilitate the ability of clients to engage in financial transactions and otherwise to enhance the client experience with respect to the Company’s products and services.

The adoption of new technologies by competitors, including internet banking services, mobile applications, advanced ATM functionality, artificial intelligence, and cryptocurrencies, could require the Company to make substantial investments to modify or adapt the Company’s existing products and services or even radically alter the way Truist conducts business. These and other capital investments in the Company’s business may not produce expected growth in earnings anticipated at the time of the expenditure.

7 19 20 23 25 27 4Q22 1Q23 2Q23 3Q23 4Q23 Empowering Clients Through T3: Truist Assist 4Q22 1Q23 2Q23 3Q23 4Q23 Building client-centered experiences 4.4 4.5 4.6 4.7 4.8 4Q22 1Q23 2Q23 3Q23 4Q23 1 Active users reflect clients that have logged in using the mobile app over the prior 90 days 2 Digital transactions include transfers, Zelle, bill payments, mobile deposits, ACH, and wire transfers 3 Client satisfaction: How satisfied are you with your most recent experience using digital banking with Truist? Mobile App Users1 Zelle Transactions Digital Transactions2 Increase in Client Satisfaction With Digital3 66 67 71 72 75 4Q22 1Q23 2Q23 3Q23 4Q23 +1% +2% +1% +9% +43% +13% +0% +7% (in millions) (in millions) (in millions) Innovative Technology + Touch – Truist Assist began its second year in market in 4Q23 with clients engaging in 26% more interactions vs. 3Q23 reflecting a surge in client adoption – In 4Q23, 85% of conversations were completed with the automated assistant, which leverages AI and natural-language processing and understanding to address over 160 unique client inquiries Building Trust – In moments that matter, live agents are available to assist with product solutions and complex transactions – In 2024, we expect Truist Assist to maintain high containment with accelerated adoption and offer clients more self-service capabilities, driving operational efficiency +3%

7 3Q22 4Q22 1Q23 2Q23 T3 (Touch + Technology = Trust) Connected Channel Experiences Deliver on Deposit Acquisition, Retention, and Client Empowerment 3Q22 4Q22 1Q23 2Q23 Continued digital momentum 3Q22 4Q22 1Q23 2Q23 1 Active users reflect clients that have logged in using the mobile app over the prior 90 days 2 Digital transactions include transfers, Zelle, bill payments, mobile deposits, ACH, and wire transfers 3 Client satisfaction: How satisfied are you with your most recent experience using digital banking with Truist? 4.3 Mobile App Users1 Zelle Transactions Digital Transactions2 Increase in Client Satisfaction With Digital3 3Q22 4Q22 1Q23 2Q23 64.9 65.9 17.6 New Account Quality – Digitally-originated Truist One Checking average account balance up 17% vs. 1Q23 with 91% of clients digitally active Personalized Relationship Rates – Enhanced pricing tools effectively attract new balances and retain existing clients Onboarding with Care – Client experience and platform improvements result in new highs in application conversion rates; integrated Digital & Care Center outbound calling enhances account funding and client satisfaction Empowering Clients – Truist Insights (AI-driven platform) now delivers actionable insights for 550K Small Business clients including cash-flow summaries, income and expense analysis, and proactive balance monitoring 67.3 +7% +3% +1% 4.4 4.5 4.6 +6% 19.0 20.4 22.9 +31% 70.8 +9% +2% +13% (in millions) (in millions) (in millions) Small Business Insights

10 1Q22 2Q22 3Q22 4Q22 Product, Experience, and Platform Innovations Delivered in 2022 Position Truist for Continued Digital Growth and Client Engagement in 2023 1Q22 2Q22 3Q22 4Q22 Client-centric digital growth 1Q22 2Q22 3Q22 4Q22 1 Active users reflect clients that have logged in using the mobile app over the prior 90 days 2 Digital transactions include transfers, Zelle, bill payments, mobile deposits, ACH, and wire transfers 3 Client satisfaction: How satisfied are you with your most recent experience using digital banking with Truist? 4.24MM Mobile App Users1 Zelle Transactions Digital Transactions2 Increase in Client Satisfaction With Digital3 1Q22 2Q22 3Q22 4Q22 58.0MM 63.5MM 13.5MM – Long Game Acquisition (2Q). Mobile application uses prize-linked savings and fun to promote financial literacy, increase client lifetime value, and drive new client acquisition. Launches to Truist teammates, clients, and prospects throughout 2023. – Truist One Banking (3Q). Truist One Checking and Truist Confidence accounts have features to help prevent overdraft fees and overspending, while encouraging strong money management habits with digital payments tools like online bill pay and Zelle® – Truist Assist (3Q). AI-enhanced virtual assistant, combining technology with human touch. Provides automated chat messaging for everyday banking help, seamlessly connecting to Contact Center teammates when live help is needed. – Truist Trade (4Q). Expanding the digital investment solutions portfolio by offering a self- directed, commission-free online trading experience with a new, simplified (digital end-to- end) account opening process 4.4MM 64.5MM +6% +5% +7% 4.30MM 4.35MM 4.38MM +3% 15.9MM 17.6MM 19.0MM +42% 65.7MM +13% +3% +21%