U.S. Bancorp

29©2025 U.S. Bank | Confidential 58% 42% Payments: Consumer & Small Business (PCS) Payments: Merchant & Institutional (PMI) • Announced partnership with Amazon to become their exclusive Small Business Cobrand Credit Card issuer • Launched U.S. Bank Business Shield Visa card to help small business owners navigate fluctuations in finances and resources • Introduced new additions to PMI leadership with Wally Mlynarski (Elavon CEO), Peter Geronimo (PMI Sales Distribution), and Raj Gazula (PMI CAO) • Elavon’s rebranding initiative reinforces its position as a leading global payments partner • Elavon was recognized with “Best Performing Gateway in 2026” by TSG4 and “Best Risk, Fraud & Compliance Solution” at Europe’s MPE 2026 awards5 Segment 1Q 2Q 3Q 4Q Credit Card stable Merchant Processing stable stable Corporate Payments and Treasury3 stable Merchant Processing (MPS) Corporate Payments and Treasury3Credit Card Payments Total Net Revenue by Business (1Q26) Highlights Historical Linked Quarter Seasonality for Payment Fees Revenue1 â â á á á á â +5.6% year-over-year +5.1% year-over-year +2.0% year-over-year Payment Services Fee Revenue Growth Rates 1 Linked quarter change based on historical trends adjusted for Covid shutdown and recovery. 2 Excludes Debit Card. 3 Includes Prepaid Card and Treasury Management Fee Revenue for consolidated reporting. 4 Elavon was awarded Best Performing Gateway and Best Transaction Speed and was a runner up for Highest Authorization Rate and Best Gateway Uptime at the 2026 The Strawhecker Group (TSG) Real Transaction Metrics Awards. 5 Best Risk, Fraud & Compliance Solution at Europe’s Merchant Payment Ecosystem (MPE) 2026 awards for Elavon’s AI-driven Pay Defense solution 46% 54% Net interest income (taxable-equivalent basis) Noninterest income á 2 3

As part of its talent strategy, the Company strives to support continuous employee learning and development. The Company provides several talent development opportunities for employees to enhance skills that are critical in the current and future working environment and empowers employees to discover ways to thrive and grow in their careers. In 2025, the Company hosted its second annual development event for all employees, which focused on topics ranging from communications to the future of banking. The Company also launched a new learning platform through its Skills Academy, providing higher quality learning aligned to critical skills. The new learning platform will be leveraged to augment skill development for role training programs and will provide core training for job family skill development needs. The Company also launched an “AI Essentials Channel” on Skills Academy, which is designed to help team members build skills in effectively using Company-approved artificial intelligence tools in their daily work. During 2025, employees completed over 1.7 million hours of training through the Company’s enterprise learning programs to better support their professional development and customer and business needs.

A breach in the security of the Company’s information systems, or the information systems of certain third parties, or a critical technology failure could disrupt the Company’s businesses, result in the disclosure of confidential information, damage its brand and create significant financial and legal risk The Company continues to experience a high number of attacks on its information systems, software, networks and other technologies. The Company’s security measures may not be effective against all threats, including new and emerging threats. Malicious actors continue to develop increasingly sophisticated methods of attack that could impact the Company. Cyber attacks can involve sophisticated and targeted attacks intended to obtain unauthorized access to confidential information, destroy or ransom data, disable or degrade service, or sabotage systems, often through the introduction of software that is included or inserted in an information system for a harmful purpose (malware). Additionally, the rapid advancement of artificial intelligence (“AI”) technologies has enabled malicious actors to develop more sophisticated and adaptive cyber attack methods. AI-driven tools can automate large-scale attacks, identify system vulnerabilities faster, and create highly convincing social engineering schemes, such as deepfake impersonations, which may significantly increase the

The Company could also incur losses resulting from the risk of human error by employees, unauthorized access to its computer systems, the execution of unauthorized transactions by employees, errors relating to transaction processing and technology, breaches of internal control systems and compliance requirements, failures of business continuation and disaster recovery processes and systems, and misconduct or fraud by employees, customers or other persons outside the Company. The increasing sophistication in AI technologies may increase the risk of fraud, such as through identity theft and bypassing controls, and may make it more difficult to detect fraud. This risk of loss also includes customer remediation costs; potential legal actions, fines or civil money penalties that could arise resulting from an operational deficiency or noncompliance with applicable regulatory standards, adverse business decisions or their implementation; and harm to the Company’s brand and customer attrition due to negative publicity.

The Company’s businesses may be adversely affected if the models it uses perform poorly, provide inadequate information, or are used improperly The Company relies on many models to measure risks, estimate values of financial instruments, and inform certain business decisions. Models may be used in processes such as assessing loan credit quality, measuring interest rate and other market risks, estimating potential revenue or losses, assessing capital adequacy and conducting capital stress testing, supporting detection of financial crimes, fraud, and cybersecurity and other threats, evaluating the allowance for credit losses and estimating the value of financial instruments and balance sheet items. The Company also uses several models that employ methodologies based on AI or machine learning, which bring unique complexities, such as the need for large datasets for training, the potential for algorithmic bias, and the need for greater explainability in interpreting model decisions. These complexities may cause the models to be less accurate or less reliable if any of the required inputs are flawed or incorporate unreliable data.

The use of new technologies, including AI and machine learning, may result in harm to the Company’s brand, increased regulatory scrutiny and increased liability The Company uses new and evolving technologies, including AI and machine learning, throughout the Company’s businesses. The Company's use of AI and machine learning is subject to risks that algorithms and datasets are flawed or insufficient or contain biased information. In addition, the models and processes relating to AI and machine learning are not always transparent, which could increase the risk of unintended deficiencies. These flaws could result in inaccurate or ineffective decisions, predictions or analysis, which could subject the Company to competitive harm, legal liability, increased regulatory scrutiny, harm to the Company’s brand or other consequences, any of which could negatively affect the Company's financial condition and results of operations. Furthermore, the legal and regulatory landscape impacting new technologies such as AI is evolving rapidly, and the inability to predict how this regulation will take shape and the absence of a uniform regulatory framework for AI may present unforeseen challenges in applying and relying on existing compliance systems. Complying with existing and new AI and data usage laws, and inconsistencies in regulation from jurisdiction to jurisdiction, could increase expenses and exposure to litigation and regulatory action.

The adoption and rapid growth of new technologies, including generative AI, cryptocurrencies, stablecoins, other digital assets, blockchain and other distributed ledger technologies, have required, and will continue to require, the Company to incur substantial expense to adapt its systems, products and services and could present operational issues. In addition, technology has lowered barriers to entry and made it possible for non-banks to offer products and services, such as loans and payment services, that traditionally were banking products, and made it possible for technology companies to compete with financial institutions in providing electronic, internet-based, and mobile phone–based financial solutions. Competition with non-banks, including technology companies, to provide financial products and services continues to intensify. In particular, the number of financial technology companies (“fintechs”) and companies that offer embedded finance solutions has grown significantly over recent years, and fintechs offer bank or bank-like products. For example, a number of fintechs have applied for bank, non-depository national bank or industrial loan charters, which, in some cases, have been granted. Under the current administration, certain U.S. banking regulators have indicated a desire to process charter applications on an accelerated timeline, including applications filed by fintechs. In addition, other fintechs have partnered with existing banks to allow them to offer deposit products or payment services to their customers. Many of these companies have fewer regulatory constraints, and some have lower cost structures, in part due to lack of physical structures. In addition, future regulatory developments may increase the ability of fintechs and other competitors to compete with traditional banks, including through the use of cryptocurrency, stablecoins and other digital assets or alternative payment systems. The Company’s ability to compete successfully depends on a number of factors, including, among others, its ability to develop and execute strategic plans and initiatives; developing, maintaining and building long-term customer relationships based on quality service, competitive prices, high ethical standards and safe, sound assets; the development of a comparable regulatory framework that addresses the risks of fintech activities; and industry and general economic trends. A failure to compete effectively could contribute to downward price pressure on the Company’s products or services or a loss of market share, which would adversely impact the Company’s results of operations.

31©2025 U.S. Bank | Confidential 69% 31% Payments: Consumer & Small Business (PCS) Payments: Merchant & Institutional (PMI) • Launched “Edward Jones Everyday Solutions powered by U.S. Bank”, a suite of cobranded checking and credit card products to help clients manage spending and investments in one digital platform • Extended cobranded partnerships with Auto Club Group (ACG) and BMW • Introduced AI-driven cash forecasting tool with Kyriba to help businesses gain real-time visibility and control over their cash and liquidity positions • Unveiled customized embedded financing offering through its enhanced Avvance developer portal experience expanded network with three new integrated partners • Rolled out its next-generation treasury management platform, SinglePoint, to manage clients’ liquidity, cash flow, and risk with greater insight and efficiency Segment 1Q 2Q 3Q 4Q Card2 stable Corporate Payments stable Merchant Processing Merchant Processing (MPS) Corporate Payments (CPS)Total Card Payments Total Net Revenue by Business (4Q25) Highlights Historical Linked Quarter Seasonality for Payment Fees Revenue1 â â â á á á á á á â +5.1% year-over-year +5.0% year-over-year -1.0% year-over-year Payment Services +5.3% Credit only Fee Revenue Growth Rates 1 Link d quarter change based on trends from 2015 to 2019 2 Includes Prepaid Card 42% 58% Net interest income (taxable-equivalent basis) Noninterest income

not be effective against all threats, including new and emerging threats. Malicious actors continue to develop increasingly sophisticated methods of attack that could impact the Company, including attack methods that are aided by advanced artificial intelligence (“AI”) models and other tools. Many financial institutions, retailers and other companies engaged in data processing and collection, including software and information technology service providers, have reported cyber attacks, some of which involved sophisticated and targeted attacks intended to obtain unauthorized access to confidential information, destroy or ransom data, disable or degrade service, or sabotage systems, often through the introduction of software that is intentionally included or inserted in an information system for a harmful purpose (malware).

The Company may not be able to anticipate or to implement effective preventive measures against all cyber attacks because malicious actor methods and techniques change frequently, increase in sophistication, often are not recognized until launched, sometimes go undetected even when successful, and originate from a wide variety of sources, including organized crime, hackers, terrorists, activists, hostile foreign governments and other external parties. Those parties may attempt to place their information technology workers as employees or contractors of the Company or the Company’s third-party vendors to attempt to gain access to the Company’s systems. Those parties may also attempt to fraudulently induce employees, customers or other users of the Company’s systems to disclose sensitive information to gain access to the Company’s data or that of its customers or clients, such as through “phishing” and other social engineering schemes. For example, recent advances in AI may allow a bad actor to create so-called “deep fakes” to impersonate the voice or likeness of another individual, which could be used in social engineering schemes that may be more difficult to detect than other social engineering efforts. Attack methods may include the introduction of computer viruses and/or malicious or destructive code, denial-of-service attacks (DDoS), and cyber extortion with accompanying ransom demands. The Company’s information security risks may increase in the future as the Company continues to increase its mobile and internet-based product offerings and expands its internal usage of web-based products, data storage and other applications. In addition, the Company’s customers often use their own devices, such as computers, smart phones and tablets, to make payments and manage their accounts, and are subject to social engineering schemes, scam websites, and other attempts from cyber criminals to compromise or deny access to their accounts. The Company has limited ability to assure the safety and security of its customers’ transactions with the Company to the extent they are using their own devices, which have been, and likely will continue to be, subject to such threats.

The use of new technologies, including AI and machine learning, may result in reputational harm, increased regulatory scrutiny and increased liability The banking industry is subject to rapid and significant technological change. To compete effectively, the Company uses new and evolving technologies, including AI and machine learning, to help improve its customer service, marketing, and products, to increase productivity for internal code development and testing, and to automate certain business decisions and risk management practices, such as fraud identification. The Company's use of AI and machine learning is subject to risks that algorithms and datasets are flawed or may be insufficient or contain biased information. In addition, the models and processes relating to AI and machine learning are not always transparent, which could increase the risk of unintended deficiencies. These deficiencies could result in inaccurate or ineffective decisions, predictions or analysis, which could subject the Company to competitive harm, legal liability, increased regulatory scrutiny, reputational harm or other consequences that the Company may not be able to predict, any of which could negatively affect the Company's financial condition and results of operations. Furthermore, the legal and regulatory landscape impacting new technologies such as AI is evolving rapidly, and the inability to predict how this regulation will take shape and the absence of a uniform regulatory framework for AI may present unforeseen challenges in applying and relying on existing compliance systems. Complying with existing and new AI and data usage laws, and inconsistencies in regulation from jurisdiction to jurisdiction, could increase expenses and exposure to legal or regulatory proceedings.

The adoption and rapid growth of new technologies, including generative AI, cryptocurrencies and blockchain and other distributed ledger technologies, have required the Company to invest resources to adapt its systems, products and services, and it expects to continue to make similar investments. In addition, technology has lowered barriers to entry and made it possible for non-banks to offer products and services, such as loans and payment services, that traditionally were banking products, and made it possible for technology companies to compete with

The Company may not be able to anticipate or to implement effective preventive measures against all cyberattacks because malicious actor methods and techniques change frequently, increase in sophistication, often are not recognized until launched, sometimes go undetected even when successful, and originate from a wide variety of sources, including organized crime, hackers, terrorists, activists, hostile foreign governments and other external parties. Those parties may also attempt to fraudulently induce employees, customers or other users of the Company’s systems to disclose sensitive information to gain access to the Company’s data or that of its customers or clients, such as through “phishing” and other social engineering schemes. For example, recent advances in artificial intelligence may allow a bad actor to create so-called “deep fakes” to impersonate the voice or likeness of another individual, which could be used in social engineering schemes that may be more difficult to detect than other social engineering efforts. Other types of attacks may include the introduction of computer viruses and/or

The use of new technologies, including artificial intelligence (“AI”) and machine learning, may result in reputational harm, increased regulatory scrutiny and increased liability The banking industry is subject to rapid and significant technological change. To compete effectively, the Company may use new and evolving

technologies, including AI and machine learning, to help improve its customer service and products and to automate certain business decisions or risk management practices. The Company's use of AI and machine learning is subject to risks that algorithms and datasets are flawed or may be insufficient or contain biased information. In addition, the models and processes relating to AI and machine learning are not always transparent, which could increase the risk of unintended deficiencies. These deficiencies could result in inaccurate or ineffective decisions, predictions or analysis, which could subject the Company to competitive harm, legal liability, increased regulatory scrutiny, reputational harm or other consequences that the Company may not be able to predict, any of which could negatively affect the Company's financial condition and results of operations.

The adoption and rapid growth of new technologies, including generative artificial intelligence, cryptocurrencies and blockchain and other distributed ledger technologies, have required the Company to invest resources to adapt its systems, products and services, and it expects to continue to make similar investments. In addition, technology has lowered barriers to entry and made it possible for non-banks to offer products and services, such as loans and payment services, that traditionally were banking products, and made it possible for technology companies to compete with financial institutions in providing electronic, internet-based, and mobile phone–based financial solutions. Competition with non-banks, including technology companies, to provide financial products and services is intensifying. In particular, the activity of financial technology companies (“fintechs”) has grown significantly over recent years and is expected to continue to grow. Fintechs have and may continue to offer bank or bank-like products. For example, a number of fintechs have applied for bank or industrial loan charters, which, in some cases, have been granted. In addition, other fintechs have partnered with existing banks to allow them to offer deposit products or payment services to their customers. Many of these companies, including the Company’s competitors, have fewer regulatory constraints, and some have lower cost structures, in part due to lack of physical structures. Also, the potential need to adapt to industry changes in information technology systems, on which the Company and financial services industry are highly dependent, could present operational issues and require capital spending. The Company’s ability to compete successfully depends on a number of factors, including, among others, its ability to develop and execute strategic plans and initiatives; developing, maintaining and building long-term customer relationships based on quality service, competitive prices, high ethical standards and safe, sound assets; and industry and general economic trends. A failure to compete effectively could contribute to downward price pressure on the Company’s products or services or a loss of market share.