Company: FITBI
Filing Date: 2025-11-05
Form Type: S-4
Source: 0001193125-25-267273
Chunk: 289

Company: FIFTH THIRD BANCORP
Filing Date: 2025-11-05
Form: S-4
Chunk 289
---
sidiaries conduct business.

(c) Comerica Bank has a Community Reinvestment Act rating of “satisfactory” or better in its most recently completed Community
Reinvestment Act examination.

(d) Since December 31, 2022, Comerica and its Subsidiaries have maintained and implemented written
information privacy and cybersecurity programs that provide for reasonable measures, consistent with accepted industry practices, Privacy Laws and all contracts to the extent such contracts relate to the use or processing of Personal Data, that are
designed to protect the privacy, confidentiality and security of all (i) Personal Data, including against any loss or misuse of, or unauthorized or unlawful access to, such Personal Data and (ii) hardware, Software, systems, servers,
networks, data communications lines, devices, and other information technology and equipment (collectively, “”) owned or used by Comerica or its Subsidiaries, including from any unauthorized access or interference,
disabling codes or instructions, spyware, trojan horses, worms, viruses, or other Software routines that permit or cause unauthorized access to, or disruption, impairment, disablement, or destruction of, any Software, data or other materials
(“”), in each case of the foregoing, including protection against any (x) unauthorized or unlawful operations performed upon Personal Data or IT Assets, or (y) other act or omission that compromises the
security or confidentiality of Personal Data or IT Assets (each of clauses (i) and (ii), a “”). To the knowledge of Comerica, Comerica and its Subsidiaries have not experienced any Security Breach (A) that
would, individually or in the aggregate,

A-19

reasonably be expected to have a Material Adverse Effect on Comerica or (B) in a manner that has resulted or is reasonably likely to result in a duty to notify any Governmental Entity or any
person. To the knowledge of Comerica, there are no data security or other technological vulnerabilities with respect to IT Assets owned or used by Comerica or its Subsidiaries that, individually or in the aggregate, would reasonably be expected to
have a Material Adverse Effect on Comerica. To the knowledge of Comerica, since December 31, 2022, neither Comerica nor any of its Subsidiaries has been the subject of any inquiry or action of any Governmental Entity with respect to any
unauthorized processing of Personal Data or material violation