US Bancorp : March 31, 2023 U.S. Bancorp

Regulatory Capital Pillar 3 Disclosures

Standardized Approach

March 31, 2023

	Table of Contents
Background	3
Overview	...........................................................................................................................................	3
Corporate Governance	3
Internal Capital Adequacy Assessment Process ("ICAAP")	4
Regulatory Capital Adequacy Ratios	5
Table 1	Regulatory Capital Ratios	5
Stress Capital Buffer	5
Table 2	Non-GAAPCapital Ratios	6
Table 3	Supplementary Leverage Ratio	6
Credit Risk Mitigation	7
Counterparty Credit Risk of OTC Derivative Contracts, Repo-Style Transactions and Eligible Margin Loans	7
Securitization	9
Equity Securities Not Subject to Market Risk Rule	10
Market Risk	11
Credit Risk: General Disclosures	11
Forward-LookingStatements	19
Appendix A - Disclosure Matrix……………………………………………………………………………...……. A1

BACKGROUND

Basel III regulatory capital rules established the definition of regulatory capital elements and minimum capital ratios, regulatory capital buffers above those minimums, a common equity tier 1 ratio, a supplementary leverage ratio and the rules for calculating risk-weighted assets. Basel III includes two comprehensive methodologies for calculating risk-weighted assets: 1) a general standardized approach and 2) a more risk-sensitive advanced approaches. Effective December 31, 2019, with the passing of the "Prudential Standards for Large Bank Holding Companies, Savings and Loan Holding Companies, and Foreign Banking Organizations" rule, U.S. Bancorp (the "Company") is classified as a Category III banking organization. Therefore, the Company is only required to utilize the general standardized approach of the regulatory capital requirements.

OVERVIEW

The Company, based in Minneapolis, Minnesota, serves millions of customers locally, nationally and globally through a diversified mix of businesses: Consumer and Business Banking; Payment Services; Corporate & Commercial Banking; and Wealth Management and Investment Services.

This document, and certain of the Company's public filings, present the Pillar 3 Disclosures in compliance with Basel III as described in Subsections 61-63 of the Capital Adequacy-Basel III Final Rule (the "Rule"). The Company's 2022 Annual Report ("Annual Report") included in the Company's Form 10-K for the year ended December 31, 2022 ("Form 10-K") and its Quarterly Report on Form 10-Q for the quarter ended March 31, 2023 ("Form 10-Q") filed with the Securities and Exchange Commission contain management's discussion of the overall corporate risk profile of the Company and related management strategies. The Pillar 3 Disclosures should be read in conjunction with the Annual Report, Form 10-K, Form 10-Q and the Consolidated Financial Statements for Bank Holding Companies - FR Y-9C. The Company's Pillar 3 Disclosures Matrix (see Appendix A) specifies where all the disclosures required by the Rule are located. The Pillar 3 Disclosures have not been audited by the Company's external auditors. The Rule applies only to the consolidated Company, with the exception that subsidiary depository institutions must disclose capital ratios.

CORPORATE GOVERNANCE

Managing risks is an essential part of successfully operating a financial services company. The Company's Board of Directors has approved a risk management framework which establishes governance and risk management requirements for all risk-taking activities. This framework includes Company and business line risk appetite statements which set boundaries for the types and amount of risk that may be undertaken in pursuing business objectives and initiatives. The Board of Directors, primarily through its Risk Management Committee, oversees performance relative to the risk management framework, risk appetite statements, and other policy requirements.

The Executive Risk Committee ("ERC"), which is chaired by the Chief Risk Officer and includes the Chief Executive Officer and other members of the executive management team, oversees execution against the risk management framework and risk appetite statements. The ERC focuses on current and emerging risks, including strategic and reputation risks, by directing timely and comprehensive actions. Senior operating committees have also been established, each responsible for overseeing a specified category of risk.

Upon closing of the MUFG Union Bank, N.A. ("MUB") acquisition, the Company's risk management framework applies to the legal entities acquired from Mitsubishi UFJ Financial Group, Inc., including MUB. Prior to closing, the Company evaluated the frameworks, policies and procedures of the acquired entities as necessary. Updates were made to align the acquired entities with the Company's risk appetite and connect the elements of their respective risk governance and reporting into the Company's existing risk management framework. Connecting the existing MUB risk governance and reporting framework into the Company's existing risk management framework allows separate risk profiles, governance, and reporting for the Company and the acquired entities, during the period from acquisition through bank merger, while also providing the ability to consolidate reporting for the Company. Upon completing the merger of MUB into U.S. Bank National Association, which is expected to occur in connection with the conversion of MUB customers and systems to the U.S. Bank National Association platform over Memorial Day weekend in 2023, the MUB risk governance and reporting framework will no longer be applicable. The Company's most prominent risk exposures are credit, interest rate, market, liquidity, operational, compliance, strategic, and reputation. Credit risk is the risk of loss associated with a change in the credit profile or the failure of a borrower or counterparty to meet its contractual obligations. Interest rate risk is the current or prospective risk to earnings and

3

capital, or market valuations, arising from the impact of changes in interest rates. Market risk arises from fluctuations in interest rates, foreign exchange rates, and security prices that may result in changes in the values of financial instruments, such as trading and available-for-sale securities, mortgage loans held for sale, mortgage servicing rights ("MSRs") and derivatives that are accounted for on a fair value basis. Liquidity risk is the risk that financial condition or overall safety and soundness is adversely affected by the Company's inability, or perceived inability, to meet its cash flow obligations in a timely and complete manner in either normal or stressed conditions. Operational risk is the risk to current or projected financial condition and resilience arising from inadequate or failed internal processes or systems, people (including human errors or misconduct), or adverse external events, including the risk of loss resulting from breaches in data security. Operational risk can also include the risk of loss due to failures by third parties with which the Company does business. Compliance risk is the risk that the Company may suffer legal or regulatory sanctions, financial losses and reputational damage if it fails to adhere to compliance requirements and the Company's compliance policies. Strategic risk is the risk to current or projected financial condition and resilience arising from adverse business decisions, poor implementation of business decisions, or lack of responsiveness to changes in the banking industry and operating environment. Reputation risk is the risk to current or anticipated earnings, capital, or franchise or enterprise value arising from negative public opinion. This risk may impair the Company's competitiveness by affecting its ability to establish new relationships or services or continue serving existing relationships. In addition to the risks identified above, other risk factors exist that may impact the Company. Refer to "Risk Factors" in the Annual Report for a detailed discussion of these factors.

The Company's Board of Directors and management-level governance committees are supported by a "three lines of defense" model for establishing effective checks and balances. The first line of defense, the business lines, manages risks in conformity with established limits and policy requirements. In turn, business line leaders and their risk officers establish programs to ensure conformity with these limits and policy requirements. The second line of defense, which includes the Chief Risk Officer's organization as well as policy and oversight activities of corporate support functions, translates risk appetite and strategy into actionable risk limits and policies. The second line of defense monitors first line of defense conformity with limits and policies and provides reporting and escalation of emerging risks and other concerns to senior management and the Risk Management Committee of the Board of Directors. The third line of defense, internal audit, is responsible for providing the Audit Committee of the Board of Directors and senior management with independent assessment and assurance regarding the effectiveness of the Company's governance, risk management, and control processes.

INTERNAL CAPITAL ADEQUACY ASSESSMENT PROCESS ("ICAAP")

The Company's ICAAP is a component of its Basel Program. The Company manages its capital to multiple minimum thresholds and measures consistent with the Company's strategic objectives, business model and capital plan. Expectations of internal and external stakeholders are integral, and the capital goals and targets are calibrated considering internally developed models that ensure adequate coverage for all material quantitative and qualitative risks, minimum regulatory requirements, supervisory stress testing expectations and rating agency and counterparty perspectives.

The Company is committed to managing capital to maintain strong protection for depositors and creditors, and for maximum shareholder benefit in order to achieve the Company's broader goals, which are as follows:

• Ensure the Company's safety and soundness;
• Maintain access to the debt and capital markets so the Company may continue to provide exceptional service to its customers and fulfill, without interruption, its obligations as a credit intermediary;
• Serve as a source of managerial and financial strength to its subsidiaries; and
• Ensure that the Company continues to be in a position to conduct its business in an environment of economic or financial stress.

The Company's ICAAP, the identification of material risks and how those material risks inform capital adequacy, is conducted via the Company's stress testing program. During this process, the Company's material risks, informed by the risk identification process, are critical to the scenario design process and the development of the Company's internal stress scenario. The results of these forward-looking scenarios inform the Company's regulatory and internally defined capital adequacy relative to the Company's risk profile and risk appetite.

4

REGULATORY CAPITAL ADEQUACY RATIOS

The Company also manages its capital to exceed regulatory capital requirements for well-capitalized financial institutions. The Company's applicable capital requirement for regulatory and supervisory purposes is based upon the ratios determined under the standardized approach.

Banking regulators define capital requirements for banks and financial services holding companies expressed in the form of a common equity tier 1 capital ratio, a tier 1 capital ratio, a total risk-based capital ratio, a leverage ratio and for advanced approaches banks and Category III banks, a supplementary leverage ratio. The current minimum required levels for these ratios are 4.5 percent, 6.0 percent, 8.0 percent, 4.0 percent, and 3.0 percent, respectively, while the requirements for an insured depository institution to be considered "well-capitalized" are 6.5 percent, 8.0 percent, 10.0 percent, 5.0 percent, and 3.0 percent, respectively. Using the standardized approach rule the Company's common equity tier 1 ratio was 8.5 percent at March 31, 2023.

A summary of the capital ratios under the standardized approach is shown in Table 1.

Table 1 Regulatory Capital Ratios

	U.S. Bancorp		U.S. Bank National Association		MUFG Union Bank National Association
(Dollars in Millions)	March 31, 2023		December 31, 2022		March 31, 2023		December 31, 2022		March 31, 2023		December 31, 2022
Common Equity Tier 1 capital	$42,027		$41,560		$46,806		$46,681		$11,185		$10,888
Tier 1 capital	49,278		48,813		47,250		47,127		11,185		10,888
Total risk-based capital	59,920		59,015		57,274		56,736		11,889		11,565
Common Equity Tier 1 capital as a percent of risk-weighted assets	8.5	%	8.4	%	10.8	%	10.7	%	19.8	%	18.6	%
Tier 1 capital as a percent of risk-weighted assets	10.0	%	9.8	%	10.9	%	10.8	%	19.8	%	18.6	%
Tier 1 risk-based capital as a percent of adjusted quarterly
average assets (leverage ratio)	7.5	%	7.9	%	8.2 %	8.1 %	11.6 %	10.9 %
Tier 1 risk-based capital as a percent of total on and off balance sheet
average exposures (supplementary leverage ratio)	6.1	%	6.4	%	6.6	%	6.5	%	10.8	%	10.1	%
Total risk-based capital as a percent of risk-weighted assets	12.1	%	11.9	%	13.2	%	13.0	%	21.0	%	19.7	%
Risk-Weighted Assets	$494,048		$496,500		$435,163		$436,764		$56,566		$58,641

The Company's total shareholders' equity was $53.0 billion at March 31, 2023, compared with $50.8 billion at December 31, 2022.The increase was primarily the result of corporate earnings and changes in unrealized gains and losses on available-for-sale investment securities included in other comprehensive income (loss), partially offset by dividends paid. In compliance with the Rule, the Company reviewed the aggregate amount of surplus capital of insurance subsidiaries included in the regulatory capital of the consolidated group and has determined it was not material. Refer to "Management's Discussion and Analysis-Capital Management" in the Annual Report and Form 10-Q for further discussion on capital management.

In addition to capital ratios defined by banking regulators, the Company considers various other measures when evaluating capital utilization and adequacy. These measures are viewed by management as additional useful methods to reflect the level of capital available to withstand unexpected market or economic conditions. Presentation of these measures allows investors, analysts, and banking regulators to assess the Company's capital position relative to other financial services companies. Certain of these measures differ from the currently effective capital ratios principally in that these ratios are subject to transitional provisions, which temporarily exclude a portion of the impact of the 2020 adoption of accounting guidance related to the impairment of financial instruments based on the Current Expected Credit Loss ("CECL") methodology. These measures are not defined in generally accepted accounting principles ("GAAP") or are not currently effective or defined in federal banking regulations. As a result, these measures disclosed by the Company may be considered non-GAAP financial measures.

Stress Capital Buffer

Effective October 1, 2020, the Federal Reserve Board ("FRB") introduced a new Stress Capital Buffer ("SCB") which replaced the capital conservation buffer. The SCB is calculated based on 1) a decrease in the Company's Common Equity Tier 1 Capital under the severely adverse scenario in the FRB's annual supervisory stress test and related Comprehensive Capital Analysis and Review ("CCAR"), plus 2) four quarters of planned common stock dividends as a percentage of risk-weighted assets subject to a floor of 2.5 percent. A company's SCB is added to the minimum capital requirement noted above for the risk-based capital ratios and represents the level of capital where restrictions on distributions and discretionary bonuses begin. The Company is currently subject to an SCB requirement of 2.5 percent based on its 2022 stress results.

The FRB, OCC and FDIC also adopted a final rule revising the definition of "eligible retained income" for purposes of the SCB and other capital buffer requirements. This revision reduces the likelihood a banking organization is suddenly subject to abrupt and restrictive distribution limitations in a scenario where the Company's ratios fall

5