U.S. Bancorp 10-K 2023-12-31

UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

WASHINGTON, D.C. 20549

Form 10-K

For the fiscal year ended December 31, 2023

or

For the transition period from (not applicable)

Commission file number: 1-6880

U.S. Bancorp

(Exact name of registrant as specified in its charter)

800 Nicollet Mall, Minneapolis, Minnesota 55402

(Address of principal executive offices) (Zip Code)

(651) 466-3000

(Registrant’s telephone number, including area code)

Securities registered pursuant to Section 12(b) of the Act:

Securities registered pursuant to Section 12(g) of the Act:

None

Indicate by check mark if the registrant is a well-known seasoned issuer, as defined in Rule 405 of the Securities Act. Yes ☑ No ☐

Indicate by check mark if the registrant is not required to file reports pursuant to Section 13 or Section 15(d) of the Act. Yes ☐ No ☑

Indicate by check mark whether the registrant (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days. Yes ☑ No ☐

Indicate by check mark whether the registrant has submitted electronically every Interactive Data File required to be submitted pursuant to Rule 405 of Regulation S-T during the preceding 12 months (or for such shorter period that the registrant was required to submit such files). Yes ☑ No ☐

Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, a smaller reporting company, or an emerging growth company. See the definitions of “large accelerated filer,” “accelerated filer,” “smaller reporting company,” and “emerging growth company” in Rule 12b-2 of the Exchange Act.

Large accelerated filer ☑ Accelerated filer ☐

Non-accelerated filer ☐ Smaller reporting company ☐

Emerging growth company ☐

If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act. ☐

Indicate by check mark whether the registrant has filed a report on and attestation to its management’s assessment of the effectiveness of its internal control over financial reporting under Section 404(b) of the Sarbanes-Oxley Act (15 U.S.C. 7262(b)) by the registered public accounting firm that prepared or issued its audit report. ☑

If securities are registered pursuant to Section 12(b) of the Act, indicate by check mark whether the financial statements of the registrant included in the filing reflect the correction of an error to previously issued financial statements. ☑

Indicate by check mark whether any of those error corrections are restatements that required a recovery analysis of incentive-based compensation received by any of the registrant’s executive officers during the relevant recovery period pursuant to §240.10D-1(b). ☐

Indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Act). Yes ☐ No ☑

As of June 30, 2023, the aggregate market value of the registrant’s common stock held by non-affiliates of the registrant was $50.6 billion based on the closing sale price as reported on the New York Stock Exchange.

Indicate the number of shares outstanding of each of the registrant’s classes of common stock, as of the latest practicable date.

Auditor Firm Id: 42 Auditor Name: Ernst & Young LLP Auditor Location: Minneapolis, Minnesota

DOCUMENTS INCORPORATED BY REFERENCE

PART I

Forward-Looking Statements

THE FOLLOWING INFORMATION APPEARS IN ACCORDANCE WITH THE PRIVATE SECURITIES LITIGATION REFORM ACT OF 1995: This report contains forward-looking statements about U.S. Bancorp (“U.S. Bancorp” or the “Company”). Statements that are not historical or current facts, including statements about beliefs and expectations, are forward-looking statements and are based on the information available to, and assumptions and estimates made by, management as of the date hereof. These forward-looking statements cover, among other things, future economic conditions and the anticipated future revenue, expenses, financial condition, asset quality, capital and liquidity levels, plans, prospects and operations of U.S. Bancorp. Forward-looking statements often use words such as “anticipates,” “targets,” “expects,” “hopes,” “estimates,” “projects,” “forecasts,” “intends,” “plans,” “goals,” “believes,” “continue” and other similar expressions or future or conditional verbs such as “will,” “may,” “might,” “should,” “would” and “could.”

Forward-looking statements involve inherent risks and uncertainties that could cause actual results to differ materially from those set forth in forward-looking statements, including the following risks and uncertainties:

• Deterioration in general business and economic conditions or turbulence in domestic or global financial markets, which could adversely affect U.S. Bancorp’s revenues and the values of its assets and liabilities, reduce the availability of funding to certain financial institutions, lead to a tightening of credit, and increase stock price volatility;

• Turmoil and volatility in the financial services industry, including failures or rumors of failures of other depository institutions, which could affect the ability of depository institutions, including U.S. Bank National Association ("USBNA"), to attract and retain depositors, and could affect the ability of financial services providers, including U.S. Bancorp, to borrow or raise capital;

• Actions taken by governmental agencies to stabilize the financial system and the effectiveness of such actions;

• Changes to regulatory capital, liquidity and resolution-related requirements applicable to large banking organizations in response to recent developments affecting the banking sector;

• Changes to statutes, regulations, or regulatory policies or practices, including capital and liquidity requirements, and the enforcement and interpretation of such laws and regulations, and U.S. Bancorp’s ability to address or satisfy those requirements and other requirements or conditions imposed by regulatory entities;

• Changes in interest rates;

• Increases in unemployment rates;

• Deterioration in the credit quality of U.S. Bancorp's loan portfolios or in the value of the collateral securing those loans;

• Risks related to originating and selling mortgages, including repurchase and indemnity demands, and related to U.S. Bancorp’s role as a loan servicer;

• Impacts of current, pending or future litigation and governmental proceedings;

• Increased competition from both banks and non-banks;

• Effects of climate change and related physical and transition risks;

• Changes in customer behavior and preferences and the ability to implement technological changes to respond to customer needs and meet competitive demands;

• Breaches in data security;

• Failures or disruptions in or breaches of U.S. Bancorp’s operational, technology or security systems or infrastructure, or those of third parties;

• Failures to safeguard personal information;

• Impacts of pandemics, natural disasters, terrorist activities, civil unrest, international hostilities and geopolitical events;

• Impacts of supply chain disruptions, rising inflation, slower growth or a recession;

• Failure to execute on strategic or operational plans;

• Effects of mergers and acquisitions and related integration;

• Effects of critical accounting policies and judgments;

• Effects of changes in or interpretations of tax laws and regulations;

• Management’s ability to effectively manage credit risk, market risk, operational risk, compliance risk, strategic risk, interest rate risk, liquidity risk and reputation risk; and

• The risks and uncertainties more fully discussed in the section entitled “Risk Factors” of the 2023 Annual Report.

In addition, U.S. Bancorp’s acquisition of MUFG Union Bank, N.A. (“MUB”) presents risks and uncertainties, including, among others: the risk that any revenue synergies and other anticipated benefits of the acquisition may not be realized or may take longer than anticipated to be realized.

In addition, factors other than these risks also could adversely affect U.S. Bancorp’s results, and the reader should not consider these risks to be a complete set of all potential risks or uncertainties. Readers are cautioned not to place undue reliance on any forward-looking statements. Forward-looking statements speak only as of the date hereof, and U.S. Bancorp undertakes no obligation to update them in light of new information or future events.

General Business Description

U.S. Bancorp is a financial services holding company headquartered in Minneapolis, Minnesota, serving millions of local, national and global customers. U.S. Bancorp is registered as a bank holding company under the Bank Holding Company Act of 1956 (the “BHC Act”), and has elected to be treated as a financial holding company under the BHC Act. The Company provides a full range of financial services, including lending and depository services, cash management, capital markets, and trust and investment management services. It also engages in credit card services, merchant and ATM processing, mortgage banking, insurance, brokerage and leasing.

U.S. Bancorp’s banking subsidiary, USBNA, is engaged in the general banking business, principally in domestic markets, and holds all of the Company’s consolidated deposits of $512.3 billion at December 31, 2023. USBNA provides a wide range of products and services to individuals, businesses, institutional organizations, governmental entities and other financial institutions. Commercial and consumer lending services are principally offered to customers within the Company’s domestic markets, to domestic customers with foreign operations and to large national customers operating in specific industries targeted by the Company, such as healthcare, utilities, oil and gas, and state and municipal government. Lending services include traditional credit products as well as credit card services, lease financing and import/export trade, asset-backed lending, agricultural finance and other products. Depository services include checking accounts, savings accounts and time certificate contracts. Ancillary services such as capital markets, treasury management and receivable lock-box collection are provided to corporate and governmental entity customers. U.S. Bancorp’s bank and trust subsidiaries provide a full range of asset management and fiduciary services for individuals, estates, foundations, business corporations and charitable organizations.

Other U.S. Bancorp non-banking subsidiaries offer investment and insurance products to the Company’s customers principally within its domestic markets, and fund administration services to a broad range of mutual and other funds.

Banking and investment services are provided through a network of 2,274 banking offices across 26 states as of December 31, 2023, principally operating in the Midwest and West regions of the United States. A significant percentage of consumer transactions are completed using USBNA's digital banking services, both online and through its digital app. The Company operates a network of 4,524 ATMs as of December 31, 2023, and provides 24-hour, seven day a week telephone customer service. Mortgage banking services are provided through banking offices and loan production offices throughout the Company’s domesti

Showing the first 8K of 88K characters. Open the full section

Information in response to this Item 1A can be found in the 2023 Annual Report on pages 140 to 155 under the heading “Risk Factors.” That information is incorporated into this report by reference.

None.

The Company is committed to managing risks that may impact the Company and incorporating risk considerations into its business activities at all levels, including strategic planning, risk identification inventory and assessment, and day-to-day business decisions. The Company’s Board of Directors has approved a risk management framework that establishes governance and risk management requirements for all the Company’s key risk areas and risk-taking activities. The Board oversees management’s performance relative to the risk management framework and risk appetite. Management is responsible for defining the various risks facing the Company, formulating risk management policies and procedures, and managing risk exposures on a day-to-day basis. The Company’s Executive Risk Committee (ERC), which is chaired by the Chief Risk Officer, oversees execution of the risk management framework. The ERC is supported by management’s senior operating committees, each responsible for a specified risk category. The Company’s Information Security Risk Committee

(ISRC), which is co-chaired by the Chief Information Security Officer (CISO) and the Chief Technology Risk Officer, is a senior operating committee under this risk governance structure and is responsible for the management of information security risk at the Company. The ISRC provides direction and oversight of the information security risk management framework and corporate control programs of the Company, including significant information security risk events, and mitigation strategies. Further, the ISRC facilitates communication across business lines to provide for effective and consistent information security risk identification and control infrastructure to mitigate and manage material information security risks. The ISRC serves as an escalation, decision making, and approval body for information security risk items, including key policies and programs, issue resolution, emerging risks, and key program adherence. The ISRC escalates matters as appropriate to executive management, the ERC, which reports to the Board’s Risk Management Committee, or a relevant committee of the Board. Generally, each of the ERC and ISRC meet at least monthly.

As part of the Company’s risk management framework, risk management programs and processes are in place to incorporate risk considerations into day-to-day business activities across the Company’s risk categories, business lines, and functions. Risk programs may manage all or certain components of a particular risk type. The Company’s cybersecurity risk program provides centralized planning and management of related and interdependent work with a focus on risks from cybersecurity threats. The Company’s cybersecurity risk program is integrated into the Company’s overall business and operational strategies and requires that the Company allocate appropriate resources to maintain the program.

The Company’s processes for assessing, identifying, and managing material risks from cybersecurity threats is integrated into the Company’s overall risk governance and oversight structures through its “three lines of defense” model for establishing effective checks and balances within the risk management framework. In this model, specific to cybersecurity threats, the first line of defense is Information Security Services (ISS), which is responsible for identifying and implementing cybersecurity controls in accordance with policy requirements and industry best practices, to meet regulatory requirements and to safeguard the business. The second line of defense, Cybersecurity Risk Oversight within the Company's Operational Risk Management group, provides reporting and escalation of emerging risks related to cybersecurity and other concerns to senior management, the ERC, the ISRC, other designated senior operating committees, and the Risk Management Committee of the Board of Directors. The third line of defense, the Company’s internal audit function, provides independent assessment and assurance regarding the effectiveness of the Company’s governance, risk management, and control processes with respect to cybersecurity threats, and provides challenge and recommendations for improvement.

The Company uses reporting and metrics frameworks and regular internal and external oversight to assess the health of the cybersecurity risk program. At the first level, the ISS team identifies, assesses, and manages cybersecurity risk and threats. The Company manages cybersecurity issues and findings through remediation and/or closure, with escalation processes if an issue or finding cannot be remediated within required timeframes. The Company engages external assessors, consultants, and auditors to review the Company’s cybersecurity risk program against those of industry peers. The Company also uses consultants periodically to provide recommendations to improve and enhance the program. Additionally, the Company continually works to align its policies and practices with industry-accepted information security practices as provided by the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF), Payment Card Industry Data Security Standards (PCI DSS), and other applicable standards, laws, and regulations.

The Company also maintains a third-party risk management program responsible for the oversight of outsourced operations, which enables the Company to oversee and identify risks related to engaging third-party service providers, including risks from cybersecurity threats to third-party service providers. The Company conducts due diligence using a risk-based approach in selecting and monitoring third-party service providers. The Company also obtains contractual assurances from third-party service providers relating to their security responsibilities, controls, reporting, and roles and responsibilities as it pertains to cybersecurity incident response policies and notification requirements. As appropriate, the Company obtains independent reviews of the third parties’ security through audit reports and testing and conducts verification and validation with third parties to confirm cybersecurity and information security risks are appropriately identified, measured, mitigated, monitored, and reported by the third party to the Company.

As part of its responsibility to oversee the management, business, and strategy of the Company, the Company’s Board of Directors reviews and approves the Company’s risk management framework annually through its Risk Management Committee and oversees the Company’s risk management processes by informing itself about the Company’s key risks and evaluating whether management has reasonable risk management and control processes in place to address those risks. The Board carries out its risk management oversight responsibilities primarily through its committees. Each Board committee is responsible for overseeing certain risks under its charter. The Board’s Risk Management Committee, with support from its Cybersecurity and Technology Subcommittee, has primary oversight responsibility for cybersecurity risk, including risks from any cybersecurity threats. The Risk Management Committee monitors the Company’s compliance with the risk management framework and risk limits established under the Company’s risk appetite statement approved by the Board. The Risk Management Committee also oversees the Company’s independent risk management function. The Board’s Risk Management Committee has a Cybersecurity and Technology Subcommittee that provides dedicated oversight to

cybersecurity risk management and cyber resiliency and certain technology matters. The Risk Management Committee and its Cybersecurity and Technology Subcommittee receive quarterly reports from management on cybersecurity issues, including cybersecurity threats. The Board’s Risk Management Committee and Audit Committee also hold a joint meeting annually at which they receive a report from the Company’s CISO on cybersecurity threats facing the Company and its preparedness to meet and respond to those threats. In addition, the full Board typically holds an annual cybersecurity education session, which features the perspective of an outside expert on current cybersecurity topics. The Company also typically conducts an annual executive-level cybersecurity exercise to test its cyber incident response, completeness of playbooks, and communication protocols. This exercise involves Board members, managing committee members, third-party companies, and regulators as appropriate.

The Company’s risk management framework includes its risk appetite statement, which is approved annually by the Board’s Risk Management Committee and defines acceptable levels of risk-taking and risk limits and establishes the governance and oversight activities over risk management and reporting. Management monitors and measures the Company’s risk appetite using a quantitative risk scorecard, which consists of risk appetite metrics and associated limits reported to the Board’s Risk Management Committee on a quarterly basis. The Company’s risk appetite statement includes specific information security metrics and associated limits. These limits also inform how matters, including cybersecurity incidents or threats, are escalated to specific members of management, appropriate senior operating committee (including the ISRC and/or ERC), and/or the Board of Directors or appropriate Board committee. The Board’s Risk Management Committee oversees the Company’s risk profile relative to its risk appetite and compliance with risk limits.

The members of the Company’s management that are primarily responsible for assessing and managing risks from cybersecurity threats, including monitoring risk appetite metrics and limits related to cybersecurity, include the Company’s CISO, Chief Risk Officer, and Chief Information and Technology Officer.

The Company’s CISO is primarily responsible for the implementation of defense capabilities and risk mitigation strategies. The Company’s CISO, Timothy J. Held, has over 26 years of information technology and cybersecurity experience. He holds the title of Executive Vice President and Chief Information Security Officer and has been in his role since 2018, having served as the Company’s Deputy CISO from 2015 to 2018 and Head of Cyber Defense, Threat Intelligence, and Incident Response from 2012 to 2018. The CISO is supported by his direct reports and their teams, many of whom hold cybersecurity-related certifications.

The Company’s CISO reports to the Vice Chair and Chief Risk Officer, Jodi L. Richard, who has served in that position since October 2018. She served as Executive Vice President and Chief Operational Risk Officer of the Company from January 2018 until October 2018, having served as Senior Vice President and Chief Operational Risk Officer from 2014 until January 2018. Prior to that time, Ms. Richard held various senior leadership roles at HSBC from 2003 until 2014, including Executive Vice President and Head of Operational Risk and Internal Control at HSBC North America from 2008 to 2014.

Venkatachari Dilip, the Company’s Senior Executive Vice President and Chief Information and Technology Officer, has oversight of technology-related risk management issues and controls that align to the NIST CSF. Mr. Dilip previously was an Executive Vice President from September 2018 to April 2023 and has served as Chief Information and Technology Officer since joining the Company in September 2018. From May 2014 until July 2017, he served as Vice President at McKinsey Digital where he helped banks accelerate their digital transformation. From April 2009 to September 2013, he served as CEO at Compass Labs leading an innovative marketing analytics company. From March 2006 until April 2008, he served as Director of Products at Google where he led product teams for mobile ads and Google Checkout. From March 2004 until March 2006, he served as Vice President of PayPal/eBay and on the Board of PayPal Europe, where he was responsible for Payments Services, Risk and Fraud Management. Previously, Mr. Dilip co-founded and led startup companies CashEdge and CommerceSoft from 1996 until 2003.

The CISO and his leadership team generally meet each business day to discuss security item triage and emerging threats and trends identified by the Threat Intelligence Team. The CISO shares pertinent information from those meetings with the Chief Risk Officer. During a cyber incident, which could involve the Company or a third-party service provider to the Company, the Company’s Cyber Security Incident Response Team (CSIRT) leads the response and internal communication. CSIRT manages low and moderate severity incidents, and Enterprise Crisis Management manages high and very high severity incidents. The risk rating of an incident may change throughout the incident investigation period as new information is learned or the environment changes. Depending on severity level, CSIRT or Enterprise Crisis Management distributes incident communications to senior management, including the Chief Executive Officer, Chief Risk Officer, Board of Directors or appropriate Board committee, and if applicable, the Company’s regulators.

ISS leadership reports prevention, detection, mitigation, and remediation activities through various working groups and committees. Certain working groups meet with the CISO monthly to review completed risk assessments, and items that require escalation are reported up using the internal committee structure and ad hoc communications if time sensitive.

Additionally, working group and committee meetings report up issues to Operational Risk Management, which may decide to open a formal Risk Management Issue (RMI) based on the severity of the issue or other factors and which are subject to specific governance processes. All security-related RMI remediation activities are reviewed with the Chief Risk Officer and Chief Information and Technology Officer on a bi-weekly basis.

During the fiscal year ended December 31, 2023, the Company has not identified any specific risks from cybersecurity threats that have materially affected, or are reasonably likely to affect, the Company’s business strategy, results of operations, or financial condition, other than the risks described under “Risk Factors – Operations and Business Risk” in the 2023 Annual Report.

U.S. Bancorp and its significant subsidiaries occupy headquarter offices under a long-term lease in Minneapolis, Minnesota. The Company also leases 5 freestanding operations centers in Kansas City, Little Rock, Atlanta, Minneapolis and Chicago. The Company owns 8 principal operations centers in Cincinnati, Fargo, Knoxville, Oshkosh, Olathe, Owensboro, Portland and St. Paul. At December 31, 2023, the Company’s subsidiaries owned and operated a total of 1,219 facilities and leased an additional 1,576 facilities. The Company believes its current facilities are adequate to meet its needs. Additional information with respect to the Company’s premises and equipment is presented in Note 9 of the Notes to Consolidated Financial Statements included in the 2023 Annual Report. That information is incorporated into this report by reference.

Information in response to this Item 3 can be found in Note 23 of the Notes to Consolidated Financial Statements included in the 2023 Annual Report under the heading, “Litigation and Regulatory Matters.” That information is incorporated into this report by reference.

Not Applicable.

PART II

The Company announced on December 22, 2020 that its Board of Directors had approved an authorization to repurchase $3.0 billion of its common stock beginning January 1, 2021. The Company suspended all common stock repurchases at the beginning of the third quarter of 2021, except for those done exclusively in connection with its stock-based compensation programs, due to its acquisition of MUB. The Company will evaluate its share repurchases in connection with the potential capital requirements given the proposed regulatory capital rules and related landscape. Capital distributions, including dividends and stock repurchases, are subject to the approval of the Company’s Board of Directors and compliance with regulatory requirements. The following table provides a detailed analysis of all shares of common stock of the Company purchased by the Company or any affiliated purchaser during the fourth quarter of 2023:

*(a)*Includes 260,000 shares of common stock purchased, at an average price per share of $36.34, in open-market transactions by USBNA, the Company’s banking subsidiary, in its capacity as trustee of the U.S. Bank 401(k) Savings Plan, which is the Company’s employee retirement savings plan.

Additional Information

Additional information in response to this Item 5 can be found in the 2023 Annual Report on page 139 under the heading “U.S. Bancorp Supplemental Financial Data (Unaudited).” That information is incorporated into this report by reference.

Information in response to this Item 7 can be found in the 2023 Annual Report on pages 22 to 58 under the heading “Management’s Discussion and Analysis.” That information is incorporated into this report by reference.

Information in response to this Item 7A can be found in the 2023 Annual Report on pages 35 to 55 under the heading “Corporate Risk Profile.” That information is incorporated into this report by reference.

Information in response to this Item 8 can be found in the 2023 Annual Report on pages 64 to 139 under the headings “Report of Management,” “Report of Independent Registered Public Accounting Firm,” “Report of Independent Registered Public Accounting Firm,” “U.S. Bancorp Consolidated Balance Sheet,” “U.S. Bancorp Consolidated Statement of Income,” “U.S. Bancorp Consolidated Statement of Comprehensive Income,” “U.S. Bancorp Consolidated Statement of Shareholders’ Equity,” “U.S. Bancorp Consolidated Statement of Cash Flows,” “Notes to Consolidated Financial Statements,” “U.S. Bancorp Consolidated Daily Average Balance Sheet and Related Yields and Rates (Unaudited)” and “U.S. Bancorp Supplemental Financial Data (Unaudited).” That information is incorporated into this report by reference.

The consolidated financial statements included in the 2023 Annual Report reflect a correction of a transposition error of the previously reported December 31, 2022 carrying amount of loans in Note 22. The correct amount was reflected in the Consolidated Balance Sheet and other disclosures of the carrying amount of loans in the Company's previously reported consolidated financial statements as of and for the year ended December 31, 2022. The correction in Note 22 had no other impact on the consolidated financial statements.

None.

Information in response to this Item 9A can be found in the 2023 Annual Report on page 63 under the heading “Controls and Procedures” and on pages 64 and 65 under the headings “Report of Management” and “Report of Independent Registered Public Accounting Firm.” That information is incorporated into this report by reference.

None.

Not Applicable.

PART III

Code of Ethics and Business Conduct

The Company has adopted a Code of Ethics and Business Conduct that applies to its principal executive officer, principal financial officer and principal accounting officer. The Company’s Code of Ethics and Business Conduct can be found at www.usbank.com by clicking on “About us” and then clicking on “Investor relations” and then clicking on “Corporate Governance” and then clicking on “Governance documents” and then clicking on “Code of Ethics” and then clicking on “Code of Ethics and Business Conduct.” The Company intends to satisfy the disclosure requirements under Item 5.05 of Form 8-K regarding amendments to, or waivers from, certain provisions of the Code of Ethics and Business Conduct that apply to its principal executive officer, principal financial officer and principal accounting officer by posting such information on its website, at the address and location specified above.

Information About the Company’s Managing Committee****1

Andrew Cecere

Mr. Cecere is Chairman, President and Chief Executive Officer of U.S. Bancorp. Mr. Cecere, 63, has served as President of U.S. Bancorp since January 2016, Chief Executive Officer since April 2017 and Chairman since April 2018. He also served as Vice Chairman and Chief Operating Officer from January 2015 to January 2016 and was U.S. Bancorp’s Vice Chairman and Chief Financial Officer from February 2007 until January 2015. Until that time, he served as Vice Chairman, Wealth Management and Investment Services, of U.S. Bancorp since the merger of Firstar Corporation and U.S. Bancorp in February 2001. Previously, he had served as an executive officer of the former U.S. Bancorp, including as Chief Financial Officer from 2000 through 2001.

Souheil S. Badran

Mr. Badran is Senior Executive Vice President and Chief Operations Officer of U.S. Bancorp. Mr. Badran, 59, has served in this position since joining U.S. Bancorp in December 2022. From January 2019 until November 2022, he served as Executive Vice President and Chief Operating Officer at Northwestern Mutual, having also served as Chief Innovation Officer from January 2019 until September 2019. Previously Mr. Badran served as President of Alibaba’s Alipay business in the Americas from August 2016 until August 2018. From 2015 to 2016, Mr. Badran served as CEO at Edo Interactive, and from 2011 to 2015, he served as Senior Vice President and General Manager at Digital River.

Elcio R.T. Barcelos

Mr. Barcelos is Senior Executive Vice President and Chief Human Resources Officer of U.S. Bancorp. Mr. Barcelos, 53, has served in this position since joining U.S. Bancorp in September 2020. From April 2018 until August 2020, he served as Senior Vice President and Chief People and Places Officer of the Federal National Mortgage Association (Fannie Mae), having served as Senior Vice President, Human Resources of the DXC Technology Company from April 2017 to March 2018. Previously, Mr. Barcelos served as Senior Vice President and Head of Human Resources for the Enterprise Services business of Hewlett Packard Enterprise Company from June 2015 to April 2017, and in other human resources senior leadership positions at Hewlett-Packard Company and Hewlett Packard Enterprise Company from July 2009 to June 2015. He previously served in various leadership roles at Wells Fargo and Bank of America.

James L. Chosy

Mr. Chosy is Senior Executive Vice President and General Counsel of U.S. Bancorp. Mr. Chosy, 60, has served in this position since March 2013. He also served as Corporate Secretary of U.S. Bancorp from June 2022 until December 2023 and from March 2013 until April 2016. From 2001 to 2013, he served as the General Counsel and Secretary of Piper Jaffray Companies. From 1995 to 2001, Mr. Chosy was Vice President and Associate General Counsel of U.S. Bancorp, having also served as Assistant Secretary of U.S. Bancorp from 1995 through 2000 and as Secretary from 2000 until 2001.

Gregory G. Cunningham

Mr. Cunningham is Senior Executive Vice President and Chief Diversity Officer of U.S. Bancorp. Mr. Cunningham, 60, has served in this position since July 2020. From July 2019 until July 2020, he served as Senior Vice President and Chief Diversity Officer of U.S. Bancorp, having served as Vice President of Customer Engagement of U.S. Bancorp from October

1 This section includes the biographies of the members of the Managing Committee of U.S. Bancorp. Each member of the Managing Committee, except for Gregory G. Cunningham, Revathi N. Dominski, Stephen L. Philipson and Dominic V. Venturo, is deemed to be an executive officer of U.S. Bancorp.

2015, when he joined U.S. Bancorp, until July 2019. Previously, Mr. Cunningham served in various roles in the marketing department of Target Corporation from January 1998 until March 2015.

Venkatachari Dilip

Mr. Dilip is Senior Executive Vice President and Chief Information and Technology Officer of U.S. Bancorp. Mr. Dilip, 64, previously was an Executive Vice President from September 2018 to April 2023 and has served as Chief Information and Technology Officer since September 2018, when he joined U.S. Bancorp. From May 2014 until July 2017, he served as Vice President at McKinsey Digital where he helped banks accelerate their digital transformation. From April 2009 to September 2013, he served as CEO at Compass Labs leading an innovative marketing analytics company. From March 2006 until April 2008, he served as Director of Products at Google where he led product teams for mobile ads and Google Checkout. From March 2004 until March 2006, he served as Vice President of PayPal/eBay and on the Board of PayPal Europe, where he was responsible for Payments Services, Risk and Fraud Management. Previously, Mr. Dilip co-founded and led startup companies CashEdge and CommerceSoft from 1996 until 2003.

Terrance R. Dolan

Mr. Dolan is Vice Chair and Chief Administration Officer of U.S. Bancorp. Mr. Dolan, 62, has served in this position since September 2023. From August 2016 to August 2023, he served as Vice Chair and Chief Financial Officer of U.S. Bancorp. From July 2010 to July 2016, he served as Vice Chair, Wealth Management and Investment Services, of U.S. Bancorp. From September 1998 to July 2010, Mr. Dolan served as U.S. Bancorp’s Controller. He additionally held the title of Executive Vice President from January 2002 until June 2010 and Senior Vice President from September 1998 until January 2002.

Revathi N. Dominski

Ms. Dominski is Senior Executive Vice President and Chief Social Responsibility Officer of U.S. Bancorp and President of the U.S. Bank Foundation. Ms. Dominski, 53, has served as Senior Executive Vice President and Chief Social Responsibility Officer since April 2023. She joined U.S. Bancorp in June 2015 as President of the U.S. Bank Foundation and Senior Vice President of Corporate Social Responsibility. Before joining U.S. Bancorp, Ms. Dominski spent 21 years with Target Corporation in leadership positions including sourcing, merchandising, merchandise planning and operations before moving to Target's Corporate Social Responsibility team, where she served as Senior Director of Education and Community Relations.

Gunjan Kedia

Ms. Kedia is Vice Chair, Wealth, Corporate, Commercial and Institutional Banking, of U.S. Bancorp. Ms. Kedia, 53, has served in this position since June 2023. From December 2016 to June 2023, she served as Vice Chair, Wealth Management and Investment Services, of U.S. Bancorp. From October 2008 until May 2016, she served as Executive Vice President of State Street Corporation where she led the core investment servicing business in North and South America and served as a member of State Street’s management committee, its senior most strategy and policy committee. Previously, Ms. Kedia was an Executive Vice President of global product management at Bank of New York Mellon from 2004 to 2008 and a Partner and associate at McKinsey from 1996 to 2004.

Shailesh M. Kotwal

Mr. Kotwal is Vice Chair, Payment Services, of U.S. Bancorp. Mr. Kotwal, 59, has served in this position since joining U.S. Bancorp in March 2015. From July 2008 until May 2014, he served as Executive Vice President of TD Bank Group with responsibility for retail banking products and services and as Chair of its enterprise payments council. From 2006 until 2008, he served as President, International, of eFunds Corporation. Previously, Mr. Kotwal served in various leadership roles at American Express Company from 1989 until 2006, including responsibility for operations in North and South America, Europe and the Asia-Pacific regions.

Stephen L. Philipson

Mr. Philipson is Senior Executive Vice President and Head of Global Markets and Specialized Finance of U.S. Bancorp. Mr. Philipson, 45, has served in this position since April 2023. From October 2017 to April 2023, he served as head of Fixed Income and Capital Markets. Previously, he led Credit & Municipal Fixed Income at U.S. Bank and, prior to that, held roles in fixed income and capital markets at Wachovia/Wells Fargo Securities and Morgan Stanley.

Jodi L. Richard

Ms. Richard is Vice Chair and Chief Risk Officer of U.S. Bancorp. Ms. Richard, 55, has served in this position since October 2018. She served as Executive Vice President and Chief Operational Risk Officer of U.S. Bancorp from January

2018 until October 2018, having served as Senior Vice President and Chief Operational Risk Officer from 2014 until January 2018. Prior to that time, Ms. Richard held various senior leadership roles at HSBC from 2003 until 2014, including Executive Vice President and Head of Operational Risk and Internal Control at HSBC North America from 2008 to 2014. Ms. Richard started her career at the Office of the Comptroller of the Currency in 1990 as a national bank examiner.

Mark G. Runkel

Mr. Runkel is Senior Executive Vice President and Chief Transformation Officer of U.S. Bancorp. Mr. Runkel, 47, has served in this position since August 2021. From December 2013 to August 2021, he served as Senior Executive Vice President and Chief Credit Officer. From February 2011 until December 2013, he served as Senior Vice President and Credit Risk Group Manager of U.S. Bancorp Retail and Payment Services Credit Risk Management, having served as Senior Vice President and Risk Manager of U.S. Bancorp Retail and Small Business Credit Risk Management from June 2009 until February 2011. From March 2005 until May 2009, he served as Vice President and Risk Manager of U.S. Bancorp.

John C. Stern

Mr. Stern is Senior Executive Vice President and Chief Financial Officer of U.S. Bancorp. Mr. Stern, 46, has served as Senior Executive Vice President since April 2023 and Chief Financial Officer since September 2023. He also served as Head of Finance from May 2023 to August 2023. He served as Executive Vice President from July 2013 through April 2023. From May 2021 until May 2023, he served as President of the Global Corporate Trust and Custody business of U.S. Bancorp. Previously, he served as Treasurer from July 2013 to May 2021 and has held various other leadership positions in his nearly 25 years at U.S. Bancorp.

Dominic V. Venturo

Mr. Venturo is Senior Executive Vice President and Chief Digital Officer of U.S. Bancorp. Mr. Venturo, 57, has served in this position since July 2020. From January 2015 until July 2020, he served as Executive Vice President and Chief Innovation Officer of U.S. Bancorp, having served as Senior Vice President and Chief Innovation Officer of U.S. Bancorp Payment Services from January 2010 until January 2015. From January 2007 to December 2009, Mr. Venturo served as Senior Vice President and Chief Innovation Officer of U.S. Bancorp Retail Payment Solutions. Prior to that time, he served as Senior Vice President and held product management positions in various U.S. Bancorp Payment Services business lines from December 1998 to December 2006.

Timothy A. Welsh

Mr. Welsh is Vice Chair, Consumer and Business Banking, of U.S. Bancorp. Mr. Welsh, 58, has served in this position since March 2019. Prior to that, he served as Vice Chair, Consumer Banking Sales and Support since joining U.S. Bancorp in July 2017. From July 2006 until June 2017, he served as a Senior Partner at McKinsey & Company where he specialized in financial services and the consumer experience. Previously, Mr. Welsh served as a Partner at McKinsey from 1999 to 2006.

Additional Information

Additional information in response to this Item 10 can be found in the Proxy Statement under the headings “Proposal 1 — Election of directors,” “Other matters — Delinquent Section 16(a) reports,” “Corporate governance — Committee responsibilities” and “Corporate governance — Committee member qualifications.” That information is incorporated into this report by reference.

Information required to be furnished in response to this Item 11 can be found in the Proxy Statement under the headings “Compensation discussion and analysis,” “Compensation Committee report,” “Corporate governance – Compensation Committee Interlocks and Insider Participation,” “Executive compensation” and “Director compensation.” That information is incorporated into this report by reference.

Information in response to this Item 12 can be found in the Proxy Statement under the headings "Equity compensation plan information" and “Security ownership of certain beneficial owners and management.” That information is incorporated into this report by reference.

Information in response to this Item 13 can be found in the Proxy Statement under the headings “Corporate governance — Director independence,” “Corporate Governance — Committee member qualifications” and “Certain relationships and related transactions.” That information is incorporated into this report by reference.

Information in response to this Item 14 can be found in the Proxy Statement under the headings “Audit Committee report and payment of fees to auditor — Fees to independent auditor” and “Audit Committee report and payment of fees to auditor — Administration of engagement of independent auditor.” That information is incorporated into this report by reference.

PART IV

List of documents filed as part of this report:

1. Financial Statements

• Report of Management

• Report of Independent Registered Public Accounting Firm on Internal Control over Financial Reporting

• Report of Independent Registered Public Accounting Firm on the Financial Statements

• U.S. Bancorp Consolidated Balance Sheet as of December 31, 2023 and 2022

• U.S. Bancorp Consolidated Statement of Income for each of the three years in the period ended December 31, 2023

• U.S. Bancorp Consolidated Statement of Comprehensive Income for each of the three years in the period ended December 31, 2023

• U.S. Bancorp Consolidated Statement of Shareholders’ Equity for each of the three years in the period ended December 31, 2023

• U.S. Bancorp Consolidated Statement of Cash Flows for each of the three years in the period ended December 31, 2023

• Notes to Consolidated Financial Statements

• U.S. Bancorp Consolidated Daily Average Balance Sheet and Related Yields and Rates (Unaudited)

• U.S. Bancorp Supplemental Financial Data (Unaudited)

2. Financial Statement Schedules

All financial statement schedules for the Company have been included in the consolidated financial statements or the related footnotes, or are either inapplicable or not required.

3. Exhibits

Shareholders may obtain a copy of any of the exhibits to this report upon payment of a fee covering the Company’s reasonable expenses in furnishing the exhibits. You can request exhibits by writing to Investor Relations, U.S. Bancorp, 800 Nicollet Mall, Minneapolis, Minnesota 55402.

*(1)*Exhibit has been previously filed with the SEC and is incorporated herein as an exhibit by reference to the prior filing.

*(2)*Management contracts or compensatory plans or arrangements.

*(3)*Certain appendices have been omitted. The Company will furnish copies of any such appendix to the U.S. Securities and Exchange Commission upon its request.

Not applicable.

SIGNATURES

Pursuant to the requirements of Section 13 or 15(d) of the Securities Exchange Act of 1934, the registrant has duly caused this report to be signed on February 20, 2024, on its behalf by the undersigned, thereunto duly authorized.

Pursuant to the requirements of the Securities Exchange Act of 1934, this report has been signed below on February 20, 2024, by the following persons on behalf of the registrant and in the capacities indicated.

*Andrew Cecere, by signing his name hereto, does hereby sign this document on behalf of each of the above named directors of the registrant pursuant to powers of attorney duly executed by such persons.

Dated: February 20, 2024