The 23-year-old gunman was fatally shot at the scene on Monday, Louisville police said.
It was unclear whether he was slain by police or took his own life. The incident marked the latest in a long series of mass shootings in the United States.
Louisville police identified the shooter as Connor Sturgeon, who joined the downtown branch of the Old National Bank as a full-time employee last year.
Police said they responded within minutes to reports of an attacker about 8.30am at the bank office near Slugger Field baseball stadium.
Officers fired at the gunman, who was armed with a rifle, Police Chief Jacquelyn Gwinn-Villaroel told reporters. The attacker broadcast live video of his attack on social media, she said.
The dead were identified as Joshua Barrick, aged 40, Deana Eckert (57), Thomas Elliot (63), Juliana Farmer (45) and James Tutt (64).
Kentucky Governor Andy Beshear fought back tears at an afternoon news briefing, saying that he knew some of the victims, including Elliot, a senior vice president at the bank.
"He taught me how to help build my law career, he helped me become governor, he gave me advice on being a good dad," Beshear said. "One of the people I talked to most in the world."
Two police officers were among the nine wounded. A 26-year-old recent police academy graduate was struck in the head and remained in critical condition after brain surgery on Monday, police said.
All nine victims were treated at the University of Louisville hospital, a hospital spokesperson said. Two other victims were also in critical condition.
The status of the shooter's job at the bank was not immediately clear on Monday. Gwinn-Villaroel said at a news conference that he was employed there. CNN, citing confidential law enforcement sources, said he had been notified that he would be fired.
Sturgeon grew up in southern Indiana, just north of Louisville, according to his mother's Facebook page. The elder of two boys, he attended Floyd Central High School in Floyds Knobs, Indiana, where he ran track and played basketball for the team his father, Todd, coached. He enrolled at the University of Alabama in 2016 as a business student.
Sturgeon was an intern at the bank for three summers from 2018 to 2020 before becoming a full-time employee in 2022 as a portfolio banker, according to his LinkedIn profile page. He had no prior contact with Louisville police, the police chief said.
"This was a targeted act of evil violence" Craig Greenberg, the mayor of Louisville, a city of 625,000, told reporters at the briefing. Greenberg said he was also friends with Elliot, who had worked on the mayoral transition campaign.
It is not the first time that a gun rampage has been live-streamed by an attacker. The gunman who killed 10 people in a racially motivated shooting at a Buffalo, New York, grocery store in May 2022 had live-streamed his attack, as had the attacker who killed 51 people at two mosques in Christchurch, New Zealand, in March 2019.
Mass shootings have become commonplace in the United States, which has experienced 146 so far in 2023, the most at this point in the year since 2016. Those statistics use the definition of four or more shot or killed, not including the shooter - according to the nonprofit Gun Violence Archive.
In one of the most recent high-profile incidents, three 9-year-old students and three staff members were killed at a school in Nashville, Tennessee, by a former student on March 27.
President Joe Biden responded to news of the shooting by reiterating his wish that Congress pass legislation requiring safe storage of firearms, background checks for all gun sales and elimination of gun manufacturers' immunity from liability.
"How many more Americans must die before Republicans in Congress will act to protect our communities?" Biden, a Democrat, said in a statement.
