We are learning more about gunman Omar Enrique Santa-Perez, who was fatally shot by officers responding to the shooting.
Cranley praised the quick response by police, saying officers did "a heroic job".
Authorities said "there was an exchange of gunfire" but it wasn't clear whether the suspect shot himself or police shot him.
The chaos unfolded alongside Fountain Square, the heavily trafficked park at the city's center.
Police Chief Eliot Issac said the shooter unleashed a torrent of bullets in the loading dock of the Fifth Third Bank building in the city's Fountain Square around 9 a.m. He saw a woman about to enter the bank and people shouted at her, he said, but she had headphones on.
Ebony Ginyard, who works at a Dunkin' Donuts in Fountain Square, said she and other workers and customers dropped to the floor when the shooting erupted, according to Reuters. The Cincinnati Enquirer reports that the scene was secured by 9:15 a.m.
"Per Fifth Third Bank, the shooter was not an employee of Fifth Third", police spokeswoman Tiffaney Hardy said via email.More news: Tropical Storm Florence forms in the eastern Atlantic
"All he had to do was look over the counter at us and we would have been shot", Ginyard told reporters, adding she saw the shooter reload his pistol.
Fifth Third Bank is one of Cincinnati's dominant financial institutions with 121 local branches.
The victims have been identified as Pruthvi Raj Kandepi, Richard Newcomer and Luis Felipe Calderón, according to the Hamilton County Coroner.
Isaac said Perez died after the first officers on the scene shot him multiple times.
Perez's aunt said her nephew held various jobs and was now working, though his aunt and her family did not know where.
The gunman was among dozens of people visiting stores, business offices, hotels and eateries in Fountain Square on Thursday morning. The company in a statement said it's working with law enforcement and offers thoughts and prayers for "everyone caught up in this bad event".
"We send our prayers to the victims and their families", said Cincinnati Mayor John Cranley. "We as a country have to deal with it", Cranley added.