Česká spořitelna, a.s.

The role of the administrative, management and supervisory bodies

Reference: pages 300-302.

The Bank's Board of Directors has 6 executive members; 1 of 6 is a woman (17%). The Supervisory Board has 9 non-executive members, 4 of whom (44%) are independent, and 3 were elected directly by employees (2 are trade union representatives); 3 of 9 (33%) are women.

Governance structure: a Sustainability Board Committee, composed of senior executives and Board members, was established in early 2025 and reports to the Board of Directors quarterly, overseeing strategy, policies, targets and sustainability risks. Sustainability Working Groups (SWGs) bring together material-topic owners and report quarterly to the Committee.

The Chief Sustainability Officer, within the Strategy Unit, leads the double materiality assessment, nominates Material Sustainability Topic Owners, sets the sustainability strategy and oversees ESG policies. The Accounting Unit prepares the Consolidated Sustainability Statement; the Strategic Risk Unit incorporates ESG risk into the risk management strategy and measures financed and downstream-leased-asset emissions; the Compliance Unit manages privacy, compliance and AML risk. Named Material Sustainability Topic Owners (B-1 managers) include the People and Culture Unit, Property Management Unit, Retail/Wholesale Divisions, Security Unit, Office of the Ombudsman and Personalisation Unit.

Information and sustainability aspects dealt with by the administrative, management and supervisory bodies

Reference: page 302.

The Board of Directors validates the outcome of the double materiality assessment carried out by the Sustainability Office, and by doing so "addressed all identified material impacts, risks and opportunities." The Board sets sustainability strategy and targets, approves Material Sustainability Topic Owners on the Sustainability Office's recommendation, and is informed periodically by the Sustainability Office, the Sustainability Board Committee and topic owners on progress.

Sustainability targets feature in monthly senior-management reports -- the Risk Report (decarbonisation portfolio performance) and the Financial Health Company Performance Report (sustainability and financial KPIs together) -- both discussed monthly at Board meetings and quarterly at Supervisory Board meetings. The Supervisory Board takes note of the Consolidated Sustainability Statement, oversees the sustainability strategy's implementation and is informed of related strategic initiatives.

Integration of sustainability-related performance in incentive schemes

Reference: pages 302-303.

ESG goals account for 10% of overall Board member targets, including climate-related objectives and emission-reduction targets, and determine variable remuneration for members who have them explicitly defined. Performance is evaluated annually by the Top Executive Appraisal Committee (TEAC), a group committee of Erste Group Bank's Management Board, whose outputs go to the Remuneration Committee; the Supervisory Board sets final bonuses.

Named 2025 ESG indicators per Board role include: Chairman -- ESG performance ratings (MSCI, ISS ESG, Sustainalytics, CDP) and advancing the net-zero portfolio transition; Risk Management Vice Chairman -- implementing the ECB ESG action plan; Financial Management -- low-carbon electricity sourcing and CSRD report delivery; Retail Banking -- Sustainable Mortgage/Housing Loans; Corporate Banking -- EU Taxonomy implementation in loan origination. The Operations and IT Board member had no ESG targets set in 2025.

Statement on due diligence

Reference: page 303.

The Group discloses a due-diligence core-elements table rather than a standalone narrative, mapping each of the five elements to the chapter that addresses it: (a) embedding in governance/strategy -> GOV-2, GOV-3, SBM-3; (b) stakeholder engagement -> GOV-2, SBM-2, IRO-1, plus E1-2, S1-1, S1-2, S3-1, S3-2, S4-2 and G1-1; (c) identifying and assessing adverse impacts -> IRO-1; (d) taking action -> E1-3, S1-4, S3-4, S4-4; (e) tracking effectiveness -> E1-4, E1-5, E1-6, S1-5, S1-9, S1-14, S1-16, S1-17, S3-4, S3-5, S4-3, S4-4, S4-5, G1-4.

"The Group has firmly embedded the concept of sustainability in the corporate business strategy and relies on sustainable, value-driven and responsible business practices that enable the Group to generate stable returns for all stakeholders over the long term."

Risk management and internal controls over sustainability reporting

Reference: page 304.

The main reporting risks identified are errors (inaccurate quantitative or qualitative data), reporting irrelevant (non-material) information, and omitting material information, all of which apply equally to value chain data. Sustainability reporting is subject to a segregation of duties similar to financial reporting, with three layers of control: input data quality controls within the business units responsible for each material topic, supported by a dedicated data-quality unit; reconciliation controls between the Consolidated Sustainability Statement and the Consolidated Financial Statements; and management review controls, with each material topic assigned a B-1 manager as topic owner, subject to review by the Sustainability Office, the Strategic Risk Unit and other contributing units.

The Statement is submitted annually to the statutory body and presented to the Supervisory Board, subject to irregular internal-audit testing, and its preparation is monitored by the Audit Committee, which also oversees the annual limited assurance process with the external provider.

Strategy, business model and value chain

Reference: page 305.

The Bank, as parent company, defines and coordinates the sustainability strategy for the whole Group via the centrally managed Sustainability Office. It operates as a credit institution with three primary segments: retail banking, corporate banking and financial markets, funded primarily by its diverse client base and offering deposit-taking, payment services, investment products and advisory services.

Value chain: upstream covers procured goods and services (IT, marketing, property/infrastructure, consultancy), with IT as the key supplier sector; own operations cover products/services, governance and workforce management; downstream covers corporate and retail clients, institutional investors, and -- via the Česká spořitelna Foundation -- affected communities.

Interests and views of stakeholders

Reference: pages 305-306.

Key stakeholder groups and engagement channels: Customers (surveys, advisory sessions, customer experience programmes) on experience, products and innovation; Employees (engagement surveys, intranet, training, employee resource groups) on development, diversity, health and work-life balance; Investors, analysts and rating agencies (presentations, conferences) on performance, climate and risk management; Supervisory and regulatory authorities (supervisory dialogues); Academic institutions and NGOs (conferences and content-driven debate).

The Board of Directors holds weekly meetings with agendas reflecting stakeholder interests; the Supervisory Board convenes quarterly with stakeholder topics consistently presented. Cross-divisional collaboration between Risk and the corporate/retail divisions supports a comprehensive stakeholder-concern response.

Material impacts, risks and opportunities and their interaction with strategy and business model

Reference: pages 307-309.

The 2025 DMA identified material IROs across E1 Climate Change, E4 Biodiversity and Ecosystems, S1 Own Workforce, S3 Affected Communities (financial literacy, entity-specific), S4 Consumers and End-Users (financial health, entity-specific, and privacy) and G1 Business Conduct. E1 carries risks, opportunities and negative impacts across climate change adaptation, mitigation and energy, concentrated in the financed portfolio; E4's sole IRO is soil sealing from real estate/infrastructure/agriculture financing; S1 covers work-life balance, health & safety, gender equality/equal pay, training and diversity, all in own operations; S4 covers financial health (positive) and privacy (risk); G1 covers corporate culture and corruption prevention, both positive.

2025 changes: climate change adaptation's positive-impact activities were reclassified as mitigation measures; a new entity-specific S3 financial literacy topic (Skoala) was added; S4 privacy was reclassified as material; S4 access-to-products-and-services lost its positive-impact classification as new accessibility legislation made it business-as-usual. "Identified short-term horizon risk did not have material current financial effects on the Group's 2025 financial position, performance or cash flow." Only climate change was assessed as posing a material risk to business-model resilience; see E1 SBM-3 for the scenario-based resilience analysis.

Description of the process to identify and assess material impacts, risks and opportunities

Reference: pages 310-313.

The 2025 DMA was a reassessment led by the Sustainability Office with input from Accounting, Strategy, Risk, Corporates and Markets, People and Culture, Compliance and Procurement, run in four steps: long-list relevance (expanded to add entity-specific financial literacy alongside financial health), short-list relevance, IRO assessment, and validation by an expert jury and the Board.

Impact materiality: scored on severity (scale, scope, irremediability for negative impacts) x likelihood, each 0-5; impacts scoring above 2.5/5 are material. Financial materiality: magnitude (0-3) x probability (0-5); above 1.5/3 is material. In 2025, Erste Group Bank ran a new quantitative UNEP FI/ENCORE portfolio analysis, flagging topics above the 90th percentile impact score for internal validation, replacing the prior manual approach. E1 negative impacts (mitigation, energy) were assessed material for their "actual and global nature"; financing of renewable energy was assessed as a material positive impact. E4 soil sealing from real-estate/infrastructure/agriculture financing was material by expert judgement. G1 identified two material positive impacts (corporate culture; corruption prevention).

Non-material topics: "In line with ESRS IRO-1 requirements, this section addresses only those sustainability matters for which disclosure is required regardless of their non-material assessment... pollution, water and marine resources, resource use and circular economy. In all these areas, no material IROs were identified" given the Group's "non-manufacturing business model."

Disclosure requirements in ESRS covered by the undertaking's sustainability statement

Reference: pages 313-315.

Appendix 2 provides a content index of 40 disclosure-requirement rows with page references, covering ESRS 2 (BP-1, BP-2, GOV-1 to GOV-5, SBM-1 to SBM-3, IRO-1, IRO-2) and the topical standards E1, E4, S1, S3, S4 and G1, plus cross-referenced ESRS 2 IRO-1 process descriptions for E2, E3 and E5 (each assessed not material). "After the completion of the DMA, the respective material sustainability matters were allocated to the relevant disclosure requirements and datapoints using the EFRAG Guidance."

"The Group has not omitted any disclosure requirements due to its immateriality other than through the process of the double materiality assessment. The Group has not set up any thresholds for determining material information. All information required by disclosure requirements is reported." A separate List of Applied Phased-in Disclosure Requirements (page 299) covers E1-9, E4-6, S1-7, S1-13 and S1-15 in full, plus partial phase-in for ESRS 2 SBM-1 (paragraph 40(b)/(c)) and SBM-3 (paragraph 48(e) anticipated financial effects).

Transition plan for climate change mitigation

Reference: pages 342-343.

The Group is within scope of the EU Paris-aligned benchmarks. In 2025, Erste Group Bank began developing a prudential transition plan under CRD VI, covering all core markets including the Czech Republic, due to the Czech National Bank by 30 April 2026.

Decarbonisation levers on the loan portfolio: decreasing financing to high-GHG sectors, increasing financing for low-/zero-emission projects, and increasing transition financing. The Group targets Net Zero (1.5°) for six financed sectors -- electricity production, heat and steam, oil and gas extraction, automotive, iron and steel, cement -- though oil/gas and cement exposures are immaterial. Real estate (mortgages, commercial real estate) targets are explicitly not aligned with the Paris Agreement, tracking 2.2°C and 1.7°C pathways respectively. For own operations, the sole lever is energy efficiency improvements (real estate, car fleet, renewable sourcing).

"The Group does not yet quantify the investments (CapEx), OpEx and funding that support the implementation of its transition plan," and does not separately manage locked-in GHG emissions, relying instead on its general net-zero-by-2050 strategy to avoid material lock-in.

Identification of climate-related risks and scenario analysis

Back-filled from ESRS 2 IRO-1 and the E1 SBM-3 resilience-analysis section, where this content is disclosed in the FY2025 report (pages 310-312, 340-341). This disclosure requirement did not exist under the 2023 ESRS the report was prepared against.

Physical risks are identified under climate change adaptation and transition risks under climate change mitigation and energy (IRO-1, page 311-312), both centred on the financed portfolio via the credit-risk transmission channel.

Scenarios used (pages 340-341): Erste Group Bank's framework draws on NGFS pathways -- a Central/Baseline scenario (combining Below 2°C and Fragmented World); an adverse Delayed Transition scenario (a disorderly transition from 2030, used conservatively for transition risk); and an adverse Current Policies scenario (Hot House World, used for physical risk). The Bank's own corporate/SME portfolio model additionally runs a Net Zero 2050 pathway limiting warming to ~1.5°C. Physical-risk hazard data comes from Munich Re Location Risk Intelligence under RCP 8.5 / SSP 5, plus dedicated river-flood and (in development) fire-weather models, and a 2022 ECB climate stress test for drought. Outputs are calculated for 2030, 2040 and 2050 over short- (up to 1 year), medium- (1-5 years) and long-term (to 2050/2100) horizons. "The resilience analysis is subject to uncertainties as it uses long-term (up to 30 years) climate and macro-economic projections that depend on assumptions about future policies, technologies and how quickly the transition will progress" (page 341).

Resilience in relation to climate change

Back-filled from the E1 SBM-3 resilience-analysis section, where this content is disclosed in the FY2025 report (pages 340-342). This disclosure requirement did not exist under the 2023 ESRS the report was prepared against.

Transition risk: under a baseline scenario, no notable near-term credit-risk impact is expected; under an adverse accelerated Delayed Transition, "material exposure to transition-induced credit risk across short-, medium- and long-term horizons" is indicated. Quantified outputs for the Bank's corporate portfolio: by 2030, annual transition-related credit losses would be CZK 500 million higher and Pillar 1 Credit RWA CZK 30 billion higher under Net Zero 2050 than under Delayed Transition/Current Policies; by 2050 the gap narrows sharply to CZK 38 million in credit losses and CZK 10 million in RWA.

Physical risk: credit risk is a material driver across all horizons, intensifying from mid-century; operational risk from physical hazards is immaterial to 2050 but material for heat waves beyond; strategic risk is material long-term; market, liquidity and reputational risk show no material physical or transition risk across any horizon.

Strategy implications: the Group has embedded climate and environmental factors into collateral-management frameworks and updated its collateral policy for physical-risk valuation (page 342); its ambition to reach net-zero portfolio status by 2050 is expected to reduce transition-risk exposure over time.

Policies related to climate change mitigation and adaptation

Reference: pages 343-345.

Four policies cover the three material E1 sub-topics: the Responsible Financing Policy (adaptation and mitigation), Lending Policy for Renewable Energy and Commercial Real Estate Financing Policy (mitigation and energy), and the Car Policy (energy).

The Responsible Financing Policy sets exclusion criteria across energy, defence/weapons, biodiversity and gambling/gaming, and commits to progressively exiting thermal-coal financing by 2030 (new financing for coal used in industrial processes such as steel/cement remains permitted for lack of alternatives). It permits nuclear financing only for safety upgrades, vital safety components, decommissioning or new EU-Taxonomy-aligned projects, reflecting Czech reliance on nuclear for energy security; it excludes Arctic oil/gas exploration and fracking, and restricts hydropower near protected areas (Natura 2000). The policy currently applies only to the Bank; subsidiary rollout for corporate lending is postponed to 2026. The Lending Policy for Renewable Energy targets wind, small hydro and solar. These policies are reviewed every two years, approved by the relevant Board member, and published on the Intranet.

Actions and resources in relation to climate change policies

Reference: pages 345-347.

Sector decarbonisation strategies (financed emissions, 2022/2023 base years, 2030 targets): heating -42%, electricity generation -54%, automotive -32%, iron and steel -22%; cement and iron/steel strategies exist but have not been formally Board-approved given limited exposure. The Group supports clients via ESG advisory, prioritising EU-Taxonomy-aligned and transition-plan-holding clients, and subsidy advisory through subsidiary Erste Grantika Advisory a.s.

Household mitigation/adaptation campaign (launched April 2024): targets 50,000 low-energy-efficiency households covering 210,859 tCO2e of financed emissions; 57% contacted by end-2025 (2024: 33%), redesigned in September 2025 to add specialist call-centre support. Own-operations lever -- electric car fleet: target 100% BEV by 2030 with a 25% 2025 interim target; achieved 36% (2024: 20%), with 256 electric cars added in 2025. Own-operations costs were assessed as immaterial except ESG-related building capex (~10% of annual Property & equipment additions, ex-headquarters).

Targets related to climate change mitigation and adaptation

Reference: pages 347-352.

Portfolio decarbonisation (financed emissions) targets, approved by the Board in 2023 and re-approved 2025, benchmarked mainly to IEA NZE2050: electricity generation 520.3 -> 237.6 kgCO2e/MWh by 2030 (2025 actual: 255.7, -51% vs 2022 baseline); heat & steam 885.8 -> 513.7 thousand tCO2e (2025: 295.3, -67%); automotive 172.0 -> 117.0 gCO2e/km (2025: 145.5, -15%); iron & steel 1.9 -> 1.5 tCO2e/tonne (2025: 1.0, -47%). Real estate targets were rebaselined in 2025 to a 2024 baseline using an internal model plus SBTi SDA/CRREM pathways, externally benchmarked via the XDC model: mortgages 69.7 -> 50.4 kgCO2e/m2 by 2030 (implied 2.2°C; 2025 actual 67.1), commercial real estate 47.2 -> 32.5 kgCO2e/m2 (implied 1.7°C; 2025 actual 44.8).

Sustainable Financing Ratio targets: corporate 25% by 2026 (2025: 25.4%, already achieved); retail mortgage 15% by 2027 (2025: 7.4%, up from 6.6%). Net Zero Scope 1+2 target: 90% reduction by 2030 from a 2017 baseline of 27,537 tCO2e (Bank only; target raised from 80% in 2025, applies Group-wide); 82% achieved in 2025 (2024: 86%, the step-back reflecting fewer purchased certificates). Electric car fleet target: 100% by 2030, 25% interim 2025 target; 36% achieved.

Energy consumption and mix

Reference: page 352.

Energy consumption is recorded individually across 1,367 business locations (including ATMs), split by source via the Tagetik system into fossil, nuclear and renewable categories, using supplier invoices/certificates where available and median/extrapolated estimates elsewhere.

2025 total energy consumption: 58,610 MWh (2024: 58,162 MWh), of which fossil 24,589 MWh (42%), nuclear 0%, and renewable 34,021 MWh (58% of total; 2024: 68.1%). Of the renewable total, 34,014 MWh is purchased/acquired renewable electricity, heat, steam and cooling, with a small 7 MWh of self-generated non-fuel renewable energy. The renewable share fell from 68.1% to 58% largely because certificate purchases for biomass/biomethane dropped to 9,001 MWh (2024: 13,450 MWh), covering about 31% of heat and gas consumption (2024: 50%), even though electricity consumption remains fully covered by certificates of origin.

Gross Scopes 1, 2, 3 and Total GHG emissions

Reference: pages 352-353.

Methodology follows the GHG Protocol (Corporate Accounting and Reporting Standard; Scope 3 Corporate Value Chain Standard) and PCAF's Global GHG Accounting and Reporting Standard for the Financial Industry, Part A, using an operational control boundary. The Group reports only Scope 3 Category 13 (downstream leased assets) and Category 15 (investments/financed emissions) as the most relevant categories; it does not measure or report avoided emissions or removals.

2025 restatement: gas heating consumption at leased properties was reclassified from Scope 1 to Scope 2 under the GHG Protocol Scope 2 Guidance; the 2024 comparative was restated (originally reported: 1,991 tCO2e Scope 1, 15,986 tCO2e Scope 2 location-based, 1,919 tCO2e Scope 2 market-based), with "the overall impact on combined Scope 1 and Scope 2 emissions... minimal, representing a change of less than 1%." Certificates of origin covered 26,651 MWh of electricity purchases and 9,001 MWh of biomass/biomethane in 2025, with biogenic emissions outside Scope 2 of 1,003 tCO2e (2024: 1,464 tCO2e). GHG intensity per net revenue rose to 80.3 tCO2eq/CZK million (location-based) and 80.2 (market-based) in 2025, up 15% from 69.6 and 69.4 in 2024.

Transition plan and consideration of biodiversity and ecosystems in strategy and business model

Reference: pages 360-361.

The Group's sole material E4 sub-topic is soil sealing: "Financing real estate and public infrastructure can have a negative impact on biodiversity as soil is sealed, and land is degraded," with investment in large monoculture agriculture also flagged as a potential contributor. A Board-level resilience analysis conducted by Erste Group Bank tracks biodiversity loss as part of "other environmental risks" within its broader physical/transition risk framework rather than as a standalone systemic-risk category; results showed no significant threat to the business model or strategy from biodiversity-related physical or transition risks (further detail under E1 SBM-3).

"The Group's own operations and upstream value chain do not have a material impact on biodiversity and are therefore not considered further." The Group plans to "incorporate biodiversity aspects more comprehensively into its strategy and policies within the next two years."

Policies related to biodiversity and ecosystems

Reference: page 361.

The Responsible Financing Policy carries exclusion criteria for construction/financing activities in protected areas to address soil sealing, including UNESCO World Heritage Sites, Ramsar-listed wetlands, and IUCN Category I/II areas or Natura 2000 sites. The policy is owned by the Head of Business Tribes, reviewed annually (principles) and every two years (policy itself), approved by the Board member for Corporates and Markets, and published on the Intranet. It "does not explicitly address the social consequences of biodiversity- and ecosystem-related impacts," applies currently only to the Bank, and is planned for rollout to corporate-lending subsidiaries in 2026.

Actions and resources related to biodiversity and ecosystems

Reference: page 361.

"Due to the emerging nature of this topic for the Group, specific action plans have not yet been established." The identified soil-sealing impact "will serve as the basis for defining specific actions to measure progress within the next two years."

Targets related to biodiversity and ecosystems

Reference: page 361.

No target has yet been set: "Due to the emerging nature of this topic for the Group and the limitations in the quality and availability of biodiversity-related data, specific targets have not yet been established." The identified soil-sealing impact "will serve as the basis for more comprehensive disclosures within the next two years."

Impact metrics related to biodiversity and ecosystems change

Reference: page 361.

"Specific metrics related to the identified material impact of soil sealing in the Group's real estate portfolio have not yet been established." Own-operations metrics are not considered relevant, as the Group "has no material sites located in or near biodiversity-sensitive areas." Downstream value-chain metrics are withheld under the ESRS 1, section 10.2 transitional provision.

Policies related to own workforce

Reference: pages 364-365.

Non-discrimination and fair working conditions are grounded in the Constitution and Charter of Fundamental Rights and Freedoms of the Czech Republic and reflected in the Collective Agreement, Code of Ethics, Internal Labour Guideline, Remuneration Policy principles and Diversity and Inclusion Policy; new hires sign compliance with the Code of Ethics. "The Group's policies related to its own workforce do not explicitly address human trafficking, forced labour, compulsory labour or child labour," though it "operates in full compliance with the Czech Labour Code," which prohibits such practices.

Health and Safety relies on legal compliance rather than a standalone policy, with benefits beyond legal minimums via the Health Centre. The Remuneration Policy mandates equal pay for equal work, benchmarked externally (Hays grades, Korn Ferry). The Diversity and Inclusion Policy, based on Erste Group Bank's, covers the Bank's workforce and customers and is overseen by the Chief Sustainability Officer; it applies only to the Bank, with no current subsidiary rollout plan.

Processes for engaging with own workforce and workers' representatives about impacts

Reference: pages 365-366.

Direct engagement: a Group-wide employee engagement survey twice a year; Včelín+, a social network launched 2024 for CSR, digital tools and branch-education discussion; echo, a new 2025 intranet spanning all Erste Group Bank countries; and Spořka LIVE, streamed Board Q&A sessions. Indirect engagement runs through collective bargaining and trade unions, managed by the People and Culture Unit, with regular meetings concluding in a signed Collective Agreement plus ad-hoc negotiations.

The Diversity and Inclusion Directive, issued 2024, binds all Bank employees and assigns responsibilities across the Board, B-1 managers, People and Culture and the Sustainability Office. Intranet channels and Spořka LIVE questions are monitored by the Communication Unit and routed for resolution; engagement survey outputs (eNPS, engagement index) go to management and team leaders for action planning.

Processes to remediate negative impacts and channels for own workforce to raise concerns

Reference: pages 366-367.

Channels include line managers as first point of contact, the whistleblowing channel (per the Whistleblowing Policy, fully anonymous reports), the employee engagement survey, and the Internal Ombudsman. "One of the key benefits of having a whistleblowing process and an Internal Ombudsman in place is that it can help to create a culture of transparency and accountability." Employees are informed of these channels from onboarding onward.

For mass layoffs (more than 29 employees/month), the Group follows Labour Code notification requirements to authorities and worker representatives, provides collective-agreement benefits, and offers an outplacement assistance package covering legal/psychological support and active job-placement assistance.

Taking action on material impacts on own workforce, and approaches to managing material risks and pursuing material opportunities related to own workforce, and effectiveness of those actions

Reference: pages 367-369.

"The Group has not identified any material risks related to its own workforce"; associated action-plan costs were assessed as immaterial and funded from standard divisional budgets. Work-life balance: flexitime/remote-work "flexi profiles," core hours 9am-2pm, the "Flexi DNA" branch rollout in 2025, four extra parental-leave days for pregnant women/single parents, and three-month sabbaticals for managers (9 used in both 2024 and 2025). Health and safety: the Prague Health Centre (launched November 2023) offers free GP consultations, telemedicine, specialist care, psychological counselling (up to 6 sessions/year) and a 24/7 crisis line, available Group-wide.

Gender equality/pay: a 2024-25 competency-model and job-redesign programme, covering 90% of Bank employees by end-2025, standardises role evaluation regardless of gender. Training: the internal AMOS booking system plus external platforms (Seduo, Digiskills, Red Button EDU); a new learning-and-development strategy is due in 2026.

Targets related to managing material negative impacts, advancing positive impacts, and managing material risks and opportunities

Reference: pages 369-370.

Diversity targets (by 2028, no base year -- outcome-based): 30% women on the Board of Directors (2025: 17%, unchanged from 2024), 30% women on the Supervisory Board (2025: 33%, already exceeded), 33% women at B-1 management (2025: 26%, up from 20%). Targets, set via Erste Group Bank and reviewed at twice-yearly Leaders' Sessions, were split into separate Board/Supervisory-Board targets in 2025 (previously a single combined 27% target).

Employee Net Promoter Score (eNPS): permanent target of 70 (no base year, continuous-improvement target); 2025 actual: 63 (2024: 57), covering all material workforce IROs except diversity and training. Training and skills development: no formalised target yet; a new Learning and Development strategy is in preparation for 2026.

Characteristics of the undertaking's employees

Reference: pages 370-372.

Total employees (headcount), 31 December 2025: 10,058 (2024: 10,277), of which 3,514 male, 6,544 female. By contract: 9,274 permanent, 784 temporary; 8,645 full-time, 1,413 part-time; no non-guaranteed-hours employees. Average FTE: 9,597 (6,198 female, 3,399 male). All employees are based in the Czech Republic.

Age distribution 2025: under 30 -- 1,421 (14%); 30-50 -- 5,482 (56%... restated basis); over 50 -- 3,155 (29% under the aligned methodology). Turnover: 1,107 new hires, 1,466 leavers, turnover rate 14% (2024: 14%, restated). The 2024 comparative for the 50+ age band was restated to match Erste Group Bank's threshold (50 vs the prior 51), with no impact on underlying workforce composition.

Diversity metrics

Reference: page 372.

Top management gender distribution, 2025: Board of Directors 4 women / 25 men (14%); B-1 managers 11 women / 31 men (26%). 2024: Board 3/23 (12%); B-1 9/36 (20%). "The share of women on the Board of Directors increased from 12% to 14%, while representation at B-1 management level rose from 20% to 26%." For B-1, gender distribution is reported for the Bank only, as subsidiaries have no B-1 level.

Age distribution, 2025: under 30 -- 1,421 (14%); 30-50 -- 5,482; over 50 -- 3,155 (restated basis applied consistently to both years, see S1-6).

Health and safety metrics

Reference: pages 372-373.

2025: 0 recordable work-related ill health cases, 77 recordable work-related accidents (rate 4 per million hours worked, down from 105 cases / rate 5 in 2024), 294 days lost to injuries/ill health/fatalities (2024: 1,324 -- the drop reflects the absence of employees on long-term sick leave from work injuries in 2025), 108,154 sick-leave business days (average 11 days/employee, unchanged), and 100% of employees covered by the health and safety management system. "There were 0 fatalities (2024: 0) in the Group's own workforce or other workers working on the undertaking's sites." Metrics are not externally validated.

Remuneration metrics (pay gap and total remuneration)

Reference: pages 373-374.

Unadjusted gender pay gap 2025: 34.4% (2024: 37.5%); adjusted pay gap: 2.0% (unchanged); remuneration ratio (highest-paid individual vs. median employee): 49.6 (2024: 50.9). The Bank holds the Universal Fair Pay Analyst certificate. The adjusted-pay-gap regression controls for position level (Hay method), job family (Korn Ferry from 2025), segment and management responsibility; the internal job-family definition and incentive-receiver parameter were dropped in 2025 as immaterial to the result (no restatement needed).

A Group-wide minimum wage of CZK 25,000/month (or CZK 150/hour) applies for 2025 and 2024, above the Czech statutory minimum of CZK 20,800 (2024: CZK 18,600), so "no employee of the Group was paid the minimum wage defined by the Czech government decree."

Incidents, complaints and severe human rights impacts

Reference: pages 374-375.

"There were no severe human rights issues or other incidents of discrimination reported in connection with the Group's workforce" and no related fines. 2025: 56 complaints filed through own-workforce channels (4 thereof discrimination incidents), 0 severe human-rights incidents, CZK 0 fines. The 2024 comparative was restated to 64 complaints / 13 discrimination incidents after aligning methodology with Erste Group Bank to count only workplace-related complaints (originally reported: 84 complaints / 10 discrimination incidents).

Policies related to affected communities

Reference: pages 375-376.

Affected communities comprise children and young adults (aged 6-19) reached through the Česká spořitelna Foundation, established by the Bank in 2002 as an independent entity. The Foundation's educational content follows the EU/OECD Competency Framework, the Czech Ministry of Finance's financial-literacy standard, and the Framework Educational Programme for Primary Education; its approach is "consistent with the general principles" of the UN Guiding Principles, ILO Declaration and OECD Guidelines, though not explicitly referenced in internal regulations. Concerns can be raised via a publicly available email address; "there were no cases of non-respect that involve affected communities in 2025." The Foundation has no policy on indigenous peoples' rights, as this is not relevant to its activities.

Financial literacy strategy (four pillars): competence education in schools; improving youth financial education; crisis-situation support; communication, advocacy and data analysis. The Skoala platform strategy was approved by the Foundation's Governing Board in 2023; a new 2026-2030 strategy is in preparation.

Processes for engaging with affected communities about impacts

Reference: page 376.

Since 2023, the Foundation has run an ongoing panel of 30 schools across regions/sizes to test methodologies and content, supplemented from 2024 by a Children's Advisory Group of 24 children (aged 6-19) testing interactive elements. Feedback channels include quarterly meetings, an annual summer school, a dedicated advisory panel, newsletters and a support email. Skoala is developed under the patronage of the Ministry of Education, Youth and Sports and the Ministry of Finance, with the Czech Banking Association, Czech National Bank, Czech School Inspectorate, National Pedagogical Institute and three universities as partners.

Satisfaction is tracked via Net Promoter Score: an average of 78 across two 2024 measurements (pre-launch and post-beta-launch), based on feedback from just over 100 schools; NPS moved to annual measurement from 2025. Skoala's product owner (B-2 manager) has operational responsibility for the surveys and feedback loop.

Taking action on material impacts on affected communities and managing the effectiveness of those actions

Reference: pages 376-377.

Skoala, a free digital platform of methodologies, worksheets, videos, mini-games and quizzes for primary/secondary teachers, was tested with 50 schools from May 2024, expanded in a September 2024 beta, and launched publicly in March 2025. It offers nearly 150 tested methodologies plus an Economic Data module added September 2025. Progress is tracked via registered/active schools, content scope, and NPS, reported to the Skoala Steering Committee.

Resources: CZK 73.7 million in 2025 operating/capital expenditure (cash-flow basis, excluding personnel), CZK 139 million cumulative; similar annual spend is expected going forward. The Foundation does not measure severe human-rights incidents connected to affected communities.

Targets related to advancing positive impacts

Reference: page 377.

Target metric: number of active schools (a school with at least one "engaged teacher" -- a light user opening 2-4 methodologies, each opened twice). Short-term target: 2,000 active schools by 2025 -- exceeded, reaching 2,432 (44% of all Czech primary/secondary schools). Medium-term target: 80% of all schools by 2030 (4,447 of 5,559 nationwide). No base year is set, as the target is outcome-based. The Foundation is piloting a separate outcome-oriented target pending successful pilot completion; progress is reported monthly to the Skoala Steering Committee and annually to the Foundation's Supervisory Board. The metric is not externally validated.

Policies related to consumers and end-users

Reference: pages 379-380.

As part of Erste Group Bank, the Group commits under the UN Global Compact to human rights and anti-corruption principles drawn from the Universal Declaration of Human Rights, the ILO Declaration and the UN Convention Against Corruption, though these are "not explicitly incorporated and mentioned in the Group's policies."

Financial health: a common Erste Group Bank framework assesses customers on five indicators (living within means, building a reserve, managing risk, saving for retirement, growing wealth), simplified from six in 2025, shown via a traffic-light scale; led locally by the Personalisation Tribe. Privacy: the Data Protection Policy ensures GDPR and Czech Banking Act (banking-secrecy) compliance, supported by Data Controller Responsibility, DPO, Data Processing Legitimacy and Transparency/Data-Subject-Rights procedures; the Cyber and Information Security Policy, led by the Bank's CISO under the Chief Risk officer for Risk Management, is reviewed at least every two years and reflects DORA.

Processes for engaging with consumers and end-users about impacts

Reference: page 380.

Net Promoter Score, measured quarterly via independent-agency online surveys, is the Group's primary customer-satisfaction indicator, reported to the Board quarterly and tied to employee incentives; the Customer Experience Unit lead (B-1) owns the process. "echo" measurement captures satisfaction immediately after channel interactions (branch, email, call centre, digital login, ATM, social media).

For negative impacts (privacy), the Group informs new customers how data is processed, seeks prior consent where needed, and -- for incidents assessed as potentially significant -- engages directly with affected customers and, in justified cases, notifies the Personal Data Protection Office via the DPO, who reports to the Head of Compliance and the Chief Risk Officer. Vulnerable groups (blind, deaf, disabled customers, children) receive adapted privacy and accessibility measures.

Processes to remediate negative impacts and channels for consumers and end-users to raise concerns

Reference: pages 380-381.

Suspected data breaches are logged by any employee through the internal EMUS incident system, triggering a Security Unit investigation and DPO notification; the DPO, after consulting Compliance, decides whether to report to the Data Protection Authority or the data subject, with all DPA-reported cases going to the Board. Customers can raise privacy complaints via George, branches, the 24/7 call centre, email, data box or the Internal Ombudsman.

In H1 2025 the Bank introduced a dedicated data-breach register; 175 data breaches were recorded in 2025, versus 104 substantiated privacy/data-protection complaints in 2024 (the Group notes it "improved the data collection process" in 2025 via formalised methodology, so the two years are not directly comparable). Two key risk indicators are tracked: the complaint ratio (complaints per 1,000 active customers) and complaints unresolved after 30 days. Metrics are not externally validated.

Taking action on material impacts on consumers and end-users, and approaches to managing material risks and pursuing material opportunities related to consumers and end-users, and effectiveness of those actions

Reference: pages 381-383.

Privacy/security: a 2017-18 GDPR implementation project (externally verified) underpins ongoing compliance; a 2025 Erste Group Bank DPO self-assessment found only minor improvement areas, closed by year-end. The Bank runs a certified CSIRT, regular penetration testing, and mandatory phishing/data-protection e-learning. Fraud losses where the fraudster initiates the transaction fell 6% year-on-year (48% for phishing), but manipulation fraud (victim persuaded to transact) rose 29% and now represents ~85% of total client transaction losses; overall, 2025 measures protected customer funds worth over CZK 3.9 billion (2024: CZK 2.7 billion). A new George app alert warns customers before authorising risky payments.

Financial health: the FIT section in George (redesigned 2024) delivers personalised financial-health guidance; Hey George, an AI assistant launched in 2025, handles routine banking queries; a Five Wins 2030 strategy (effective 2025) standardises Erste Group Bank's financial-health indicators from six to five, live in George since Q4 2025. The personalisation/refinement action plan "was successfully completed in 2025, achieving its intended objectives."

Targets related to managing material negative impacts, advancing positive impacts, and managing material risks and opportunities

Reference: pages 383-384.

Target: number of unique customers who have familiarised themselves with their financial-health indicators (digitally via FIT or in person with a banker), set annually using prior-year results, monitored quarterly by the Board. 2025 target: 1.55 million unique customers; actual: 1 million (2024: 1.1 million) -- the Group attributes the miss to diminishing returns as coverage of the target base matures, noting the 2025 target "was set at a very ambitious level." 2026 plans focus on deepening FIT engagement and communication. The metric is not externally validated and is explicitly not an ESRS outcome-oriented target; a confidential internal impact-oriented target (30-day product-purchase attribution) is tracked but not reported, and another is being piloted.

Privacy: no formalised target; the Group instead monitors completion of mandatory Data Security Training, with non-completion risking disciplinary proceedings.

Business conduct policies and corporate culture

Reference: pages 386-388.

The Code of Ethics, approved by the Board, sets binding ethical rules for employees and Board members, covering customer-centricity, data protection, employee conduct and corporate social responsibility, reinforced by mandatory annual e-learning and a dedicated Manager of Ethics role. AML is governed by the System of Internal Principles, Procedures and Control Measures (implementing Czech AML/sanctions legislation and FATF/Wolfsberg/Basel standards), supported by an AML Help Desk and workshops.

The Whistleblowing Policy, under a Whistleblowing Office reporting to the Chief Risk Officer, guarantees anonymity and covers all whistleblower categories per Czech Act No. 171/2023; it has been rolled out to four named subsidiaries directly and, from 1 January 2025, via an outsourcing channel to all other employing subsidiaries. The separate Internal Ombudsman process handles complaints/suggestions about conduct, decisions or policies, with records reported semi-annually to the Ethics Committee and Board, and an annual report published publicly.

Prevention and detection of corruption and bribery

Reference: page 388.

The Policy on Conflict of Interest and Anti-Bribery & Corruption sets zero-tolerance, standardised procedures, implemented by teams under the Compliance Unit (Prevention and Detection; Investigation, operating independently; AML and International Sanctions), reporting to the Chief Risk Officer and, for critical cases, to the Board and Supervisory Board. It aligns with the UN Convention against Corruption, to which the Czech Republic is a signatory state, and was last reviewed in 2025 (on its two-year cycle).

Mandatory annual one-hour compliance training, due within three months of hire and annually thereafter, covers conflicts of interest, anti-bribery and corruption, extending to Board members (not required for the Supervisory Board). 2025 coverage: 98% of at-risk staff, 86% of Board of Directors (9,969 total completions; 2024: 98% / 81%, 10,105 completions).

Targets related to business conduct

Back-filled under the pre-2025/2026 MDR-T framework (this report is prepared under the 2023 ESRS, which had no standalone G1-3 targets DR; business-conduct targets/effectiveness-tracking fell under MDR-T).

No numeric business-conduct target is stated, but effectiveness is tracked in its absence, satisfying MDR-T's alternative limb. Compliance-training coverage is measured and compared year over year -- 98% of at-risk staff and 86% of the Board of Directors completed anti-corruption/anti-bribery training in 2025 (G1-3, page 388) -- with overdue completions "regularly reported to the employee's manager." Corruption-incident monitoring is likewise tracked: the Group runs an internal fraud-detection system alongside whistleblowing and reports zero convictions for anti-corruption/anti-bribery violations in both 2025 and 2024 (G1-4, page 388). Whistleblowing-programme effectiveness is reported semi-annually to the Ethics Committee and Board (G1-1, page 388).

Incidents of corruption or bribery

Reference: page 388.

Cases are typically triggered by whistleblowing investigations or the Group's internal fraud detection system, which monitors for suspicious behaviour proactively rather than relying on whistleblowing alone; the Group also runs regular background checks on suppliers and other third parties to avoid conflicts of interest. "There were no convictions (2024: 0) related to violation of anti-corruption and anti-bribery laws within the Group in 2025. Therefore, no fines were imposed, and the Group did not need to take any actions to address breaches in anti-corruption and anti-bribery procedures and standards." This has not been validated by any external body.