Adyen

The role of the administrative, management and supervisory bodies

Reference: pages 76-77; composition and diversity datapoints incorporated by reference to the Corporate governance chapter (page 51) and to the DEI diversity tables (pages 130-131).

Listed in the ESRS content index as covered by "(a) The role of the administrative, management and supervisory bodies (b) DEI Sustainability Statement - Diversity metrics within our workforce (c) Corporate governance report" (page 92).

Adyen has a two-tier board: "The Management Board and Supervisory Board are our administrative, management, and supervisory bodies" (page 76). Within the Management Board the two Co-CEOs, the CFO, the CRCO and the CHRO "are each responsible for the management of specific identified material sustainability impacts, risks, and opportunities, including setting targets related to these IROs" (page 76). The Risk Committee and Integrity Risk Committee support the Management Board on risk oversight including sustainability risk.

The Supervisory Board "monitors and advises the Management Board on sustainability matters". Its Audit and Risk Committee "supervises sustainability-related risks, such as anti-financial crime, business conduct, and data privacy and data protection"; the Nomination and Remuneration Committee "oversees matters impacting our employees, including Ways of working, Diversity, equity, inclusion (DEI), and people growth" (page 76).

The ESG Working Group established in 2022 is no longer operational: "Following the successful achievement of its objectives in 2024, the working group is no longer operational. ESG governance is now embedded within the business and across individual functions such as procurement, governance, and controlling" (page 76). The Sustainable impact strategy Working Group, formed in 2024, remains in place with a direct reporting line to the CFO (pages 76-77).

Gender and age composition: Management Board 2 women / 5 men (28.6% / 71.4%), Supervisory Board 3 women / 4 men (42.9% / 57.1%) (page 130). None of the board members are employees of the company (footnote 3, page 76).

Information provided to and sustainability matters addressed by the administrative, management and supervisory bodies

Reference: page 77.

The index points GOV-2 to "The role of the administrative, management, and supervisory bodies" (page 92).

The DMA is the primary channel. "A key component of their involvement in identifying and managing sustainability IROs is through the DMA... Once complete, the DMA outcome is reviewed with the Risk Committee and recommended for approval. It is then approved by the Management Board, discussed by the Audit and Risk Committee, and then subsequently shared with the Supervisory Board" (page 77).

Frequency. "The Sustainable impact strategy Working Group, with input from subject-matter experts across the business, provides the Management and Supervisory Boards with a quarterly overview of identified material matters. This update enables the Boards to assess Adyen's sustainability progress, oversee any major transactions, consider potential trade-offs and make informed decisions on strategic adjustments and resource allocation" (page 77). Targets for material sustainability matters "are reported quarterly to the Management and Supervisory Boards" (page 82).

At Supervisory Board level the cadence is lighter: "The Company's overall ESG strategy and activities are discussed at the Supervisory Board level on at least an annual basis. In 2025, the material ESG matters were discussed at least once, and more frequently when necessary, in Supervisory Board and Committee meetings" (page 77).

Expertise. "Building on the assessment performed in 2024, the Management and Supervisory Board members possess the collective expertise... Where knowledge gaps exist, the boards draw on internal and external experts" (page 77). No new 2025 self-assessment is described.

Integration of sustainability-related performance in incentive schemes

Reference: page 77.

A nil return, stated plainly: "Adyen does not currently have any incentive schemes or remuneration policies linked to sustainability matters for members of its Management Board or Supervisory Board" (page 77).

The index lists GOV-3 against "Sustainability-related performance in incentive schemes" (page 92), so the disclosure is made and the answer is that no such link exists. No percentage of variable remuneration tied to climate or other sustainability targets is therefore reported, and no GHG-linked element is disclosed anywhere in the statement.

Two sustainability-adjacent incentives are disclosed at levels below the Management Board, and neither is a board incentive scheme:

• Procurement: "we integrated this objective into our procurement function by setting internal targets for procurement managers to secure SCoC adherence" for the updated Supplier Code of Conduct (page 101).
• Commercial: "our team sought to incentivize our account managers to actively promote Adyen Giving by integrating donation volume into their commercial margin targets" (page 137).

This is unchanged from the prior year and is a clear gap against peers that tie executive variable pay to decarbonisation milestones.

Statement on due diligence

Reference: page 78. Also listed in the datapoints table as GOV-4 paragraph 30, SFDR Indicator 10 Table 3 of Annex 1, page 78 (page 96).

Adyen presents the mapping table required by ESRS 2 GOV-4, covering all five core elements (page 78):

• A. Embedding due diligence in governance, strategy and business model: the Sustainable impact strategy section and the Double materiality assessment section, with governance on page 76.
• B. Engaging with affected stakeholders in all key steps: the Engaging with our stakeholders section "and on page 101 - evaluating our suppliers' sustainability journey".
• C. Identifying and assessing adverse impacts: the Double materiality assessment section, page 101, "and in the Climate and environmental risk assessment section".
• D. Taking actions to address those adverse impacts: "the Climate actions section and in the Carbon removals section. We take further action to prevent potential impacts through the implementation of our Supplier Code of Conduct."
• E. Tracking the effectiveness of these efforts and communicating: "the Climate targets and metrics section".

The framing is explicit: "Responsible business conduct is fundamental to our license to operate. To effectively identify, monitor, and mitigate impacts across our value chain, we integrate environmental and social due diligence into our core operations" (page 78).

Worth noting that every row of the table points at climate or supplier content. With one material impact (value chain GHG) and the remaining material matters framed as risks and opportunities, the due diligence account is narrow by design rather than by omission.

Risk management and internal controls over sustainability reporting

Reference: page 79.

Who prepares the statement. "The Sustainability Statement, including all relevant data points, is prepared by the ESG reporting team, which sits in Adyen's Group Finance function. This report is written with support from subject matter experts across the business" (page 79).

The main risk, named. "Within sustainability reporting, Adyen identifies the key risk of using incomplete or inaccurate data" (page 79).

Four mitigations are disclosed (page 79):

1. Risk assessments feeding off the Risk management section's event identification process, covering "those which could impact the quality of Adyen's sustainability reporting and our ability to comply with ESG reporting standards".
2. Systems: "Our current processes are a mix of data management platforms and manual processes. We are continuously exploring solutions that will further enhance our data collection, efficiency, and quality."
3. Internal controls: "Sustainability reporting controls have been part of Adyen's Internal Control System (ICS) since 2023 and continue to be matured taking into account the latest results from risk assessment (e.g. DMA) and control testing."
4. Internal reporting: findings from evaluation of the ESG controls framework "are shared with the Supervisory Board, Management Board and the Risk Committee on an ongoing basis".

The admission that processes remain "a mix of data management platforms and manual processes" is the candid part, and it sits alongside the Scope 3 uncertainty disclosure on page 75. No control deficiencies or remediation actions are reported for 2025.

Strategy, business model and value chain

Reference: page 80; incorporated by reference to Business strategy and the headcount graph in the Management Review (page 92).

Business model. "Adyen's business model is centered on a single platform, built in-house... Structured across three commercial pillars - Digital, Unified Commerce and Platforms" (page 80). "By building and operating our own platform, we retain clear oversight of our value chain and reduce exposure to sustainability risks linked to third-party dependencies" (page 80).

Inputs and outputs. Inputs are "our technical and commercial expertise from the Adyen team, continuous customer feedback, licenses, software, hardware, data centers, and transaction data". Beneficiary groups named are customers, employees, investors and nonprofit organisations (page 80).

Value chain. "Our upstream value chain consists of suppliers and vendors that support our platform. This primarily includes the manufacturing of our physical products, like POS terminals, the inbound logistics... and the providers of our data centers and payment partnerships." Downstream covers outbound distribution, merchant use and end-consumers across "hospitality, food & beverage, retail, and e-commerce" (page 80).

New in 2025: a supplier hot-spot screen. "In 2025, we deepened our understanding of our upstream value chain by conducting an assessment of the impacts and risks associated with our direct suppliers", mapping "identifying and mapping our key upstream" hot-spot segments, which it names as data centres and hardware manufacturing, and cross-referencing supplier data against "the WWF's Biodiversity & Water Risk Filters, the ITUC Global Rights Index and the Walk Free Global Slavery Index" (page 80).

The result is a single material value chain impact: "The assessment confirmed that the only material impact connected to our value chain is the greenhouse gas (GHG) emissions across our full value chain - upstream and downstream" (page 80). Supplier engagement "accounted for 43% of our reported emissions data in 2025".

No revenue breakdown by ESRS sector is given; revenue is cross-referenced to Note 2 of the financial statements.

Interests and views of stakeholders

Reference: pages 84-86; workforce-specific engagement on page 114.

Stakeholder groups. "Consistent with our 2024 assessment, our key stakeholders include employees, our customers, shareholders, suppliers, regulators, nonprofit partners, and society at large" (page 84). Pages 85-86 set out, per group, how Adyen engages and what it takes from the engagement.

Examples given: employees via the annual culture and inclusion (C&I) survey, Employee Resource Groups and DEI Committees; customers via Net Promoter Score surveys and account management; shareholders via the AGM, quarterly earnings calls and investor meetings; suppliers via onboarding, the DMA, procurement meetings and site visits; nonprofit partners via Nonprofit Partner Days and skills-based volunteering; regulators via formal meetings on a pre-defined cadence (pages 85-86).

How views reach the boards. "The outcomes of these engagements are reviewed by our leadership teams and Management Board... The way the stakeholder views are shared with leadership differs depending on the stakeholder group and the frequency and format of engagement. For example, views from employees are shared annually as part of our culture and inclusion (C&I) survey results, whereas the views from customers are reviewed on an ad hoc basis" (page 84).

Two complementary routes. "First, our ongoing engagement activities enable us to gather continuous input and act quickly on concerns or expectations as they arise. Second, the DMA process provides a structured and periodic assessment" (page 84).

A limitation is disclosed without being labelled as one: the last structured gathering of external stakeholder insight was in 2024. "In addition to our ongoing and ad-hoc engagement with external stakeholders, one of the key moments in which we gathered insights was as part of the DMA process in 2024" (page 84), and the 2025 review was a targeted refresh rather than a full reassessment (page 87).

Material impacts, risks and opportunities and their interaction with strategy and business model

Reference: pages 89-90. Paragraph 48(e) (anticipated financial effects) is excluded under the ESRS 1 Appendix C transitional provisions (page 75).

The material IRO table (page 89) carries 12 typed rows across 10 material sustainability matters, each with financial materiality, impact materiality, ESRS mapping, value chain location and time horizon:

• Environmental: Climate change (E1), an actual negative impact, upstream. "Although we are not heavily involved in high-emission-intensity activities, the greenhouse gas (GHG) emissions from energy use in operations and the value chain contribute to" and "cause widespread environmental harm such as rising global temperatures, extreme weather events, and disruption of ecosystems". Financial materiality: Not material.
• Social: Ways of working (S1, opportunity); DEI (S1, actual positive impact); People growth (S1, actual positive impact and opportunity); Social impact (entity specific, potential positive impact, "currently unmeasured and therefore considered a potential positive impact"); Impact technology (entity specific, actual positive impact).
• Governance: Business conduct, split in 2025 into two G1 risks (anti-bribery and corruption; protection of whistleblowers) plus Responsible tax practices (entity specific); Data privacy and data protection (S4, risk); Anti-financial crime (entity specific, risk).

Notably, every governance and S4 matter is a risk with impact materiality "Not material", and every E1 row is an impact with financial materiality "Not material" (page 89). The company identifies no material negative social impacts at all.

Resilience. "We consider our strategy and business model to be resilient and well-equipped to manage the aforementioned identified risks while maximising our opportunities... We perform resilience analysis in the form of stress testing as outlined further in the Risk management section" (page 90). The explicit gap: "While we do not yet have a complete view of the current and expected financial effects of our material sustainability risks and opportunities" (page 90).

Climate-specific risk identification and scenario analysis is also presented under E1-2 (2025 ESRS numbering), and the resilience conclusion under E1-3.

Description of the processes to identify and assess material impacts, risks and opportunities

Reference: pages 87-88.

2025 was a targeted review, not a new DMA. "Building on the DMA conducted in 2024, Adyen continues to rely on the outcomes and methodology established through that assessment, which remains valid... A full reassessment was not performed, as there were no significant changes to Adyen's business model or strategy" (page 87). The illustration of the 2024 approach "is included for reference" from the 2024 Annual Report.

Five steps are disclosed (pages 87-88):

1. Review of the regulatory and reporting landscape, including the EU Omnibus Simplification Package. "As these amendments are still at the proposal stage, they were not applied in the 2025 review."
2. Evaluation of internal and external developments: "shifts in geopolitical, social, and market conditions", new products and business processes. "These assessments indicated that the existing IROs continue to reflect Adyen's material topics".
3. Reviewing materiality criteria and thresholds: unchanged. Impact materiality used "scale, scope, irremediability (if negative in nature) and likelihood (if potential)". Financial materiality used "a threshold based on a combination of the likelihood of occurrence and the potential magnitude of the financial effects".
4. Refining and scoring existing IROs, guided by peer benchmarking, which "confirming the necessity of entity-specific material topics, such as 'Impact technology,' given our unique global financial technology platform model".
5. Assessing Adyen's value chain, newly extended to direct suppliers, concluding that "the only material impact within Adyen's value chain relates to greenhouse gas (GHG) emissions across our full value chain".

Changes from 2024 (pages 75, 88): Information security folded into a new "Data privacy and data protection" topic; "Company culture" renamed "Ways of working" and reframed as an opportunity only; "Learning & development" renamed "People growth"; Business conduct "further broken down into distinct sub-risks".

The DMA also functions as a risk process: "the assessment of financial materiality also feeds into our wider consideration of business risks" (page 88). No materiality thresholds are quantified and no scoring scale is published.

Disclosure requirements covered by the sustainability statement

Reference: pages 91-96. The index itself runs pages 92-95, with the datapoints-from-other-EU-legislation table on page 96.

Adyen prints a genuine ESRS content index with three columns: disclosure description, reference in the report, and explanatory note (page 92). It covers ESRS 2 (BP-1, BP-2, GOV-1 to GOV-5, SBM-1 to SBM-3, IRO-1, IRO-2), E1, S1, S4, G1 and the MDRs for four entity-specific matters.

Topical standards used (page 91): "Climate change (E1), Ways of working (S1), DEI (S1), People growth (S1), Data privacy and data protection (S4), Business conduct (G1)". Entity-specific matters, disclosed with MDRs only: "Social impact, Impact technology, Anti-financial crime, Responsible tax practices (as part of Business conduct)".

Four blanket notes apply across disclosures (page 91): there are matters "for which we do not have a formal policy in place" and an approach is disclosed instead; actions "did not require significant investment to complete" with related spend sitting in Wages and Salaries; metrics "are not validated by a third party, that isn't our assurance provider"; and for targets, "there are some sustainability matters for which we prefer to adopt an approach of flexibility and continuous improvement. Wherever this is the case, we have provided a clear and transparent explanation for not having targets in place."

Out-of-scope paragraphs are flagged in the index: E1-1 paragraphs 14, 15 and 16; E1-5 paragraphs 38(a)-(d), 39 and 40-43; E1-6 paragraph 48(b); E1-7 paragraph 61; S1-17 paragraph 104; S4-1 paragraphs 16 and 17; S4-4 paragraphs 31, 32, 33(b), 34, 35 and 37 (pages 92-94).

Two defects in the index are worth a reader's attention. First, E1-4 has no row in the main table (the table runs E1-1, E1-2, E1-3, then E1-5), yet the datapoints table lists "E1-4 GHG emission reduction targets paragraph 34" at page 99, where a full targets section does appear. Second, the same table lists "E1-1 Undertakings excluded from Paris-aligned benchmarks paragraph 16 (g)" at page 98, but no benchmark-exclusion statement appears on page 98 or anywhere else in the report.

Closing note: "Other data points listed in ESRS 2 Appendix B, which are not included in the table above, are considered either not material or not relevant for Adyen" (page 96).

Transition plan for climate change mitigation

Reference: page 98. The index lists E1-1 against "Climate change Sustainability Statement - 'Our Climate transition plan'" with the explanatory note "ESRS E1-1 paragraphs 14, 15, 16 are out of scope" (page 92).

There is no transition plan yet. "We are progressing toward a Paris-aligned Climate transition plan (CTP), with a strong focus on concrete actions to mitigate our negative impacts. While no formal timeline has been set for full alignment, we have identified 2026 as a key period to advance the development of the climate transition plan and work towards its integration into our broader business strategy" (page 98).

What exists instead are two near-term targets: "As we continue to develop our climate transition plan, we have already set two science-based near-term targets. These targets, described further in the section below, reflect our current emissions profile and focus on our largest reduction opportunities, namely Scope 2 and our significant Scope 3 categories" and "While we recognize that additional steps are required to complete our long-term climate" "transition plan, we are encouraged by our current momentum" (page 98).

Value chain framing. "As a financial technology platform, most of our emissions occur in our value chain. Collaborating with suppliers is therefore essential to achieving meaningful reductions." The supplier engagement target is "developed in accordance with SBTi criteria consistent with a well-below 2°C pathway" and "currently covers more than half of our total Scope 3 footprint" (page 98).

Locked-in emissions: a nil return. "We have assessed for assets and business activities incompatible with a climate-neutral economy and determined that we hold no long-lived or carbon-locked assets" (page 109), supported by "Approximately 93% of our total assets have a maturity of less than 30 days" (page 109).

No net-zero target: "Adyen has not set a formal net-zero target" (page 108). No CapEx or OpEx is allocated to the plan (page 91), and the EU Taxonomy KPIs are deferred under the 2026 simplification relief with "No activities... claimed as being associated with economic activities that qualify as environmentally sustainable" (page 110).

The index's note that paragraphs 14 to 16 are out of scope sits awkwardly with the datapoints table, which cites E1-1 paragraph 14 at page 98 (page 96).

Identification of climate-related risks and scenario analysis

Back-filled from the Climate and environmental risk section, where this content is disclosed in the FY2025 report (pages 108-109), together with ESRS 2 IRO-1 (pages 87-88). This disclosure requirement did not exist under the 2023 ESRS the report was prepared against.

The assessment dates from 2023 and was not refreshed in 2025. "In 2023, Adyen conducted a comprehensive assessment of our Climate & Environmental (C&E) risk. A thorough review of asset maturity, merchant base, and geographical exposures determined that Adyen has low residual risk exposure to both physical and transition risks" (page 108). "To ensure continuous monitoring of C&E risk exposure, this in-depth assessment will be conducted regularly" (page 109), with no date given for the next iteration.

Physical and transition risks are classified separately (paragraph 15), through "a three-step approach: (1) applying scenario analyses to Adyen's business model for both physical and transition risks, (2) conducting four top-down assessments across key C&E dimensions, and (3) performing a detailed bottom-up matrix risk analysis" (page 108).

Methodology and exposure (paragraph 16): "For each major financial risk type such as credit, market and operational risk, transmission channels were qualitatively assessed across short-, medium- and long-term horizons... We also used geospatial coordinates for our key locations to ensure a relevant, location-specific analysis" (page 108). Horizons are short 1 year, medium 3 years, long 10 years (page 108), which differ from the DMA's ">5 years" long term (page 75).

Scenarios used (paragraph 17). Physical: a high-emission NGFS pathway, "a high physical-risk scenario, referred to as 'Current Policies,' over a ten-year forecast period. This scenario reflects a world in which limited additional climate policy is introduced and where continued high emissions lead to substantial global warming" (page 109). Transition: "a high-transition-risk scenario from the Network for Greening the Financial System called 'Divergent Net Zero'... a disorderly transition to net-zero emissions by 2050" where "global warming slightly overshoots 1.5°C before returning below that threshold by 2100" (page 109).

Assumptions. "Both scenarios incorporated macroeconomic variables such as GDP growth, exchange rates, and policy interest rates" (page 109). "For short-term physical risks, Adyen" "developed stress-test scenarios reflecting plausible near-term climate hazards that could affect operations" (pages 108-109); no short-term transition stress test was run because "Transition-related risks typically materialize over a longer time horizon of ten years or more" (page 109).

Gap against paragraph 17(a)(iii): no global average temperature projection is given per scenario beyond the qualitative descriptions above.

Resilience in relation to climate change

Back-filled from ESRS 2 SBM-3 "Our business resilience" (page 90) and the quantified scenario results in the Climate and environmental risk section (page 109), where this content is disclosed in the FY2025 report. This disclosure requirement did not exist under the 2023 ESRS the report was prepared against.

Results of the analysis (paragraph 19(a)). "The qualitative findings demonstrate high resilience: under the high-transition risk scenario, the impact on net income before taxes is projected not to exceed 2% over the long term. Conversely, this scenario highlighted a potential financial opportunity where projected rises in global interest rates could increase our net financial income. Under the high-physical risk scenario 'Current Policies,' the maximum modelled impact on net income was a decrease of less than 3.5%" (page 109). "Our climate analysis is compatible with our financial statements due to it being based on our 10-year forecast model at a consolidated level" (page 109).

Implications for strategy and business model. "Integrating sustainability matters into our strategy and decision-making is fundamental to our business resilience... We consider our strategy and business model to be resilient and well-equipped to manage the aforementioned identified risks while maximising our opportunities, ensuring sustainable growth over the long term. We perform resilience analysis in the form of stress testing as outlined further in the Risk management section" (page 90). "As a result, we have maintained our strategic focus and initiatives without requiring significant changes to our business model or operations" (page 90).

Where resilience is weakest, stated candidly. "the assessment of C&E risk in relation to inherent operational risk identified areas of higher risk, particularly due to the physical climate impact on data centers, platform availability, and business continuity. As a core element of Adyen's strategy is to sustain service availability even under severe stress conditions, the impact of such events is largely mitigated" (page 109).

Areas of uncertainty (paragraph 19(b)). "While we do not yet have a complete view of the current and expected financial effects of our material sustainability risks and opportunities, we are continuously embedding the implications of new directives and regulations into our strategy and business model" (page 90).

Capacity to adapt (paragraph 19(c)). Addressed through asset maturity rather than asset flexibility: "Approximately 93% of our total assets have a maturity of less than 30 days, resulting in a negligible risk of value impairment due to climate-related transition impacts", and "Adyen holds no material long-lived assets at risk of becoming 'stranded'" (page 109). No discussion of financial resources available for adaptation investment is given.

Policies related to climate change mitigation and adaptation

Reference: page 98. The index lists E1-2 against "Climate change Sustainability Statement - 'Our policy and approach'" (page 92).

An approach, not a formal policy. The climate content sits under "Our policy and approach": "Guided by The Adyen way of building an ethical business, our approach to climate change prioritizes targeted mitigation across our key hotspots. We identify our hotspots by understanding our direct and indirect emissions through our annual GHG inventory" (page 98). The blanket note on page 91 explains the pattern: "there are some sustainability matters for which we do not have a formal policy in place. In these instances, we have instead disclosed our approach".

Three key elements, "which remained unchanged in 2025" (page 98):

• "A commitment to quantifying, monitoring, and accounting for our environmental footprint."
• "A key focus on reducing the impact of emissions from energy consumption in our offices and data centers, representing a large portion of our combined purchased and acquired electricity and energy, and the hardware purchases that consume energy to power Adyen's platform."
• "To minimize the carbon footprint of our infrastructure hardware procurement, we consider sustainable procurement guidelines that incorporate Life Cycle Assessment (LCA) data, supplier emissions reduction targets, and ESG scores."

Scope: "Our approach applies to our whole global operations." Accountability: "Our CFO oversees the Sustainable impact strategy Working Group and retains responsibility for our climate change approach, upholding accountability to the Supervisory Board." Accessibility: available externally "via The Adyen way of building an ethical business document, available on our website at investors.adyen.com/governance" (page 98).

Renewable energy is the stated lever: "During 2025, we increased our portion of total scope 2 renewable energy consumption from 69% to 83%" (page 98).

The approach is mitigation-only. No adaptation policy is disclosed, consistent with the 2023 conclusion of "low residual risk exposure to both physical and transition risks" (page 108), though it leaves the data centre physical risk identified on page 109 without a matching policy statement.

Actions and resources in relation to climate change policies

Reference: pages 100-101. The index lists E1-3 against "Climate change Sustainability Statement - 'Actions'" (page 92).

Three 2025 actions are disclosed, all global: "In 2025, we took the following steps to engage key parts of the business on our near-term climate targets, ensuring a globally aligned approach rather than region-specific actions" (page 100).

1. Embedding environmental criteria in data center evaluation (Scope 2). "a sustainability section is now a mandatory component of the white papers used by our senior leadership for site approval... we progressed from using estimations in 2024 to 100% primary energy consumption data in 2025 for our analysis. Our evaluation criteria now include a site's carbon intensity, use of renewable energy, Power Usage Efficiency (PUE), potential for future emission reductions" (page 100).

2. Integrating sustainability into our global workplace (Scope 2). "we achieved 100% primary data coverage for our data centers and secured primary data for 16 of our 32 global" (page 100) "offices, up from 13 in 2024. This improved granularity enabled us to verify that our major EMEA offices operate on renewable energy, a confirmation that was not previously possible" (page 101). Rollout continues "with a prioritized focus on our top 10 largest offices and locations where we have higher operational control" (page 101).

3. Evaluating our suppliers' sustainability journey (Scope 3). "our focus in 2025 shifted towards broader engagement and expanded to include all strategic partners. We launched an initiative to drive the adoption of our updated Supplier Code of Conduct (SCoC) across these partners... we expanded our data engagement by formally requesting GHG accounting capabilities and LCA data from key hardware partners" (page 101).

Resources: none quantified, and the reason is given. "While we have not yet modelled specific carbon reductions from these actions, embedding sustainability requirements into procurement negotiations has established the governance needed to drive reductions going forward" (page 101). Across the statement, "our actions are executed internally and did not require significant investment to complete. This means that related capital and operational expenditure primarily relate to cost accounted for as part of 'Wages and Salaries'" (page 91).

Adaptation actions are not disclosed under E1-3; the nearest content is the operational-risk finding on data centre physical exposure (page 109).

Targets related to climate change mitigation and adaptation

Reference: pages 99-100. E1-4 has no row in the main ESRS content index table (pages 92-93 run E1-1, E1-2, E1-3, then E1-5), but the company's datapoints table lists "E1-4 GHG emission reduction targets paragraph 34" with a page reference to 99 (page 96), and a full targets section appears there.

Two targets, both near-term, neither an absolute GHG reduction target (page 99):

Baseline. "Progress toward these time-bound goals is measured against a 2023 baseline. As our second year of comprehensive measurement, 2023 reflects normal operating conditions... We have not yet set interim milestones for these targets" (page 99). Baseline value for the renewable target is 75% (page 99).

Methodology, target 1. "The renewable energy target reflects the proportion of market-based Scope 2 emissions relative to location-based Scope 2 emissions... Renewable energy proportions are based on standard grid factors unless an energy supplier provides a detailed breakdown (primary data)." Scope: "Adyen's office locations and global data center locations" (page 99).

Methodology, target 2. "We assess suppliers based on their own alignment with the Science Based Targets initiative (SBTi) or core climate science criteria... We utilize the public SBTi database supplemented by manual verification of our top suppliers' public climate disclosures" (page 100). The 2028 year "was selected to align with SBTi criteria, which require supplier engagement targets to be achieved within five years of the baseline (2023)" (page 100).

A self-reported shortfall against SBTi guidance: "our supplier engagement target currently covers over 50% of our Scope 3 emissions, based on our 2025 GHG inventory. As it does not cover at least 67% of total Scope 3 emissions, as required under SBTi's guidance, we will continue to assess how best to address the remaining Scope 3 emissions through our CTP" (page 100).

Uncovered categories. "For the remaining Scope 3 categories, we are still assessing the most appropriate target-setting methodology. These categories include business travel (Category 6) and the use of our In-Person Payments (IPP) products (Category 11)" (page 99). No changes were made to either target versus 2024, and no adaptation target is set.

Energy consumption and mix

Reference: page 102. The index lists E1-5 with the note "ESRS E1-5 paragraphs 38a,b,c,d, 39 and 40-43 are out of scope" (page 93), so no high-climate-impact-sector breakdown, no energy intensity per net revenue and no non-renewable production figures are given.

Total energy consumed rose 57%, from 34,815 MWh in 2024 to 54,623 MWh in 2025 (page 102):

Methodology. "To determine our reported energy mix, site-level energy consumption data is aggregated and standardize to MWh. We incorporate categorized regional and national grid electricity production mixes from credible sources such as EPA eGRID and IEA to calculate the mix across both Scope 1 and Scope 2." Scope: "Adyen's office locations and global data center locations" (page 102).

The increase is partly a data-quality artefact, and the company says so: the stated change versus 2024 is "Moved from estimated usage to primary data for data centers and key offices" (page 102). Elsewhere: "In 2025, we significantly improved our data quality, achieving 100% primary data coverage for our data centers and expanding primary data collection to 16 of our 32 global offices, up from 13 in 2024... In 2025, the portion included a total of 22,516 MWh in purchased RECs. This figure reflects our improved data quality which incorporates actual consumption data from all data centers rather than estimated usage" (page 100).

The whole renewable figure is therefore contractual rather than physical: 22,516 MWh of purchased Renewable Energy Certificates, with zero self-generation. Fossil fuel remains the majority of consumed energy at 55%.

Gross Scopes 1, 2, 3 and Total GHG emissions

Reference: pages 103-105. The index notes "ESRS E1-6 paragraph 48b is out of scope" (page 93).

Total emissions rose, and the company states it plainly (page 103):

Intensity per net revenue (an entity-specific metric): market-based 35 tCO2e per EUR million (2024: 36), location-based 42 (2024: 40), on net revenue of EUR 2,364 million (2024: EUR 1,996 million) (page 103).

The candid sentence: "While we have not yet achieved a reduction in our absolute GHG emissions, we are observing a decrease in market-based emissions intensity. As our operational scale continues to expand, absolute emissions alone are not a sufficient indicator of performance" (page 103).

Method. Operational control boundary, GHG Protocol Corporate Standard, IPCC AR5 GWPs, all seven gases; "As all our subsidiaries are fully owned, our GHG inventory covers our entire Consolidated group" (page 102). Scope 2 location-based rose 47% "primarily driven by increased energy consumption of our data center sites and global offices"; market-based fell 22% "This reduction reflects the Renewable Energy Certificates (RECs) purchased on our behalf and demonstrates our continued commitment to prioritizing infrastructure partners who run on renewable energy" (page 104).

Restatements are disclosed line by line (page 103): Category 1 from 32,794 to 35,170; Category 2 from 1,982 to 6,043; Category 6 from 15,938 to 13,820; Category 11 from 17,283 to 3,840. Reasons given are a finer goods-and-services classification, reallocation of capitalised hardware spend from Category 1 to Category 2, a new travel provider with a distance-based method, and "In 2025, we corrected a calculation regarding the operational usage assumptions for our in-person payment terminals regarding device sleep and standby modes" (pages 104-105).

Data quality. "Supplier-provided activity-based data currently accounts for 43% of our reported Scope 3 emissions" (page 104). Categories 5, 8, 10, 13, 14 and 15 are assessed as not significant (page 105). Adyen "does not participate in any regulated emission trading schemes" (footnote 12, page 103).

GHG removals and GHG mitigation projects financed through carbon credits

Reference: page 107. The index notes "ESRS E1-7 paragraph 61 is out of scope" (page 93). The datapoints table cites E1-7 paragraph 56 at page 107 (page 96).

No removals in the value chain; purchased durable removals outside it. "Across three procurement cycles, we have contracted 19,498 tCO2e from eleven projects spanning seven removal pathways across the EU, LATAM, APAC, and North America." The active portfolio "(inventory and outstanding deliveries) stands at 17,083 tCO2e" (page 107).

Portfolio by pathway (page 107): Mineralisation 4,928 tCO2e (29%), Enhanced Weathering 3,740 (22%), Biochar 2,500 (15%), BECCS 2,000 (12%), Marine CDR 1,622 (9%), Other Biomass CDR 1,293 (8%), Direct Air Capture 1,000 (6%). "In accordance with ESRS classifications, 6% are Technological (DAC) and 94% are Hybrid (all other pathways)."

Retirements began this year. "In 2025, we retired carbon removal credits for the first time, beginning with credits sources from the Andes and Sonnenerde projects... In 2025, 2,415 tCO2e were formally retired" (page 107).

Quality and claims. "Of the active portfolio, 40% is to be verified under Isometric, 29% under Puro.earth, and 31% under supplier-specific standards or pending final registry identification/certification." "None of the credits procured to date have been issued with a corresponding adjustment under Article 6 of the Paris Agreement" (page 107).

No neutrality claim is made, twice over. "As Adyen follows a contribution-based approach, these retirements are not used to make offsetting or carbon neutrality claims" (page 107), and "Adyen has not set a formal net-zero target. We pursue a contribution-based approach, meaning we retire these credits to support global decarbonization efforts and do not make claims of carbon neutrality against them" (page 108).

Project-level detail is given for O.C.O Technology, InPlanet, Charm Industrial, Equatic, UNDO, Vesta, Sirona, Stockholm Exergi and Carboneers (pages 107-108), including that O.C.O "successfully delivered to Adyen its full commitment of 3,428 tCO2e of verified, high-durability carbon removals".

Not disclosed: the monetary amount spent on the portfolio, and any breakdown of credits by reduction versus removal beyond "100% of our portfolio consists of carbon removal projects".

Internal carbon pricing

Reference: page 106. The index lists E1-8 against "Climate change Sustainability Statement - 'Internal carbon pricing'" (page 93).

Price and basis. "The internal carbon price is set at $100 per metric ton of CO2e" (page 106, methodology column). "This price is set in reference to the UN Global Compact's recommendation and is consistent with emerging reference carbon price discussions in the latest SBTi Corporate Net-Zero Standard draft", and "We view this price as a forward-looking signal that reflects the increasing cost of credible climate action" (page 106).

Type: a shadow fee funding removals. Two stated objectives: "Incentive alignment: Embedding the cost of carbon into internal financial planning and operational decision-making" and "Capital allocation: Funding high-durability carbon removal in line with our climate contribution approach" (page 106). "The contribution amount is calculated as a shadow fee. We multiply the total gross emissions from the in-scope categories by the $100 price. This calculated fee determines our financial commitment to carbon removal initiatives" (page 106).

Coverage (page 106):

The 2025 change. "we expanded the scope of this mechanism to include Scope 2 (market-based) emissions, in addition to Scope 1 and Scope 3 Category 6 (business travel) emissions covered in prior years. The mechanism now covers 100% of our direct emissions and approximately 22% of our total Scope 1, 2, and 3 footprint. We prioritize these categories as they represent areas where we have the most direct operational control" (page 106).

"By design, this mechanism structurally integrates climate responsibility into our growth model: as emissions increase or decrease, the financial allocation toward carbon removal scales accordingly" (page 106). 2024 figures "are not restated to ensure consistency with the original Carbon Budget cap" (footnote 17, page 106).

At $100 per tonne on 18,494 tonnes the implied 2025 contribution is in the order of USD 1.8 million, but the monetary amount is not disclosed, nor is the price differentiated by business unit or geography. Coverage excludes 78% of the footprint, including Categories 1, 2 and 11, which together account for 57,805 tCO2e (page 103).

Policies related to own workforce

Reference: pages 116, 119, 123, 142. The index routes S1-1 to seven separate places: the DEI Policy, "Business conduct Sustainability Statement - 'Respect for human rights'", the DEI prevention-of-discrimination subsection, the Adyen Formula, Normal Course of Life, No Blush, and People growth's "Our policy and approach" (page 93).

DEI Policy is the one formal, board-endorsed policy: "Our DEI Policy was revised and endorsed by the Management Board and Supervisory Board and published in November 2025" (page 123), with three commitments on senior leadership representation, hiring and growth from all backgrounds, and an inclusive environment. It "remains aligned with Best Practice Provision 2.1.5. of the Dutch Corporate Governance Code" and is supported by an Equal Employment Opportunity Policy and the principle of "Equal Pay for Equal Work" (page 123). Publicly available at investors.adyen.com/governance.

Inappropriate Behavior Policy "applies to all employees and covers all forms of discrimination, violence, and harassment. We do not limit specific grounds for discrimination, rather we consider any and all forms of discrimination in breach of our policy" (page 123). The Integrity Risk Committee upholds adherence (page 124).

Ways of working and People growth have no formal policy, by choice. "The Adyen Formula, and its key principles, guide our ways of working", and there is no intention to codify it: "We do not plan on" "developing a formalized policy. We strongly believe that the success we have achieved as a company, is tied to our Formula and the autonomous, and high-performing culture we have created" (page 116). For people growth: "Our approach to people growth is not reflected in a formalized policy. Instead, it builds on Adyen's L&D practices and is rooted in our culture of autonomy" (page 119). The Normal Course of Life and No Blush policies are described at page 116 and all three "apply to all Adyen employees globally".

Human rights. "we require our suppliers to share our commitment to responsible business practices... our Supplier Code of Conduct, which was introduced in 2024, includes a dedicated clause on human rights" (page 142), aligned with the UN Guiding Principles on Business and Human Rights (footnote 34, page 142).

An explicit paragraph 22 carve-out: "With regards to S1-1 paragraph 22, Adyen does not have explicit policies addressing trafficking in human beings, forced labor, compulsory labor, or child labor, as these are not considered material risks within our workforce" (footnote 33, page 142).

Processes for engaging with own workforce and workers' representatives about impacts

Reference: page 114, under "How we engage with our people"; participation metric on page 117.

Adyen engages directly rather than through representatives. "We engage with our team through consistent and established processes on matters related to people growth and DEI, which are topics identified as material from an impact perspective" (page 114).

Three channels (page 114):

1. The annual culture and inclusion (C&I) survey, "our primary way of gathering anonymized feedback at scale from our team members across the company. It provides valuable insights into workplace culture, employee experience, and the effectiveness of our initiatives... It also gives us insights into the experiences of different demographic groups within Adyen, especially under-represented groups". Participation was 87% in Q2 2025 (2024: 88%), with the Chief Commercial Officer acting as sponsor; "Sponsorship changes each year to demonstrate commitment at the highest level" (page 117).
2. Employee Resource Groups, "self-led and organized by employees" with DEI programme managers accountable for governance, and executive sponsorship by a senior leadership team member for ERGs in North America, Latin America and EMEA. "We are in the process of exploring a similar approach for APAC" (page 114).
3. DEI Committees in North America, Latin America and EMEA, each with two ERG leads per group, connecting "at least on a quarterly basis to align on strategic initiatives in partnership with senior leadership, HR and DEI Program Managers" (page 114).

Limits the company names itself. "gathering and interpreting data across a global organization presents inherent challenges. DEI initiatives must reflect local contexts; what works well in one region or for one underrepresented group may not be effective or appropriate elsewhere... Our data collection practices... are also influenced by varying legal and regulatory requirements across countries. These factors make it more complex to build a complete view of representation" (page 114).

No works council, trade union or other workers' representative body is mentioned, and no global framework agreement is disclosed.

Processes to remediate negative impacts and channels for own workforce to raise concerns

Reference: pages 123-124 and 142. The index routes S1-3 to the DEI prevention-of-discrimination section and to "Business conduct Sustainability Statement - 'Protection of whistleblowers'" (page 93).

Channels. Grievances are "formalized under our Inappropriate Behavior Policy" (page 123), with "Guidance on how to report incidents, which is accessible via our intranet". The whistleblowing route runs "either through a designated whistleblowing platform or directly to the Chairman of the Supervisory Board. Alternatively, reports may be submitted to an independent external whistleblowing body", named as the Dutch Whistleblower Authority of De Nederlandsche Bank (page 141), reflecting Directive (EU) 2019/1937.

New in 2025: "we introduced an additional channel via a third-party platform, for our employees in the Americas to raise concerns, remaining anonymous if they choose. This channel is in addition to our Confidential Advisors, who offer assistance for our Netherlands based employees" (page 123).

Remediation and tracking. "If an incident is formally reported, and meets the definition of inappropriate behavior the report is promptly investigated and acted upon by our HR team. All reported cases are formally tracked in a dedicated system, with timely resolution monitored, and appropriate measures taken to address incidents and prevent recurrence" (page 142). "All incidents of inappropriate behavior, including incidents of discrimination or harassment, are reported to the Integrity Risk Committee as an aggregate on a quarterly basis" (page 142).

Safeguards. "Adyen maintains a strict, zero-tolerance policy against retaliation" (page 142). The Whistleblower Policy "includes safeguards to protect individuals who report, including no-reprisal rights... Whistleblowers always retain the option to report anonymously, and investigations must adhere to strict confidentiality measures that follow the four-eyes principle... only the Vice Presidents of the Second Line are permitted to handle investigations internally, with defined timelines set for each phase" (page 141).

Effectiveness test. "As part of our annual C&I survey we ask our people if they feel they can report unethical practices without fear of consequences and we use these insights as a way to assess the effectiveness of this policy, as well as the effectiveness of our grievance and complaints handling mechanisms" (page 124). The survey result on that question is not published.

Taking action on material impacts on own workforce

Reference: pages 117 (Ways of working), 120 (People growth), 124-125 (DEI).

Ways of working, three action areas (page 117): streamlining ways of working, tracked internally "via our hours-saved initiative", including "a multi-year program to modernize our internal communication and productivity tooling" and design changes to the Tech organisation; embedding leadership expectations, now "reflected in our leadership hiring approach, the design of our leadership development programs, how we assess the performance of our leaders"; and growing our people.

People growth (page 120): the Pay It Forward peer-learning programme, where "Instead of expanding the number of learning ambassadors, we scaled the impact of the program by upskilling our existing ambassadors"; the revamped Own Your Growth programme plus a new "Empower Your Team's Growth program for leaders globally, built around coaching circles"; refreshed Payments Essentials training, to be embedded into onboarding in 2026; academy developments (Tech Academy embedding GenAI, Operations Academy on "new scalable onboarding standards", Commercial Academy standardising "sales qualifications with MEDDIC framework", Marketing Academy on team agility and AI); and "business-driven exchanges on our internal jobs board".

DEI (pages 124-125): first-time participation in "New York City Pride March, the Grace Hopper Celebration in Chicago, and for a third year, in an International Women's Day role model campaign in the Netherlands"; an ERG-sponsored "job seeker mentorship program through Jobs for Humanity"; accessibility in the new Chicago office with "quiet rooms, collaboration areas, working cafés, and phone booths... all-gender restrooms and dedicated rooms for parents and prayer"; inclusive event design at Connect week including "clear signage and sensory maps"; and four training refreshes, notably "Unconscious Bias Training refinement" brought in-house and the "Respectful Workplace Training", revamped from "the former U.S. Anti-Harassment Training" and extended to LATAM.

Resources. "Key actions carried out in 2025 represent business as usual, and no significant additional monetary investments were made" (page 120), consistent with the blanket statement on page 91.

Effectiveness. "A positive trend in progress towards these targets serves as a key measure of the effectiveness of our initiatives" (page 124), measured through the C&I survey delta between under-represented and majority groups (page 124).

Targets related to own workforce

Reference: pages 125-127. The index lists S1-5 against "DEI Sustainability Statement - 'Targets'", and adds that for the other two subtopics "Ways of working and People growth Sustainability Statements - No targets have been set so ESRS 2 paragraph 81 has been applied" (page 93).

Four DEI target groups, all unchanged from 2024 (pages 125-127):

Baselines are given: Supervisory Board 40% women (2022), Management Board 17% women (2022), GLT 54% women (2023); C&I favourability 2pp (2024); unexplained pay cases 135 (2024) (pages 125-127).

Two targets moved backwards in 2025. GLT representation fell from 44% to 34% women and Supervisory Board from 50% to 43%, explained by "the changes in the composition of teams with the addition of new Supervisory Board member Steve van Wyk, and the expansion of our Global Leadership Team" (page 125). "There were no changes to the Management Board in 2025. The current size and composition requires Adyen to set a longer time horizon to achieve this commitment" (page 125).

Monitoring. "We continue to monitor the progress of all targets quarterly via the Management Report, which is submitted to the Management Board and made available to our Supervisory Board. Where indicated, we have directly engaged with our workforce to support the setting of these quantifiable goals" (page 125).

Limits acknowledged. "While our efforts extend beyond gender, we have not set metrics for other areas of diversity" (page 125), and pipeline data is collected for gender in nine countries and race or ethnicity in three only (page 127).

Characteristics of the undertaking's employees

Reference: page 115, "General workforce metrics".

By country, for countries with at least 50 employees representing at least 10% of the total workforce: Netherlands 2,401 (50%), United States 847 (18%), Others 1,532 (32%), total 4,780 (page 115). "Our greatest growth this year came from outside The Netherlands, particularly in the US. This is in line with our previously communicated strategy to grow our North American footprint."

Turnover is reported and explained rather than softened: leavers 677 (2024: 592), turnover rate 14.8% (2024: 13.8%). "When calculating our attrition rate (referred to here as turnover rate) we look at the number of employees who left Adyen in 2025 (disclosed as number of leavers) as a percentage of the average headcount for the financial year." And: "At Adyen, we uphold a high bar for talent... Attrition is a natural extension of maintaining a high performance standard. We believe keeping our attrition rate within a healthy range - specifically for a technology company in its growth phase - is an important element in effectively scaling our team" (page 115).

Not disclosed: breakdown by employee contract type (permanent, temporary, non-guaranteed hours), and the number of employees who left is given as a count and rate without a regional split.

Diversity metrics

Reference: pages 130-131. The index lists S1-9 against "DEI Sustainability Statement - 'Diversity metrics within our workforce'" (page 93), and the datapoints table points GOV-1 board gender diversity paragraph 21(d) to page 130 (page 96).

Gender by management level (page 130):

A third gender category is reported throughout: 27 individual contributors (0.7%) and 1 team lead (0.1%) in 2025 (pages 130-131).

Age by management level (pages 130-131). Management Board: none under 30, 2 aged 30-39, 2 aged 40-49, 3 aged 50 plus. Supervisory Board: 1 aged 40-49, 6 aged 50 plus (85.7%). GLT: 7 aged 30-39, 17 aged 40-49, 5 aged 50 plus. Individual contributors skew young: 1,054 under 30 (26.9%), 2,338 aged 30-39 (59.6%), 440 aged 40-49, 92 aged 50 plus (2.3%).

GLT size grew from 25 to 29 members, 0.61% of employees (2024: 0.57%) (page 131).

Method. "The age diversity of each management level is calculated by dividing the number individuals per age category by the total number" of individuals in that same management level, with age taken from date of birth, "employee's onboarding or in an offline file for our Supervisory Board" being the two capture points named (page 131).

The direction of travel at the top is negative on both the GLT and the Supervisory Board, as the target table on page 125 also shows.

Adequate wages

Reference: page 128. The index lists S1-10 jointly with S1-16 against "DEI Sustainability Statement - Remuneration metrics" (page 93).

The disclosure is a compliance confirmation, stated as a footnote: "All Adyen employees are paid an adequate wage, in line with ESRS S1-10" (footnote 28, page 128). That is a complete nil-exception answer to the requirement: no employee is paid below the applicable adequate wage benchmark, so no breakdown by country of non-compliance is required.

The supporting mechanics are disclosed: "Our base salaries are set using market benchmarks by role, seniority, and location. We ensure that our offers are above the national minimum wage by country and is in line with Adyen's collective bargaining agreements, where applicable" (page 128). And on the wider approach: "At Adyen, our global remuneration approach is designed to attract and retain talent while aligning with our long-term business objectives. We prioritize fair and equitable remuneration and as part of this commitment, we conduct an annual internal audit to ensure we uphold equal pay standards" (page 128).

The equal pay framework sits alongside it: "we continue to uphold the principle of Equal Pay, ensuring the same pay for the same impact in the same role. To meet our commitment to Equal Pay we use industry-benchmarked salary guidance to define remuneration by role and location" (page 127), with a target of zero unexplained cases of salary deviating more than 5% from that guidance, at 75 cases in 2025 against 135 in 2024 (page 127).

What is not given: the benchmark used per country, whether it is the statutory minimum wage or a living-wage reference, and any count of employees close to the floor. The claim rests on the national minimum wage comparison quoted above.

Training and skills development metrics

Reference: pages 120-121. The index lists S1-13 against "People growth - 'Metrics' section" (page 94), and the S1 mapping table on page 113 points S1-13 to page 120.

The metric reported is review participation, not training hours (page 121):

Average training hours are deliberately not tracked, and the reasoning is given in full: "At Adyen, we do not mandate or track standardized metrics such as average training hours per employee. We offer a wide variety of learning options beyond traditional classroom and virtual trainings including coaching, mentoring, self-paced learnings, podcasts, and more. We believe team members and their manager are best positioned to identify meaningful growth opportunities and determine the most appropriate learning to meet that opportunity. We focus on flexible and personalized, high-value growth paths, as we believe these are far more valuable than company-wide metrics" (page 120).

Method. "The metric is calculated based on the number of employees, by gender, who have at least 1 performance rating at the end of the financial year as a percentage of total employees, by gender, who are employed at the end of the financial year. Employees who recently joined Adyen, are on leave, have resigned, or are in the process of termination during the performance review period may not have a final rating captured" (page 121). Scope: "All employees globally excluding Management Board, interns, part-time graduate program students." A footnote explains the timing: "For the 2025 reporting period, the end-of-year performance rating submission window extended into January 2026" (page 121).

Targets: none, with a stated reason. "We believe the best results come when talented people are empowered to make a direct impact on their growth ambitions, which is why we have not set quantitative People growth targets. As our approach evolves, we will reassess the requirement for such goals" (page 120).

Participation fell 3 percentage points year on year, which the statement does not explain beyond the submission-window footnote.

Compensation metrics (pay gap and total compensation)

Reference: pages 128-129. The index lists S1-16 with S1-10 against "DEI Sustainability Statement - Remuneration metrics" (page 94), and the datapoints table points S1-16 unadjusted gender pay gap paragraph 97(a) to page 128 (page 96).

The headline gap is wide and moved in both directions: the average unadjusted gap narrowed 1.1 percentage points while the median unadjusted gap widened 0.5 points. The adjusted gap, comparing like roles in like locations, is 4.1%, and the separately targeted median adjusted gap is 2.7% against a sub-2% target for 2028 (page 127).

Method, remuneration ratio. "we compare the annual total remuneration of the highest paid individual to the median annual total remuneration for all employees (excluding the highest paid employee)" (page 129). Total remuneration includes fixed and variable pay, base salary at 100% FTE, Adyen+, allowances, expected pension, and "bonuses and commissions, Adyen Equity (calculated as fixed percentage of base salary), and sign-on equity", while "Benefits in-kind, which are not easily quantifiable, are excluded from remuneration calculations" (page 129). Scope: all employees globally excluding interns and part-time graduate programme students.

Method, pay gaps. The unadjusted gaps compare annual remuneration of men and women "not taking into consideration any factors that could account for a pay gap between the genders, such as role and location"; the adjusted gap compares "average annual base salaries for men and women in the same roles in the same locations" (page 129).

A reconciliation note worth reading. "The Annual remuneration ratio is different from the pay ratio outlined in the Remuneration report due to the different required methodology" (page 129).

No targets are set on these metrics: "We have not set targets for any of these metrics" (page 128). The targets sit on the separately defined median adjusted pay gap and unexplained-deviation count instead (page 127).

Incidents, complaints and severe human rights impacts

Reference: page 142. The index lists S1-17 against "Business conduct Sustainability Statement - 'Managing and reporting inappropriate behaviors'" with the note "S1-17 Paragraph 104 is out of scope" (page 94), so severe human rights incidents, complaints to OECD National Contact Points and related fines are not reported. The datapoints table points S1-17 incidents of discrimination paragraph 103(a) to page 142 (page 96).

The figure: 8. "All incidents of inappropriate behavior, including incidents of discrimination or harassment, are reported to the Integrity Risk Committee as an aggregate on a quarterly basis. In 2025, 8 incidents of discrimination including harassment were formally reported", and "This figure was compiled from quarterly reviews of integrity-related incidents. No fines or penalties have been incurred as a result of the incidents disclosed above" (page 142).

It is a first-time metric and is not comparable with last year, which the company flags: "This metric is reported for the first time in 2025 to align with the requirements set out in S1-17. In the prior year, related information was reported using a broader scope. The methodology applied in the current year provides a basis for future reporting periods" (footnote 31, page 142). No 2024 comparative is therefore given.

Handling. "If an incident is formally reported, and meets the definition of inappropriate behavior the report is promptly investigated and acted upon by our HR team. All reported cases are formally tracked in a dedicated system, with timely resolution monitored, and appropriate measures taken to address incidents and prevent recurrence. Furthermore, Adyen maintains a strict, zero-tolerance policy against retaliation" (page 142).

Human rights position. "Consistent with our prior year disclosures, due to the nature of our business, our direct impact on modern slavery and child labour scenarios remains minimal" (page 142), and "any identified human rights wrongdoings must be reported through various channels. A dedicated team within our second-line function is responsible for investigating all concerns brought forward, including any human rights issues" (page 142).

Not disclosed: the outcomes of the 8 incidents, whether any were substantiated, and any breakdown by type or region.

Policies related to consumers and end-users

Reference: pages 144-145. The index lists S4-1 against "Data privacy and data protection Sustainability Statement - 'Our policy and approach'" with the note "ESRS S4-1 paragraphs 16 and 17 are out of scope" (page 94).

The material IRO is a privacy risk, and it reaches end-users. "Adyen identifies a risk of privacy incidents, such as personal data breaches or data exposure resulting in the unauthorized access, disclosure, or unlawful processing or mishandling of personal data... The potential effect of the risk extends beyond immediate stakeholders - merchants, partners, and employees - to the customers of our merchants as well. Given Adyen's central role in the financial ecosystem, these data-related events can have significant and far-reaching social consequences" (page 144). Adyen defines the population precisely: "we define customers as our direct clients - merchants, sub-merchants and platforms - and end-users as the shoppers who transact through these customers" (page 144).

The policies. "Adyen's privacy-related policies and procedures, which include Adyen's Privacy Statement, Privacy and Data Protection Policy, are designed to ensure compliance with applicable data protection laws worldwide. These policies establish restrictions and obligations on, for example, data usage, which allow us to deliver innovative data-driven products responsibly and maintain a privacy-by-design approach" (page 144).

Scope: "applies to the whole of Adyen in all countries where it operates, including all Adyen employees, all computers, servers, and applications operating for Adyen's business purposes, users of the Adyen platform, and all other relevant data subjects" (page 144).

Governance: a three lines model, with "The Data Privacy Team, led by Adyen's Global Head of Data Privacy (who also serves as our Data Protection Officer)" in the second line, and "ultimate accountability for Adyen's privacy compliance rests with the Management Board" (page 144).

Standards: GDPR plus monitoring of US state-level laws and "this year, defining a renewed focus and strategy for the APAC region"; "We maintain compliance with the SOC 2 standard, which governs the security of our systems and data, and is audited by PwC" (page 144).

Accessibility: "The Privacy Statement is publicly available on the Adyen website. Internally, the Privacy and Data Protection Policy is stored in our documentation repository" (page 145). Mandatory Data Privacy and Information Security training runs at onboarding and annually (page 144).

Taking action on material impacts on consumers and end-users

Reference: page 145. The index lists S4-4 against "Data privacy and data protection Sustainability Statement - 'Actions'" with the note "ESRS S4-4 paragraphs 31, 32, 33b, 34, 35, 37 are out of scope" (page 94), so the action plan detail, resources and engagement-effectiveness elements are not disclosed.

Three 2025 actions (page 145):

1. Launching the data governance framework. "The launch of our new Data Governance Framework is a key action in mitigating risks related to data privacy and data protection. The framework is designed to ensure Adyen's data is managed effectively and responsibly throughout its lifecycle. Its core objectives are to establish clear data ownership, enhance data awareness and interoperability, and define data quality validations. By formalizing these processes, the framework strengthens data security and privacy while enhancing our ability to make data-driven decisions. The framework was published internally and communicated to relevant stakeholders during the year. Its continued development and full integration across the organization remain a key priority."

2. Updating the Privacy Statement. "Throughout 2025, Adyen carried out a further update to its Privacy Statement. This revision was made to ensure the statement accurately reflects our full range of products and services and is in line with our business objectives. This ongoing process ensures our customers and individuals remain informed about Adyen's processing of their personal data."

3. Enhancing privacy and security culture. "we made further improvements in 2025 by updating the training to include new content on topics such as AI and Data Ethics and our updated data classification model." Separately, "we further developed our role-based training initiatives to ensure our employees are informed about security risks relevant to their role."

Scope and purpose. "The scope of these actions, unless otherwise specified, is aligned with the scope of the policy. Though regulation varies region by region, with substantial local nuance, we feel our global approach ensures we remain compliant wherever we operate. These actions directly support our policy objectives, which are to protect personal data and ensure compliance with applicable laws and regulations, thereby mitigating the risk of supervisory proceedings or legal actions resulting from non-compliance" (page 145).

Effectiveness is measured by two metrics: one reportable data breach in 2025 (2024: one), and a 96% completion rate for the Data Privacy and Information Security Refresher training (2024: 93%) (pages 145-146). No monetary resources are attached to the actions, consistent with the blanket statement on page 91.

Business conduct policies and corporate culture

Reference: pages 140-143. The index lists G1-1 against "Business conduct Sustainability Statement" (page 94).

Culture. "This commitment is rooted in our foundational Formula 'we make good decisions and consider the long-term benefits for our customers, Adyen, and the world at large' which, together with the Compliance Handbook, our central reference for policies, procedures, and guidance on ethical behavior, guides our corporate culture... Integrity is embedded in our decision-making, underpins our duty of care to customers, shareholders, and society, and is fundamental to our license to operate" (page 140).

Scope, refined this year into three sub-risks. "While in 2024 we captured this as a single general risk, this year it has been refined into three specific sub-risks: Anti-bribery and corruption... Protection of Whistleblowers... Responsible tax practices" (page 140). Standards basis: "we continue to use the ESRS G1 standard as a basis for disclosing information on anti-bribery, corruption, and whistleblower protection. For responsible tax practices, we adhere to the minimum disclosure requirements as this is an entity-specific sustainability matter" (page 140).

The policy set. The Compliance Handbook "sets out clear frameworks and policies for identifying and reporting potential misconduct for both internal and external stakeholders, covering a wide range of topics, including inappropriate behavior, anti-bribery and corruption, and conflicts of interest" (page 140). The Global Anti-bribery and Corruption Policy "aligns with the provisions of the United Nations Convention Against Corruption (as applicable to the private sector)" (page 140). The Whistleblower Policy reflects national law transposing Directive (EU) 2019/1937 (page 141).

Training. "All policies in our Compliance Handbook remain applicable to all Adyen employees. To ensure comprehensive understanding, all employees are required to complete an annual Compliance Refresher Training", which "continues to explain our approach to topics such as anti-bribery and corruption, inappropriate behavior, whistleblowing, and conflicts of interest in detail" (page 141).

Whistleblower protection. Channels run to a dedicated platform, the Chairman of the Supervisory Board, or externally to the Dutch Whistleblower Authority of De Nederlandsche Bank. Safeguards include "no-reprisal rights", anonymity, confidentiality under "the four-eyes principle", and handling restricted to "the Vice Presidents of the Second Line" (page 141).

Human rights is presented as a fourth pillar: "adherence to human rights is a fundamental pillar to our approach to responsible and ethical business conduct" (page 140), with the Supplier Code of Conduct carrying "a dedicated clause on human rights" (page 142).

Prevention and detection of corruption and bribery

Reference: pages 140-141. The index lists G1-3 as "Procedures to address corruption and bribery" against "Business conduct Sustainability Statement - 'Anti-bribery and corruption'" (page 94).

The policy and who owns it. "Adyen is committed to preventing, detecting, and reporting any instances of bribery and corruption that may occur internally or within the course of doing business. Our Global Anti-bribery and corruption Policy formally establishes this commitment, guiding employee behavior and applying to all entities and global business activities. The policy provides comprehensive risk guidance covering employees, customers, third parties, and partners and aligns with the provisions of the United Nations Convention Against Corruption" (page 140). "Accountability for the effective implementation and oversight of the Global Anti-bribery and corruption Policy rests with the CRCO and the wider Management Board" (page 140).

Risk assessment. "as part of our Systematic Integrity Risk Analysis (SIRA), Adyen performs a periodic assessment of any potential bribery and corruption risks exposed during the course of business, ensuring that risks are identified and mitigated in a timely manner" (page 140).

Investigator independence. "Consistent with our approach in the previous year, the investigation of potential instances of bribery and corruption lies with the Second Line, the outcomes of which may be reported to senior management as needed" (page 140). Incidents "would be reported to Adyen's Integrity Risk Committee on a quarterly basis. These insights are consolidated into reports and are shared with Adyen's Management and Supervisory Board" (page 141).

Training, including a risk-based tier. "While participation in the annual Compliance Refresher Training is mandatory for all Adyen employees, we provide additional, specialized training for certain roles that are more exposed to bribery and corruption risks-such as commercial teams, partnership roles, or those in leadership positions. This specialized training is conditional, with local Compliance teams responsible for assessing specific functional needs to determine required participation." Both cover "relevant laws, prohibited conduct, 'red flags' requiring enhanced scrutiny, reporting mechanisms, and the potential consequences of non-compliance" (page 141).

Policy maintenance. "both our Global Anti-Bribery and Corruption Policy and its underlying regulatory analysis are subject to annual review to maintain the policy's applicability and operational efficacy. For instance, in 2025 we refined our internal gift registration tool" (page 141).

Not disclosed here: the completion rate of the general anti-bribery training is not given in the G1 section; "The 2025 training completion rate and its calculation methodology and scope are disclosed in the Anti-financial crime section" (footnote 30, page 141). No percentage of functions covered by the risk assessment is published.

Targets related to business conduct (part of MDR-T/GDR-T disclosures)

Reference: pages 141 and 143. The statement was prepared under the 2023 ESRS, where business conduct targets fell under MDR-T rather than a standalone G1-3, so there is no section with that heading. The content below is MDR-T's other limb: how effectiveness is tracked in the absence of a target.

No business conduct targets are set. The statement's general position applies: "Rather than setting fixed or arbitrary targets, there are some sustainability matters for which we prefer to adopt an approach of flexibility and continuous improvement. Wherever this is the case, we have provided a clear and transparent explanation for not having targets in place. In addition, we also provide the reader with how we measure the effectiveness of our policy in the absence of time-bound targets" (page 91).

Anti-bribery and corruption: effectiveness tracked two ways. "The effectiveness of our approach is measured in two ways: through the delivery and completion of dedicated training, and through our due diligence processes, both aimed at early risk detection and mitigation. The outcomes of our Global Anti-Bribery and Corruption Policy are also continually monitored with any breaches and preventative actions clearly documented" (page 141). The outcome for the year: "Consistent with our performance in the previous year, 2025 concluded with no convictions or fines connected to violations of anti-corruption or bribery. Therefore, no specific responsive actions were required during the reporting period" (page 141).

Responsible tax practices: an explicit refusal to set targets, with reasons. "In line with our 'Tax Follows the Business' pillar of our approach, Adyen does not set specific tax targets or effective tax rate objectives. We believe our tax contribution should be a natural outcome of our commercial activities, remaining consistent with evolving laws and our commitment to ethical behavior. Instead, we base our practices on a conservative risk appetite, prioritizing integrity, transparency and compliance" (page 143). Effectiveness is instead tracked through the Total Tax Contribution: "Our 'Total Tax Contribution' is updated yearly and helps us evaluate the performance and effectiveness of our Responsible Approach to Tax... In case of an identified material deviation in the amounts, we will investigate the root cause and take action" (page 143). The index records this as "ESRS-2 80: Not applicable as no targets have been set for this topic" (page 95).

The same applies to anti-financial crime, where the index again notes "ESRS-2 80: Not applicable as no targets have been set for this topic" (page 95).

So the business conduct chapter reports no targets and does disclose effectiveness tracking, which is what MDR-T required of it.

Incidents of corruption or bribery

Reference: page 141. The index lists G1-4 as "Confirmed incidents of corruption and bribery" against "Business conduct Sustainability Statement - 'Anti-bribery and corruption'" (page 94), and the datapoints table points "G1-4 Fines for violation of anti-corruption and anti-bribery laws paragraph 24 (a)" to page 141 (page 96).

A nil return for the second year. "Consistent with our performance in the previous year, 2025 concluded with no convictions or fines connected to violations of anti-corruption or bribery. Therefore, no specific responsive actions were required during the reporting period" (page 141).

That is a complete answer to paragraph 24(a), covering both the number of convictions and the amount of fines, and it is explicitly comparative to 2024.

Monitoring that would surface an incident. "We maintain our framework up to date so it reflects any Anti-bribery and corruption risks that could affect our business... The outcomes of our Global Anti-Bribery and Corruption Policy are also continually monitored with any breaches and preventative actions clearly documented. Should such an incident arise, its outcome would be reported to Adyen's Integrity Risk Committee on a quarterly basis. These insights are consolidated into reports and are shared with Adyen's Management and Supervisory Board to ensure strategic adjustments are taken wherever necessary" (page 141).

Investigations sit outside the first line: "the investigation of potential instances of bribery and corruption lies with the Second Line" (page 140).

Reader note on what is not stated. The disclosure is framed as convictions and fines. The number of confirmed incidents that did not result in a conviction or fine, the number of confirmed incidents relating to contract terminations with business partners, and the number of legal proceedings underway are not separately reported. Given the nil return on convictions and fines the practical gap is narrow, but a statement that there were no convictions or fines is not literally a statement that there were no confirmed incidents.

Separately, 8 incidents of discrimination including harassment were reported in 2025 under S1-17, with no fines or penalties incurred (page 142). Those are inappropriate-behaviour incidents, not corruption incidents.