Aktia Bank

The role of the administrative, management and supervisory bodies

Reference: pages 45-47.

The Board "oversees that Aktia is managed efficiently and follows prudent business principles", approves the business and risk strategy, and "approves new or updated sustainability-related policies as well as sustainability program and climate strategy updates" (page 45).

Composition (pages 45-46): 6 members at year end, against an Articles range of 5 to 12. "The share of female board members is 50 per cent." All are independent of significant shareholders; all except Juha Hammaren are independent of Aktia, he having held management roles since 2014 including CEO from February 2023 to end of May 2024.

Committees (page 46): the Audit Committee (Sari Somerkallio chair, Hanne Katrama, Juha Hammaren) "oversees ESG development, progress of the sustainability program as well as impacts, risks and opportunities"; the Risk Committee prepares risk matters "including risks related to sustainability"; plus the Remuneration and Corporate Governance Committee.

"The Board of Directors is experienced in banking business and risk management, including relevant impacts, risks and opportunities associated with material sustainability topics" (page 45). Material IROs "are divided among the members of the Executive committee according to their respective segments and functions", and internal control follows a "three lines of defence" model (page 46).

Information provided to and sustainability matters addressed by the administrative, management and supervisory bodies

Reference: page 47.

"Sustainability is considered in all Aktia's operations, and sustainability matters are regularly on the agendas of Aktia's Executive Committee and Board of Directors. At the Board level, the Audit Committee oversees ESG development and the progress of the sustainability program and the impacts, risks and opportunities as defined in the double materiality assessment" (page 47).

The Sustainability Director develops sustainability work and sets targets in line with strategy and, with the ESG team, manages the IROs identified in the DMA, reporting to the Executive Committee member responsible for Group Functions (page 47).

Reviewed and approved in 2025 by the Executive Committee and the Audit Committee (page 47): the 2024 CSRD sustainability report; the results of the updated double materiality assessment; Aktia's Green Financing Framework; the draft 2025 sustainability report; and the new Sustainability Strategy for 2026-2029.

Work is guided by the Sustainability Programme 2022-2025, the Climate Strategy and the 2025 DMA update, "which served as the basis for the new Sustainability Strategy 2026-2029". The ESG Committee, chaired by the Sustainability Director, coordinates responsible investment implementation. The assurance provider "has also discussed the requirements of sustainability reporting with the Board" (page 46).

Integration of sustainability-related performance in incentive schemes

Reference: pages 47-48.

Remuneration principles "are based on Aktia's strategy, objectives, values and long-term interests, including Aktia's sustainability programme and climate strategy", and are defined by the Board (page 47).

Two principles carry the link (page 48): "Take sustainability risks into account and encourage responsible behaviour by integrating objectives related to sustainability and the management of sustainability risks into the targets of remuneration recipients"; and "Define sustainability objectives based on the employee's role ... Sustainability considerations are primarily applied to the remuneration of management and individuals whose roles require attention to sustainability risks, such as portfolio management positions."

The climate link is explicit: "As part of the long-term incentive program for key personnel, there is a target aligned with Aktia's Climate Strategy concerning the reduction of carbon dioxide emissions from banking and investment activities" (page 48). Under S4, customer and employee experience "is included in each employee's individual annual goals and remuneration" (page 98).

Not disclosed: no percentage of variable or total remuneration tied to sustainability or climate targets. HR reviews the policy annually including an equality analysis; the Board approves it annually (page 48).

Statement on due diligence

Reference: page 48.

"The main aspects and steps of the due diligence process are embedded in responsible investment assessments, credit decision processes in banking and in risk and compliance processes as well as in internal audit reviews. In addition, Aktia uses external partners where appropriate to assess specific business areas or companies for possible financing or investment" (page 48).

A mapping table sets the five core elements of due diligence against the sections of the statement (page 48):

• Embedding due diligence in governance, strategy and business model - GOV-1, GOV-2, GOV-5, SBM-1
• Engaging with affected stakeholders in all key steps - SBM-2, E1-3, E4-3, S1-2, S4-2
• Identifying and assessing adverse impacts - SBM-3, IRO-1
• Taking actions to address those adverse impacts - S1-3, S1-4, S4-3, S4-4, E1-3, E4-3
• Tracking the effectiveness of these efforts and communicating - E1-4, E4-4, S1-5, S4-5

The table is also flagged in the IRO-2 datapoint index as the "Statement on due diligence" datapoint (ESRS 2 paragraph 30), referenced to page 45 (page 59).

Risk management and internal controls over sustainability reporting

Reference: pages 48-49.

"Aktia's Board of Directors acts as the highest governing body overseeing sustainability reporting. The Audit Committee ensures the proper organization of financial and sustainability reporting as well as internal control and audit. In 2025, the Executive Committee and the Audit Committee approved the first sustainability report prepared in accordance with CSRD and the updated results of the double materiality assessment" (page 48).

Responsibility sits with the Sustainability Director, who reports to the Executive Committee member for Group functions and "provides progress updates on sustainability work at Audit Committee meetings" (page 48).

Control model (pages 48-49): the three lines of defence. Function heads form the first line; the second is the independent Compliance and Risk Control functions, which "develop, maintain and monitor general principles and the risk management framework, as well as oversee the development of material risks"; the third is Internal Audit, "a separate and independent unit tasked with ensuring that internal control and risk management are properly organized". "Risk Control and Internal Audit ... report quarterly to the Board's Risk Committee. Reporting includes any observations related to sustainability risks across different risk areas" (page 49).

Not disclosed: no risk assessment findings or mitigation actions for the reporting process itself.

Strategy, business model and value chain

Reference: pages 49-51.

Aktia is "a Finnish asset manager, bank and life insurer that has been creating wealth and wellbeing from one generation to the next for 200 years", operating and paying taxes in Finland with approximately 880 employees and offices in the Helsinki, Turku, Tampere, Vaasa, Oulu and Kuopio regions (page 49).

Strategy to 2029, three priorities (page 49): Active Wealth Management; Winning in Strategic Segments (Premium, Private Banking, SMEs, institutional); and the Aktia Experience, with "data and technology ... key enablers".

Sector exclusions datapoint: "Aktia is not active in, nor does it have direct revenues from the following industries: coal, oil, gas, chemicals production, controversial weapons and cultivation and production of tobacco" (page 49), referenced for the four paragraph 40(d) datapoints (page 59).

Value chain (page 51): upstream, IT, real estate and vehicle suppliers who "are global players with complex value chains", plus 44,000 shareholders; own operations, Group functions and a controlled joint venture with CGI covering the core banking system, whose "About a hundred IT specialists in CGI's team (India) ... are considered value chain employees from Aktia's perspective"; downstream, 258,000 private and 24,000 corporate and institutional customers, 76,000 insurance contracts, a loan portfolio of households 64%, corporates 21%, housing companies 15%, and asset management materiality "assessed based on Aktia's own funds (approx. 26% of total Aktia AUM)".

Segment revenue: asset management EUR 31.6m, banking and insurance EUR 264.2m, total EUR 295.8m (page 62).

Interests and views of stakeholders

Reference: page 52.

"Collaboration with different stakeholders helps assess expectations towards Aktia and guide product and service development accordingly." Key stakeholders are "customers, employees, shareholders and financiers, as well as societal actors such as authorities, educational partners, NGOs and the media" (page 52).

A table gives, per group, the engagement channels, purpose and themes, and the impact on operations and strategy (page 52):

• Own workforce - employee surveys, eNPS, A-Talk development discussions, safety and health at work, whistleblowing channel, events and training - feeding diversity and equality principles, personnel policies, compensation practice, career planning and the Aktia Experience culture programme.
• Customers and end users - customer experience and NPS surveys, events, webinars, interviews, meetings, feedback surveys, whistleblowing channel - feeding channel, product and service development and information security.
• Suppliers - supplier meetings, audits and assessments, whistleblowing channel - feeding sustainable procurement practices and operational resilience.
• Also partners and associated companies, investors and owners, investment targets (nomination committees, AGMs, feeding active ownership, norm-based screening and impact investing), student activities, and authorities, classifiers and auditors.

Not disclosed: no role is named as responsible for ensuring engagement informs Aktia's approach, and effectiveness is not assessed.

Material impacts, risks and opportunities and their interaction with strategy and business model

Reference: pages 53-55.

"As a result of the update of the double materiality assessment carried out during 2025, Aktia has identified nine sustainability topics as material, compared to 16 in the 2024 sustainability report. In the double materiality analysis for 2024, greater emphasis was placed on data-driven results, while the update particularly took into account the weight of impacts that were validated by internal stakeholders" (page 53).

The 13 material IROs (page 54): E1 - financed emissions from investments and from lending (two negative impacts) and lending in accordance with Aktia's sustainability criteria (positive impact); E4 - negative impacts of financed activities on biodiversity (asset management); S1 - health-related, psychosocial and financial impacts from potentially adverse working conditions, plus two financial risks of absences and recruitment difficulties, one from perceived unfavourable working conditions, one from perceived discrimination; S4 - positive impacts from the Aktia Experience, wealth transfer between generations (opportunity), customer data security or privacy breaches (risk); G1 - the Aktia Experience culture (opportunity), breaches of ethical practices such as fraud, corruption or bribery (risk), anti-money laundering and counter-terrorist financing (negative impact).

Two explicit negatives (page 53): "Aktia has not identified financial effects of material risks and opportunities on its financial position, financial performance, or cash flows", and "Aktia has not separately assessed the resilience of its strategy and business model in accordance with ESRS."

The matrix records 5 of 10 topical standards as material, naming E2, E3, E5, S2 and S3 "Not material to Aktia" (page 55).

Description of the processes to identify and assess material impacts, risks and opportunities

Reference: pages 56-58.

"During the 2025 financial year, Aktia carried out the process required by the CSRD to identify and assess material impacts, risks and opportunities (IRO) related to Aktia's operations, covering all ESRS standards and the entire value chain." It was led by Aktia's ESG specialists "and supported by external experts"; results "were adopted by Aktia's CEO and the Executive Committee and presented to Aktia's Board of Directors" (page 56).

Four phases (page 56): contextual analysis; identification of IROs across the value chain over short, medium and long term; determination of materiality under the CSRD; and documentation for assurance. "No assumptions were used in the assessments." Findings "were compared with the EU standardised table of sustainability topics (ESRS 1 AR 16)".

Method (page 56): a five-step scale - negative impacts scored on severity, probability and irreversibility, positive impacts on scope, scale and probability. A data-driven ESG analysis of corporate bond and equity funds used portfolio-weighted PAI indicators and EU Taxonomy data "as indicators to assess the weighted severity of impacts", excluding "investees for which reliable ESG data were not available, such as mixed funds, sovereign debt funds ... third party funds, private equity funds and outsourced asset management solutions".

Financial materiality (page 56): "Sustainability risks for asset management and banking were considered sufficiently diversified and therefore their estimated financial impact in most cases did not exceed the defined qualitative or quantitative materiality thresholds."

Topic-by-topic screening covers climate, pollution, water, biodiversity, circular economy and business conduct; for each, "External stakeholders were not consulted as part of the assessment" (pages 56-58). Climate-specific risk identification and scenario analysis is also presented under E1-2 (2025 ESRS numbering).

Disclosure Requirements in ESRS covered by the undertaking's sustainability statements

Reference: pages 59-60.

The IRO-2 section prints one table: the list of datapoints derived from other EU legislation (ESRS 2 Appendix B), with SFDR, Pillar 3, Benchmark Regulation and EU Climate Law columns and a page reference or a "Not material" flag per datapoint. Aktia does not print a concordance listing every disclosure requirement covered; the DRs addressed are identifiable from the DR-coded section headings indexed at the head of each chapter (pages 44, 61, 88, 99).

Flagged "Not material" (pages 59-60): E2-4; all five E3 rows; E4-2 paragraphs 24(b)-(d); E5-5 paragraphs 37(d) and 39; E1-5 paragraphs 40-43; all five E1-9 rows; SBM-3-S1 paragraphs 14(f)-(g); S1-1 paragraphs 22-23; every S2 and S3 row; G1-1 paragraph 10(b).

Referenced to pages: board diversity, independence and due diligence (45); the four SBM-1 paragraph 40(d) rows (49); E1-1 paragraphs 14 and 16(g) (77); E1-4 paragraph 34 (79); E1-5 paragraphs 37-38 (80); E1-6 paragraph 44 (81); E1-7 paragraph 56 (84); SBM-3-E4 paragraph 16(a)-(c) (85); and the S1, S4 and G1 rows across pages 89-102.

Basis of preparation (page 45): prepared "in accordance with the Finnish Accounting Act, European Sustainability Reporting Standards (ESRS) relevant for Aktia and the EU Taxonomy". "Aktia has not used the option to omit a specific piece of information corresponding to intellectual property, know-how or the results of innovation nor has it used an exemption from disclosure of impending developments." No ESRS 1 Appendix C phase-in provision is claimed anywhere.

Material standards (page 45): E1, E4, S1, S4, G1. "Compared to the previous double materiality assessment conducted in 2024, the standards E2 Pollution, E5 Resource Use and Circular Economy and S2 Workers in the Value Chain were now assessed as non-material."

Transition plan for climate change mitigation

Reference: page 77.

"Aktia does not have a transition plan under the ESRS. Aktia's climate strategy sets milestones for climate change mitigation for 2025 and 2030 for different businesses and own operations" (page 77).

What is disclosed in place of a plan (page 77):

• "In 2026, Aktia will set short-term climate targets in line with the Science Based Targets initiative (SBTi). Aktia signed and published the SBTi commitment in 2024, according to which climate targets are assessed and aligned with the initiative over the next two years."
• "Aktia is committed to the Paris Agreement, which aims to limit global warming to 1.5 degrees C."
• "Aktia is excluded from the EU Paris-Aligned Benchmarks (PAB)."

The climate strategy was launched in September 2021 with milestones published in 2022 and targets to 2050; it "has been approved by the Executive Committee and the Sustainability Director is responsible for its implementation" (page 77). The 2025 and 2030 milestones "are part of Aktia's sustainability programme targets, which have been approved by Aktia's Executive Committee and Board of Directors" (page 79). Under E4, Aktia "will prepare a transition plan as part of the SBTi target-setting process in 2026" (page 87).

Not disclosed: no decarbonisation lever quantified by contribution, no locked-in emissions assessment, no CapEx or OpEx allocated. The EU Taxonomy weighted average KPI is 2.1% on both a turnover and a CapEx basis (page 62).

Identification of climate-related risks and scenario analysis

Reference: pages 56-57 and 77.

Back-filled from ESRS 2 IRO-1 (pages 56-57) and E1 SBM-3 (page 77), where this content is disclosed in the FY2025 report. This disclosure requirement did not exist under the 2023 ESRS the report was prepared against.

Classification. The risk register splits risks into physical (extreme weather events; change in weather conditions) and transition (legislation, technology, market, reputation), each with a potential impact and a control column (page 57). "In Finland, flooding and its impact on the condition of properties and collateral value ... are considered to be the most significant aspects."

Methodology (pages 56-57). In banking, physical risks are assessed "in particular for housing, real estate and collateral financed by Aktia. A risk assessment tool can be used to identify whether the target is located in an area with a high flood risk. The assessment does not include a separate sensitivity analysis to examine the probability, scope or duration of the risk." In asset management an external tool "assesses potential value losses due to extreme weather conditions and natural disasters, based on the investments' geographical and sector-specific exposure". For own operations, physical risks "are considered limited, as all Aktia's premises are located in Finland and business continuity is not location dependent", so premises and supply chain are not assessed separately.

Scenarios (page 57). Aktia takes "into account different climate scenarios as defined by the International Energy Agency (IEA). In addition to the 1.5 degrees C global warming scenario, high-emission scenarios have also been considered - quantitatively in investment activities and qualitatively in financing activities." The analysis "identifies the year in which the portfolio consumes the carbon dioxide emission budget allocated to it and from which the portfolio is no longer aligned with the 1.5-degree warming scenario".

Gaps: no individual scenario named beyond the IEA family, no temperature projection per scenario, no key assumptions, and no date for the analysis. E1 SBM-3 concludes these risks "are not material" (page 77).

Resilience in relation to climate change

Reference: pages 53 and 57.

Back-filled from ESRS 2 SBM-3 (page 53) and the "Resilience analysis" subsection of ESRS 2 IRO-1 (page 57). This disclosure requirement did not exist under the 2023 ESRS the report was prepared against.

The company states plainly that no ESRS resilience assessment was made: "Aktia has not separately assessed the resilience of its strategy and business model in accordance with ESRS" (page 53). The same position is taken for biodiversity: "At this stage, no assessment has been made of the resilience of the current business model and strategy to the physical, transition and systemic risks related to biodiversity and ecosystems, nor of the scope of the resilience analysis in relation to the company's own activities or its upstream or downstream value chain" (page 85).

What is described under the heading "Resilience analysis" (page 57):

• "Aktia assesses the potential financial impacts of climate risks using both internal and external analytical tools, taking into account different climate scenarios as defined by the International Energy Agency (IEA). In addition to the 1.5 degrees C global warming scenario, high-emission scenarios have also been considered."
• "The results of the resilience analysis carried out are not expected to have a direct impact on Aktia's strategy or business models."

Aktia "has not identified financial effects of material risks and opportunities on its financial position, financial performance, or cash flows" (page 53), and its "assets and business activities do not have significant exposure to physical climate risks" (page 57).

Not disclosed: no significant areas of uncertainty, and no short, medium or long term capacity to adjust or adapt.

Policies related to climate change mitigation and adaptation

Reference: pages 77-78.

"Aktia has a climate strategy as well as internal directives and instructions that steer its activities towards mitigating climate change, adapting to its impacts, improving energy efficiency, and adopting renewable energy. The progress of the climate strategy objectives is monitored, and policies are updated annually" (page 77).

Four instruments:

• Climate strategy - launched September 2021, milestones published 2022, targets to 2050; approved by the Executive Committee, implemented by the Sustainability Director (page 77).
• Environmental policy - "guides all activities concerning material environmental aspects and is aligned with the double materiality assessment"; Aktia "is committed to considering environmental aspects when developing new products and services for customers" (page 77).
• Principles for responsible investment - "take into account risks and opportunities related to climate change", applying "the exclusion of sectors, consideration of sustainability factors, norms-based screening in accordance with the UN Global Compact principles, active ownership and engagement, and impact investing" (pages 77-78).
• Principles for responsible lending - "Aktia has excluded certain business sectors and activities from its financial services. Aktia has also imposed restrictions on defined sectors and companies that have links to them" (page 78).

Not disclosed: the policies are not mapped to the ESRS sub-topics of mitigation, adaptation, energy efficiency and renewable energy deployment individually, and no scope exclusions or availability statements are given.

Actions and resources in relation to climate change policies

Reference: page 78.

"Aktia mitigates climate change through various measures across all asset management and banking operations ... Aktia has sufficient capability and expertise to implement actions related to climate change" (page 78).

Asset management. Commitment to "the International Climate Action 100+ initiative aimed at engaging with the world's largest corporate greenhouse gas emitters"; CDP reporting; public support for the Transition Pathway Initiative; six SFDR Article 9 funds named, including Aktia Prosperity, Aktia Solarwind III and Aktia Bioindustry I. "At the end of 2025, 98.3 per cent of the capital invested in our funds was in SFDR Article 8 and Article 9 funds. The share has increased by 0.2 percentage points from the previous year." Norm-based screening follows the UN Global Compact, with escalation "by initiating an engagement process".

Banking. Green housing and vehicle loans, with requirements "based on EU Taxonomy criteria assessing substantial contribution to climate change mitigation"; green and sustainability-linked corporate loans; a bond framework "accelerated by ... the Sustainability Guarantee granted to Aktia by the European Investment Fund and a EUR 75 million loan agreement with NIB (Nordic Investment Bank) extending to 2027, which is partly earmarked for supporting environmental projects". "During 2025, Aktia has developed a green financing framework to enable it to issue green financial instruments such as green bonds, green loans and green commercial papers", built to the ICMA Green Bond Principles and the APLMA, LMA and LSTA Green Loan Principles.

Not disclosed: no CapEx or OpEx amounts, and no GHG reduction attributed to any individual action.

Targets related to climate change mitigation and adaptation

Reference: page 79.

"The climate strategy milestones for 2025 and 2030 were set in 2022 ... The target setting was based on the change in greenhouse gas emissions between the baseline year and 2021, as well as a market analysis of target levels. The targets take into account Scope 2 and Scope 3 emissions from Aktia's own operations, as well as Scope 3 emissions from asset management and banking. Stakeholders were not consulted when setting the targets" (page 79).

Asset management - carbon neutrality in the investment portfolios by 2050 "the operating environment permitting"; 2025 milestones of equity and corporate bond portfolio carbon footprint -30% (outcome -53.3%) and green bond share of corporate credit funds 35% (36.7%); by 2030, footprint -50% and carbon neutrality in real estate investments. Base year 2019 (pages 61, 79).

Banking - "In 2025, Aktia achieved its interim target of establishing a Green Bond framework. The loan portfolio target by 2030 is a -30% reduction in the carbon footprint of corporate and housing loans (baseline 2020: 971 425 tCO2e)", with 2025 at -32%. The share of responsible loans "was 3.46% (2024: 2.82%)".

Own operations - carbon neutrality by 2050, with carbon-neutral energy consumption in leased premises by 2030; in 2025 renewable electricity is used "in its head office and all locations where Aktia has its own electricity contract".

Stated limitations (page 79): targets are "defined separately for the short, medium and long term, but not separately for the GHG-scopes", and "The current targets are not science-based and do not address different decarbonization methods, the adoption of new technologies, or various climate scenarios."

Energy consumption and mix

Reference: page 80.

Reporting "covers Aktia's premises and consists of the energy consumption in leased premises and is based on data from landlords or electricity suppliers. Calculation has been based on the average energy consumption of other premises, if actual consumption data is not available." "Aktia's head office uses 100% renewable energy. 70% of the energy consumed in Aktia's other premises is renewable" (page 80).

Total consumption fell 17% and the renewable share rose from 64% to 70%. "Aktia's energy consumption reporting has been assured as part of the sustainability reporting assurance process, and no other external parties have been used."

Scope note: energy is material "through asset management when investing in companies in sectors with a high climate impact. Due to this indirect exposure, the energy consumption of these companies does not affect Aktia's own operations." The energy-intensity datapoints for high climate impact sectors (paragraphs 40-43) are "Not material" in the IRO-2 index (page 59), so no intensity per net revenue is given.

Gross Scopes 1, 2, 3 and Total GHG emissions

Reference: pages 81-84.

"Aktia has screened its operations and plans in accordance with the GHG Protocol and the PCAF standards ... No Scope 1 emissions have been identified at Aktia. ... Scope 3 emissions ... includ[e] categories 1, 3, 5, 6, 7, 9 and 15" (page 81).

Scope 2 location-based is down 76% on the base year, but total emissions rose 15% year on year because category 15 is 99.6% of the footprint and grew from 152,130 to 175,562. GHG intensity rose from 495 to 596 tCO2e per EUR million of net revenue (page 84).

Financed emissions (page 82): investment activities Scope 1 and 2 of 114,109 tCO2e (2024: 90,328; base year 194,417, -41%) plus investee Scope 3 of 2,302,048, and lending Scope 1 and 2 of 61,453 plus 662,498 unallocated - 3,078,655 tCO2e in total (2024: 2,927,230). Listed equity and bonds carry EUR 4,435m and 2,302,048 tCO2e at intensity 519 and a PCAF data quality score of 1; business loans EUR 1,336m and 414,497 tCO2e at intensity 310 and score 5; commercial real estate rose 314% to 14,033 tCO2e (pages 82-83).

Coverage (page 84): "The reported emissions from investment activities constitute 26% of Aktia's net assets under management ... The reported emissions of the loan portfolio constitute 73% of Aktia's entire loan portfolio", both under PCAF 2022 cost-based. "Aktia's emissions reporting has not been assured separately by any external party."

GHG removals and GHG mitigation projects financed through carbon credits

Reference: page 84.

"During the reporting period, Aktia did not participate in actions related to GHG removals or storage. In order to reduce the adverse impacts of the emissions from our own operations, Aktia has participated in planting domestic forest on a former peat production area" (page 84).

No tonnage is attributed to the forest planting, no carbon credits are reported as cancelled or purchased, and no net-zero claim is made that relies on removals or credits. The IRO-2 datapoint index references the E1-7 datapoint "GHG removals and carbon credits" (paragraph 56) to page 84 (page 59).

Read with E1-4, the 2050 carbon neutrality goals for the investment portfolios and own operations are therefore stated without any disclosed removals or credit mechanism behind them (page 79).

Transition plan on biodiversity and ecosystems

Reference: page 85 (section headed "E4-1 Transition plan and consideration of biodiversity and ecosystems in strategy and business model"), with page 87.

"Aktia has not prepared a transition plan for asset management concerning biodiversity and ecosystems. At this stage, no assessment has been made of the resilience of the current business model and strategy to the physical, transition and systemic risks related to biodiversity and ecosystems, nor of the scope of the resilience analysis in relation to the company's own activities or its upstream or downstream value chain" (page 85).

On strategy: "From the asset management's point of view, biodiversity is one of the main environmental themes alongside climate. Reduced biodiversity may pose risks to investors at the systemic level. Aktia has not directly embedded biodiversity and ecosystems in its strategy and business model or assessed their resilience ... However, Aktia develops approaches to biodiversity and ecosystems."

Own operations sit outside the material impact: "Aktia's own operations do not have any direct material negative impacts related to land degradation, desertification or soil sealing, or operations that affect threatened species. Aktia does not have premises located in or near biodiversity-sensitive areas."

Forward commitment: "Aktia will prepare a transition plan as part of the SBTi target-setting process in 2026, and at the same time, the goals and timeline related to biodiversity and ecosystems will be specified" (page 87). The single material E4 IRO is "Investments: Negative impacts of activities financed by Aktia on biodiversity and ecosystems" (page 85).

Policies related to biodiversity and ecosystems

Reference: pages 85-86.

"Aktia has internal directives and instructions that address biodiversity and ecosystems. The principles do not take into account the social consequences of impacts related to biodiversity and ecosystems. Aktia does not have any premises located in or near biodiversity-sensitive areas, nor does it have policies related to such areas" (page 85).

Three instruments:

• Environmental policy - "guides all activities concerning material environmental aspects and is aligned with the double materiality assessment"; the Sustainability Director implements, monitors and updates it (page 85).
• Principles for responsible investment - "also take into account risks and opportunities related to biodiversity and ecosystems", applying "sector exclusion, consideration of sustainability factors, norm-based screening in accordance with the UN Global Compact, active ownership and engagement, and impact investing". "Aktia has analysed its funds' dependencies on natural capital and reported on the impacts of its activities on biodiversity" (page 85).
• Stewardship policy - "defines the methods and practices through which Aktia seeks to influence the governance and principles of issuers of equity and corporate bond investments"; "Stewardship is also one of the means by which Aktia aims to advance the carbon neutrality targets set out in its climate strategy" (page 86).

Not disclosed: the IRO-2 index marks the three E4-2 policy datapoints on sustainable land and agriculture practices (paragraph 24(b)), sustainable oceans and seas (24(c)) and deforestation (24(d)) "Not material" (page 59). No traceability, biodiversity offset policy or third-party certification scheme is referenced.

Actions and resources related to biodiversity and ecosystems

Reference: pages 86-87.

"During 2025, as part of its work related to biodiversity, Aktia continued its analysis of the funds' dependencies on natural capital and impacts on biodiversity, covering equity and corporate bond funds" (page 86).

Analysis (page 86). One external tool "models the net impact of companies based on a quantification model ... uses machine learning techniques and a broad database of scientific articles", considering "habitat destruction, threatened species, alien invasive species, animal suffering, land use, land degradation, desertification, soil sealing and ecosystem services".

• Dependencies - "the high and very high dependencies of the funds' investments relate to water supply, water flow regulation and water purification", in sectors including "the restaurant and food industry, pharmaceutical industry and healthcare, water distribution and aquaculture, energy industry, as well as manufacturing of basic iron and steel".
• Pressures - "the funds' investments have a high or very high impact on biodiversity and ecosystems, for example through emissions of non-GHG air pollutants and through emissions of toxic soil and water pollutants. Sectors with high impact include heavy industry and energy-related sectors such as manufacturing of basic iron and steel, chemical and plastics production, oil and gas extraction and refining."

Instruments (pages 86-87). SFDR Principal Adverse Impact data is used "at both at the fund and the investee levels"; green bonds "are used to finance environmental projects, which can also be related to sustainability topics in the areas of biodiversity and ecosystems".

Engagement (page 87). Aktia is part of the PRI-launched Spring initiative, "which aims to halt biodiversity loss by 2030 ... supported by more than 200 investors", and participates in Nature Action 100.

Two explicit negatives (page 87): "Aktia has not used biodiversity offsets in its action plans. In biodiversity activities, the knowledge of local communities or indigenous peoples have not been used." No monetary resources are disclosed.

Targets related to biodiversity and ecosystems

Reference: page 87.

"Aktia has not set targets related to biodiversity and ecosystems in accordance with the ESRS. The targets will be reassessed in connection with the update of the sustainability programme for 2026. As part of the SBTi target-setting process and the preparation of the transition plan, Aktia will assess biodiversity and ecosystem-related objectives and monitoring in 2026" (page 87).

Effectiveness tracking in the absence of targets is described: "Aktia monitors the effectiveness of its actions in relation to material sustainability impacts, risks and opportunities as part of the annual double materiality assessment and the quarterly ESG reporting for investment activities" (page 87).

Related measurement that is reported, though not presented as an E4 target: the continued natural-capital dependency and pressure analysis of equity and corporate bond funds, and the SFDR biodiversity PAI indicators published annually on Aktia's website (pages 58, 86-87).

Not disclosed: no ecological threshold, no base year and base value, no target year and no measurable outcome-oriented biodiversity target of any kind. Aktia also notes it has "not yet made a more detailed assessment of transition, physical or systemic risks related to biodiversity and ecosystems as the identified impacts are limited overall" (page 58).

Anticipated financial effects from biodiversity and ecosystem-related impacts, risks and opportunities

Reference: page 87 (section headed "E4-6 Potential financial effects from biodiversity and ecosystem-related risks and opportunities").

"Aktia has not assessed potential financial opportunities from biodiversity and ecosystem-related risks and opportunities" (page 87).

The position is consistent with SBM-3, where "Aktia has not identified financial effects of material risks and opportunities on its financial position, financial performance, or cash flows, nor material risks and opportunities that involve a significant risk of a material adjustment to the carrying amounts of assets and liabilities disclosed in the financial statement during the next financial year" (page 53), and with the statement that Aktia "has not yet made a more detailed assessment of transition, physical or systemic risks related to biodiversity and ecosystems as the identified impacts are limited overall" (page 58).

No monetary amounts, no time horizons and no quantified exposure are given, and no ESRS 1 phase-in provision is invoked anywhere in the statement. Aktia does state that it "will prepare a transition plan as part of the SBTi target-setting process in 2026", when biodiversity goals and timelines "will be specified" (page 87).

Policies related to own workforce

Reference: pages 89-90.

"Aktia complies with the nationally binding collective agreements of the banking and insurance sectors and the regulations of Finnish labour law, which set the standards for, in example, working time and working conditions", including "national legislation that guarantees employees' freedom of association and the right to organise" (page 89).

Human rights position: "Aktia does not have a separate human rights policy because all Aktia's own employees work in Finland where the realisation of human rights is ensured by legislation. The Finnish state has committed to complying with the UN Guiding Principles on Business and Human Rights, which is why Aktia has not separately analysed how human rights are complied with in our own workforce" (page 89).

Code of Conduct (pages 89-90): it "includes the principles for work, information security and privacy protection" and commits Aktia to "the UN Declaration of Human Rights and other UN treaties, the UN Sustainable Development Goals, ILO conventions and the OECD Guidelines for Multinational Enterprises". It is owned by Compliance, updated annually, and employees "commit to the Code of Conduct already at the recruitment stage".

Other instruments (page 90): the equality plan under the Finnish Non-Discrimination Act; diversity and equality principles; recruitment principles ("transparent, fair, non-discriminatory and supportive of diversity"); a competence requirements directive; the remuneration policy, which "is gender neutral and one of its targets is to ensure that everyone gets equal pay for equal work"; flexible hours and hybrid work; occupational health services "exceeding the statutory requirements"; and zero tolerance "for all forms of harassment and inappropriate treatment at the workplace".

The IRO-2 index marks the S1-1 trafficking (paragraph 22) and accident prevention policy (23) datapoints "Not material" (page 60).

Processes for engaging with own workforce and workers' representatives about impacts

Reference: pages 90-91.

"Aktia regularly communicates with employees through internal communication channels, such as monthly events, webinars and weekly intranet bulletins. The views and opinions of employees are also collected through employee and other surveys, development discussions and cooperation with occupational health care. HR leads and coordinates actions related to employees and reports on them to the Board of Directors, the CEO and the Executive Vice President of Group Functions" (page 90).

Individual dialogue (page 90): "Formal A-talk discussions held twice a year are an important part of Aktia's performance management model. The discussions held at the turn of the year focus on target setting ... The discussions held in the middle of the year focus on occupational well-being and competence development." Regular one-on-one discussions sit alongside them, and "The purpose of these discussions is to identify potential negative impacts on employees in advance."

Surveys (page 91): "Twice a year, Aktia conducts a wider employee survey ... The survey results are processed with employee representatives for the whole Aktia, and each manager reviews the results with their own team. Based on the results, the work communities agree on development measures ... In addition, a shorter pulse survey is carried out quarterly."

Formal representation (page 91): "Aktia engages in continuous dialogue with employees in accordance with the Act on Co-operation. The communication takes place in the co-operation committee (SAD), which meets four times a year and consists of elected representatives and workers' safety representatives as well as non-permanent employer representatives."

Not disclosed: no single role is named as having operational responsibility for ensuring engagement informs Aktia's approach, and effectiveness is not assessed.

Processes to remediate negative impacts and channels for own workforce to raise concerns

Reference: page 91.

"Employees have multiple channels to raise concerns. Concerns can be immediately raised with one's own manager, HR, employee representatives or occupational safety and health representatives ... If an employee feels that they do not want to raise their concern with their own manager, they can contact HR, an employee representative or an occupational safety and health representative directly. The contact details are available on the intranet" (page 91).

Handling: "HR is responsible for investigating and addressing potential concerns raised as well as take measures on a case-by-case basis and ensure that the matter is resolved within a reasonable timeframe. If the concern is about another employee's conduct or behaviour (for example harassment or inappropriate behaviour), the matter is addressed in accordance with Aktia's instructions on disciplinary procedures."

Collective route: health and safety, working conditions and wellbeing "are also reviewed quarterly in the co-operation committee where employee representatives and regional occupational safety and health representatives can raise relevant topics ... with the employer's representative". Aktia also "conducts regular workplace surveys to assess the healthiness and safety of work", run jointly with occupational health professionals.

Whistleblowing: "Aktia has a whistleblowing channel in place for internal and external stakeholders", maintained by a third party, allowing confidential and if necessary anonymous reporting; reports are handled by the Chief Compliance Officer and Chief Audit Executive, with retaliation prohibited by law (pages 91, 101).

Not disclosed: whether employees' awareness of, or trust in, these channels has been assessed.

Taking action on material impacts on own workforce

Reference: pages 91-92.

Working conditions (page 91). "In recent years, Aktia has invested in manager training and development in order to detect the individual needs of employees and to provide support in the planning of actions in various ways. Measures to improve working conditions and increase wellbeing are agreed on a case-by-case basis between the manager and the employee. If necessary, HR, an occupational health representative, employee representatives or other relevant parties will be invited." Working time is monitored in a system that "allows for quick detection of possible overtime", and "All overtime work requires the manager's approval in order to prevent excessive workload."

The occupational health wellbeing programme aims "to raise awareness about health and safety issues, promote wellbeing in general and reduce negative impacts such as absenteeism and unwanted turnover", including "a work ability indicator, which facilitates early intervention in health risks". Aktia "emphasises internal recruitment and job rotation ... All vacancies in Aktia are first opened internally".

Equal treatment (pages 91-92). "No discriminatory questions or claims are allowed in job interviews ... When two candidates are equally strong, the representative of the minority must be chosen, taking into consideration the provisions of the Equality Act. According to the recruitment principles, both genders should be represented among the final three candidates." On harassment, "Raised incidents are also monitored through the risk reports to give Group management a clear picture of the situation and the opportunity to take corrective action if issues arise."

Competence (page 92): "The priorities in competence development are the digital Aktia Way studies, role-specific training and leadership development."

Not disclosed: no monetary resources are allocated to these actions.

Targets related to own workforce

Reference: page 92, with pages 50 and 88.

"Aktia has not set targets related to its own workforce in accordance with the ESRS standard" (page 92).

What is set instead, under the Sustainability programme 2022-2025 approved by the Board and management (page 92): "Aktia measures employee experience and wellbeing using eNPS +28 (2024: +19) and employee surveys. Aktia measures diversity, equality and equal opportunities for all with the SHE index 70 (2024: 82), gender division, and indicators for pay equality."

The programme's stated target levels are "Siqni Flame-index at least 80", "SHE Index at least 85" and "eNPS (Employee Net Promoter Score) at least 20" (page 50). Against those, the 2025 eNPS of +28 beats the target of +20 from a 2022 baseline of -13 (page 88), while the SHE index of 70 is 15 points below the 85 target and 12 points down on 2024 (page 92).

HR's stated priorities frame the metrics (page 92): "an empowering employee experience: I can grow together with Aktia"; "strong leadership based on our values and strategy: we lead people, targets and well-being"; "our shared culture and way of working".

Not disclosed: no base year or baseline value for the SHE index in the S1 chapter, no target year, no explanation of the fall in the SHE index, and no statement on whether workers or their representatives were involved in setting the metrics.

Characteristics of the undertaking's employees

Reference: page 92.

"The number of employees represents people with an employment contract valid on the last day of the reporting period. It includes active and non-active employees ... Gender as stated by the employees themselves" (page 92).

Headcount fell by 43 (4.7%); women are 54% of the workforce. SBM-1 states Aktia "employs approximately 880 people around Finland" (page 49).

Turnover and hires (page 92): turnover "is based on the total number of employees voluntarily leaving within the year divided by the number of employees at the end of the reporting period" and was 7% (2024: 10%), with 75 women, 67 men and 1 not specified leaving. New hires totalled 102 (2024: 194) - 40 women, 62 men.

Not disclosed: no country breakdown, the statement noting Aktia "operates in Finland and its entire own workforce is subject to national employment legislation" (page 89), and no reconciliation to the financial statements.

Characteristics of non-employee workers

Reference: page 93.

"Aktia's own workforce consists exclusively of employees under employment contracts" (page 93).

The boundary is set in SBM-3: "In this sustainability report, the term 'own workforce' refers to Aktia's own employees who have a valid employment contract with Aktia at the end of the reporting period. External service providers are not included in Aktia's own workforce" (page 89).

This is a complete nil return rather than an omission: Aktia reports no self-employed people and no people provided by undertakings primarily engaged in employment activities within its own workforce, so there is no headcount to disaggregate.

Non-employee workers do appear in the value chain description, where "About a hundred IT specialists in CGI's team (India) ... are considered value chain employees from Aktia's perspective" under the strategic joint venture Aktia controls (page 51). Those workers fall under S2 Workers in the value chain, which Aktia's 2025 double materiality assessment found not material (pages 45, 55).

Collective bargaining coverage and social dialogue

Reference: page 93.

"In 2025, 95% of Aktia's employees were covered by a collective agreement. Only employees under an executive employment contract were not covered by a collective agreement" (page 93).

The policy context is set out in S1-1: "Aktia complies with the nationally binding collective agreements of the banking and insurance sectors and the regulations of Finnish labour law, which set the standards for, in example, working time and working conditions. Aktia complies with the Finnish labour legislation regarding the implementation of organisational changes and the period of advance notice given for them, as well as with national legislation that guarantees employees' freedom of association and the right to organise" (page 89).

Social dialogue is conducted through the co-operation committee (SAD) under the Act on Co-operation, which "meets four times a year and consists of elected representatives and workers' safety representatives as well as non-permanent employer representatives", and through elected representatives on the Operations Committee (pages 46, 91).

Not disclosed: the coverage figure is not split by country or region, and no separate percentage is given for employees represented by workers' representatives, although the whole workforce is in Finland (page 89).

Diversity metrics

Reference: page 93.

"Diversity metrics show the gender distribution of Aktia's Executive Committee and the age distribution among all employees" (page 93).

Female representation at management level fell from 38% to 29%, the Executive Committee having moved from 3 women and 5 men to 2 women and 5 men. The statement does not comment on the change.

Aktia measures "diversity, equality and equal opportunities for all with the SHE index 70 (2024: 82), gender division, and indicators for pay equality" (page 92), against a programme target of "SHE Index at least 85" (page 50). At Board level, separately disclosed under GOV-1, "The share of female board members is 50 per cent" across 6 members (page 45).

Adequate wages

Reference: page 93.

The table reports a single country, Finland, which is consistent with the S1 scope statement that "Aktia operates in Finland and its entire own workforce is subject to national employment legislation" (page 89).

The underlying wage framework is set out in S1-1: Aktia "complies with the nationally binding collective agreements of the banking and insurance sectors and the regulations of Finnish labour law" (page 89), and 95% of employees are covered by a collective agreement, the exception being employees on executive contracts (page 93). The remuneration policy "is gender neutral and one of its targets is to ensure that everyone gets equal pay for equal work" (page 90).

Not disclosed: Aktia does not name the benchmark used to define an adequate wage, nor does it state whether the comparison was made against an applicable minimum wage, a collective agreement floor or a living wage reference.

Social protection

Reference: page 93.

"All Aktia employees under employment contracts are covered by social protection either through public programs or benefits provided by Aktia, against income loss resulting from any of the following significant life events: sickness, unemployment, employment injury and acquired disability, parental leave, and retirement" (page 93).

The disclosure covers all five life events ESRS S1-11 asks about and reports full coverage, so no percentage of employees not covered arises and no country-by-country breakdown of gaps is needed. All employees are in Finland and subject to national employment legislation (page 89), and 95% are covered by a collective agreement (page 93).

Related provision reported elsewhere: occupational health services "exceeding the statutory requirements", a wellbeing programme developed with the occupational health provider that includes "the opportunity for discussions with a designated occupational nurse, digital coaching and targeted measures to support mental wellbeing according to needs", and a regularly monitored work ability indicator used "to proactively identify potential work ability risks and to anticipate them" (page 90). Entitlement to family-related leave is reported as 100% under S1-15 (page 94).

Persons with disabilities

Reference: page 93.

"In Finland, the law prohibits employers from collecting and processing personal data regarding an employee's disability" (page 93).

Aktia gives the legal impediment in place of a percentage. This is a complete answer rather than a silent omission: the ESRS datapoint cannot be produced without processing data that Finnish law prevents Aktia from holding, and all of Aktia's own workforce is in Finland (page 89).

No figure, and therefore no breakdown by gender, is reported. Related disclosures that are given: the equality plan under the Finnish Non-Discrimination Act, which "defines the targets for promoting non-discrimination and the measures for monitoring the targets", and the diversity and equality principles committing Aktia "to guaranteeing equal opportunities to all employees and to ensuring equal treatment in the entire work community" (page 90). Social protection against acquired disability is reported as covering all employees (page 93), and three incidents of discrimination were recorded in 2025 (page 94).

Training and skills development metrics

Reference: page 93.

"The information on performance and career development discussions and training applies to all Aktia employees, with the exception of members of Aktia's Executive Committee. During 2025, training for managers as well as business and AI training has been increased, which has resulted in a higher number of training hours compared to the previous year" (page 93).

Average training hours rose more than fourfold, from 9 to 38 hours, which Aktia attributes to increased manager, business and AI training. At the same time participation in performance and career development reviews fell from 98% to 89%, with men at 85% against women at 92%; the statement does not comment on that fall.

The programmes behind the figures are described under S1-4: "The priorities in competence development are the digital Aktia Way studies, role-specific training and leadership development", with measures agreed in a personal development plan and every employee confirming in the online learning environment that the plan has been carried out (pages 90, 92).

Health and safety metrics

Reference: page 93.

"All employees are covered by Aktia's occupational health and safety system. The number of incidents related to work-related injuries, illness, and fatalities are those reported to our occupational health service or directly to HR by employees or managers" (page 93).

Recordable accidents rose from 2 to 7 and the reported rate from 0.2% to 0.8%, while days lost fell from 12 to zero. Aktia does not comment on the increase in accidents.

The IRO-2 index references fatalities and the number and rate of work-related accidents (paragraphs 88(b) and 88(c)) and days lost (88(e)) to page 93, while the S1-1 datapoint on a workplace accident prevention policy or management system (paragraph 23) is "Not material" (page 60). Underlying risk management is described under S1-1: occupational health services "exceeding the statutory requirements" and a monitored work ability indicator (pages 90-91).

Work-life balance metrics

Reference: page 94.

"All Aktia employees are entitled to family leave under collective agreements and Finnish legislation. The percentage is based on the total number of employees who took family leave during the year divided by the number of employees at the end of the reporting period. The employees are divided by gender" (page 94).

Take-up rose from 2% to 3% of the workforce, with the gender split of those taking leave broadly unchanged.

Supporting arrangements are described under S1-1 and S1-4: "All Aktia employees have the possibility to work flexible hours, which supports work-life balance and employees' well-being. Work-life balance is also supported by offering the possibility of hybrid work in most positions within Aktia. Hybrid work has only been restricted in positions requiring the employee's presence at Aktia's premises" (page 90), and "All overtime work requires the manager's approval in order to prevent excessive workload. This also supports work-life balance and sustainable working conditions" (page 91). Parental leave is one of the life events covered by the social protection reported under S1-11 (page 93).

Compensation metrics (pay gap and total compensation)

Reference: page 94 (section headed "S1-16 Remuneration metrics (pay gap and total remuneration)").

"The ratio between men's and women's total salaries is calculated based on the total compensation paid. The ratio between the compensation of the highest paid employee and the median compensation of the company's other employees is calculated based on total compensation" (page 94).

Footnote: "The gender pay gap is unadjusted and does not take into account the different positions held by women and men" (page 94).

The gap narrowed by 2.0 percentage points while the CEO pay ratio rose from 8 to 9. The statement does not comment on either movement.

Policy context from S1-1: "The remuneration policy is gender neutral and one of its targets is to ensure that everyone gets equal pay for equal work. The gender pay gap is monitored regularly and reviewed annually with employee representatives" (page 90). Executive Committee remuneration "is benchmarked at least every second year against the remuneration paid by other companies of a similar size and by companies in the financial sector" (page 48). The IRO-2 index references the unadjusted gender pay gap (paragraph 97(a)) and excessive CEO pay ratio (97(b)) to page 94 (page 60).

Incidents, complaints and severe human rights impacts

Reference: page 94.

"The number of work-related incidents refers to all cases of discrimination, bullying, sexual harassment and other types of harassment that may occur in the workplace. Cases are reported to HR by employees, managers, unions or employee representatives or via the whistleblowing channel. Reconciliation of fines, penalties and compensation resulting from incidents are based on the financial statements" (page 94).

Discrimination incidents rose from 2 to 3, with no fines or compensation paid and no severe human rights incidents in either year. Aktia does not comment on the incidents or state how they were resolved.

Handling is described under S1-3 and S1-4: harassment cases "are addressed in accordance with Aktia's instructions on disciplinary procedures", and "Raised incidents are also monitored through the risk reports to give Group management a clear picture of the situation" (pages 91-92). The IRO-2 index references incidents of discrimination (paragraph 103(a)) and non-respect of the UNGPs and OECD guidelines (104(a)) to page 94 (page 60).

Policies related to consumers and end-users

Reference: page 96.

"Customer relationships and customers' trust are most valuable in Aktia's business, and Aktia's Code of Conduct contains the most important rules on information security, processing of personal data, handling of customer complaints and ethical principles for responsible customer work at Aktia ... Aktia is subject to the Financial Supervisory Authority (FIVA) and the Finnish Financial Ombudsman Bureau (FINE). At Aktia, Executive Vice President of Group Functions has the highest operational responsibility for customer communications and contacts" (page 96).

Code of Conduct. Aktia commits to "the UN Declaration of Human Rights and other UN treaties, the UN Sustainable Development Goals, ILO conventions, and the OECD Guidelines for Multinational Enterprises. Aktia also expects the same from its partners and service providers ... Aktia has not caused any severe human rights violations through its operations in 2025."

Customer complaints directive. Employees "are instructed to resolve matters fairly at once and in accordance with official requirements. Aktia's Chief Compliance Officer is responsible for the directive, and it is reviewed annually ... the individual may not participate in the handling of the complaint."

Information security and data protection directives are owned by the Head of Operational Risk and the Data Protection Officer, updated annually, and "are based on the Board of Directors' regulation on the framework relating to the handling of operative risks and reporting".

Non-discrimination and access. "Consumers have a statutory right to basic banking services provided by deposit banks ... Aktia has an internal directive confirmed by the CEO on the obligation to offer basic banking services and bank transfer services to private customers." Lending must rest on "the customer's sufficient ability to pay".

Processes for engaging with consumers and end-users about impacts

Reference: pages 96-97.

"Aktia maintains regular contact with customers through its communication and service channels, including personalised service at branches, by phone, by letter, via chat, the mobile bank, and online bank, as well as through general information on its website, social media, communication materials, and customer events. The Director of Group Functions and the directors in charge of customer service in each business area are responsible for the customer experience and communications" (pages 96-97).

Engagement on the material information-security risk (page 97): "Aktia actively engages with customers in matters related to information security and data protection. Customers are immediately notified if there are disruptions in Aktia's services, phishing campaigns are carried out in Aktia's name, or other activities of threat actors are detected. If a data leak, data breach or other information security incident were to occur at Aktia concerning customers' funds or personal data, customers would be informed immediately, and instructions would be given. Aktia's communications department is responsible for informing customers in wide disruptions or exceptional circumstances, guided by Aktia's crisis committee."

"Feedback from customers is collected after training sessions, in addition to which feedback on safe banking can also be given directly to Aktia ... The feedback is used to develop operations to better meet the wishes of Aktia's customers."

Vulnerable groups: "In banking, Aktia has also taken into account persons who need special assistance in the use of digital services with regard to possible negative impacts. Vulnerable stakeholders have not been identified separately for affected consumers and end-users in Aktia's investment activities" (page 95).

Processes to remediate negative impacts and channels for consumers and end-users to raise concerns

Reference: page 97.

"Aktia has different channels for customers to provide feedback and make customer complaints, as well as defined processes for handling complaints. Consumers and end-users can make complaints via Aktia's website, directly to an Aktia employee or to one out-of-court dispute resolution body (The Financial Ombudsman Bureau/The Financial Supervisory Authority). A complaint made through Aktia's website or employee is registered in the customer feedback system" (page 97).

"Aktia's customers can also report misconduct or unethical behaviour through a digital whistleblowing channel maintained by a third party, and instructions for reporting are described on Aktia's website."

A candid limitation: "Aktia has not assessed whether customers and stakeholders are aware of the reporting channels or whether they trust the channels' effectiveness in handling feedback" (page 97).

Information security routes (page 97): the website "has a section on safe banking and clear instructions on what to do in a situation where online banking codes or a bank card have fallen into the wrong hands. Customers are directed to contact Aktia's customer service, the online bank or the card blocking service ... customers and other stakeholders can report detected phishing messages directly to the email address specified on the website." Internally, "The Enterprise Information Tool (EIT) on Aktia's intranet is used as a reporting channel for information security incidents detected by employees."

Where a complaint is against an individual, "the complaint must be handled by an independent colleague or manager" (page 96).

Taking action on material impacts on consumers and end-users

Reference: pages 97-98.

Information security and data protection (pages 97-98). "The Chief information Security Officer (CISO), together with the CISO team, is responsible for Aktia Group's information security strategy and measures ... The CISO is responsible for monitoring information security at Aktia and reports on information security regularly to management, risk management, the Board of Directors of Aktia and subsidiaries, and, if necessary, to authorities." The Data Protection Officer is responsible for data protection.

Aktia's risk management methods "include information security management in accordance with the requirements of the ISO 27001 standard", covering "information security risk, incident and continuity management; employee safety and physical security; securing services and information systems, for example through access control and encryption; supplier management and information security assessment of new suppliers; as well as regular training of employees and customers". For new or changed personal data processing, "a Data Protection Impact Assessment (DPIA) and other data protection assessments ... are carried out whenever necessary".

Training. "Every Aktia employee must complete mandatory online training on information security and data protection annually, and completion is monitored." Aktia runs "annual webinars and live events related to secure digital banking" for customers and "actively participates in the sharing of cyber threat information and intelligence between financial actors in accordance with Article 45 of the DORA regulation".

"No serious human rights problems or cases of human rights violations related to customers have been reported during the reporting period. Aktia has not taken specific actions aimed at generating significant additional impacts" (page 98).

Not disclosed: no monetary resources are allocated to these actions.

Targets related to consumers and end-users

Reference: page 98.

"Aktia has set targets for measuring Aktia's trust and reputation as well as information security with stakeholders internally and as part of its sustainability programme (2022-2025) ... Aktia has not set targets related to consumers and end-users in accordance with ESRS, but as part of the sustainability program approved in 2022" (page 98).

Four measured targets (page 98):

• Wealth plan coverage - "Aktia has set the goal of drawing up a wealth plan for 90% of customers and the outcome of 2025 was 69% (2024: 68%) of customers who have been granted a housing loan."
• Trust and reputation - T-Media's Reputation&Trust survey, measuring organisations "among stakeholders from eight different aspects: Administration, Finance, Management, Innovation, Interaction, Products & Services, Workplace and Sustainability". "The target level is above 3.50, and in 2025 the result was 3.56 (2024: 3.52)", against a 2022 baseline of 3.45 (page 88).
• Information security awareness (Inreach) - "The target is above 3, and the outcome in 2025 was 3.41 (2024: 3.43)."
• Supplier and stakeholder reviews (Outreach) - "Target is at least 25 supplier evaluations and stakeholder meetings annually and the outcome in 2025 was 47 (2024: 28)."

Three of the four were met; wealth plan coverage at 69% remains 21 percentage points short of the 90% goal.

Not disclosed: whether consumers or end-users were engaged in setting the targets.

Business conduct policies and corporate culture

Reference: pages 100-101 (section headed "G1-1 Corporate culture and business conduct policies").

Corporate culture. "One of the three priorities in Aktia's strategy is the Aktia Experience, a cultural program aimed at excellent customer and employee experience ... Customer focus is more than a strategic choice for Aktia - it is a cultural decision that is present in everyday thinking, operations and cooperation" (page 100). The three material G1 IROs are the financial opportunities of the Aktia Experience culture, operational risks "related to potential breaches of ethical practices such as fraud, corruption or bribery cases", and anti-money laundering and counter-terrorist financing activities.

Code of Conduct (page 100). It covers "anti-corruption, secondary occupations and positions of trust as well as protection of Aktia's business secrets", plus "rules on insider regulation, on prevention of money laundering and terrorist financing as well as rules on compliance with financial sanctions", and "is updated annually by the Compliance function". "Training on Aktia's Code of Conduct is mandatory for all employees and the operational management ... during the year 97.7% of Aktia employees completed the training." Breaches "may lead to actions in accordance with Aktia's disciplinary procedure".

Other instruments (pages 100-101): a directive on gifts and entertainment setting "guiding principles for transparency and moderation"; a directive on operational incidents under which "all employees are obliged to report detected risk events without undue delay"; and the Board's instruction on the prevention of money laundering and terrorist financing.

Whistleblower protection (page 101). A third-party channel allows confidential and anonymous reporting, open also to "External parties, also other than customers"; reports go to the Chief Compliance Officer and Chief Audit Executive. "By law, Aktia may not take retaliatory measures against whistleblowers. In addition, Aktia also undertakes not to use procedures aimed at preventing the reporting of infringements."

Prevention and detection of corruption and bribery

Reference: pages 101-102.

Anti-corruption (pages 101-102). "Aktia has a zero-tolerance for corruption, bribery and other undue influence ... Aktia's directive on gifts and entertainment (anti-bribery and anti-corruption measures) is approved by the CEO and applies to all employees, the operational management and consultants working for Aktia." "In accordance with the Code of Conduct, Aktia does not support, directly or indirectly, political parties, individual politicians or candidates in political elections."

Risk-exposed functions (page 101). "Employees who have direct contact with customers, those who can influence procurement or purchasing decisions, and those with decision-making authority related to customers are considered particularly exposed to risks associated with bribery and corruption."

Separation of investigators (page 102). "Benefits that exceed a certain value must be reported through Aktia's internal incident management system. The reports are visible to the manager of the person who made the report and to the Risk Control function and the Compliance function ... The reported cases of bribery and corruption are handled by the Chief Compliance Officer and Chief Audit Executive, who are independent from those involved in the case."

Training (page 102). "All employees must complete training on anti-corruption at the beginning of their employment. In addition, the training must be completed annually." The Code of Conduct training "consists of eight (8) modules", covering conflicts of interest, gifts and entertainment, reporting infringements and insider rules among others. Completion: 818 participants at a 97.7% rate (2024: 887 and 99.7%).

Financial crime prevention (page 102). "Aktia has continued to invest in its measures preventing money laundering and terrorist financing and has allocated resources for strengthening its procedures within this area. In addition, Aktia continues to not deliver payments to or from Russia or Belarus." Suspicious activity is reported to the Financial Intelligence Unit.

Targets related to business conduct

Reference: pages 100-102, with page 50.

Back-filled from the business conduct chapter, where targets are addressed as part of the MDR-T/GDR-T disclosures rather than as a numbered disclosure requirement. G1-3 became a standalone DR only in the 2025/2026 ESRS; the statement was prepared under the 2023 ESRS (page 45).

Aktia discloses no outcome-oriented business conduct target. The G1 chapter index lists only G1-1, G1-3 and G1-4 (page 99), and no material G1 IRO carries a stated target (page 100). Aktia's position on ESRS targets is stated topic by topic: "Aktia has not set targets related to its own workforce in accordance with the ESRS standard" (page 92); "Aktia has not set targets related to consumers and end-users in accordance with ESRS" (page 98); "Aktia has not set targets related to biodiversity and ecosystems in accordance with the ESRS" (page 87).

Consistent with MDR-T's other limb, effectiveness is tracked in the absence of targets. "Training on Aktia's Code of Conduct is mandatory for all employees and the operational management ... during the year 97.7% of Aktia employees completed the training. HR monitors the completion of the training" (page 100) - 818 participants at 97.7%, against 887 and 99.7% in 2024 (page 102). Anti-corruption training is required on joining and annually, with "The Operational Risk function monitor[ing] the completion rate and report[ing] on it in the Risk Control function's reports to the operational management and the Board of Directors".

Other monitoring (pages 101-102): quarterly Compliance reporting of bribery and corruption reports to management and the Board; mandatory reporting of benefits above a threshold; operational risk event reporting through the Enterprise Information Tool; and regular updates to the money laundering and terrorist financing risk assessments.

At programme level, "Business ethics" sits among the Principles of Governance focus areas, whose stated targets are ESG rating and information security measures rather than any corruption metric (page 50).

Incidents of corruption or bribery

Reference: page 102 (section headed "G1-4 Confirmed incidents of corruption or bribery").

"In 2025, no reports on corruption or bribery were received and no related operational risk events were detected. No convictions have been issued, and no fines have been paid for violations of anti-corruption and anti-bribery laws" (page 102). Aktia also states that "No cases of corruption or bribery have been reported in Aktia during the reporting period".

Detection and handling context (page 102). "In Aktia, cases concerning corruption and bribery can be reported through various channels, for example through Aktia's internal incident management system. The system is managed by the Risk Control function, which is independent from other operations and reports to the Compliance function. The whistleblowing channel can also be used to report suspected cases of bribery and corruption. The reported cases of bribery and corruption are handled by the Chief Compliance Officer and Chief Audit Executive. The Compliance function is responsible for including any bribery and corruption reports in its quarterly report."

The IRO-2 index references the G1-4 datapoints "Fines for violation of anti-corruption and anti-bribery laws" (paragraph 24(a)) and "Standards of anti-corruption and anti-bribery" (24(b)) to page 102 (page 60).