Banca Monte dei Paschi di Siena

The role of the administrative, management and supervisory bodies

Reference: pages 149-156.

Banca MPS has a traditional governance structure: Board of Directors, Board of Statutory Auditors, Shareholders' Meeting, Chief Executive Officer (also General Manager) and five Board committees, namely Appointments, Remuneration, Risk and Sustainability, Related-Party Transactions, and IT and Digitalisation (page 149).

Composition at 31 December 2025 (pages 149-153):

• 15 directors, of whom 11 assessed as independent (73.33%); the CEO is the only executive member, the other 14 are non-executive.
• Board gender split 53% men / 47% women; Board of Statutory Auditors 2 men and 1 woman among standing auditors.
• No employee or worker representatives sit on the Board.
• Director ages range from 50 to 72 (average 60); a Lead Independent Director has been designated since December 2024.

The Board adopted a "Diversity Policy on the composition of the Corporate Bodies" in February 2025 (page 152). Sustainability expertise is held by approximately 47% of directors, with two ESG Board induction sessions delivered by SDA Bocconi on 4 June and 18 September 2025 (page 156). The Sustainability Reporting Officer is the same person as the Financial Reporting Officer; Andrea Francesco Maffezzoni took that office on 1 July 2025 (page 151).

Information provided to and sustainability matters addressed by the bodies

Reference: pages 157-158.

Governance bodies are informed of material impacts, risks and opportunities through regular information flows and control mechanisms. The Board of Directors, supported by the Risk and Sustainability Committee (RSC), "reviews and approves the results of the double materiality assessment, evaluating the effectiveness of the policies adopted and their contribution to ESG risk management and opportunity enhancement" (page 157).

Frequency: "In 2025, ESG matters were addressed at 8 meetings of the Board of Directors" (page 157).

The material IRO list approved by the Board is presented per standard in the topical chapters, with time horizon and value chain boundary (page 157).

The Board of Statutory Auditors monitors the sustainability reporting process with the support of the corporate control functions, verifying the adequacy of the organisational structure, the existence of operational guidelines and procedures, and obtaining "a specific certification from the Delegated Administrative Body and the Sustainability Reporting Officer". For 2025 that certification was issued by the Financial Reporting Officer (pages 157-158).

Integration of sustainability-related performance in incentive schemes

Reference: pages 158-160.

ESG objectives have been integrated into variable remuneration since 2023 and aligned with the Industrial Plan (page 158). The CEO/General Manager scorecard is weighted economic-financial 80%, risk management 10% and ESG objectives 10% (page 159).

The composite ESG KPI comprises (page 159):

• New ESG lending to Individuals
• New ESG lending to Companies
• Percentage of the less represented gender in positions of responsibility
• Percentage of new ESG issuances, net of subordinated instruments

Climate considerations: "Climate considerations are included in the objective scorecard within the percentage weighting assigned to the achievement of ESG objectives (10%), which includes the volumes to be granted in support of the climate transition" (page 159). The lending indicator carries sub-targets linked to green volumes "defined in line with the annual financed-emissions reduction trajectory envisaged by the 2030 decarbonisation targets".

Non-executive directors and statutory auditors receive no incentive plans and no link to Group results (page 159). The 2025 remuneration policy was approved at the Shareholders' Meeting of 17 April 2025 (page 159).

Statement on due diligence

Reference: page 162.

The Group states that it "integrates the due diligence process within its business model and overall strategic framework, without configuring it as a separate and formalised procedure". The process comprises three phases: identification of actual and potential negative impacts caused or contributed to on people and the environment; management and mitigation through targeted actions; and transparent reporting of progress and measures adopted (page 162).

A mapping table sets the core elements of due diligence against ESRS references (page 162):

The 2025 double materiality analysis identified material IROs for each topic, sub-topic and sub-sub-topic, with results submitted to top management and external stakeholders and final approval by the senior governing bodies (page 162).

Risk management and internal controls over sustainability reporting

Reference: pages 163-164.

Preparation of the Statement "is integrated into the financial reporting process and is the responsibility of the Sustainability and ESG Function". Oversight of reporting regulation, project monitoring and coordination of disclosure is centralised at the Parent Company (page 163).

The control model follows the Internal Control System required by Bank of Italy Circular no. 285/2013, Title IV Chapter 3, and identifies (page 163):

• Parent Company departments performing first-level line controls on completeness, correctness, reliability and timeliness;
• subsidiaries in the reporting perimeter performing line controls, with their contribution approved by their own Boards;
• the Sustainability and ESG Function, which runs the annual double materiality analysis per EFRAG IG 1;
• the corporate control functions: the CRO department (integration of ESG risk factors into risk frameworks and risk appetite), the Chief Compliance Executive department and the Chief Audit Executive department. For Mediobanca the compliance and audit oversight is ensured by its own functions.

Verification supporting the Financial Reporting Officer's attestation follows a "mixed" operational model combining an analytical approach with a synthetic check-list and sub-certification approach, concluded in a "Report for the Issuance of the Certification" (page 164).

Strategy, business model and value chain

Reference: pages 164-169.

Banca MPS is a commercial bank whose model combines a branch network with a digital platform. Following completion of the public tender and exchange offer for Mediobanca, the Group perimeter expanded from 15 September 2025, adding Wealth Management, Corporate & Investment Banking, Specialty Finance, Consumer Finance and Insurance to the traditional retail and commercial banking business (page 167). At 31 December 2025 the Group employed 22,079 people (page 167).

The 2024-2028 Industrial Plan treats sustainable value creation as an enabling strategic lever, and in 2025 the Board approved an updated 2025-2028 Sustainability Plan built on three directions: support for the transition (including Net Zero own operations by 2030), the Bank's social role in local areas, and Governance and People (pages 164-166).

On 26 February 2026 the Board approved the 2026-2030 Industrial Plan, whose ESG strategy rests on stakeholder-oriented governance, decarbonisation and climate transition, and sustainable finance. Its quantitative ESG targets are to raise ESG AUM under SFDR Articles 8 and 9 from 47% in 2025 to 50% in 2030, ESG loans as a share of new lending from 17% to 25%, and bond issuance to around 25% of total annual issuances by 2030 (page 166).

The value chain splits into upstream (suppliers, business partners) and downstream (customers, end consumers) segments (pages 168-169).

Interests and views of stakeholders

Reference: pages 171-174.

Stakeholder engagement is run through a twofold approach (page 172):

• Stakeholder Management, interviewing the Group's internal structures that maintain ongoing dialogue with stakeholders, to identify and assess the related IROs;
• Stakeholder Engagement, direct one-to-one interviews with external stakeholders to assess and share the relevance of identified IROs.

Categories engaged, with method and topics addressed, are tabulated on pages 172-174:

Topics raised include climate change, sustainable finance, diversity and inclusion, the gender pay gap, human rights, financial inclusion and support for SMEs. The 2025-2028 Sustainability Plan provides for more structured engagement, including a stakeholder engagement policy (pages 165, 289).

Material impacts, risks and opportunities and their interaction with strategy and the business model

Reference: pages 179-185; IRO tables pages 180-182.

"As in the previous year, all macro-topics set out by the ESRS standards are material, with the exception of the Topic 'ESRS E2 - Pollution', 'ESRS E3 - Water and marine resources' and 'ESRS E4 - Biodiversity and ecosystems'" (page 179). The only change against FY2024 is that S1 Own workforce is now also material from a risk perspective, because "the analysis carried out in fact showed the potential risk linked to talent outflow to be material" (page 179).

The IRO tables (pages 180-182) set out 44 material IROs by topic, sub-topic, typology and value chain position: E1 15, E5 1, S1 7, S2 2, S3 4, S4 8 and G1 7.

Material climate risk exposures under continuous monitoring (pages 183-184):

• physical climate risk for credit risk in non-financial corporate portfolios;
• physical climate risk for credit risk in retail mortgage portfolios;
• transition climate risk for credit risk in non-financial corporate portfolios;
• transition climate risk for credit risk in retail mortgage portfolios;
• transition climate risk for operational and reputational risk, linked to exposure to counterparties in "brown sectors".

All are associated with Key Risk Indicators in the Risk Appetite Statement, with operational limits monitored quarterly and reported to top management (page 184).

Description of the processes to identify and assess material impacts, risks and opportunities

Reference: pages 169-179.

The methodology introduced in 2024 and aligned with the ESRS was confirmed for FY2025 with refinements that "did not result in substantial changes in the results" (page 169). The process runs in five steps (page 170): understanding the context and defining the boundary; mapping and engaging stakeholders; identifying potentially material IROs; assessing them; and identifying and validating material topics.

Assessment metrics (pages 176-178):

• Impacts: entity (severity or benefit), extension (scope, from "highly localised" to "global") and, for negative impacts only, irreparability, each on a 1 to 5 scale.
• Risks and opportunities: magnitude and likelihood of occurrence, each 1 to 5. "risks and opportunities that ... have an overall assessment higher than 3 are considered material" (page 177).
• Time horizons: short term 1 year, medium term up to 5 years, long term over 5 years (page 177).

Mapping used the ESRS topic, sub-topic and sub-sub-topic structure and concluded that "there was no need to identify IRO entity-specific, as the topics mapped are adequately included in the Topics and Sub topics provided for by the applicable ESRS standards" (page 174).

For climate, a dedicated process identifies physical and transition risk factors and transmission channels onto core risks (page 178).

Disclosure requirements in ESRS covered by the undertaking's sustainability statement

Reference: pages 185-190.

The Statement carries an explicit ESRS content index, printed as "Table of Contents [IRO-2]" (pages 185-189), with columns Section, ESRS topic, Duty of disclosure and Paragraph. It covers ESRS 2 (BP-1, BP-2, GOV-1 to GOV-5, SBM-1 to SBM-3, IRO-1, IRO-2), E1, E5, S1, S2, S3, S4 and G1. E2, E3 and E4 do not appear in the index at all, consistent with the DMA finding that those topics are not material (page 179).

Non-disclosure is signalled in the Paragraph column: E1-8 "Not applicable." and E1-9 "Phased-in" (page 185); E5-1 "Not applicable.", E5-2 "Not material", E5-3 "Not applicable.", E5-4 "Not material", E5-5 "Not material", E5-6 "Phased-in" (page 186); G1-2, G1-5 and G1-6 "Not material" (page 188).

A second table, "Elements of information from other EU regulations [IRO-2]" (pages 188-190), lists the Appendix B datapoints with a Material / Non-material column, marking the E2-4, E3-1, E3-4, E4-2 and E5-5 datapoints "Immaterial" and the E1-9 datapoints "Phased-in".

The Group notes that "The minimum reporting requirements regarding metrics, policies, actions and targets (MDR-M, MDR-P, MDR-A, MDR-T) are defined in those sections of each ESRS" (page 188); Group policies are gathered in a single [MDR-P] chapter (pages 191-214).

Transition plan for climate change mitigation

Reference: pages 215-221.

"As with most financial institutions, the predominant share of emissions attributable to the Group, equal to 99.91%, consists of 'Scope 3' financed emissions ... while only a small portion, 0.09%, derives from internal activities" (page 215).

The plan targets Net Zero by 2030 for own emissions and by 2050 for financed emissions, has been prepared since 2022 and follows NZBA, UNEP FI and GFANZ guidelines (page 215).

Scope (page 216): at the baseline date, high-emitting sectors accounted for EUR 14.9 bn of gross carrying amount to non-financial corporates and 2.663 mln tCO2eq of financed emissions, being 43% of total NFC exposures (EUR 34.8 bn) and 74% of total financed emissions (3.614 mln tCO2eq).

Levers include the ESG Outlook steering indicator, exclusion criteria for coal and unconventional oil and gas, green and sustainability-linked lending, and counterparty engagement (pages 218-219).

Approval: the plan and its targets "were presented to and discussed within the Management Committee - ESG Session and subsequently approved by the Board of Directors, subject to the binding opinion of the Risks and Sustainability Committee", and were "definitively approved by the Board of Directors in January 2025" (page 217).

On locked-in emissions: "the MPS Group has provided for further analyses within the 2025-2028 Sustainability Plan, aimed at identifying them" (page 218).

Identification of climate-related risks and scenario analysis

Reference: pages 178, 183-184.

Back-filled from ESRS 2 IRO-1 and SBM-3. This disclosure requirement did not exist under the 2023 ESRS (Delegated Regulation (EU) 2023/2772) the report was prepared against.

Classification. Risks are analysed as transition risk (Climate Change Mitigation) and physical risk (Climate Change Adaptation), following a pathway begun after the November 2020 ECB Guidelines (page 182). The five material climate risk exposures are listed under SBM-3.

Methodology (page 178). Three areas: sensitivity analysis of the Group's own activities; portfolio analysis of counterparty exposure; and verification of suppliers' climate risk management maturity.

Scenarios (page 183). "The climate scenarios used for physical risk are based on Open Data (ISPRAmbiente, IPCC, Copernicus) and commercial sources (Cerved Spa), with medium- to long-term impact projections according to 'Current Policies' models (Hot House World). For transition risk, scenarios are used that envisage a drastic reduction in greenhouse gas bond issues, such as 'Net Zero 2050', in line with the Paris Agreement." Target-setting separately uses NGFS Net Zero 2050 and IEA NZE2050 (page 228).

Time horizons (page 183): short term up to 1 year; medium term 1 to 5 years; long term over 5 years, open-ended beyond 2050.

Gap: no global average temperature projection is stated for each scenario used.

Resilience in relation to climate change

Reference: pages 182-184.

Back-filled from ESRS 2 SBM-3 and the climate risk management section. This disclosure requirement did not exist under the 2023 ESRS the report was prepared against.

Resilience statement (page 182): "the resilience of the Group's strategy and business model is reflected in its ability to deal with material risks and impacts that have arisen, as well as to take advantage of identified opportunities. This resilience is ensured by the consistency of the analyses carried out in the context of the double materiality analysis with the stakeholder engagement activity, with the 2024-2028 Industrial Plan and with the analyses of the impact of ESG risk factors".

How scenario results feed the response (pages 183-184): physical and transition risk variables are integrated into simulation processes to determine risk add-ons calculated through probability of default and loss given default. "The C&A risk management approach includes the definition of a tolerance margin based on adverse scenario analyses conducted in internal and institutional climate stress testing programmes", with operational exposure limits assigned to business structures and escalation when limits are exceeded.

Capacity to adjust (page 184): Risk Appetite Statement KRIs and limits are monitored quarterly and reported to top management.

Gap: no separate ESRS-defined resilience analysis is presented.

Policies related to climate change mitigation and adaptation

Reference: pages 221-222; policy descriptions pages 191-196.

The policy framework is anchored in the Group Directive on Sustainability and ESG, which "sets out commitments relating to impacts on the environment, ecosystems and the circular economy" and articulates the Group's commitment along three strategic lines (pages 221-222):

• provision of green lending, through lending standards integrated with ESG criteria and dedicated products;
• investment services, progressively adding advisory, investment and insurance products with sustainability-linked strategies;
• issuance of green bonds.

The Code of Ethics "identifies the environment as a primary asset that the Group is committed to safeguarding", reinforced by the Group Directive on Legislative Decree 231/2001 compliance obligations, which extends governance and control safeguards to environmental matters (page 222).

Further instruments are the Group Environmental Policy, the Group Directive on Oversight of the Environmental Management Model and the Group Policy on Safety and Environment, which set the criteria for managing activities with significant environmental impact (page 222). Climate and environmental risk factors are governed by the Group Risk Management Policy and the "Methodological Rules for ESG risk factors" (page 222).

Actions and resources in relation to climate change policies

Reference: pages 222-227.

Own operations (pages 223-224). Since 2019 the Group draws up a Measurement and Verification Plan under the IPMVP protocol, certified by Tor Vergata University of Rome, which for 2025 evidenced a reduction in project-related consumption of 7,181 MWh against the 2019 baseline. The network energy management platform (PER) is installed at more than 1,200 branches. LED relamping was completed at approximately 90 properties, and Home-Work Commuting Plans covered 14 offices in 8 cities and about 3,800 employees.

Downstream value chain (pages 224-227). Sectors are grouped into three clusters: priority high-emitting sectors with published 2030 targets; non-priority high-intensity sectors (Real Estate, Transport, Automotive, Agriculture, Chemicals) with interim management targets; and all others managed counterparty by counterparty.

Green volumes disbursed in 2025 (page 227), Group excluding Mediobanca:

Project finance disbursed EUR 257 mln for renewables and sustainable mobility and EUR 106 mln for sustainable real estate; the Group completed its first Green Senior Preferred Unsecured Bond of EUR 500 mln (pages 225-226).

Targets related to climate change mitigation and adaptation

Reference: pages 227-232.

Own operations (pages 227-228). Baseline year 2017. The initial target was a 60% cut in Scope 1 by 2026 and 100% renewable electricity; the 2024-2028 Industrial Plan added Net Zero for Scope 1 and Scope 2 market-based by 2030. At 31 December 2025 the Group recorded a 90% reduction in Scope 1, a 49% fall in fossil fuel consumption and a 38% reduction in energy consumption versus 2017.

Downstream value chain: 2030 financed-emissions targets (pages 228-232).

Trajectories use NGFS Net Zero 2050 for Oil & Gas, Power Generation and Iron & Steel (2022 baseline) and IEA NZE2050 for Cement and Aluminium (2023 baseline); financed emissions follow PCAF (page 228).

Progress is positive except Oil & Gas, which "is characterised by a more complex and slower decarbonisation pathway than that required to meet the 2030 target"; a review of that target and baseline is planned during 2026 (page 231). No target was set for Agriculture "as it is characterised by limited quality of the associated emissions data" (page 217). Upstream, "the Group has not defined specific climate change management targets along the upstream value chain" (page 232).

Energy consumption and mix

Reference: pages 232-235.

Consumption is collected per building from each Group company and includes natural gas, electricity, heat, steam and cooling, fuel for company cars and diesel for heating (page 232).

Coal consumption is nil. Total consumption fell 3.8% year on year. Renewable electricity backed by Guarantees of Origin or self-generated reached 99.16% of total electricity at Group level and 99.93% at the Parent Company (pages 233-234). Energy intensity is reported against net revenue from activities in high climate impact sectors, which amounted to EUR 5,150 thousand in 2025 (page 235).

Gross Scopes 1, 2, 3 and Total GHG emissions

Reference: pages 235-242.

Scope 1 and 2 follow the operational control criterion under the GHG Protocol Corporate Standard (page 235).

"for the purposes of calculating Scope 3 emissions, estimates were used for 99.98%" (page 236). Scope 1 and 2 use ABI Lab Guidelines (December 2025) conversion factors, ISPRA emission factors and IPCC GWPs (page 236). Category 15 financed emissions follow PCAF, with residential and commercial mortgages newly included in 2025 and the 2024 figure not restated (page 147). Categories 7, 8, 10, 11, 12 and 14 are excluded as not material or already counted (page 239). There were no biogenic CO2 emissions in any scope (page 236).

GHG removals and GHG mitigation projects financed through carbon credits

Reference: page 242.

"In 2025, the Group offset emissions arising from the use of 2.833 million scm of natural gas, equal to around 100% of the total natural gas consumption of Banca MPS and Banca Widiba, through the purchase of VER credits for participation in the project known as Karcham Wangtoo Hydroelectric Plant (VCS-1742), developed by Jaypee Karcham Hydro Corporation" (page 242). The verification standard is the Verified Carbon Standard (VCS) by Verra.

100% of credits come from reduction projects and none from absorption projects; the share from projects within the EU is nil (page 242).

The Group states plainly that "No removal mechanisms are included" and that "No external certification (such as SBTi) has been envisaged and there is currently no formal document describing the methodology adopted in detail" (page 242). Carbon credits are used to offset the share of hard-to-abate emissions supporting the Scope 1 reduction target published in the 2022-2024 business plan (page 242).

Policies related to resource use and circular economy

Reference: page 243.

The E5 chapter states that the material element for the Group is an opportunity scoped to the downstream value chain: "Outflows of resources related to products and services ... with reference to the downstream value chain" (page 243).

Policies cited are the Group Sustainability and ESG Directive, "which sets out commitments relating to impacts on the environment, ecosystems and the circular economy", the Group Code of Ethics, and the Model 231 (page 243). For direct impacts the Group applies the "Management and monitoring of the waste disposal service" policy (page 243).

On the downstream opportunity, "the Group identifies an opportunity in pursuing investment strategies towards sustainable long-term projects and products by offering dedicated credit solutions to companies engaged in material recovery and reuse" (pages 243-244).

Index inconsistency. The Group's ESRS content index sets the Paragraph column for E5-1 to "Not applicable.", E5-2 to "Not material" and E5-3 to "Not applicable." (page 186), contradicting its own E5 chapter, which prints these codes as section tags, and the DMA, which lists E5 as material with one opportunity IRO (pages 179-180). Taken as reported on the strength of the tagged sections.

Actions and resources related to resource use and circular economy

Reference: pages 244-245.

The Group offers "dedicated credit solutions to companies active in material recovery and reuse, supporting activities such as recycling, waste management and the reuse of raw and secondary materials", with an ESG questionnaire used to "collect qualitative and quantitative information on their commitment to circular economy models" (page 244).

Named initiatives (pages 244-245):

• National Recovery and Resilience Plan (NRRP), "Green revolution and ecological transition".
• SACE Growth, Green module, renewed in 2025, with SACE guarantees for around 70% of the total disbursed.
• Green Energy Financing for new biomethane plants and conversion of existing biogas plants.
• Conventions with the Ministry for Business and Made in Italy, Invitalia, CDP and ABI supporting SME investment and the "Italian Green New Deal".

At Banca Widiba the NANDO pilot project in Milan applies AI to office waste management (page 244).

Index inconsistency. The Group's ESRS content index sets the Paragraph column for E5-1 to "Not applicable.", E5-2 to "Not material" and E5-3 to "Not applicable." (page 186), contradicting its own E5 chapter, which prints these codes as section tags, and the DMA, which lists E5 as material with one opportunity IRO (pages 179-180). Taken as reported on the strength of the tagged sections.

Targets related to resource use and circular economy

Reference: page 245.

The Group discloses that it has set no quantitative target: "To date, the Group has not defined specific quantitative targets for the management of resource outflows related to products and services along the downstream value chain. The adoption of specific targets dedicated to fostering the ecological and circular transition of the target customers will be evaluated in the future in order to ensure a continuous improvement of the commitment on this issue" (page 245).

In place of a target it points to an existing framework: "However, the topic is appropriately covered through the broader framework of the decarbonisation targets set by the Group, in line with the guidelines defined by the NZBA framework" (page 245), namely the 2030 sector trajectories under E1-4.

The chapter adds that the initiatives described "form part of the Group's ordinary operations and are monitored and renewed annually" (page 245), the effectiveness-tracking limb of the minimum disclosure requirement.

Index inconsistency. The Group's ESRS content index sets the Paragraph column for E5-1 to "Not applicable.", E5-2 to "Not material" and E5-3 to "Not applicable." (page 186), contradicting its own E5 chapter, which prints these codes as section tags, and the DMA, which lists E5 as material with one opportunity IRO (pages 179-180). Taken as reported on the strength of the tagged sections.

Policies related to own workforce

Reference: pages 247-260.

Policies are set out by sub-topic. On working conditions, the Group commits to secure employment, working hours, fair remuneration, social dialogue, freedom of association, collective bargaining and work-life balance under the Code of Ethics. "All Group employees are covered by collective bargaining, at national level through the application of the sectoral national collective labour agreements for the banking sector and, at company level, through the signing of second-level bargaining agreements" (page 247).

On occupational health and safety, the Parent Company operates an OHSMS certified since 2008, with risks recorded in the Risk Assessment Document, updated during 2025 (page 250).

On training and skills, development including reskilling and change management is governed by internal rules and the supplementary bargaining agreement of 25 July 2025 (page 251).

On diversity and inclusion, the Gender Equality Policy states zero tolerance of discrimination on race and ethnic origin, colour, sex, sexual orientation, gender identity, disability, age, religion, political opinion, national or social origin. Harassment can be reported through the whistleblowing system or to a dedicated Protection Committee (page 256).

On privacy, the Data Protection Policy is reinforced by the Group Directives on Logical Security Governance and ICT Risk and Security Management (page 259).

Processes for engaging with own workforce and workers' representatives about impacts

Reference: pages 260-261.

"In line with constitutional principles and regulations in force, the Group encourages freedom of association for employees, which it manifests in many ways. Level II bargaining, which is entirely consistent with the applicable regulatory framework, confirms the strategic value of dialogue and the active involvement of trade union organisations, at the basis of a corporate climate of positive participation. To this end, the Group is committed to promoting information and consultation rights of the Trade Unions" (page 260).

"Ongoing discussion between the parties, at central and peripheral level, has the objective of fostering adequate awareness and assessment of the repercussions on resources of reorganisations and seeking suitable convergences to mitigate impacts and guarantee quality of working conditions" (page 261).

Engagement also feeds the double materiality analysis: employees were engaged through interviews with the Human Resources and Workers' Health and Safety functions and a workshop with Group employees selected from sustainability contacts (pages 173-174).

Concrete outcomes in 2025 include the July 2025 second-level agreements on professional development, welfare and territorial mobility and on the company bonus, and the extension of the MP Solidale time bank to colleagues who are victims of gender-based or domestic violence (pages 248-249).

Processes to remediate negative impacts and channels for own workforce to raise concerns

Reference: page 262.

"The Group promotes, by means of territorial meetings, moments of confrontation and instances of dialogue to encourage opportunities to express any concerns and needs of its workers" (page 262).

The formal channel is the Whistleblowing system governed by the Group Code of Ethics: "Through the dedicated IT platform or via a special telephone service, staff and certain qualified external personnel may report, confidentially, irregular or incorrect circumstances and conduct which they suspect or have become aware of in the course of their duties." Reports are received by the fraud audit department, which also conducts internal investigations (page 262).

An online whistleblowing training campaign launched in 2024 continued in 2025 with all Group resources enrolled (page 262).

For inappropriate behaviour under the "Rules on preventing and combating gender-based harassment in the workplace", employees may instead refer to an internal Protection Committee (page 262). A listening and psychological counselling service, in place since 2016 and extended to all Group companies, evolved on 3 June 2024 into an anonymous support service that "may be used as an initial specialist support and guidance service in the event of reports of harassment in the workplace" (page 248).

Taking action on material impacts on own workforce

Reference: pages 247-260.

Actions are set out sub-topic by sub-topic.

Working conditions (pages 248-250): the July 2025 second-level agreements on professional development, welfare and territorial mobility and on the company bonus; the MP Solidale time bank, extended in July 2025 to colleagues who are victims of gender-based or domestic violence; extended paternity leave and new leave for children's school enrolment; the Professione Genitori parental pathway; corporate pension funds receiving 3% of remuneration.

Health and safety (page 250): RINA Services audits from 25 February to 7 March 2025 confirmed renewal of the ISO 45001:2018 certification, with improvement programmes defined as a result.

Training (pages 251-256): annual planning linking each activity to corporate processes and risks, a Risk Culture Framework project launched in 2025, and around 10,000 people in direct customer contact trained on MiFID II for 30 hours per capita.

Diversity and inclusion (pages 257-258): Plural Management training reaching 240 resources with positions of responsibility; the Women's Empowerment workshop with 77 women and an equal number of men; the online course "Prevention of and response to gender-based harassment" taken by 96% of the corporate population.

Retention (pages 258-259): actions to retain critical resources during the Mediobanca integration, with structured monitoring.

Targets related to own workforce

Reference: pages 250, 251, 256, 258-259.

Diversity target, quantified (page 258): the percentage of positions of responsibility held by women "was set at 35% by 2023 and was comfortably passed, with the actual figure at the end of this period reaching 37% and increasing further to 38.6% at the end of 2025. This indicator will continue to be monitored, with the objective of reaching the target set by the 2024-2028 Industrial Plan, equal to more than 40% at the end of the period."

Working conditions (page 250): annual qualitative and quantitative objectives covering resource empowerment, role assignment, training, performance assessment, corporate climate monitoring and personnel cost budgets.

Health and safety (page 250), stated as an absence: "To date, the Group has no specific targets to manage the issue of safety at work. However, the monitoring of the issue is ensured for the Parent Company by the aforementioned external audits and by the improvement programmes and continuous dialogue with the Workers' Safety Representatives."

Training (page 256): annual objectives set by the Human Resources department, monitored through process KPIs. Privacy (page 261): second-level compliance controls, audits and Level II checks on Data Protection Impact Assessments.

Characteristics of the undertaking's employees

Reference: pages 263-266.

Figures are actual headcount at period end, not estimates or averages (page 262).

Italy accounts for 21,197 of the 22,079 employees, with the remainder spread across Algeria, China, Egypt, France (173), Germany (18), India, Luxembourg (30), Morocco, Monaco (290), the United Kingdom (264), Switzerland (33), Tunisia (42), Turkey and the United States (17) (page 263).

Turnover (page 266): the MPS Group net of Mediobanca reported 87 new hires and 274 terminations, of which 110 resignations; Mediobanca reported 90 new hires and 108 terminations, of which 97 resignations, since closing. "The turnover rate (excluding Mediobanca), calculated as the ratio between the total number of terminations (274) and the total number of active human resources (16,546), is 1.66%. In 2024, it stood at 1.53%."

The change in headcount against 2024 reflects the Mediobanca acquisition rather than organic growth.

Characteristics of non-employee workers

Reference: page 266.

"The total number of workers who are not employees at the end of the period was 1,788" (page 266).

The Group flags a methodological change: "With reference to DR S1-7, compared to the previous year, the scope of non-employee workers has been expanded to also include financial advisors in order to provide a more detailed representation of the own workforce", with 2024 comparatives restated and the difference against the previously published figure shown (page 147).

On the 2024 basis: "In 2024, the Group provided disclosure solely for workers made available by undertakings whose principal activity is 'employment activities' (NACE N78, temporary agency workers), totalling 6. Self-employed workers (financial advisers and agents), on the other hand, numbered 567 in 2024" (page 266).

Collective bargaining coverage and social dialogue

Reference: pages 266-267.

"All employees in Italy are covered by collective bargaining agreements; therefore, the percentage is 100%" (page 266).

Figures are given for countries with more than 50 employees representing more than 10% of the total, which in practice means Italy (page 267). The 2024 comparative is reported in the 80 to 100% band for Italy on both collective bargaining coverage and workplace representation (page 267).

The underlying arrangement is that "All Group employees are covered by collective bargaining, at national level through the application of the sectoral national collective labour agreements for the banking sector and, at company level, through the signing of second-level bargaining agreements", with the economic and regulatory treatment of the CCNL supplemented by company bargaining on welfare, economic integration, training and professional development (pages 247-248).

Diversity metrics

Reference: page 267.

Senior management is defined as the first and second levels reporting to the management and control bodies: for the Parent Company, Chief and First Levels; for Group companies, the General Manager where one exists; for Mediobanca, first-level key function holders and the management and control bodies (page 267).

Two features stand out. Women hold 22.45% of senior management positions against a workforce that is 50.7% female, and the share of women in senior management fell slightly against 2024 (23.60%). The age profile is heavily weighted to over-50s at the legacy MPS perimeter (54.64%), while Mediobanca brings a younger profile (11.66% under 30 against 1.99%).

Adequate wages

Reference: page 268.

"The Group ensures a fair level of remuneration for all staff, in compliance with supervisory provisions and the provisions of the CCNL. To ensure internal consistency, gender neutrality and alignment with best practice, the Group assesses the positioning of employees' remuneration packages against the reference market, also with the support of specialist consultants and always in full compliance with company-level bargaining and the CCNL in force from time to time" (page 268).

The Group states that this approach "makes it possible to maintain the competitiveness of the remuneration package and to support the attraction and retention of key staff", with further detail cross-referenced to the Report on remuneration and fees paid (page 268).

On forthcoming regulation: "the Group actively participates in sector working groups on issues related to regulatory developments concerning EU Directive 2023/970 of 10 May 2023 (so-called 'Pay Transparency Directive'), with a view to progressive and rapid alignment with the future Italian regulatory framework" (page 268).

Under the Pay Transparency heading the Group commits to "systematically monitoring the trend of the gender pay gap, adopting corrective measures for its reduction" (page 259). No adequate-wage benchmark or percentage of employees paid above an applicable minimum is disclosed.

Social protection

Reference: pages 268-270.

"Employees with a subordinate employment relationship (Italy contract) with one of the companies of the Group are covered against the various cases of loss of employment income by the protections provided by Italian law" (page 268). For the Parent Company and Banca Widiba the Credit Sector CCNL and the MPS Supplementary Agreement also apply; MPS Tenimenti and MPS Magazzini Generali Fiduciari apply their own national agreements.

Cover disclosed for the Parent Company and Widiba (page 268):

• Illness: salary and job preservation up to 36 months (CCNL), NASPI for 24 months after dismissal, and recruitment of a child or spouse on premature death.
• Unemployment: NASPI indemnity for 24 months following any dismissal.
• Work injury and disability: salary and job preservation up to 36 months, indemnified leave, benefits for approaching retirement, and insurance cover for permanent disability or death.
• Parental leave: job preservation and indemnity for compulsory and optional leave, plus CCNL salary top-ups.
• Retirement: extraordinary income support within 5 years of entitlement, the AGO pension and supplementary pension benefits.

The MPS Pension Fund and MPS Welfare Fund, introduced in 2020 with membership open to dependent family members, allocate on ESG criteria and are UNPRI signatories (pages 269-270).

Persons with disabilities

Reference: page 270.

"The proportion of the Group's own employees with disabilities is 6% (of whom 52% men and 48% women). For Mediobanca, the proportion is 5% (of whom 51% men and 49% women). Excluding Mediobanca, the figure stands, as in 2024, at 6% (of whom 52% men and 48% women)" (page 270).

"The criteria that identify persons considered 'disabled' under Law 68/1999 are set out in Article 1 of the Law. Each year, in compliance with the regulations in force, the Group checks, on the basis of the overall workforce, the number of disabled workers to be included and proceeds, normally in agreement with Employment Centres (Provincial Offices of the Ministry of Labour responsible for compulsory employment) to recruit disabled workers" (page 270).

The Group notes that additional workers fall within the "other protected categories" of Article 18 of Law 68/1999, for whom a percentage of compulsory recruitment is reserved although they are not disabled, for example orphans of persons who died as a result of work, and refugees. Those workers are not included in the 6% figure (page 270).

Related actions include "Inclusive Leadership" training run in 2025 with a focus on disability and an inclusive communication guidance document published during Inclusion Week in March 2025 (page 257).

Training and skills development metrics

Reference: pages 270-272.

Performance reviews, by gender (page 270):

By category, coverage is 93.35% for executive managers, 98.20% for middle managers and 98.20% for professional areas (page 271).

Average training hours (page 271):

By category the consolidated averages are 10.5 hours for executive managers, 31.6 for middle managers and 35.2 for professional areas (page 271).

The Group explains the Mediobanca figures: "For the Mediobanca Group, the training considered is only that delivered from 30 September to 31 December 2025" (page 271), which is why the consolidated average falls below the 41.6 hours recorded at the legacy perimeter. The 3D Approach model delivered "a reduction in serious and very serious gaps in favour of slight and insignificant gaps" and an increase in the number of resources with 40 to 60 training hours (pages 271-272).

Health and safety metrics

Reference: pages 272-273.

Occupational illness cases, fatalities from occupational illness and days lost to work-related injuries, illnesses and fatalities are all reported as 0 (page 273).

Two movements deserve attention and are not commented on by the Group: two serious accidents in 2025 against none in 2024, and Mediobanca's recordable accident rate of 8.03 against 2.10 at the legacy MPS perimeter. Commuting accidents rose from 92 to 125.

The Group flags a data gap twice: "The required data on the total number of non-employees whose work and/or workplace is controlled by the organisation are not available" (pages 272-273).

Work-life balance metrics

Reference: pages 273-274.

"During 2025, a total of 4,241 employees (or 19% of eligible staff) took parental leave, of whom 1,535 were men (or 14% of eligible men) and 2,706 women (or 24% of eligible women)" (page 273).

"Benefits are granted to all staff regardless of contract type and working hours (part-time or full-time). All employees are entitled to leave for family reasons. When returning from parental leave, job preservation is fully guaranteed" (page 273).

"As at 31 December 2025, the return-to-work rate after parental leave was approximately 92%, and the retention rate 12 months after leave (excluding the Mediobanca Group) was approximately 99%, with an even percentage for women and men." In 2024 the return rate was approximately 94% and the retention rate 98% (page 274).

The Group flags a methodological change: 2024 covered parental leave only, whereas 2025 covers "all types of family leave, among which those provided for under Law 104", with 2024 recalculated (page 147).

Compensation metrics (pay gap and total compensation)

Reference: pages 274-275.

"For 2025, the percentage delta between the average gross hourly wage of male employees and the average gross hourly wage of female employees corresponded to 29.4%. For the Mediobanca Group, the difference was 44.8%, while excluding the latter the difference was 11.4% (11.35% in 2024)" (page 274).

By employment category the consolidated gap is 30.8% for executives, 14.7% for middle managers and -1% for white-collar workers; net of Mediobanca the figures are 16.2%, 6.7% and -1% (page 274).

"For 2025, the total remuneration ratio, calculated as the ratio of the annual gross total remuneration of the highest-paid person to the median annual gross total remuneration of the remaining employees (excluding that person), was 66.1" (page 274).

Both indicators jump because of the acquisition. The Group explains: "The expansion of the Group workforce, with highly specialised positions for which a greater presence of male workers is found in the Mediobanca Group, resulted in a wider gap in the Group indicator" (page 274). No equivalent explanation is offered for the total remuneration ratio rising from 8.97 to 66.07.

Incidents, complaints and severe human rights impacts

Reference: page 275.

"No evidence has been found of legal and/or out-of-court claims relating to episodes of violations by the workforce of rights relating to gender equality (against four relevant reports on the topic of 'sexual harassment in the workplace'), in line with the previous year. More generally, the absence of judicial and/or extrajudicial applications on the subject of serious human rights incidents is confirmed" (page 275).

So the return is a nil return on claims, with four internal reports of sexual harassment in the workplace disclosed alongside it. The report gives no further detail on the outcome or handling of those four reports.

The EU legislation datapoint table marks as "Material" the S1-17 datapoints on incidents of discrimination (paragraph 103(a)) and non-respect of the UN Guiding Principles on Business and Human Rights and the OECD Guidelines (paragraph 104(a)), pointing to this section (page 189).

Channels through which such matters reach the Group are the whistleblowing system operated by the fraud audit department and the internal Protection Committee established under the "Rules on preventing and combating gender-based harassment in the workplace" (page 262). No fines, penalties or compensation for damages relating to severe human rights incidents are reported.

Policies related to value chain workers

Reference: pages 276-277.

The mapping exercise "resulted in the identification of material impacts in relation to the upstream value chain only", so the disclosures cover suppliers' workers under "working conditions" and "other work-related rights" (page 276).

The Group Code of Ethics "is the document that governs the guiding principles, values and rules of conduct that complement the legal and regulatory obligations for workers in the upstream value chain" (page 276). "on the basis of contracts and general purchasing conditions, suppliers are required to expressly accept, by means of a specific form, the declaration of commitment not to engage in behaviour that conflicts with the provisions of the Group's Code of Ethics" (pages 276-277).

"The Group also undertakes to respect the United Nations Universal Declaration of Human Rights ... including the principles on Child Labour and Forced Labour" (page 277).

Supporting instruments are Model 231, the Group Directive on Expenditure and Supplier Management, and the Group Health and Safety Policy (page 277).

"To date, no cases of non-compliance with the UN Guiding Principles, the ILO Declaration or the OECD Guidelines with regard to workers in the upstream value chain have been detected at Group level" (page 277). The 2025-2028 Sustainability Plan provides for a Human Rights Policy and an ESG Procurement Policy (page 165).

Processes for engaging with value chain workers about impacts

Reference: page 279.

The Group discloses the absence of a formal process and what stands in its place: "Although the Group does not have a formalised process for involving suppliers' workers, either directly or through representatives, it does believe that the requirements assessed when signing contracts with suppliers make it indirectly possible to assess respect for the rights of workers" (page 279).

Two mechanisms are described (page 279):

• Supplier evaluation questionnaire. "a questionnaire is submitted, with answers where the supplier with certification is given a score. Suppliers holding such certifications obtain scores that also assume greater relevance at the stage of selection for the award of the supply/service."
• Self-declaration at registration. "all suppliers are also required to provide a self-declaration on the application (where required) of the relevant national/regional collective labour agreements."

Engagement for the double materiality analysis was conducted indirectly, through an interview with the Procurement function rather than with suppliers' workers (page 174). "The constant involvement of suppliers ... takes place through the Stakeholder Management process overseen by the Purchasing Department" (page 277).

Processes to remediate negative impacts and channels for value chain workers to raise concerns

Reference: page 279.

"In order to prevent and/or remedy the concerns of workers in the value chain, the Group provides channels of free access also to external parties, such as the Whistleblowing system. This system helps to monitor and prevent the risks to which the Group may be exposed as a result of facts and conduct contrary to external regulations, company rules, internal procedures and its own Code of Ethics, thereby contributing to the implementation of sustainability policies and promoting their integrity and fairness" (page 279).

Access is explicitly extended beyond the Group's own staff: "access is through institutional channels, and therefore the system may also be accessed by any employees or staff not only of the Group, such as employees belonging to companies that provide goods or services or perform work for third parties and perform or have performed their work for the Group" (page 279).

Protections are described under G1: the Group protects whistleblowers reporting in good faith against retaliatory or discriminatory conduct, ensures confidentiality, and applies penalties to anyone who breaches confidentiality, retaliates or obstructs a report. Feedback is given to the reporter within three months (pages 316-317). The report does not state how many reports, if any, came from value chain workers in 2025.

Taking action on material impacts on value chain workers

Reference: pages 277-280.

"Suppliers are selected based on an assessment process that ... provides for the express assessment of compliance with regulations on labour law, National Collective Labour Agreement application, and payment of contributions (DURC) ... the possession of ESG certification of the counterparty" (page 277).

Conduct required across the procurement chain includes objectivity in supplier selection, anti-mafia checks with declaration of the beneficial owner, a declaration that no corruption convictions exist, observance of anti-money laundering legislation, and "verification of technical and professional suitability, especially in work requiring temporary or mobile construction sites ... in accordance with Article 26 and Title IV of Legislative Decree 81/08" (pages 277-278).

"For specific product categories, for which workers' physical wellbeing and moral character are of key importance, the commitment focuses strongly on examining the supplier's economic and financial conditions and the level of protection for workers" (page 278).

"The Group's anti-corruption policies and procedures are communicated to individual suppliers, covering 100% of suppliers" (page 278).

Outcome disclosed: "Based on the analyses carried out by the functions involved, no serious human rights problems or incidents in the upstream value chain have been reported to date" (page 278).

Targets related to managing material negative impacts on value chain workers

Reference: page 278.

The Group discloses the absence of a target and the monitoring that stands in its place: "The Group has not, to date, defined any specific targets to deal with the issue of value chain workers. However, the effectiveness of the policies and actions adopted in this regard is ensured through the monitoring of specific indicators in order to ensure supply chain management aimed at respecting the principles of social and environmental sustainability" (page 278).

The monitoring described is "the verification, in the years following those of the first contractualisation, of the existence of the requisites for registration in the Group's Supplier Register, as well as the controls carried out by the Control and Internal Audit functions" (page 278).

Quantified activity: "During 2025, 100% of the new suppliers (230 in total) were assessed according to environmental criteria, in accordance with international standards" (page 278). The E1-4 section adds that this was "about twice as many as in 2024" (page 232).

"The adoption of specific targets to deal with this issue will be evaluated in the future" (page 278). The 2025-2028 Sustainability Plan foresees an ESG Procurement Policy (page 165).

Policies related to affected communities

Reference: page 280.

"The Group pursues the social and environmental development of the community in which it operates through professional development initiatives, events dedicated to career guidance, the promotion of financial education programmes, actions supporting the more vulnerable groups and the promotion of artistic heritage (banking and national)" (page 280).

The policy framework named for this topic is the Group Directive on Communication and External Relations, together with the rules on Management of the historical archive, Management of artistic heritage and Management of sponsorships and fundraising, "aimed at governing the protection and enhancement of cultural heritage and support for social and local initiatives" (page 280).

Oversight is ensured by the wider framework of the Group Directive on Sustainability and ESG, the Montepaschi Group Code of Ethics and the Group Directive on Legislative Decree 231/2001 compliance obligations (page 280).

The material sub-topic identified in the double materiality analysis is "Economic, social and cultural rights", carrying two positive impacts and two opportunities and no negative impacts or risks (page 181).

Processes for engaging with affected communities about impacts

Reference: page 288.

"The Group's business model seeks to enhance the needs of customers and small and medium-sized enterprises rooted in the territory by listening to their needs in order to identify new opportunities and community needs. The Group recognises the importance of the point of view of the affected communities, promoting structured interaction with associations, bodies, institutions and players in the civil economy, active in the area" (page 288).

"The focus on communication with and involvement of the target communities is directly implemented through events and sponsorships as tools for dialogue and discussion with stakeholders ... encouraging the participation and involvement of all local stakeholders" (page 288).

The process is formalised under the Group Communication and External Relations Directive, with external communication overseen by the Communications Staff function and the "Media Relations, Events and Sponsoring" function coordinating delegated activities (page 288).

For the double materiality analysis, community representatives were engaged through "Virtual one-to-one interviews with representative figures from the community and the local area (trade associations, ESG associations)" (page 172). The 2025-2028 Sustainability Plan provides for a stakeholder engagement policy (page 289).

Processes to remediate negative impacts and channels for affected communities to raise concerns

Reference: pages 288-289.

The Group frames this as protection of human rights in affected communities: it "recognises the social value of its role and is committed to generating shared value for the communities and territories in which it operates, with respect for human rights, the self-determination of local communities and the quality of social contexts" (page 288).

"The Group's commitment to communities is formalised in the Code of Ethics, which defines the guiding principles regarding respect for human rights, legality, fairness and social responsibility ... These principles apply to all Group initiatives and activities that may generate actual or potential impacts on local communities, and are integrated into decision-making processes and relations with local stakeholders" (pages 288-289).

"the Group promotes transparent and structured dialogue with communities and local stakeholders, encouraging listening and responsible engagement in order to understand local needs and prevent or mitigate any negative impacts. To this end, in line with the Sustainability Plan, publication of a policy on stakeholder engagement is envisaged" (page 289).

No community-specific grievance mechanism distinct from the whistleblowing system is described, and no community grievances received in 2025 are reported.

Taking action on material impacts on affected communities

Reference: pages 281-288.

Microcredit (page 281). Banca MPS helped establish Microcredito di Solidarietà S.p.A. in 2006 with the Municipality and Province of Siena and the Diocese of Siena and Montepulciano. Terms are a maximum EUR 10,000, TAN 3%, no commission and no early repayment charge. "The number of loans disbursed in 2025 increased compared with 2024, rising from 150 to 159, while the volume ... with an amount disbursed during 2025 of EUR 626,500 (compared with EUR 588,764 in 2024)." On 16 September 2025 the company was transformed into a Social Enterprise under Legislative Decree 112/2017.

Vulnerable people (pages 281-282). MPS Fiduciaria promoted memoranda of understanding on banking, insurance and trust services for families with severely disabled members. Mediobanca supports UNHCR's programme for unaccompanied foreign minors, the INSIEME sports project in Milan, Fondazione Cometa and VIDAS.

Career guidance (page 282). The MPS Orienta programme covers agreements with universities, master's programmes, specialist schools and employment centres enabling traineeships.

Community initiatives (page 287). Support for the agri-food sector including the Wine & Siena partnership; BAM Foundation support for Festivaletteratura in Mantua; "Banca Aperta" guided tours of the Historic Headquarters in Siena; and sponsorship of the Siena Fifth Conference of the Future of Europe.

Targets related to managing material impacts on affected communities

Reference: pages 287-288.

"The Group, aware of its role and of the social responsibility arising from its business activities, has increasingly strengthened its support for the communities in which it operates, defining contribution targets aimed at promoting initiatives with a social impact" (page 288).

"In this context, Mediobanca also devoted particular attention to the inclusion of socially vulnerable categories and those at risk of exclusion, with a specific focus on young people. In pursuing this objective, it committed to supporting projects with a social impact through ongoing dialogue with third-sector organisations and bodies, publishing results and progress in order to enable communities to monitor them and identify potential areas for improvement" (page 288).

The disclosure names no measurable value, baseline or target date for those contribution targets, and gives no progress figure. Community activity is instead evidenced through the outputs under S3-4, principally microcredit volumes of 159 loans and EUR 626,500 disbursed in 2025 against 150 loans and EUR 588,764 in 2024 (page 281). Related quantified social commitments sit outside S3, in the Industrial Plan: at the end of 2024 the Group reported EUR 954 mln of loans disbursed for social purposes and social bonds of EUR 750 mln, equal to 25% of total issuance (page 232).

Policies related to consumers and end-users

Reference: pages 290-300.

Policies are set out by sub-topic.

Privacy and information security (pages 290-292). The Group Directive on personal data protection compliance and the Group Directive on Logical Security Governance define the objectives pursued through the Information Security Management System (ISMS), reinforced by the ICT Governance, ICT and Security Risk Management and Incident Management directives. "The Guideline is reviewed annually and updated at least every three years, or in any case whenever a significant change in reference legislation, security standards, internal processes ... attack scenarios, Group technologies and organisational structure is detected."

Freedom of expression and complaints (page 293). Under the Code of Ethics the Group commits to responding to complaints from customers and their protection associations; proper handling is treated as "an essential activity to establish a satisfactory customer relationship".

Responsible business practices and social inclusion (pages 298-299). The Group Policy on Commercial Policies and the Group Product Policy govern product design and marketing "in order to prevent unfair commercial practices". Exclusion and enhanced due diligence policies apply to armaments, including a full exclusion for controversial weapons and countries under sanction or in armed conflict, to tobacco, and to gambling (page 299).

Processes for engaging with consumers and end-users about impacts

Reference: pages 306-307.

"To spread the culture of relationships, the Group monitors the achievement of targets related to customer satisfaction and loyalty. In particular, it collects suggestions and proposals from customers and other significant stakeholders relating to the products and services offered, adopting an approach based on active listening and customer engagement" (page 306).

Contact Centre (page 306). The Network Hub provides commercial and specialised assistance through the MIA non-generative chatbot, "a virtual assistant that handles 50% of requests autonomously", with consultants handling the rest by chat (75%) and telephone (25%). "An average annual flow of about 400,000 calls and 80,000 enquiries handled through other channels is recorded through these contact structures."

Banca Widiba (pages 306-307). Products and services are scored 1 to 5 with comments; the website received "an average of 13,500 comments per month, of which 97% were positive". In 2025 the internal Net Satisfaction Score "remained stable at 94 on a scale from -100 to 100, while the mobile App's Net Promoter Score reached 45, exceeding the banking sector average of 30".

Customer views also feed the double materiality analysis through interviews with a Corporate and Private Territorial Department head and with corporate customers (page 172).

Processes to remediate negative impacts and channels for consumers and end-users to raise concerns

Reference: pages 307-310.

"The Group seeks maximum transparency and accessibility of grievance channels, actively informing consumers of their existence through its institutional website, contractual documentation and direct communication at branches and specialist centres" (page 307). Complaints may be submitted by hand, by post, online or by email.

Beyond complaints, customers may escalate to the Supervisory Authorities, request mediation or assisted negotiation, and after an unsuccessful complaint may refer to the Financial Banking Arbitrator (ABF) or the Financial Disputes Arbitrator (ACF) (page 307).

Maximum response times (page 308): 60 calendar days for banking, financial and investment services; 45 for insurance brokerage; 30 for consumer credit information system breaches; and 15 business days for payment services.

The Group prepares and publishes an annual report on complaint handling under Section XI of the Bank of Italy's Supervisory Provisions of 20 June 2012 (page 309).

The Group is candid about a limitation: "No involvement of stakeholders (i.e. customers submitting complaints or appeals) in the planning, review, operations and improvement of the procedure described above is envisaged" (page 309). Effectiveness is inferred from the number of upheld, partially upheld and rejected complaints and from arbitration outcomes.

Taking action on material impacts on consumers and end-users

Reference: pages 291-306.

Information security (pages 291-292). The Parent Company operates the ISMS, which "formalises process, operational and technological security requirements, in compliance with current regulations and sector best practices (such as ISO 27001, NIST, SSAE16, ISAE 3402, SOC2)". Initiatives launched in 2025 cover Business Continuity Management following Cyber Resilience Stress Tests, Cybersecurity Awareness campaigns, security platform development (Zero Password Security, Zero Trust Network, API Gateway, micro-segmentation), Identity and Access Management, Incident Detection and Response, resilience testing including TIBER-IT, and AI integration for real-time data protection and predictive fraud models.

Product governance and inclusion (pages 299-300). Product characteristics are set using customer intelligence analyses covering behavioural profile, MiFID profile, portfolio analysis and direct and indirect feedback, with risk profile evaluation for investment products and definition of the target market.

Catastrophe protection (page 226). The "Protezione business" product was extended with a catastrophic risks package in two tiers to meet Ministerial Decree No. 18 of 30 January 2025; in 2025 1,620 Mia Protezione Business policies and 5,333 Mia Protezione retail policies were taken out.

Targets related to managing material impacts on consumers and end-users

Reference: pages 293, 299, 306.

Information security targets (page 293) come from the 2024-2028 IT Security Strategic Plan: strengthening security safeguards, digital resilience and business continuity; transposing regulatory requirements and Supervisory Authority findings; and increasing customer cybersecurity awareness. Performance is assessed through "a proprietary framework that makes it possible to assess the maturity level of the Group's security controls", evaluated quarterly, an annual audit plan and third-party penetration testing.

Digitalisation of the offering (page 298), stated as an absence: "the Group did not envisage the identification of measurable quantitative targets. However, the effectiveness of the policies and actions adopted ... is adequately monitored through the monitoring activities carried out by the Body with Strategic Supervision Function (BSSF)", which receives information at least annually.

Commercial development indicators, actual figures at December 2025 (page 306):

These sit against the 2024-2028 Industrial Plan objectives of 30% of ESG volumes disbursed and 25% Green and Social Bond issuance by 2028 (page 232).

Business conduct policies and corporate culture

Reference: pages 311-319.

The Code of Ethics "contains the principles, values and rules of conduct that the Group is committed to following in all its activities" and "is an essential part of Model 231". It is approved by the Board of Directors, binds directors, auditors, managers and employees, and is monitored under the internal control system (pages 311-312).

"Any non-compliance ... can also be detected by each corporate function ... Relevant reports are to be sent at the same time to the Compliance and Internal Audit Functions" (page 312). Cybersecurity is a pillar of the Group's culture, governed by the Directive on Logical Security Governance (page 312).

Whistleblower protection (pages 316-317): "The Group protects whistleblowers who have submitted a report in good faith against retaliatory, discriminatory or in any event unfair conduct", ensures confidentiality, and applies penalties for breaches, retaliation or obstruction.

Anti-corruption (page 317): a "zero-tolerance" policy, with periodic risk self-assessment and identification, at least every two years, of the main areas at risk. Political contributions are expressly prohibited.

Anti-money laundering (pages 318-319): a Group Policy on money laundering and terrorist financing, with second-level oversight by the AML Function, whose Head reports directly to the CEO, extended since 2024 to embargoes and restrictive measures.

Prevention and detection of corruption and bribery

Reference: pages 313-314, 319-321.

The Group reports anti-corruption training as the metric for this requirement: "100% of the Parent Company's staff are involved in the enrolment campaign for anti-corruption courses" (page 319).

Anti-corruption training, 2025 consolidated (page 320):

For the MPS Group perimeter alone, 16,219 are in functions at risk with 16,144 recipients (page 321). Topics covered are the definition of corruption, policy, and suspicion and detection procedures.

Training on Legislative Decree 231 topics, Group net of Mediobanca (page 313): 16,258 employees trained, 99% coverage, including 151 executives (99%), 6,105 middle managers (100%) and 10,002 office staff (99%). Anti-corruption training reached 15,979 bank employees, 96% in 2025 against 99% in 2024 (page 314).

Targets related to business conduct

Reference: pages 316, 318, 319.

Back-filled from the business conduct chapter, where targets sit under MDR-T rather than a numbered DR. G1-3 became a standalone DR only in the 2025/2026 ESRS.

Banca MPS sets no quantitative business conduct targets and says so twice.

On whistleblower protection: "The process thus structured ensures adequate protection of whistleblowers, although no quantitative targets have been defined in this respect" (page 316).

On corruption: "On the basis of the above safeguards, the Group ensures the prevention of active and passive corruption, although it has not defined quantitative targets in this regard" (page 319).

Consistent with MDR-T, effectiveness is tracked instead:

• The Head of Internal Reporting Systems, within Internal Audit, "ensures the proper conduct of the process and drafts an annual report to the Board of Auditors, the Board of Directors, the Risk and Sustainability Committee and the Director in charge of the internal control and risk management system" (page 316).
• The Group "is committed to carrying out a self-assessment of risks, to be submitted periodically to the corporate functions in order to assess their likelihood of occurrence and the effectiveness of the relevant existing regulatory and control measures" (page 317).

Training coverage acts as the quantified proxy: 99% on Legislative Decree 231 topics and 96% on anti-corruption in 2025 (pages 313-314).

Incidents of corruption or bribery

Reference: page 321.

The Group reports a nil return: "In 2025, no cases of legal and regulatory non-compliance within the Group were found, without penalty of any kind or with a non-monetary penalty, and there were no confirmed instances of corruption involving the workforce (as in 2024)" (page 321).

So there were no confirmed incidents, no convictions and no fines for violation of anti-corruption and anti-bribery laws in either 2025 or 2024. The "Elements of information from other EU regulations" table marks the G1-4 datapoints on fines for violation of anti-corruption and anti-bribery laws and on standards of anti-corruption and anti-bribery as pointing to this section (page 190).

The context for the return is set out under G1-1: potentially all corporate structures are exposed to corruption risk, and "For each business process, the corruption risks to which the Group is potentially exposed are assessed. On the basis of the results of the latest assessment exercise carried out in 2024, despite the existence of potential risks across all Group structures, no need emerged for further action in addition to the safeguards currently in place" (page 317).

The Group does not disclose the number of whistleblowing reports received in 2025, nor the outcome of any investigations, so the nil return on confirmed incidents cannot be read against a volume of allegations.