Banco Comercial Português

The BCP Group has a unitary governance model in which supervisory and management responsibilities are exercised in an integrated manner by the Board of Directors (BoD). On the reference date the BoD had 6 executive and 10 non-executive members; independent directors represent 55 per cent of non-executive directors, and the least represented gender is 35.29 per cent of members. The BoD oversees sustainability, monitoring Risk Appetite Statement indicators and the Risk Identification Process (including climate risks). Executive Committees of the Group entities manage sustainability, supported by Sustainability Commissions that approve strategic initiatives and monitor the Sustainability Master Plan. At BoD level, the Corporate Governance, Ethics and Sustainability Committee (CGESC) recommends ESG and governance policies and issues opinions on the sustainability report, while the Risk Assessment Committee (RAC) monitors material risks including ESG and climate risk factors. Millennium bcp's Sustainability Area (Office for Economic Research, Sustainability and Supervision Affairs) ensures compliance. CGESC and RAC regulations were updated in November 2024. Members' sustainability expertise is detailed in the Corporate Governance Report.

BCP describes how its management and supervisory bodies, including the relevant Commissions, are regularly briefed on impacts, risks and opportunities (IRO), the implementation of due diligence processes, and the effectiveness of policies, actions, metrics and targets. This monitoring occurs through a structured reporting process with different intervals and instruments. During the reporting period, having carried out a thorough review of the double materiality analysis, these bodies analysed all impacts, risks and opportunities identified as material (cross-referenced to SBM-1). During 2024 the Bank continued its ESG-focused risk identification and assessment exercise, using advanced market practices including forward-looking scenarios, transmission of ESG risks to traditional risk categories and the business, and inclusion of all BCP Group exposures. Results are integrated into day-to-day operations through management and mitigation actions and the identification of business opportunities arising from the low-carbon transition. Priorities for managing social and environmental risk factors are addressed in the Sustainability Master Plan.

The remuneration policy and incentive schemes for management and supervisory bodies incorporate sustainability, including objectives on climate action and GHG emissions reduction. At Millennium bcp the annual pool bonus is indexed to KPIs including one specifically related to sustainability. Corporate KPIs used to calculate the Executive Committee's maximum annual variable remuneration give a weight of 7.5 per cent to sustainability criteria. The Chief Risk Officer's evaluation includes the KPI "Compliance with the Sustainability Master Plan - Group", with sustainability weighted at 10 per cent in calculating his/her variable remuneration. Non-executive members performing supervisory duties are not covered by incentive or variable remuneration schemes. Alignment with sustainability is one of the behaviours assessed in employees' annual performance evaluations. Managers reporting to the Executive Committee have specific objectives such as the KPI "Level of implementation of the Sustainability Master Plan". In late 2024 the Incentive Matrix added components for Sustainable Business Credit and mortgage credit for A/A+ energy-rated properties. Remuneration conditions are approved at the General Meeting on a proposal from the Nominations and Remunerations Committee.

BCP provides a due diligence statement noting that the Group has implemented processes and control mechanisms to identify, monitor and address negative impacts on people and the environment. A mapping table links the core due diligence elements to sections of the sustainability statement. Integrating due diligence into governance, strategy and business model maps to GOV-2, GOV-3, SBM-1 and SBM-3 (including E1.SBM-3 and S1.SBM-3). Engaging with affected stakeholders maps to GOV-2, SBM-2, IRO-1 and MDR-P disclosures (E1-2, S1-1, G1-1). Identifying and assessing negative impacts maps to IRO-1 and SBM-3. Adopting measures to respond to negative impacts maps to MDR-A actions across E1-1 to E1-3, S1-1 to S1-4, S4-1 to S4-4 and G1-1 to G1-3. Monitoring effectiveness and communicating maps to MDR-T targets E1-4, S1-5 and S1-9. The table gives specific page references for each element.

BCP describes risk management and internal controls over sustainability reporting. Qualitative and quantitative data on the entire value chain are collected and consolidated by the Bank's Sustainability area, then analysed and assessed by the Executive Committee. The report is submitted to the CGESC, which issues an opinion on compliance with mandatory sustainability reporting standards to the BoD, which approves the version and submits it to the General Meeting for final approval. To ensure proper data collection and processing aligned with ESRS requirements, the Bank has a specific internal standard, NP0469, describing the principles and methods for collecting data and structuring the report. Both the double materiality analysis process and the Sustainability Report are subject to independent external Limited Assurance in accordance with the International Standard on Assurance Engagements 3000, reinforcing credibility, regulatory compliance and transparency. To date the BCP Group has not identified any concrete risks related to the communication of sustainability information.

Banco Comercial Português, with its decision-making centre in Portugal, operates under the Millennium brand and is a leader in various financial business areas. The Group is present in Portugal, Poland (Bank Millennium), Mozambique, Angola (through a stake in Banco Millennium Atlantico) and China (Macau), with a total of 15,664 employees in its main geographies of Portugal, Poland and Mozambique, plus representative offices and commercial protocols. Portuguese activity focuses on retail and corporate banking, segmented across mass-market and Prestige, Business, Corporate and Large Corporate customers, and includes the digital bank ActivoBank. Despite responsible financing efforts, the Bank still has commercial relations with fossil fuels (associated revenue 2,445,716.72 euros), chemical products (479,858.19 euros) and tobacco (263,933.45 euros), figures for the Portuguese operation. The "Valorizar 28" 2025/2028 Strategic Plan targets a top-quartile S&P Global CSA rating via sustainable financing, employee well-being and diversity, and a culture of rigour. Sustainability commitments are operationalised through the Sustainability Master Plan (SMP), first established in 2009 and regularly revised, with common Group actions plus local plans for Portugal, Poland and Mozambique.

BCP states its ability to create value depends on strong, lasting relationships of trust with all stakeholders, whom it groups into two categories: stakeholders affected by the Group along its value chain, and users of sustainability statements (supervisors, investors, lenders and other creditors, asset managers, credit institutions, insurers, plus business partners, trade unions and social partners, civil society, NGOs, governments, analysts and academia). The Bank has engagement mechanisms feeding decision-making, continuous improvement and innovation. A detailed table sets out engagement types, frequency and purpose for employees (climate/organisational surveys annually, whistleblowing channels, monthly HR Commission, dialogue with the Workers' Committee and Unions), customers (experience and mystery-customer surveys, satisfaction surveys, complaints and Client Ombudsman, consumer protection associations), suppliers (relationship management, sustainability evaluation surveys, workshops), shareholders (analyst calls, roadshows, Investor Days, General Meetings) and communities (partnerships with NGOs and third sector). A stakeholder consultation is run every three years; the last (2022/2023 online survey) informed the 2024 materiality analysis. Results are analysed by the GESS Corporate Sustainability Area, which informs the Sustainability Commission, Executive Committee, CGESC and the Board.

In 2024 the BCP Group thoroughly revised its double materiality analysis to align with CSRD and ESRS requirements, identifying the material impacts, risks and opportunities for the Bank. The disclosure presents a detailed table of impacts classified by issue, sub-issue, description, positive or negative nature, location in the value chain (own operations, upstream, downstream), whether real or potential, and time horizon. For example, financing projects that promote adaptation to climate change (resilient infrastructure, renewable energy) is identified as a positive, real, downstream impact. The analysis covers own operations (resource consumption, GHG emissions, labour practices) and the value chain (suppliers, partners, customers). The material topical standards resulting from the assessment are ESRS E1 Climate change, ESRS S1 Own workforce, ESRS S4 Consumers and end-users, and ESRS G1 Business conduct. The section cross-references IRO-1 for the identification process and links material IRO to the strategy and business model, including transition-related opportunities and ESG risk factors integrated into traditional risk categories.

BCP describes its double materiality analysis as a structured process covering own operations (resource consumption, GHG emissions, labour practices) and the entire value chain (suppliers, partners, customers, including labour practices and product/service quality). It focuses on relevant areas such as resource- or emission-intensive activities, business relationships prone to non-compliance with environmental or social standards, and geographies with weaker regulatory frameworks or greater climate exposure. Impacts are scored as the product of severity (scale, scope, irreparability on 0-5 scales) and probability (0.2-1); for human rights negative impacts, severity prevails and covers upstream and downstream operations, products, services and business relationships. Risks and opportunities are assessed as the average of magnitude of financial effects and likelihood. The assessment draws on key internal interlocutors and on the ESG risk management procedure, including the materiality analysis of climate and environmental (C&E) risk factors and human rights risk analysis. A footnote notes the process incorporates the IRO-1 requirements for E1-E5. ESG risk factors follow a three-lines-of-defence model under the Board, assessed over short (1 year), medium (2-5 years) and long (over 10 years) horizons, with a C&E materiality assessment feeding the Risk Identification Process. The analysis is subject to Limited Assurance.

IRO-2 confirms the report complies with the ESRS Disclosure Requirements, presented in a content-index table in the Annexes section, which also lists all data points deriving from other EU legislation. The double materiality analysis concluded that ESRS E2 Pollution, ESRS E3 Water and Marine Resources, ESRS E4 Biodiversity and ecosystems, ESRS E5 Resource use and circular economy, ESRS S2 Employees in the value chain, and ESRS S3 Affected Communities do not present IRO materially relevant to the BCP Group and its stakeholders, so the disclosure requirements for these standards are not included. The materiality of information disclosed was assessed using qualitative factors and the limits and criteria in section 3.2 of ESRS 1. The full content index (DR to page) maps each requirement, including ESRS 2 disclosures (BP-1 p12, GOV-1 p15, GOV-2 p16, GOV-3 p16, GOV-4 p18, GOV-5 p19, SBM-1 p19, SBM-2 p23, SBM-3 p26, IRO-1 p32, IRO-2 p38) and the material topical standards E1, S1, S4 and G1.

The BCP Group's transition plan for climate change mitigation is in the process of formalization, bringing together the decarbonisation commitments already included under Pillar 3, the evolution of its own operations, and the objectives of the strategic plan, including a monitoring process, the definition of specific KPIs, and the preparation of disclosure reports. Development of the Climate Transition Plan is scheduled for 2025, and it will be used to strengthen the foundations and quantify interim targets. The plan is developed under the Sustainability Master Plan and aligns with BCP's strategy of adapting its business model to the transition to a low-carbon economy. As a bank, its overall ambition is carbon neutrality of its own operations (direct emissions) by 2030 and neutrality of its credit and investment portfolio by 2050. Sector-level GHG reduction targets for carbon-intensive sectors under Pillar 3 feed into the plan (detailed in E1-4).

The Bank defines fundamental sustainability principles through corporate policies supporting management of climate change mitigation, adaptation and energy efficiency. These policies are available on the Bank's website and to employees via the intranet; compliance oversight rests with the Board of Directors, supported by the Corporate Governance, Ethics and Sustainability Committee. The Sustainability Policy (reviewed every 3 years) sets principles for the transition to a sustainable economic model, integrating climate issues into risk models and product offerings and financing green and energy-efficient projects; it adopts initiatives such as the UN Global Compact and the BCSD Portugal Charter of Principles. The Environmental Policy targets minimising the Bank's environmental footprint through eco-efficiency, environmental financial products, responsible financing (excluded or restricted sectors to reduce portfolio emissions) and environmental education, reinforcing commitment to the UN SDGs and the Paris Agreement. Additional policies include the Principles of Responsible Finance, Principles of Responsible Investment, Sustainability Guidelines for Suppliers, a Corporate Volunteering Policy, and a Climate Resilience and Operational Continuity Policy (applicable only to Mozambique operations).

The Bank implemented initiatives to reduce GHG emissions, promote energy efficiency and use renewable energy across its geographies, aligned with the 2025-2028 Strategic Plan. Renewable energy actions: two photovoltaic plants at TagusPark (total investment 1,564,940 euros) produced 2,363 MWh in 2024, covering around 34% of the Bank's TagusPark buildings' electricity consumption and avoiding 1,404 tCO2e since operation began; panels installed in eight branches. Photovoltaic systems at Headquarters (avoiding 380.5875 tCO2e/year), MPETO (38.089 tCO2e/year) and Matola (37.09 tCO2e/year). 100% of grid electricity is purchased from renewable sources with Guarantees of Origin. In 2024 Millennium bcp partnered with Cleanwatts, EDP and GreenVolt to integrate 229 branches (60% of its network) into Renewable Energy Communities, estimated to avoid 1,765 tCO2e/year. Energy efficiency: around 14,000 lamps replaced with LED lighting in central buildings (halving lighting consumption). Other measures include efficient heating/cooling systems and energy monitoring platforms.

The Bank aims to achieve carbon neutrality in its own operations (direct emissions) by 2030 and neutrality of its credit and investment portfolio by 2050. Interim targets and firmer foundations will be set via the Climate Transition Plan, whose development is scheduled for 2025. For Scope 3 financed emissions (category 15), it set 2026 interim intensity-based targets (base year 2023, Pillar 3 aligned) for eight carbon-intensive sectors: Energy (141.00 gCO2/kWh reference, 141.00 target); Fossil fuel combustion (67.00 to 65.40 kgCO2/GJ); Automobile (125.00 to 119.10 gCO2/km); Aviation (131.00 to 123.60 gCO2/km); Shipping (7.00 to 6.50 gCO2/km); Cement (0.70 to 0.62 tCO2/t); Steel (1.40 to 1.37 tCO2/t); Aluminium (2.15 to 2.12 tCO2/t); Chemical products (28.50 to 27.90 kgCO2/GJ). Targets were structured on the IEA Net Zero by 2050 scenario, compatible with the 1.5C ambition, and have not been validated by SBTi. Scope 3 Category 15 targets for 2030 have not yet been formalized.

In 2024 total energy consumption by the Group was 86,192 MWh, a 1% reduction versus 2023 (87,250 MWh; 2022: 87,448 MWh). Fossil energy consumption was 43,706 MWh (up about 1%; Portugal cut its fossil consumption by 13%). Electricity and heat purchased or acquired from renewable sources fell almost 4% to 40,030 MWh, while renewable energy generated by the organisation rose 4% to 2,456 MWh; total renewable energy consumption was 42,486 MWh. Around 49% of the Bank's energy mix came from renewable sources and the rest from fossil sources, as in the prior year. By geography: almost 77% renewable in Portugal, around 40% in Poland, with Mozambique introducing renewable energy this year (still limited impact). The Bank purchases 100% renewable energy in all facilities (implemented in Portugal and Poland since 2022), using photovoltaic plants at Taguspark, grid electricity certified with Guarantees of Origin, and solar panels in Gdansk and Mozambique. Total energy consumption uses the same organisational limits as scope 1 and 2 emissions.

In 2024 Scope 1 gross emissions were 5,505 tCO2e (2023: 5,202; 2022: 4,543), up 6%, comprising stationary combustion 871, mobile combustion 4,595 and fugitive emissions 39 tCO2e; biogenic CO2 emissions were 126 tCO2e. Scope 2 market-based emissions were 5,955 tCO2e (up 3%; 2023: 5,756; 2022: 7,769); location-based Scope 2 was 16,496 tCO2e (down 14%; 2023: 19,283; 2022: 25,606). Portugal reports 0 tCO2e market-based Scope 2 (only renewable energy). Combined Scope 1 and 2 emissions rose about 5% due to Mozambique activities and expanded reporting scope, with Scope 1 at 48% and Scope 2 at 52% of the total. Scope 3 gross emissions rose sharply to 9,598,650 tCO2e (2023: 6,839,678) after methodological improvements, dominated by Category 15 investments/financed emissions at 8,350,239 tCO2e; other categories: purchased goods and services 138,470, capital goods 5,607, fuel and energy-related activities 7,088, business travel 1,543, leased assets 1,095,704 tCO2e. Total GHG emissions reached 9,610,110 tCO2e market-based (9,620,650 location-based). Market-based emissions intensity was 2,688 tCO2e/million euro (net revenues 3,575 million euro).

The Bank did not carry out any GHG removals in 2024, nor did it finance mitigation projects financed by carbon credits.

The Bank does not apply internal carbon pricing schemes.

The Bank has a suite of group-wide policies covering all salaried workers. The Human Resources Policy sets the HR management model (onboarding, remuneration and benefits, training, leadership), implemented by the HR department. The BCP Group Human Rights Policy commits to the UN Universal Declaration, ILO conventions, OECD guidelines and the UN Global Compact, and prohibits human trafficking, forced and child labour, discrimination and harassment while protecting freedom of association and collective bargaining; it is approved by the Board of Directors and reviewed every 2 years. The Diversity and Equal Opportunities Policy prohibits discrimination on grounds including gender, sexual orientation, nationality, ethnicity, religion, age and trade union membership, implemented via an annual Gender Equality Plan. The Occupational Health and Safety Policy applies to all Portugal operations (reviewed every 2 years); Millennium bim has a Policy for Workers with HIV/AIDS. Further policies include the Employee Remuneration Policy (with a malus clause), the Benefits and Social Support Policy, and Regulations on the Provision of Remote Work. Each geography maintains its own policy versions complying with national legislation.

The Bank runs continuous, structured dialogue with employees via the corporate intranet, a dedicated HR area and designated Human Resources Managers. In the first two years of employment, seven formal moments of interaction are established. Employees also engage through the performance evaluation process (evaluation/self-assessment in February/March and a mid-term meeting in October) and the annual organisational climate survey measuring satisfaction and motivation. Idea-generation programmes run in each geography: Mil Ideias (Portugal), Call 2 Action (Poland) and Ideias que Contam (Mozambique); in Mozambique the forum was visited by 287 employees in 2024, generating 452 ideas or comments, of which 301 were being analysed and 151 archived. At Bank Millennium, meetings are held between employees and the Board of Directors. In Portugal the Bank maintains active dialogue with employee representatives: the Workers' Committee meets monthly with the CEO and the HRD, and the Human Resources Commissions meet quarterly. Working conditions, including remuneration regulations, incentives and remote-work rules, are defined in the Collective Labour Agreement (ACT) negotiated with the unions.

In all countries where the Bank operates there are formal complaint mechanisms for employees to report irregular situations arising under the Code of Conduct and the Code of Good Conduct for Preventing and Combating Harassment and for Promoting Equality and Non-Discrimination, both publicised and subject to training. For other issues employees can turn to their Human Resources Manager. Employees who report irregularities or complaints are safeguarded by the Code of Conduct, which provides protection against retaliation. At Millennium bcp, the Compliance Office monitors and handles communications under specific formal procedures and reports on them to the Corporate Governance, Ethics and Sustainability Committee; at Bank Millennium, all communications are recorded by the Human Resources Division, which informs the Process and Operational Risk Committee. These processes generate actions and specific action plans to mitigate negative impacts, and their effectiveness is monitored through continuous follow-up and internal surveys. Employee confidence in the channels is also assessed via the annual Climate Survey, which includes measures to protect respondent anonymity.

Following the results of the risk analysis and employee engagement processes, the Bank's Divisions, in liaison with the HRD and the Human Resources Manager and with the approval of the Human Resources Commission, define their own and/or transversal action plans. These plans set strategic action to improve real or potential negative impacts and to boost positive ones, and each has its own monitoring and follow-up processes. To ensure a fuller understanding of the effects of these actions, they are described under the reporting requirements in the Metrics and targets section. This DR is largely disclosed by cross-reference: the specific actions, their metrics and their effectiveness are reported in the subsequent Metrics and targets subsections (S1-5 through S1-17), covering areas such as diversity and inclusion targets, training, benefits, remote work, parenthood support, health and safety, and remuneration equity.

The Bank sets strategic objectives reviewed quarterly by the Human Resources Commission, with motivation and satisfaction indicators assessed annually against market benchmarks. Three quantified targets are disclosed with a 2022 baseline and 2024 results. For diversity and inclusion, the percentage of the under-represented gender in the management body was 35% (2022 baseline) and 35% (2024 result), against a target of at least one third of the under-represented sex on the management body for both 2024 and 2025. The percentage of women in new leadership positions rose from 38% (2022) to 43% (2024), exceeding the 2024 target of 35%, with a 2025 target of 41.25%. For training, average annual training hours per employee were 52 (2022 baseline) and 50 (2024 result), against a target of 54 for both 2024 and 2025.

In 2024 the BCP Group's workforce fell 0.15% (24 fewer employees) to 15,664, with resignations and retirements the main reasons for departure. By gender and country: Mozambique 2,625 (1,235 men, 1,390 women), Poland 6,836 (2,419 men, 4,417 women) and Portugal 6,203 (3,395 men, 2,808 women); group totals were 7,049 men and 8,615 women. By contract type: 14,827 permanent, 837 temporary and 0 non-guaranteed hours; 15,474 full-time and 190 part-time. Turnover: 1,450 workers left in 2024 (Mozambique 154, Poland 1,034, Portugal 262), a 9% group turnover rate (Mozambique 6%, Poland 15%, Portugal 4%); the turnover rate per employee was 10.2. The Bank made 203 external recruitments in 2024 at an average age of 26. Traineeships totalled 500: 19 curricular (9 women, 10 men), 325 professional (203 women, 122 men) and 156 short-term (97 women, 59 men).

To support core activities such as IT projects, digital, control functions (risk, compliance, auditing) and legal and financial advice, the BCP Group hires non-salaried workers. In 2024 there were 3,678 non-salaried workers in total: 648 self-employed workers, 1,971 workers supplied by companies primarily engaged in employment activities, and 1,059 classified as other. The methodologies and assumptions for collecting and consolidating this quantitative information are reported in the Methodological Notes section. Non-salaried workers are also covered by social protection against loss of income through public mechanisms regardless of the geography in which they operate (as noted under S1-11).

The BCP Group recognises and supports freedom of association and the right to collective bargaining, reinforcing its commitment to the 10 Principles of the UN Global Compact. Overall, in 2024, 56% of BCP Group salaried employees were covered by collective bargaining agreements (100% in Portugal and 95.3% in Mozambique), and 45% were unionised. Coverage by geography: Portugal in the 80-100% band for both collective bargaining and workplace representation; Mozambique in the 80-100% band for non-EEA salaried workers; Poland in the 0-19% band for both bargaining coverage and workplace representation. Working conditions of employees not covered by agreements follow the applicable national labour legislation; at Bank Millennium, where no collective agreement is in force, conditions are established in agreement with the trade unions. On consultation and negotiation, Millennium bcp's Collective Labour Agreements set minimum notice periods for communicating transfers: 30 days under the ACT Vertical (clause 32, no. 6) and 60 days under the ACT Quadros (clause 34, no. 3).

The BCP Group's overall gender distribution in 2024 was 45% men and 55% women. By age band: over 50 years, 59% men and 41% women; 30 to 50 years, 37% men and 63% women; under 30 years, 42% men and 58% women. In 2024, 758 women held management positions (Executive Committee/Top Management and Management), corresponding to 41% of these positions, with 24% in Portugal, 54% in Poland and 27% in Mozambique; in commercial functions women reached 62% of the group (50% Portugal, 74% Poland, 61% Mozambique). Distribution by professional category (men/women): EBD 87%/13%; senior management 74%/26%; management 57%/43%; commercial 38%/62%; technicians 51%/49%; other 58%/42%. The Group emphasises equal opportunities and gender parity, formalised in the annual Plan for Gender Equality and the Valorizar 28 Strategic Plan, with commitments to the iGen forum, the UN Women's Empowerment Principles (joined 2020) and the European Charter for Diversity.

BCP ensures that all its employees receive an adequate salary in accordance with the applicable benchmarks, and also guarantees a minimum entry salary for new employees. This DR is disclosed briefly, with no additional quantitative breakdown provided in the section; related pay-equity figures are reported under S1-16 (Remuneration metrics).

The Bank ensures all employees are covered by social protection against loss of income due to illness, unemployment, accidents at work, disability, parental leave and retirement, promoted through public mechanisms and complemented by company benefits; all workers also have the right to family leave. Non-salaried workers are likewise covered against loss of income through public mechanisms regardless of geography. In 2024, 100% of BCP Group employees were guaranteed the right to family leave and all who expressed an intention to use it were able to do so. Additional benefits support health, well-being and work-life balance: subsidised health insurance for employees and families; dedicated medical units and staff in Portugal and Poland; access to Clínica Universidad de Navarra in Portugal (229 appointments in 2024, 124 hospitalizations). Health Bureau figures for 2024 include 24,871 consultations, 8,124 check-ups and 42,933 persons covered by health insurance. Housing loans and social-purpose loans are offered under special conditions (2024 housing portfolio 343.2 M for 5,339 employees).

The percentage of workers with disabilities in the BCP Group was 1% in 2022, 1% in 2023 and 2% in 2024. To promote inclusion, Millennium bcp in Portugal signed a still-active 2022 protocol with APSA (Portuguese Asperger Syndrome Association) to include members in the labour market, within its commitment to Law no. 4/2019, which establishes an employment quota system for people with disabilities (degree of incapacity of 60% or more). The Bank plays an active role in the Inclusive Community Forum (ICF), a Nova SBE initiative, including through Working Group meetings and the Vencer no Mundo do Trabalho (Winning in the World of Work) training. As part of its Corporate Social Responsibility plan, Millennium bcp also has a cooperation agreement with BIP-Semear, a social and professional inclusion project that employs and trains young people and adults with intellectual and developmental disabilities. The methodologies for the quantitative information are reported in the Methodological Notes section.

In 2024 the average number of training hours per employee was 50 (47 for men, 52 for women). By professional category (total hours): EBD 41, senior management 41, management 50, commercial network 62, technicians 29, other 28. Entity-specific training data show 2024 in-person hours of 115,876, e-learning 406,985 and remote 256,172, with 50 hours per worker (58% women, 42% men). Human Rights, Ethics and Sustainability training reached 12,244 employees for 50,175 hours (Human Rights 3,182 employees/9,954 hours; Ethics and Conduct 3,078/3,746; Sustainability 5,984/36,475). A Competition Law e-learning course was completed by 5,746 employees (5,746 hours) by 31 December 2024. Employees trained totalled 42,592 (25,556 in Portugal, 17,036 international). Programmes include the Millennium Banking Academy, LEAD, Power On 2.0, Millennium Leader and inGenious. Performance evaluations covered 14,424 employees (92%): 6,610 men (94%) and 7,814 women (91%); the Organisational Climate Survey had an 88.3% response rate.

The Bank's occupational safety and health management system, based on legal requirements, covers 100% of the workforce. During 2024 the Group carried out 213 occupational safety and health visits to premises and 14 air quality tests. Health and safety metrics for 2024: zero deaths due to work-related injuries in all geographies; 50 accidents at work recorded (Mozambique 5, Poland 28, Portugal 17); an accident rate of 1.89 (Mozambique 0.94, Poland 2.57, Portugal 1.66); and 1,476 days lost due to injuries and deaths (Mozambique 61, Poland 545, Portugal 870). Training on health, hygiene and safety at work, which is periodic and mandatory for all employees, covered 1,019 employees in 2024 for a total of 1,780.8 hours, an increase over 2023 due to broader platform access. In Portugal, specific first-response firefighting training covered 157 employees.

Work-life balance metrics are disclosed together with social protection. Remote work: in Portugal the 2022 regulation (revised 2024) provides a hybrid system for compatible functions with 60% in the workplace (3 days) and 40% remote (2 days); in Poland the recommendation is 50% office and 50% remote. In 2024, 100% of BCP Group employees were guaranteed the right to family leave and all who intended to use it were able to do so. The Parenthood Protection Programme Bebe Millennium has run since 2015; in 2024 in Portugal 66 babies were celebrated with Millennium Baby Vouchers worth 874.90 euros net, and around 1,150 employees were able to spend their children's birthday afternoons with them. Parents of children entering 1st and 5th grades receive half a day off. Support to education included 48 student-worker beneficiaries and 3,076 employees with school-age children. Flexible working hours and adjustment of objectives on return from maternity/paternity leave are also provided.

The BCP Group defines remuneration by category and fulfilment of objectives and applies a 1:1 salary ratio between men and women with comparable functions, levels of responsibility and career paths. The 2024 annual salary gap (women/men) was 37.4% in Mozambique, 30.4% in Poland, 24.0% in Portugal and 33.8% for the Group. The total annual remuneration ratio in 2024 was 28 in Mozambique, 38 in Poland and 19 in Portugal; consolidated group information for this ratio was unavailable, and the Bank stated efforts will be made to ensure its reliability in the next report. The Group states it remains committed to a fair and transparent salary structure that encourages equity and professional growth. The methodologies and assumptions for collecting and consolidating the quantitative information are reported in the Methodological Notes section.

In 2024 the BCP Group, which voluntarily conducts regular self-assessment processes on human rights matters in its main geographies, did not identify any work-related complaints or incidents of discrimination, including harassment. Consequently, it was not necessary to pay any fines, penalties or compensation for damages resulting from such complaints or violations. The Bank also recorded no incidents of human rights violations (such as forced labour or child labour), and no sanctions, fines or damages related to human rights violations were imposed on the Bank.

BCP Group maintains several internal policies applying across all geographies, employees, products and customers (individuals and legal entities), with the Executive Committee responsible for implementation. The Code of Conduct commits to integrity and honesty; Article 26 provides for protection of customers' assets and Article 27 addresses conflicts of interest. The Policy and Process for the Approval of New Products (PANP) governs fair design and sale, ensuring products suit customers' needs, knowledge and target-market profiles, comply with supervisory rules, and defining products whose sale is prohibited. Investment products are classified under SFDR (Articles 6, 8, 9). Credit Risk Policies are set in a Group code; in 2024 the ESG Management and Control Principles (GR0047) were revised to integrate ESG risk into credit granting. Further policies include the Policy for the Prevention and Management of Conflicts of Interest, Policy on Related Parties, the Privacy Policy (GDPR compliance, publicly available on the website), the Policy for the Management and Processing of Complaints, the Human Rights Policy (non-discrimination, financial inclusion) and the Diversity and Equal Opportunities Policy. No human rights non-compliance was recorded in 2024.

BCP engages customers through branches, digital channels, surveys, customer service and complaint channels. Its "Experience Evaluation" model invites customers within 24 hours of an interaction to answer a satisfaction and recommendation questionnaire. Using Marktest's BASEF Study NPS indicator, Millennium bcp reached an overall 72.8 NPS points in Portugal in 2024, ranking first among the five largest banks. By segment: Prestige Customers 65.1 NPS points (up 5.5 vs 2023), Business Customers 69.1 (up 4.6), Mass Market 76.6 (up 2.7). Recommendation of the service provided by the employee/manager reached 87.7 points across more than 146,000 customer experiences. In Portugal, 42 surveys were carried out in 2024 covering more than 257,000 evaluated experiences. A Customer Experience Indicator (CEI) is embedded in employees' Incentive System (SIR) with quarterly prizes. The Bank also runs a Sustainability Questionnaire (QESG) for investment-service customers. For corporate customers, satisfaction with remote channels was 85.6% for Internet Banking Corporate and 78.3% for Corporate Mobile Banking.

BCP commits to timely, fair and effective complaint resolution following industry best practices and regulatory guidelines. Complaints can be submitted via the institutional website, customer service direct lines (telephone), email, online dispute resolution platforms (Millennium bim), complaint books at branches, or through Central Banks. In Portugal, complaints registered rose 10.7% to 76,624 in 2024 (69,234 in 2023), with about 80% card-related; international registered complaints reached 191,998 (up 24.7%). Complaints solved were 46,321 in Portugal and 188,933 internationally. Average resolution time in Portugal was maintained at 4 days. Complaints are managed by commercial areas and the Customer Care Centre (CAC), monitored monthly by the Audit Committee and the Retail Commission. The independent Client's Ombudsman appraised 2,751 interpellations in 2024 (down 1.8%), comprising 2,664 complaints and 87 appeals, with an average response time of 9 days; main topics were current accounts (33%) and cards (13%), with Retail representing 77% of exposures and ActivoBank 18%. DECO addressed 11 inquiries (down 68%), answered in an average of 4 days.

BCP applies social and environmental criteria across its commercial offer. Sustainable credit solutions in Portugal included Leasing and Green ALD Car (879 operations, 40,351 thousand euros) and Green Real Estate Development Credit (portfolio of 58,117 thousand euros). Microcredit financed 615 thousand euros across 18 projects, creating 34 jobs. Personal Credit products impacted 250 customers: Crédito Universitário (46 loans, 563 thousand euros), electric-vehicle car leasing (66 operations, 2.4 million euros) and Sustainable Buildings Personal Credit (138 loans, 1.4 million euros); the Green Housing Credit incentive was granted in 1,687 operations. The Financial Advisory Service (SAF) supported 229 Real Estate Credit and 1,093 Personal Credit customers, restructuring 32 million euros. Millennium Let's GO! for minors reached 12,750 subscriptions. In Poland, 69,753 consolidation loans totalled 629 million euros. In Mozambique, IZI Microcredit disbursed over MZN 4.2 billion to around 211,000 customers. At end-2024 Millennium bcp had 348 sustainable investment funds (8,058 million euros). Accessibility measures follow WCAG 2.1 level AA. No human rights violations related to consumers were recorded in 2024.

The Bank's new "Valorizar 28" Strategic Plan sets reinforcement of the ESG commitment as a strategic ambition, targeting the top quartile of the S&P Global CSA ranking and growth of sustainable financing. Commercial objectives are defined by the Marketing, Commercial Network Coordination and Management Information Divisions and approved by the Executive Committee. The Bank maintains targets set in previous years for consumers and end users, applied globally across its three geographies. Reported targets and 2024 performance: Customer complaints (BdP claims, PT) at Top 6 in 2024 with a Non-Top 3 target for 2024 and 2025; Global Satisfaction 1st Bank NPS (Individual PT) at Top 1 in 2024, target Top 2; Satisfaction with Main Bank NPS (Corporate PT) at Top 2 in 2024, target Top 2; Reputation NPS (PT) at Top 1 in 2024, target Top 2. Cyber risk security rating (BitSight): Portugal 800 (target above 740), Poland 810 (target above 780), Mozambique 760 (target above 740).

BCP Group's business conduct rests on several policies. The Code of Ethics and Conduct applies to management and supervisory bodies, all employees and trainees, and representatives or employees of service providers (covered entities), reflecting commitments to ethics, transparency, integrity and corporate responsibility, including non-discrimination, prohibition of harassment, due diligence and prevention of corruption. It is reviewed biannually or whenever relevant (updated in 2024). All employees are trained on its contents every two years via e-learning, run by the Human Resources Division. The Policy on the Reporting of Irregularities (Whistleblowing) ensures reports are handled securely, confidentially, promptly, independently and objectively, protecting whistleblowers from retaliation in line with Directive (EU) 2019/1937 and national law, with the Audit Division following up. Employees receive specific whistleblowing training. Other policies include the Anti-Corruption and Anti-Bribery Policy, the Policy for the Prevention and Management of Conflicts of Interest, and the Anti-Money Laundering and Financing of Terrorism Policy. Effectiveness is monitored against targets: Internal Control System scoring reached 3.35 in 2024 (2.2 in 2022 baseline; target under or equal to 5.5) and high-risk AML customers per 100,000 (PT) fell to 10.2 in 2024.

BCP Group selects suppliers on criteria such as global competence, functionality, quality, flexibility, continued service capacity and respect for sustainability criteria, privileging local suppliers: 89.8% of payments went to local suppliers in 2024 (90.5% in 2022, 90.3% in 2023). The Sustainability Guidelines for Suppliers set commitments aligned with the Universal Declaration of Human Rights, OECD Guidelines, ILO Principles, UN Global Compact and the APEE Portugal Charter of Principles, covering legal compliance and ethical conduct, human rights, labour rights, health and safety, environment and management. They are approved by the Board of Directors and reassessed biennially. Suppliers cooperate via questionnaires or site visits. Since 2007 contracts include sustainability clauses. A Sustainability Questionnaire for Suppliers, implemented in Portugal from 2022, was in 2023 sent to suppliers with contracts over 50,000 euros; so far 132 suppliers have been evaluated, obtaining a 0.6 average on a scale of 0 to 1. In Poland, 100% of new contracts include a Code of Ethics compliance clause. Millennium bim implemented its own ESG supplier assessment in 2024. Millennium bcp pays within the contractual default of 30 days for both SMEs and large companies.

BCP Group adopts a structured approach to prevent, detect and fight corruption and bribery through policies, procedures and control mechanisms aligned with international regulations, adapted to each country. In Portugal, Millennium bcp bases its approach on risk management, compliance monitoring and strengthening ethical culture, conducting regular risk assessments and due diligence on third parties throughout the contractual relationship, and provides a confidential whistleblowing channel. Governance is supervised by the Compliance and Operational Risks Commission (CORC) and the Audit Commission, with investigators independent of the management chain involved. Anti-corruption training programs include specialised modules for higher-risk functions. By the end of Q4 2024, 46% of members of the management and supervisory bodies had completed this training, continuing into Q1 2025. At Bank Millennium (Poland), corruption incidents are reported by the Head of Compliance to the Chairman of the Board and Chairman of the Supervisory Board; the whistleblowing channel allows anonymous reporting. Training is mandatory for all employees, including the Board. Millennium bim carries out background checks on suppliers. Anti-corruption training coverage in 2024: 100% (Mozambique), 93% (Poland) and 100% (Portugal).

In 2024, no cases of corruption in the BCP Group were detected. There was no compliance case that led to dismissal or disciplinary measures against employees, no situations where contracts with business partners were terminated or not renewed due to corruption-related violations, and no legal proceedings brought against the Bank or its employees, nor fines imposed for product-related infractions. Recorded cases in 2024 of corruption and/or bribery were 0 in Mozambique, 0 in Poland and 0 in Portugal; discrimination and/or harassment, conflicts of interest, and money laundering and/or insider trading were also 0 (Poland reported as not applicable for several categories). The number of alerts, questions or requests for advice received via the whistleblowing system in 2024 was 0 in Mozambique and 15 in Portugal. No complaints were registered with the Group in 2024. Regarding cooperation with authorities, the Group made 4,910 total reports to local judicial entities in 2024 (up from 3,067 in 2023), including 2,907 own-initiative reports in Portugal, and responded to requests, though these relate to judicial cooperation rather than confirmed corruption cases.

Millennium bcp's general contractual payment condition is payment after receipt of the invoice, representing about 80% of the value of its annual invoices. Customers pay for services received within 30 days of receiving the invoice, representing about 5% of annual invoices. Other invoices are paid within 90 days of receipt, except those from Poland which, per market standards, are paid within 17 days of receipt. In Mozambique, the average payment period is 8 days. Per the Payment practices table for 2024, the average time to pay an invoice from the date the contractual or statutory payment term starts to be calculated was 8 days in Mozambique, 17 days in Poland and 30 days in Portugal. Standard payment terms by main category of suppliers were 30 days in each of Mozambique, Poland and Portugal. The number of ongoing court cases for late payment was 0 in all three countries. In Poland, Bank Millennium recommends e-invoices and uses a paperless workflow to avoid late payments. Millennium bcp's default contractual payment deadline of 30 days applies regardless of whether the supplier is an SME or a large company (internal regulation NP0041).