BPER Banca

Board composition and sustainability governance

Reference: pages 97-99.

The Board of Directors is 60% men, 40% women, with 73% independent directors (15 members: 9 men, 6 women; 1 executive, 14 non-executive; 11 independent). Employee representation on the Board is not provided for in the Articles of Association.

Governance bodies for sustainability: the Board of Directors, the CEO, the Sustainability Committee and the Control and Risk Committee (both internal Board committees). The Board "approves the Consolidated Sustainability Statement, the PRB Report..., the Business Plan, the Risk Appetite Framework, the Risk Governance Policies, and the BPER Transition Plan" (p.97).

The Sustainability Committee meets at least quarterly and reviews the ESG Policy, ESG regulatory documents and the Transition Plan. The ESG Management Committee, chaired by the CFO, coordinates sustainability activities Group-wide. In 2024-2025 the Board undertook a year-long, three-module training programme covering governance, risk management and business models, including ESG integration into credit risk assessment and the EBA ESG risk management guidelines (pp.97-98).

Information flows to governance bodies

Reference: page 99.

The Sustainability Committee reviews the Group's ESG Policy, ESG regulatory documents and reporting (including the Consolidated Sustainability Statement), the Transition Plan (objectives, implementation strategies and targets), and any matters the CEO raises. It meets at least once every three months and reports to the Board at least once a year on its activities.

The Control and Risk Committee meets at least once every two months, supporting the Board in assessing ESG risk within the internal control and risk management system, examining the Group Risk Map, risk appetite and tolerance thresholds, and reviewing quarterly risk reporting that includes an ESG-risk focus. It also supports the Board in examining the Transition Plan's objectives, implementation strategies and targets.

ESG in remuneration

Reference: pages 100-101.

Short-term incentive (MBO): ESG objectives carry a weight of 15% for 2025 in the Strategic Scorecard (including the CEO's). The ESG component uses six metrics: % weight increase of ESG products, Green Loan Amount, Net-Zero Banking Alliance sector strategy definition (Aluminium, Iron and Steel, Commercial Real Estate), Energy Plan direct emission reduction, progress on women in positions of responsibility, and ESG ratings (S&P CSA, Sustainalytics, Standard Ethics).

Long-Term Incentive Plan 2025-2027 (BPER shares, for the CEO and key managers): sustainability targets carry a 20% weight, across Sustainable Finance, ESG investments (AuM) and Diversity and Inclusion.

Most Material Risk Takers receive ESG incentives weighted 10%-15%; objectives also explicitly include "preparation of the Transition Plan" for some commercial roles (p.100).

Due diligence core elements mapped to disclosures

Reference: pages 102-103.

BPER states due diligence "is not currently an autonomous and formalised procedure" but is integrated into its strategic framework. A table maps the five core due-diligence elements to specific disclosures: (a) embedding in governance/strategy -> GOV-2, GOV-3, SBM-3; (b) engaging affected stakeholders -> SBM-2, IRO-1, S1-1, S1-2, S2-1, E1-2, S4-1; (c) identifying and assessing adverse impacts -> IRO-1, SBM-3; (d) taking action -> S1-3, S1-4, S2-4, E1-3, S4-4; (e) tracking effectiveness -> S1-4, S1-5, E1-4, E1-5, S4-4 (p.102).

Internal control system for sustainability reporting

Reference: page 103.

The Group Internal Control System ("ICS") comprises rules, functions, structures, resources, processes and procedures ensuring activities align with internal practices, sector standards and external regulation. The Board of Directors defines the criteria for the design, execution and assessment of the system and the roles of corporate bodies and functions within it. Sustainability reporting sits within this wider ICS, with the Sustainability and Control and Risk Committees and the ESG Management Committee and ESG Strategy Unit providing oversight of ESG data and reporting controls (pp.97, 103).

Strategy and value chain

Reference: page 105-106.

The Group has 21,882 employees in Italy, plus 40 in Luxembourg, 359 in Switzerland and 19 in Monaco. ESG has been integrated into strategy "for some time," with products for corporate and retail customers aligned to sustainable development goals, including products with environmental purposes and products with a social purpose for retail and Third Sector customers.

The 2024-2027 Business Plan "B:Dynamic | Full Value 2027" rests on three pillars (unlocking full customer value, capturing economies of scale, leveraging the Group's balance sheet) delivered through three enablers: technology/AI, ESG and sustainability commitment, and organisation and people. The Plan sets a ceiling of over Euro 7 billion for ESG Corporate and Retail products, 45% of AuM in ESG investments, and at least Euro 1 billion in Green Bond issuance (p.106). Value chain data collection covers direct/indirect funding and suppliers, feeding the double materiality analysis and Scope 3 reporting (E1-6).

Stakeholder mapping and engagement

Reference: page 107.

The Group maps its stakeholders as: customers, employees, financial market, shareholders, suppliers, footprint areas and community, environment, and Public Administration, periodically monitoring and updating the map. Engagement is built around a structured stakeholder analysis and segmentation process intended to "transform [risks] into opportunities." Stakeholder views feed directly into the double materiality analysis and into individual-topic engagement processes described under SBM-3 and the S1-S4 disclosure requirements (p.107).

Material IROs

Reference: pages 108-114; IRO tables pp.109-114.

The 2025 double materiality analysis identified 43 material impacts (I-1 to I-43), 11 material risks (R-1 to R-11) and 7 material opportunities (O-1 to O-7) across E1, S1, S2, S3, S4 and G1 (pp.109-114). "The double materiality analysis produced results in line with last year's results," with the main changes being sub-topic relevance shifts in S2 ("Other work-related rights - Privacy" added) and S4 ("Personal safety" dropped) (p.108).

Material impact/risk/opportunity counts by topic: E1 - 9 impacts, 8 risks, 3 opportunities; S1 - 13 impacts, 2 risks, 1 opportunity; S2 - 3 impacts; S3 - 4 impacts, 1 opportunity; S4 - 10 impacts, 1 risk, 2 opportunities; G1 - 4 impacts. ESRS E2, E3, E4 and E5 carried no material impacts, risks or opportunities in this analysis.

Double materiality process

Reference: pages 115-118.

Impact materiality and financial materiality were assessed separately then combined. For financial materiality, the Group's Enterprise Risk Management (ERM) risk catalogue and methodologies were reused, transcoded onto a common 1-4 scale for potential scale and likelihood; the materiality threshold was set at "Medium-High." This process identified 11 material risks and, via a parallel Business Plan-based opportunity assessment, 7 material opportunities (p.117).

For E2, E3, E4 and E5, the process considered both own activities and upstream/downstream (financed/invested) activities using supplier-base composition, the investment and securities portfolio, internal monitoring data and public databases. For biodiversity (E4) specifically: "the Group's offices and branches are not located within or near biodiversity-sensitive areas" and the Group "did not consider it necessary to take any biodiversity mitigation measures" (p.118). Climate-specific methodology is cross-referenced under "E1 IRO-1" (p.141).

ESRS content index

Reference: pages 119-120 (IRO-2 - Table of Contents).

The Group publishes a full ESRS content index listing, by topical standard, which Disclosure Requirements it covers. All ESRS 2 general disclosures are covered; under E1 the index lists GOV-3, E1-1 through E1-7 (E1-8 and E1-9 are not listed); under G1 it lists GOV-1, IRO-1, G1-1, G1-2, G1-3, G1-4 and G1-6 (G1-5 is not listed). "For non-material topics (E2, E3, E4, E5), the information required by ESRS 2 IRO-1 are included in 'IRO-1...'" (p.119) - i.e. no topical DRs are claimed for these four standards. A further table (p.120 onward) lists datapoints derived from other EU legislation under ESRS 2 Appendix B, each marked with its section or "Not material."

Transition Plan

Reference: pages 158-159.

Approved by the Board on 18 December 2025, the first Transition Plan under Article 76(2) of Directive 36/2013/EU and the EBA ESG risk management Guidelines. It covers sector decarbonisation targets for Power generation, Oil and Gas, Aluminium, Iron and Steel, Commercial Real Estate and Agriculture, a coal phase-out policy, and confirms continuity with the Net-Zero Banking Alliance (joined 9 March 2022; the Alliance wound down its formal mandate in October 2025).

The Plan "has identified no 'locked-in' greenhouse gas emissions from major products or assets that could potentially compromise the attainment of emission reduction targets" (p.159). The Group states it has "not in 2025 allocated significant monetary amounts, in relation to CapEx and OpEx, to implement actions taken or planned" - OpEx/CapEx information is described elsewhere in the statement as "not material in relation to the total investments made and total costs incurred in 2025" and therefore not separately reported (p.96).

Climate scenario analysis

Back-filled from ESRS 2 SBM-3 (E1) and E1 IRO-1, where this content is disclosed in the FY2025 report (pages 138-151). This disclosure requirement did not exist under the 2023 ESRS the report was prepared against.

Two NGFS scenarios were used: "Net Zero 2050" (Orderly transition family, limits warming to +1.5C) and "Current Policies" (Hot House World family, existing policies unchanged) (p.151). NGFS scenarios are reconciled to IPCC Shared Socioeconomic Pathways (SSP) and Representative Concentration Pathways (RCP).

Physical risk is assessed via a climate calculation engine producing risk maps per hazard and scenario through to 2050, reconciled with ESRS 1 Appendix A AR 16. Transition risk is transmitted through variables such as an emissions tax, modelled via a sectoral model onto counterparties' financial statements (pp.150-151). For target-setting specifically, the 2030 sector targets use the IEA Net Zero Emissions 2050 scenario and, for Commercial Real Estate, the CRREM reference scenario (p.177).

Business model resilience to climate-related risks

Back-filled from ESRS 2 SBM-3 (E1), where this content is disclosed in the FY2025 report (page 139). This disclosure requirement did not exist under the 2023 ESRS the report was prepared against.

Since March 2023 BPER has run a three-phase resilience analysis: (1) an inertial simulation assuming counterparties follow scenario-based decarbonisation pathways with no additional Group intervention, to test whether targets and physical-risk exposure would be met; (2) identification of portfolio segments needing intervention, with strategic levers ("green disbursements", "adaptation finance", "insurance mitigation") hypothesised and their feasibility/impact assessed; (3) a simulation testing the Group's capacity to meet 2030 NZBA targets and contain physical risk once those levers are applied (p.139).

The general (ESRS 2) resilience statement confirms "the Group Banks conduct an annual resilience analysis with reference to the physical and transition risks to which the business may be exposed" (p.115).

Climate policies

Reference: pages 161-163.

The "ESG Policy" (updated January 2026) sets five guiding principles including "environmental protection and assessment of the direct and indirect impacts." The "Policy for the governance of credit risk" sets indicators and thresholds for high physical-risk exposure, high physical-risk mortgages, high transition-risk exposure and high environmental-risk exposure, monitored periodically by Risk Management.

The "ESG Loan Origination Policy" integrates ESG considerations into lending, applying to all Group companies except a short list (Modena Terminal, BPER Real Estate, Arca Holding, Arca Fondi SGR, Adras, St. Anna Golf, Annia), with Banca Popolare di Sondrio Group companies onboarded from 18 July 2025.

Climate actions

Reference: pages 167-169.

Actions in credit: acquisition of counterparties' decarbonisation plans/targets, ESG covenants, and placement of green/sustainable products; automated Energy Performance Certificate acquisition for mortgage collateral; taxonomic-alignment detection tools in lending applications; ESG training for over 1,000 corporate-centre and credit staff (2024-2025).

Retail/business products: "Mutuo Green" (energy classes A-C) and the new 2025 "Mutuo Green a SAL" renovation loan; Superbonus/Ecobonus tax-credit purchasing since 2020; business financing including Fin Helios (photovoltaic), a regional energy-efficiency fund (Emilia Romagna), Green Corporate Real Estate loans, and EIB/EIF/SACE-backed green loans (pp.167-169).

NZBA decarbonisation targets

Reference: pages 176-179 (NZBA targets and performance monitoring table).

Following the Banca Popolare di Sondrio acquisition, all targets were restated to a 31 December 2025 baseline, using portfolio-wide intensity metrics (PCAF-aligned):

Targets use the IEA Net Zero 2050 scenario (CRREM for real estate); "no specific stakeholder engagement activity was carried out to define these objectives" and targets were "not subject to external audits" (p.176). Residential Real Estate has a disclosed baseline (28.1 kgCO2e/m2) but no target, as attainment depends on external public-policy factors.

Energy consumption

Reference: page 182 (Energy consumption and mix table).

Total energy consumption for high-climate-impact-sector companies (BPER Real Estate, Modena Terminal, Adras, Annia and four other Group real-estate entities) was 11,337.03 MWh in 2025 (up from 10,255.42 MWh in 2024), split 85% fossil / renewable share rising year-on-year. Total Group energy production from renewable sources was 2,443.63 MWh (2024: 1,713.81 MWh).

Energy intensity per net revenue from high-climate-impact activities was 0.58 MWh/EUR thousand (2024: 0.63, -7.4%), against net revenue from those activities of EUR 19,545 thousand out of EUR 8,285,816 thousand total net revenue (p.182).

GHG emissions

Reference: pages 183, 185-186 (E1-6 tables).

Scope 3 is overwhelmingly Category 15 (Investments) - financed emissions from the loan book and securities portfolio, totalling roughly 97.1 million tCO2e for loans and related securities - dwarfing the bank's own Scope 1/2. GHG intensity (location-based) rose to 12.39 tCO2e/EUR thousand net revenue (2024: 9.11, +36%) (p.186).

Carbon credits

Reference: page 196.

BPER has "no active carbon absorption and/or storage projects." It offsets corporate mobility fleet emissions via BPER Banca, Banca Cesare Ponti and Finitalia using the DKV CARD CLIMATE fuel card, funding three Myclimate Gold Standard-certified projects (solar in the Dominican Republic, efficient stoves in Kenya, water filtration in Uganda).

4,347 tCO2e of carbon credits were cancelled in 2025 (2024: 2,322.74 tCO2e), 100% emission-reduction projects (0% removal), 100% Gold Standard, 0% EU-issued and 0% qualifying as Paris Agreement Article 6 corresponding adjustments.

Own-workforce policies

Reference: pages 198-201.

No dedicated human-rights policy; the topic is addressed in the "Code of Ethics", "ESG Policy" and "Policy for the management of human resources," drawing on the UN Guiding Principles, OECD Guidelines and ILO Declaration, and endorsing UN Global Compact Principles 4 and 5 (forced and child labour).

The "Diversity, Equity and Inclusion Policy" links to all S1 material IROs on equal treatment, and in June 2025 the Board approved updates introducing a Disability Manager role and strengthened anti-harassment provisions. The "Group Policy for governing the risk of non-compliance with occupational health and safety regulations" implements Italian Legislative Decree 81/08, with the Safety Office auditing compliance.

Worker engagement

Reference: pages 202-203.

Labour relations run through trade unions under the National Collective Agreement, with joint company/union committees on welfare and equal opportunities. About 70 internal job postings drew over 1,000 applications in 2025 via the Job Posting tool. Engagement also runs through the "People Survey 2024" (Willis Towers Watson engagement/eNPS model), the "Sportello di Ascolto" (Listening Desk) for work-related stress, and regular meetings with Workers' Safety Representatives.

Remediation channels

Reference: page 203.

Employees can complain orally or in writing to their Organisational Unit Manager, HR Business Partner or up the chain to the Chief People Officer; all complaints are "analysed for the purpose of identification" then acted on. Work-related stress has a two-phase process (preliminary then in-depth assessment) with quarterly Listening Centre reports to HR. Hazards can be reported via intranet, e-mail to the Safety Office, or the Workers' Safety Representative, with anonymity assured; a lowered safety level triggers notification to the Prevention and Protection Unit, including via the BHelp ticketing system at BPER Banca.

Actions for own workforce

Reference: pages 204-207.

The Welfare Plan covers health/dental insurance (through 2027), long-term care, accident cover, meal vouchers and a "welfare credit"; over 6,000 employees use up to 10 remote-working days per month. BPER Banca obtained the "Top Employer Italia" certification for the seventh consecutive year. On equal treatment: UNI ISO 45001 certification obtained 19 June 2025 (Parent Company); IDEM Gender Equality and UNI/PdR 125:2022 certifications held by four Group companies; "BperAbility" disability-inclusion projects continued, and the new Strategic Plan for Gender Equality 2026-2027 was approved 23 February 2026.

Workforce targets

Reference: pages 210-211.

"At least 30% women in leadership roles by 2027" - achieved: "By 31 December 2025, over 30% of leadership roles were occupied by women." 30% of FTEs in the up-skilling programme - achieved at >32%. >60% of employees trained on ESG topics each year - achieved at >64% in 2025. All three targets apply for 2025-2027 with no interim milestones and no direct workforce involvement in target-setting; the Business Plan sets them and MBOs are linked to them.

Employee headcount

Reference: page 211.

22,300 total employees at 31.12.2025 (19,532 in 2024): 10,019 women, 12,281 men. 22,276 permanent, 24 temporary; 19,871 full-time, 2,429 part-time. 21,882 employees in Italy (the only country meeting the 50-employee/10% threshold). Employee turnover: 6.36% (2024: 7.82%), 1,418 outbound employees. Figures reflect the Banca Popolare di Sondrio Group acquisition from H2 2025.

Non-employee workers

Reference: page 212.

381 non-employee workers at 31.12.2025 (209 in 2024): 18 self-employed, 40 interns, 323 contract/agency workers. The rise "is due to a short-term requirement linked to the integration process following the acquisition of the Banca Popolare di Sondrio Group."

Collective bargaining

Reference: page 212.

99.98% of employees are covered by collective bargaining agreements (2024: 99.97%); the shortfall is due to BPER Bank Luxembourg. Coverage and workplace representation in Italy both fall in the 80-100% band. In addition to the banking-sector CCNL, the Group applies sector agreements for Modena Terminal (logistics), Finitalia (insurance/ANIA), Rent2Go (tertiary trade) and Pirovano Stelvio (Federalberghi).

Diversity metrics

Reference: page 213.

Top management: 2 women (8.00%), 23 men (92.00%) of 25 total - defined per EU Directive 36/2013 as Material Risk Takers with day-to-day executive responsibility, plus Managers with Strategic Responsibilities. Age distribution (22,300 total): <30 years 1,470; 30-50 years 11,716; >50 years 9,114.

Adequate wages

Reference: page 213.

"The Group is committed to ensure equal professional opportunities and remuneration, through the use of neutral, objective and inclusive criteria... In particular, all Group employees receive an adequate salary in line with the applicable benchmarks," verified through ongoing market benchmarking exercises.

Social protection

Reference: page 214.

"All Group employees are covered by social protection, through public programmes or benefits offered by the company against loss of income due to a major life event."

Persons with disabilities

Reference: page 214.

Employees with disabilities subject to legal reporting: 5.54% of the workforce at 31.12.2025 (women 2.57%, men 2.98%; 2024: 5.34% total). Banca Popolare di Sondrio Suisse employees are excluded from the calculation as Swiss data-protection law (the DPA) treats this as highly sensitive personal data.

Training metrics

Reference: page 214.

94.39% of employees participated in regular performance reviews (women 93.22%, men 95.34%; 2024: 93.33%). Average training hours: 57.94 per employee in 2025 (women 61.26, men 55.24), up from 52.13 in 2024, "primarily bolstered by the enhancement of mandatory online courses."

Health and safety metrics

Reference: page 215.

100% of own workers and non-employees covered by the health and safety management system; zero work-related fatalities. 48 recordable work-related injuries (2024: 49), injury rate 1.58 (2024: 1.65); 1,040 days lost to work-related injury/illness (2024: 1,393). The improvement is attributed partly to flexible working reducing commuting accidents and to ISO 45001 certification obtained in June 2025.

Work-life balance metrics

Reference: page 215.

100% of employees (both genders) are entitled to family-related leave. Take-up: 47.16% overall (women 60.05%, men 36.64%; 2024: 49.84% overall).

Pay gap and remuneration ratio

Reference: page 215.

Gender pay gap: 19.31% in 2025 (restated 2024 figure: 17.16%, originally reported as 14.54% under the prior methodology), now based on total compensation (fixed plus cash and instrument-based variable pay). Annual total remuneration ratio (highest-paid individual to median employee): 65.84 (2024: 63.73), influenced by a revised CEO pay-mix favouring short-term variable pay.

Incidents and complaints

Reference: page 216.

"In 2025 for the BPER Banca Group, there were no incidents and subsequent complaints of harassment in the workplace submitted through the established channels. No administrative sanctions were applied. The BPER Group has not received any employment-related complaints regarding human rights from its own workforce."

Value-chain worker policies

Reference: pages 216-217.

No dedicated human-rights policy for value-chain workers; addressed via the "Code of Ethics" and "ESG Policy", referencing the same international standards as S1-1. The "ESG Loan Origination Policy" sets health-and-safety criteria for financed counterparties' workers; the "Security Management Macro-process Regulation" covers data protection. "There was no evidence of any breach" of the referenced human-rights frameworks concerning value-chain workers in 2025.

Value-chain worker engagement

Reference: pages 217-218.

"To date, the BPER Group has not activated processes to directly engage the workers of funded undertakings... with specific reference to the issue of workplace health and safety." Instead, information on funded counterparties' worker-engagement mechanisms, including whistleblowing, is gathered as part of the ESG Loan Origination Policy's sectoral analytical data collection.

Remediation for value-chain workers

Reference: page 218.

"As of now, there are no available channels for workers in the value chain to express their concerns or needs" directly to BPER. Mitigation instead relies on a third-party ESG score (covering remuneration, ISO 18001/45001 certification, whistleblowing presence at the funded undertaking), inclusion of the legality rating in counterparty evaluation since the latest ESG Loan Origination Policy review, and ordinary credit-quality monitoring with an early-warning mechanism triggered by prejudicial events or seizures.

Actions for value-chain workers

Reference: pages 218-219.

"There was no evidence of serious human rights problems and incidents related to funded undertakings in 2025." Counterparties with evidence of minimum-safeguard violations face restrictive lending policies and enhanced credit-supply-chain management; Sustainability Linked Loans with relevant KPIs are treated as a risk-mitigating factor. Additional exclusion criteria are added to the ESG Loan Origination Policy as specific risk areas are identified.

No quantified target, reasoned

Reference: page 219.

"The BPER Group has not set any measurable targets for workers in the value chain, also in view of the fact that the impacts identified are mainly related to the occurrence of single episodes and not systemic in nature." Policies and mitigation measures are instead reviewed periodically to ensure alignment with best industry practice, in lieu of a quantified target.

Affected-communities policies

Reference: pages 219-221.

"The double materiality analysis showed that there were no negative impacts on the human rights of the affected communities." Community matters are covered by the "Code of Ethics" and "ESG Policy"; the "Group Regulations on the Process of Institutional Promotion and Donations" (updated July 2025) govern sponsorship/donation criteria, and the "Policy governing relations with defence operators, weapons manufacturers and dealers" restricts financing in that sector.

Community engagement

Reference: page 222.

Communities and associations engage via the Sponsorship Management (SPM) Procedure/Portal: registration, request entry and analysis/approval phases, with effectiveness tracked through visibility/positioning returns, media coverage, and a self-certification form of impact from grant recipients.

Community remediation channels

Reference: page 223.

"Currently, there are no dedicated channels for the community to report concerns and receive assistance." Group company websites carry e-mail contacts for donation/sponsorship-related needs instead.

Community actions

Reference: pages 223-226.

"During the current year, there was no evidence of human rights problems and incidents related to the affected communities." Actions include the ABI-MEF First Home Guarantee Fund (up to 80% guarantee for priority categories); project financing for hospitals, nursing homes and a 500-bed student residence; over 100 donations in 2025; the "Insieme per le donne" campaign for D.i.Re (over EUR 220,000 disbursed to 57 refuge centres, 129 women and 187 children supported); and Premio Strega/Taobuk cultural sponsorships.

Community investment target

Reference: page 226.

EUR 20 million in community contributions over the 2024-2027 Business Plan period (base value 0, not a percentage target). "In 2025, the total value surpassed Euro 7 million," consistent with the planned trajectory.

Consumer policies

Reference: pages 227-231.

No dedicated human-rights policy for customers; addressed via the "Code of Ethics" and "ESG Policy". The "Data Protection Policy" (updated May 2025) sets a Privacy Delegate/Contact/DPO structure per GDPR. The "Security Management Macro-process Regulation" (2025) underpins the Strategic Security Plan. A dedicated "Regulation of the Ethics and Governance process of Artificial Intelligence Systems" governs AI system development/monitoring against the EU AI Act, overseen by the Chief Data Officer.

Customer engagement

Reference: pages 232-233.

"La Piazza" online community (since 2017) has over 5,700 active customers, average survey redemption ~25%. "Voice of Customer" tracks transactional Net Satisfaction Score across six products/five channels; retail uses monthly Net Promoter Score surveys; Private, Corporate/Large Corporate and Financial Advisor clients are surveyed via telephone CSAT one to two times a year. Results feed the daily "BVoice" Business Intelligence application.

Consumer remediation channels

Reference: page 233.

Privacy-incident handling runs through the Data Protection Officer network (appointed per GDPR Article 37) under the Group's "Data Breach Management" Regulation, covering reporting, detection, resolution, impact assessment and notification sub-processes.

Consumer protection and inclusion actions

Reference: pages 234-237.

"No evidence of report of any human rights issues or incidents linked to the Group's customer relationships for the year 2025." The 2025-2027 Strategic Security Plan ran 40 technological/organisational initiatives across six areas; all 2025 Operational Plan goals were met. Retail/Corporate/Third Sector products with social purpose include under-36 mortgages, Honour Loans, disaster loans, and the BPER Bene Comune unit's Third Sector accounts and crowdfunding (e.g. five co-funded cultural/social projects at 60% via "Il futuro a portata di mano"). Website-accessibility work used AccessiWay testing and "accessible by design" practices.

Consumer-facing targets

Reference: pages 241-243.

IT security: Hardening Policy compliance target 50% by 2025 - achieved (50%); Data Loss Prevention target 20% by 2025 - exceeded (30%). ESG financing ceiling: over EUR 7 billion over 2024-2027; EUR 3.9 billion disbursed in 2025. Bancassurance penetration: target ~25% by 2027; 19% in 2025 (15% in 2024). Retail digitalisation rate: 71% at end-2025 against a 74% target for 2026, with specific customer groups (over-75s, those under support administration) excluded by design.

Business-conduct framework

Reference: pages 244-252.

Founded on the "Code of Ethics" (updated 27 November 2025), the Organisation and Management Model (Legislative Decree 231/2001, last updated 27 November 2025), the Antitrust Policy (June 2025), the Policy for governing the risk of money laundering and terrorist financing (revised December 2025), the Policy for the governance of tax compliance risk, and the Anti-Corruption Policy.

Whistleblowing: the Whistleblowing Officer is the Chief Audit Officer. "In 2025, 26 reports were received at Group level through whistleblowing channels: of these, 10 were assessed as out of scope... The 14 reports falling within the scope of application of the rules had the following results: for 4 reports, the in-depth investigations carried out confirmed the validity of the aspects reported... 10 reports were dismissed due to the absence of elements" (page 251). A mandatory whistleblowing training course ran for all employees, deadline 31 December 2025.

Supplier management

Reference: pages 253-254.

Governed by the "Regulation on the purchasing process and accounts payable cycle" and the "Code of Ethics", with the Procurement Centre Unit managing the cycle. ESG criteria introduced in 2023 (Minimum Environmental Criteria in tenders, an ESG section in the vendor-register questionnaire) were the subject of a 2025 project to evolve supplier ESG assessment, including a gap analysis against current regulation, to be implemented from 2026.

Anti-corruption framework

Reference: pages 254-256.

The "Anti-Corruption Monitoring Model" (since November 2022) comprises the Anti-Corruption Policy and an Anti-Corruption Programme defining sensitive processes, risk assessment, controls and escalation. Ex-post controls in 2025 covered gifts/hospitality, charitable donations and sponsorships, third-party relations, and real-estate transactions; ex-ante pre-clearance of benefits ran continuously via the Compliance Function for the Prevention of Corruption (CFPC), with half-yearly summaries to Top Management. Training in 2025 included an Executive Management Committee presentation, a Board induction, and a dedicated classroom session at Banco di Sardegna.

Business-conduct targets

This is the MDR-T "other limb" for G1 - Targets related to business conduct, renumbered in the 2025/2026 ESRS from the 2023 MDR-T cross-cutting requirement.

Reference: page 259.

"Although no specific targets are set for business conduct, the BPER Group monitors any potential risks associated with specific sectors/areas of operation in order to supplement the relevant policies where necessary. The Group ensures the monitoring process of policies and actions taken... A specific level of ambition has not yet been established; consequently, no qualitative-quantitative indicators to assess progress have been established." This statement was prepared under the 2023 ESRS, where business-conduct targets fell under MDR-T rather than a standalone G1-3 target DR.

Corruption incidents

Reference: page 256.

"During 2025, to the best of the Group's knowledge and in accordance with the provisions of the Group's internal anti-corruption regulations..., no incidents of corruption or bribery involving the Group's personnel and business partners were detected. Consequently, there are no reported sanctions or convictions imposed for violations of laws against corruption and bribery."

Payment practices

Reference: page 256.

Governed by the "Regulation on the purchasing process and accounts payable cycle" (approved January 2026). Standard terms are mostly within 60 days of invoice date, with no differentiation by supplier type or size. Average invoice payment time: 27 days in 2025 (down from 31 days in 2024 on a comparable basis; 46 days under the prior, narrower methodology). 88% of payments were made punctually (within two days of the due date). "As at 31 December 2025, there were no outstanding legal proceedings due to late payment."