BRD - Groupe Societe Generale

Reference: pages 65-69.

The AMSB perimeter is the Executive Committee and the Board of Directors: "The Board of Directors (BoD) holds ultimate responsibility for overseeing the Group's Sustainability Strategy, ensuring the effective management of material impacts, risks and opportunities (IROs)", while "The Executive Committee (EC) is responsible for implementing the Sustainability Strategy across all relevant business lines and functions" (page 65). Named roles follow on pages 65-66: Finance (publishing the statement), Human Resources (own workforce IROs, trade union), the Social Environment and Positive Impact Financing Directorate (ESPIF), the Transformation Department (Horizons 2027 KPIs) and the Risk Management Function. The Compliance Committee, through ESPIF, "provides quarterly updates to both the BoD and the EC on key environmental and social risk highlights".

Diversity (page 68): at 31 December 2025 eight of nine Bank BoD seats were occupied, with "five female (56%) and four male (44%)" and "four independent board members, accounting for 44% of the BoD". The EC had "five male members (71.4%) and two female members (28.6%)". BRD Sogelease's board was four female and one male; BRD Asset Management's board was entirely male with 33% independence. Executive and non-executive numbers and sector experience are incorporated by reference to Chapter 2 Corporate Governance (pages 68-69).

Reference: page 66.

"The Management Body of BRD Group (EC and BoD) considers the material impacts, risks and opportunities when overseeing BRD Group's strategy, major transactions and risk management processes." The statement explains that the sustainability strategy "was developed through a combination of top-down strategic guidelines from SG and a bottom-up approach identifying material topics through internal analysis, such as DMA or the Business Environment Scan 2024 (BES)", and that SG's four pillars (a culture of responsibility, environmental transition, positive local impact, responsible employer) are integrated into the Horizons 2027 business strategy.

On major transactions and risk management, "the Executive Committee evaluates how ESG risks and opportunities align with market trends, business objectives, and stakeholder expectations. ESG-related trade-offs, such as the balance between short-term operational costs and sustainability goals, are carefully assessed", with the ESPIF Division supporting identification and mitigation of ESG risks in transactions and client engagements.

The approval chain is stated plainly: "The material impacts, risks, and opportunities identified through the DMA were validated by the EC before final approval by the BoD" (page 66). Skills and expertise are addressed separately under GOV-1 23 (pages 66-67), including 2025 training on CSRD and ESRS for all staff, EC and BoD members.

Reference: page 68.

BRD Group discloses a partial link only. "For 2025, all EC members had to fulfil KPI related to strategic projects of the Bank, including ESG KPI within the framework of Group Performance & Efficiency Program connected to ESG strategy. In addition, KPIs related to the results of the Employee Barometer (related targets are disclosed in Own workforce chapter) were also included in the objectives set for 2025, carrying a weight of up to 15% in management variable remuneration for 2025. Consistent with the prior year, BRD's CEO objectives for 2025 included SG Group KPIs related to the reduction of Oil & Gas exposure."

The Group is explicit that no structured scheme exists: "At present, BRD Group's current remuneration policy for the Management Body does not include structured incentive schemes directly linked to sustainability matters. However, each year, specific objectives are established for the members of these bodies, including those related to sustainable finance."

The same position is repeated in the strategy section: governance measures "operate independently of remuneration, as current remuneration policy for the Management Body does not include structured incentive schemes directly linked to sustainability matters" (page 75). No percentage of variable remuneration tied specifically to GHG emission reduction targets is given.

Reference: page 69.

The statement on due diligence is presented as Table 1, "Treatment of Due Diligence in the Sustainability Statement", mapping each of the five core elements of the due diligence process to the paragraphs that cover it:

• Embedding due diligence in governance, strategy and business model: ESRS 2 GOV-2 page 66, GOV-3 page 68, SBM-3 pages 87-98, 100-101, 143-146, 171-172
• Engaging with affected stakeholders in all key steps: GOV-2 page 66, SBM-2 pages 75-79, MDR-P pages 108-111, 150-152, 175-180, 197-200, S1-2 pages 154-155, S4-3 pages 182-184
• Identifying and assessing adverse impacts: ESRS 2 IRO-1 pages 78-87
• Taking actions to address those adverse impacts: MDR-A pages 111-118, 157-162, 184-193, 203-204
• Tracking the effectiveness of these efforts and communicating: MDR-T pages 118-121, 163-164, 193-195, 205, and SBM-3 pages 87-98, 100-101, 143-146, 171-172

The table is a cross-reference map rather than a narrative account of the due diligence process; the underlying engagement and remediation mechanisms are described in the topical chapters it points to.

Reference: pages 69-70.

BRD Group reports a gap openly: "Currently, BRD Group does not have a fully formalized risk management and internal control system dedicated exclusively to the sustainability reporting process." The Finance Department is ultimately responsible for integrating the statement into the BoD Annual Report, and the process relies on the existing internal control framework in Chapter 7 of that report.

On method: "BRD Group does not currently employ a formalized risk assessment methodology for sustainability reporting. However, potential risks related to data accuracy, completeness, and consistency have been identified and managed during the reporting process."

Four reporting risks are named with mitigations (page 70): data accuracy, given "reliance on manual data collection and limited automation"; regulatory compliance risk; internal capacity, where "Specialized knowledge on sustainability reporting frameworks still under development"; and timeliness. Oversight runs through "periodic updates to the EC" and the ESG by Design Program and ESG working group. The Group states it plans "to enhance the risk assessment process by developing a more structured approach".

Reference: pages 70-74.

"BRD Group is active in Romania in the banking, leasing and asset management sector. BRD Group's total number of employees as of 31 December 2025 was 5,517 (vs. 6,243 as of 31 December 2024)." The perimeter is BRD Groupe Societe Generale S.A., BRD Sogelease IFN S.A. and BRD Asset Management SAI S.A., with Societe Generale S.A. as ultimate controlling party (page 62).

Inputs (page 71) are financial capital from shareholders, deposits and partnerships with the EIB and IFC; human capital; technology; sustainability integration; and regulatory compliance. Outputs (pages 71-72) span retail green loans, corporate sustainability-linked loans, leasing through BRD Sogelease and investment products: "BRD Asset Management's product portfolio comprises 12 diverse investment funds, with RON 9.27 billion assets under management (AUM), out of which 5 investment funds are SFRD Article 8 compliant, as of 31 December 2025."

The strategy follows SG's four pillars. Two commitments are quantified: "BRD Bank set the target to deliver EUR 2.4 billion in sustainable finance production by 2027" and "achieving a 55% reduction in the carbon footprint of its own operations by 2027, compared to the 2019 baseline" (page 74). The value chain, including joint ventures BRD Asigurari de Viata S.A. and CIT ONE S.A., is described under BP-1 5-c (page 63).

Reference: pages 75-79.

Eleven stakeholder groups are listed (pages 75-76): employees, capital market, sectorial or market associations, unions, clients, local and central authorities, mass media, suppliers, shareholders, competitors and local communities. Table 2 gives the engagement method for each, including supplier engagement "through the Group tool, Sourcing Hub, deployed in all entities".

A dedicated consultation fed the 2025 DMA update: "From this consultation, we received more than 1,400 responses from affected stakeholders and users of sustainability information" (page 81). Findings are reported frankly (page 77): stakeholders "perceive BRD Group's impact on people, communities, and the environment as largely positive", while "areas for improvement were identified, such as enhancing communication on sustainability actions, addressing digitalization challenges, and increasing transparency regarding environmental initiatives."

An external rating movement is disclosed: "In December 2025, Sustainable Fitch has upgraded BRD-Groupe Societe Generale S.A.'s (BRD) ESG Entity Rating to '2' from '3' and improved its entity score to 65 from 63" (page 77).

Own-workforce views (pages 77-78) cite 2025 Employee Barometer results: 74% participation, 62% reporting work/life balance (73% in 2024), 77% feeling able to speak up freely (85%).

Reference: pages 87-98.

Table 3 (pages 88-94) lists 27 material IROs across four standards, each with sub-topic, IRO type, value chain position and time horizon. E1 carries 11 (three risks, three opportunities, one potential positive impact, four actual negative impacts) across climate adaptation, mitigation and energy. S1 carries 7 (two risks; two actual positive impacts on freedom of association and collective bargaining; three negative impacts on secure employment, health and safety and gender equality). S4 carries 6 (risks on privacy, access to quality information and security of a person; positive impacts on access to products and services and on sustainable finance, the latter flagged "(Entity Specific)"; one sustainable finance opportunity). G1 carries 3 (positive impact on corporate culture; negative impacts on whistle-blower protection and on corruption prevention).

Table 4 (page 95) records six changes versus 2024, including secure employment and health and safety newly material and adequate wages newly not material.

Financial effects are qualitative only: "For 2025 reporting cycles only a qualitative analysis was performed" (page 97). The ESRS 1 Appendix C phase-in applies to SBM 3-48-e. Resilience is monitored through the annual Business Environment Scan, which "does not include the analysis of social and governance areas" (page 98, footnote).

Reference: pages 78-87.

The DMA was introduced in 2024 and updated for 2025: "the results of the previous DMA have been updated ... The underlying process and methodology remained largely unchanged, with only targeted enhancements introduced to improve the identification and assessment of positive impacts" (page 79). Positive impacts are now tested on "four key criteria: intentionality, additionality, accountability to the entity, and the absence of mitigation of a negative impact or risk", so "Initiatives that are merely compliance-driven are not classified as positive impacts".

Three phases are described (page 80): understanding the context; identifying and assessing IROs against the ESRS 1 AR 16 list; validation by the Executive Committee then Board approval. Finance coordinated the exercise with an external consultant. Sources include the UNEP-FI Impact Radar, SASB Standards for Consumer Finance and Commercial Banks, GRI Standards and the 2025 Business Environment Scan. Banking activities "account for approximately 94% of BRD Group's total operations" (page 81).

Thresholds are quantified. Impacts scored on scale, scope, irremediable character and likelihood (0-5): "a threshold score of 2.5 was applied" (page 82). Risks and opportunities scored on likelihood (0-5) and magnitude (0-3): "a threshold score of 1.5 (on a maximum of 3 points) was applied" (page 83). Topic-level processes follow on pages 84-87.

Reference: pages 62, 206-207.

A full ESRS content index is printed as Annex 1, "CONTENT INDEX - LIST OF THE DISCLOSURE REQUIREMENTS" (pages 206-207), listing each covered disclosure requirement with page references: ESRS 2 (BP-1 to IRO-2), ESRS E1 (E1-1 pages 99-100, E1-2 pages 108-111, E1-3 pages 111-118, E1-4 pages 118-121, E1-5 pages 122-123, E1-6 pages 123-133), ESRS S1 (S1-1 to S1-17), ESRS S4 (S4-1 to S4-5) and ESRS G1 (G1-GOV-1-5, G1-1, G1-3). Annex 2 (pages 208-211) lists datapoints deriving from other EU legislation, each marked with a page or "Not material"; Annex 3 lists disclosures incorporated by reference.

The basis of preparation (page 62) states that "All disclosure requirements and data points corresponding to topics and sub-topics that resulted as immaterial during the DMA, are not included in this statement."

Reliefs are named: "Phase-in option in accordance with ESRS 1 Appendix C, has been adopted specifically for the following disclosures: ESRS 2 SBM 3-48-e ..., ESRS E1-9 ... In addition, BRD Group has applied the transitional provision related to value chain information, specifically for Scope 3 GHG emissions (E1-6)." Note that G1-4 (page 205) and S1-11 (page 167) are disclosed in the body without appearing in Annex 1.

Reference: pages 99-100.

BRD Group does not yet have a transition plan in the ESRS sense and says so. Under E1-1.17: "BRD Group acknowledges the importance of adopting a structured approach to aligning its activities with climate goals ... In this context, BRD is developing the annual prudential transition plan and actively monitoring the decarbonization of its portfolios, in line with SG Group strategic objectives." Alignment is inherited: "BRD Group is working to ensure compliance with SG's commitments, including the Net Zero Banking Alliance (NZBA) targets and the implementation of sector-specific decarbonization pathways." It adds: "BRD Group is not excluded from the Paris Agreement Benchmarks."

The limitation is stated in the climate IRO section: "As BRD Group has not realized a transition plan in line with Paris Agreement's objectives, the analysis related to identification of activities that are incompatible with or need significant efforts to be compatible with a transition to a climate-neutral economy was not performed yet" (page 85).

Listed initiatives (page 99) include sustainable finance and SLLs, retail green loans under InvestEU, green financing growth at BRD Sogelease, IFC and EIB partnerships, and the SME Eco-Tech Program. In 2025 the Group deployed an "ESG Memo tool" automating mandatory ESG controls at onboarding, and work on the prudential transition plan began in 2025 and "will continue in 2026".

Back-filled from ESRS 2 IRO-1 (climate section) and E1-SBM-3, where this content is disclosed in the FY2025 report (pages 84-85, 100-101). This disclosure requirement did not exist under the 2023 ESRS the report was prepared against.

Reference: pages 84-85.

Classification: "For climate change adaptation, the risks are primarily climate-related physical risks ... For climate change mitigation, the risks are primarily climate-related transition risks" (page 100); Table 3 tags each E1 risk row as physical or transition (pages 88-90).

Methodology: "The identification of climate-related physical risks was conducted through the BES at BRD Group level. This process encompassed an analysis of climate-related hazards over the short, medium and long-term, capital allocation plans and the expected lifetime of its assets", covering own operations and the upstream and downstream value chain. Named hazards are "droughts, floods and increased temperatures", focused on eastern and south-eastern Romania across Agriculture, Energy, Real Estate and Automotive. Transition events were screened for "likelihood, magnitude, and duration".

Scenario analysis was not used: "High-emission climate scenarios were not used as part of this analysis" (page 84) and "While a 1.5 degree scenario was not explicitly used in the analysis, the identified risks are consistent with this target" (page 85). No scenario name, temperature projection or analysis date is therefore given.

Back-filled from ESRS 2 SBM-3 and the E1 resilience subsection, where this content is disclosed in the FY2025 report (pages 98, 100-101). This disclosure requirement did not exist under the 2023 ESRS the report was prepared against.

Reference: pages 100-101.

The Group performs no formal resilience analysis of the ESRS kind and says so: "While BRD Group does not currently perform a formal climate scenario analysis or stress test to evaluate the impact of climate change on its strategy, it conducts multiple recurring assessments to identify material climate-related risks and their potential effects" (page 100). Those are the annual DMA, the annual Business Environment Scan covering Corporate, Retail, Sovereign Bonds and both subsidiaries, an annual assessment of enterprises with turnover below EUR 7.5 million, and the ICVI and CCVI vulnerability indicators.

Assumptions include "expected regulatory tightening linked to EU climate policies" and shifts in the energy mix toward renewables. On uncertainty, the assessment "reflects the inherent limitations of available sector-level and geospatial climate data, evolving regulatory expectations, and changes in business models across client segments."

On capacity to adapt: "BRD Group maintains the capacity to adjust or adapt its strategy and business model over the short and medium term" (page 101). CCVI for physical risk "was deployed" in December 2025, with portfolio and geographic heatmaps from 2026.

Reference: pages 108-111.

Four policies are disclosed against MDR-P, all inherited from Societe Generale and transposed locally. One gap is flagged at the outset: "For energy efficiency, BRD Group does not have a specific policy" (page 108).

SG Environmental and Social (E&S) General Principles (pages 108-109), updated in 2025. "This policy covers all the climate change-related material IROs identified during the double materiality analysis, therefore addressing climate change mitigation, climate change adaptation, and energy efficiency." Under its risk management system the Group "may apply enhanced monitoring, introduce contractual E&S conditions, restrict dealings or even exclude certain clients, products or services". Accountability sits with SG's CORESP committee and, at BRD, the Executive Committee.

SG E&S Sectoral Policies (pages 109-110) cover ten sectors including Thermal Power, Thermal Coal, Mining, Shipping, Civil Nuclear Power, Oil and Gas and Tobacco. In March 2025 the Thermal Coal policy was amended to "extend the definition of 'coal developers' subject to exclusions".

SG's Transversal Statement on Climate (pages 110-111) "aims to align its activities with the Paris Climate Agreement", referencing UNEP-FI PRB and TCFD; "Energy efficiency, renewable energy deployment or other areas are not explicitly addressed by this policy." For each policy the report records that the upstream value chain and affected stakeholders are not explicitly in scope.

Reference: pages 111-118.

Seven actions are disclosed, each tagged with a decarbonisation lever or adaptation solution. Resourcing is stated negatively: "The allocation of future resources was not determined and disclosed for any of the actions listed below" (page 111), and most record that "No significant monetary amount of Capex or Opex were required".

The Corporate Climate Vulnerability Indicator was strengthened "in December 2025 through the addition of a physical risk module"; in 2025 "BRD Group has conducted CCVI assessments for more than half of its client portfolio with Turnover > EUR 5m" (pages 111-112). On funds: "In 2025, additional four BRD Asset Management investment funds were transformed to be compliant with Article 8", giving "five ESG Article 8 funds (compared to one as of 2024 end), with RON 2.09 billion assets under management" (page 113). On energy: "BRD Group maintained 100% renewable electricity across all operations where BRD has control over contracts" (page 114). EV charging at BRD Tower enabled "an estimated 240,000 km of electric travel". Fleet greening replaced 145 diesel Dacia Logans with petrol models, leaving from January 2026 "only 0.2% of the vehicle fleet" on diesel. Photovoltaics reached "1153 MWh, contributing to a 6.5% reduction in BRD's dependency on external energy sources" against 858 MWh in 2024, and equipment and Green IT upgrades saved "1,000 MWh of energy, 16 tones of CO2 emissions annually" (pages 116-118).

Reference: pages 118-121.

One GHG target is disclosed: "Achieve a 55% reduction in the carbon footprint of BRD Group's own operations by 2027, compared to the 2019 baseline", quantified as "the 2019 baseline of 20,071 tons of CO2 (tCO2). The target expressed in absolute terms is of 11, 039 tons of CO2 (tCO2)" (page 118). Scope is Scope 1, market-based Scope 2 and selected Scope 3 categories; it "does not currently extend to upstream or downstream value chains" and "It is a gross target" (page 119).

Progress: "achieving a 51.7% reduction by 2025, compared to the 2019 baseline", against 45% in 2024.

A methodology caveat is disclosed: the methodology and actual values in the metrics section are "different from the methodology used to determine the baseline value" (page 118), and "The target was not set based on conclusive scientific evidence" (page 120). Four levers are named, with the footnote that "Information related to the contribution of each decarbonization levers to the GHG reduction target is not available".

Paris alignment is denied: "The own emissions reduction target is not science-based and has not been explicitly aligned with limiting global warming to 1.5 degrees, as outlined by the Science Based Targets initiative (SBTi) or other similar frameworks"; "climate scenarios were not explicitly considered"; and "the GHG reduction targets have not been externally assured" (page 121). No financed-emissions reduction target is set.

Reference: pages 122-123.

Energy consumption is split across two tables, one for BRD Bank plus BRD Sogelease (Table 5, page 122) and one for BRD Asset Management (Table 6, pages 122-123).

For BRD and Sogelease, total energy consumption fell from 37,434 MWh in 2024 to 35,352 MWh in 2025. Fossil energy rose from 17,969 to 18,071 MWh, lifting the fossil share from 48% to 51%: crude oil and petroleum products fell from 336 to 243 MWh, natural gas rose from 16,003 to 16,700 MWh, and purchased electricity, heat, steam and cooling from fossil sources fell from 1,630 to 1,128 MWh. Renewable energy fell from 19,465 to 17,281 MWh, all purchased rather than self-generated, taking the renewable share from 52% to 49%. Coal, other fossil sources, nuclear, renewable fuels and self-generated non-fuel renewables are all zero.

BRD Asset Management consumed 97.73 MWh in 2025 (84.90 MWh in 2024), entirely fossil, with "Share of fossil sources in total energy consumption 100%" in both years.

Basis: "The calculations for energy consumption for BRD and Sogelease were made based on the invoices received by the suppliers ... For BRD AM, the data was provided by the owner of the building" (page 121). The note adds: "The data includes diesel used for the generator and heating. The data is not validated by an external body. No assumptions were used." No energy intensity per net revenue is given; Annex 2 marks the high-climate-impact-sector datapoints "Not material".

Reference: pages 123-133.

Table 7 (pages 123-125) reports the inventory on an operational control basis. Gross Scope 1 was 4,586 tCO2e in 2025 (4,615 in 2024), from stationary combustion of 3,420, 9 and 13 at the Bank, Asset Management and Sogelease and mobile combustion of 1,038, 9 and 102. Gross location-based Scope 2 was 3,363 tCO2e (3,752) and market-based Scope 2 was 258 tCO2e (367).

Scope 3 totals 1,430,755 tCO2e (1,797,389), dominated by category 15 Investments at 1,403,052 tCO2e (1,752,781). Other categories: purchased goods and services 24,650 (39,202), fuel and energy-related activities 1,279 (1,858), waste 1 (2), business travel 71 (107), employee commuting 1,702 (3,439). Totals were 1,438,704 tCO2e location-based and 1,435,600 tCO2e market-based.

Scope 3.1 moved from Exiobase/Ademe to CEDA factors: "The BRD Group recalculated the 2024 emissions figure using the updated CEDA emission factors, resulting in 36,649 tCO2e" (page 125). Data quality is quantified: "approximately 5% of the reported Scope 3 emissions (excluding Scope 3.15) are derived from primary, supplier-specific information" (page 126).

Financed emissions follow the PCAF standard. Table 8 shows intensity per million RON financed falling from 31.7 to 24.0. "Percentage of portfolio covered by Financed Emissions calculation from total portfolio: 76% in 2025 (78% in 2024)" (page 130).

Reference: pages 150-154.

Three policies are disclosed against MDR-P. The Human Resources Policy "covers all the material IROs related to the own workforce" and "was revised in 2025 to reinforce commitments to equal treatment, equal opportunities, and the prohibition of discrimination and harassment. Updates also further embedded inclusion and diversity principles within the Recruitment Policy" (page 150). The Human Resources Director is accountable, reporting to the CEO and BoD.

The Remuneration Policy covers "the material IRO related 'gender equality and equal pay for work of equal value'", is approved by the BoD on Remuneration Committee recommendation and has incorporated "sustainability risk considerations since March 2021" (page 151).

The Occupational Health and Safety Policy (page 152) frames the OHS Management System, is "fully aligned with Romanian legal requirements (Law 319/2006)" and applies "to all employees, regardless of their role or seniority, and external collaborators, including leased personnel ... The policy has no exclusions." The CEO is accountable.

Human rights commitments (pages 152-153) reference the Universal Declaration of Human Rights, ILO fundamental conventions, OECD Guidelines and the UN Guiding Principles: "Interdictions regarding child labour, trafficking of human beings, and forced labour are guaranteed through internal regulation." BRD signed the Romanian Charter of Diversity in 2018 (page 153).

Reference: pages 154-155.

"At BRD Group, employee engagement occurs both directly with the workforce and through workers' representatives. The HRD, who reports directly to the CEO is responsible for overseeing this engagement."

Frequency and scope are specified: "Regular meetings with employee representatives are held at least quarterly, with additional meetings scheduled upon request from either party. These discussions ... cover a wide range of significant topics, including working conditions, remuneration, health and safety, and working time." The trade union contributes to the training plan, attends quarterly results meetings, sits on a mixed Health and Safety Committee and "is invited to the Board of Directors meetings to discuss matters of professional, economic, and social interest".

The survey channel is quantified, including the deterioration: "For 2025, the participation rate of BRD employees was at 74% (vs 76% in 2024) and the engagement/ commitment show a decline with 14pp (61% from 75% in 2024)" (page 155).

"SG Group and UNI Global Union concluded in 2023 a new 4-year global agreement on fundamental rights. This agreement applies to all subsidiaries, including BRD Group." Vulnerable groups are identified through the DE&I programme, with a minority-inclusion question in the SG Barometer since 2023.

Reference: pages 155-157.

Remediation is tied to the three negative impacts identified: "The 2025 double materiality assessment identified several areas of concern, including secure employment, health and safety and gender equality" (page 155).

For secure employment, "BRD ensures that any dismissals strictly comply with collective dismissal regulations. Employees whose roles are impacted receive compensation and benefits defined by the Collective Labour Agreement", with union consultation on "supplementary measures, which may include financial or non-financial support, career counselling, or outplacement services".

The grievance mechanism is described procedurally (page 156): a formal procedure within the Internal Regulation; a dedicated email address "managed by a limited number of HR personnel to ensure confidentiality"; and "All employees are protected against retaliation by the provision of the Code of Conduct." Handling runs from validity assessment through optional mediation to "a commission (HR, Legal, Compliance and sometimes Union representatives)" issuing a final report, with an online register and annual reporting to the HR Executive Director.

Awareness is measured rather than asserted: "The assessment related to what extent BRD Group employees are aware and trust the channels available to raise complaints/grievances is realized through the Employee Barometer survey."

Reference: pages 157-163.

Actions are grouped by IRO, following an escalation process that "begins with the internal risk assessment framework, which flags areas of concern based on HR and operational data" (page 157).

Secure employment. Career and Development Week ran 22-26 September 2025: "More than 2,000 employees took part in these activities within a single week." Post-termination support includes maintained eligibility for the 2024 and 2025 performance bonuses, internal training access "for up to twelve months following termination", and "a six-month medical subscription after termination, fully covered by the Bank" (page 158).

Gender pay gap. Annual salary calibration against market wage studies and uniform Collective Labor Agreement benefits "including anniversary and loyalty bonuses".

Freedom of association and collective bargaining (pages 159-160). Quarterly management-union meetings and logistical support including "dedicated office space and meeting facilities (e.g., a room in BRD Tower) ... and access to a bank vehicle". BRD's agreement runs to June 2026; BRD Sogelease concluded its own at end-2024.

Health and safety. MIND BRD with Regina Maria "remained active during January-February 2025", with "a 24/7 Emotional Helpline".

Training and skills (pages 161-162). "40% of people managers, were trained in 2025"; mentoring expanded from "58 participants and 32 pairs" to Group-wide; a 12-pair Reverse Mentoring pilot from October 2025.

Reference: pages 163-164.

Table 14 sets three 2027 targets: "Obtain an employee engagement rate of 80% in 2027", "Obtain an employee inclusion rate of 92% in 2027" and "Obtain a well-being score of 7.5 in 2027" (page 163).

Measurement is specified: "The targets are obtained through the annual employee self-assessment by responding to a series of questions in the SG Barometer, in the form of grades on a scale from 1 to 10 ... The index is the average of these grades, expressed in the form of percentage." Inclusion "is defined based on the employee's answer to the question: 'I feel included and accepted as I am'."

Baselines are 2023 values of 77% engagement, 89% inclusion and 6.7 wellbeing, with milestones of "79% by 2025, reaching 80% by 2026", inclusion "90% by 2025, 91% by 2026, 92% by 2027", and wellbeing "7.1 by 2025, 7.3 by 2026, 7.5 by 2027". Benchmarks were SG Group, the Eurozone and the Ipsos Bank Finance Insurance Worldwide-RED database.

Performance deteriorated and the Group reports it: "The progress in 2025 for the targets is: Employee engagement rate: 61%; Employee inclusion rate 85%; Employee well-being score: 6.2" (page 164), each below both the 2025 milestone and the 2023 baseline. The explanation offered is "a period of organizational optimization" plus "enhanced maturity of our measurement methodologies". No target is set for secure employment, where the IRO table records "Not established" (page 147).

Reference: pages 164-165.

Table 15 reports 5,517 employees at 31 December 2025 against 6,243 a year earlier, split 4,171 female and 1,346 male (4,748 and 1,495 in 2024). "Other" and "Not reported" are shown as not applicable, with a footnote that self-specified gender is "Not yet monitored by BRD Group".

The movement is explained: "The difference in the total number of employees between 2024 and 2025 is primarily the result of both natural leaves and a period of organizational optimization, during which BRD Group implemented structural efficiency measures and process simplification in response to external and strategic pressures."

Tables 16 and 17 give contract type by gender (page 165). In 2025: 5,331 permanent (4,020 female, 1,311 male), 186 temporary (151, 35), zero non-guaranteed-hours, 5,493 full-time and 24 part-time, against 5,956 permanent, 287 temporary, 6,211 full-time and 32 part-time in 2024.

Table 18 reports turnover rising from 811 employees and 12.8% in 2024 to 1,133 and 19.3% in 2025.

The note states: "All employee data were reported as headcount at the end of the reporting year ... Employee turnover includes both voluntary and involuntary contract terminations", calculated against an average headcount from month-end figures divided by 12. "The data is not validated by an external body", and the reconciliation point to the financial statements is Note 1 Corporate information.

Reference: page 166.

Table 19 reports the total number of non-employee workers in BRD Group's own workforce falling from 343 in 2024 to 285 in 2025, of which self-employed workers fell from 320 to 259 and "workers provided by undertakings primarily engaged in employment activities" rose from 23 to 26.

The definition is given: "Non-employees are individuals who are not directly employed by BRD, but which are either self-employed individuals or contracted through a third party engaged in employment activity."

The movement is explained rather than left unexplained: "The significant fluctuation observed during the reporting year is linked to SG Group strategy, cascaded into BRD Group's strategy, referring to optimization of external resources and also the internalization of some niche profiles."

Methodology limits are stated: "All data related to non-employees were reported as headcount at the end of the reporting year ... Data is not an estimate. The data is not validated by an external body." No breakdown by gender or by region is provided for non-employees, and no separate figures are given per subsidiary. The ESRS content index lists S1-7 against page 166 (page 207).

Reference: page 166.

"As of the end of 2025, 99.49% of BRD Group employees were covered by collective bargaining agreements (vs 97% as of 2024 end). Both BRD Bank and Sogelease have their own collective labour agreement in place covering their respective employees."

The residual gap is identified: "As for the other subsidiary there is no collective labor contract. Additionally, the collective labor agreement concluded at the banking sector level applies only to BRD, as it is specific to banks, and not to other subsidiaries." BRD Asset Management is therefore the uncovered entity.

European-level representation is described: "The Executive Board of IMPACT Trade Union has appointed representatives within the Group European Works Council established at the Societe Generale level. These representatives also serve as the voice for subsidiaries in Romania, ensuring that employee interests are communicated and considered at the European level."

Table 20 reports both collective bargaining coverage and workplace representation for Romania in the 80-100% band for 2025 and 2024.

Collective bargaining is one of the two material positive impacts under S1: "The impact may manifest through effective collective bargaining that ensures fair rights and working conditions for all employees, contributing to their retention" (page 92).

Reference: page 167.

The metrics are disclosed voluntarily, and the Group says so: "The sustainability matter of Diversity was not assessed as material by BRD Group following the results of the DMA. However, diversity-related metrics provide relevant insights in relation to gender equality and equal pay for work of equal value. Accordingly, BRD Group discloses these metrics." ESRS S1-9 is nonetheless listed in the content index against page 167 (page 207).

Table 21 gives gender distribution at top management level: 10 female (42%) and 14 male (58%) of 24 in 2025, against 11 female (42%) and 15 male (58%) of 26 in 2024. "Top management is defined as members of Board of Directors and Executive Committee, reported as headcount at the end of the reporting year."

Table 22 gives the age distribution: under 30 years old 925 employees or 17% in 2025 (1,201 or 19% in 2024); between 30 and 50 years old 3,387 or 61% (3,786 or 61%); over 50 years old 1,205 or 22% (1,256 or 20%).

"All data are reported as headcount at the end of the period. The data is not validated by an external body."

The related material impact is the organisational-level gender pay gap, which the Group attributes to role composition: women are "less present in higher paid senior, technical, or specialist positions and more concentrated in functions with lower average remuneration" (page 146).

Reference: page 167.

Social protection is disclosed in the body of the statement under the code S1-11, although the disclosure requirement is not listed in the ESRS content index at Annex 1 (pages 206-207).

Coverage is stated as complete: "All BRD Group employees benefit from social protection coverage through a combination of Romanian public social security schemes and employer-provided benefits, ensuring protection across all major life events. Romanian legislation provides statutory protection for sickness, unemployment, employment injury and acquired disability, parental leave, and retirement, applicable to all employees working within the Group."

Employer-provided cover is itemised: "BRD Group enhances employee protection through a group life insurance policy covering death from any cause, partial or permanent disability resulting from accidents, surgical interventions, hospitalization, convalescence, fractures and burns due to accidents, as well as serious illnesses. Furthermore, through the Collective Labour Contract of BRD and Sogelease and the Internal Regulation of BRD Asset Management, employees are eligible for financial support in cases of death, serious illness, and for the procurement of prosthetics."

"Social Protection" is also named as a metric attached to the secure employment IRO (page 147). No percentage of employees uncovered by each risk type is given, consistent with a statement of universal statutory coverage.

Reference: pages 167-168.

Table 23 (page 168) reports both measures, and both training figures fell sharply.

The share of employees participating in regular performance and career development reviews was 88% of women and 95% of men in 2025, against 89% and 94% in 2024. A footnote qualifies it: "Evaluation campaign for 2025 finalized in 2026 ... Percentage of employees that participated in regular performance and career development divided by headcount reported in S1-6 is 90%."

Average training hours per employee fell from 59 to 40 hours for women and from 46 to 30 hours for men.

The data basis is specified: figures come from "all active e-learning platforms, including MyLearning, BRD IKnow LMS, Bold Technologies, Coursera, and Udemy (starting November 2024)", summing hours completed "whether active or inactive, during the selected year, using the criteria 'Complete'", divided by year-end headcount segmented by gender. "One hour of training = 60 minutes."

The surrounding narrative (page 167) describes annual formal evaluation with a recommended mid-year meeting, objectives aligned to Group, entity and team strategy, and HR Business Partners supporting recruitment, mobility and training per entity. Training and skills development is the S1 financial-materiality risk following the 2025 reassessment that moved its positive-impact side to not material (page 95).

Reference: pages 168-169.

Table 24 reports health and safety metrics for employees and non-employees, and 2025 deteriorates against 2024.

Coverage is complete: 100% of own workers and non-employees "are covered by health and safety management system based on legal requirements and (or) recognised standards or guidelines" in both years. Fatalities are zero throughout, for own workforce and for other workers on the undertaking's sites.

Recordable incidents rose. "Number of recordable work-related accidents for own workforce" went from 3 in 2024 to 7 in 2025, with the rate rising from 0.27 to 0.64, calculated as "Number of employees involved in work-related accidents / the number of total hours worked ... x 1,000,000". Cases of recordable work-related ill health went from 0 to 1. Days lost to work-related injuries, fatalities and ill health rose from 81 to 608. All non-employee figures are zero.

The note records the basis and an external check: "All BRD Group employees are covered by the health and safety management system. Data above are determined according to the Romanian Law. Investigation files are validated by ITM (Territorial Labour Inspectorate)" (page 169).

Health and safety was newly material in 2025 from a negative-impact perspective, driven by psychosocial rather than physical risk: "While physical safety risks remain low in the financial sector, mental health considerations are becoming increasingly prominent" (page 95).

Reference: pages 169-170.

Table 25 discloses both metrics with restated comparatives. The gender pay gap was 28.54% in 2025 against 28.52% for 2024 as restated and 30.14% as originally reported. The annual total remuneration ratio of the highest-paid individual to the median for all other employees was 26x in 2025, against 25x restated and 29x as originally reported.

The restatement is explained: "benefits in kind (such as, plane tickets, private health insurance or medical subscriptions) as well as other forms of variable cash payments (such as vacation vouchers, the 13th salary, loyalty bonuses or meal vouchers) offered to employees were included in the scope of total remuneration, whereas they were not comprehensively captured in the original presentation. These additional benefits may account for up to approx. 15% of total remuneration on average."

The gap is "the unadjusted ratio according to ESRS requirements". The cause is attributed to role composition: "The reported gender pay gap is primarily explained by the distribution of women and men across different roles and functions within the Group, rather than by pay differences for comparable work. Consistent with this, comparisons among employees performing similar roles do not indicate material disparities" (page 170). Pay is systematically reviewed on return from parental leave or maternity.

Reference: page 170.

"In 2025, BRD Group received a total of 5 complaints, all representing discrimination/harassment alerts (vs. 11 in 2024) through whistleblowing channels from SG or BRD. Of the 5 alerts received in total, 4 were not confirmed, while 1 alert is currently being processed."

Financial consequences are reported as nil: "There were no fines, penalties or compensation for damages because of complaints for discrimination/harassment in the reporting period."

Severe human rights incidents are also reported as nil: "In addition, no severe human rights incidents connected to BRD Group workforce have occurred in the reporting period."

Related position statements appear earlier in the chapter. Under S1-SBM 3-14 f, g the Group reports that "Considering its business model, BRD Group didn't identify operations at significant risk of incidents of forced labour or compulsory labour, and child labour" (page 145), a position Annex 2 cross-references to page 145 for both the forced labour and child labour datapoints (page 209).

Annex 2 cross-references the S1-17 discrimination incidents datapoint to page 170 and the non-respect of UNGPs and OECD Guidelines datapoint to page 170 (page 210). The complaints channel itself is described under S1-3 (pages 155-157), including the dedicated email address, the investigating commission and protection from retaliation under the Code of Conduct.

Reference: pages 175-180.

Five policies are disclosed against MDR-P, each mapped to the material consumer IROs.

The Information and ICT System Security Directive (pages 175-176) "addresses the material IROs related to Privacy, Access to quality information and Security of a person". It applies to all personnel, to Group entities using BRD's ICT systems and "to third-party ICT service providers", with exclusions named: business continuity except cyber resilience, fraud, physical security and staff loyalty. "Considering the activities carried out by BRD Group as a financial institution, this policy covers also all its clients." The CEO is accountable.

The Customer Complaints Policy (pages 176-177) "addresses the material IROs related to privacy, access to quality information, security of a person and access to products and services". The Fraud Risk Management Policy (pages 177-178) governs internal stakeholders and "does not directly cover all consumers or end-users".

The Societe Generale Sustainable Financing Framework (pages 178-179) aligns with the UN SDGs and the Paris Agreement and excludes "tobacco, weapons and gambling". The Standards for Assessing and Addressing the ESG Risks (pages 179-180) govern the sustainable product lifecycle.

Consumer human rights follow the SG Transversal Statement on Human Rights, "ensuring that all clients are treated with dignity, fairness, and non-discrimination" (page 180).

Reference: pages 181-182.

"BRD Group incorporates the perspectives of its customers into its decisions and activities aimed at managing actual and potential impacts on them", through regular surveys "on various aspects of its offerings, including products, services, processes, and customer-bank interactions" (page 181).

Channels are specified by segment: "Engagement occurs directly with BRD Group customers for private individuals and with their legitimate representatives for businesses." Corporate surveys run through external agencies: "The annual Corporate Net Promoter Score (NPS), for a selected list of SME &TCC companies" and "The 2nd day call survey, recurrent for all SME companies that purchase certain banking products".

Responsibility is named: RCVM Directors, the RCVM Executive Director and the Retail Deputy CEO, with the Corporate Executive Director and Deputy Global Corporate CEO for corporate clients.

Effectiveness is tracked through the complaints application, internal audits, a feedback loop and action plans (page 182). Vulnerable consumers are identified by law: "BRD applies the national legal definition of vulnerable customers as stipulated by Law no. 258/2017, which transposes EU Directive 2014/92/EU, rather than using a separate internal definition", and "YouBRD application is accessible and compatible with Voice Over readers".

Reference: pages 182-184.

Eight internal channels are listed (page 182): direct contact at branches, the MyBRD Contact call centre, email to mybrdcontact@brd.ro, an online complaint form, a website chat function, written complaints to the Quality Direction, a messaging section in the internet banking platforms, and social media.

Seven external escalation routes are also listed (pages 182-183), including the National Authority for Consumer Protection, the Centre for Alternative Dispute Resolution in the Banking Field, the National Bank of Romania and the Financial Supervisory Authority. "If a customer receives a negative response from BRD regarding their complaint, the reply includes a list of institutions where they can further escalate their concerns."

Business partners are held to the same standard: BRD "requires relevant partners - such as outsourcing providers, payment processors, insurance distributors, IT service suppliers, and fintech collaborators - to maintain accessible complaint channels or to follow BRD defined procedures", embedded in contractual clauses, service level agreements and GDPR provisions (page 183).

Tracking is assigned: "The Quality Direction continuously analyses complaints to monitor the evolution of key indicators, identify dysfunctions ... Every complaint receives a personalized response within the designated internal timeframe" (page 183).

Reference: pages 184-193.

Actions are organised by IRO.

Privacy (pages 184-185). The GDPR Program and annual GDPR training continued in 2025, with a Data Protection Officer, branch and subsidiary correspondents and DPIAs. "BRD's GDPR Programme has been closed in 2025, however actions related to personal data protection ... are continuously monitored, improved and reported quarterly to the Top Management within the Compliance Committee".

Access to quality information (pages 185-187). "Throughout 2024 and 2025, District BRD has organized 16 regional events in eight cities, attracting more than 1,200 participants"; the #ItCouldHaveBeenYou anti-fraud campaign continued in 2025.

Security of a person (pages 187-188). "annual penetration tests to the internet exposed applications", a tabletop cyberattack simulation, and DORA compliance "cover[ing] all four pillars", including "the TLPT exercise in close cooperation with the National Bank of Romania".

Access to products and services (pages 188-189). IFC Gender Finance, EUROBRD, the EIF Sustainability Guarantee providing "a 70 percent guarantee on eligible loans", and the MEDAT programme targeting "4,000 beneficiaries between 2022 and 2027".

Sustainable finance (pages 189-193). 2025 deals include "a green loan of RON 688 million in a syndicated facility supporting Distributie Energie Oltenia SA", plus the first Romanian SME sustainability-linked loan.

Reference: pages 193-195.

The Group sets a target for one material matter and states plainly that it sets none for the others: "For the material IROs related to Privacy, Access to quality of information, Security of a person, Access to products and services, BRD Group has not identified any material targets relevant to be disclosed. The Group established processes are anchored within the functions that have day-to-day responsibility for ensuring adherence to its policies" (page 193).

The sustainable finance target is "Achieve EUR 2.4 billion in sustainable finance production by 2027." History and progress are quantified: "BRD Bank set an initial target of EUR 1 billion in sustainable finance transactions by 2025, which was already achieved in September 2024". Progress: "As of the end of December 2025 the cumulated value was 2.3 billion EUR (vs.1.4 billion EUR as of the end of December 2024)", cumulated from 2021 and "set at Bank level" (page 194).

A second metric is given: "the New Sustainable Finance Production, which in 2025, at BRD bank level, reached EUR 917 million ... calculated based on the gross amount of new loans, credit facilities approved and signed during 2025."

The target covers 2021-2027 with annual reviews, applies downstream in Romania and excludes the upstream value chain. Third-party verification applies only to SLL financing.

Reference: pages 197, 200, 202-203.

Corporate culture rests on the Leadership Model values "Customer First, Integrity, Care, Team Spirit, Innovation, Responsibility, and Commitment" (page 197). Embedding runs through an annual training plan, Climate Fresk workshops, the ESG Academy, the "Welcome to BRD" onboarding programme, and a Culture and Conduct programme with "a structured roadmap focused on governance frameworks, risk management, and communication ... overseen by designated roles such as the Culture and Conduct Correspondent and Conduct Officer", reviewed annually at executive level. Culture is measured through the SG Barometer and the Organizational Health Index: "In 2025, both OHI and the Barometer achieved high participation rates at BRD level - 77% and 74% respectively" (page 204).

The SG Code of Conduct "applies to all BRD Group subsidiaries and to all its employees as well as partners, customers, and suppliers" and "is part of the CSR clause, being mandatory to be inserted in all the contracts concluded with third parties" (page 198). The Conflict of Interests Policy (page 199) implements NBR Regulation 5/2013 and MiFID II and "is reviewed at least annually".

Whistle-blower protection is detailed (pages 200-201): anonymous reporting "via the WhistleB platform" plus an independent SG platform, with "strong protections ... against retaliation, including dismissal, demotion, salary reductions, intimidation, discrimination".

Reference: pages 197-198, 199-202, 202-203.

The framework has four parts: "BRD Group's framework for preventing and detecting cases of corruption includes the Code of Conduct, the Principles and Rules Governing the Fight Against Corruption, a Whistleblowing Mechanism and a specific Training Programme" (page 200).

The Principles and Rules Governing the Fight Against Corruption (pages 199-200) regulate "the granting of undue benefits and bribes; recruiting and evaluation of employees; giving or receiving gifts or invitations to business meals or external events; the use of a third party intermediary or supplier; 'facilitation' payments; sponsorship and patronage; political and religious donations". They align with the UN Convention against Corruption, Wolfsberg ABC guidance, the UK Bribery Act and the US FCPA.

Investigator independence is explicit: "the investigators or investigating committee are separate from the chain of management involved in the matter", with mandatory Legal, HR and Compliance members. The Compliance Executive Director reports findings and an anonymised status of all alerts to the EC (page 201).

Functions at risk are mapped (page 202) and the mapping "is reviewed and updated twice per year", most recently September 2025. Table 27 gives 306 at-risk functions at Group level in 2025 (327 in 2024) with 304 trained (321); training is annual and covers "all at-risk functions (100% coverage)".

Reference: page 205.

G1-3 as a standalone targets disclosure requirement did not exist under the 2023 ESRS this statement was prepared against; business conduct targets fell under MDR-T. BRD Group answers MDR-T directly and in the negative: "For the material IROs related to Business Conduct, BRD Group has not identified any targets relevant to be disclosed. The Group established processes are anchored within the functions that have day-to-day responsibility for ensuring adherence to its policies" (page 205, under the heading "Targets / MDR-T"). The G1 IRO management table records "Not established" in the Targets column for all three material G1 IROs (pages 196-197).

MDR-T's other limb, tracking effectiveness in the absence of a target, is addressed. BRD Group runs "a structured yearly maturity assessment across five key pillars: Governance Framework, Conduct Risk Management, Culture & Conduct Monitoring, HR Processes, and Communication", aiming "to maintain the 'Advanced' maturity level at BRD level, while for subsidiaries to reach Intermediate level", and "Quarterly updates are presented to the Compliance Committee" (page 203). It also "performed annual risk assessments covering conduct risk, conflicts of interest, and anti-bribery and corruption (ABC)", and reports ABC training coverage of at-risk functions at 100% (page 202).

Reference: page 205.

Table 28, "Incidents of corruption and bribery", is printed under the code G1-4 in the Metrics section of the business conduct chapter and reports nil in both years: "Number of convictions for violation of anti-corruption and anti-bribery laws" is 0 in 2024 and 0 in 2025, and "Fines for violation of anti-corruption and anti-bribery laws (RON)" is 0 in 2024 and 0 in 2025.

The counting basis is narrow and stated: "Only final, legally confirmed convictions and final, legally imposed fines ... are included in the metric. Internal disciplinary actions, open investigations, allegations, or pending legal cases are not counted unless they result in a final legal conviction or fine."

Neither the number of confirmed incidents nor the split between own workers and business partners is given. Related figures appear elsewhere: five discrimination or harassment alerts in 2025, four not confirmed and one in process (page 170).

[uncertain: G1-4 is not listed in the ESRS content index at Annex 1 (pages 206-207), which covers only G1-GOV-1-5, G1-1 and G1-3, and Annex 2 marks the two G1-4 EU-legislation datapoints "Not material" (page 211). The body disclosure is labelled with the G1-4 code and carries the required datapoints, so it is treated as reported; those index rows are inconsistent with it.]