Erste Group Bank AG

Reference: page 25

The Management Board (five members; 20.00% female in 2025, up from 18.33% in 2024) "has overarching responsibility for managing the organisation and defining the sustainability strategy, framework, goals and priorities." In 2025 it "was briefed six times on material environmental matters (sustainable financing, climate change mitigation, Responsible Financing Policy)," and the gender pay gap was presented to the Board and the Remuneration Committee. The Supervisory Board (18 members, 55.34% female, 91.60% independent) "has established its own Strategy and Sustainability Committee," which together with the Audit Committee "were briefed eight times on climate related IROs" in 2025.

The Management Board, Audit Committee and Strategy and Sustainability Committee were informed four times about the double materiality assessment (DMA), which the Management Board then acknowledged. Sustainability-related expertise reaches the boards through a mandatory group-wide web-based ESG training rolled out in 2025 "across the Group to all employees, including board members," plus external courses such as the EBA ESG risk-management training and a 2025 FMA webinar on sustainable finance for management and supervisory bodies. The Nomination Committee has set a minimum target of 30% for the underrepresented gender on the Management Board and Supervisory Board by 2028.

Reference: page 27

Erste Group runs an "ESG KPI Dashboard that enables regular monthly performance monitoring of key sustainability metrics," covering sustainable financing volumes, financing activities and GHG/decarbonisation KPIs at group level; the Management Board is informed at least quarterly on environmental IROs through this dashboard, while IROs on Own Workforce, Consumers & End-users and Business Conduct are reported "on demand." "All IROs identified as material in the DMA were discussed with and acknowledged by the Management Board and presented to the Audit Committee."

Policy governance is split by function: the CEO for Own Workforce matters, the CFO for finance, the COO for IT/banking services and the CRO for risk including environmental risk. As a worked example, the Group Responsible Financing Policy — which "establishes industry-specific ESG exclusion and phase-out criteria" for carbon-intensive sectors — is owned by Credit Risk Portfolio and "was most recently updated in 2025 and approved by the Management Board in October 2025." Group Diversity Management similarly owns policy governance for the gender equality IRO, embedded in the CEO division and coordinating with local Diversity Management teams in each core market.

Reference: page 28

No variable remuneration is paid to Supervisory Board members. For the Management Board, variable pay is capped at 100% of fixed remuneration; amounts above EUR 150,000 defer 60% (below, 40%), with at least half of both upfront and deferred pay settled in non-cash instruments (Performance Share Units) subject to retention periods, and malus/clawback provisions under EBA guidelines.

"In 2025, 15% (2024: 15%) of the relevant Management Board members' variable remuneration was based on ESG criteria (including 10% ESG targets out of which 1/3 to 2/3 with climate related considerations)." The 10% ESG component includes two overarching targets — maintaining strong external ESG ratings (MSCI, ISS ESG, Sustainalytics, CDP) and implementing the ECB ESG Action Plan (CRO) — plus named targets tied to specific Management Board members: portfolio net-zero target setting (CFO/CCMO), sustainable retail mortgage volume (CRetO), sustainable corporate financing volume (CCMO) and zero-carbon electricity sourcing (CFO). All Management Board members additionally carry a 5%-weighted diversity target as part of their leadership evaluation. Performance on ESG targets is scored on a 5-point scale by CEO/CFO/CRO division experts and reviewed by the Remuneration Committee.

Reference: page 30

Erste Group's Code of Conduct references the UN Guiding Principles on Business and Human Rights and the OECD Guidelines for Multinational Enterprises, and due diligence was applied "throughout the Double Materiality Assessment to identify actual and potential negative impacts on the environment and society."

The statement provides an explicit mapping of the ESRS due-diligence core elements to chapters: (a) embedding due diligence in governance/strategy maps to GOV-2, GOV-3 and SBM-3; (b) engaging affected stakeholders maps to GOV-2, SBM-2, IRO-1, E1-2, S1-1/S1-2, S3-1/S3-2, S4-1/S4-2 and G1-1; (c) identifying and assessing adverse impacts maps to IRO-1; (d) taking action maps to E1-3, S1-4, S3-4 and S4-4; and (e) tracking effectiveness and communicating maps to E1-4, S1-5, S3-5 and S4-5.

Reference: page 31

The statement names three risks in the sustainability reporting process — "errors in reporting," "reporting on irrelevant information" and "omitting relevant information" — and four mitigation measures: internal controls on quantitative data (the same 4-eyes principle and data validation used for financial reporting), internal controls on qualitative data (4-eyes, management review, external consulting), the double materiality assessment itself ("carried out in collaboration with an external consultant"), and a relevance analysis that maps DMA results to the mandatory and material disclosure requirements actually disclosed.

In 2025 Erste Group "implemented a new disclosure management tool," adding granular per-section user permissions, documented change tracking, approval restricted to document owners, and dynamic linking so that "once the data has been uploaded, it refreshes across the entire document." The Management Board and Audit Committee are informed of the sustainability-reporting risk assessment annually, and the statement is presented to the Supervisory Board for approval.

Reference: page 32

Erste Group operates retail and corporate banking across Austria, Czechia, Slovakia, Romania, Hungary, Croatia and Serbia, serving "a customer base exceeding 16 million." Its sustainability strategy has two pillars: supporting the green transition (net-zero portfolio ambition by 2050, net-zero banking operations by 2030, sustainable financing across CEE) and promoting social inclusion (social banking/financial inclusion, financial health and literacy, diversity, business-conduct compliance).

Value chain: upstream covers procured goods and services (IT services, infrastructure, consulting) assessed by expenditure category, e.g. "IT services were included in the assessment for Climate Change (E1)... consulting services were considered in the assessment of Workers in the Value Chain (S2)." Own operations covers workforce, branches and offices — material IROs here fall under Own workforce (S1), Consumers and end-users (S4) and Business conduct (G1). Downstream ("the portfolio") covers financed clients: "the highest individual sectoral exposure (real estate) is reflected in the identified material negative impact relating to financed CO2 emissions." The statement notes the DMA "is currently limited in considering all aspects of the value chain due to data availability constraints," with focus on direct business relationships.

Reference: page 34

Stakeholders were split into "affected stakeholders: retail customers, corporate clients, employees, suppliers and nature" and "users of the sustainability statement: investors, analysts, rating agencies, supervisory and regulatory authorities, NGOs, potential future employees and other readers." For each group, at least one internal contact person conducted individual interviews to document topics relevant to that group, feeding directly into the IRO identification — for example, "the IROs for S1 (Own Workforce) were defined with employee representatives and the Group People & Culture department."

Engagement channels vary by group: advisory sessions and customer-experience programmes for retail customers; conferences, seminars and roadshows for investors; supplier feedback questionnaires for procurement; supervisory dialogues for regulators. IRO-1 clarifies that "the executed assessment process did not comprise an explicit step of engaging with external stakeholders" directly — external views were captured indirectly through in-house experts' regular exchanges with customers, NGOs, rating agencies and investors.

Reference: page 36

The SBM-3 table lists every material IRO by sustainability matter, type, value-chain position and time horizon. Environmental: two Climate change adaptation IROs (a physical-risk credit risk and an adaptation-financing opportunity, both Portfolio); five Climate change mitigation & Energy IROs (a transition-risk credit risk, an actual positive impact from renewable-energy financing, an energy-market-instability risk, an actual negative impact from Scope 1/2/3 emissions, and a decarbonisation-financing opportunity, all Portfolio); one Soil sealing actual negative impact from financing real estate/infrastructure (Portfolio).

Social: Gender equality (actual negative impact, gender pay gap), Training and skills development (opportunity), and Diversity (actual positive impact plus a potential negative impact from workplace discrimination), all Own operations; Social Banking (actual positive impact on financial inclusion, Downstream); Privacy (potential negative impact from data breaches/cyberattacks) and Financial Health (actual positive impact), both Portfolio. Governance: Protection of whistleblowers and Corruption and bribery prevention/detection, both potential negative impacts, Own operations. The chapter notes that in the 2025 reassessment, Work-life balance and Health and Safety impacts "not exceeded the materiality threshold," while a new Social Banking positive impact (moved from S4 to S3) and a new Diversity negative impact were added.

Reference: page 39

The 2025 DMA is Erste Group's second under ESRS. It introduced a "Portfolio Analysis to identify impacts from the credit risk portfolio," run centrally under Group Accounting and Group Corporate Affairs & Stakeholder Management with input from Investor Relations, People & Culture, Procurement, Risk Management and Corporates & Markets. The process ran in four steps: (1) a relevance analysis of every ESRS 1 Appendix A AR16 topic plus entity-specific topics (financial health, social banking); (2) impact and financial materiality assessment of relevant IROs; (3) quality assurance of scores by "a central expert jury"; (4) visualisation in a matrix and acknowledgement by the Management Board.

The Portfolio Analysis used "an Excel-based tool considering input data by UNEP FI and ENCORE," scoring loans by sector/country ESG impact and flagging topics exceeding "the 90th percentile threshold" for expert review. Impact materiality used a 0–5 severity scale (scale, scope, and for negative impacts irremediability) multiplied by likelihood, with "impacts with a total score above 2.5... considered material." A Top-Down approach assessed IROs centrally with continuous validation against subsidiary-level DMA results via weekly AT/CEE calls and workshops. External stakeholder engagement was not a formal DMA step; views were captured indirectly through internal experts' regular contact with customers, NGOs, rating agencies and investors.

Reference: page 45

"After the completion of the DMA the respective material sustainability matters were allocated to the relevant disclosure requirements and data points by using the EFRAG Guidance." The printed content index lists disclosure requirements and page references under four headings — General information (BP-1/BP-2, GOV-1 to GOV-5, SBM-1 to SBM-3, IRO-1/IRO-2), Climate change (E1 SBM-3, E1-1 to E1-6), Biodiversity and ecosystems (E4 SBM-3, E4-1 to E4-5), Own workforce (S1 SBM-3, S1-1 to S1-7, S1-9, S1-12, S1-13, S1-16, S1-17), Affected communities (S3 SBM-3, S3-1, S3-2, S3-4, S3-5), Consumers and end-users (S4 SBM-3, S4-1 to S4-5), and Business conduct (G1-1, G1-3, G1-4, G1-5). No disclosure requirements are listed for E2 (Pollution), E3 (Water and marine resources), E5 (Resource use and circular economy) or S2 (Workers in the value chain), consistent with the "Non-material sustainability matters" assessment on page 44.

A separate table cross-references data points that derive from other EU legislation (SFDR, Pillar 3, the EU Climate Law benchmark regulation), each flagged material or not material — this is the source used to classify several DRs (E1-7, E1-9, S2-1) not otherwise itemised in the main index. Erste Group also discloses entity-specific information "following the policy, action and target structure" for Social Banking and Financial Health.

Reference: page 84

"Erste Group has the ambition to achieve a net zero status of its portfolio by 2050." In 2024 the Group "developed elements of a transition plan guided by GFANZ," and in 2025 built out its prudential transition plan under the Capital Requirements Directive (CRD VI). "Due to different legal requirements and timing there is currently no intention to develop an overall transition plan fully aligned with a 1.5-degree pathway." The CRD VI plan "focuses on assessing and managing financial risks arising from nature and climate risks, providing strategic direction, including decarbonisation targets and implementation measures."

The plan is described as "fully integrated into Erste Group's overall business strategy and financial planning," with portfolio developments and client progress monitored quarterly and reported "regularly to the Management Board and Supervisory Board." Policies, actions and targets underpinning the plan are detailed in E1-2, E1-3 and E1-4.

Reference: page 80

Back-filled from the "Resilience of the business model" section of E1 SBM-3 (pages 80-83). This disclosure requirement did not exist under the 2023 ESRS the report was prepared against.

Climate risks are classified as physical or transition. The scenario framework uses NGFS-informed pathways: a Central/Baseline scenario ("combining NGFS' Below 2°C and Fragmented World"), an adverse Delayed Transition scenario for transition risk ("strong climate policies... stalled until 2030"), and an adverse Current Policies scenario for physical risk ("Hot House World"). Physical risk also draws on Munich RE hazard data, using "the RCP 8.5 and SSP 5 scenario" for a "highly conservative" downside read. Time horizons: short-term up to 1 year, medium-term 1-5 years, long-term over 5 years (to 2050 transition, 2100 physical).

Scope: sovereigns, financial institutions, corporates, SMEs and real estate for transition risk; real-estate-collateralised loans plus own/outsourced operations for physical risk. Key assumptions include a "(shadow) carbon price" and macro parameters "derived from the regulatory scenarios as well as the economic research department." Performed "in the third quarter of 2025," flagged as using "long-term (up to 30 years) climate and macro-economic projections."

Reference: page 82

Back-filled from the "Resilience of the business model" section of E1 SBM-3 (pages 80-83). This disclosure requirement did not exist under the 2023 ESRS the report was prepared against.

Results: under the adverse Delayed Transition scenario, credit risk shows "notable exposure" to transition-induced losses short/medium term, but "in the long-term, capital position is expected to improve and the risk becomes immaterial." Market, liquidity, strategic and reputational risk show "no material transition risks... across all time horizons." Under Current Policies, physical risk is "a material driver for credit risk across all time horizons," with operational risk material medium/long term (river floods) and strategic risk material long-term (to 2100); market, liquidity and reputational risk show no material physical risk.

On adaptive capacity: "Erste Group maintains the ability to adapt its strategy and business model." Short-term, "robust capital position and stable funding structure" support continued affordable-capital access; medium/long-term the Group can "redeploy its credit portfolio," aided by its decarbonisation strategy and workforce reskilling. A forward-looking WACI table shows financed-loan emissions intensity ranging from 19 tCO2e/EUR million by 2050 under Net Zero 2050 to 203 under Current Policies.

Reference: page 85

Erste Group's climate policies are organised as a table linking each material IRO to a named policy, decarbonisation lever and target. Key policies: the Sustainable Finance Methodology (SFM), the Group Real Estate Financing (REF) Policy, the Group Responsible Financing Policy (RFP) and the Group Corporate Lending Principles (CLP). The RFP "establishes exclusion criteria for financing of the Energy, Defense, Biodiversity and Gaming & Gambling sector[s]" and sets phase-out criteria for carbon-intensive sectors; the REF Policy addresses climate-adaptation risk and opportunity in real estate financing; the SFM defines what counts as sustainable financing toward the 15% retail-mortgage and 25% corporate-financing targets.

Each policy is linked to a named "Key decarbonization lever": promoting a sustainable real estate sector, emission reduction in the energy sector, and client engagement — each in turn mapped to specific 2026/2027 sustainable-financing targets detailed further in E1-4.

Reference: page 90

Four decarbonisation levers, covering "the energy and real estate sectors in Erste Group's portfolio," which "have the highest emissions." The statement is explicit that "the current and future operational and capital expenditures incurred to implement the below actions are immaterial amounts" and that "no actions are in place to provide remedy to individuals harmed by actual material impacts."

"Promoting a sustainable real estate sector" uses two enablers: a Financial Health Commercial Real Estate Tool (screening under way through 2026) and a Renovation Financing/Energy Efficiency Calculator for retail mortgage clients. "Financed emissions reductions in the energy sector" combines renewable energy financing — "renewable energy exposures classified as sustainable financing account for 44% of the total electricity portfolio" — with progressive coal exit: "phasing out coal financing by 2030... with an extension period until 2035 for existing clients" with a credible transition plan. The "Client engagement framework" runs a three-phase process (selection, dialogue, monitoring) via an ESG Assessment Questionnaire, finalised for large corporates in autumn 2025. "Emission reduction in own operations" targets Scope 1/2 through mobility electrification and building efficiency; the statement notes "operational scope 3 emissions represents a significant challenge" as they depend on third parties.

Reference: page 93

Decarbonisation targets are set per sector against baselines, using named methodologies and scenario pathways. Mortgages use an internal model benchmarked against "XDC ITR 2.2°C" (baseline 45.2 kgCO2e/m² in 2024); Commercial real estate uses "XDC ITR 1.7°C." Electricity production uses PACTA benchmarked to "IEA NZE2050," targeting "a 49% reduction in the physical emission intensity of the portfolio by 2030, bringing it down from a 2022 baseline of 357.1 kgCO2e/MWh to 182.7 kgCO2e/MWh." Heat/steam, oil and gas, automotive, iron/steel and cement carry their own sector targets against SBTi/PACTA methodologies.

"As all targets are derived based on the Science-Based Target Initiative (SBTi) and PACTA methodologies, these targets serve as 1.5°C scenario-based benchmarks, except the real estate sectors," calibrated instead to 2.2°C (mortgages) and 1.7°C (CRE) under the XDC model. "In total, to date, the decarbonisation targets have been set for a credit risk volume of EUR 128 billion," 64.3% of financed-emissions volume (2024: 56.9%), covering 40.5% of Scope 1/2 and 17.1% of Scope 1/2/3 financed emissions. Progress is "approved by the Management Board as part of the Group Risk Report." Sustainable financing targets: 15% retail mortgages by 2027, 25% corporate financing by 2026.

Reference: page 103

Energy consumption is tracked at "approximately 2,500 business locations," split fossil/nuclear/renewable using supplier invoice data with national-average fallbacks where invoices are unavailable; the split is "not validated by an external body." Total energy consumption in 2025 was 258,073 MWh (2024: 267,779 MWh), of which the renewable share held at 56% both years. Fossil sources fell from 117,839 MWh (2024) to 113,610 MWh (2025), 44% of the total in both years; nuclear-sourced consumption was 514.8 MWh (0.2% of total) in 2025.

Renewable energy consumption was 141,106.4 MWh in 2025 (2024: 146,634.7 MWh; the 2024 self-generated non-fuel renewable figure "has been corrected from 7,211 to 2,265"). Separately, Erste Group calculates but does not include in E1-5/E1-6 the energy consumption of investment properties it owns but does not operate — "Energy consumption of investment properties falling under scope 1 and 2 was 54,494 MWh" — "as the future treatment and disclosure approach for these assets is being evaluated."

Reference: page 105

Gross location-based Scope 1 GHG emissions were 14,867 tCO2e in 2025 (2024: 16,803; base year 2022: 20,707), a 12% year-on-year fall. Gross location-based Scope 2 emissions rose to 44,462 tCO2e (2024: 42,619; 2022 base year: 44,769), up 4%. Methodologies follow "the GHG Protocol Corporate Accounting and Reporting Standard and the PCAF methodology," and cover both Erste Group's own banking operations (Scope 1, 2, 3) and its financed portfolio (financed Scope 3 emissions), consistent with the IRO-1 description of the 2024-year-end carbon footprint used as DMA input.

Forward-looking best-estimate financed-emissions intensity (WACI, business loans/project finance/corporate bonds) is disclosed under four scenario pathways ranging from 204 tCO2e/EUR million turnover (2026, Net Zero 2050) to 217 (2026, Current Policies), with the 2025 actual WACI falling below the recalculated 2025 estimate of 252, "consistent with declining Scope 1 and 2 financed emissions and intensity."

Reference: page 115

"Within this framework, biodiversity loss is categorised under other-environmental risks. Systemic risks are not treated as a separate risk type, but are indirectly covered when transition and physical risks are assessed based on comprehensive stress testing. Erste Group's own operations and upstream value chain have not been assessed" for biodiversity resilience specifically. Time horizons match the E1 resilience framework (short 0-1 year, medium 2-5 years, long over 5 years to 2050).

"Currently, systematic external stakeholder involvement in the analysis has not yet been established," though ongoing dialogue with regulators, investors, analysts, rating agencies, academic institutions and NGOs fed into the materiality assessment. Results: "Erste Group did not identify any significant threats to its business model or strategy when considering biodiversity and ecosystems-related physical or transition risks with the existing analysis. Systemic risk is not yet analysed." On strategy integration: collateral valuation now examines biodiversity via the Green Building Certificate, and "if violations of environmental protection are identified, the necessary renaturation costs must be taken into account in the valuation."

Reference: page 116

"Erste Group did not yet develop a comprehensive policy to address this sustainability matter." As "a first immediate step, its internal Group Responsible Financing Policy has been complemented by restrictions to finance activities or projects that may impact protected sites or are located within protected areas." The Policy "will not finance any activities with material adverse effect on protected areas," subject to an impact assessment confirming satisfactory mitigation measures.

Governance: first-line control by business units and credit-underwriting teams; second-line control at group level by the Non-Financial Risk function with the ESG function within Credit Risk Portfolio, and locally by local Risk functions. The statement is explicit that "material dependencies, physical and transition as well as systemic risks and opportunities are currently not covered," and that once a methodology exists to measure soil-sealing contribution, Erste Group intends to "develop a strategy, establish more actions and set targets."

Reference: page 117

"Specific actions have not yet been established." The one concrete step taken is the exclusion-criteria extension to the Group Responsible Financing Policy described under E4-2 — "Erste Group has reviewed the scope of its Group Responsible Financing Policy and implemented exclusion criteria regarding activities and construction projects in protected areas as a first step to reduce the identified negative impact." Following the 2025 DMA identification of soil sealing as material, "specific actions to measure progress will be defined in the upcoming years on the basis of a more in-depth analysis."

Reference: page 117

"Erste Group is dedicated to integrating targets to reduce negative impacts on biodiversity and ecosystems into its strategic framework. Specific targets have not yet been established. The identified material impact of soil sealing will trigger more comprehensive disclosures in upcoming years." No target metric, baseline or date is disclosed for FY2025.

Reference: page 117

"Specific metrics related to the identified material impact of soil sealing in Erste Group's real estate portfolio have not yet been established. Erste Group does not disclose biodiversity metrics relating to its own operations, because it has no material impact on biodiversity-sensitive areas." No quantified soil-sealing or land-degradation metric is provided for FY2025.

Reference: page 120

Policies map to three material IROs: gender pay gap (Group Remuneration Policy), training/skills opportunity (Group People & Culture Strategy) and diversity (Group Diversity and Inclusion Policy). The Remuneration Policy "promotes gender equality and equal pay for equal work, thereby creating a secure environment with standardised and adequate wages for all employees regardless of their gender," reviewed at least annually by the Remuneration Committee and covering "all employees of Erste Group and... members of the Supervisory Board... on a consolidated, sub-consolidated and solo level."

The Code of Conduct grounds human-rights commitments in the Universal Declaration of Human Rights, the ILO Declaration and OECD Guidelines, and "upholds all fundamental rights by encouraging freedom of association and collective bargaining, prohibiting any form of forced or child labour, eliminating any form of discrimination." The Group Diversity and Inclusion Policy covers employees of Erste Group Bank AG and its named core-market subsidiaries, defines diversity dimensions (ethnicity, gender, sexual orientation, gender identity, socio-economic status, age, cognitive dimensions), and is approved by the Holding Management Board.

Reference: page 123

Direct engagement channels: annual one-to-one performance reviews; an internal social network ("echo," launched 2024, "20 active group-wide communities" and "more than 300 country- and institute-specific communities" by end-2025); and a group engagement survey. The 2025 survey reached "more than 44,000 people... and more than 36,000 employees... participated, achieving a response rate of 82%," producing "a group-wide Employee Engagement Index score of 80 out of a possible 100 points."

Indirect engagement runs through works councils: in Erste Group Bank AG, "four times a year the works council meets with the Management Board," with statutory consultation rights and a European Works Council agreement covering all EU/EEA-associated operating countries. Vulnerable-group engagement runs through Erste Colours, Erste Ability and the internal social network.

Reference: page 125

Channels to raise concerns: "line manager as the first contact point," the whistleblowing process (Erste Integrity, described under G1-1), works councils, the employee survey, performance reviews, and contact with Anti-Discrimination Officers, ethics managers or ombudspersons. Each core-market entity has locally tailored anti-discrimination processes and instruments — e.g. Austria's Anti-Discrimination Officer, Česká spořitelna's internal ombudsman, Slovenská sporiteľňa's EMUS whistleblower app, Erste Bank Serbia's "HeartCount" tool and Anti-Bullying Counselling Centre.

Remedies can include "access to counselling and support services," "corrective actions, such as policy changes or additional training," and engagement with employees and representatives. The statement notes Erste Group "does not currently conduct formal surveys among employees who have used internal grievance... channels" out of privacy concern, relying instead on individual feedback to designated contacts and monitoring of external escalations, which "occur only in rare cases."

Reference: page 126

Key actions by sub-topic: gender equality uses "Hiring and Succession Planning Standards based on Women Career Index" and a "Gender Pay Gap Analysis" (unadjusted gap calculated for all employees; structural/adjusted analysis covers "more than 80%... of employees"); training and skills uses "skills-based development talks and upskilling" plus AI-literacy training tied to the Group AI Strategy; diversity uses three Employee Resource Groups — Erste Colours (queer employees), Erste Women's Hub (women) and Erste Ability (disability inclusion) — plus discrimination-prevention training such as "Fostering Respectful Interactions" and "Recognizing and Preventing Sexual Harassment."

Effectiveness tracking: the FKi index and gender-representation targets (S1-5) for pay gap; participant numbers, training demand and qualitative feedback for skills; and, for discrimination prevention, an anonymised report from the Austrian Anti-Discrimination Officer to the Management Board, People & Culture and the employees' council. Resources are allocated locally, mainly through People & Culture departments; the AI/skills training coordination involves group and local People & Culture plus Erste Group's Österreichische Sparkassenakademie, "with expenditures amounting to EUR 21.6 million in 2025 (2024: EUR 21.3 million)."

Reference: page 131

"Erste Group sets targets only for gender equality matters" at group level — training hours, part-time share, performance-evaluation coverage and sick days are left to local discretion, tracked instead through the engagement survey. Two targets: minimum 30% underrepresented gender on management boards and minimum 33% on B-1 level by 2028, both benchmarked to 2022 baselines (28% share of women in top-management) and monitored quarterly by the Group Diversity team.

2025 progress by entity (management board / B-1 share): Erste Group Bank AG 20.0% / 33.3%; Erste Bank Oesterreich 66.7% / 37.0%; Erste Bank Hungary 16.7% / 31.3%; Česká spořitelna 16.7% / 26.2%; Slovenská sporiteľňa 0.0% / 32.0%; Banca Comercială Română 60.0% / 26.1%; Erste Bank Croatia 20.0% / 40.9%; Erste Bank Serbia 50.0% / 52.2%. The statement notes "Slovenská sporiteľňa needs to catch up in both... management board and board-1 in the following years," while other banks are on track or already at target.

Reference: page 132

Total headcount at 31 December 2025: 49,024 (2024: 49,094). By gender: 30,244 female, 18,780 male, 0 other/not reported. By geography: Austria 20,111 (largest), followed by Czechia 10,097, Romania 5,158, Hungary 3,603, Slovakia 3,647, Croatia 3,102, Serbia 1,292, and smaller counts in North Macedonia, Bosnia and Herzegovina, Slovenia, Montenegro and Poland.

Contract mix (2025): 45,751 permanent, 3,046 temporary, 227 non-guaranteed-hours (a new Slovak category from 2025); 40,619 full-time, 8,178 part-time. Turnover: 5,686 new hires and 6,070 leavers in 2025, "a turnover ratio of 12.3% (2024: 12.2%)," excluding parental leave and internal transfers.

Reference: page 133

"In addition to own employees, there are 3,469 (2024: 3,104) non-employee workers (headcount as of 31.12.25), which are either self-employed individuals (1,031; 2024: 1,099) or individuals contracted through a third party engaged in employment activity (2,438; 2024: 2,005)." Non-employees are engaged for a defined contract period, and "employment contracts take precedence over non-employees agreements" where both apply.

Reference: page 134

Top-management gender split (B0 Management Board plus B-1 direct reports across Erste Group Bank AG and named core-market subsidiaries): 124 female / 363 male in 2025 (25% / 75%), essentially unchanged from 2024's 128/374. The year-on-year headcount decline (502 to 487) reflects consolidation of mirror B-1 positions held by one individual across two legal entities.

Age distribution (2025): under 30, 8,112 (16.5%); 30-50, 27,102 (55.3%, down from 57.5% in 2024); over 50, 13,810 (28.2%, up from 26.0%).

Reference: page 134

Using the UN Convention on the Rights of Persons with Disabilities definition, "Erste Group employs 651 (2024: 643) employees with health disability (disability above 50% or equivalent severity grade) as of 31 December 2025 which represents 1.3% (2024: 1.3%) of the total headcount."

Reference: page 135

Average training hours per headcount, 2025: 39.5 overall (2024: 39.4); 40.8 for women (2024: 40.1), 37.4 for men (2024: 38.2); 43.8 for management functions (2024: 43.5), 39.0 for non-management. "There is no targeted value on the group level, as for each entity the optimal number of trainings hour might be different."

Performance-review coverage: "appraisal talks were held with 88.7% (2024: 87.9%) of all employees," and "the proportion of reviews to the foreseen number of reviews by Erste Group's local internal procedure is 98.9% (2024: 97.1%)" — reviews are not foreseen for every employee, e.g. new joiners mid-year or where reviews are mandatory only for bonus-eligible staff.

Reference: page 135

Erste Group holds "a Fair Pay Analyst certification from the Fair Pay Innovation Lab," with its methodology recognised as an EU trademark. The unadjusted group-wide gender pay gap for 2025 was 27.7% (2024: 28.9%), weighted across country results by headcount; by country it ranged from 19.8% (Slovenia) to 51.7% (Poland). Structural analysis of 38,726 employees (2024: 38,195) found an average global gap of 25.9% (2024: 26.8%), narrowing to an adjusted gap — controlling for job level, age, management responsibility and local factors — of 2.1% (2024: 2.5%): "the unadjusted pay gap is driven by job levelling."

The remuneration ratio (CEO total pay versus median employee total pay, full-time equivalent, including estimated bonus) was 70.8 in 2025 (2024: 67.5). For 3% of employees, salaries used for the ratio "were interpolated according to the salary distribution of the rest of the workforce."

Reference: page 137

"There have been in total 28 (2024: 26) reported incidents of discrimination." The company received "156 (2024: 160) total complaints from its workforce regarding various topics related to unacceptable behavior, discrimination, termination of employment and entitlements and workplace management, thereof 56 (2024: 84) in Česka spořitelna" — the Czech-entity drop reflects "a methodology alignment with Erste Group Bank AG, so that it now relates only to complaints to its own workforce."

"In both 2025 and 2024, there have been no fines, penalties, or compensation for damages resulting from incidents of discrimination and complaints or relating to severe human rights issues or incidents connected to the company's own workforce. No incidents related to human rights have been reported in either 2025 and 2024."

Reference: page 138

Social Banking policy centres on the Social Banking Strategy: "an aspect of Erste Group's strategy and business model is to provide financial services to socially vulnerable people, small enterprises and social organisations..., including those who would otherwise be excluded from access to financial services." The strategy is described as tracing back to "one of the founding ideas of Erste Oesterreichische Spar-Casse," with policy instruments including microfinancing, the Time Bank volunteering portal, FLiP (Erste Financial Life Park) financial education and financial literacy workshops.

Actions and targets tied to this policy are detailed in S3-4 and S3-5; Erste Group also engages social organisations, including membership of the Social Entrepreneurship Network Austria (SENA).

Reference: page 139

Indirect engagement runs through "social organisations such as NGOs and social enterprises," including the High-Impact Enterprises Scaling Programme ("Marc," launched 2024) providing "mentoring, training and technical support" to social enterprises. Direct engagement uses "advisory and mentoring sessions in branches and online" plus financial-education and readiness programmes.

Effectiveness is tracked through a biennial Social Banking Impact Report with ex-post client surveys — "the 2025 assessment included 1,266 (1,190 in the 2023 Impact Report) client interviews," which "influences product design, risk management and strategic priorities" and directly led to the Marc programme after "identified gaps in business know-how."

Reference: page 140

Key actions map to a named policy: Social organisations and Microfinancing (Social Banking Strategy), Time Bank (no dedicated policy), FLiP (Policy Framework) and Financial Literacy Workshops (Social Banking Strategy). Social organisation lending is backed by "portfolio guarantees from the European Investment Fund (EIF) under the InvestEU Programme" and a complementary ERSTE Foundation guarantee. Microfinancing includes "Der Mikrokredit" in Austria and country programmes in Slovakia, Romania, Croatia (BCR Social Finance) and Serbia ("Naše selo").

FLiP has run since October 2016 and became "a non-profit limited liability company and a wholly owned subsidiary of Erste Social Finance Holding GmbH" in April 2023, with six social-franchise partners by 2025 and new locations opened in Graz and Klagenfurt. 2025 reach: "more than 109,000 (96,000 in 2024) visitors" to the Vienna tours, "more than 55,000 (44,000 in 2024) visitors" via the FLiP2Go mobile version, and 45,000 app sessions (2024: 20,648); the FLiP app won the 2025 eAward. Financial literacy workshops run in Croatia, Romania, Slovakia (FinQ, active since 2019) and Serbia (the Money School, with Zbor HUBs launched in Romania in 2025).

Reference: page 142

Three tracked metrics against 2017 baselines and 2025/2030 targets: social banking financing reached EUR 814 million cumulative in 2025 against a "Target 2025" of EUR 650 million (Target 2030: EUR 1,000 million); education support participants reached 111 thousand cumulative (Target 2030: 80 thousand — already exceeded); job creation and retention reached 110 thousand cumulative (Target 2030: 200 thousand).

2025 yearly performance: EUR 101.4 million in new social banking financing across 2,208 new clients, split EUR 53.4 million/1,712 clients microfinance and startup finance and EUR 44.6 million/182 clients social-organisation finance; 20,930 education-support participants in the year; a separate FLiP target of 15,000 annual visitors was "exceeded with over 17,000 visitors," and the FLiP app's 20,000-session target was exceeded more than twofold at over 45,000 sessions. Job/preserved-job figures are estimated biennially via client survey, since "this data is only collected once every two years."

Reference: page 144

Two material IROs each map to named policies: Financial health (entity specific) to the Social Banking Strategy and the Zweite Sparkasse Strategy; Privacy to the Group Security Strategy, Group Data Protection Policy and Group Cybersecurity Policy. Zweite Sparkasse is "a fully-fledged Austrian credit institution" whose strategy targets people without access to regular banking.

On privacy, "the right to data protection is enshrined in the EU Charter of Fundamental Rights," and the Group Security Strategy sets five principles: security by design, striving simplicity, data-driven security, risk integration and customer orientation, "approved by the Management Board and aligned with regulatory standards, specifically... GDPR." Supporting procedures cover data-controller responsibility, the Data Protection Officer's role, data-processing legitimacy, and transparency/data-subject rights. The Cyber Security Policy, reviewed annually, is overseen by the Group Chief Information Security Officer (Group CISO) and covers DORA alignment.

Reference: page 146

Financial health engagement runs through the same biennial Social Banking Impact Report as S3-2 — "the 2025 impact report included 158 (162 in the 2023 impact report) client interviews with individuals in financial difficulty" — overseen by Group Social Banking. Privacy engagement is different in kind: "Erste Group does not directly engage with its customer base for insight into an already heavily regulated process," since GDPR compliance applies uniformly to all customers regardless of background.

Reference: page 147

Data breaches ("breaches of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data") are assessed by expert teams "using an internally developed data breach risk assessment tool, based on the methodology provided by the European Union Agency for Cybersecurity." Remedies range "from deleting data to changing passwords" to refresher training and disciplinary measures. Complaints reach Erste Group through a 24/7 Contact Centre, online channels, or anonymously via the whistleblowing platform; "in 2025 0.28% (0.33% in 2024) of group customer complaints were related to privacy matters."

Reference: page 147

Financial health actions: specialised accounts, housing microloans and education loans for financially vulnerable individuals (study loans in Romania and Austria; housing programmes in several countries); debt counselling (e.g. Slovenská sporiteľňa's low-income household support). Impact: "In 2025 the results found that 83% of clients were now able to pay their debt obligations on time as a result of Erste Group's support," from a 158-client survey. Zweite Sparkasse reintegrates customers "into organised economic conditions" via partner social organisations that determine eligibility, tracked by new-client counts (see S4-5). The "she invests" programme addresses gender gaps in financial literacy with roughly 1,000 participants annually.

Privacy actions: multi-layer cyber defences (firewalls, DDoS protection, EDR, threat intelligence, SOC, IPS); a Control Framework with local self-assessment and group-level approval; public awareness campaigns run with the Federal Ministry of Interior, Payment Services Austria, Austrian Post and Watchlist Internet. "In 2025, Erste Group spending on the topic of cybersecurity totalled EUR 67.83 million (2024: EUR 59.68 million)." Mandatory annual cybersecurity awareness training reached a 98.9% participation rate (2024: 97%). "In 2025 there were no incidents of severe human rights abuses towards the Group's retail customer base."

Reference: page 149

Zweite Sparkasse target: "an increase in 1,000 new clients for each subsequent year," set in 2024; "Zweite Sparkasse reported 1,794 new clients in 2025, exceeding the target by a significant amount." Financing to private individuals in financial difficulty is disclosed as a sub-component of the total Social Banking financing target reported under S3-5.

Reference: page 152

Governed by the Code of Conduct, embedding "core values of people, fairness and transparency" and five leadership dimensions (out of comfort zone, servant leadership, performance impact, future orientation, client orientation). Two named policies address the two material G1 IROs: the Group Risk Policy Whistleblowing (protection of whistleblowers) and the Policy on Conflict of Interest and Anti-Bribery and Corruption (corruption/bribery prevention).

Whistleblowing: grounded in "EU Directive 2019/1937, the Austrian Whistleblower Protection Act and the Austrian Banking Act §99g," with channels including an internet portal, mail, telephone and personal meetings, open to employees and third parties. The "Erste Integrity" reporting office sits under the CRO division's Non-Financial Risk function, providing "anonymity protection, protection of involved individuals and protection against false accusations." Anti-bribery/corruption: the mandatory web-based training (CoI/ABC WBT), repeated every two years, "must" achieve "a knowledge test with a rate of at least 80%"; additional targeted training applies to Management Board members and staff in sales, sponsorship, cooperation, donations and marketing.

Reference: page 153

Suspected internal fraud involving bribery/corruption triggers a thorough Internal Audit review, alongside investigation by the Conduct Compliance department under a "3-Lines-of-Defense Model," reporting to the Management Board and Supervisory Board. Group Anti-Financial Crime runs mandatory fraud-prevention training covering red flags, prevention and reporting, delivered on-site monthly for new joiners and via a biennial web-based module for all staff.

The Policy on CoI and ABC was rolled out to "over 90 entities within the Erste Group and the Austrian savings banks sector," with a revised second version implemented at end-2024, strengthening rules on political mandates as secondary occupations and on donations/sponsorships to political parties; full rollout of the revised HV-Rulebook completes in early 2026. Training coverage in 2025: 90.4% of staff at-risk functions (2024: 92.4%) and 69.2% of management-body members (2024: 73.6%), the latter drop attributed to "the technical infrastructure of the e-learning platform, assignment dates and logic, escalation processes."

Reference: page 154

Back-filled from G1-1, G1-3 and G1-4 (pages 152-155). This is a 2023-ESRS-prepared statement, and standalone G1-3 Targets did not exist as a numbered requirement under the 2023 ESRS; business-conduct targets fell under MDR-T, whose second limb is a description of how effectiveness is tracked in the absence of a formal target. Erste Group does not state a numeric target for corruption/bribery prevention or whistleblower protection, but it discloses ongoing effectiveness tracking: "Group Conduct Compliance monitors the completion of e-learning modules," with year-over-year training-coverage figures reported (staff at-risk 90.4% in 2025 vs 92.4% in 2024; management bodies 69.2% vs 73.6%), and "the progress of these actions is monitored through evaluations of the web-based training, data analysis of the reporting tool, checks and risk assessments."

A new regulatory training framework, RegONE, was introduced in 2025 to standardise "the entire lifecycle of regulatory training... including an escalation logic for non-completion," beginning rollout in Austria — itself evidence of a tracked, evolving control rather than a static disclosure.

Reference: page 155

"There have been zero convictions for violations of anti-corruption and anti-bribery laws and the amount of fines for such violations is zero in 2025. This mirrors the situation from the previous year, where both convictions and fines were also zero (2024: zero)." Key action: ongoing training programmes to prevent and detect corruption and bribery under the Policy on CoI and ABC (detailed in G1-1/G1-3), plus a group-wide compliance platform "in progress" to centralise knowledge sharing on conflicts of interest and related policy resources.

Reference: page 155

2025 advocacy priorities: "the creation of a strong Savings and Investments Union, increasing the EU's and CEE region's competitiveness as well as fostering domestic policies that are conducive for the economy." Material-topic-linked advocacy: climate change mitigation/energy ("a well-balanced simplification agenda... in the context of CSRD/CSDDD"), financial health (the Commission's Savings and Investment Accounts recommendation) and gender equality (input on the EU Pay Transparency Directive).

"Erste Group Bank AG and Erste Bank der oesterreichischen Sparkassen AG do not provide donations to political parties (or their sub-organizations), candidates, active politicians with political mandates at all levels, party-political action committees or for party-political causes." Memberships include the Institute of International Finance, Eurofi, the Austrian Federal Economic Chamber, the Federation of Austrian Industries and the Austrian Savings Banks Association. Erste Group is registered in the Austrian Lobbying and Advocacy Register (LIVR-00179) and the EU Transparency Register (910859715397-14). "Among the Supervisory Board members newly appointed during the reporting period, one member had held a position in public administration within the two years preceding their appointment."