Finecobank Banca Fineco Spa

Reference: pages 104-109 (Section 1.2.1, GOV-1 and G1-GOV-1)

The Board of Directors approves the code of ethics and code of conduct, defines the risk level compatible with strategy, and annually assesses and approves the list of relevant sustainability topics and their impacts, risks and opportunities (IROs), after review by the Corporate Governance and Environmental and Social Sustainability Committee (p.105). The Board has 11 members (6 women, 5 men; 55% / 45%), of whom 91% are independent. Of the 11 directors, 10 declared sustainability skills (p.104). Committee mandates are set out on pp.106-108: Corporate Governance and Environmental and Social Sustainability Committee (3 independent non-executives), Risk and Related Parties Committee (5), Appointments Committee (3), Remuneration Committee (3). The Board of Statutory Auditors (5 members) supervises sustainability reporting certification and has assessed that it collectively understands the main impacts, risks and opportunities, climate and environmental risks included (p.109). Management oversight runs through the Sustainability Management Committee and, from 2025, an ESG Working Group of departmental ESG Ambassadors (pp.105-106). Employee representatives hold no seat on the bodies (p.104).

Reference: pages 109-110 (Section 1.2.2, GOV-2)

The administrative, management and supervisory bodies are informed about IROs through the Corporate Governance and Environmental and Social Sustainability Committee and the Risk and Related Parties Committee, which normally meet monthly before the Board meeting. The Chairman of the Sustainability Committee briefs the Board on the main ESG issues at each Board meeting, and the Sustainability department reports trends in key ESG metrics so the Board can monitor the effectiveness of policies and actions (p.109). In 2025 the Risk and Related Parties Committee reviewed all relevant risks from the Double Materiality Assessment, the Sustainability Committee and the Board examined all material IROs, and the Board approved the Double Materiality Assessment outcomes in July 2025 (p.110). From the first half of 2025 the Group formalized a monitoring system tracking how often material topics and their IROs are addressed by the Committees, the Board of Statutory Auditors and the Board (p.110).

Reference: pages 110-111 (Section 1.2.3, GOV-3 and E1-GOV-3)

Incentive schemes link to objectives in the Multi-Year Plan ESG 2024-2026 (MYP ESG). The 2025 short-term scheme for the CEO and General Manager and other most relevant personnel carries sustainability objectives under 'Stakeholder Value' and 'Tone from the top', weighted 10% each of the target sheet: at least 50% of new platform funds with a Fineco ESG rating of 6 or more, a customer satisfaction score of 90 or more, maintaining EMAS registration, and sustainability behaviors (p.110). The Long-Term Incentive Plan 2024-2026 carries sustainability targets weighted 15% of the variable part: reducing Scope 1 and 2 (market-based) emissions by at least 55% by 2026 against the 2021 baseline (5% of the final bonus), Diversity, Equity & Inclusion objectives, and new Article 8 and 9 funds (p.111). Incentives are approved by the Board on the Remuneration Committee's favorable opinion and put to a binding Shareholders' Meeting vote (p.110).

Reference: pages 111-114 (Section 1.2.4, GOV-4)

The Group states that its due diligence "is not an autonomous and formalised procedure but is fully integrated into the Group's strategic framework and business model" (p.111). The section maps the five core elements of due diligence to report sections in a table (pp.111-114): embedding due diligence in governance, strategy and business model (GOV-1 to GOV-3, SBM-1, SBM-3); engaging stakeholders (GOV-2, SBM-2, IRO-1, E1-2, S1-1, S1-2, S4-1, S4-2, G1-1); identifying and assessing adverse impacts (IRO-1 and the E1 to E5 IRO-1 sub-sections); taking actions (E1-3, E5-2, S1-4, S4-4, E1-1, S1-3, S4-3); and tracking effectiveness (responsible finance and innovation targets in Sections 5.1.3, 5.1.4 and 5.2.2, E1-4 to E1-6, E5-3, E5-4, S1-5 to S1-17, S4-5, G1-3, G1-4).

Reference: pages 114-115 (Section 1.2.5, GOV-5)

The internal control system for sustainability reporting follows a common framework inspired by the CoSO Framework, covering company-level controls, an administrative and accounting model, periodic control testing and IT general controls (COBIT, ISO/IEC 27001) (p.114). An internal attestation flow gives managerial responsibility for first-level controls to the structures of the Parent Company and subsidiary, with the Manager in charge of financial reporting and the delegated Board member reporting on the system's status (p.114). Risk assessment uses five 'Sustainability Assertions': Relevance, Faithful Representation, Comparability, Verifiability and Comprehensibility. The main risks identified are consistency and completeness of the reporting perimeter, completeness and accuracy of the double materiality analysis, incorrect representation of the value chain, and completeness and integrity of the data (p.115). Results are shared with the Risk and Related Parties Committee, the Internal Control Business Committee, the 231/2001 Supervisory Board, the Board of Directors and, quarterly, the Board of Statutory Auditors (p.115).

Reference: pages 116-120 (Section 1.3.1, SBM-1)

FinecoBank describes itself as "one of the most important FinTech banks in Europe" with one of the largest financial advisory networks (p.116). At 31 December 2025 the Group had 1,529 employees (1,435 in Italy, 94 in Ireland), 445 Fineco Centers, 3,076 financial advisors and 1.800 million customers, 98% of them natural persons (p.116). The business model has three product areas: Banking, Investing and Brokerage; Fineco Asset Management DAC (Dublin) manages in-house funds (p.116). The Group states it is not active in fossil fuels, chemical production, controversial weapons or tobacco (p.117). The strategy is anchored in the Multi-Year Plan ESG 2024-2026 (p.117-118). The value chain, mapped per EFRAG IG2, covers upstream (customers as funding source, bank counterparts, suppliers, shareholders), own operations (employees and personal financial advisors) and downstream actors (customers, local communities) (pp.118-119). Supplier management uses an ESG questionnaire since 2021 and, from 2025, a supplier register with ESG data (pp.119-120).

Reference: pages 120-121 (Section 1.3.2, SBM-2, S1-SBM-2 and S4-SBM-2)

For the 2025 Double Materiality Analysis the Group engaged three stakeholder groups directly: employees (two ESG training days with surveys at both FinecoBank offices, plus a sample at Fineco AM), customers (surveys) and the financial community (a sample of key investors interviewed one-to-one). Management gave its assessment through the Sustainability Management Committee (p.120). Financial advisors were not directly engaged in 2025; the Group used the results of their 2024 engagement (p.120). Assessments are presented to internal committees and the Sustainability Management Committee and then approved by the Board (p.120). Outside the DMA, engagement runs through investor meetings, customer care and similar channels; in 2025 the Group recorded 743 interactions with institutional investors, 21 of them on ESG issues (p.121).

Reference: pages 122-133 (Section 1.3.3, SBM-3, including S1-SBM-3 and S4-SBM-3)

The 2025 Double Materiality Analysis identified seven material sustainability topics, down from nine in 2024 after the Group merged duplicates: Climate change, Use of resources and circular economy, Own workforce (employees and financial advisors), Consumers and end-users, Business conduct, and two entity-specific topics, Responsible finance and financial education, and Innovation (pp.122-127, 131). The IRO table (pp.123-127) lists, for example, positive climate impacts from energy efficiency and investment in counterparties with net-zero commitments, and negative impacts from operational and financed air emissions and energy consumption (p.123). Material risks are all social: conduct risk (34% of operational losses at 31 December 2025), ICT and security risk and greenwashing risk (p.128). Current financial effects are tabulated for six social risks, for example misselling EUR 1.4m on financial position and EUR -1.7m on performance (pp.129-130). For expected financial effects the Group applied the phase-in under Delegated Regulation (EU) 2025/1416 (p.129). Resilience is assessed through the ICAAP/ILAAP and the ECB's SREP, concluded on 28 October 2025 (p.130).

Reference: pages 134-139 (Section 1.4.1, IRO-1, with E1-IRO-1 to G1-IRO-1)

The Group followed EFRAG IG1 in three steps: context analysis and IRO identification, stakeholder engagement, and consolidation. Impacts are scored on severity, scope, irremediable character (negative impacts only) and likelihood, giving a synthetic score from 1 to 16. A materiality threshold was set from the score distribution and approved by the Board in July 2025 (pp.134-135). Risks and opportunities are scored on magnitude and likelihood, also on a 1-to-16 scale (p.136). Sustainability risks are assessed in the annual risk inventory, in a separate 'ESG Risk Deep Dive', and feed the Risk Appetite Framework (p.136-137). Inputs include the 2024 sustainability statement, EFRAG IG1, GRI Financial Services Sector Supplement, S&P and CDP questionnaires (p.137). The process had no significant changes versus 2024 (p.137). For other environmental topics the Group relied on its EMAS-certified environmental analysis, which found significant impacts only in energy consumption and atmospheric emissions (pp.138-139). ESRS 1 para 119 incorporation by reference was used only for E1-IRO-1 (p.103).

Reference: pages 139-151 (Section 1.4.2, IRO-2)

The report prints an ESRS content index (pp.139-150) with three columns: the disclosure requirement, the EU-legislation datapoints (SFDR, Pillar 3, Benchmark Regulation, Climate Law) and the location in the report. It states the table shows "the disclosure requirements the Group has fulfilled" and those "the Group has assessed as not material" (p.139). Disclosure requirements marked "Not material" in the index include E1-9, E2-4, E3-1, E3-4, E4 (SBM-3 and E4-2), E5-5, S2-1, S2-4 and S3-1 to S3-5 (pp.143-149); E1-7 and some E1-5 datapoints are marked N/A (pp.142-143). Entity-specific topics 'Responsible Finance and Financial Education' and 'Innovation' are indexed to Sections 1.2-1.4, 5.1 and 5.2 (p.150). The Group states that all requirements for material topics were reported except voluntary information and phase-in information, and that conditional requirements are reported only when their conditions occur (p.151).

Reference: pages 155-156 (Section 2.2.1, E1-1)

"The Group has adopted a climate change mitigation transition plan": the Net-Zero Emissions Commitment by 2050, approved by the Board in August 2022, updated in March 2023 and tightened in the Multi-Year Plan ESG 2024-2026 (p.155). It sets: Scope 1 and 2 (market-based) emissions down 55% by 2026 against a 2021 baseline; Scope 3 operational emissions down 20% by 2030; a 90% overall cut by 2050 with residual emissions neutralized through certified carbon credits; and 95% of sovereign and bank debt-security exposure to issuers with a net-zero target by 2030 and 100% by 2050 (p.155). Targets reference the SBTi Corporate Net-Zero Standard and the SBTi financial-sector guidance (p.155). The plan is part of the MYP ESG 2024-2026 and the investment plan carries an ESG portfolio section (p.156). The Group states it is not excluded from EU Paris-aligned benchmarks and that there are no potential locked-in emissions, as it has no fossil-fuel exposures and its target assets are bank and sovereign debt, not corporate loans (p.156). Progress is reported in Section 2.2.3.

Reference: pages 138, 494-498

Back-filled from ESRS 2 E1-IRO-1 (pp.137-138), which the report incorporates by reference to the Part E notes on climate and environmental risks (pp.494-498; see p.103 and p.138). This disclosure requirement did not exist under the 2023 ESRS the report was prepared against.

The Group classifies climate risk as physical (acute and chronic) or transition (pp.494, 496-498). It identifies vulnerabilities such as damage to the Milan registered office and data processing centers, a fall in value of mortgage collateral (average loan-to-value about 43%), and customers moving to rivals with better ESG products (pp.496-498). It states it "does not directly rely on high-emission climate scenarios" because they "would not adequately capture the specific vulnerabilities of its business model" (p.138), and that transition-risk assessment "is not based on the analysis of climate-related scenarios" (p.498). Instead it runs ICAAP stress tests (p.138). Horizons: short term one year, medium term two to five years, long term six to ten years (p.497).

Climate-specific risk identification is also presented under E1-2 (2025 ESRS numbering).

Reference: pages 130, 138, 496-498

Back-filled from ESRS 2 SBM-3 (p.130) and the E1-IRO-1 text (p.138). This disclosure requirement did not exist under the 2023 ESRS the report was prepared against.

The report gives no standalone climate resilience analysis. SBM-3 states that resilience of strategy and business model to material risks "is ensured by the Supervisory Review Process", meaning the ICAAP and ILAAP run by the Group and the ECB's SREP; the SREP 2025 process concluded on 28 October 2025 (p.130). It states its exposure to climate and environmental risk "is limited due to the intrinsic characteristics of its business model" and that specific stress tests were run in the ICAAP for the most significant vulnerabilities (p.138). The ICAAP stress tests cut the value of mortgage collateral in high-risk areas, and a transition scenario shifting clients from Article 6 to Article 8 and 9 funds produced impacts it calls immaterial (pp.497-498). The Part E notes add that the Group keeps marginal exposure to physical risk through its Risk Appetite Framework (p.495).

Climate resilience is also presented under E1-3 (2025 ESRS numbering).

Reference: pages 156-159 (Section 2.2.2, E1-2)

The policies address five material climate impacts: promoting energy efficiency and renewable energy (actual positive), contributing to the transition through net-zero-committed sovereign and bank counterparties (actual positive), energy consumption, operational emissions including value chain, and financed emissions (all actual negative) (p.156). Named policies: Code of Ethics (environmental compliance, p.156); Global Environmental Policy, in place since 2020 and updated in 2024, applying to all activities and the value chain (p.157); Global Policy on Sustainability, updated in 2025 for the CSRD (p.157); Global Policy on reducing energy consumption and natural resources, updated in 2025, with an Energy Manager (p.157); a circular on winter heating set-points (p.158); and a company-car policy under which only electric or hybrid cars can be ordered (p.158). Operational measures include closing most of the Milan registered office on Mondays and Fridays in 2025, a Home-Work Travel Plan and a sustainable mobility portal (p.158).

Reference: pages 159-160 (Section 2.2.3, E1-3)

Actions sit within the MYP ESG 2024-2026 and the Net-Zero Commitment (p.159). Actions reported in a table by decarbonization lever: (1) aligning the internal investment portfolio, with securities aligned to net-zero targets at 99.6% at end-2025 (99.4% in 2024), already above the 95% target for 2030; (2) supply-chain decarbonization through renovating the Milan hot and cold fluid plant, replacing gas boilers with multi-purpose electric heat pumps; (3) energy efficiency, adding about 50 desks in occupied Milan offices to avoid heating unused space; (4) renewable energy, completing 7 more charging stations for a total of 15 (13 Milan, 2 Reggio Emilia), with Milan electricity 100% renewable (pp.159-160). Resources: the refurbishment used EUR 2.2 million CapEx, and the Group says other 2025 initiatives involved no significant CapEx or OpEx (p.160). It notes the Scope 1 and 2 actions depend on budgeted plant renewal (p.159).

Reference: pages 155, 159-160 (Section 2.2.3, E1-4)

Targets: Scope 1 and 2 (market-based) -55% by 2026 and -90% by 2050 against 2021; Scope 3 (categories 1 paper, 8 and 14) -20% by 2030 and -90% by 2050 against 2021; and 95% of sovereign and bank debt securities with a net-zero target by 2030, 100% by 2050 (pp.155, 160). Base year 2021, chosen as the most representative year less affected by the pandemic (p.159). Scope 1 and 2 targets cover all emissions in those scopes, and Scope 3 targets cover the three categories named (p.159). Progress at end-2025: Scope 1 and 2 (market-based) 227 tCO2e against a 410 tCO2e baseline, down 45%; covered Scope 3 emissions 1,140 tCO2e against 1,336 tCO2e, down 15% (p.160). Targets sit in the EMAS Environmental Program and are externally verified yearly (p.159). Asset-alignment targets reference a 1.5 degree scenario (p.159).

Reference: pages 161-163 (Section 2.2.4, E1-5)

Total internal energy consumption was 4,774 MWh in 2025 (4,283 MWh in 2024): direct 1,148 MWh (natural gas 595, car fleet fuel 377, photovoltaics 176) and indirect electricity 3,626 MWh (p.161). Energy mix 2025: fossil sources 972 MWh (20%), renewable 3,802 MWh (80%); in 2024 fossil was 29% and renewable 71% (p.162). Electricity purchased is 100% renewable with guarantees of origin, and gas consumption is offset 100% through VER credits (p.161). External energy consumption outside operational control totalled 7,246 MWh, including 2,461 MWh at data processing centers (p.163). The report states that energy for the 376 Fineco Centers with utilities in advisors' names is estimated from the 69 centers in the Bank's name, and that Reggio Emilia and Dublin figures rely on landlord data (p.162). Photovoltaic output was 188 MWh (p.162). The index marks high-climate-impact sector datapoints N/A (p.142).

Reference: pages 163-167 (Section 2.2.5, E1-6)

2025 gross GHG emissions: Scope 1 227 tCO2e (285 in 2024); Scope 2 location-based 936 tCO2e, market-based 0 (100% guarantees of origin); Scope 3 3,586,790 tCO2e (3,162,921 in 2024); total 3,587,953 tCO2e location-based and 3,587,017 market-based; intensity 1.64 tCO2e per EUR thousand of net revenue (p.166). Category 15 Investments is 3,584,823 tCO2e, almost all of Scope 3: sovereign debt securities 3,518,835, mortgages 50,009, bank-issued debt 15,978 (p.166). Other categories: purchased goods 57, capital goods 74, business travel 229, employee commuting 525, leased assets 415, franchising 668 (p.166). Methods follow the GHG Protocol and the PCAF financial-industry standard, with ABI Guidelines emission factors (p.163). Only 0.5% of Scope 3 uses primary data (p.166). 2024 categories 1 and 2 were restated (paper emissions 73 tCO2e rather than 20) (p.102). Counterparty Scope 3 of 18,315,627 tCO2e is reported separately (p.165, note 45).

Reference: pages 168-169 (Section 2.3.1, E5-1)

The policies address the one material E5 impact, "Consumption of materials for inbound operational activities (e.g., paper, toner)", described as current and negative (p.168). Named instruments: the Global Operational Regulation on defining and disseminating the Group Environmental Policy, updated in 2025 for the CSRD (p.168); the EMAS-registered Environmental Management System, held since 2022 (registration IT-002166, valid to 19 June 2027), with the CFO as Management Representative; Fineco AM is outside EMAS scope (p.168). The Environmental Policy is implemented through projects on sustainable sourcing, less virgin material and more recycled content (p.169). The Group Sustainability Policy and the Energy and Resource Consumption Reduction Policy also apply (p.169). EMAS program progress is reviewed quarterly by the Sustainability Management Committee and the board Sustainability Committee, and 376 internal environmental audits ran from September 2020 to end-2025 (p.169).

Reference: pages 169-173 (Section 2.3.2, E5-2)

Actions sit in the MYP ESG 2024-2026 and the EMAS program. Listed actions with 2025 status (pp.170-171): replacing plastic payment cards with recycled PVC cards (468,452 issued or replaced in 2024 and 2025; 24% of a 1,928,313 card stock); digitizing paper-based processes, including digital signature for non-account holders and post-sale overdrafts (analysis stage); environmental audits of global service providers for Fineco Centers (6 of 9 audited); selecting more sustainable materials, with 384 third-party-certified products bought through the Fineco Shop in 2025; and an energy-saving screen saver launched 26 November 2025. Existing digital signature tools save around 90 tonnes of paper in 2025 (p.173). Among 21 Financial Shops opened in 2025, 9 applied both reuse criteria of the environmental design guidelines (p.173). The report states no significant CapEx or OpEx were needed for these actions in 2025 (p.169).

Reference: pages 169-172 (Section 2.3.2, E5-3)

The report states "all targets included in the table below are voluntary and have been defined in 2023", all tied to the 'Resource Inflows' sub-topic, with progress reviewed quarterly by the Sustainability Management Committee and the board Sustainability Committee (p.169). Targets and 2025 progress (pp.170-171): replace at least 50% of plastic payment cards with recycled PVC by 2026 (0% in 2023, 24% in 2025); reach a ratio of paper documents to total documents of 1/7 by 2026 (2/7 in 2023, 1.2/7 in 2025); 90% digitization of documents in non-account-holder signatures and post-sale overdrafts by 2026 (0% so far); audit 100% of Fineco Center global service companies by 2026 (6 audited in 2025 against a 2023 base of 0); measure sustainable-material selection from 2024; and energy-saving screen savers by 2025 (pp.170-172). Each target is marked with its waste-hierarchy layer, such as Prevention or Disposal (p.170).

Reference: pages 174-175 (Section 2.3.3, E5-4)

Material inflows are paper, toner and IT devices (p.174). Office paper used in 2025 was 42,221 kg (54,847 kg in 2024): FinecoBank 3,744 kg, Fineco AM 392 kg and Fineco Centers 38,085 kg (p.174). FSC-certified paper was 45% (35% in 2024) and EU Ecolabel paper 68% (76%); at the Milan and Reggio Emilia offices 100% of paper has both labels (p.174). Fineco Center consumption is estimated from a sample of 80 of 445 centers with an 84% response rate (p.174, note 52). Total materials used were 42,279 kg, including 53 kg of toner at FinecoBank and 5 kg at Fineco AM (p.175). The report did not disclose the recycled-content share because the data were insufficient in quantity and quality, citing ESRS 1 Appendix B; Group-level paper of 3,794 kg is 100% non-recycled, while the Network's recycled share is "neither available nor estimable" (p.175, note 53).

Reference: pages 176-187 (Section 3.1.1, S1-1)

The own workforce covers employees and the network of financial advisors, who are non-employees acting under an agency agreement (p.176). Policies address the material workforce impacts and the opportunity of retaining and attracting advisors (p.176). Named policies include the Integrity Charter, Code of Conduct and Compliance Culture; the Organization, Management and Control Model under Legislative Decree 231/2001; the Whistleblowing policy; the HR Policy Framework; Diversity, Equity & Inclusion; Gender Equality; Fight against Harassment, Sexually Inappropriate Behavior and Bullying; and the Remuneration Policy (pp.176-182). Work-life balance rests on a second-level agreement of 8 April 2024 and a smart working agreement allowing up to 14 days a month (p.182). The Health and Safety at Work local policy was approved in November 2024 (p.183). The human rights approach cites the UN Guiding Principles, ILO conventions and the OECD Guidelines, and the Group "does not tolerate child labour" (p.186).

Reference: pages 191-202 (Section 3.1.4, S1-4)

Actions are tabulated against the material impacts (pp.191-196): gender equality communication; inclusion items in the employee survey; partnerships with Valore D, ABI's Women in Banking charter and Fondazione Libellula; anti-harassment training; supplementary allowance paid by the Bank for the first 30 days of parental leave, up to 100% of pay; two paid days for day-care enrollment; five extra days of smart working for caregivers; health and safety training under Legislative Decree 81/08; and, for advisors, mandatory and ESG training, the Academy and the four-year Becoming PFA program. In 2025 the Bank reviewed all irregularity reports on advisors and issued written warnings; none involved social or human rights issues (p.195). Resources: EUR 1.5 million OpEx on training for the own workforce, with no other significant CapEx or OpEx (p.197). The Bank says no pay disparities were found and no remediation of significant actual impacts was needed (p.198). It obtained Top Employer Italy certification for the seventh consecutive year (p.198).

Reference: pages 202-205 (Section 3.1.5, S1-5)

Targets are part of the MYP ESG 2024-2026 (Board-approved December 2023), cover the Italy perimeter and use 2023 as baseline year (p.202). Targets with 2025 reporting values (pp.202-204): at least 10 pieces of diversity and inclusion content by 2026, with 39 published (cumulative 2024-2025); the Gender Equity Pay Gap below 5% for all categories doing the same or equally valuable work by 2026; more of the least represented gender in leadership roles, with a minimum 5% target by 2026 and 185 female managers and executives against 148 in the base year; 20% of new advisor placements to be women, with 18.1% at end-2025; ESG training for 75% of Private Bankers (53.2% in 2025) and 50% of PFAs (56.8% in 2025); and at least 10 ESG training courses at Fineco AM, with 6 available (p.204). The report says objectives were defined with HR and, for advisors, through discussion sessions with territorial structures (pp.204-205). Progress is reviewed periodically by the Sustainability Management Committee and the CGSAS Committee, and the gender equality targets are verified yearly by an external certifying body (p.204).

Reference: pages 205-206 (Section 3.1.6, S1-6)

At 31 December 2025 the Group had 1,529 employees (1,451 in 2024): 883 men and 646 women, none reported as other or not communicated (p.205). By contract: 1,506 permanent (871 men, 635 women) and 23 temporary (12 men, 11 women); 1,434 full-time and 95 part-time (5 men, 90 women) (p.205). No non-guaranteed-hours employees. Italy is the only country with more than 50 employees and at least 10% of the total, with 1,435 employees (p.205). Customer Care employed 197 people, 13% of the total (p.205). 39 employees left in 2025 (49 in 2024), a turnover rate of 2.7% (3.5% in 2024), calculated as 2025 departures over end-2024 headcount (p.206). Figures are headcount at period end, with no estimates (p.205).

Reference: pages 206 (Section 3.1.7, S1-7)

The non-employee workforce is the financial advisor network, described as "independent professionals" working under an agency agreement. At 31 December 2025 there were 3,076 advisors (3,002 in 2024): 25 Area Managers, 180 Group Managers and 2,871 Personal Financial Advisors; 2,518 men and 558 women; 820 Private Bankers sit inside these categories (p.206). By age, 256 were under 30, 1,069 aged 30 to 50 and 1,751 over 50 (p.206). There were 188 new entries in 2025 (178 in 2024): 100 junior and 88 senior, 154 men and 34 women (p.206). Numbers come from an analysis of actual data at year end (p.206).

Reference: page 207 (Section 3.1.8, S1-8)

93.9% of Group employees (94.3% at end-2024) are covered by collective bargaining agreements and represented by employee representatives (p.207). All workers in Italy are covered by the national collective labor agreement for the credit sector (p.207). No agreements exist for representation by a European Works Council, SE or SCE (p.207). In Ireland, sector-specific collective bargaining is not provided; at Fineco AM, conditions are set in individual contracts and the Employee Handbook, under Irish law (p.207). No Group employee is located outside the European Economic Area (p.207).

Reference: page 207 (Section 3.1.9, S1-9)

Senior management comprises 5 Executives with Strategic Responsibilities at 31 December 2025: 4 men (80%) and 1 woman (20%), unchanged from 2024 (p.207). Age distribution of employees: under 30 years 157 (10.3%, against 13.2% in 2024); 30 to 50 years 958 (62.7%); over 50 years 414 (27.0%); total 1,529 (p.207). The Board's gender split is reported in the governance section: 6 women and 5 men of 11 directors (p.105). Gender split of all employees: 883 men and 646 women (p.205).

Reference: page 207 (Section 3.1.10, S1-10)

The disclosure is two sentences: "In Italy and Ireland, all employees are paid a fair salary, in line with the applicable reference standards (in Italy, the pay levels established by the national collective bargaining agreement)" (p.207). Related text: the Group states in S1-4 that "no pay disparities or inadequate salaries were identified", as confirmed by its gender equity pay gap analysis across all Bank employees (p.198). No adequate-wage benchmark or count of employees below one is printed.

Reference: pages 207-208 (Section 3.1.11, S1-11)

All employees are covered against loss of income from illness; in Italy the employer bears full salary during illness, and in Ireland employees get 5 days of paid sick leave at 70% of normal salary, then state sickness benefit (p.207). Involuntary unemployment is covered by NASpI in Italy and by Irish Department of Social Protection benefits for Fineco AM staff (p.207). Employer-paid mandatory insurance covers work injuries and occupational disease, and Fineco adds cover for accidents, work incapacity, permanent disability and death (p.207). Parental leave in Italy runs up to 10 months, extendable to 11, with the Bank topping up the first 30 days to 100% of pay (p.208). Financial advisors have public (INPS) and category (ENASARCO) coverage, plus health insurance for certain clusters (p.208).

Reference: page 208 (Section 3.1.12, S1-12)

As of 31 December 2025, 61 employees were people with disabilities or from protected categories (60 at 31 December 2024), FinecoBank only. They represent 4% of the Group's employees (3.7% of men and 4.3% of women), against 4.1% in the comparison period (p.208). Data come from the census under mandatory employment law L.68/1999 (p.208). For Ireland the figure cannot be retrieved because there is no legal obligation to run such a census (p.208). Related action: Fineco joined the Digital Inclusion Job Day in October 2025 (p.187).

Reference: pages 208-210 (Section 3.1.13, S1-13)

Employees completed 64,998 training hours in 2025 (61,523 in 2024), an average of 42.5 hours per employee: 42.3 for men and 42.7 for women (p.209). By category: professional areas 41,957 hours (47.1 average), middle managers 21,366 (36.5) and executives 1,675 (31.6) (p.209). 96.4% of employees received an annual performance evaluation, reported for evaluation year 2024 because reviews happen early in the following year (pp.208-209). For financial advisors (p.210): mandatory training 129,919 hours (42.2 average, down from 61.8 in 2024); non-mandatory 109,957 hours (35.8 average); Youth Project beginners 13,957 hours (56.7 average). Training data are point-in-time extracts from internal databases and vendor platforms (p.210).

Reference: pages 210 (Section 3.1.14, S1-14)

The Group runs a Health and Safety Management System under an external Head of Prevention and Protection Service, an external Competent Doctor, three internal Safety Delegates and two Workers' Safety Representatives (Milan and Reggio Emilia). It applies to all Group employees (p.210). Advisors working in Bank-managed premises receive health and safety training, and a 2025 circular set out their main obligations under Legislative Decree 81/08 (p.210). The report states that in 2025 "there were no fatalities due to work-related injuries or illnesses, nor were there any reported cases of work-related diseases or occupational accidents" (p.210). No injury rate or lost-days figure is printed beyond this nil statement.

Reference: page 211 (Section 3.1.15, S1-15)

All employees may take family-related leave. In 2025, 145 employees (9.5% of total employees, point-in-time) took it, 69% women and 31% men; in 2024 it was 122 employees (8.41%), 74% women and 26% men (p.211). Counted leaves are mandatory maternity, mandatory paternity and parental leave (p.211). The Bank also offers extra leave beyond law and collective agreements, such as for nursery enrollment, children with specific learning disorders and key family events, and from 2025 lets women work remotely for two months before maternity leave starts (p.211).

Reference: page 211 (Section 3.1.16, S1-16)

The gender pay gap is 26.6% in 2025 (27.3% in 2024), defined as the difference between average gross hourly pay of men and women as a percentage of men's average, calculated on gross hourly pay (p.211). The pay ratio between the highest-paid individual (the CEO and General Manager) and the median total annual remuneration of all other employees is 57.6 (56.0 at 31 December 2024) (p.211). Separately, the Group's Gender Equity Pay Gap method compares women and men within homogeneous job categories, and the report says its analysis found no unjustified disparity (pp.197-198).

Reference: page 211 (Section 3.1.17, S1-17)

"During the year, the Group did not record any incidents or events with significant impacts regarding human rights." No complaints were received through the whistleblowing channels, so fines, penalties or damages amount to zero, and no complaints went to OECD National Contact Points about working conditions or equal treatment (p.211). Related statement: no incidents of discrimination in the workplace were brought to the Group's attention in 2025 (p.191).

Reference: pages 212-217 (Section 3.2.1, S4-1)

The policies address three positive impacts, three potential negative impacts (privacy breach, inadequate listening to clients, irresponsible marketing or greenwashing), six social risks and the market-positioning opportunity (p.212). Named policies: Global Privacy Policy, GDPR-based, with a DPIA process and a Legitimate Interests Assessment model (pp.212-213); Local Policy on Digital Accessibility, applying Directive (EU) 2019/882 and published internally in 2024 (p.213); Global Operational Regulation on marketing and advertising guidelines (p.214); Global Complaint Management Policy (p.214); General Security Policy, with ICT Security Incident Management and Emergency and Crisis Management policies, the latter covering DORA serious incidents (pp.214-216). Customers' human rights are addressed through principles of transparency, fairness and non-discrimination (p.216). Clients are the consumers in scope; the Group says it provides intangible financial products (p.132).

Reference: pages 220-227 (Section 3.2.4, S4-4)

The report states "No serious issues or incidents concerning human rights related to consumers and/or end users have been reported" (p.221). Actions (pp.221-224): the Underage Account with 14,175 accounts open for under-18s at 31 December 2025 and a portfolio-mirroring feature added in September 2025; 25 events on sustainability and financial knowledge, meeting the target of at least one per commercial area; roughly 350,000 customer contacts a month with 97% of phone requests resolved on the call; TRI*M customer satisfaction index of 103; dissatisfied clients at 2.28%; adherence to the ABI moratorium for women victims of violence; and Basic Account A and B for disadvantaged groups. Cyber and fraud actions in 2025 included air-gapped backups, updated encryption and new fraud-predictor data (p.227). Resources: EUR 2.1 million OpEx on charity and partnerships and EUR 4.9 million OpEx on ICT and security, excluding security embedded in broader contracts (p.224).

Reference: pages 227-228 (Section 3.2.5, S4-5)

Targets, set in 2023 under the MYP ESG 2024-2026, with 2025 results (pp.227-228): 25 customer events with sustainability and financial knowledge as the central theme (target 2025, delivered); TRI*M satisfaction of 90 points or more, with 103 reached in 2025; ESG questions in the survey, with three added since 2024; participation in 80% of know-how partnership meetings by 2026, with 100% in 2025 through CertFin; simplifying mobile access to ETF Savings Plans on the app, still in progress; mobile access to the educational offering, released in January 2025; accessibility training for designers, with about 40 employees on the 2025 course; and recurring culture, environment and charity partnerships. One MYP ESG target, ISO 27001 or equivalent for at least 80% of IT service providers by 2026, has no data available as of 2025 (p.228). The report states "Customers were not directly involved in setting the targets" (p.228).

Reference: pages 229-235 (Section 4.1.1, G1-1)

The Group builds its approach on a culture of compliance with five mechanisms: tone from the top, governance and processes, training and development, communication and people engagement, and performance management (p.229). The policies address four positive impacts (workforce ethical behavior, external stakeholder appreciation, whistleblower protection, anti-corruption framework), one potential negative impact (stakeholder distrust if corruption occurred) and one opportunity (p.229). Policies: Integrity Charter and Code of Conduct, the 231/2001 Model and Whistleblowing (cross-referenced to Section 3.1.1); two conflict-of-interest policies (pp.229-231); the Global Anti-Corruption Policy, which draws on the UN Convention against Corruption and ISO 37001 (p.231); and an Anti-Money Laundering policy (p.231). Whistleblowing reports can be anonymous, are acknowledged within seven days and are protected from retaliation under Legislative Decree 24/2023 (p.232). Functions most exposed to corruption risk: Procurement; Identity & Communications; Brand, Advertising & Events; and People Management & Development (p.234).

Reference: pages 110, 190, 200, 231, 234

Back-filled from the business conduct chapter (Section 4.1). This disclosure requirement did not exist under the 2023 ESRS the report was prepared against; business conduct targets fell under MDR-T.

The report states no quantified business conduct target. What it describes is how the framework is checked: "regular reporting to internal committees and corporate bodies takes place" on risks of non-compliance with the anti-corruption framework (p.234); first and second level controls inside the anti-corruption program (p.234); an annual Compliance Officer report on the whistleblowing system to the Board, Board of Auditors, 231 Supervisory Board and Risk and Related Parties Committee (p.190); and an annual conflicts-of-interest report to Senior Management (p.231). Mandatory courses end in a final test, and completing mandatory training is a prerequisite for access to the incentive system (p.200). The 2025 short-term incentive carries a 'Tone from the top' objective on behaviors that strengthen the culture of risk and compliance (p.110).

Business conduct targets are also presented under G1-3 (2025 ESRS numbering).

Reference: page 235 (Section 4.1.3, G1-4)

The Group reports no convictions or fines for violation of anti-corruption and anti-bribery laws in 2025 or 2024: number of convictions 0 and amount of fines EUR 0 in both years (p.235). It also reports zero confirmed incidents of corruption or bribery in both years, zero confirmed incidents in which own workers were dismissed or disciplined for corruption or bribery, and zero incidents in which business partner contracts were terminated or not renewed for corruption-related violations (p.235). The text says "there were no cases of active or passive corruption in either the 2025 fiscal year or the previous 2024 fiscal year" (p.235).