Hoist Finance Ab (Publ)

Reference: pages 41-42.

The Board of Directors is the highest decision-making body for sustainability matters. It decides the sustainability strategy, the double materiality assessment (DMA), the related key metrics and the consolidated sustainability statement (p.41). At year-end 2025 it had six members, all elected by the AGM, all non-executive, with no employee representatives. Women held 17% of seats and men 83%. 67% of members were independent of the company, corporate management and major shareholders (p.41).

The Risk and Audit Committee (RACO) has monitored sustainability reporting and the related material impacts, risks and opportunities since 2024. The CEO holds primary responsibility for implementing the sustainability strategy, with the Executive Management Team. Group functions and local management teams carry it out and gather the metrics (p.41). The Board delegated operational responsibility for reporting to the CEO, who set up a dedicated project and steering group in 2025. These are to be phased out from 2026 and the work moved into ongoing operations (p.42).

The Board had training in 2025 on corruption and conflicts of interest, risk management and the CSRD rules, and has "access to sustainability expertise within the company" (p.41). Member backgrounds are in the Corporate Governance Report, pp.26-35.

Reference: page 42.

During 2025 the Board approved the DMA and related issues regarding the Group's sustainability strategy. RACO and the Board "received regular updates on, and took active part in, implementation of the double materiality assessment, including determination of relevant key metrics" (p.42).

The material impacts and risks the Board and RACO dealt with are listed in SBM-3 on p.46. The company says that "A procedure for reporting to the Board and relevant committees on the progress of identified material impacts and risks is under development" (p.42), so a formal procedure for progress reporting on identified impacts and risks is not yet in place.

Sustainability matters, impacts, risks and opportunities are described as "an integral part of the Group's strategic planning, decision-making processes and ongoing risk management" (p.42). As a regulated credit market company under the Swedish Financial Supervisory Authority, Hoist Finance says its material risks "lie primarily in the social and governance-related areas" and are handled in its regular risk management process (p.42).

Reference: page 42.

Hoist Finance reports no link between sustainability performance and executive pay: "The incentive scheme pertaining to senior executives is not linked to specific sustainability-related targets. Sustainability-related targets are therefore not used as performance criteria or as a basis for variable remuneration" (p.42).

The statement gives no percentage of variable pay tied to sustainability. The Remuneration Policy is summarized in the policy table on p.43: it sets out how fixed and variable remuneration is decided, who is responsible at each level, how risk-takers are identified, the remuneration components and the rules for deferred remuneration.

Reference: page 42.

The statement on due diligence is a table on p.42. The company introduces it as "an overview of how Hoist Finance manages specific elements of due diligence as regards people and the environment, and where this information can be found in the sustainability statement" (p.42).

The table lists five elements: due diligence in governance, strategy and business model; engaging with affected stakeholders; identifying and assessing negative impacts on people and the environment; actions to address negative impacts; and tracking effectiveness of actions. It points to disclosure requirements including GOV-2, SBM-1, SBM-2, SBM-3, IRO-1, S1-4, S4-4, G1-3, MDR-T, S1-5 and S4-5. The EU-legislation datapoint table marks the due diligence statement datapoint (GOV-4, paragraph 30) as Material, p.42 (p.64).

Reference: page 42.

Sustainability data comes from several functions and systems, with named data owners for each area (p.42). Reporting runs on internal instructions that "specify common guidelines and requirements for the collection, documentation and reporting of sustainability data". The reporting principles set roles, responsibilities, timelines and steps to control data flows (p.42).

Controls described: "Duality controls have been implemented to minimise the risk of incorrect information", and data owners carry out validations and reconciliations in their departments. The internal control environment rests on these principles (p.42).

The company says the work is unfinished: "Work on risk assessments and internal control for sustainability reporting are under development and will continue to be developed going forward" (p.42). The statement does not describe a risk assessment of the reporting process itself.

Reference: pages 44-45.

Hoist Finance is "a regulated credit market company that invests in portfolios of non-performing consumer and small business loans", bought from banks and other financial institutions across Europe (p.44). The business model has three pillars, investment management, capital and funding, and loan management, plus Group-wide functions (p.44). The Group also takes savings deposits in six European countries through HoistSpar, and was active in 14 European countries at 31 December 2025 (p.45). It had 1,112 employees (p.52).

The value chain figure on p.44 shows regulators, outsourcing partners, suppliers, banks, financial institutions, investors, savings customers and borrowers around the three pillars. In some countries and segments, collection is outsourced to third-party providers (p.56).

The revenue breakdown by ESRS sector (SBM-1 paragraph 40(b)-(c)) is under phase-in (p.40). The paragraph 40(d) datapoints on fossil fuels, chemicals, controversial weapons and tobacco are marked Non-material (p.64).

Reference: page 45.

The table on p.45 names eight stakeholder groups and how each is engaged. Investors: group and individual meetings and presentations. Borrowers: dialogue through the loan management organization, surveys and a complaints procedure. Savings customers: contact mostly started by the customer. Banks and financial institutions: mainly through the investment management organization. Suppliers and outsourcing partners: agreements and the Supplier Code of Conduct. Regulators and supervisory authorities: active monitoring and forward-looking dialogue. Own employees: performance reviews, management conferences and annual surveys. Society: industry bodies, an active PR strategy and academic partnerships.

The Board "receives regular updates on stakeholder perspectives", which feed the DMA. External dialogue for the DMA covered investors, equity and credit analysts and banks (p.47). Views of employees, borrowers, savings customers and suppliers are covered in later sections (p.45).

Reference: page 46.

The table on p.46 lists the material impacts, risks and opportunities. Hoist Finance says "Our main impact is in the social- and governance-related areas" (p.46). It has 12 rows, which we counted because the report states no total: four negative impacts on employees under S1 (working conditions, equal treatment and opportunities); four under S4 (one positive and one potential negative impact on financial inclusion, one potential negative impact and one risk on privacy); three under G1 (protection of whistleblowers, supplier relationships, corruption and bribery); and one entity-specific row on offloading credit risk from the banking system.

The positive impacts are borrowers' financial inclusion and the credit-risk offload, which the company calls "an actual positive impact" (p.46).

On financial effects: "At the present time, no substantive financial effects related to material risks have been identified" (p.46). The anticipated financial effects datapoint (SBM-3 paragraph 48(e)) is under phase-in (p.40). Each topic chapter repeats its own rows: pp.50, 52, 56, 58, 60.

Reference: page 47.

The DMA "is structured around the steps defined in the ESRS". It covers the strategy and business model, the whole value chain "from a stakeholder perspective" and the market and regulatory context. Inputs were qualitative and quantitative, including climate reporting and annual employee survey results (p.47).

Steps: a gross list of impacts was sorted as positive or negative and as actual or potential. Risks and opportunities followed the same process, "ranging from the risk of Hoist Finance being used for money laundering to the risk of our loan portfolio being impacted by climate change". Each item was scored in a model, with the financial materiality threshold for risks and opportunities "set at over five per cent of operating profit". The report states no impact-side threshold. A measurability metric was then added to the material IROs.

Internal dialogue (the CSRD steering group and RACO) and external dialogue (investors, equity and credit analysts, banks) shaped the result, and the Board approved it. The assessment is to be updated annually (p.47).

Reference: pages 47, 62-66.

The company says the content of the statement "is based on the results of the double materiality assessment" and points to the Supplementary Information, pp.62-66, for the disclosures included, those incorporated by reference and a table of datapoints derived from other EU legislation (p.47).

The index (pp.62-63) lists ESRS 2 general disclosures (BP-1 to IRO-2) and MDR-P, MDR-A, MDR-M and MDR-T for the entity-specific topic, "Supporting and de-risking the European Banking System". It lists S1 (SBM-2, SBM-3, S1-1 to S1-6, S1-9, S1-10, S1-13, S1-16, S1-17), S4 (SBM-2, SBM-3, S4-1 to S4-5) and G1 (GOV-1, IRO-1, G1-1 to G1-4). No E1 to E5, S2 or S3 requirement is listed. The datapoint table (pp.64-66) marks each datapoint Material or Non-material, with pages for the material ones.

IRO-2 states that climate change (E1) is not material (p.47). Phase-in is applied to the revenue split by ESRS sector, anticipated financial effects, S1-7 and S1-15 (p.40).

Reference: pages 52-53 (policy summaries p.43).

Hoist Finance names five Group-wide documents for its own workforce: the Remuneration Policy, Sustainability Policy, Diversity Policy, Code of Conduct and Whistleblower Policy (p.52). Together they are "designed to prevent discrimination, including harassment, and to promote equal opportunities and the right to good working conditions for all employees" (p.52). The Diversity Policy covers the grounds in the "Equality Act 2010", as the report names it: age, gender and gender identity, sexual orientation, ethnic origin, skin color, disability, religion, political ideology, national origin and social origin (p.53). Detailed instructions add preventive actions, detection mechanisms and follow-up reporting (p.53).

The governance documents "apply to all employees across the Group" (p.43), with a summary of each in the table there. The S1 impacts are scoped to employees: people who work for the company but are not employees, such as consultants, "are not included" (p.52).

The datapoint table marks the human rights policy commitments (paragraph 20) and ILO conventions 1 to 8 due diligence (paragraph 21) as Material, p.52, and the trafficking (22) and workplace accident prevention (23) datapoints as Non-material (p.65).

Reference: page 53.

The company says efforts to prevent stress and overwork, unfair working conditions and unequal treatment "are integrated into daily operations and the HR function's work" (p.53). Survey results and other employee input identify what to act on. Responsibility for carrying actions out sits with designated employees in each national management team, supported by HR (p.53).

Actions named for 2025: an in-depth review of the survey results with a focus on diversity, equality and inclusion; training of HR managers from each market; early work on internal inclusion training; internal training sessions and the annual PDDs; country activities on physical and mental health and team building; workshops and information days on diversity and inclusion; and HR training on the EU Pay Transparency Directive (p.53). A hybrid working model is used (p.53).

The section gives no budget or resource figures for these actions.

Reference: page 54.

Hoist Finance sets no measurable, time-bound target for its own workforce. It says it aims at "a work environment characterised by respect, fairness and equal development opportunities for all employees" and to have staff reflecting the diversity of society (p.54). Effectiveness is tracked through metrics in S1-6 to S1-17: the employee survey, staff turnover, salary levels against minimum wages, pay gaps, remuneration ratios and sick leave (p.54).

The company explains: "It may be appropriate to set specific, measurable, time-bound targets for some metrics, while others are used primarily to monitor developments over time. Hoist Finance will evaluate future targets where deemed appropriate" (p.54).

Reference: page 54.

At the end of 2025 Hoist Finance had 1,112 employees (headcount): 650 women, 462 men, none reported as other. The 2024 total was 1,222 (737 women, 485 men). By contract: 1,069 permanent (625 women, 444 men), 37 temporary (20 women, 17 men) and 6 non-guaranteed (5 women, 1 man). Consultant and B2B contracts are excluded (p.54).

By country: Italy 340, Poland 206, Germany 185, France 119, Sweden 91, UK 75, Spain 64, Greece 13, Netherlands 11, Cyprus 4, and one each in Belgium, Finland, Luxembourg and Portugal. France, Poland, Italy and Germany each have more than 50 employees and at least 10% of the total (p.54).

Turnover: 273 terminations in 2025 (445 in 2024), 94 of them voluntary (175). Turnover was 24.32% (31.99%). Sick leave was 2.49%, with no 2024 figure. The company ties the high turnover in both years to restructuring in Italy and Romania (2024) and Spain and Romania (2025) (p.54).

Reference: page 55.

Gender split at end of 2025 (2024 in brackets): all employees 650 women (58%) and 462 men (42%) (737, 60% and 485, 40%); managers 100 women (47%) and 114 men (53%) (98 and 117); local management teams 15 women (31%) and 33 men (69%) (10 and 32); Executive Management Team 5 women (36%) and 9 men (64%) (4 and 10). Local management teams exist in France, Greece, Italy, Poland, Spain and Germany.

Age split of 2025: under 30, 148 (13%); 30-50, 796 (72%); over 50, 168 (15%). In 2024: 145 (12%), 900 (74%) and 177 (14%). Figures are headcount at period end from the HR system and exclude consultants and B2B contracts (p.55).

Reference: page 55.

The disclosure is a single statement: "Hoist Finance offers fair salaries and benefits in accordance with local laws, and we ensure that all employees have a base salary that exceeds the minimum wage in their respective country" (p.55).

The company monitors salary levels relative to minimum wages as one of its S1 metrics (p.54). No country-by-country breakdown, benchmark or list of exceptions is given.

Reference: page 55.

Performance review (PDD) completion in 2025 (2024): employees 100% (99%); managers 97% (98%); Executive Management Team 100% (92%); men 99% (98%); women 100% (99%). New employees and those on sickness, parental or long-term leave are excluded. Consultant and B2B contracts are not in PDD figures (p.55).

Average training hours in 2025 (2024): employees 8 h (8 h); managers 10 h (9 h); Executive Management Team 11 h (4 h); men 8 h (7 h); women 9 h (9 h). Hours are total registered training hours, from the HR system and local reports, divided by the employees who completed training (p.55).

Reference: page 55.

Unadjusted gender pay gap in 2025: 34%, with no 2024 comparison. The company defines it as the difference between women's and men's average salary levels as a percentage of men's average, using basic salary converted to annual salary and translated to SEK (p.55). The statement does not say what drives the figure. It reports that "Work is underway on calculating the adjusted pay gap", to remain a focus in 2026 ahead of the Pay Transparency Directive (p.55).

Total remuneration ratio: 21.9 in 2025 (21.6 in 2024). It compares the annual basic salary of the highest-paid individual with the median annual salary of all other employees (p.55).

The datapoint table marks both the unadjusted gender pay gap (paragraph 97(a)) and the excessive CEO pay ratio (paragraph 97(b)) as Material, p.55 (p.66).

Reference: page 55.

Employees are encouraged to take complaints or perceived breaches of conduct to their manager, HR or Compliance, or to use the whistleblowing channel. Compliance assesses whistleblowing cases and, for discrimination, decides how they are handled (p.55).

The only outcome reported: "In 2025, this process did not result in any cases of discrimination leading to legal action" (p.55). No count of complaints or incidents, and no fines or compensation amounts, are given. The datapoint table marks the incidents of discrimination datapoint (paragraph 103(a)) as Material, p.55, and non-respect of UN Guiding Principles and OECD guidelines (paragraph 104(a)) as Non-material (p.66).

Reference: pages 56-58.

Financial inclusion (p.56): the Group-wide policies are the Sustainability Policy, Code of Conduct and Complaints Management Policy. The Sustainability Policy says Hoist Finance promotes financial inclusion for individuals and small businesses with overdue debts through "sustainable long-term payment plans". The Code of Conduct requires borrowers to be "treated fairly, respectfully and ethically". The company says it follows the laws of each market and takes account of "overarching international standards such as the UN's human rights framework".

Privacy (p.58): the Privacy Policy, Security Policy, Code of Conduct and Complaints Management Policy. The Privacy Policy sets the minimum standard for processing personal data and how incidents are handled. The Security Policy provides risk-based protection of borrowers' and savings customers' data. All third parties must comply with the GDPR.

Due diligence instructions cover loan portfolio sellers and buyers and borrowers (p.57). The datapoint table marks S4-1 policies (paragraph 16) and non-respect of UN Guiding Principles and OECD guidelines (paragraph 17) as Material, pp.56, 58 (p.66).

Reference: pages 57, 59.

Borrowers (p.57): the main action is agreeing repayment plans, which are classed as forbearance measures. The company says these have "a material positive impact" and reduce the risk of negative impact. Conservative portfolio valuation limits the chance of unrealistic repayment expectations. The statement is plain that "No specific actions were implemented in 2025 to strengthen the positive impact or minimise the negative impact on borrowers, as this is part of ongoing operations". Forbearance covered 15.1% of the total loan book (CRR Article 47b basis), excluding co-investments where Hoist Finance holds a minority share and legal proceedings.

Data protection (p.59): actions are built into operating procedures, with continuous monitoring of complaints and enquiries, data protection reviews and incident management. Employees are trained annually and partners are held to GDPR standards. A 2025 action was additional protection of IT and data security against cyber risks.

Reference: pages 57, 59.

Borrowers: there is "no specific target for the percentage of loans subject to forbearance measures", because the figure depends on each borrower's situation and wishes (p.57). The company reads a falling share as a possible sign of weaker lending standards in acquired portfolios or higher interest rates, and calls it "one of many risk indicators". The 2025 figure is 15.1% (p.57).

Data protection: "Hoist Finance do not have any measurable, time-bound, result-oriented targets related to data protection". Instead it applies standardized compliance procedures and monitors effectiveness through the share of employees who finished annual GDPR training: 99% in 2025 and 99% in 2024 (p.59).

Reference: pages 60-61.

The policies named for business conduct are the Code of Conduct, Sourcing Policy, Sustainability Policy, Whistleblower Policy, AML Policy and Anti-Corruption Policy (p.60). Business ethics incidents such as corruption and bribery go through prompt, objective investigation by designated, authorized people, using a framework of whistleblower function, gifts and benefits instructions and conflict of interest rules (p.60).

The Whistleblower Policy follows the Swedish Whistleblower Act (2021:890), which implements the EU Whistleblower Directive. Employees, including temporary staff, can report anonymously, only a few designated people see cases, and anonymous dialogue continues after a report. Case summaries go to the Board regularly (p.60). All employees get annual anti-corruption training covering gifts and benefits and conflicts of interest, and must read and follow the Code of Conduct (pp.60-61).

The datapoint table marks the UN Convention against Corruption (paragraph 10(b)) and whistle-blower protection (paragraph 10(d)) datapoints as Non-material (p.66), although whistleblower protection is a material G1 sub-topic (p.60).

Back-filled from the business conduct chapter (pp.60-61). G1-3 became a standalone targets disclosure requirement only in the 2025/2026 ESRS. This statement uses the 2023 numbering, where G1-3 is Prevention and detection of corruption and bribery (p.61), so business conduct targets would sit under MDR-T.

No business conduct target is stated. The chapter sets no measurable, time-bound goal, and the index lists MDR-T only for the entity-specific topic (pp.51, 62).

The chapter does track how controls are working, MDR-T's other limb:

• Annual training completion: anti-money laundering 99% (100% in 2024), anti-corruption 99% (100%), conflicts of interest 99% (100%), whistleblowing 99% (98%) (p.61).
• Supplier controls: 93% of suppliers had full due diligence and 93% had signed the Supplier Code of Conduct (p.61).
• Regular risk assessments, with results "used to reinforce our control measures" (p.61), and case summaries "reported regularly to the Board of Directors" (p.60).

The report does not call any of this effectiveness tracking, so this entry is our reading of the chapter, not a company claim.

Reference: page 61.

The statement is short: "During the reporting period, Hoist Finance have not been subject to any convictions or fines related to violations of corruption or bribery laws. No confirmed incidents were identified that required action related to internal procedures or anti-corruption standards" (p.61).

A nil return is a complete answer here. The datapoint table marks both G1-4 datapoints, fines for violating anti-corruption and anti-bribery laws (paragraph 24(a)) and the anti-corruption standards (paragraph 24(b)), as Material, p.61 (p.66). The report gives no count of reports received through the whistleblower channel.