Hrvatska Postanska Banka Dd

Reference: pages 87-91.

The Bank runs a two-tier system: "the Bank's corporate governance is based on a two-tier system comprising the Management Board and the Supervisory Board, with the General Meeting as the third key body" (p. 87). The Management Board "holds overall accountability for the governance of the Bank and for defining the sustainability strategy, framework, objectives and priorities" and gets an update on the IRO process at least annually (p. 87). It has five members, all men: "no female representation", unchanged from the prior period (p. 87). The Supervisory Board has five members, three of them women (60%), and 60% are independent (p. 89). Its committees are Audit, Remuneration, Risk, Nomination and ESG (p. 89). Employees have no formal board representatives; the union branch speaks for them (p. 87). On 1 June 2025 the Sustainable Business Office became a Sustainable Business Department inside the Strategic Development and Business Transformation Division (pp. 90-91). A diversity policy took effect on 9 May 2025, with a 40% target for the underrepresented gender; the Supervisory Board stood at 60% women on 31 December 2025 (p. 91).

Reference: pages 92-94.

The boards are informed "most commonly on a monthly or quarterly basis" through formal reporting, committees and meetings (p. 92). The Management Board "systematically considers the implications of sustainability matters for capital expenditure, the development of new products and business initiatives", and the report states that "no situations arose that required trade-offs between financial and sustainability objectives" in 2025 (p. 92). A table (pp. 93-94) lists each material IRO, the body informed and the 2025 action. The Management Board, ESG Committee and Supervisory Board adopted the Climate Strategy, a revised Sectoral Policies document and non-financial targets for Scope 1 and 2 emissions and Scope 3 Category 15 financed emissions (p. 93). The Management Board also took decisions on a gender pay gap target, the Remote Work Rulebook, a mentoring program and an updated Code of Ethics (pp. 93-94). The Risk Committee received quarterly security reporting that "did not result in any breach of client data privacy or security" (p. 94).

Reference: page 95.

This is a nil return for board pay. The Remuneration Policy sets the structure and criteria for Management Board and Supervisory Board remuneration, and a Remuneration Committee advises both boards (p. 95). On sustainability the report says: "Sustainability-related matters, including climate-related matters, are not currently incorporated as distinct components of the remuneration of members of the administrative, management and supervisory bodies" (p. 95). No percentage of variable pay linked to climate or other sustainability targets is given for board members. Below board level, the S1-1 chapter says the Performance Management Rulebook requires at least 10% of the target-setting structure to relate to sustainability objectives (p. 143).

Reference: page 95.

"Within HPB Group, due diligence does not operate as a separate formalised process, but is instead fully embedded in the strategic framework, business model and risk management system" (p. 95). The ESG specialist team coordinates it. A table maps the core due diligence elements to report sections: embedding in governance, strategy and business model (GOV-2, GOV-3, SBM-3); engaging affected stakeholders (GOV-2, SBM-2, IRO-1, E1-2, S1-1, S1-2, S4-1, S4-2, G1-1); identifying and assessing adverse impacts (IRO-1); taking action (E1-3, S1-4, S4-4); and tracking effectiveness (E1-4, S1-5, S4-5) (p. 95). The statement describes no stand-alone due diligence procedure, and the cross-legislation datapoint table marks the GOV-4 due diligence statement as Material (p. 118).

Reference: page 96.

Controls are programmed and manual checks plus checks at consolidation for quantitative data, and the "four-eyes" principle for qualitative data; the process is built into the existing financial reporting framework (p. 96). The report names its main risks: inaccurate data, disclosing information that is not material, and omitting material information, including value chain data (p. 96). It also admits that the Bank "does not currently have a separate formalised procedure governing the collection and processing of data for the Sustainability Report"; designated process owners and dual control apply instead, and a formal procedure "is planned for the forthcoming period" (p. 96). The Management Board and Audit Committee are told of reporting risks annually; the Audit Committee reviews the report and the Supervisory Board approves it (p. 96). A new Rulebook for preparing the Sustainability Report was adopted in 2025 (p. 93).

Reference: pages 97-100.

HPB Group serves "566,000 clients" in retail, small and medium-sized enterprises, and large corporates and the public sector, through 66 centers, 6 regional centers and 14 entrepreneurial centers, plus the "Bank at the Post Office" project with Hrvatska pošta (p. 97). It operates only in Croatia and had 1,792 employees at the end of 2025 (1,720 a year earlier) (p. 97). The 2026-2030 strategy has three pillars: client-centric approach, digital and operational excellence, and sustainable growth (p. 97). The Group says it does not operate in the sectors referred to in SBM-1 paragraph 40(d) and names fossil fuels, chemicals production under NACE 20.2 and controversial weapons (p. 97). Upstream value chain: IT, software, energy and external service suppliers and payment partners; downstream: clients and distribution channels (p. 99). The paragraph 40(b) and 40(c) revenue breakdown by ESRS sector is omitted under phase-in (p. 86).

Reference: pages 100-102.

Key stakeholders are clients, shareholders and investors, supervisory and regulatory authorities (CNB, ECB, HANFA), employees, and local community and society, which includes nature treated as a "silent" stakeholder (p. 100). A table (p. 101) gives the reason for engaging each group, the channels (for clients: website, contact center, CRM campaigns, social media, educational events, branches) and the key topics. Client interests are "particularly focused on information system security, personal data protection and access to financial services" (p. 101). The report says the 2026-2030 strategy "was not adopted directly as a consequence of stakeholder feedback" and that feedback "did not lead to revisions of the strategic objectives", although it shaped priorities in implementation (p. 102). The boards learn stakeholder views through the Sustainability Report, risk management reports and the DMA results (p. 102).

Reference: pages 103-110.

The SBM-3 table (pp. 103-105) lists each material IRO with its type, value chain position and time horizon. Material topics are E1 (climate change adaptation and mitigation), E4 (direct drivers of biodiversity loss; soil degradation), S1 (wages, work-life balance, gender equality and equal pay, training), S4 (information system security, privacy, access to products and services) and G1 (business ethics, conflict of interest, whistleblower protection, corruption and bribery). Counted from the table, there are 25 IROs: E1 7, E4 2, S1 6, S4 4, G1 6. The identified climate risks "relate primarily to transition risks, while physical climate risks were not identified as material" (p. 105). Both E4 IROs are potential negative impacts in the downstream value chain, arising through lending (p. 107). Anticipated financial effects under paragraph 48(e) are omitted under phase-in; qualitative information only is given (p. 86). New in 2025 are the portfolio carbon footprint impact and risk, the two biodiversity impacts and several G1 items (p. 110).

Reference: pages 111-115.

A cross-functional team (Strategic Development and Business Transformation, Strategic Risk and Risk Control, Human Resources Management, Compliance) ran the DMA. It began with a relevance screening of every matter in ESRS 1 AR 16 plus an entity-specific G1 sub-topic, and a preliminary portfolio analysis with the UNEP FI tool (pp. 111-112). New in 2025 is an online survey of clients, business partners and suppliers, all employees and the management body (p. 112). Impacts and risks or opportunities are scored 1 to 5; 4 (material) or 5 (critical) makes an item material (pp. 112-113). E2, E3, E4 and E5 were assessed only through financed sectors, not own operations (p. 115). Energy within E1 is not material because "the Group does not have energy-intensive processes" (p. 115). Climate scenarios are NGFS for physical risk and ECB scenarios for transition risk; "scenario analysis is primarily qualitative" (p. 114). For E4 there is no formal assessment of biodiversity-specific risks and no scenario analysis (p. 114).

Reference: pages 116-123.

The report prints a "List of disclosure requirements" table (pp. 116-117) by segment. General information: BP-1, BP-2, GOV-1 to GOV-5, SBM-1 to SBM-3, IRO-1, IRO-2. Climate change: E1-1, E1-2, E1-3, E1-4, E1-6. Own workforce: S1-1 to S1-7, S1-9, S1-10, S1-11, S1-13, S1-15, S1-16, S1-17. Consumers and end-users: S4-1 to S4-5. Business conduct: G1-1, G1-3, G1-4. The table carries no page numbers; a "Chapter" column repeats each DR title. A second table (pp. 118-123) lists datapoints that derive from other EU legislation and marks each Material, Not material, or "Disclosure deferred under transitional provisions", for example the E1-9 and E4-2 datapoints. E4 is absent from the DR list because the Group uses the E4 transitional exemption (pp. 86, 141).

Reference: pages 125-127.

HPB Group has no complete transition plan. It "progressed the development of strategic and operational documentation", including the Climate Strategy, but says the documentation "does not yet cover all elements prescribed by the standard" and the formal Transition Plan is "intended to be completed in the forthcoming period" (pp. 125-126). Long-term qualitative objectives to 2050 sit in three areas: decarbonization, response to climate risks and opportunities, and contribution to the economy's transition (p. 126). Targets are a 42% cut in Scope 1 and 2 emissions and a 25% cut in Scope 3 Category 15 financed emissions by 2030 against 2023 (p. 133), set with IEA pathways; the Group makes no formal claim of conformity with any specific external standard and holds no verification under one (p. 126). Financing bans include thermal coal and coal power, nuclear, mining and tobacco production (p. 126). No separate capital or operating expenditure is identified for climate measures. A preliminary qualitative assessment found no material locked-in emissions in own operations, and no check against the EU Paris and Climate Transition Benchmark exclusion criteria has been done (p. 127).

Reference: pages 113-114, with 106 and 86.

Back-filled from ESRS 2 IRO-1 (pages 113-114) and SBM-3 (page 106), where this content is disclosed in the FY2025 report. This disclosure requirement did not exist under the 2023 ESRS the report was prepared against.

Classification. Physical hazards named are heatwaves, flooding, wildfires, storms, droughts and sea level rise; transition drivers are regulation and tax, technology, market developments, consumer preferences and reputation (p. 113). The material climate risks are transition risks (p. 105).

Method. Physical: geospatial analysis at cadastral-parcel level for collateral real estate, and vulnerability by economic activity for corporate loans. Transition: sector exposure, transmission channels and creditworthiness effects, turned into heat maps (pp. 113-114).

Scenarios. NGFS scenarios, including a Hot house world case, for physical risk, and three ECB transition scenarios to 2030 (immediate start, late start, delayed start; the delayed case implies about +2.5 °C) (pp. 106, 113). At least one 1.5 °C scenario is used (p. 113). Horizons run to 2030, 2030-2050 and beyond 2050 (p. 86). The report says "scenario analysis is primarily qualitative" and that a quantitative analysis is planned (p. 114).

Reference: pages 105-107.

Back-filled from ESRS 2 SBM-3 (pages 105-107), where this content is disclosed in the FY2025 report. This disclosure requirement did not exist under the 2023 ESRS the report was prepared against.

Scope and result. The Group assessed resilience to transition risks and opportunities for own operations and the downstream value chain, covering loan sectors that are emissions-intensive or sensitive to regulatory change (p. 106). It concludes that "HPB Group's strategy is relatively resilient to the identified climate risks", that transition risks "have been identified as manageable through the existing risk management framework", and that the Group "can maintain business model stability and capital adequacy", including under the immediate-start ECB scenario (p. 107). Results feed the ICAAP (p. 107).

Limits. The view is described as "preliminary" and the report admits "certain aspects are not yet fully developed" (pp. 106-107). Physical risks "may represent increasing challenges in the medium and long term" for real estate collateral (p. 106). A diversified IT setup, a dispersed branch network and remote working limit physical vulnerability (p. 107).

Reference: pages 127-130.

The anchor is the HPB Group Climate Strategy to 2050, tied to the Paris Agreement, the European Green Deal, Croatia's Low-Carbon Development Strategy and EBA guidelines on ESG risks (p. 127). It covers mitigation (own Scope 1 and 2 and financed Scope 3 Category 15 emissions, sustainable products, energy efficiency) and adaptation (physical and transition risk management, scenario analysis) (p. 127). The Management Board and Supervisory Board approve it (p. 128). The report states it "has not yet been supported by a methodological linkage or scenario-based validation demonstrating that the planned package of measures is sufficient to deliver a 1.5°C pathway" and that there is "no documented linkage between transition actions and financial planning" (p. 128). Risk policies are the Rulebook on identifying environmental risks, the Methodology for Assessing the Materiality of Environmental Risks, the Risk Appetite Policy and the Business Continuity Policy (pp. 128-129). Responsible financing rests on Sectoral Credit Policies, an industry ESG rating and a client-level ENV score (pp. 129-130). Most of these documents are confidential and internal (pp. 128-130).

Reference: pages 131-132.

Own operations: a pilot of a centralized system to monitor heating, cooling, lighting and electrical equipment, started "towards the end of the 2025 reporting period" with a rollout decision in 2026; annual Scope 1, 2 and 3 calculation with wider scope planned by end-2026; and employee training on sustainability and energy efficiency, delivered in 2025 (p. 131). Environmental risk management: better climate risk methods, an annual physical and transition risk assessment through existing prudential risk categories, and ESG target values in the Risk Appetite Framework (p. 131). Responsible financing: restrictions and RAS limits for transition-sensitive sectors, industry ESG ratings and client ENV scores in credit decisions, and advisory support for clients (pp. 131-132). The report says "it is not possible to quantify the individual contribution of each action", and the pilot has no measurable outcome yet (p. 131). On resources, it reports no need for "the separate identification of material capital expenditure or operating expenditure beyond regular business activities" (p. 132).

Reference: pages 132-135.

Three targets: Scope 1 and 2 emissions, Scope 3 Category 15 financed emissions, and new sustainable lending volume (p. 132). The base year is 2023 and both emission targets run to 2030 (p. 133). Scope 1 and 2 (location-based): 1,246.46 tCO2e to 722.95 tCO2e, a 42% cut, on the IEA Net Zero scenario; 1,468.67 in 2024 and 1,225.09 in 2025 (p. 133). Scope 3 Category 15: 795,976.59 tCO2e to 596,982.44 tCO2e, a 25% cut; 957,947.47 in 2024 and 958,958.47 in 2025 (p. 133), about 20% above the base year by the table's figures. The targets "have not been submitted for SBTi validation" and carry no external verification (p. 133). There are no sector-level targets and no quantified contribution per measure (pp. 133-134). Sustainable lending: target EUR 15 million in 2024 (actual 17.1), EUR 20 million in 2025 (actual 64.98, 325%), EUR 30 million for 2026, not derived from climate scenarios (pp. 134-135).

Reference: pages 135-140.

Group 2025: Scope 1 761.67 tCO2e (2024: 762.28); Scope 2 location-based 463.42 (706.39); Scope 2 market-based 477.53; Scope 3 966,298.20 (961,564.10); total location-based 967,523.28 (963,032.77); total market-based 967,537.39 (p. 135). Scope 3 Category 15 financed emissions are 958,958.47 tCO2e, about 99% of Scope 3 (p. 135). Intensity is 4,789.72 tCO2e per EUR million of net revenue location-based, up from 4,327.85 (p. 136). Scope 3 covers categories 1, 2, 3, 5, 6, 7, 8 and 15 (p. 136). The 2024 and 2025 figures are "not fully comparable": emission factors were updated and distribution losses moved to Category 3 (p. 137); Category 2 was calculated for the first time and Category 8 was split out of Category 1 (p. 138). Financed emissions use PCAF; the financed asset base is EUR 3,863.53 million, with data quality scores from 1 to 5, business loans 4 and mortgages and commercial real estate 5 (pp. 139-140). The share covered by the EU ETS is 0% (p. 137). The data have not been validated externally other than by the assurance provider (p. 136).

Reference: pages 143-148.

Policies and practices cover "recruitment, development, performance management, remuneration, flexible working arrangements, occupational health and safety, diversity and inclusion, and the prevention of discrimination and harassment" (p. 143). Main instruments: the Work Regulations and the Collective Agreement (new in 2025, valid to end-2027, covering all employees except Management Board members) (p. 144), the Remuneration Policy (pp. 144-145), the Performance Management Rulebook, under which at least 10% of target-setting relates to sustainability objectives (p. 143), the Rulebook on Employee Professional Development (p. 148), and the ESG Policy with annexes on diversity and non-discrimination and on human and children's rights (pp. 146-147). Dignity at work is covered by a Rulebook on the Procedure and Measures for the Protection of Employee Dignity (p. 146). HPB is a Diversity Charter and UN Global Compact signatory (pp. 146-147). The Work Regulations commit the Group to no additional third-party standards (p. 144). Employees reach the policies on the internal portal (p. 146).

Reference: pages 151-153.

Adequate wages: the 2025 Collective Agreement raised pay, the minimum monthly basic gross salary, supplements, meal allowances and support payments for all employees, tracked through the ORVI survey and turnover (pp. 151, 153). Gender equality: uniform pay criteria, an annual pay gap analysis and a 2025 target for Level 4 specialist roles (p. 151), plus women's leadership programs, including a leadership academy for female managers (p. 152). Training: onboarding, mentoring, employer-funded education calls and leadership programs (pp. 152-153). Work-life balance: remote work, flexible hours, a shortened working Friday, extra leave for parents, and half-time on full pay for one month after parental leave (pp. 152-153). Remedy runs through the dignity committee and whistleblower channels (p. 152). The Group received the Employer Partner certificate for the ninth consecutive year (p. 153). On resources, implementation "has not required significant additional operating or capital expenditure beyond regular business activities" (p. 153).

Reference: pages 154-156.

Adequate wages and work-life balance have no quantified targets; the report says "disclosures focus on monitoring the effectiveness of measures implemented, in line with ESRS 2 MDR-T, paragraph 81" (p. 154). Pay is reviewed at least annually, with turnover, survey results on pay fairness and corrective actions as indicators (p. 154). Gender pay gap: Level 4 specialist roles showed a 7% gap in favor of men in 2024; the target was to cut it by at least 2 percentage points over 2024-2025, and "The target was achieved in 2025", helped by raising the minimum salary to EUR 1,420 (p. 155). No 2026 gap target will be set until job evaluation and the EU pay directive (2023/970) are in place (p. 155). Training: 19% of employees took digital and analytical skills training in 2025 (the baseline) and the 2026 target is 30% (p. 155). HR, business areas and the Management Board set targets, with employee input through internal channels and the works council (pp. 155-156). Indicators are not validated externally beyond the assurance provider (p. 154).

Reference: pages 156-158.

At 31 December 2025 the Group had 1,792 employees (475 men, 1,317 women), up from 1,720; the Bank had 1,769 (pp. 157-158). By contract, 85 were temporary and 1,707 permanent; by working time, 1,748 full-time and 44 part-time (p. 157). Turnover was 139 leavers, or 7.76% of year-end headcount (10.29% in 2024) and 7.92% of average headcount; women's turnover fell from 10.22% to 6.76% while men's was 10.53% (p. 158). Bank turnover was 7.41% (p. 158). All employees are in Croatia, so no country split applies (p. 157). Data are headcount, use no estimates and are not validated externally beyond the assurance provider (p. 157). The Group classes its workforce as permanent employees, fixed-term employees, students and external collaborators (p. 156). Bank-level data begin in 2025 (p. 157).

Reference: page 159.

Non-employee workers are students engaged on student contracts and external collaborators on contracts for services, used for projects, training delivery, data processing and digitalization work. The Group does not use temporary employment agencies (NACE N78). In 2025 there were 86 non-employee workers in both the Group and the Bank (33 men, 53 women), against 71 in the Group in 2024 (33 men, 38 women). The figure counts every person engaged at any point in the year, not a year-end or average position, because many are engaged for short periods. Hours of engagement are not collected. The report states there were no material fluctuations in numbers, and the data are not validated externally beyond the assurance provider.

Reference: pages 160-161.

Group 2025, highest management level (the Management Board and managerial functions): 87 men (4.9% of all employees) and 158 women (8.8%), against 86 (5.0%) and 142 (8.3%) in 2024 (p. 160). Women make up 64.5% of employees in managerial positions on that definition (p. 160). The Management Board itself has five men and no women (p. 87). Age profile of all Group employees in 2025: under 30, 203 (11.3%); 30 to 50, 1,095 (61.1%); over 50, 494 (27.6%), against 166, 1,170 and 384 in 2024 (p. 160). Bank-level 2025 figures are shown alongside (p. 160). Data are as at 31 December, use no estimates and are not validated externally beyond the assurance provider (pp. 160-161). The Group is a Diversity Charter signatory and sets out diversity principles within its ESG Policy (p. 160).

Reference: page 161.

"HPB Group confirms that all employees receive adequate pay in accordance with ESRS S1-10 and Commission Delegated Regulation (EU) 2023/2772", and says the lowest salary "materially exceeds" the adequacy benchmarks of at least 60% of the median and 50% of the average gross salary (p. 161). The Croatian benchmarks given are EUR 582.00 (60% of the median gross salary) and EUR 485.00 (50% of the average gross salary) (p. 161). In 2025 the Group raised the minimum monthly basic gross salary, other base salaries, supplements for work on public holidays and non-working days, and the meal allowance (p. 161); the minimum salary reached EUR 1,420 (p. 155). Pay is set under the Work Regulations and the Collective Agreement (p. 161). Terms for non-employee workers are monitored against legislation and market standards (p. 161). The report gives no count of employees below the adequate wage; it states that all employees receive adequate pay.

Reference: page 162.

The Group confirms that all employees are covered by social protection through the public social security system, and adds benefits from the Collective Agreement and internal acts (p. 162). Benefits listed: paid leave of up to seven days a year for personal circumstances (marriage, birth of a child, bereavement, relocation, blood donation, preventive medical examination) plus leave for education and return from parental leave; solidarity support payments on the birth or adoption of a child, death of a family member, disability or long-term illness, and death of an employee; accident insurance (death, disability, illness), supplementary and additional health insurance, an annual preventive medical examination and access to psychological counseling; and severance payments on retirement (p. 162). All employees are in Croatia (p. 157).

Reference: pages 162-164.

Group 2025: 49,672.50 training hours for women (69.4% of hours, 37.72 hours per employee) and 21,947.70 for men (30.6%, 46.21 per employee); Bank: 49,454.40 hours for women (38.04 per employee) and 21,748.20 for men (46.37) (p. 164). All actively employed staff have goals and an annual performance review; the completion rate was 85.70% overall, 88.65% for men and 84.60% for women (p. 163). Programs named include HPB Start onboarding, Knowledge Nurseries development modules, the third call for employer-funded education with a higher per-person cap, and the DigiBank Academy, a three-month program ending in a two-day hackathon (pp. 162-163). The eUčionica e-learning platform delivered 79 courses in 2025 (p. 163). 2024 is "not fully comparable" because a different method was used (p. 163). Data come from learning management and performance systems and are not validated externally beyond the assurance provider (p. 163).

Reference: pages 164-165.

Entitlement to family-related leave and its use, Group 2025: 33 men (6.95% of male employees) and 158 women (12.00% of female employees) were entitled, and all of them took it (100%); Bank: 33 men (7.04%) and 150 women (11.50%), also all taking it (p. 165). The 2024 columns show 122 men and 162 women entitled, with 19 men and 162 women taking leave (p. 165). "Entitled" means meeting statutory eligibility during the year and "used" means starting leave during the year; data are not adjusted for length of employment (p. 164). Remote work is contractually agreed for 914 Group employees (51.00%) and 894 Bank employees (50.54%) (p. 165), up to 4, 6 or 12 working days a month depending on the role (p. 164). Employees also get extra annual leave for each child up to age 15 (p. 164). The data are not validated externally beyond the assurance provider (p. 164).

Reference: pages 166-167.

Gender pay gap (men's pay relative to women's, on average gross hourly pay), 2025 against 2024: identified staff (6.57)% against (4.60)%, so women earn more; other employees (managers) 9.51% against 11.90%; other employees (non-managers) 14.80% against 17.40% (p. 166). The Management Board has five men and no women, so no gap can be calculated and the report shows n/a (p. 166). The report notes "A clear decreasing trend" in the two largest categories (p. 166). The method is unchanged between years; pay includes base salary, supplements and allowances, with one-off payments spread over the annual hours fund and FTE adjustment where needed (pp. 166-167). The Group also reports the ratio of the highest-paid individual's total annual remuneration to the median total annual remuneration of employees (p. 167). Data come from the payroll system, use no estimates and are not validated externally beyond the assurance provider (p. 166). A Level 4 specialist gap target was met in 2025 (p. 167).

Reference: page 168.

In 2025 the Group "recorded no cases of reported discrimination or harassment, and no complaints were submitted through the formal reporting channels", and no related fines, penalties or compensation (p. 168). It identified no severe human rights violations, including forced labor, human trafficking or child labor (p. 168). The table shows 0 severe human rights incidents, 0 discrimination cases and 0 complaints for both the Group and the Bank in 2025; the Group's 2024 column shows 0 severe incidents, 5 reported discrimination cases and 0 complaints through channels (p. 168). The report says the zero "is not attributable to data limitations, but to the fact that no formal or informal reports meeting the recording criteria were received in 2025" (p. 168). Data come from the Employee Dignity Protection Committee, HR and other units, and are not validated externally beyond the assurance provider (p. 168).

Reference: pages 169-174.

Policies cover information and cyber security (owned by the Corporate Security Division, approved by the Management Board) (pp. 169-170), personal data protection under an independent Data Protection Officer (p. 170), accessibility and social inclusion built on the Croatian Post partnership, digital channels and the "HPB for Financial Literacy" program, which ran 20 activities reaching 7,517 participants in 2025 (p. 170), the Policy on the Protection of Consumers and Non-Consumers and the Complaint Management Policy (pp. 171-172), and the Principles for Users of Products and Services and the Principles on the Protection of Human and Children's Rights, both published on the website (pp. 171-172). The report states that "no instances of non-compliance with these principles were identified in HPB Group's own operations or across the value chain involving consumers and end-users" (p. 169). Service quality, measured by mystery shopping and CAWI surveys, feeds employee performance assessment (p. 171). The datapoint table marks S4-1 human rights and UNGP datapoints Material (p. 123).

Reference: pages 175-178.

Cyber and data actions are ongoing with no end date: regular vulnerability assessments and penetration testing, layered security controls, ransomware detection and data leakage prevention tools, security checks before new systems go live, and network segmentation, access management and endpoint protection (p. 175). Access: the Ploče and Križevci centers and HP Krapina opened in 2025, mHPB app changes for blind and partially sighted users, and Google Pay, Apple Pay and Garmin Pay (p. 177). Remedy: complaint channels, irregularity and ethics procedures and the HGK Mediation Centre (p. 175). The Group ran 28 employee workshops on service quality, 22 of them corrective workshops after customer research (p. 176). Complaints received were 1,626 in 2025 against 1,673 in 2024, with average resolution time of 6.65 days against 6.28 (p. 176). The report says "implementation of the measures described did not require significant additional operating expenditure beyond the regular annual budgets" (p. 178).

Reference: pages 178-179.

Only information system security carries a quantified target: one security incident or fewer in 2025, tied to EBA guidelines on major incident reporting under PSD2 (p. 178). No incident reached the significance level defined in DORA, Regulation (EU) 2022/2554 (p. 178). The report says "HPB Group did not engage in direct cooperation with consumers, end-users, or their legitimate representatives when determining target values" (p. 178). Privacy has no quantitative target; the Group will consider measurable targets over the next two reporting periods, and its ambition "includes zero tolerance for material personal data breaches" (p. 179). Access to products and services has no formal target either; the Group plans to consider targets in 2026-2027 on digital channel use, service availability in less densely populated areas and inclusion of vulnerable groups (p. 179). For these topics effectiveness is monitored through complaints, corrective actions and consumer feedback (p. 178).

Reference: pages 181-187.

The Code of Ethics is the main policy, adopted by the Management Board with Supervisory Board approval after consulting the chief trade union representative (pp. 181-182). Related instruments are the Conflict of Interest Management Policy (p. 182), the Rulebook on the Procedure for Reporting Irregularities, with a Confidential Reporting Officer and an Irregularities Resolution Committee that reports to the Audit Committee (pp. 182-183), and an Anti-Corruption Policy with a zero-tolerance approach that also covers third parties in the value chain (p. 183). The Bank applies the HANFA and Zagreb Stock Exchange Corporate Governance Code (p. 182) and, as a majority state-owned credit institution, the state anti-corruption program for majority state-owned companies (p. 183). Culture work runs under the "Mijenjamo kulturu za bolju futuru" initiative, with five principles and 15 measures (pp. 183-184). In 2025 there were "no confirmed cases of corruption or bribery, no confirmed breaches of the Code of Ethics, and no whistleblower reports" (p. 183). HPB "does not maintain a stand-alone policy dedicated exclusively to ethics training" (p. 184).

Reference: pages 186-187.

Back-filled from the business conduct chapter, where targets are addressed as part of the MDR-T disclosures rather than as a numbered disclosure requirement. G1-3 became a standalone DR only in the 2025/2026 ESRS; the statement was prepared under the 2023 ESRS (pp. 86, 125).

The Group applies "qualitative target expectations in the area of business conduct, derived from the Code of Ethics, the Conflict of Interest Management Policy, the Anti-Corruption Policy and the whistleblower protection framework" (p. 186): high ethical standards, broad training coverage, timely handling of reports and zero tolerance of corruption. The report says "While these targets are not currently expressed in numerical terms" and that "As baseline and reference values have not yet been formally defined", monitoring uses operational indicators (p. 186). Progress is tracked through internal controls, case handling and training participation, reviewed at least annually (p. 186). The Group "will assess, in the forthcoming period, whether measurable targets and associated time horizons should be introduced" (p. 187).

Reference: page 189.

For both 2024 and 2025, Bank and Group, the table shows zero confirmed cases of corruption or bribery, zero convictions, zero employees dismissed or sanctioned, zero contracts terminated and EUR 0 in fines (p. 189). The report says no internal or external investigations, court proceedings, judgments or sanctions relating to corrupt practices arose, and no remedial action was needed (p. 189). The zeros "reflect the actual outcome of the reporting period and do not indicate the absence of mechanisms or record-keeping" (p. 189). An "incident" is any report received and preliminarily assessed that points to potential corrupt conduct by employees or third parties; data come from the irregularities reporting register, internal control systems and HR case records, and Compliance confirms the totals (p. 189). The Group also found no severe human rights violations linked to corruption or bribery (p. 189). No external verification applies beyond the assurance provider (p. 189).