Illimity Bank Spa

The role of the administrative, management and supervisory bodies

Reference: pages 54-59.

illimity uses the traditional management and control system, and Banca Ifis has been its sole shareholder since 19 September 2025 (page 54). At 31 December 2025 the Board of Directors had 12 members. The gender diversity ratio was 50% (46% in 2024) and 50% of members were independent, down from 85% in 2024 (page 54, notes 4-5). The member counts shown (1 executive, 14 non-executive) cover 15 people: 12 directors and 3 statutory auditors (page 54, note 2). After year-end the Board moved to 13 members and Raffaele Zingone became CEO (page 55).

There is no employee or worker representation on the bodies (page 56). ESG expertise is "held by two-thirds of the Directors in office" (page 59). The Board approves the Sustainability Statement and the double materiality assessment, the Board of Statutory Auditors supervises the reporting process, the CEO certifies it, and the Sustainability Committee of the parent, Banca Ifis, oversees the process and gives an opinion on the assessment (page 57).

Information provided to and sustainability matters addressed by the undertaking's administrative, management and supervisory bodies

Reference: pages 58, 60.

The Sustainability structure summarizes the double materiality results for Board approval, after the opinion of the parent's Sustainability Committee and the Risk Officer's "non-obstructive assessment" (page 60). The Board approved the 2025 results on 11 December 2025 (page 58). Results are reviewed and approved at least once a year. The Board sets the strategic ESG targets, the Sustainability Plan, the Climate Strategy and the ESG risk appetite framework (page 60).

In 2025 the bodies and committees "addressed the entire gamut of material impacts, risks and opportunities" in their meetings, including climate risks, regulatory compliance, gender equality and sustainable finance opportunities (page 60). The adjusted gender pay gap and the ESG targets in incentive schemes went to the Sustainability and Remuneration Committees between the first and third quarters (page 60). The illimity Sustainability Committee no longer exists; the parent's committee replaced it (page 60).

Integration of sustainability-related performance in incentive schemes

Reference: pages 60-61.

The main schemes are the annual MBO and the Long-Term Incentive Plan (LTIP) 2021-2025, addressed to the management body, senior executive management and beneficiary employees (pages 60-61). For the CEO in office at the start of 2025, the Goal Card carried ESG targets "with a weight of 15% on the short-term scheme (STI) and 20% on the long-term scheme (LTI)" (page 61).

Climate KPIs in the MBO: sustainable finance for at least 15% of cumulative net business origination in 2023-2025, and 100% completion of the actions in the 2023-2025 Climate and Environmental Risk Action Plan. In the LTI, the "Top ESG Rating & Sustainable Finance" indicator is 10% of the Goal Card and covers maintaining carbon neutrality, financed emission strategies, reactivating renewable energy plants and the sustainable finance targets (page 61).

Statement on due diligence

Reference: pages 61-63.

illimity says its due diligence "is not a standalone, formalised procedure". It is built into the strategic framework and internal rules: the Credit Procedure, the Bank's ESG Investment Policy, Fürstenberg SGR's ESG Investment Policy and the Sustainable Supply Chain Policy (page 61). For the 2025 assessment the Bank drew up a list of positive and negative impacts and had selected internal and external stakeholders rate them (page 62). Each negative impact has its own policies, actions, targets and metrics in the relevant sections (page 62).

A table on page 63 maps the core due diligence elements (governance and strategy, stakeholder engagement, identifying impacts, actions, monitoring) to the ESRS disclosures that cover them. For example, GOV-1 to GOV-3 and SBM-3 cover integration, and the E1, S1, S3, S4 and G1 action, target and metric disclosures cover monitoring.

Risk management and internal controls over sustainability reporting

Reference: pages 64-65.

The internal control system for the Sustainability Statement mirrors the one used for financial reporting. It covers five processes: the reporting perimeter, value chain analysis, the double materiality assessment, data collection and disclosure, and reconciliation between the financial and sustainability statements. Each control is documented, evaluated, tested and validated (page 64).

The four main risks named are consistency with the consolidated financial statements and completeness of scope, completeness and accuracy of the materiality assessment, incorrect representation of the value chain, and completeness, correctness and integrity of data (page 64). Results feed the Risk Officer's ESG risk work, including ICAAP, ILAAP and the operational risk self-assessment. First-level controls sit in the business, and the control functions run second- and third-level controls. The CEO and the Financial Reporting Officer certify compliance, and results go to the Board each year (page 65).

Strategy, business model and value chain

Reference: pages 66-70.

illimity mainly targets the Italian market. It lends to high-potential companies and finance companies, including the unlikely-to-pay (UTP) segment, runs asset management through subsidiaries, and offers digital banking to retail customers (page 66). Headcount was 672 at year-end 2025 (779 in 2024): Lombardy 466, Emilia-Romagna 171, Lazio 24, other regions 11 (page 66).

The 2023-2025 Sustainability Plan ended on 31 December 2025 and its ESG targets are "all understood as having been achieved" (page 67). The sustainable finance target was 15% of 2023-2025 origination; the Bank reports 13.4% and says it was "achieved over the three-year period" (page 67, note 9). The ISO 37301 certification target "was limited to preparatory activities" (page 68, note 10).

Value chain (pages 69-70): suppliers fall into service clusters, with IT almost entirely under a full outsourcing contract with altermAInd S.r.l., 48% owned by illimity. Partners include SACE, Mediocredito Centrale and the European Investment Fund for loan guarantees. Downstream customers are mainly Italian SMEs, plus retail depositors.

Interests and views of stakeholders

Reference: pages 70-71.

illimity names eight stakeholder categories: the Board, SME customers, retail customers, shareholders and investors, suppliers and partners, community and industry bodies, employees, and other silent stakeholders such as regulators, rating agencies and NGOs (page 70). Each has set dialogue channels, such as engagement surveys and the intranet for employees, the Vendor Management Portal for suppliers, and ESG profile campaigns for corporate customers (page 71).

For the 2025 assessment only employees (through the ESG Ambassadors) and suppliers rated impacts, while internal functions did the financial materiality (page 70). The Board, the parent's Sustainability Committee, the Risk Officer and the Board of Statutory Auditors gave views on the overall result (page 70). The Board learns stakeholder views at regular meetings of the Bank's Board and the parent's Sustainability Committee (page 71). The Bank expects the merger into Banca Ifis in the second part of 2026 (page 71).

Material impacts, risks and opportunities and their interaction with strategy and business model

Reference: pages 71-78.

The assessment found five material topics: E1 climate change, S1 own workforce, S3 affected communities, S4 consumers and end-users, and G1 business conduct (pages 72-74). Three tables list 32 items: 11 impacts (9 positive, 2 negative), 10 risks and 11 opportunities. The two negative impacts are Scope 3 category 15 greenhouse gas generation from the securities and loan portfolio (current, medium term) and a potential digital divide for disadvantaged users as processes digitize (page 72). The 10 risks are four climate risks (physical and transition effects on credit and liquidity), one S1 legal-proceedings risk, three S4 risks and two G1 risks (page 73).

The Bank states that "there were no current financial effects of material risks and opportunities of illimity on its financial position, results of operations and cash flows" (page 77). It also says a resilience analysis was carried out for each business area in the period, with detail in the E1 section (page 77).

Description of the processes to identify and assess material impacts, risks and opportunities

Reference: pages 78-89.

The 2025 assessment was run top-down with the subsidiaries and coordinated with the parent, Banca Ifis (page 78). Inputs included the Strategic Plan, the Sustainability Plan, internal rules, products and locations, a value chain map, regulation, peer and media analysis, and stakeholder engagement (page 78). Impacts were rated as "gross" impacts by employees (the "ESG Ambassadors", about 10% of staff) and by suppliers: 77 relevant suppliers were identified, and those covering about 83% of annual expenditure commitments were assessed (page 79). Impact materiality is severity (scale, scope, irremediability) times probability, with the cut-off set at the median of the results (page 80). Risks and opportunities are scored on magnitude and likelihood, and an item is material at or above a cut-off equal to the average of the maximum attainable score (page 81).

Climate work uses NGFS scenarios and the Valuecube-ABI model (pages 82-86). The Bank found E2, E3, E4 and E5 "immaterial to illimity" (page 86).

Disclosure requirements in ESRS covered by the undertaking's sustainability statement

Reference: pages 182-189.

Section 5.1.2 lists the disclosure requirements "fulfilled by illimity" for ESRS 2, E1, S1, S3, S4 and G1. The column is headed "Par." and gives report section numbers, not page numbers (pages 184-189). Section 5.1.1 lists the Appendix B datapoints from other EU legislation, each marked with a section number, "Not Material", "Phase-in" or "N/A" (pages 182-183).

In the index: ESRS 2 BP-1 to IRO-2; E1-1 to E1-7; S1-1 to S1-17; S3-1, S3-2, S3-4 and S3-5; S4-1 to S4-5; G1-1 to G1-4 and G1-6. E1-9 appears as "Phase-in" (page 185). Not in the index: E1-8, S3-3, G1-5, all of E2 to E5 and all of S2. Appendix B marks "Not Material" the datapoints for E2-4, E3-1, E3-4, E4-2, E5-5, the SBM-3 forced and child labor risks for S1 and S2, and S2-1 and S2-4 (pages 182-183).

Transition plan for climate change mitigation

Reference: pages 99-102.

The transition plan is the Climate Strategy, approved by the Board in November 2024, with implementation starting in FY2025 and a 2030 and 2050 horizon (pages 100, 102). It has three pillars: cut own emissions (net-zero Scope 2 market-based by 2030, with residual emissions offset by credits), grow sustainable finance, and decarbonize the most carbon-intensive sectors in the portfolio from 2025 (page 100). illimity says it has held carbon neutrality for Scope 1 and 2 since 2020 by buying certified credits (page 100).

Portfolio targets cover Shipping, Power, Steel, Oil & Gas and Real Estate, using IEA, Poseidon Principles and SBTi scenarios (page 101). Levers: financing bans or limits for sectors such as coal-fired power, sector intensity targets, and Green and Sustainability-Linked Loans (page 102). Guarantees of Origin cover about 59% of energy needs, with 100% targeted by 2030 (page 102). The plan is "embedded and aligned with the Bank's overall business strategy and financial planning (budget)", and illimity is excluded from the EU Paris-aligned benchmarks (page 102).

Identification of climate-related risks and scenario analysis

Back-filled from ESRS 2 IRO-1 (E1.IRO-1) and E1.SBM-3, where this content is disclosed in the FY2025 report (pages 82-86, 96-99). This disclosure requirement did not exist under the 2023 ESRS the report was prepared against.

Four climate risks are listed (page 96): two transition risks (falling collateral value from energy-efficiency rules, and weaker counterparty credit ratings from higher transition costs and carbon taxes) and two physical risks (credit risk from acute or chronic events, and liquidity risk from deposit withdrawals after damage to depositors' property).

Scenarios: NGFS scenarios supplied through Oxford Economics, run in the Valuecube-ABI model in five-year steps from 2025 to 2050 (pages 84-85, 97). The report does not name individual NGFS scenarios or give a global temperature projection per scenario; the transition work refers to "a future in which global warming is limited to 1.5°C" (page 85). Physical risk on collateral and repossessed real estate uses ISPRA hydraulic and hydrogeological indices (pages 83-84). Results: transition probabilities of default rise about 4% in the baseline and about 20% in stressed scenarios, on a sample covering 22% of Corporate Banking exposures (page 85). About one-third of financed counterparties sit in the high or very high physical risk range (page 84).

Resilience in relation to climate change

Back-filled from ESRS 2 SBM-3 (E1.SBM-3), where this content is disclosed in the FY2025 report (pages 77, 96-99). This disclosure requirement did not exist under the 2023 ESRS the report was prepared against.

The resilience assessment applied NGFS scenario outputs to a sample of financed companies (page 96). The latest analysis was done in the first half of 2025 (page 98). Business functions rated four areas on a 1-5 probability scale (business model, outlook strategies, risk safeguards and policies, external context), and an overall score above 2.5 puts the risk on the Group's Risk Radar (pages 97-98).

Result: scenario effects on probability of default were "relatively limited", and climate and environmental risk was judged material in 2025 (page 98). Because the economic impact in the basic scenario was small, the Bank did not factor the estimates into its capital and liquidity adequacy assessments (page 98). Stated limits: the model is point-in-time and rests on assumptions about the speed of regulatory change, consumer preferences and technology (page 97). On adaptability, the model gives priority to a company's ability to access capital to "redeploy, upgrade or dispose of existing assets"; reskilling and portfolio reorientation need expert judgment (page 99).

Policies related to climate change mitigation and adaptation

Reference: pages 102-105.

The Environmental and Climate Policy sets how the Bank and its subsidiaries prevent, manage and, where possible, reduce climate and environmental impact, including commitments to monitor and report them (page 103). It applies to own operations, to financed and invested customers and counterparties, and to suppliers for indirect impacts. The Board issued it and the CEO approved the latest update (page 103). Two other policies are tabled: the Facility Management Procedure (page 104) and the Credit Procedure, which brings ESG factors into credit rating and supports Green, Social and Sustainability-Linked facilities (pages 104-105).

Policy content (page 102): carbon neutrality for Scope 1 and 2; measuring and managing financed emissions; exclusion of coal-fired power plants, unconventional fossil fuel extraction and unsustainable palm oil production from financing and investment. On adaptation, physical risks are built into risk management, "although a specific governance model for coordinating adaptation activities has yet to be defined" (page 103). The ESG Investment Policy and the Sustainable Supply Chain Policy are described under G1-1 (page 105).

Actions and resources in relation to climate change policies

Reference: page 106.

Mitigation actions are a 100% cloud-based model with no branches, electricity covered by Guarantees of Origin (GO), and a Car Policy that favors hybrid, plug-in hybrid and electric vehicles (page 106). At 31 December 2025 about 44% of the car fleet was electric hybrid, mild hybrid or plug-in. Staff who choose a full-electric car get a 10% discount on the rental fee, up to EUR 100 per month (page 106).

Scope 2 market-based emissions were 100 tCO2e in 2022, 97 in 2023 (the base year for the net-zero target) and 86 in 2024. In 2025 they were 167 tCO2e, "an increase of 72% compared to the base year", which the Bank attributes to a wider perimeter and methodology changes made to match the parent's method (page 106). The E1 chapter gives no CapEx or OpEx figure for these actions (pages 96-123).

Targets related to climate change mitigation and adaptation

Reference: pages 107-115.

The Climate Strategy sets zero Scope 2 market-based emissions by 2030, from a 2023 base of 96.8 tCO2e, by moving all supply contracts to Guarantees of Origin (pages 107, 113). It also sets 2030 and 2050 sector targets for the credit portfolio, stated as emission intensity of financed counterparties rather than absolute emissions (page 111). Shipping and Power carry targets; Steel, Oil & Gas and Real Estate carry limits at origination (page 111). The sector target values are not in the captured text, which appears to omit the charts (pages 107-111).

Exposure at 31 December 2025, as share of portfolio assets and share of financed emissions: Shipping 0.2% and 1.2%; Power 0.2% and 0.1%; Steel 0.01% and 0.1%; Oil & Gas 0.02% and 0.4%; Real Estate 0.2% and 0.7% (pages 108-111). No progress is recorded for Shipping and Power because no new financing went to them (pages 108-109). Scenarios: IEA Net Zero Emissions 2050 and, for Real Estate, an SBTi 1.5°C pathway for Italy built with CRREM. The Bank says this "does not imply any formal commitment to the Science Based Targets initiative" (pages 111-112). The 2023-2025 Sustainability Plan environmental targets ended on 31 December 2025 (page 115).

Energy consumption and mix

Reference: pages 115-116.

Total energy consumption was 2,406.1 MWh in 2025 (2,208.9 MWh in 2024). Fossil sources were 1,856.1 MWh, 77% of the total (66% in 2024). Renewable electricity was 550.0 MWh, 23% (34% in 2024). Nuclear and self-generated energy were zero (page 115). The Bank says the rise reflects a wider consolidation perimeter, method changes made to match Banca Ifis and the latest banking-sector guidance (page 115).

The fossil line covers the vehicle fleet and electricity not backed by Guarantees of Origin (page 115, note 18). For owned and leased properties without bill data, consumption was estimated as floor area times the energy performance index from Energy Performance Certificates (pages 115-116). Guarantees of Origin cover about 59% of energy needs (page 116). Appendix B marks the two high-climate-impact-sector energy items as N/A (page 182).

Gross Scopes 1, 2, 3 and Total GHG emissions

Reference: pages 116-122.

2025 gross emissions in tCO2e (2024 in brackets): Scope 1 384 (307); Scope 2 location-based 239 (292); Scope 2 market-based 167 (86); Scope 3 878,937 (747,843); total market-based 879,488 (748,236) (page 116). Scope 3 categories reported are 1, 2, 3, 5, 6, 7 and 15; category 15 (financed emissions) is 862,016 of the Scope 3 total (page 116). Financed emissions cover about 80% of gross assets (70% before), the portfolio carbon footprint is 131 tCO2e per EUR million (123 before), the weighted PCAF data quality score is about 3, and 46% of category 15 uses counterparty primary data (pages 117, 121).

Intensity is 1.9 thousand tCO2e per EUR million of net revenue (1.3 in 2024), on net revenues of EUR 457.7 million (page 122). Methods: GHG Protocol, ABI Lab guidelines and PCAF, with spend-based calculation for categories 1 and 2 (pages 118-119). Fleet fuel is now reported at 100%, up from 70% in 2024, to match the parent's method (pages 115, 118).

GHG removals and GHG mitigation projects financed through carbon credits

Reference: pages 122-123.

illimity "did not develop projects aimed at GHG removal or storage" in its own operations or value chain (page 122). It buys carbon credits to offset its Scope 1 and Scope 2 location-based emissions of the previous year. In 2025 it cancelled 600 Gold Standard credits, equal to 600 tCO2e (554 in 2024), on 21 May 2025 (page 123). All were from emission reduction projects, none from removals, none from projects in the EU, and none qualified as corresponding adjustments (page 123).

Projects named: Maputo Clean Cookstoves (2021), Burn Stoves Project in Kenya (2024) and Svilosa Biomass Bulgaria (2022, 2023 and 2025) (page 122). The Bank says the credits do not count toward its reduction targets, and that it "has not yet set itself targets concerning net-zero targets" (page 123).

Policies related to own workforce

Reference: pages 125-134.

Commitments sit in the Code of Ethics (illimity Way), now used alongside the Banca Ifis Group Code. They cover human rights, freedom of association, collective bargaining, and the elimination of forced labor, child labor and discrimination, citing the UN Guiding Principles, the ILO Declaration and the UN Global Compact, which illimity joined in 2021 (pages 125-126). Policies tabled with scope, owner and access: Code of Ethics, Diversity, Equity & Inclusion (DE&I) Policy, Anti-Harassment Policy, Remuneration Policy, Health & Safety procedure and Privacy Policy (pages 129-134).

The Board approves the DE&I, Anti-Harassment, Remuneration and Privacy policies. DE&I training has been mandatory for the whole workforce since 2023, and failing to complete it "will affect the annual bonus" (page 126). Health and safety follows Legislative Decree 81/08, with an employer, a prevention and protection service and workers' safety representatives (page 127).

Taking action on material impacts on own workforce

Reference: pages 137-139.

No significant negative impact was identified. Actions target positive impacts and the one workforce risk, legal proceedings over working conditions (page 137). Results from the 2023-2025 Sustainability Plan (pages 138-139): women were 24.6% of managers at 31 December 2025, up from 20.8% in 2022; the adjusted equal pay gap stayed below 5%; the UNI_PdR 125:2022 gender equality certification was kept until November 2025; the Anti-Harassment Policy has applied since 2023 with mandatory training; training reached 672 employees for 37,849 hours, 56.3 hours per employee, of which 2,971 hours (4.4 per employee) were ESG training (page 139).

Resources: about EUR 0.7 million of OpEx for the training action, with no material CapEx (page 139). Human Resources checks effectiveness, partly through the Great Place to Work survey (page 137).

Targets related to own workforce

Reference: pages 139-141.

Targets come from the 2023-2025 Sustainability Plan, approved by the Board in February 2023 and ended on 31 December 2025 (page 139). Social targets (page 140): double the number of women in management roles; keep the talent pool gender balanced and the equal pay gap within 5%; keep the engagement index above 70%; run real estate impact projects through the Foundation; keep the gender equality certification; adopt an anti-harassment policy; 42 training hours per employee, with 3 hours of ESG training; sustainable mobility awareness; assess more than 50% of goods and services spend with ESG criteria.

The Bank calls all of them measurable, with no base value, a 2022 base year and a final date of 31 December 2025 (page 140). It says the targets "are not based on firm scientific data" (page 141). The Sustainability function coordinated monitoring, reported quarterly to the Sustainability Board Committee until mid-2025 and to the Board at least annually (page 139).

Characteristics of the undertaking's employees

Reference: pages 142-143.

The Group had 672 employees at 31 December 2025: 332 women and 340 men, with none recorded as other or not disclosed (779 in 2024, a fall of 13.7%). Of these, 668 were permanent (330 women, 338 men) and 4 fixed-term (2 women, 2 men). There were no variable-hour employees. Permanent staff include apprentices (page 142).

124 employees left in 2025: 118 voluntarily, 6 dismissed, none through retirement or death. Turnover was 18.5% (10.1% in 2024), calculated as leavers divided by headcount at year-end (page 143). The regional split of headcount is on page 66.

Characteristics of non-employee workers

Reference: page 143.

The Group had 21 non-employees in its own workforce at year-end 2025 and 40 in 2024. The 21 are 10 interns and 11 workers on self-employment contracts, counted across all Group companies at 31 December 2025 (page 143). The SBM-3 section gives the same split (page 124). The section gives the headcount and these two categories only.

Collective bargaining coverage and social dialogue

Reference: pages 143-144.

All employees are covered by national collective bargaining agreements: 100% in both 2025 and 2024. illimity Bank and Fürstenberg SGR fall under the agreement for middle managers and staff in professional areas of credit, financial and instrumental companies. ARECneprix, Abilio, Quimmo Agency and Quimmo Prestige Agency fall under the Supplementary Credit Agreement (page 143). Workers' representatives also cover 100% of employees (page 143).

Italy is the only country in the coverage table, in the 80-100% band for both collective bargaining coverage and workplace representation (page 144). The Group has no agreement for a European Works Council or similar body (page 144).

Diversity metrics

Reference: pages 144-145.

Senior management is defined as the first line reporting to the CEO of illimity Bank, seven people in both years: 1 woman (14.3%) and 6 men (85.7%) in 2025 and 2024 (page 144).

Employees by age at 31 December 2025 (2024 in brackets): under 30, 81 or 12.1% (115, 14.8%); 30 to 50, 516 or 76.8% (591, 75.9%); over 50, 75 or 11.2% (73, 9.4%). Total 672 (779) (page 145).

Adequate wages

Reference: page 145.

The statement says all Group employees receive a "fair and adequate wage", set against applicable benchmarks and in line with current regulations. It gives no figures: no adequate wage benchmark is named and no count of employees below one is shown (page 145). Collective bargaining coverage is 100% (page 143).

Social protection

Reference: page 145.

The statement says all Group employees have social protection coverage for illness, unemployment, occupational injury and disability, leave and retirement, "as also envisaged by national legislation" (page 145). No breakdown by country, employee group or type of coverage is given.

Persons with disabilities

Reference: pages 145-146.

21 employees are persons with disabilities, 3.1% of the total (26, 3.3% in 2024): 13 women (1.9%) and 8 men (1.2%) (page 145). In 2024 the figures were 15 women (1.9%) and 11 men (1.4%). The count covers 20 workers with civilian invalidity and 1 employed under Article 18 of Law 68/99, as at 31 December 2025 (page 146).

Training and skills development metrics

Reference: page 146.

Performance and career reviews reached 99.6% of eligible employees (98.7% in 2024): 99.7% of women (99.2%) and 99.4% of men (98.3%). Eligible means hired by 1 October 2025 (page 146).

Average training was 56 hours per employee (51 in 2024): 66 hours for women (49) and 47 for men (53). The figure is total training hours divided by employees at 31 December 2025 (page 146).

Health and safety metrics

Reference: pages 146-147.

100% of own workers are covered by the health and safety management system (page 146). There were 4 recordable work-related injuries among employees in 2025 (3 in 2024) and none among non-employees; the rate was 3.7 per million hours worked (4.3 in 2024). There were no recordable work-related illnesses and no work-related deaths in either year (page 147).

Days lost were 2,030 in 2025 against 130 in 2024. The Bank says the two are not comparable: 2025 counts all illness, including cases not related to work, and 109 of the 2025 days came from work-related injuries, including travel to and from work (page 147, note 27). The absenteeism rate was 1.2% of 166,753 working days (page 147).

Work-life balance metrics

Reference: page 147.

All employees are entitled to family leave. In 2025, 72 employees took it (55 women and 17 men), 10.7% of employees against 12.3% in 2024. By gender: women 16.6% (17.9%) and men 5.0% (7.5%) (page 147).

Compensation metrics (pay gap and total compensation)

Reference: page 148.

The unadjusted gender pay gap was 33.2% in 2025 (37.3% in 2024): the difference between the average gross hourly wage of men and of women, relative to men's average. The Bank notes that it compares non-homogeneous categories and ignores same-job or equal-value comparisons (page 148). Separately it reports an adjusted equal pay gap below 5% (page 139).

The ratio of the highest-paid person's total annual remuneration to the median of all other employees was 13.1 (23.1 in 2024) (page 148).

Incidents, complaints and severe human rights impacts

Reference: pages 148-149.

No incidents of discrimination, including harassment, were recorded in 2025 (1 in 2024). That 2024 case was reported late in 2024, and concluded in 2025 with a conciliation agreement (page 148, note 28). Two reports came through whistleblowing channels in 2025: one from the first half, with the investigation concluded and no payments made, and one from the second half about an episode of verbal harassment, which the Bank says is not discrimination in the legal sense and which was still under investigation at year-end (page 148). No complaints went to OECD National Contact Points, and fines and compensation were EUR 0 (page 148).

There were no serious human rights incidents involving the own workforce, no cases of non-respect of the UN Guiding Principles, the ILO Declaration or the OECD guidelines, and no fines (page 149).

Policies related to affected communities

Reference: pages 151-152.

The Bank defines its affected communities as communities of individuals and businesses in Italy (page 151). It commits to the UN Guiding Principles, the ILO Declaration and the OECD Guidelines for Multinational Enterprises (page 151). The policy areas cited are protection against discrimination, child and forced labor, wage and gender equality, and safe working conditions. The existing policy is the Code of Ethics, described under S1-1 (page 152).

Safeguards are ESG due diligence on counterparties and publicly accessible whistleblowing channels (page 151). Dialogue includes work on SME development, such as Open-es, and surveys of SMEs and households, including non-customers (page 152). The Bank reports that no cases of non-compliance with these principles were found in its own operations or up and down the value chain in the period (page 152).

Taking action on material impacts on affected communities

Reference: pages 153-154.

In 2025 the Bank supported fondazione illimity, which it does not control and which sits outside both the illimity and Banca Ifis groups, through funding and donated real estate from guarantees on non-performing loans (page 153). Through "Make it Double" the Bank matches employee donations to the Foundation (page 153).

Projects active at end-2025: Albergo Etico Cesenatico, a hotel where young people with disabilities train; (RE)GENERATION CAMP in Rome, with an average of 18 participants per workshop against a capacity of 20; Barrio21 in Catania, co-housing for 5 young care leavers in 2 apartments; and H EDU in Treviso, an education and counseling center that opened on 1 March 2025 (pages 153-154). Resources: about EUR 0.2 million of OpEx and no material CapEx (page 154). No serious human rights incidents emerged in the affected communities (page 153).

Targets related to managing material negative impacts, advancing positive impacts, and managing material risks and opportunities

Reference: pages 154-155.

The priority target is the development of social impact projects in Real Estate through the Foundation, set first in the 2021-2025 Strategic Plan and then in the 2023-2025 Sustainability Plan (page 155). It has no base value, a base year of 2022, a five-year horizon of 2021-2025 and a final date of 31 December 2025 (page 155).

Progress was tracked through the ESG Tableau de Bord (page 155). With the Sustainability Plan concluded, a retrospective review took place in 2025, and the parent applied its own social impact measurement method to the projects (page 155). The Bank says the target "is not based on fixed scientific data" (page 155).

Policies related to consumers and end-users

Reference: pages 156-159.

Consumers and end-users are retail customers (consumers, sole traders and micro-enterprises) and corporate customers (large businesses and SMEs) (page 156). The Bank commits to the Universal Declaration of Human Rights and the UN Global Compact, which it joined in 2021, and excludes certain sectors from credit and investment after checks on counterparties (page 156).

Policies tabled with owner, scope and access: ICT Security Policy (page 158), Transparency of Banking and Financial Operations and Services Policy (pages 158-159) and Complaints Management Policy (page 159). The Code of Ethics, the Privacy Policy and the Credit Procedure also apply (page 159). The Bank states that it found no breaches of the UN Global Compact principles or the OECD Guidelines affecting consumers and end-users in the value chain (page 157).

Taking action on material impacts on consumers and end-users, and approaches to managing material risks and pursuing material opportunities related to consumers and end-users, and effectiveness of those actions

Reference: pages 162-165.

Three impacts are covered (page 162): customer satisfaction (positive), SME credit access (positive), and a potential digital divide for disadvantaged users (negative). For the digital divide the Bank uses the "Accessibility" project and monitors accessibility reports to Smart Care (pages 162-163). Mitigation for the three risks covers data breach (IT security, breach protocols, GDPR and DORA safeguards), market-integrity compliance (transparency rules, market abuse monitoring) and reputational risk (communication controls ending with Compliance & AFC and Legal) (page 163). The two opportunities rest on the Privacy Policy and the Data Protection Officer, and on transparent communication guidelines (pages 163-164).

The Bank found no serious problems or human rights incidents tied to consumers and end-users through its complaints channel and the Data Protection Officer (page 164). It says "no specific resources were dedicated exclusively" to these topics (page 165).

Targets related to managing material negative impacts, advancing positive impacts, and managing material risks and opportunities

Reference: pages 166-169.

Three targets from the 2023-2025 Sustainability Plan apply (pages 166-167): develop the sustainable finance product offer and framework; develop ESG support and advisory services for SMEs; and reach 15% of cumulative 2023-2025 origination for sustainable finance. The Bank says the first two have no level to reach, and the third a 15% level (page 168). All have no base value, a 2022 base year and a final date of 31 December 2025 (page 168).

Results: the Green, Social & Sustainability-linked Loan Framework was finished in the third quarter of 2023 (page 168); Open-es advisory services ran in 2023-2024, with an SME survey (page 169); and ESG-linked financings and investments totaled EUR 398 million, shown against total cumulative net origination for 2023-2025 (page 169). The Bank puts the achieved share at 13.4% (page 67, note 9). It says the targets "are not based on firm scientific data" (page 168).

Business conduct policies and corporate culture

Reference: pages 170-176.

The Bank relies on a Code of Ethics and an Organisational, Management and Control Model under Legislative Decree 231/2001, overseen by a Supervisory Board (page 170). Whistleblowing follows Legislative Decree 24/2023 for illimity Bank, ARECneprix, Abilio and Fürstenberg SGR, with investigations that must be prompt and impartial and a result within three months (pages 171-172). The 2025 training plan covered anti-money laundering, anti-corruption and the Legislative Decree 231 liability regime (page 171). The Anti-Corruption Policy lists 18 sensitive processes, such as gifts, procurement and relations with public officials (page 171).

Policies tabled: the Model, the Anti-Corruption Policy (which adheres to ISO 37001:2016), the Whistleblowing Policy, the ESG Investment Policy (corporate finance) and the Sustainable Supply Chain Policy (pages 172-176).

Targets related to business conduct

Back-filled from the business conduct chapter, where targets are addressed as part of the MDR-T/GDR-T disclosures rather than as a numbered disclosure requirement. G1-3 became a standalone DR only in the 2025/2026 ESRS.

The G1 chapter has no target table. Targets that bear on business conduct sit in the 2023-2025 Sustainability Plan: anti-corruption certification (ISO 37001) and compliance certification (ISO 37301) (page 68), and at least 50% of spending on ESG-rated suppliers by 2025 from 30% in 2022, with a result of 57% of supplies assessed, corresponding to 85% of spending commitments to relevant suppliers (page 179). The Bank says the plan's targets were "all understood as having been achieved", and notes that ISO 37301 "was limited to preparatory activities" (pages 67-68).

Tracking: training on whistleblowing for 100% of staff in 2024 and new hires in 2025, Code of Ethics training for 100% in 2023 and new hires in 2024 and 2025, and 85 active ESG Ambassadors (page 179).

Incidents of corruption or bribery

Reference: page 181.

During 2025, "there were no proven incidents of corruption and no public lawsuits concerning corruption were filed against the illimity organisation or against its employees" (page 181). Appendix B points the G1-4 datapoints on fines for breaches of anti-corruption and anti-bribery laws and on anti-corruption standards to this section (page 183).

Payment practices

Reference: page 178.

The average time to pay invoices due in 2025 was about 37 days from the invoice date (page 178). The standard term is a 60-day transfer at the end of the month of the invoice date, though specific agreements can differ. 48% of payments met the deadlines on the invoices, which the Bank says was influenced by a methodology change and by supplier due diligence during integration into the Banca Ifis Group (page 178). There are no known legal proceedings over non-payment or late payment (page 178).

The calculation covers all invoices paid by each Group company in 2025, from Italian, EU and non-EU suppliers. It excludes intra-group invoices, suppliers that are natural persons or flat-rate or withholding-tax suppliers, transfers and credit notes (page 178).