I. Assessment of the Supervisory Board of mBank S.A. on the situation of the bank from the consolidation perspective, with consideration of the adequacy and effectiveness of the internal control system, the risk management system, the system for ensuring compliance of the bank’s business with standards or applicable practices, and the internal audit system operating at the bank

1. mBank Group activity in 2025

The Supervisory Board analysed mBank Group’s financial results and key performance indicators, taking into consideration both external and internal factors.

Throughout 2025, Poland was among the fastest growing economies in the European Union (EU). According to preliminary estimates from Statistics Poland (GUS), Poland’s GDP growth rate reached 3.6% versus 3.0% in 2024. GDP growth was mainly driven by consumer demand and investment recovery. Private consumption growth was supported by a strong labour market and rising real wages, while investments were driven by inflows of EU funds.

Inflation slowed from 4.9% in early 2025 to 2.4% in December, as pressure from high electricity, gas and fuel prices faded. In the face of weakening inflation, the Monetary Policy Council (RPP) gradually eased the monetary policy, delivering six interest rate cuts. As a result, the NBP reference rate decreased by 175 basis points, reaching 4.00% at the end of 2025. This favoured an increase in lending activity across the banking sector.

In 2025, mBank's Supervisory Board regularly reviewed the Management Board's reports and analysed materials addressing the main areas relevant to assessing the company’s position. It approved the mBank Group's Strategy for 2026–2030 and supported the Management Board in implementing business and organisational initiatives aimed at creating optimal conditions for the Group's continued development.

2025 was the final year of mBank Group’s strategy for 2021–2025 “From the Icon of Mobility to the Icon of Possibilities”. The successful implementation of its key initiatives, grouped into five strategic blocks, has further strengthened mBank's position among the leading banks in Poland in terms of business growth and key financial indicators. The Group successfully surpassed its strategic goals in the area of operational efficiency, stability, growth rate and profitability.

In 2025, mBank Group’s income reached an all-time high of PLN 12.47 billion, which represents a 3.8% increase on 2024.

This robust performance was predominantly driven by net interest income (+4.5% year on year) and net fee and commission income (+12.0% year on year).

The Supervisory Board appreciates the Management Board's effectiveness in managing net interest income amid a declining interest rate environment. The decline in the net interest margin from 4.35% in 2024 to 4.05% in 2025, driven by interest rate cuts, was significantly mitigated through adjustments to the loan and deposit offering in response to changing market conditions as well as through balance sheet structure optimisations and hedging transactions.

The increase in net fee and commission income resulted mainly from a growing base of active clients, higher number of transactions, robust sales of financial and investment products, broader range of insurance products and other services related to accounts and loans. The result was also supported by one ‑ off income from new agreements extending the bancassurance cooperation with UNIQA and from settlements with the card organization.

The Group’s total costs in 2025 grew by 14,2% along with the rising scale of business and employment, higher contributions to the Bank Guarantee Fund (BFG) and further investments in strategic growth areas and IT. At the same time, mBank stood out in the sector for its remarkably high cost efficiency, measured by a cost-to-income (C/I) ratio at the consolidated level of 31.0%.

The cost of legal risk associated with foreign currency mortgages in 2025 was PLN 2.04 billion compared with PLN 4.31 billion in 2024. Throughout 2025, each quarter brought a decline in the number of new lawsuits, the number of ongoing court proceedings, and consequently the value of newly created provisions. In 2025, mBank concluded 10.5 thousand settlements with borrowers, and the total number of signed settlements reached 33.4 thousand, of which 32.4 thousand concerned Swiss ‑ franc ‑ denominated loans. At the end of 2025, the number of active Swiss franc loan agreements (5,952) was 93% lower compared to the initial number of contracts.

The mBank Group’s gross profit for 2025 amounted to PLN 5.02 billion, representing an increase of PLN 2.05 billion (68.8%) compared to the previous year.

In 2025, the Group posted a net profit of PLN 3.54 billion versus PLN 2.24 billion in 2024 (+58.0% year on year). Return on equity (ROE) stood at 17.9%, return on tangible equity (ROTE) at 20.8% and return on assets (ROA) at 1.4%, which proves mBank's outstanding ability to create shareholder value.

The year 2025 was marked by expanding business volumes. The Group’s gross loan portfolio reached PLN 136.77 billion as at December 31, 2025, representing a 9.4% increase compared with 2024. Amounts due to clients stood at PLN 229.15 billion, up 14,1% year on year, driven primarily by inflows into current accounts. In 2025, mBank increased its market share in total loans and total deposits. Loans to individual clients – both mortgage and non ‑ mortgage – as well as retail deposits grew at a pace that clearly exceeded the market.

mBank Group’s liquidity position is comfortable, as demonstrated by high LCR and NSFR and a net loans- to-deposits ratio of 58.1% as at December 31, 2025.

The Group maintains robust buffers in relation to the minimum requirement for own funds and eligible liabilities (MREL). In 2025, mBank issued senior non-preferred bonds under the EMTN Programme with a total nominal value of EUR 500 million. The issue attracted very strong investor demand, with the order book exceeding EUR 4.3 billion, corresponding to 8.8 ‑ times oversubscription. The proceeds were allocated to purposes aligned with the mBank Group’s Green Bond Framework.

The Supervisory Board gladly acknowledged the continued strengthening of the Group's capital base. Key contributors included the retention of earnings in accordance with the mBank Group's capital management strategy approved by the Supervisory Board and the issuance of EUR 400 million in Tier 2 subordinated bonds. This marked the first public issue of euro-denominated Tier 2 bonds in the Polish banking sector. Moreover, in 2025 the Bank carried out a securitisation transaction involving a portfolio of Project Finance corporate loans worth a total of PLN 3.8 billion and exercised a ramp-up option in a transaction signed in 2024, increasing the nominal value of the securitised portfolio from PLN 5.2 billion to PLN 7.0 billion.

As at December 31, 2025, the consolidated T1 capital ratio reached 14.4%, while the Total Capital Ratio (TCR) was 16.3%. The buffer above the minimum requirements set by the Polish Financial Supervision Authority (KNF) amounted to 4.3 percentage points.

The Supervisory Board welcomed the news that three global rating agencies, S&P Global Ratings, Moody's and Fitch Ratings, upgraded mBank's ratings in 2025 in recognition of its significant progress in mitigating the risk of CHF loans, improving profitability and strengthening the capital base.

In September 2025, the Supervisory Board approved the mBank Group Strategy for 2026–2030 “Full Speed Ahead!”. The strategy sets ambitious directions for further development with a focus on growth, innovation and profitability following a period of intensive restructuring of the foreign currency loan portfolio. It was well received by the market, encompassing plans for dynamic growth, enhanced client engagement, market share expansion, a return to dividend payments and the adoption of technological innovations.

Following the announcement of its new strategy, the Bank unveiled its Transition Plan, which sets specific goals and actions in the area of climate neutrality and sustainable financing. mBank is the first bank in

In 2025, mBank was the first banking institution in Poland to completely overhaul its central systems, moving them to modern technology platforms. The Supervisory Board considers the replatforming as a solid foundation for further growth, improved safety, lower costs and a new competitive advantage. Simultaneously, the Bank continued to digitalise and modernise its processes and develop its product range. It introduced, among others, a payment ring with health and activity tracking features (smart ring), a multi-currency Visa Travel payment card, new payment options within the mZakupy service in the mobile app, a package of retirement solutions, and launched a digital mortgage.

In summary, the Supervisory Board’s assessment of the overall economic and financial standing of mBank is positive. The Bank meets all the requirements for safe operation, capital adequacy and liquidity, whereas the conditions presented above allow the Supervisory Board to be optimistic about the Group's prospects for further development.

2. Assessment of the adequacy and effectiveness of the company’s system of internal control, risk management, compliance with standards or applicable practices and internal audit

The Bank’s risk management system and internal control system are organised on three independent levels – lines of defence.

The internal control system supports the management of the Bank by contributing to ensuring the effectiveness and efficiency of the Bank’s operations, the reliability of financial reporting, compliance with risk management principles, and the Bank’s compliance with laws and internal regulations.

The internal control system includes:

1. The control function which aims to ensure compliance with control mechanisms relating in particular to risk management in the Bank, which includes positions, groups of people or organisational units responsible for the performance of tasks assigned to this function. The function is carried out in a systematic manner by employees at all organisational levels by means of:

■ continuous monitoring, consisting of the examination of selected operations or activities performed at the Bank,

■ periodic verification, consisting of an examination of selected operations or activities already completed in order to check the adequacy and effectiveness of the continuous monitoring.

2. The compliance function which is responsible for identifying, assessing, controlling and monitoring the risk of non-compliance of the Bank’s operations with the law, internal regulations and market standards, as well as for presenting reports in this respect. The tasks of the compliance function are performed by the Compliance Department.

3. An independent internal audit function which aims to examine and assess, in an independent and objective manner, the adequacy and effectiveness of the risk management system and the internal control system. The tasks of the independent internal audit function are performed by the Internal Audit Department.

The Audit Committee provides the Supervisory Board with its opinion on the assessment of the internal control system based on information from the Bank’s Management Board on the functioning of the internal control system, reports on the effectiveness of the control function, significant and critical irregularities and the status of recovery plans, reports on compliance risk management, the assessment from an internal audit perspective, as well as the results of audits. The Committee takes into account in its opinion information from the parent company, subsidiaries, the auditor, supervisory institutions (e.g., the Polish Financial Supervision Authority), as well as from other third parties. The Committee assesses the performance of the Compliance Department and the Internal Audit Department on the basis of annual activity reports presented directly by the Directors of the Compliance and Internal Audit Departments.

The Directors of the Compliance Department and the Internal Audit Department took measures on an on-going basis to ensure that adequate human resources and the necessary financial resources were available to systematically improve the qualifications, experience and skills of the staff of those units.

Based on the information received in 2025, the Supervisory Board assesses the adequacy and effectiveness of the internal control system (including the control function, the compliance function, and the internal audit function) in relation to the complexity of the Bank’s activities, organisational structure, and risk management system as fair. As part of the assessment of the internal control system, on the basis of an opinion of the Audit Committee, the Supervisory Board identified the strengths of the system and areas for further improvement. The Supervisory Board assessed that the units responsible for the control function, compliance risk management, and internal audit carried out their tasks in accordance with the internal regulations on a continuous basis, and that the Bank’s Management Board and Audit Committee, as well as the Supervisory Board, received adequate reports and information on the effects of such activities. The independence of the Compliance Department and the Internal Audit Department was ensured as defined in the Rules of the Compliance Department and the Audit Charter, respectively. In performing their duties, employees of those units performed their activities with independence and objectivity, did not execute processes which were subject to their controls, and did not engage in activities which could give rise to a conflict of interest with their duties.

The mBank Group’s risk management system is based on the concept of three lines of defence.

The Bank has in place risk committees for each business line: the Retail Banking Risk Committee, the Corporate and Investment Banking Risk Committee, and the Financial Markets Risk Committee, which define the risk management principles and determine the risk appetite of the business line. Risks are also an important focus of the work of other committees in the Bank chaired by members of the Management Board.

The Bank has in place methodologies and processes where risks are identified and assessed to determine their potential impact on current and future operations. The comprehensive risk management structure is complemented by a consistent system for monitoring and reporting risk levels and breaches of limits set. The reporting system covers the key management levels.

The Supervisory Board receives periodic reports presenting an assessment of the level of risk identified and the effectiveness of the actions taken by the Management Board. In matters of risk, the Supervisory Board acts through the Risk Committee, which exercises on-going oversight of individual risks, in particular credit risk (including concentration risk), market risk, operational risk, liquidity risk, reputation risk, and business risk. The Committee makes recommendations on significant exposures with single business entity risk.