This document is a free translation of the Polish original. Terminology current

in Anglo-Saxon countries has been used where practicable for the purposes

of this translation in order to aid understanding. The binding Polish original

should be referred to in matters of interpretation.

Independent Auditor's Report

To the General Shareholders’ Meeting and Supervisory Board of Bank Millennium S.A.

Report on the Audit of the Annual Consolidated Financial Statements

Opinion

We have audited the accompanying annual consolidated financial statements of Bank Millennium S.A. Group (the “Group”), whose parent entity is Bank Millennium S.A. (the “Parent Entity”), which comprise:

•      the consolidated statement of financial position as at 31 December 2025;

and, for the period from 1 January to 31 December 2025:

•      the consolidated statement of profit or loss;

•      the consolidated statement of comprehensive income;

•      the consolidated statement of changes in equity;

•      the consolidated statement of cash flows;

and

•      explanatory notes to the consolidated financial statements containing a description of the accounting policies adopted and other explanatory information

(the “consolidated financial statements”).

In our opinion, the accompanying consolidated financial statements of the Group:

•      give a true and fair view of the consolidated financial position of the Group as at 31 December 2025 and of its consolidated financial performance and its consolidated cash flows for the financial year then ended in accordance with International Financial Reporting Standards, as adopted by the European Union (“IFRS EU”) and the adopted accounting policy;

•      comply, in all material respects, with regard to form and content, with applicable laws and regulations and the provisions of the Parent Entity's articles of association.

Our audit opinion on the consolidated financial statements is consistent with our report to the Audit Committee dated 27 February 2026.

Basis for Opinion

We conducted our audit in accordance with:

•      International Standards on Auditing as adopted by the National Council of Statutory Auditors and the Council of Polish Agency for Audit Oversight as National Standards on Auditing (the “NSA”); and

•      the act on statutory auditors, audit firms and public oversight dated 11 May 2017 (the “Act on statutory auditors”);

•      regulation (EU) No 537/2014 of the European Parliament and of the Council of 16 April 2014 on specific requirements regarding statutory audit of public-interest entities and repealing Commission Decision 2005/909/EC (the “EU Regulation”); and

•      other applicable laws and regulations.

Our responsibilities under those standards and regulations are further described in the Auditor’s Responsibility for the Audit of the Consolidated Financial Statements section of our report.

We believe that the audit evidence we have obtained is sufficient and appropriate to provide a basis for our opinion.

Independence and Ethics

We are independent of the Group in accordance with the “Handbook of the International Code of Ethics for Professional Accountants (including International Independence Standards)” (“Code of Ethics”) as adopted by the resolution of the National Council of Statutory Auditors („NCSA”), together with the ethical requirements that are relevant to audits of consolidated financial statements of public interest entities in Poland. We have also fulfilled our other ethical responsibilities in accordance with these requirements and the Code of Ethics. During our audit the key statutory auditor and the audit firm remained independent of the Group in accordance with requirements of the Act on statutory auditors and the EU Regulation.

Key Audit Matters

Key audit matters are those matters that, in our professional judgment, were of most significance in our audit of the consolidated financial statements of the current period. They are the most significant assessed risks of material misstatements, including those due to fraud. Key audit matters were addressed in the context of our audit of the consolidated financial statements as a whole, and in forming our opinion thereon we have summarised our response to those risks. We do not provide a separate opinion on these matters. We have determined the following key audit matters:

Losses on disputed cases arising from CHF mortgages loans

Net carrying amount of the CHF loan portfolio as at December 31, 2025: PLN 707,8 million, (December 31, 2024: PLN 1 306,7 million). Total amount of adjustments reducing the gross carrying amount of CHF loans and legal risk provisions as at December 31, 2025: PLN 7 113,5 million (December 31, 2024:PLN 8 463,7 million). Legal risk provisions recognized in 2025: PLN 2 037,4 million (2024: PLN 2 179,1 million). Reference to the consolidated FS: Section 7.4 (including „Impact of legal risk on foreign currency mortgages”), Section 13, Section 14: note 14.

Key audit matter

Our response

In the past, the Group has granted mortgage loans denominated or indexed to CHF ("CHF loans") to individual clients. Due to numerous lawsuits concerning contractual clauses and the case law established in Poland in recent years, the legal risk associated with CHF loans has a significant impact on the financial statements – both through the provision for legal risk and through the way the effects of expected court verdicts/settlements are recognised in the forecasted cash flows from loan agreements. Determining the level of recognised adjustments and the provision requires significant judgements, in particular as regards: -       the number of new lawsuits, -       settlement costs, including statutory interest, which are dependent on the timing of cash outflows. Due to the scale of the amounts included and the significant judgment of the management board in the key assumptions, we considered this area to be a key audit matter.

Our audit procedures performed included i.a: •      assessment of the methodology for estimating the financial effects of the legal risk related to CHF loans, as well as the accounting policy in this area; •      testing on a sample basis of key parameters (e.g. status, date of the lawsuit) to the source documentation of the legal function and system reports, and for selected information – analysis of information from external law firms in order to assess the completeness of the approach and the correctness of the classification of cases; •      assessing on a sample basis the accuracy of the key data used in the calculations (balance) by reconciling them with the Group’s IT systems and source documentation; •      assessment of the most significant assumptions by comparing them with historical data and current cost performance; •      for the selected sample, verification of final court verdicts and settlements; •      assessment of the completeness and adequacy of the disclosures in the consolidated financial statements required by the relevant financial reporting standards.

Expected credit losses for loans and advances to customers

Loans and advances to customers (amortized cost) – net carrying amount as of December 31, 2025: PLN 76 415,2 million (December 31, 2024: PLN 74 863,0 million). Result from impairment of these exposures in 2025: PLN 228,9 million (2024: PLN 304,5 million). Provisions for financial commitments and guarantees as of December 31, 2025: PLN 105,4 million (December 31, 2024: PLN 53,6 million). Reference to the consolidated FS: Section 7.4 (including „Impairment of loans and advances”), section 14: note12, note 22, note 37.

Key audit matter

Our response

In accordance with IFRS 9, the determination of expected credit losses includes (i) the identification of a significant increase in credit risk (SICR) and impairment indicators, and then (ii) the measurement of ECL over a 12-month horizon or over the lifetime of the exposure. This estimate depends on the selection of data and model parameters (i.a. PD, LGD, EAD), thresholds and criteria for allocation to stages (SICR), as well as adopted macroeconomic scenarios and their weights. For exposures for which expected credit losses are estimated individually, assumptions about recovery scenarios, collateral valuation and forecasted cash flow dates have a material impact. Due to the size of the portfolio and the significant judgment of the management board in key assumptions, we considered this area to be a key audit matter.

With the support of our financial risk specialists and IT specialists, we have focused on the following key procedures: •     we assessed the design and implementation of internal controls and tested the operating effectiveness of selected controls regarding: (i)            completeness and accuracy of the input data for ECL models; (ii)           allocation of the exposures to stages (including SICR), and (iii)          calculating expected credit losses, including selected controls in the IT environment; •     on a sample basis, we verified to the source systems the key data used in the process of calculation; •     on a sample basis, we analysed the SICR criteria applied and selected impairment indicators; •     we recalculated selected key elements of the calculation for relevant models, assessed the consistency of the methodology with IFRS 9, evaluated the main assumptions, including macroeconomic scenarios, and recalculated expected credit losses based on a sample of exposures; •     we assessed on a selected sample of significant exposures, by analysing the recovery scenarios adopted, the values of recoveries from collateral, and the timing of expected cash flows; •     we assessed the completeness and adequacy of the disclosures in consolidated financial statements required by the relevant financial reporting standards.

Other Matter

The consolidated financial statements of the Group as at and for the year ended 31 December 2024 were audited by another auditor who expressed an unmodified opinion on those financial statements on 24 February 2025.

Responsibility of the Management Board and Supervisory Board of the Parent Entity for the Consolidated Financial Statements

The Management Board of the Parent Entity is responsible for the preparation of the consolidated financial statements that give a true and fair view in accordance with IFRS EU, the adopted accounting policy, the applicable laws and regulations and the provisions of the Parent Entity's articles of association and for such internal control as the Management Board of the Parent Entity determines is necessary to enable the preparation of consolidated financial statements that are free from material misstatement, whether due to fraud or error.

In preparing the consolidated financial statements, the Management Board of the Parent Entity is responsible for assessing the Group's ability to continue as a going concern, disclosing, as applicable, matters related to going concern and using the going concern basis of accounting unless the Management Board of the Parent Entity either intends to liquidate the Group or to cease operations, or has no realistic alternative but to do so.

According to the accounting act dated 29 September 1994 (the “Accounting Act”), the Management Board and members of the Supervisory Board of the Parent Entity are required to ensure that the consolidated financial statements are in compliance with the requirements set forth in the Accounting Act. Members of the Supervisory Board of the Parent Entity are responsible for overseeing the Group’s financial reporting process.

Auditor’s Responsibility for the Audit of the Consolidated Financial Statements

Our objectives are to obtain reasonable assurance about whether the consolidated financial statements as a whole are free from material misstatement, whether due to fraud or error, and to issue an auditors’ report that includes our opinion. Reasonable assurance is a high level of assurance, but is not a guarantee that an audit conducted in accordance with NSAs will always detect a material misstatement when it exists. Misstatements can arise from fraud or error and are considered material if, individually or in the aggregate, they could reasonably be expected to influence the economic decisions of users taken on the basis of these consolidated financial statements.

The scope of audit does not include assurance on the future viability of the Group or on the efficiency or effectiveness with which the Management Board of the Parent Entity has conducted or will conduct the affairs of the Group.

As part of an audit in accordance with NSAs, we exercise professional judgment and maintain professional scepticism throughout the audit. We also:

•      identify and assess the risks of material misstatement of the consolidated financial statements, whether due to fraud or error, design and perform audit procedures responsive to those risks, and obtain audit evidence that is sufficient and appropriate to provide a basis for our opinion. The risk of not detecting a material misstatement resulting from fraud is higher than for one resulting from error, as fraud may involve collusion, forgery, intentional omissions, misrepresentations, or the override of internal control;

•      obtain an understanding of internal control relevant to the audit in order to design audit procedures that are appropriate in the circumstances, but not for the purpose of expressing an opinion on the effectiveness of the Group's internal control;

•      evaluate the appropriateness of accounting policies used and the reasonableness of accounting estimates and related disclosures made by the Management Board of the Parent Entity;

•      conclude on the appropriateness of the Management Board of the Parent Entity’s use of the going concern basis of accounting and, based on the audit evidence obtained, whether a material uncertainty exists related to events or conditions that may cast significant doubt on the Group’s ability to continue as a going concern. If we conclude that a material uncertainty exists, we are required to

draw attention in our auditors’ report on the audit of the consolidated financial statements to the related disclosures in the consolidated financial statements or, if such disclosures are inadequate, to modify our opinion. Our conclusions are based on the audit evidence obtained up to the date of our auditors’ report on the audit of the consolidated financial statements. However, future events or conditions may cause the Group to cease to continue as a going concern;

•      evaluate the overall presentation, structure and content of the consolidated financial statements, including the disclosures, and whether the consolidated financial statements represent the underlying transactions and events in a manner that achieves fair presentation.

•      obtain sufficient appropriate audit evidence regarding the financial information of the entities or business activities within the Group to express an opinion on the consolidated financial statements. We are responsible for the direction, supervision and performance of the group audit. We remain solely responsible for our audit opinion.

We communicate with the Audit Committee of the Parent Entity regarding, among other matters, the planned scope and timing of the audit and significant audit findings, including any significant deficiencies in internal control that we identify during our audit.

We provide the Audit Committee of the Parent Entity with a statement that we have complied with relevant ethical requirements regarding independence, and communicate with them all relationships and other matters that may reasonably be thought to bear on our independence, and where applicable, actions taken to eliminate threats or safeguards applied.

From the matters communicated with the Audit Committee of the Parent Entity, we determine those matters that were of most significance in the audit of the consolidated financial statements of the current reporting period and are therefore the key audit matters. We describe these matters in our auditors’ report on the audit of the consolidated financial statements unless law or regulation precludes public disclosure about the matter or when, in extremely rare circumstances, we determine that a matter should not be communicated in our report because the adverse consequences of doing so would reasonably be expected to outweigh the public interest benefits of such communication.

Other Information

The other information comprises:

•      the selected financial data,

•      the Management Board Report on the activity of Bank Millennium S.A. and Capital Group of Bank Millennium S.A. for the year ended 31 December 2025 (the “report on activities”), including the corporate governance statement and the sustainability reporting, the letter of the President of the Management Board, the statement of the Management Board regarding the preparation of the consolidated financial statements and report on activities, the Management Board’s information regarding the appointment of the audit firm for the audit of the consolidated financial statements, the Management Board’s information regarding the appointment of the audit firm for the attestation of the sustainability reporting, which are separate parts of the report on activities,

•      the statement of the Supervisory Board regarding the Audit Committee,

•      the Supervisory Board's assessment of the combined report of the Management Board on the activities of Bank Millennium S.A. and the Bank Millennium S.A. Capital Group, as well as the financial statements of Bank Millennium S.A. and the Bank Millennium S.A. Capital Group,

•      the assurance report on the sustainability reporting of the Group,

(together the “other information”).

The Management Board of the Parent Entity is responsible for the other information.

The Management Board and members of the Supervisory Board of the Parent Entity are required to ensure that the report on activities, including its separate parts, is in compliance with the requirements set forth in the Accounting Act.

Our opinion on the consolidated financial statements does not cover the other information. With regard to the sustainability reporting, which constitutes a separate part of the report on activities, another auditor on behalf of our audit firm performed an assurance engagement, the results of which were presented in a separate assurance report with an unmodified opinion, which is included as part of the other information.

In connection with our audit of the consolidated financial statements, our responsibility is to read the other information and, in doing so, consider whether the other information is materially inconsistent with the consolidated financial statements or our knowledge obtained in the audit, or otherwise appears to be materially misstated. If, based on the work we have performed, we conclude that there is a material misstatement in the other information, we are required to report that fact. We have nothing to report in this regard.

Additional Matters to be Reported under the Act on Statutory Auditors

In accordance with the Act on statutory auditors our responsibility is to opine on whether the report on activities, excluding the sustainability reporting, was prepared in accordance with applicable laws and regulations and the information given in the report on activities is consistent with the consolidated financial statements.

Moreover, in accordance with the requirements of the Act on statutory auditors our responsibility is to opine on whether the Group included in the statement on corporate governance the information required by the applicable laws and regulations, and in relation to specific information indicated in those laws or regulations, to determine whether it complies with the applicable laws and regulations and is consistent with the consolidated financial statements.

Opinion on the Report on Activities

Based on the work undertaken in the course of our audit of the consolidated financial statements, in our opinion, the accompanying report on activities, excluding the sustainability reporting, in all material respects:

•      has been prepared in accordance with applicable laws and regulations, and

•      is consistent with the consolidated financial statements.

Opinion on the Statement on Corporate Governance

In our opinion, the corporate governance statement, which is a separate part of the report on activities, includes the information required by paragraph 70 subparagraph 6 point 5 of the Decree of the Ministry of Finance dated 29 March 2018 on current and periodic information provided by issuers of securities and the conditions for recognition as equivalent of information required by the laws and regulations of a non-member state (the “decree”).

Furthermore, in our opinion, the information identified in paragraph 70 subparagraph 6 point 5 letter c-f, h and letter i of the decree, included in the corporate governance statement, in all material respects:

•      has been prepared in accordance with applicable laws and regulations; and

•      is consistent with the consolidated financial statements.

Statement on Report on Activities

Furthermore, based on our knowledge about the Group and its environment obtained in the audit of the consolidated financial statements, we have not identified material misstatements in the report on activities. This statement does not cover the sustainability reporting.

Report on Other Legal and Regulatory Requirements

Information on Compliance with Prudential Regulations

The Management Board of the Parent Entity is responsible for the Group’s compliance with the applicable prudential regulations defined in separate laws, in particular for the appropriate determination of the capital ratios.

Our responsibility was to inform in our auditor’s report whether the Group complies with the applicable prudential regulations defined in separate laws, in particular whether the Group appropriately determined the capital ratios presented in note 8.2 “Capital management”.

The audit objective was not to express an opinion on the Group’s compliance with the applicable prudential regulations and therefore we do not express such an opinion.

Based on our audit of the consolidated financial statements of the Group, we inform that we have not identified any instances of non-compliance, in the period from 1 January to 31 December 2025, of the Group with the applicable prudential regulations, defined in separate laws, in particular with respect to the determination of the capital ratios as at 31 December 2025, that could have a material impact on the consolidated financial statements.

Statement on Services Other than Audit of the Financial Statements

To the best of our knowledge and belief, we did not provide prohibited non-audit services referred to in Art. 5 paragraph 1 second subparagraph of the EU Regulation and Art. 136 of the act on statutory auditors.

Services other than audit of the financial statements, which were provided to the Group and entities under the control of the Parent Entity in the audited period are listed in in point 13.5 of the report on activities.

Appointment of the Audit Firm

We have been appointed for the first time to audit the annual consolidated financial statements of the Group by resolution of the Supervisory Board dated 24 February 2025. Our period of total uninterrupted engagement is 1 year.

Opinion on Compliance of the Consolidated Financial Statements Prepared in the Single Electronic Reporting Format with the Requirements of the Regulatory Technical Standards on the Specification of a Single Electronic Reporting Format

As part of our audit of the consolidated financial statements we were engaged to perform a reasonable assurance engagement in order to express an opinion on whether the consolidated financial statements of the Group as at 31 December 2025 and for the year then ended prepared in the single electronic reporting format included in the reporting package named grupamillennium-2025-12-31-1-pl.zip (the “consolidated financial statements in the ESEF format”) were tagged in accordance with the requirements specified in the Commission Delegated Regulation (EU) of 17 December 2018 supplementing Directive 2004/109/EC of the European Parliament and of the Council with regard to regulatory technical standards on the specification of a single electronic reporting format (the “ESEF Regulation”).

Defining the Criteria and Description of the Subject Matter of the Service

The consolidated financial statements in the ESEF format have been prepared by the Management Board of the Parent Entity to meet the tagging requirements and technical requirements for the specification of a single electronic reporting format, which are defined in the ESEF Regulation. The subject of our assurance service is the compliance of the tagging of the consolidated financial statements in the ESEF format with the requirements of the ESEF Regulation, and the requirements set out in these regulations are, in our opinion, appropriate criteria for our opinion.

Responsibility of the Management Board and Supervisory Board of the Parent Entity

The Management Board of the Parent Entity is responsible for the preparation of consolidated financial statements in the ESEF format in accordance with the tagging requirements and technical conditions of a single electronic reporting format, which are specified in the ESEF Regulation. Such responsibility includes the selection and application of appropriate XBRL tags using the taxonomy specified in that regulation.

This responsibility of the Management Board of the Parent Entity includes designing, implementing and maintaining internal control relevant to the preparation of the consolidated financial statements in the ESEF format that is free from material non-compliance with requirements specified in the ESEF Regulation, whether due to fraud or error.

The members of the Parent Entity’s Supervisory Board are responsible for overseeing the financial reporting process, including the preparation of financial statements in the format required by applicable law.

Auditor’s Responsibility

Our objective is to issue an opinion about whether the consolidated financial statements in the ESEF format were tagged in accordance with the requirements specified in the ESEF Regulation.

We conducted our engagement in accordance with the National Standard on Assurance Services Other than Audit or Review 3001PL “Audit of financial statements prepared in a single electronic reporting format” as adopted by the NCSA (“NSAE 3001PL”) and where applicable, in accordance with the International Standard on Assurance Engagements 3000 (Revised) “Assurance Engagements Other than Audits or Reviews of Historical Financial Information” as adopted by the NCSA as the National Standard on Assurance Engagement 3000 other than Audit and Review (R) (“NSAE 3000 (R)”). These standards requires that the auditor plans and performs procedures to obtain reasonable assurance about whether the consolidated financial statements in the ESEF format were prepared in accordance with specified criteria.

Reasonable assurance is a high level of assurance, but it is not guaranteed that the assurance engagement conducted in accordance with NSAE 3001PL and where applicable, in accordance with NSAE 3000 (R) will always detect material misstatement.

The procedures selected depend on the auditor’s judgment, including the assessment of the risks of material misstatements, whether due to fraud or error. In making those risk assessments, the auditor has considered internal controls relevant to the preparation of the consolidated financial statements in the ESEF format in accordance with the specified criteria in order to design procedures that are appropriate, which provide the auditor with sufficient and appropriate evidence under the circumstances. The assessment of internal controls was not performed for the purpose of expressing an opinion thereon.

Summary of the Work Performed

Our procedures planned and performed included, among others:

•      obtaining an understanding of the process of preparing the consolidated financial statements in the ESEF format, including selection and application of XBRL tags by the Parent Entity and ensuring

compliance with the ESEF Regulation, including an understanding of the mechanisms of internal control relevant to this process,

•      reconciling the tagged information included in the consolidated financial statements in the ESEF format to the audited consolidated financial statements,

•      assessing, by using a specialized IT tool compliance with the regulatory technical standards regarding the specification of a single electronic reporting format,

•      assessing the completeness of tagging with respect to

-       all numbers in a declared currency disclosed in the consolidated statement of financial position, the consolidated statement of profit or loss, consolidated statement of comprehensive income, the consolidated statement of changes in equity and the consolidated statement of cash flows in the consolidated financial statements in the ESEF format, and

-       notes, comprising material accounting policies and other explanatory information on a sample of XBRL tags, in particular block tags, in accordance with the mandatory elements of the core taxonomy contained in Annex II of ESEF Regulation,

•      inspecting the block tagging to assess whether the regulatory technical standards ‘requirement has been correctly applied to include the relevant data within the scope of the digital tag, on a sample basis

•      assessing whether the XBRL tags from the core taxonomy specified in the ESEF Regulation were properly applied, and whether the taxonomy extensions were used in situations where the closest core taxonomy element could misrepresent the accounting meaning of the disclosure, on a sample basis,

•      assessing the correctness of anchoring of the applied taxonomy extensions in the core taxonomy specified in the ESEF Regulation, on a sample basis.

•      inspecting how the data is presented within the digital tag to assess whether the presentation is reasonable within the boundaries of the technical capabilities connected with block tagging, on a sample basis.

Requirements of the Quality Control and Ethical Requirements, including Independence

The firm applies International Standard on Quality Management (PL) 1 “Quality Management for Firms that Perform Audits or Reviews of Financial Statements, or Other Assurance or Related Services Engagements” as adopted by the Council of Polish Agency for Audit Oversight as National Standard on Quality Control 1, which requires us to design, implement and operate a system of quality management including policies or procedures regarding compliance with ethical requirements, professional standards and applicable legal and regulatory requirements.

We have complied with the independence and other ethical requirements of the IESBA Code as adopted by the resolution of the NCSA, which is founded on fundamental principles of integrity, objectivity, professional competence and due care, confidentiality and professional behaviour as well as other independence and ethical requirements, applicable to this assurance engagement in Poland.

Opinion on Compliance with the Requirements of ESEF Regulation

Our opinion has been formed on the basis of, and is subject to, the matters outlined above.

We believe that the evidence we have obtained is sufficient and appropriate to provide a basis for our opinion on compliance with the requirements of the ESEF Regulation.

In our opinion, the consolidated financial statements in the ESEF format as at 31 December 2025 and for the year then ended was tagged, in all material respects, in accordance with the requirements of the ESEF Regulation.

On behalf of audit firm

KPMG Audyt Spółka z ograniczoną odpowiedzialnością sp.k.

Registration No. 3546

Signed on the Polish original

Justyna Zań

Key Statutory Auditor

Registration No. 12750

Proxy

Warsaw, 27 February 2026