mBank S.A.

Remuneration Information • Mar 1, 2025

This document is a free translation of the Polish original. Terminology current in Anglo-Saxon countries has been used where practicable for the purposes of this translation in order to aid understanding. The binding Polish original should be referred to in matters of interpretation.

Independent Reasonable Assurance Report

To the General Shareholders' Meeting and Supervisory Board of mBank S.A.

Scope of Service

At the request of mBank S.A. (the "Bank") we performed an independent reasonable assurance engagement relating to evaluation of the remuneration report of the Management Board Members and the Supervisory Board Members for year 2024 (the "Remuneration report") in terms of the inclusion of the information required under Article 90g paragraphs 1-5 and paragraph 8 of the Act on Public Offering and Conditions Governing the Introduction of Financial Instruments to Organized Trading, and Public Companies dated 29 July 2005 (the "Act") .

Responsibilities of the Supervisory Board of the Bank

Members of the Bank's Supervisory Board are responsible for the preparation of the Remuneration report in accordance with Article 90g of the Act. This responsibility also includes designing, implementing and maintaining internal control relevant to the preparation of the Remuneration report that is free from material misstatement whether due to fraud or error.

Auditor's Responsibilities

Our objective was to evaluate the completeness of the information included in the Remuneration report against the criteria set out in the section "Identification of the Criteria" and to issue an independent reasonable assurance conclusion based on the evidence obtained.

We conducted our engagement in accordance with International Standard on Assurance Engagements 3000 (Revised), "Assurance Engagements Other Than Audits or Reviews of Historical Financial Information" as adopted by the National Council of Statutory Auditors ("NCSA") as National Standard on Assurance Engagements Other Than Audit and Review 3000 (R). That standard requires that the auditor plans and performs procedures to obtain reasonable assurance about whether the Remuneration report has been prepared completely and that the information has been disclosed with the level of detail required by Article 90g paragraphs 1-5 and paragraph 8 of the Act.

The firm applies International Standard on Quality Management (PL) 1 "Quality Management for Firms that Perform Audits or Reviews of Financial Statements, or Other Assurance or Related Services Engagement" as adopted by the Council of Polish Agency for Audit Oversight as National Standard on Quality Control 1, which requires us to design, implement and operate a system of quality

tel. +48 (22) 528 11 00, fax +48 (22) 528 10 09, kpmg@kpmg.pl

KPMG Audyt Spółka z ograniczoną odpowiedzialnością sp.k., a Polish limited partnership and a member firm of the KPMG global organization of independent member firms affiliated with KPMG International Limited, a private English company limited by guarantee.

Company registered at the District Court for the capital city of Warsaw in Warsaw, 12th Commercial Division of the National Business Register.

KRS 0000339379 NIP: 527-26-15-362 REGON: 142078130

KPMG Audyt spółka z ograniczoną odpowiedzialnością sp.k. ul. Inflancka 4A, 00-189 Warsaw, Poland

management including policies or procedures regarding compliance with ethical requirements, professional standards and applicable legal and regulatory requirements.

We have complied with the independence and ethics requirements of the International Code of Ethics for Professional Accountants (including International Independence Standards) of the International Ethics Standards Board For Accountants (IESBA Code) as adopted by the resolution of the NCSA, which is founded on fundamental principles of integrity, objectivity, professional competence and due care, confidentiality and professional behavior as well as other independence and ethical requirements, applicable to this assurance engagement in Poland.

The procedures selected depend on our judgment, including the assessment of the risks of material misstatement in the Remuneration report, whether due to fraud or error. In making those risk assessments, we have considered internal control relevant to the preparation of the Remuneration report in accordance with Article 90g paragraphs 1-5 and paragraph 8 of the Act in order to design assurance procedures that are appropriate in the circumstances, but not for the purposes of expressing a conclusion as to the effectiveness of internal control.

Our procedures included, in particular:

• reading the content of the Remuneration report and assessing whether it contains quantitative and qualitative (descriptive) disclosures to the extent required by the Act;
• determining, by comparing to corporate documents, a list of persons for whom there is a requirement to include information in the Remuneration report and determining, by inquiring of persons responsible for preparing the Remuneration report, and, where we deem it appropriate, also directly of persons who are subject to information requirement, whether all information provided for in the criteria for preparation of the Remuneration report has been disclosed;
• reading the resolutions of the General Shareholders Meeting of the Bank regarding the remuneration policy for Members of the Management Board and Supervisory Board and related detailed resolutions of the Supervisory Board and assessing whether the information presented in the Remuneration report is consistent with the remuneration policy adopted by the Bank and effective during the period covered by the report;
• agreeing the presented remuneration amounts to the Bank's accounting books and payroll documentation, in relation to each Member of the Management Board and Supervisory Board;
• determining whether the remuneration of the Members of the Management Board and Supervisory Board includes cash or non-cash benefits granted to their closest family members in accordance with the requirements of the Act;
• determining whether the information concerning granted or offered financial instruments, including the general terms - complies with the adopted and approved variable remuneration component program adopted by the Bank.

The Remuneration report was not subject of audit within the meaning of National Standards on Auditing. The procedures performed by us do not constitute either an audit or review of this financial information, therefore we are not responsible for issuing or updating any reports or opinions on the Bank's historical financial information.

Our procedures were solely aimed at obtaining evidence that the information included by the Supervisory Board in the Remuneration report, in terms of its completeness complies with the applicable requirements. The purpose of our work was not to assess the sufficiency of the information included in the Remuneration report in terms of the purpose of preparing the Remuneration report, or to assess the correctness and integrity of the information contained therein, in particular as to the amounts disclosed, including estimates made for prior years, figures, dates, analysis, allocation methods and compliance with the adopted remuneration policy.

Our procedures also included an assessment of whether the subject matter of the engagement is appropriate and the criteria adopted for preparation of the Remuneration report are appropriate to the given circumstances.

Identification of the Criteria

The evaluation criteria of the Remuneration report are set out in Article 90g paragraphs 1-5 and paragraph 8 of the Act.

Conclusion

Our conclusion has been formed on the basis of, and is subject to, the matters outlined above.

We believe that the evidence we have obtained is sufficient and appropriate to provide a basis for our conclusion.

In our opinion, the Remuneration report, in all material respects, contains all the elements listed in Article 90g paragraphs 1-5 and paragraph 8 of the Act.

Restriction of Use of Our Report

Our report has been prepared for the General Shareholders' Meeting and Supervisory Board in order to meet the requirements of the Article 90g paragraph 10 of the Act and shall not be used for any other purpose. KPMG accepts no liability in relation to this report, arising from contractual or non-contractual relationships (including negligence) in relation to third parties. The above does not exclude our liability where such exclusion is disallowed by law.

On behalf of audit firm

KPMG Audyt Spółka z ograniczoną odpowiedzialnością sp.k. Registration No.: 3546

Signed on the Polish original

Marcin Podsiadły

Key Certified Auditor

Proxy

Warsaw, 28 February 2025