Abak Spolka Akcyjna

Remuneration Information • Mar 3, 2023

This document is a free translation of the Polish original. Terminology current in Anglo-Saxon countries has been used where practicable for the purposes of this translation in order to aid understanding. The binding Polish original should be referred to in matters of interpretation.

Independent ReasonableAssurance Report

To the General Shareholders' Meeting and Supervisory Board of mBank S.A.

Scope of service

At the request of mBank S.A. (the "Bank") we performed an independent reasonable assurance engagement relating to evaluation of the remuneration report of the Management Board and the Supervisory Board of mBank S.A. for the year 2022 (the "Remuneration report") in terms of the

inclusion of the information required under Article 90g paragraphs 1-5 and paragraph 8 of the Act on Public Offering and Conditions Governing the Introduction of Financial Instruments to Organized Trading, and Public Companies of 29 July 2005 ("the Act").

Responsibility of the Supervisory Board of the Bank

Members of the Bank's Supervisory Board are responsible for the preparation of the Remuneration report in accordance with Article 90g of the Act. This responsibility also includes designing, implementing and maintaining internal control relevant to the preparation of the Remuneration report that is free from material misstatement whether due to fraud or error.

KPMG Audyt spółka z ograniczoną odpowiedzialnością sp.k.

ul. Inflancka 4A, 00-189 Warszawa, tel. +48 (22) 528 11 00, fax +48 (22) 528 10 09, Email kpmg@kpmg.pl, Internet www.kpmg.pl

© 2023 KPMG Audyt Spółka z ograniczoną odpowiedzialnością sp.k., polska spółka komandytowa i członek globalnej organizacji KPMG składającej się z niezależnych spółek członkowskich stowarzyszonych z KPMG International Limited, prywatną spółką angielską z odpowiedzialnością ograniczoną do wysokości gwarancji. Wszelkie prawa zastrzeżone.

Auditor's Responsibility

Our objective was to evaluate the completeness of the information included in the Remuneration report against the criteria set out in the section "Identification of the criteria" and to issue an independent reasonable assurance conclusion based on the evidence obtained.

We conducted our engagement in accordance with International Standard on Assurance Engagements 3000 (Revised), 'Assurance Engagements Other Than Audits or Reviews of Historical Financial Information' as adopted by the National Council of Statutory Auditors ('NCSA') as National Standard on Assurance Engagements 3000 (R). That standard requires that the auditor plans and performs procedures to obtain reasonable assurance about whether the Remuneration report has been prepared completely and that the information has been disclosed with the level of detail required by Article 90g paragraphs 1-5 and paragraph 8 of the Act.

The firm applies International Standard on Quality Control 1 "Quality Control For Firms That Perform Audits And Reviews Of Financial Statements, And Other Assurance And Related Services Engagements" as adopted by NCSA as national standard on quality control and accordingly maintains a comprehensive system of quality control including documented policies and procedures regarding compliance with ethical requirements, professional standards and applicable legal and regulatory requirements.

We have complied with the independence and ethics requirements of the International Code of Ethics for Professional Accountants (including International Independence Standards) of the International Ethics Standards Board For Accountants (IESBA) as adopted by the resolution of the National Council of Statutory Auditors, which is founded on fundamental principles of integrity, objectivity, professional competence and due care, confidentiality and professional behavior as well as other independence and ethical requirements, applicable to this assurance engagement in Poland.

The procedures selected depend on our judgment, including the assessment of the risks of material misstatement in Remuneration report, whether due to fraud or error. In making those risk assessments, we have considered internal control relevant to the preparation of the Remuneration report in accordance with Article 90g paragraphs 1-5 and paragraph 8 of the Act in order to design assurance procedures that are appropriate in the circumstances, but not for the purposes of expressing a conclusion as to the effectiveness of internal control.

Our procedures included, in particular:

• reading the content of the Remuneration report and assessing whether it contains quantitative and qualitative (descriptive) disclosures to the extent required by the Act;
• determining, by comparing to corporate documents, a list of persons for whom there is a requirement to include information in the Remuneration report and determining, by inquiring of persons responsible for preparing the Remuneration report, and, where we deem it appropriate, also directly of persons who are subject to information requirement, whether all information provided for in the criteria for preparation of the Remuneration report has been disclosed;
• reading the resolutions of the General Shareholders' Meeting of the Bank regarding the remuneration policy for Members of the Management Board and Supervisory Board and related detailed resolutions of the Supervisory Board and assessing whether the information presented in the Remuneration report is consistent with the remuneration policy adopted by the Bank and effective during the period covered by the report;
• agreeing the presented remuneration amounts to the Bank's accounting records and payroll documentation, in relation to each Member of the Management Board and Supervisory Board;
• determining whether the remuneration of the Members of the Management Board and Supervisory Board includes cash or non-cash benefits granted to their closest family members in accordance with the requirements of the Act;

— determining whether the information concerning granted or offered financial instruments, including the general terms complies with the adopted and approved variable remuneration component program adopted by the Bank.

The Remuneration report was not subject of audit within the meaning of National Standards on Auditing. The procedures performed by us do not constitute either an audit or review of this financial information, therefore we are not responsible for issuing or updating any reports or opinions on the Bank's historical financial information.

Our procedures were solely aimed at obtaining evidence that the information included by the Supervisory Board in the Remuneration report,

Identification of the criteria

The evaluation criteria of the Remuneration report are set out in Article 90g paragraphs 1-5 and paragraph 8 of the Act.

Conclusion

Our conclusion has been formed on the basis of, and is subject to, the matters outlined above and should be read in conjunction with these matters.

We believe that the evidence we have obtained is sufficient and appropriate to provide a basis for our conclusion.

in terms of its completeness complies with the applicable requirements. The purpose of our work was not to assess the sufficiency of the information included in the Remuneration report in terms of the purpose of preparing the Remuneration report, or to assess the correctness and integrity of the information contained therein, in particular as to the amounts disclosed, including estimates made for prior years, figures, dates, analysis, allocation methods and compliance with the adopted remuneration policy.

Our procedures also included an assessment of whether the subject matter of the engagement is appropriate and the criteria adopted for preparation of the Remuneration report are appropriate to the given circumstances.

In our opinion, the Remuneration report, in all material respects, contain all the elements listed in Article 90g paragraphs 1-5 and paragraph 8 of the Act.

Restriction of Use of Our Report

Our report has been prepared for the General Shareholders' Meeting and Supervisory Board in order to meet the requirements of the Article 90g paragraph 10 of the Act and shall not be used for any other purpose.

KPMG accepts no liability in relation to this report, arising from contractual or noncontractual relationships (including negligence) in relation to third parties. The above does not exclude our liability where such exclusion is disallowed by law.

On behalf of audit firm KPMG Audyt Spółka z ograniczoną odpowiedzialnością sp.k. Registration No. 3546

Signed on the Polish original

Katarzyna Łącka-Dziekan Certified Auditor Registration No. 13131 Proxy

2 March 2023