mBank S.A.

Audit Report / Information • Mar 4, 2022

The Polish original should be referred to in matters of interpretation. Translation of auditor's report originally issued in Polish.

Ernst & Young Audyt Polska spółka z ograniczoną odpowiedzialnością sp. k. Rondo ONZ 1 00-124 Warszawa

+48 (0) 22 557 70 00 +48 (0) 22 557 70 01 warszawa@pl.ey.com www.ey.com/pl

INDEPENDENT AUDITOR'S REPORT ON THE ATTESTATION SERVICE GIVING REASONABLE ASSURANCE WITH REGARD TO ASSESSMENT OF THE REMUNERATION REPORT

For the General Meeting and Supervisory Board of mBank S.A.

We were appointed to conduct the assessment of the attached Management Board and Supervisory Board of mBank S.A. Remuneration Report, (hereinafter referred to as 'Bank') for the 2021 year (hereinafter referred to as 'the Remuneration Report') with regards to the completeness of the information required by Article 90g(1) to (5) and (8) of the Act of 29 July 2005 on Public Offering and Conditions for the Introduction of Financial Instruments to the Organised Trading System and Public Companies (i.e. OJ of 2020, item 2080) (hereinafter referred to as the 'Act on Public Offering').

Identification of criteria and description of subject matter services

The remuneration report was prepared by the Supervisory Board in order to meet the requirements of Article 90g(1) of the Act on Public Offering. The applicable requirements for the remuneration report are contained in the Act on Public Offering.

The requirements described in the previous sentence define the basis for preparation for the remuneration report and, in our opinion, provide the appropriate criteria for us to draw a conclusion giving the reasonable assurance.

In accordance with the requirements of Article 90g(10) of the Act on Public Offering, the remuneration report shall be assessed by the independent auditor with regards to the inclusion of the information required by Article 90g(1) to (5) and (8) of the Act on Public Offering. This report meets this requirement.

By the assessment of the statutory auditor referred to in the preceding sentence and which forms the basis for our conclusion giving reasonable assurance, we mean an assessment of whether, in all material respects, the scope of the information presented in the remuneration report is complete and the information has been disclosed in detail as required by the Public Offering Act.

Responsibility of Members of the Supervisory Board

In accordance with the Act on Public Offering, Members of the Supervisory Board of the Bank are responsible for preparing the remuneration report in accordance with applicable

law, in particular for the completeness of the report and for the information contained therein.

Responsibility of the Supervisory Board also includes designing, implementing and maintaining an internal control system that ensures the preparation of a complete statement of remuneration free from material misstatements due to fraud or error.

Responsibility of the statutory auditor

Our aim was to assess the completeness of the information contained in the Remuneration Report in relation to the criteria set out in section Identification of criteria and description of subject matter services and to express, on the basis of the evidence obtained, an independent conclusion from the reasonable assurance engagement.

We conducted our engagement in accordance with National Standard on Assurance Engagements Other than Audits or Reviews 3000 in the wording of International Standard on Assurance Engagements 3000 (amended), Assurance Engagements Other than Audits or Reviews of Historical Financial Information adopted by Resolution No 3436/52e/2019 of the National Board of Auditors of 8 April 2019, as amended (hereinafter as "NSAE 3000 (A)").

This standard requires the auditor to plan and implement procedures in such a way as to obtain reasonable assurance that the remuneration report has been prepared in accordance with certain criteria.

Reasonable assurance is a high level of assurance, but does not guarantee that the service performed in accordance with NSAE 3000 (A) always detects material distortions.

The procedures selected depend on the auditor's judgment, including the assessment of the risks of material misstatement, whether due to fraud or error. In making those risk assessments, the auditor considers internal control relevant to preparation of the complete report in order to design procedures that are appropriate in the circumstances. The assessment of the internal control system was not performed for the purpose of expressing an assurance on the effectiveness of the internal control.

Summary of work performed and limitations of our procedures

The procedures planned and performed by us include in particular:

• Familiarizing ourselves with the content of the remuneration report and comparing the information contained therein with the applicable requirements;
• Familiarizing ourselves with the resolutions of the General Meeting of the Bank concerning remuneration policies of Members of the Management Board and the Supervisory Board and additional details of the above resulting from the resolutions of the Supervisory Board;
• Establishing, by comparison with corporate documents, a list of persons for whom there is a requirement to include information in the remuneration report and establishing, by inquiries to the persons responsible for the preparation of the remuneration report and, where appropriate, directly the persons responsible for the requirement to include

information, whether all the information meeting the criteria for preparing the remuneration report have been disclosed.

Our procedures were intended solely to obtain evidence that the information provided by the Supervisory Board in the remuneration report for its completeness complied with the applicable requirements. The purpose of our work was not to assess the adequacy of the information contained in the remuneration report with regard to the purpose of preparing the remuneration report, nor to assess the correctness and reliability of the information contained therein, in particular as regards the amounts disclosed, including estimates made for previous years, figures, dates, breakdowns, allocations, compliance with the remuneration policy adopted by the Management Board.

The remuneration report was not audited within the meaning of National Auditing Standards. During our assurance procedures, we did not conduct an audit or review of the information used to prepare the remuneration report and therefore we do not assume responsibility for issuing or updating any reports or opinions on the Bank's historical financial information.

We believe that the evidence we have obtained is a sufficient and adequate basis for us to express the following conclusion.

Ethical requirements, including independence

When providing the service, the statutory auditor and the audit firm complied with the independence requirements and other professional ethics requirements set out in the International Code of Ethics of Accountants (including International Standards of Independence) issued by the International Ethics Standards Board for Accountants and introduced as a professional auditors' ethics by Resolution of the National Council of Statutory Auditors (KRBR) No 3431/52a/2019 of 25 March 2019 (hereinafter as "IESBA Code"). The IESBA Code is based on fundamental principles concerning integrity, objectivity, professional competence and due care, confidentiality and professional conduct. We have also complied with other requirements of independence and ethics that apply to this assurance service in Poland.

Quality control requirements

The audit firm applies the national quality control standards as set out in International Quality Control Standard 1 - "The quality control of audit firms and audit firms carrying out other audit and related services orders", adopted by Resolution No. 2040/37a/2018 of the National Council of Auditors of 3 March 2018, as amended (hereinafter referred to as 'KSKJ').

As required by the KSKJ, the audit firm maintains a comprehensive system of quality control including documented policies and procedures regarding compliance with ethical requirements, professional standards and applicable legal and regulatory requirements.

Conclusion

The auditor's conclusion is based on the issues described above and should therefore be read taking these issues into account.

In our opinion, the Remuneration report, in all material respects, contains all the elements listed in Article 90g(1) to (5) and (8) of the Act on Public Offering.

Other matters

The Remuneration report was signed by the Chairman of the Supervisory Board of the Bank after the authorisation given in the resolution of the Supervisory Board No 192/22. All members of the Supervisory Board voted in favour of the Remuneration report.

Restriction of use

This report was prepared by Ernst & Young Audit Polska sp. z o.o. sp. k. for the General Meeting and the Supervisory Board and is intended solely for the purpose described in section Identification of criteria and description of subject matter services and should not be used for any other purpose.

Ernst & Young Audit Polska sp. z o.o. sp. k. does not therefore accept any liability arising from contractual and non-contractual relations (including negligence) with regard to third parties in the context of this report. The foregoing does not relieve us of liability in situations where such exemption is excluded by law.

Warsaw, March 3, 2022

(-)

Anna Sirocka Certified Auditor No. in the register: 9626

on behalf of: Ernst & Young Audyt Polska spółka z ograniczoną odpowiedzialnością sp. k. Rondo ONZ 1, 00-124 Warsaw No. on audit firms list: 130