XTB S.A. — Audit Report / Information 2022

Mar 23, 2023

TRANSLATORS’ EXPLANATORY NOTE

The English content of this report is a free translation of the registered auditor’s report of the below-mentioned Polish Company. In Poland statutory accounts as well as the auditor’s report should be prepared and presented in Polish and in accordance with Polish legislation and the accounting principles and practices generally adopted in Poland. The accompanying translation has not been reclassified or adjusted in any way to conform to the accounting principles generally accepted in countries other than Poland, but certain terminology current in Anglo-Saxon countries has been adopted to the extent practicable. In the event of any discrepancies in interpreting the terminology, the Polish language version is binding.

PricewaterhouseCoopers Polska spółka z ograniczoną odpowiedzialnością Audyt sp. k. , ul. Polna 11, 00-633 Warsaw, Poland, T: +48 (22) 746 4000, F:+48 (22) 742 4040 , www.pwc.pl

PricewaterhouseCoopers Polska spółka z ograniczoną odpowiedzialnością Audyt sp. k. is entered into the National Court Register maintained by the District Court for the Capital City of Warsaw, under KRS number 0000741448, NIP 113-23-99-979. The seat of the Company is in Warsaw at Polna 11.

Independent Registered Auditor’s Report

To the General Shareholders’ Meeting and the Supervisory Board of XTB S.A.

Report on the audit of consolidated financial statements

Our opinion

In our opinion, the attached annual consolidated financial statements of XTB S.A. Group („the Group”), in which XTB S.A. is the parent entity (“the Parent Company”):

• give a true and fair view of the consolidated financial position of the Group as at 31 December 2022 and its consolidated financial performance and its consolidated cash flows for the year then ended in accordance with the applicable International Financial Reporting Standards as adopted by the European Union and the adopted accounting policies;
• comply in terms of form and content with the laws applicable to the Group and the Parent Company’s Articles of Association;

Our opinion is consistent with our additional report to the Audit Committee issued on the date of this report.

What we have audited

We have audited the annual consolidated financial statements of XTB S.A. Group which comprise:

• the consolidated statement of financial position as at 31 December 2022; and
• the following prepared for the financial year from 1 January to 31 December 2022:
  • the consolidated statement of comprehensive income;
  • the consolidated statement of changes in equity;
  • the consolidated statement of cash flows, and
  • the notes comprising a description of the adopted accounting policies and other explanations.

Basis for opinion

Basis for opinion

We conducted our audit in accordance with the National Standards on Auditing in the wording of the International Standards on Auditing as adopted by the resolution of the National Council of Statutory Auditors (“NSA”) and pursuant to the Law of 11 May 2017 on Registered Auditors, Registered Audit Companies and Public Oversight (the “Law on Registered Auditors”) and the Regulation (EU) No. 537/2014 of 16 April 2014 on specific requirements regarding the statutory audit of public-interest entities (the “EU Regulation”). Our responsibilities under those NSA are further described in the Auditor’s responsibilities for the audit of the consolidated financial statements section of our report. We believe that the audit evidence we have obtained is sufficient and appropriate to provide a basis for our opinion.

Independence

We are independent of the Group in accordance with the International Code of Ethics for Professional Accountants (including International Independence Standards) issued by the International Ethics Standards Board for Accountants (IESBA Code) as adopted by resolution of the National Council of Statutory Auditors and other ethical requirements that are relevant to our audit of the financial statements in Poland. We have fulfilled our other ethical responsibilities in accordance with these requirements and the IESBA Code. During the audit, the key registered auditor and the registered audit firm remained independent of the Group in accordance with the independence requirements set out in the Act on Registered Auditors and in the EU Regulation.

Our audit approach

• The overall materiality threshold adopted for the purposes of our audit was set at PLN 46,400 thousand, which represents approximately 5% of the profit before tax.
• We have audited the annual consolidated financial statement of the Group for the period ended 31 December 2022.
• The scope of our audit covered 100% of the sum of total assets of all the consolidated Group companies before consolidation eliminations.
• Valuation of financial assets and liabilities and recognition of result on operations on financial instruments

Materiality

Scoping

Key audit matters

3

As part of designing our audit, we determined materiality and assessed the risks of material misstatement in the consolidated financial statements. In particular, we considered where the Company’s Parent Company’s Management Board made subjective judgements; for example, in respect of significant accounting estimates that involved making assumptions and considering future events that are inherently uncertain. We also addressed the risk of management override of internal controls, including among other matters, consideration of whether there was evidence of bias that represented a risk of material misstatement due to fraud. We tailored the scope of our audit in order to perform sufficient work to enable us to provide an opinion on the consolidated financial statements as a whole, taking into account the structure of the Group, the accounting processes and controls, and the industry in which the Group operated.

Materiality

The adopted level of materiality influenced the scope of our audit. The audit was designed to obtain reasonable assurance whether the consolidated financial statements as a whole do not contain any material misstatements. Misstatements can arise from fraud or error. Distortions are considered material if, individually or in aggregate, they could reasonably be expected to influence the economic decisions of users taken on the basis of the consolidated financial statements. Based on our professional judgement, we determined certain quantitative thresholds for materiality, including the overall materiality for the consolidated financial statements as a whole, as presented below. These thresholds, together with qualitative considerations, helped us to determine the scope of our audit and the nature, timing and extent of our audit procedures and to evaluate the effect of misstatements, both individually and in aggregate on the consolidated financial statements as a whole.

Overall Group materiality	PLN 46,400 thousand (14,320 thousand PLN in 2021)
How we determined it	approximately 5% of profit before tax
Rationale for the materiality benchmark applied	We have taken profit before tax as the basis for determining materiality because we believe this measure is commonly used to evaluate the Company's operations by users of financial statements and is a generally accepted benchmark. We applied materiality at 5% because, based on our professional judgement, it is consistent with the level of quantitative materiality used in the examination of profit-oriented entities in the brokerage industry.

We agreed with the Audit Committee that we would report to them misstatements identified during our audit above PLN 2,320 thousand, as well as misstatements below that amount that, in our view, warranted reporting for qualitative reasons.

Key audit matters

Key audit matters are those matters that, in our professional judgement, were of most significance in our audit of the consolidated financial statements of the current period. They include the most significant identified risks of material misstatements, including the identified risks of material misstatement resulting from fraud. These matters were addressed in the context of our audit of the consolidated financial statements as a whole, and in forming our opinion thereon. We summarized our response to these risks and, when deemed appropriate, presented the most important observations relating to these risks. We do not provide a separate opinion on these matters.

| Key audit matter | How our audit addressed the key audit matter # Information on accounting policies

Information on accounting policies, as well as quantitative disclosures regarding the result on operations on financial instruments, financial assets at fair value through profit or loss and financial liabilities held for trading are described in notes 4.4, 4.13, 4.4, 5.1, 15 and 21 respectively. As part of our audit procedures, we obtained an understanding of the Group's policies and procedures for entering into transactions and valuing financial instruments and recognizing the result thereof. We analysed the design and verified the effectiveness of the control mechanisms implemented by the Group in this area, including the process of concluding transactions with customers, the valuation process, as well as the risk management process, including limits on open positions. With respect to the IT systems through which transactions are executed and financial instruments are valued, we have updated our understanding and assessment of internal controls covering the area of change management and access control to systems that process customer transaction data. On selected populations of transactions, we performed independent valuation of financial instruments and analysis of correctness of recognition of valuation in the books as at the balance sheet date. Furthermore, with regard to the result on financial instruments, we performed detailed tests, including independent recalculation of the result on a sample basis, as well as reconciliation of selected transactions to source documentation and tests of system reports on transactions on financial instruments. In addition, we conducted an analysis of customer complaints and claims. Furthermore, we assessed the adequacy and completeness of the disclosures concerning the result on financial instruments, financial assets at fair value through profit or loss and financial liabilities held for trading in the financial statements in accordance with the accounting standards applicable to the Company.

5 Responsibility of the Management and Supervisory Board for the consolidated financial statements

The Management Board of the Parent Company is responsible for the preparation of annual consolidated financial statements that give a true and fair view of the Group’s financial position and results of operations, in accordance with the International Financial Reporting Standards as adopted by the European Union, the adopted accounting policies, the applicable laws and the Parent Company’s Articles of Association, and for such internal control as the Management Board determines is necessary to enable the preparation of consolidated financial statements that are free from material misstatement, whether due to fraud or error.

In preparing the consolidated financial statements, the Parent Company’s Management Board is responsible for assessing the Company’s Group’s ability to continue as a going concern, disclosing, as applicable, matters related to going concern and using the going concern basis of accounting unless the Management Board either intends to liquidate the Group or to cease operations, or has no realistic alternative but to do so.

The Parent Company’s Management Board and members of its Supervisory Board are obliged to ensure that the consolidated financial statements meet the requirements provided for in the Act of of September 29, 1994 on accounting (the "Accounting Act"). Members of the Supervisory Board are responsible for overseeing the financial reporting process.

Auditor’s responsibility for the audit of the consolidated financial statements

Our objectives are to obtain reasonable assurance about whether the consolidated financial statements as a whole are free from material misstatement, whether due to fraud or error, and to issue an auditor’s report that includes our opinion. Reasonable assurance is a high level of assurance, but is not a guarantee that an audit conducted in accordance with the NSA will always detect a material misstatement when it exists. Misstatements can arise from fraud or error and are considered material if, individually or in aggregate, they could reasonably be expected to influence economic decisions of users taken on the basis of these consolidated financial statements.

The scope of the audit does not cover an assurance on the Group’s future profitability or the efficiency and effectiveness of the Parent Company’s Management Board conducting its affairs, now or in future.

As part of an audit in accordance with the NSA, we exercise professional judgement and maintain professional scepticism throughout the audit. We also:

• Identify and assess the risks of material misstatement of the consolidated financial statements, whether due to fraud or error, design and perform audit procedures responsive to those risks, and obtain audit evidence that is sufficient and appropriate to provide a basis for our opinion. The risk of not detecting a material misstatement resulting from fraud is higher than for one resulting from error, as fraud may involve collusion, forgery, intentional omissions, misrepresentations, or the override of internal control.
• Obtain an understanding of internal control relevant to the audit in order to design audit procedures that are appropriate in the circumstances, but not for the purpose of expressing an opinion on the effectiveness of the Group’s internal control.
• Evaluate the appropriateness of accounting policies used and the reasonableness of accounting estimates and related disclosures made by the Parent Company’s Management Board.
• Conclude on the appropriateness of the Parent Company’s Management Board’s use of the going concern basis of accounting and, based on the audit evidence obtained, whether a material uncertainty exists related to events or conditions that may cast significant doubt on the Group’s ability to continue as a going concern. If we conclude that a material uncertainty exists, we are required to draw attention in our auditor’s report to the related disclosures in the consolidated financial statements or, if such disclosures are inadequate, to modify our opinion. Our conclusions are based on the audit evidence obtained up to the date of our auditor’s report. However, future events or conditions may cause the Group to cease to continue as a going concern.
• Evaluate the overall presentation, structure and content of the consolidated financial statements, including the disclosures, and whether the consolidated financial statements represent the underlying transactions and events in a manner that achieves fair presentation.
• Obtain sufficient appropriate audit evidence regarding the financial information of the entities or business activities within the Group to express an opinion on the consolidated financial statements.

We are responsible for the direction, supervision and performance of the Group audit. We remain solely responsible for our audit opinion.

We communicate with the Audit Committee regarding, among other matters, the planned scope and timing of the audit and significant audit findings, including any significant deficiencies in internal control that we identify during our audit. We also provide the Audit Committee with a statement that we have complied with relevant ethical requirements regarding independence, and to communicate with them all relationships and other matters that may reasonably be thought to bear on our independence, and where applicable, related safeguards.

From the matters communicated to the Audit Committee, we determine those matters that were of most significance in the audit of the consolidated financial statements of the current period and are therefore the key audit matters. We describe these matters in our auditor’s report unless law or regulation precludes public disclosure about the matter or when, in extremely rare circumstances, we determine that a matter should not be communicated in our report because the adverse consequences of doing so would reasonably be expected to outweigh the public interest benefits of such communication.

Other information, including the Report on the operations

Other information

Other information includes:

• "Report of the Management Board on the operations of the Group and the Company" for the financial year ended December 31, 2022 ("Report on operations") along with a statement on the application of corporate governance, which is a separate part of this Report on activities.
• A separate report on non-financial information
• Annual Report for the financial year ended December 31, 2022 ("Annual Report") (together "Other Information")

Other information does not include the financial statements and our auditor’s report thereon. We obtained the annual report before the date of this audit report, except for the Statements of the Supervisory Board:
a) regarding the appointment, composition and functioning of the audit committee referred to in Art. 71 section 1 point 8 of the Regulation of the Minister of Finance of March 29, 2018 on current and periodic information provided by issuers of securities and the conditions for recognizing as equivalent information required by the law of a non-member state ("Regulation on current information")
b) in the scope of assessment, together with justification, regarding the report on the activity of the issuer and the financial statement in terms of their compliance with the books, documents and the facts referred to in Art. 71 sec. 1 point 12 of the Regulation on current information, which will be available after that date.

Responsibility of the Management and Supervisory Board

The Management Board of the Parent Company is responsible for preparing Other Information in accordance with the law. The Company’s Management Board is obliged to ensure that the Report on the operations together with the separate sections and the separate report on non-financial information complies with the requirements of the Accounting Act.# Registered auditor’s responsibility

Our opinion on the audit of the consolidated financial statements does not cover Other Information. In connection with our audit of the consolidated financial statements, our responsibility is to read Other Information and, in doing so, consider whether it is materially inconsistent with the information in the consolidated financial statements, our knowledge obtained in our audit, or otherwise appears to be materially misstated. If, based on the work performed, we identified a material misstatement in Other Information, we are obliged to inform about it in our audit report.

In accordance with the requirements of the Act on the Registered Auditors, we are also obliged to issue an opinion on whether the Report on the operations has been prepared in accordance with the law and is consistent with information included in annual consolidated financial statements. Moreover, we are obliged to issue an opinion on whether the Parent Company provided the required information in its corporate governance statement. In addition, we are required to audit the financial information included in the Report on the operations in accordance with the scope described in this audit report and the requirements of the Financial Instruments Trading Act of July 29, 2005 (the "Trading Act").

Other Information Statement

We represent that in the light of the knowledge about the Group and its environment obtained during our audit, we have not identified any significant misstatements in the Report on operations and other information that we obtained before the date of this audit report. In the event that we find a significant distortion in the Statements of the Supervisory Board:

a) with regard to the appointment, composition and operation of the audit committee referred to in Art. 71 section 1 item 8 of the Regulation on current information and
b) in the scope of the assessment with justification regarding the report on the issuer's activities and financial statements in terms of their compliance with the books, documents and the facts referred to in Art. 71 sec. 1 point 12 of the Regulation on current information,

we are obliged to inform the Parent Company's Supervisory Board about it.

Opinion on the Report on the operations

Based on the work we carried out during the audit, in our opinion, the Report on the operations:
* has been prepared in accordance with the requirements of Article 49 of the Accounting Act and para. 71 of the Regulation of the Minister of Finance dated 29 March 2018 on current and periodical information submitted by issuers of securities and conditions for considering as equivalent the information required under the legislation of a non-Member State (“Regulation on current information”) and art 110w point 1 of Trading Act;
* is consistent with the information in the consolidated financial statements.

Opinion on the corporate governance statement

In our opinion, in its corporate governance statement, the Group included information set out in para. 70.6 (5) of the Regulation on current information. In addition, in our opinion, information specified in paragraph 70.6 (5)(c)–(f), (h) and (i) of the said Regulation included in the corporate governance statement are consistent with the applicable provisions of the law and with information included in the consolidated financial statements.

Information on non-financial information

In accordance with the requirements of the Chartered Accountants Act, we confirm that the Group has included in the Report on the operations information about the preparation of a separate report on non-financial information as referred to in Article 55.2c of the Accounting Act and that the Group has prepared such a separate report. We have not performed any assurance work on the separate non-financial information report and we do not express any assurance thereon.

Report on other legal and regulatory requirements

Report on the compliance of the format of the consolidated financial statements with the requirements of the European Single Electronic Format ("ESEF")

In connection with the audit of the consolidated financial statements, we have been engaged by the Parent Company's management under the audit contract for the consolidated financial statements to perform an attestation service that provides reasonable assurance to express an opinion on whether the consolidated financial statements of the Group as at and for the year ended 31 December 2022 prepared in a single electronic reporting format contained in a file named “xtb_2022-12-31_pl.zip” (the "consolidated financial statements in ESEF format") have been labelled in accordance with the requirements set out in Article 4 of Commission Delegated Regulation (EU) No 2019/815 of 17 December 2018 supplementing Directive 2004/109/EC of the European Parliament and of the Council with regard to regulatory technical standards concerning the specifications of the uniform electronic reporting format (the "ESEF Regulation").

Description of the subject matter of the contract and applicable criteria

The consolidated financial statements were prepared in the ESEF format by the Parent Company’s Management Board to comply with the technical requirements regarding the specification of a single electronic reporting format and marking up, which are set out in the ESEF Regulation. The subject matter of our assurance engagement is the compliance of the consolidated financial statements in the ESEF format with the requirements of the ESEF Regulation and the requirements of this regulation, in our view, constitute appropriate criteria to form a reasonable assurance conclusion.

Responsibility of the Management Board of the Parent Company and the Supervisory Board

The Parent Company’s Management Board is responsible for the preparation of the consolidated financial statements in the ESEF format in accordance with the technical requirements regarding the specification of a single electronic reporting format which are set out in the ESEF Regulation. This responsibility includes the selection and application of appropriate markups in XBRL using taxonomy specified in the ESEF Regulation. The responsibility of the Management Board includes also designing, implementing and maintaining internal controls relevant for the preparation of the consolidated financial statements in the ESEF format which are free from material non-compliance with the requirements of the ESEF Regulation and their marking-up in compliance with these requirements. Members of the Parent Company’s Supervisory Board of Parent Entity are responsible for overseeing the financial reporting process, which includes also the preparation of the consolidated financial statements in accordance with the format compliant with legal requirements.

Our responsibility

Our objective was to express an opinion, based on the conducted reasonable assurance engagement, whether the consolidated financial statements prepared in the ESEF format were marked up, in all material respects, with the requirements of the ESEF Regulation.

We conducted our engagement in accordance with the National Standard on Assurance Engagements other than Audit and Review 3001 - audit of financial statements prepared in the single electronic reporting format (“KSUA 3001pl”) and where relevant with the National Standard on Assurance Engagements 3000 (R) in the wording of the International Standard on Assurance Services 3000 (Revised) - ‘Assurance Engagements other than Audits and Reviews of Historical Financial Information’ as issued by the National Council of Statutory Auditors (KSUA 3000(R)). These standards require that we comply with ethical requirements, plan and perform procedures to obtain reasonable assurance whether the consolidated financial statements in the ESEF format were marked up, in all material aspects, in compliance with the specified criteria.

Reasonable assurance is a high level of assurance, but it does not guarantee that the service performed in accordance with KSUA 3001pl and KSUA 3000 (R) will always detect the existing material misstatement (significant non-compliance with the requirements). The selection of the procedures depend on the auditor's judgement, including the auditor's assessment of the risk of material misstatements, whether due to fraud or error. In performing the assessments of this risk, the auditor shall consider the internal control related to the preparation of the consolidated financial statements in the ESEF format and its marking-up in order to plan appropriate procedures to provide the auditor with sufficient evidence appropriate to the circumstances. The assessment of the functioning of the internal control system was not carried out in order to express an opinion on the effectiveness of its operation.

Quality control and ethical requirements

We apply the provisions of the regulation of the National Council of Statutory Auditors with regard to internal quality control in the wording of International Standard on Quality Control 1 and accordingly maintain a comprehensive system of quality control including documented policies and procedures regarding compliance with ethical requirements, professional standards and applicable legal and regulatory requirements.

We comply with the independence and other ethical requirements of the International Code of Ethics for Professional Accountants (including International Independence Standards) issued by the International Ethics Standards Board for Accountants as adopted by resolution of the National Council of Statutory Auditors, which is founded on fundamental principles of integrity, objectivity, professional competence and due care, confidentiality and professional behaviour.# Summary of work done

Our planned and performed procedures were aimed at obtaining reasonable assurance whether the consolidated financial statements in the ESEF format were marked-up, in all material aspects, in compliance with the applicable requirements. Our procedures included in particular:

• obtaining an understanding of the process of preparing consolidated financial statements in the ESEF format, including the process of selecting and using XBRL tags by the Group and ensuring compliance with the ESEF Regulation, including understanding the internal control system mechanisms related to this process;
• reconciliation, on a selected sample, of the tagged information contained in the consolidated financial statements in the ESEF format to the audited consolidated financial statements;
• assessment of compliance with technical standards regarding the specification of a single electronic reporting format, including the use of the XHTML format, using a specialized IT tool and with the support of an IT expert;
• assessment of the completeness of marking information in the consolidated financial statements in the ESEF format with XBRL tags;
• assessment of whether the XBRL tags from the taxonomy specified in the ESEF Regulation have been properly used and whether the extensions of the taxonomy have been appropriately used in situations where the basic taxonomy specified in the ESEF Regulation does not identify relevant elements;
• assessment of the correct anchoring of the applied taxonomy extensions in the basic taxonomy specified in the ESEF Regulation.

We believe that the evidence we have obtained is sufficient and appropriate to form the basis of our conclusion.

Conclusion

In our opinion, based on the procedures performed, the consolidated financial statements in the ESEF format were marked-up, in all material respects, in compliance with the requirements of the ESEF Regulation.

Information on compliance with prudential regulations

The Management Board of the Parent Company is responsible for complying with the applicable prudential regulations set out in separate legislation, and in particular, for the correct determination of the capital ratios. The capital ratios as at 31 December 2022 have been presented in Note 36 of the consolidated financial statements and include total capital requirement.

We are obliged to inform in the report on the audit of the consolidated financial statements whether the Group complies with the applicable prudential regulations set out in separate regulations, in particular whether the Group correctly determined the capital ratios.

For the purposes of this information, separate regulations are understood as Regulation (EU) 2019/2033 of the European Parliament and of the Council of 27 November 2019 on prudential requirements for investment firms and amending Regulations (EU) No. 1093/2010, (EU) No. 575/2013, (EU) No. 600/2014 and (EU) No. 806/2014 ("IFR"), the Act of August 5, 2015 on macroprudential supervision of the financial system and crisis management in the financial system ("Macroprudential Supervision Act"), Regulation of the Minister of Development and Finance of April 25, 2017 on internal capital, risk management system, supervisory assessment program and supervisory examination and evaluation, as well as remuneration policy in a brokerage house, Regulation of the Minister of Development and Finance of December 8, 2021 on the estimation of internal capital and liquid assets, the risk management system, supervisory review and evaluation, as well as the remuneration policy in a brokerage house and a small house brokerage.

It is not the purpose of an audit of the financial statements to present an opinion on compliance with the applicable prudential regulations specified in the separate legislation specified above, and in particular, on the correct determination of the capital ratios, and therefore, we do not express such an opinion.

Based on the work performed by us, we inform you that we have not identified:

• any cases of non-compliance by the Parent Company with the applicable prudential regulations set out in the separate legislation referred to above, in the period from 1 January to 31 December 2022;
• any irregularities in the determination by the Parent Company of the capital ratios as at 31 December 2022 in accordance with separate legislation referred to above, which would have a material impact on the financial statements.

Statement on the provision of non-audit services

To the best of our knowledge and belief, we declare that the non-audit services we have provided to the Parent Company and its subsidiaries are in accordance with the laws and regulations applicable in Poland and that we have not provided any non-audit services prohibited under Article 5(1) of the EU regulation and Article 136 of the Act on Registered Auditors. The non-audit services which we have provided to the Parent Company and its subsidiaries in the audited period are disclosed in the note 30 to the consolidated financial statements.

Appointment

We were first appointed to audit the Company's annual financial statements by Board Resolution 45/2018 dated November 7, 2018 and again by resolution dated May 4, 2021. We have audited the Company's financial statements continuously beginning with the fiscal year ended December 31, 2019, a period of four years.

The Key Registered Auditor responsible for the audit on behalf of PricewaterhouseCoopers Polska spółka z ograniczoną odpowiedzialnością Audyt sp.k., a company entered on the list of Registered Audit Companies with the number 144., is Agnieszka Accordi.

Agnieszka Accordi
Key Registered Auditor No. 11665

Warsaw, 21 March 2023