Report of the Board of Statutory Auditors to the General Shareholders' Meeting

Statutory Auditors' Report to the General Shareholders' Meeting

pursuant to Article 153 of Legislative Decree No. 58/1998

Shareholders,

The Board of Statutory Auditors (the "Board") is required to report to the General Shareholders' Meeting of Banca Generali S.p.A. (hereinafter also "Banca Generali", the "Bank" or the "Company"), convened, inter alia, to approve the Financial Statements for the year ended 31 December 2025, on the supervisory activity performed and any omissions and censurable facts identified, pursuant to Article 153 of Legislative Decree No. 58/1998 ("TUF"). This activity was carried out in accordance with the code of conduct recommended by the Roll of Certified Public Accountants and Commercial Experts, while also taking account of the provisions issued by Consob and the Bank of Italy, the instructions set out in the Corporate Governance Code and the provisions of Article 19 of Legislative Decree No. 39/10. The following information also takes account of Consob recommendations contained in Communication No. 1025564/2001.

It bears recalling that on 18 April 2024 the General Sharehold-ers' Meeting of Banca Generali had appointed this Board of

Statutory Auditors until the approval of the Financial Statements for the year ending 31 December 2026, in the persons of Natale Freddi (Chairman), Paola Carrara and Gianmaria Garegnani (Acting Auditors). On the same date, the Board of Directors also granted the Board of Statutory Auditors the functions attributed to the Supervisory Board pursuant to Article 6 of Legislative Decree No. 231/2001.

During the year, the Board of Statutory Auditors met 20 times and 4 times in its capacity as Supervisory Body. It also took part in 21 meetings of the Board of Directors, 18 meetings of the Internal Audit and Risk Committee, 10 meetings of the Remuneration Committee, 11 meetings of the Nomination and Governance Committee, 10 meetings of the Sustainability and Innovation Committee and 14 meetings of the Credit Committee. The Board of Statutory Auditors also took part in the induction programme for members of the Bank's corporate bodies.

1. Supervisory activity concerning compliance with the law and Articles of Association

   The Board of Statutory Auditors periodically obtained information from the Directors - including by participating in the meetings of the Board of Directors and its Board Committees

   - regarding the activity carried out and management actions undertaken. On the basis of the information available, it may reasonably confirm that those activities and actions were implemented in compliance with the law and the Articles of Association.

   The significant events occurred during the year that the Board of Statutory Auditors deems appropriate for mention in light of their importance include:

   › a public voluntary exchange offer was launched by Medi-obanca - Banca di Credito Finanziario S.p.A. for 100% of shares of the Bank and was declared lapsed following the resolution of Mediobanca's General Shareholders' Meeting of 21 August 2025;

   › on 24 September 2025, Banca Generali approved the plan for merging Intermonte Partners SIM S.p.A. After receiving the Bank of Italy's authorisation, the merger plan was filed with the relevant Registries of Companies. The transaction was finalised in February 2026;

   › on 31 October 2025, BG (Suisse) Private Bank S.A. acquired the Swiss Aequitum Group, registered as an Alternative Investment Fund Manager (AIFM) in Switzerland. Subsequently, the reverse merger of Aequitum Holding

   SA into Aequitum S.A. was carried out, and, after obtaining the legal authorisations, BG Valeur S.A. was merged with the company resulting from the reverse merger. This new entity changed its company name into BG Aequitum S.A;

   › on 17 April 2025, following an extraordinary transaction that would lead to a change of control in Saxo Bank, the Board of Directors authorised the exercise of the put option envisaged by the partnership agreement with Saxo Bank in order to proceed with the disposal of the equity investment and the early termination of the joint venture. The sale & purchase agreement was reached at the end of December 2025 and is expected to be signed in the first quarter of 2026.

   It should also be noted that, at 31 December 2025, the consolidated CET1 ratio was 17.1% and Total Capital Ratio (TCR) was 18.9%, compared to the new SREP minimum requirement of 8.7% and 13.2%, respectively. The main information on capital adequacy, risk exposure and the general characteristics of the systems implemented to identify, measure and manage said risks are illustrated in the Pillar 3 disclosures prepared pursuant to Part VIII of Regulation (EU) No. 575/2013.

   With regard to relations with the Supervisory Authorities, the Board of Statutory Auditors was updated by the competent

   company functions regarding the requests and inquiries made and the responses given. In turn, when requested, it provided responses to such Authorities on specific topics relating to

   the reports received and the audits carried out by the Board of Statutory Auditors.

2. Supervisory activity concerning compliance with the principles of sound management

   The Board of Statutory Auditors acknowledged and supervised the compliance with the principles of sound management by obtaining information from the Heads of the competent Control Functions and the Manager in charge of preparing the Company's financial reports, as well as from meetings with the Independent Auditors as part of the mutual exchange of relevant data and information. In the year, it also met several times with the Chief Executive Officer, the Deputy General Managers and other top managers at the Board of Directors' meetings, the Board Committees' meetings or at other ad-hoc meetings, to obtain information regarding operating performance, the internal control system and main company risks. During such meetings, the Board of Statutory Auditors observed the regular, constant flow of information from the main corporate operating functions and, in the case of the Board of Directors, its constant updating on the activities of the Bank and its subsidiaries.

   The Board of Statutory Auditors may therefore reasonably state that the transactions carried out are inspired by the principles of sound management, and that management decisions were made on the basis of adequate flows of information and awareness of their risk level.

   In particular, as regards the most significant economic, financial and equity transactions implemented by the Bank, subject to supervisory activity, the Board of Statutory Auditors may reasonably confirm that they were implemented in compliance with the law, Bank of Italy Circular No. 285/2013 and the Articles of Association and were not manifestly imprudent, risky, in conflict with the resolutions passed by the Shareholders' Meeting or such as to compromise the integrity of the Compa-

   ny's assets. The transactions in which Directors had an interest were approved in accordance with the law, regulations and Articles of Association. As part of the information provided on the preparation of the annual and half-yearly financial statements, the information pursuant to Article 150 of TUF was provided by the Chief Executive Officer and also by the Manager in charge of preparing the Company's financial reports.

   In addition, - based on the financial report, the information received during the Board of Directors' meetings and the information provided by the Group's Head of Internal Audit, by the Boards of Statutory Auditors of the main direct subsidiaries and by the Independent Auditors -, the Board of Statutory Auditors determined that there had been no atypical and/ or unusual transactions with companies of the Banca Generali Banking Group (the "Group"), third parties or related parties, i.e., transactions that, in view of their characteristics, may give rise to doubts as to the correctness/completeness of the information in the financial statements, conflicts of interest, integrity of company assets and the protection of minority shareholders.

   No issues came to light from the meetings held with the Chairman of the Board of Statutory Auditors of Generfid S.p.A. and the management bodies and the Internal Audit Function of BG Fund Management Luxembourg S.A., BG (Suisse) Private Bank S.A., BG Aequitum S.A. and Intermonte SIM S.p.A., or from the examination of the Directors' reports included in the financial statements. Likewise, at such meetings, no issues were reported relating to the activities carried out, where required, in our capacity as Supervisory Body pursuant to Legislative Decree No. 231/2001.

3. Supervisory activity concerning adequacy of the organisational structure

   The Board of Statutory Auditors supervised the adequacy of the Bank's organisational structure by holding meetings with the latter's operating functions, and in particular with the Chief Operation Office & Innovation Area and the Organisation & Projects function, in order to verify the adequacy of the company structure, system of delegated powers, internal control and risk management system and information flows.

   The Bank's organisational structure stems from a continuous commitment to improving efficiency and aligning with the objectives set out in the Strategic plan, which provides for the ongoing growth of the Bank and the network, the strengthening and enhancement of skills, a competitive and technological context and an evolving legal and regulatory framework. The organisational structure did not change substantially during the year, although the process of rationalising some of its internal structures continued, with particular emphasis on the activities of the Deputy General Manager Products, Wealth and Asset Management and the Deputy General Manager Distribution, both reporting to the two Vice General Managers.

   The Board of Statutory Auditors found no significant issues, and has no recommendations to submit.

   The Board of Statutory Auditors also supervised the proper performance of the management and coordination activities carried out by the Bank as Parent Company and has no observations to make in this regard.

   In fact, the Parent Company performs its steering and governance tasks and provides support to its subsidiaries, in accordance with the Consolidated Law on Banking (TUB), supervisory regulations and Group regulations, adopting risk management procedures and internal control mechanisms that ensure coordinated, unified management of the various Group companies in order to:

   › ensure satisfaction of the requirements imposed by supervisory regulations at Group level;

   › safeguard the profitability and value of the equity investments of the Parent Company and all its subsidiaries;

   › avoid any harm to the integrity of the assets of each Group entity by also providing instructions through specific instruments, such as Group regulations and policies on specific subjects.

   The Board of Statutory Auditors supervised the adequacy of the instructions provided by the Company to its subsidiaries pursuant to Article 114, paragraph 2, of TUF.

4. Corporate governance

   The Board of Statutory Auditors assessed the methods whereby the Borsa Italiana Corporate Governance Code adopted by the Bank was implemented, according to the terms illustrated in the "2025 Report on Corporate Governance and Ownership Structure" (the "Corporate Governance Report"). It should be noted that the corporate bodies also acknowledged the latest recommendations formulated in the letter from the Chair of the Corporate Governance Committee of 18 December 2025.

   In line with the legislation of reference, Banca Generali's Board of Directors, with support from the external professional Spencer Stuart - appointed as independent expert for the 2024-2026 three-year term - launched the 2025 annual self-assess-ment on the functioning of the Board and Board Committees, as well as of their size and composition.

   The Board of Statutory Auditors as well performed its 2025 annual self-assessment to evaluate its functioning, size and composition. The results of the two self-assessments are reported

   in detail in the Corporate Governance Report.

   Furthermore, during the year the Board of Statutory Auditors verified that the Statutory Auditors met the relevant requirements in accordance with the MEF Decree No. 169 of 23 November 2020, as well as, in general, with the applicable legal, regulatory and self-regulatory provisions in force. In detail, pursuant to Article 23 of the MEF Decree, the Board of Statutory Auditors conducted new specific assessments of the continuing satisfaction of its members' eligibility requirements and criteria, including those of independence and absence of causes of incompatibility, where supervening events might have affected possession of such requisites.

   Additionally, during the year the Board of Statutory Auditors verified the proper application of the assessment criteria and procedures adopted by the Board of Directors to assess possession of the fit and proper requirements of its members, pursuant to applicable legislation.

5. Supervisory activity concerning transactions with related and connected parties

   The Board of Statutory Auditors supervised the compliance with applicable legislation of the Policy for Transactions with Related Parties, Connected Parties and Corporate Officers pursuant to Article 136 of TUB (the "Policy") adopted by the Bank on this matter (as most recently updated on 22 June 2023) and its proper application, participating in all the meetings of the Internal Audit and Risk Committee - which also acts as the Committee for the preliminary review of transactions with related and connected parties and is tasked with issuing the related opinions required by applicable legislation, as established by the relevant Policy - and periodically receiving and analysing information regarding the transactions performed. The Board of Statutory Auditors has no record of related and connected party transactions undertaken in conflict with the Company's interest.

   In 2025, one transaction qualifying as a "transaction of greater importance" - with such characteristics that do not enable the application of the exemptions provided for by related party regulations - was carried out and entailed the obligation to disclose the related information document to the market. In detail, on 17 April 2025, Banca Generali's Board of Directors resolved to sign an addendum amending and supplementing the deed for the distribution of insurance products in place between Banca Generali and Generali Italia S.p.A. (signed in March 2018), also joined by Genertellife S.p.A., subsequently replaced by Alleanza Assicurazioni S.p.A. as a result of the merger of Genertellife S.p.A., effective 1 January 2025.

   On 5 November 2025, the Banks' Board of Directors approved a related party transaction qualifying as an ordinary transaction

   of greater importance concerning the issuance, by 31 December 2025, of a preferred senior bond (unsubordinated and unsecured) eligible for MREL purposes, pursuant to Articles 72-bis and 72-ter of Regulation (EU) 575/2013, for an aggregate nominal value of 100 million euros, to be subscribed by Assicurazioni Generali through private placement. To support its assessment, the Bank's Board of Directors acquired and examined the fairness opinion issued by the financial advisor Deloitte, attesting to the fairness of the general economic terms of the instrument compared to those observed on the market for similar instruments.

   In addition, transactions qualifying as "transactions of lesser importance" were undertaken with related parties, as illustrated in detail in the Directors' Report on Operations, in addition to "ordinary or recurring transactions" effected at arm's length, the effects of which are analysed in the dedicated section of the Notes and Comments.

   The Board of Statutory Auditors verified that in the Report on Operations and the Notes and Comments the Board of Directors provided adequate disclosure of transactions with related and connected parties and intragroup transactions in light of applicable legislation.

   Following a review of the activity carried out by the various functions covered by the Policy and discussions with the Internal Audit Function, the Board of Statutory Auditors believes that transactions with related and connected parties are adequately supervised and, to the best of its knowledge, that the Policy was properly applied.

6. Supervisory activity concerning the internal control and risk management system

The Board of Statutory Auditors supervised the adequacy of the internal control and risk management system mainly through:

› meetings with the Bank's top managers, the purpose of which included examining the internal control and risk management system;

› periodic meetings with the Heads of the Internal Audit, Compliance and Anti-Money Laundering, and Risk Management Functions (hereinafter the "Control Functions") in order to assess the methods of planning of the work, based on identifying and assessing the main risks present in processes and in organisational units;

› examination of the Control Functions' periodic reports (Tableaux de Bord and annual Reports) and of periodic reports on the results of monitoring of the implementation of the remediations identified;

› acquisition of information from the Heads of other Corporate Functions;

› meetings with the control bodies of the main subsidiaries pursuant to paragraphs 1 and 2 of Article 151 of TUF during which the Board of Statutory Auditors obtained information on the matters deemed material, affecting Group companies and the internal control system;

› discussion of the results of the Independent Auditors' work;

› participation in the proceedings of the Internal Audit and Risk Committee, acquiring information on the criticalities considered of particular interest to the Board of Statutory Auditors' activity.

Banca Generali has adopted, and constantly updates, the Internal Control System Policy, which identifies the bodies and functions involved in the definition of the internal control system, the methods and tools for identifying and assessing risks, coordination between control functions, the Banking Group's internal control system and reports and flows of information. The system is structured on three levels: the first level performs line controls aimed at ensuring the proper performance of transactions; the second level concerns the monitoring of risks and compliance; and the third is aimed at identifying breaches of procedures and internal regulations.

With reference to the first-line controls, Banca Generali has operational procedures in place (process flows) that relate to all activities carried out and identify the activities, roles, tools and line controls according to the company process tree. These procedures are constantly updated by the Normativa & Regulatory Hub, within the structure of the General Counsel & Sustainability department to bring them into line with changes in external and internal rules and regulations, the organisational structure and operating methods and to incorporate the suggestions for improvement that emerge from the activities performed by the Control Functions.

With regard to the second- and third-line controls, the Board of Statutory Auditors engaged in constant dialogue with the Control Functions in carrying out its activities. In addition to the Business Functions and Control Functions, the functioning of the control system also involves the Parent Company's Supervisory Board pursuant to Italian Legislative Decree 231/2001, whose activity is described in a subsequent chapter.

The Control Functions submit periodic reports to the Board of Directors and the Board of Statutory Auditors on the activities performed and their main observations. Each quarter, the

Tableaux de Bord are presented; these are informational documents that provide an update on the risks and state of progress of the annual plan of each Function. At the end of the year, as required by the law, the Functions submit an annual Report, which, in addition to underscoring the work done during the year, concludes with a concise assessment of the adequacy of the internal control system with regard to matters within their purview.

On a quarterly basis, the Control Functions submit a Remediation Integrated Report, illustrating by grading and maturity these remediations for each Corporate Control Function, thus allowing to monitor their implementation.

The Board of Statutory Auditors acknowledges that the annual Reports of the Compliance, AML and Risk Management Control Functions, each for the aspects within their respective remit, conclude with a mostly adequate opinion of the structure of the Company's internal control system. With regard to the Internal Audit Function Report, the assessment of the internal control system takes account not only of the findings of the Function's activity, but also of the outcome of the of second-line Functions' activities. The Internal Audit Function Report thus concludes with an Overall Adequate opinion in terms of the completeness, adequacy, functionality and reliability of the internal control system.

The Board of Statutory Auditors also acknowledged the Board of Director's assessment of the internal control system, which was deemed mostly adequate, also in light of the Internal Audit and Risk Committee's opinion.

The Group's Internal Audit Function operates based on three-year and annual plans prepared and developed for Banca Generali and the individual subsidiaries of the Banking Group, in line with the provisions of the outsourcing contracts of the Internal Audit service to the Chief Audit Office of the Parent Company of the Banking Group.

The Group's three-year plan sets the expected objectives and contains information on process and risk coverage through audits. Over the three-year period, assurance is provided on all the processes identified as part of the risk assessment in order to define, according to a risk-based approach, the priorities and the frequency of interventions, in line with the methodology adopted. The annual plan defines, in line with the three-year plan, the specific activities and processes to be audited during the year. The above plans are submitted to annual approval by the Board of Directors and are updated, including during the year, in case of significant changes.

The annual report on the Internal Audit Function relating to the year indicates that all activities planned were concluded at the date of this report. No significant issues emerged with regard to the audits performed. However, the control activities performed (including at Group level) identified a need for the competent Corporate Functions to implement remedial actions to mitigate the risks inherent in some processes and operating practices, typical of the banking business.

In the Outsourcing & ICT Third Parties Management, an organic and gradual consolidation of the governance model is underway, in compliance with the evolution introduced by the DORA Regulation and in line with the EBA Guidelines. The en-

gagements carried out confirm the presence of an overall adequate context, with contractual control measures, structured classification and due diligence processes and a consolidated management reporting. Nonetheless, in the ICT Third Parties area, a further strengthening of the control measures in Business Continuity, of the procedures to define and identify concentration risk and a better definition of the controls performed in compliance with the applicable regulations is necessary.

The elements addressed as part of the remedial actions during the year do not jeopardise the reliability of the internal control system, which thus confirmed to be overall adequate.

The Function performs this activity also in outsourcing for subsidiaries and, as of 2025, for Intermonte as well. With regard to the latter, the results of the activity were "partially adequate" relating to the control measures applied in the AML area, in order management and best execution, and ICT security which, under several aspects, also impact the internal control system at Group level. The necessary remedial actions were in any case activated and are still underway, thus substantially in line with the deadlines set.

Interaction between the Board of Statutory Auditors and the Internal Audit Function was constant over the year, as the Function took part in most meetings of the Board of Statutory Auditors. In any case, the Function informs the Board of Statutory Auditors promptly of any issues or areas of concerns that might emerge from its activities.

Upon definition of the 2026 annual audit plan by the Function, the Board of Statutory Auditors formulated its observations on the most relevant topics, making suggestions with a view to improving both processes and contents.

The Compliance Function carries out a preliminary assessment of internal procedures' suitability and provides support and advice with applicable regulations, in addition to verifying ex-post compliance of company processes so as to ensure that operational processes are designed and implemented consistently with the regulatory framework.

Audits revealed an overall medium-low exposure to the risk of non-compliance, in light of the overall design and effective operational development of company processes, despite identifying the following areas requiring enhanced oversight: (i) secu-ritisations of trade receivables requiring thorough assessment of possible measures to protect customers, including those of informational nature; (ii) fine-tuning of measures already in place in compliance with regulatory provisions (reporting obligations, instant payments) and prompt alignment with regulations soon to enter into effect; (iii) the Bank's projects with impacts on the business model (e.g., integration of Intermonte, Investlinx) and personal data processing, including in light of the external context (an increasing number of regulations in the IT area, attention of Authorities and, more generally, an increase of IT risks).

With regard to control activity relating to the distribution network, there continues to be a need to keep high levels of supervision, in addition to further reinforcing them to pursue constant improvement in the efficient monitoring of various risk elements. Within this framework, attention should also be drawn to the constant efforts to raise the awareness of the distribution network of the implementation of the remediations requested by the Network Control Function.

With reference to complaints - relating to both investors and consumers - each quarter the Function presents its observations relating to the overall situation of complaints, based on the data provided by the Function tasked with managing it (number of complaints, those that resulted in litigation and reimbursements paid by the Bank during the period). In light of the limited number of complaints received on banking and financial services and of their nature and diversification, the Function did not detect any new compliance-related issues in relation to the processes concerned.

In the forthcoming year, the Function will continue to monitor the regulatory developments underway (i.e., in the areas relating to Saving and Investments Union, Retail Investment Strategy, Open Finance, etc.) so as to detect the related impacts and promptly define the activities to comply with it, and will analyse the necessary risk management measures regarding business projects (e.g., Intermonte, Investlinx, etc.).

The Compliance Function supported the Data Protection Officer with the activities set out in the GDPR and in data protection regulations. The Annual Report of the Data Protection Officer was presented to the Board of Directors on 20 March 2026 and sets out the activities carried out in 2025. The Report identifies particularly important topics such as the traceability of bank transactions pursuant to Provision 192/2011, as well as the data breach suffered by the provider Infocert S.p.A. and the ensuing notifications that the Bank submitted to the Data Protection Authority. The Report's conclusions confirm the overall suitability of the said control measures to protect personal data.

The Compliance Function prepared the "Annual Report on the Proper Functioning of the Whistleblowing System" for 2025, in which it is stated that the Policy was updated in November 2025 and that no problems were detected with regard to the functioning of internal whistleblowing systems, including in the tests performed on the systems in question. However, five reports were received that gave rise to the necessary inquiries within the deadlines set by regulations.

The Anti-Money Laundering Function performs all the tasks assigned to the Function as

identified by Supervisory Provisions and the AML Policies of Banca Generali Group, described in detail in the Annual Report.

It carries out its activities also for the fiduciary subsidiary Generfid in light of the common customer base, in addition to performing management and coordination of the similar functions established within subsidiaries (BG Aequitum, BG Fund Management Lux, BG Suisse Private Bank and Intermonte SIM).

In particular, in 2025 the Function supervised the proper fulfilment of the customer due diligence obligations through ex-post controls on compliance with the requirements, so as to ensure that processes were actually carried out in accordance with applicable regulations.

As regards customer profiling, it should be noted that the Board of Directors, convened on 19 January 2026, approved the proposal to redefine the RAF thresholds, as follows: Risk Appetite 4.5% and Risk Tolerance 5.0%. The redefinition of the RAF thresholds is aimed at maintaining them in line with the evolution of the banking industry, also taking account of the characteristics of customers of Banca Generali and the relevant (private) peer group.

In terms of "active cooperation", the Anti-Money Laundering Function constantly assesses and analyses in detail the proposed reporting of suspicious operations received from both HQ structures and Branches and from Financial Advisors.

The Function also performs ex-post checks to identify possible anomalous operations performed by customers, with a view to ensuring that processes are not only designed, but also actually implemented and executed in compliance with the regulatory framework. The Function also constantly monitors the progress of remediations required at the end of the periodic checks performed.

In light of the auditing activities performed in 2025 and the overall outcome of checks outlined in the annual risk self-as-sessment, the Function expressed a "mostly adequate" opinion on the AML/CFT control system implemented by the Bank in terms of its completeness, suitability, functionality and reliability. After the annual AML risk-assessment activity, residual risk confirms in fact to be LOW, as in the previous year. Assessment also took account of the overall improvement actions implemented, including following the 2025 Bank of Italy's audit on transaction monitoring.

The Risk Management Function's activity is aimed at ensuring that the Banca Generali Group's risk levels are kept consistent with the risk strategies and the risk profile, and in line with the risk limits and tolerance thresholds established by the Board of Directors in the Risk Appetite Framework (RAF) and in the Recovery Plan. No significant issues worthy of attention were brought to light during the work done over the year.

The year 2025 witnessed a strengthening of control measures. The following are worthy of note: i) the completion of several remediations in relation with operational, ICT and reputational risks; ii) the definition of a control framework for the operations of the newly-acquired company Intermonte in order to monitor risks, especially market and counterparty risks, also with a view to the capital absorption estimated according to regulations for the banking sector; iii) the implementation and fine-tuning of the assessment methodologies brought in line with DORA Regulation, in particular: (i) ICT & Security Risk Assessment, (ii) risk assessment on ICT Third Parties (iii) risk assessment on ICT projects. Moreover, the activity was integrated by the design and implementation of the applications for the execution of ICT & Security Risk assessments on processes and ICT Third Parties; iv) the improvement of the asset and liability management (ALM) systems, through the updating of the parameters underlying the PAV and CSRBB models, and of the framework to monitor the rate risk profile of the banking book, in compliance with regulations concerning basis risk monitoring, also by defining differentiated shock scenarios on each market curve (multicurve framework); v) the development of tools for analysing the potential risks that may arise from the adoption of new technologies: methodological evolution to integrate assessments with specific risk measurements deriving from emerging technologies, such as Artificial Intelligence (AI), also taking account of regulatory developments (e.g., the AI ACT).

From the assessment of the risk management process the need emerged to continue to consolidate data quality and risk analytics (with regard to market risk and ESG), update risk models (with regard to basis risk in the ALM, PAVs behavioural models, CSRBB and the credit risk arising from loans to customers, the accepted internal rating model) and, more generally, to formalise a risk governance model framework at Group level.

Moreover, in light of the acquisition of Intermonte, the Chief Risk Office intends, as part of the project to implement the new front office system (Murex), provide the investment firm (SIM) with metrics for an adequate risk assessment and methodologies for the fair value measurement of transactions involving derivatives and structured products, in line with the Group's governance and methodologies. With regard to ICT and IT security risks, an evolution of the ICT & Security Risk Management framework is expected, through the adoption of web applications. In addition, in accordance with the Insurbanking strategy, the asset management check and monitoring framework will be strengthened.

The Board of Statutory Auditors examined the Internal Capital Adequacy Assessment Process (ICAAP) documents, which quantify the current and prospective internal capital to be held for the risks to which the Group is exposed, as well as those for liquidity (ILAAP), which aim to assess the adequacy of the liquidity held by the Bank. Both documents were approved by the Board of Directors on 17 April 2025. The ICAAP and ILAAP confirm the adequacy of the Bank's capital and liquidity. The Board of Statutory Auditors formulated its observations also on the basis of the Report of the Internal Audit Function, which acknowledges compliance with regulations.

The Board of Statutory Auditors examined the new Risk Appetite Framework (RAF) with effect from 2026, taking account of the recommendations of the Supervisory Authorities and of the regulatory indications. The structure of primary and complementary indicators remained unchanged compared to the previous year, except for the inclusion among primary indicators of the RWA-related ratio (TREA) in view of the application of the new MREL thresholds as of 1 January 2027. Moreover, estimates relating to capital ratios were updated based on the third-quarter 2025 risk profile and keeping as still valid the 2025 forecasts included in the last Plan. Lastly, the thresholds of the AML High Risk Profile Ratio were updated to maintain it in line with the industry trends. The RAF confirms the Bank's solidity, with capital and liquidity ratios above the minimum regulatory requirements.

In order to assess the internal control system, particular importance is attached to the analysis of the operational procedures and methods that the Control Functions adopt to pursue their objectives, as well as the suitability of their staff. The Control Functions operate on the basis of procedures that are approved by the Board of Directors and kept up to date, and analyse in detail the activity to be carried out. At the level of resources, the Board of Statutory Auditors liaised with all Control Functions and expressed its opinion on the appropriateness of resources at the end of 2025 in consideration of the Functions' activity plan for 2026, requesting constant updates on their adequacy.

The Board of Statutory Auditors oversaw the remuneration of the control functions, for purposes of the variable component payment. In concert with the Remuneration Committee and the Internal Audit and Risk Committee, it analysed the score-cards of their qualitative performance in terms of the objectives set for 2025.

The Bank prepared the "Summary Report on the ICT and Cyber-Security Risk Situation", which provides the main outcomes on IT risk management relating to 2025, in compliance with the provisions of the Bank of Italy Circular No. 285 of 17 December 2013 (as subsequently amended) and the Regulation

(EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 - "Digital operational resilience for the financial sector" (DORA), which provide for the adoption of an integrated model for managing, assessing and dealing with corporate risks.

In 2025, the Bank executed the DORA programme, which included the consolidation of line processes and the implementation of the ICT and IT security risk management framework.

As required by the DORA Regulation, the areas subject to assessments with regard to ICT and IT security risks were identified in: (i) processes - assessments through an annual campaign; (ii) third parties, i.e Outsourcers and ICT suppliers

• periodic assessments and on an event basis; (iii) ICT projects

• assessments on an event basis.

A medium/medium-low risk emerged from the assessment of the three areas. Medium risk is chiefly attributable, in keeping with the previous year, to the outsourcer CSE with regard to both processes and the outsourcer's quality due to the full outsourcing model, which also generates a concentration risk. In the processes area, the remedial actions were identified with regard to the control measures in place and the governance of applications. Some of the said actions are already being implemented. As far as Outsourcers and ICT Suppliers are concerned, although the control mechanisms and the measures adopted are robust and effective, an implicit residual risk still remains, which qualifies as medium, but with a high concentration risk, in relation with the full outsourcing model adopted by the Bank.

With regard to the implementation status of security initiatives, the main security operational activities concerned (i) Incident Management; (ii) Fraud Management; (iii) Analysis of Security Threats; (iv) Physical Security; (v) Event Security; (vi) Trip Security. Overall, the main KPIs indicate adequate security levels, with improvement points identified and addressed in the 2026 plan.

The main interventions planned in the 2025 security plan have been completed. Some project activities will continue in 2026, ensuring an evolution in terms of extension of their scope and effectiveness of the supporting technological solutions (e.g. projects linked to Identity and Access Management systems, third-party security).

As far as fraud is concerned, it should be noted that most of the amounts have been recovered.

As for operational continuity, several operational continuity and disaster recovery test sessions were conducted in 2025 and the first quarter of 2026, aimed at assessing the responsiveness and effectiveness of the operational continuity strategy in case of critical issues and significant disruptions. Test results were positive, confirming the solidity of the measures adopted.

Based on the work carried out, the information acquired, the content of the annual reports of the Control Functions, and particularly the overall favourable opinion expressed by the Control Functions regarding the internal control system, the Board of Statutory Auditors considers that there are no significant issues such as to affect the structure of the internal control and risk management system.

The Board of Statutory Auditors, in the exercise of its functions, has overseen compliance with the provisions contained in Legislative Decree No. 125 of 6 September 2024, in particular with reference to the drafting process and the contents of the Sustainability Statement drawn up by Banca Generali.

The main sustainability governance structures chiefly consist of the Board of Directors, the Sustainability and Innovation Committee, the Remuneration Committee and the Internal Audit and Risk Committee. In particular, the Sustainability and Innovation Committee, pursuant to its Regulation, i) supports the Board of Directors in integrating sustainability into the definition of corporate strategies; ii) provides a prior assessment of the strategic ESG-related proposals for updating the Sustainability Policy; iii) monitors on a regular basis the main sustainability-related KPIs; iv) examines the general outline of the Sustainability Statement contained in the Annual Integrated Report and its content organisation, as well as the completeness and transparency of the information it provides, expressing its observations in this regard to the Board of Directors called to approve the said Statement.

In 2025, the Board of Directors and/or the committees - each for the matters falling under its remit - received regular reports and, where required, were called on to resolve on sustainability matters. The areas subject to disclosure included in particular the Transition Plan, the approach to sustainable finance, the updating of the Sustainability Dashboard with the introduction of new KPIs on individual material impacts, risks and opportunities, the remuneration policies and their ESG targets, the monitoring of the Action Plan on climate-related and environmental risks, and the updating of the Double Mate-

riality Analysis. Where applicable, a peer analysis was always submitted to the corporate bodies, so as to enable a better strategic assessment.

Banca Generali decided that the attestation of compliance with the standards set forth by sustainability regulations be issued by the Manager in Charge of preparing the Company's financial reports. Accordingly, in this area the tasks of the Manager in Charge concerning the preparation of financial reporting were extended, with particular regard to the supervision of the administrative procedures for collecting and selecting data for the purposes of the Sustainability Statement.

Moreover, the 262 Model was integrated with specific controls to ensure the accuracy and reliability of the sustainability-re-lated information. The 262 Model guarantees compliance with applicable regulations, the integration with company's strategies and the mitigation of the risks associated with the disclosure of sustainability-related information. On a six-monthly basis, the Board of Statutory Auditors receives from the Manager in Charge the results of this activity and assesses the results thereof.

The Board of Statutory Auditors thus verified - acknowledging the content of the attestation issued by the Chief Executive Officer and the Manager in Charge pursuant to Article 81-ter of Consob Regulation No. 11971/99 and the content of the Independent Auditors' Report - that the Consolidated Sustainability Statement was drawn up in compliance with the reporting standards applied pursuant to Directive 2013/34/EU and the related Decree and the specific provisions adopted pursuant to Article 8, paragraph 4, of Regulation (EU) No. 2020/852.

In accordance with the provisions of Article 19 of Legislative Decree No. 39/2010, the Board of Statutory Auditors (in its capacity as Internal Control and Audit Committee) carried out the prescribed supervisory activities regarding the Independent Auditors' operations.

KPMG, which was already awarded the statutory audit of the financial statements, is the firm assigned with the task of performing the limited assurance of the Sustainability Statement up to the financial statements for the year ending 31 December 2029.

The Board of Statutory Auditors monitored on an ongoing basis the activity of Independent Auditors, with which it met regularly in order to ensure an adequate exchange of information flows. In particular, the Board of Statutory Auditors examined the Audit Plan prepared, also relating to the limited assurance of the Consolidated Sustainability Statement, liaising with the contact persons of Independent Auditors.

The Independent Auditors, in their report issued on 24 March 2026, highlight, based on the work carried out, that they did not identify any elements that led them to believe that:

› the Sustainability Statement of Banca Generali for the year ended 31 December 2025 was not prepared, in all material respects, in compliance with the reporting principles adopted by the European Commission pursuant to Directive 2013/34/EU;

› the information contained in section "Disclosures pursuant to Article 8 of Regulation (EU) 2020/852 (Taxonomy Regu-lation)" has not been prepared, in all material respects, in accordance with Article 8 of EU Regulation No. 852 of 18 June 2020.

The Manager in Charge and the Chief Executive Officer issued the attestation, pursuant to Article 154-bis, paragraph 5-ter of TUF, certifying that the Sustainability Statement was drawn up in compliance with i) the reporting standards applied pursuant to Directive 2013/34/EU and Legislative Decree No. 125/2024 and ii) the specific provisions adopted pursuant to Article 8, paragraph 4, of Regulation (EU) No. 2020/852 (Taxonomy Regulation).

The Board of Statutory Auditors did not become aware of breaches of the relevant regulatory provisions.

1. Omissions or censurable events, opinions given and initiatives taken

   The Board of Statutory Auditors did not receive any reports pursuant to Article 2408 of the Italian Civil Code.

   The Board of Statutory Auditors is not aware of any other events or matters to report to the Shareholders' Meeting.

   The Board of Statutory Auditors, in addition to the matters already indicated in this Report, issued opinions or expressed observations that are within its remit pursuant to current legislation and supervisory provisions for banks. In particular, the Board of Statutory Auditors expressed:

   › its opinion on the processes and procedures relating to the remuneration of Directors, when required, in particular on the remuneration of the Chief Executive Officer and of the

   members of the Board committees;

   › its opinion on the presentation to the Board of Directors of transactions falling within the scope of Article 136 of TUB;

   › the favourable opinion on the approval of the Policy for assigning non-audit services to Independent Auditors;

   › considerations on the Annual Report regarding the outsourcing of important operational functions.

   In the course of the activity carried out and based on the information obtained, no omissions, censurable matters, irregularities or significant circumstances were found that needed to be reported to the Supervisory Authorities or mentioned in this Report.

2. Supervisory Board

   After being assigned the functions attributable to the Supervisory Board ("SB") referred to in Article 6, paragraph 4-bis of Legislative Decree No. 231/2001 on the vicarious liability of entities, the Board of Statutory Auditors oversaw the functioning and compliance with Model 231 adopted by the Bank and analysed the periodic information flows received from the Control Functions.

   During the year, the Supervisory Board oversaw the adequacy of the Model in light of regulatory developments. The 231 Model currently in force was adopted by the Board of Directors during the meeting held on 25 March 2025, since no such substantial changes to predicate offences or organisational changes were made to require an update of the model.

   No reports of breaches of the Organisational and Management Model pursuant to Legislative Decree 231/01 were received through the dedicated e-mail account during the period. Five reports were received through the whistleblowing channels set up pursuant to the Whistleblowing Policy, but no material elements for the purposes of Legislative Decree 231/01 were identified. In this regard, the necessary inquiries were conducted, resulting in dismissal of the reports.

   The Board of Statutory Auditors, in its capacity as Supervisory Board, reported on the activities carried out during the year ended 31 December 2025 without pointing out any issues, illustrating an overall satisfactory situation and substantial alignment with the provisions of the 231 Model adopted by the Bank, ascertaining that the same is adequate.

3. Conclusions

In view of the Ordinary Shareholders' Meeting convened, in first call, on 16 April 2026 (as per the notice of calling published on 17 March 2026), the Board of Statutory Auditors, without prejudice to the specific duties and responsibilities of the Independent Auditors in terms of auditing the accounts and verifying the reliability of the financial statements, has no comments to make to the Shareholders' Meeting, pursuant to Article 153 of TUF, regarding the approval of the Financial Statements as

at 31 December 2025, accompanied by the Annual Integrated Report, as presented by the Board of Directors and the proposal for the distribution of net profit for the year.

Milan, 24 March 2026

The Board of Statutory Auditors

2025