Q4 2025 MCAN Supplemental Regulatory Disclosure

M C A N F I N A N C I A L . C O M T S X : M K P

‌This supplemental regulatory disclosure report includes (i) Basel III Pillar 3 disclosures; and (ii) Climate Risk Management disclosures for MCAN Mortgage Corporation d/b/a MCAN Financial Group (the "Company", "MCAN" or "we") at December 31, 2025.

Additional information regarding MCAN, including copies of our continuous disclosure materials such as the Annual Information Form, are available on the System for Electronic Document Analysis and Retrieval ("SEDAR+") at https://www.sedarplus.ca and our website at https://www.mcanfinancial.com.

‌Basel III Pillar 3 Disclosures

These disclosures are made pursuant to the Pillar 3 Disclosure Guideline for Small and Medium-Sized Deposit-Taking Institutions ("SMSBs") Capital and Liquidity Requirements of the Office of the Superintendent of Financial Institutions ("OSFI") as MCAN is a Category II SMSB. Additional information can be found on OSFI's Financial Data for Loan Companies website: https://www.osfi-bsif.gc.ca/Eng/wt-ow/Pages/FINDAT-lc.aspx. For further qualitative disclosure, refer to our 2025 Annual Report, on the System for Electronic Document Analysis and Retrieval at www.sedarplus.ca or the Company's website at www.mcanfinancial.com.

The amounts disclosed in the tables below represent the carrying amounts included in the Company's consolidated financial statements at and for the year ended December 31, 2025, which are prepared in accordance with International Financial Reporting Standards ("IFRS") and use the accounting policies described therein. This document is unaudited and is reported in thousands of Canadian dollars, unless otherwise noted.

The Basel III capital adequacy framework is applied to the consolidated operations of the Company, which include the Company's wholly-owned subsidiary, MCAN Home Mortgage Corporation.

The Company's Common Equity Tier 1 ("CET 1") capital consists of share capital, contributed surplus and retained earnings. The Company does not hold any additional Tier 1 capital instruments; therefore, its CET 1 capital is equal to its Tier 1 capital. The Company's Tier 2 capital consists of Stage 1 and Stage 2 mortgage allowances calculated under IFRS. Total Capital equals CET 1 or Tier 1 capital plus Tier 2 capital.

The Company's authorized share capital consists of an unlimited number of common shares with no par value. At December 31, 2025, the Company had 40,471,074 common shares outstanding.

As a Loan Company under the Trust Act, OSFI oversees the adequacy of the Company's capital. OSFI requires all federally regulated institutions to meet the minimum capital to risk-weighted asset ("RWA") ratios of 7% CET 1 capital, 8.5% Tier 1 capital and 10.5% Total capital and a minimum leverage ratio which is calculated on a different basis from the MIC leverage ratio. The risk-weighting of all on-balance sheet assets and all off-balance sheet assets is based on a prescribed percentage of the underlying asset position, in addition to adjustments for other items such as impaired mortgages. Risk-weighted assets also include an operational risk charge, which is based on certain components of the Company's net income over the past 12 quarters. The Company uses the standardized approach for credit risk and the basic indicator approach for operational risk. The Company maintains internal minimum targets for CET 1, Tier 1 and Total capital ratios.

The Company maintains prudent capital planning practices to ensure that it is adequately capitalized and continues to satisfy minimum standards and internal targets. In conjunction with the annual strategic planning and budgeting process, the Company completes an Internal Capital Adequacy Assessment Process ("ICAAP") in order to ensure that it has sufficient capital to support its business plan and risk appetite. The ICAAP assesses the capital necessary to support the various inherent risks that the Company faces, including liquidity and funding, credit, interest rate, market, operational, regulatory compliance, strategic and reputational risks. The Company's business plan is also stress tested under various adverse scenarios to determine the impact on its results from operations and financial condition. The ICAAP is reviewed by both management and the Board of Directors (the "Board") and is submitted to OSFI annually. In addition, the Company performs stress testing on its internal forecasts for capital adequacy on a quarterly basis, and the results of such testing are reported to the Board.

The Company's key metrics are outlined in the table below. OSFI's Pillar 3 Disclosure Guideline for SMSBs Capital and Liquidity Requirements prescribes standardized row numbers when disclosing certain capital information to facilitate comparability across regulated entities.

The Company's total balance sheet exposures, regulatory capital and leverage ratio are outlined in the table below. OSFI's Pillar 3 Disclosure Guideline for SMSBs Capital and Liquidity Requirements prescribes standardized row numbers when disclosing certain capital information to facilitate comparability across regulated entities.

1 Certain items, such as negative cash balances and derivatives, are adjusted from on-balance sheet items but included in consolidated assets in our 2025 Annual Report.

The Company's regulatory capital information at December 31, 2025 is outlined in the table below. OSFI's Pillar 3 Disclosure Guideline for SMSBs Capital and Liquidity Requirements prescribes standardized row numbers when disclosing certain capital information to facilitate comparability across regulated entities.

Credit risk is the risk of financial loss resulting from the failure of a counterparty, for any reason, to fully honour its financial or contractual obligations to the Company, primarily arising from our investments and lending activities. Fluctuations in interest rates may impact real estate values and may also reduce the net realizable value of the collateral property to the Company. These risks may result in defaults and credit losses, which may result in a loss of earnings.

Credit risk is managed through risk management policies and procedures that emphasize the quality and diversification of our investments and lending activities. Credit policies include credit risk limits in alignment with the Risk Appetite Framework. These credit risk limits include, but are not limited to, concentration by asset class, geographic region, dollar amount and borrower. These policies are amended on an ongoing basis and approved by the Board to reflect changes in market conditions and risk appetite.

The Capital Commitments Committee, which is comprised of management, is accountable for decision-making on credit risk issues and provides oversight of proposed investments for the construction, commercial and marketable and non-marketable securities portfolios.

Credit and commitment exposure are closely monitored by operational and oversight business units. The Risk and Compliance Committee, which is comprised of management, monitors and challenges credit risk exposures, monitors portfolio and underwriting quality and performance against credit risk limits on a quarterly basis. The Enterprise Risk Management and Compliance Committee reviews all material risks affecting the Company on a quarterly basis, which includes the identification, assessment, and monitoring of material credit risks.

The Company identifies potential risks in our mortgage portfolio by way of regular review of market and portfolio metrics, which are a key component of quarterly market reports provided to the Board by management. Existing risks in our mortgage

portfolio are identified by arrears reporting, portfolio diversification analysis, post funding monitoring and risk rating trends of the entire mortgage portfolio. The aforementioned reporting and analysis provide adequate monitoring of and control over our exposure to credit risk.

The Company assigns a credit score and risk rating for all mortgages at the time of underwriting based on the assessed credit quality of the borrower and the value of the underlying real estate. Risk ratings are reviewed annually at a minimum, and more frequently whenever there is an amendment, or a material change such as a default or impairment.

As part of the Company's credit risk management process, the Company monitors its loan portfolio for early indicators of potential concern. The "monitored/arrears" category includes construction and commercial loans that may experience events such as slow sales, cost overruns or are located in geographic markets in which risks have arisen. Loans in this category are included in stage 2. Considering factors such as borrower equity, portfolio loan to value ratios and project liquidity, at December 31, 2025, there have been no indications at the portfolio level of potential loss of principal in excess of the allowances for credit losses recorded for mortgages in stage 1 and 2. These collective allowances are based on forward-looking economic assumptions and other factors.

As a response to economic uncertainty, the Company has increased the frequency of monitoring and reporting of our credit risk profile, including enhanced arrears reporting and pipeline monitoring. Real estate prices may continue to be impacted by macroeconomic headwinds, which may adversely impact asset values and the ability for borrowers to make timely payments on mortgages.

The maximum credit exposure on our individual financial assets is equal to the carrying value of the respective assets, except for our non-securitized mortgage portfolio, where maximum credit exposure also includes outstanding commitments for future mortgage fundings and our investments in non-marketable securities, where maximum credit exposure includes our total remaining commitments.

Operational risk is the potential for loss resulting from people, inadequate or failed internal processes, systems, or from external events. Operational resilience is the ability to deliver operations, especially critical operations, through disruption.

The Operational Risk Management and Resiliency Framework ("ORMRF") covers all components of MCAN's operational risk management, including processes and control activities to ensure adherence with business and regulatory requirements. The ORMRF sets out an integrated approach to identify, measure, monitor, manage and report on known and emerging operational risks. Management and the Board review operational risk on a quarterly basis. Complementing the ORMRF is the Crisis Management Framework which serves to enable operational resiliency in stressed and crisis scenarios.

Third Party Risk

Within operational risk, third party risk is the risk of third parties failing to provide goods and services or otherwise carrying out activities in accordance with their arrangements. This risk also considers similar risks as it relates to fourth and fifth parties. We outsource the majority of our construction and commercial mortgage origination, mortgage servicing and collections to MCAP and other third parties. There is a risk that the services provided by third parties will fail to adequately meet our standards and expose MCAN to negative outcomes.

The Company's Third-Party Risk Management Framework incorporates the relevant requirements of OSFI Guideline B-10, Third-Party Risk Management Guideline. We regularly review our critical third-party relationships to determine if an arrangement is critical and to assess the overall risk inherent in that arrangement. All third-party arrangements are subject to a risk management program, which includes detailed monitoring activities. If a third-party arrangement is critical, it is subjected to an enhanced risk management program.

Technology and Cyber Security Risk

Technology risk encompasses the risk of IT systems, tools, and practices being unable to support business and user needs. Cyber security risk is the risk of loss of confidentiality, integrity, or availability of information, data, or information (or control) systems as a result of actions taken by internal or external malicious actors. In particular, the cybersecurity threat landscape remains elevated globally, where threat actors are increasingly utilizing sophisticated tools and technologies to disrupt

business operations. Any such system failure or material data loss, either accidental through misconfiguration or purposeful through threat actors, could generate disruption to business practices, create financial loss, and damage MCAN's reputational risk profile.

The IT Management Committee, which is comprised of management, is accountable for overseeing technology and cybersecurity risk management activities and reports cyber security, system performance, and technology change management risks to the IT Governance Committee ("ITGC"). The Senior Director, Digital and Information Technology reports on the technology and cyber risk profile to the ITGC. We also leverage third parties to provide cyber security insurance, incremental technical expertise, infrastructure and security monitoring support, and periodic cyber security assessment assistance, such as vulnerability/penetration testing and broader risk assessments. These activities are complemented by crisis management plans, including a Cyber Security Incident Response Plan, Disaster Recovery Plan, and process-level Business Continuity Plans, all of which are supported by an executive Crisis Management Team.

Strategically, MCAN continues to invest in its technology and data infrastructure to enhance operational processes, resiliency, cyber security, analytical capabilities, and digital-first customer offerings.

Data Risk Management

Data Risk Management is the risk of data being improperly sourced, stored, accessed or retained, due to gaps in data management practices or model governance, resulting in suboptimal decision-making, regulatory scrutiny, reputational harm, and financial impacts.

Management leverages data-driven insights to inform strategic decision-making, underscoring the importance of investing in our data infrastructure. These investments ensure we have robust, reliable, and timely data to support our operations and strategic initiatives. Concurrently, we are enhancing our control environment to strengthen governance, risk management, and compliance processes.

Process Risk Management

Process risk is the risk that business processes are unable to readily adapt when needed or be optimally executed due to system limitations, inflexible process design, or poor execution, resulting in operational or customer-facing disruptions.

Management is dedicated to enhancing our processes to increase throughput while ensuring the continuity of business operations. We have established comprehensive risk frameworks, including business continuity plans, to mitigate potential disruptions and safeguard our customers from adverse impacts. Additionally, management continually invests in our process infrastructure to improve service delivery and reduce risk. This proactive approach helps us maintain operational resilience and strive to deliver seamless experiences for our customers.

Market risk is the exposure to adverse changes in the value of financial assets. Market risk includes price risk on marketable securities, execution risk and real estate values, among others. Any changes in these market risk factors may negatively affect the value of our financial assets, which may have an adverse effect on our financial condition and results of operations. We do not undertake trading activities as part of our regular operations, and therefore are not exposed to risks associated with activities such as market making, arbitrage or proprietary trading.

Our marketable securities portfolios are susceptible to market price risk arising from uncertainties about future values of the securities. We manage the equity price risk through diversification and limits on both individual and total securities. Portfolio reporting is submitted to management on a regular basis and to the Board on a quarterly basis.

Our non-marketable securities portfolios are focused on equity and debt investments in Canadian real estate focused funds. The portfolio is susceptible to the overall outlook of the real estate market, execution risk from respective fund managers, and other market conditions, such as spreads, housing prices, land prices, construction costs and adverse changes in interest rates or capitalization rates.

‌Climate Risk Management Disclosure

As part of OSFI's B-15 Climate Risk Management Guideline, MCAN has produced the disclosure below on how we integrate climate-related risks into our decision-making and risk management frameworks, along with its impact to our business model and financials.

MCAN's governance on climate-related risks is integrated in existing quarterly Senior Management and Board level Committees, inclusive of Risk & Compliance Committee ("RCC") and the Enterprise Risk Management & Compliance Committee ("ERM&CC"). For a detailed description of all risk management governance associated with the Company, refer to the "Risk Governance and Management" section of our 2025 Annual Information Form, which is available on the Company's profile on SEDAR+ at https://www.sedarplus.ca. Both RCC and ERM&CC maintain strong oversight over MCAN's risk management practices across financial and non-financial risks and impacts through qualitative and quantitative reporting. Further, learning on climate-related developments, in addition to other risk environment changes, are elements within these committees.

For all team members, MCAN's remuneration is tied to a team member's capability in meeting our DRIVE values, of which "Resilience", which encompasses risk management competencies across all risk types, is a core value.

At the Management-level, MCAN applies proportional, fit-for-purpose, governance over all its risks, inclusive of climate-related risks. Senior Management's RCC, which includes our executive leadership team, receives updates on major risk and regulatory developments, as well as Management progress on ongoing risk management activities. Further complementing RCC is regular reporting on financial and non-financial risks via quantitative and qualitative methods of which climate-related information is integrated.

As MCAN is primarily focused on residential real estate funded by term deposits and residential mortgage securitizations within regions where physical risks are well-understood and of lower likelihood, impacts to cash flows, finance, or cost of capital are minimal. The geographic spread of our loans within these regions further supports that impacts would be isolated to individual loans, presenting nominal short-term impacts.

In the longer-term, MCAN acknowledges there to be transition-related opportunities associated with green investment or funding vehicles (e.g. sustainable bonds, green mortgages), but MCAN does not offer these vehicles currently.

MCAN performs climate-related analysis at loan origination to ensure minimal physical risk, leveraging tools such as appraisal reviews and environmental assessments. MCAN has minimal appetite to lend in flood plains or areas that have increased risk of forest fire, and this approach is factored into our underwriting criteria. MCAN anticipates no material changes to its business model or value chain due to its limited exposure to climate-related risks but monitors for these risks and opportunities regularly.

Climate-related Risk Impacts

In 2025, climate-related risks or risk events did not impact MCAN's financial position. Based on our current business model and portfolio distribution across real estate assets, MCAN currently does not expect material impacts to its financial performance from climate-related physical or transition risks, nor any major investments associated with mitigation or adaptation efforts based on the existing scope of business and strategy.

MCAN maintains a Climate Risk Management Framework that details how climate-related risk identification, assessment and monitoring are embedded proportionally across Operational Risk, Credit, and Strategic risk assessment programs and governance. Further, MCAN performs portfolio-level analysis of its residential real estate assets to understand physical risk exposures. The outcomes of this analysis inform our ICAAP as well as appropriate sizing of climate-related risks relative to other risk types.

Further, MCAN performs an annual strategic enterprise risk assessment that considers climate-related physical and transition risks. These risks and associated opportunities are considered annually in alignment with strategic and budget planning, as well as risk appetite setting. If the risks are deemed material to strategic objectives, they are scoped in for assessment, rated across the dimensions of likelihood and severity, and prioritized accordingly.

MCAN monitors provincial concentration metrics across its core business lines. These concentration metrics provide insight on areas of potential risk, as well as for potential future diversification and strategic growth. Further, MCAN monitors its Scope 1 and 2 emissions on an annual basis. As 2025 operational emissions data are not yet available at the time of this disclosure, MCAN is reporting its 2024 operational GHG emissions. MCAN has used the GHG Protocol Corporate Standard to classify and report Scopes 1 and 2. The methodology, built on utility billing data and recognized emission factors, is consistent with and comparable to GHG Protocol requirements.

As an office-based organization with no combustion equipment or corporate vehicles, MCAN recorded zero Scope 1 emissions for 2024. MCAN's location-based Scope 2 emissions arise solely from electricity usage associated with its leased corporate office facility.

MCAN relies on verified utility consumption data from its landlord. Emissions are calculated using location-based grid emission factor. No renewable energy certificates, market-based factors, or carbon offsets are applied by MCAN. Only gross Scope 2 emissions, based on actual electricity consumption, are reported.

MCAN's total emissions from its facilities in 2024 were: 5.9 tCo2e

On a forward-looking basis, based on our business strategy and hybrid working model, MCAN does not expect its Scope 1 and 2 emissions to materially change year-over-year.

As MCAN's core business is financing real estate development and individual borrowers, MCAN's climate-related risks and opportunities are of lower materiality and impact relative to other risks and opportunities. Thus, specific targets relative to climate-related goals are not established based on current strategy. However, as MCAN's strategy evolves, Management may elect to set targets if climate-related risks and opportunities become more material to corporate goals.

MCAN remains committed to sound risk management practices and a strong risk culture. Management will continue investing in understanding climate-related risk, which will help shape MCAN's approach to climate risk management in future. Our ongoing memberships with the Global Risk Institute and Partnership for Carbon Accounting Financials and consultations with OSFI will also be leveraged to further our knowledge on climate-related risk and reporting standards.