4

|

ING Bank Śląski S.A.

|

Report on non-financial information of ING Bank Śląski S.A. Group in 2021

• factoring,

• payroll and accounting services.

The group members are also the founders of ING for Children Foundation and ING Polish Art Foundation.

In 2021, the bank and its subsidiaries did not conclude any transactions with related entities that would be individually or jointly significant and concluded other than on the arm’s length basis.

ING Bank Śląski performs operations with ING Bank N.V. and its subsidiaries on the inter-bank market. These are both short-term deposits and loans, as well as operations in derivatives. The bank also maintains bank accounts of entities from the ING Group as well as provides outsourcing and advisory services. All of the above transactions are carried out on an arm’s length basis.

The operating costs incurred by the bank in favour of the parent entity result mainly from agreements for consulting and advisory services, operational support, operational handling of payment cards and data processing and analysis, provision of software licences, or IT support. In terms of costs incurred by the bank for other related entities, outsourcing agreements play a dominant role regarding the provision of system resource hosting services for various applications, leasing of IT equipment, monitoring the availability and performance of applications and IT infrastructure as well as penetration testing and IT security monitoring. You can read more about transactions with related entities in the “Related entities” note in the Annual Consolidated Financial Statements of the ING Bank Śląski S.A. Group for 2021.

ING Bank Śląski S.A. Group composition

Subsidiaries and associates within the ING Bank Śląski S.A. Group as at 31 December 2021

A solid frame line indicates a subsidiary and a dashed frame line indicates an associated company; *the ING Lease (Polska) Group comprises an additional 5 subsidiaries in which ING Lease (Polska) Sp. z o.o. holds 100% of the shares.

The Bank, through ING Investment Holding (Polska) SA, holds 45% of shares in NN Investment Partners TFI SA and treats this company as an associated company. Subsidiaries are consolidated by our bank using the full method, and the associated company (NN Investment Partners TFI SA) is consolidated using the equity method. In addition to its subsidiaries and associates, the bank has minority capital investments, including in the following companies:

• Biuro Informacji Kredytowej S.A. (9.0% of shares),

• Krajowa Izba Rozliczeniowa SA (5.7% of shares),

• Polski Standard Płatności Sp. z o.o. (14.3% of shares).

ING Bank Śląski S.A.

ING Investment Holding (Polska) S.A. (100%)

ING Lease Polska Sp. z o.o.* (100%)

ING Commercial Finance Polska S.A. (100%)

NN Investment Partners TFI S.A. (45%)

ING Bank Hipoteczny S.A. (100%)

ING Usługi dla Biznesu S.A. (100%)

Nowe Usługi S.A. (100%)

Solver Sp. z o.o. w likwidacji (100%)

5

|

ING Bank Śląski S.A.

|

Report on non-financial information of ING Bank Śląski S.A. Group in 2021

ING Investment Holding (Polska) S.A.

ING Investment Holding (Polska) S.A. is a holding company. Through that company, the bank holds shares in three companies: ING Lease (Poland) (100%), ING Commercial Finance (100%) and NN IP TFI (45%).

ING Lease (Polska) Sp. z o.o.

ING Lease (Polska) has been present in the market since 1995. Since 2012, it has been a member of the Group of ING Bank Śląski S.A. ING Lease (Polska) offers all basic types of leasing which allow to finance both movables (in the form of cars, vans, heavy transport vehicles, machinery and equipment, construction, medical, equipment and IT equipment) and real estate. The ING Lease (Polska) Group is composed of 5 subsidiaries wherein ING Lease (Polska) Sp. z o.o. holds 100% of shares. The company services are targeted at all market segments: large, medium and small enterprises as well as micro clients (entrepreneurs).

In 2021, the company’s new leasing production amounted to PLN 6.3 billion (+64.0% y/y). As at 2021 yearend, the company served almost 36 thousand clients (an increase of 6.5% y/y) and the value of the portfolio amounted to PLN 11.5 billion (+11.6% y/y; based on management accounting data).

ING Commercial Finance Polska S.A.

ING Commercial Finance Polska offers factoring products. The company was incorporated in 1994 under the name of Handlowy Heller. Upon its incorporation into ING Group, since 2006 the company has been operative under the name of ING Commercial Finance Polska. Since 2012, it has been the member of the ING Bank Śląski S.A. Group – like ING Lease (Polska).

As per the Polish Factors Association’s data, in 2021, ING Commercial Finance Polska was the second biggest factoring company in Poland. In 2021, the turnover of ING Commercial Finance Polska totalled PLN 53 billion (up +43% y/y), which accounted for 14.7% of the market turnover. In 2021, the Company served nearly 8.2 thousand clients (up by 49% y/y) and bought out 3.9 million invoices (up by 19% y/y).

ING Bank Hipoteczny S.A.

The main purpose of the operation of ING Bank Hipoteczny, which started operating in 2019, is the issue of long- term mortgage bonds with the underlying instruments being debt claims under the mortgage-backed loans acquired from ING Bank Śląski S.A. or other banks.

The set goal may be achieved through:

• strengthening of funding stability in the ING Bank Śląski S.A. Group,

• diversification of funding sources for the existing retail mortgage portfolio,

• adjusting maturity structure of assets and liabilities in the balance sheet,

• releasing liquidity of the ING Bank Śląski S.A. Group,

• lowering the cost of financing the conducted lending activity in the part of the loan portfolio financed with other long-term instruments.

ING Bank Hipoteczny has so far issued 5-year “green” mortgage bonds in 2019 for an amount of PLN 400 million. The funds obtained from the issue will be used to refinance mortgage loans in PLN for natural persons, secured with mortgage belonging to 15% of the most energy-efficient buildings in Poland. In recent years, due to the market situation caused by the COVID-19 pandemic, ING Bank Hipoteczny did not issue mortgage bonds, but in order to increase the diversification of its existing funding sources, it established an own bond programme under which it issued short-term debt securities.

ING Usługi dla Biznesu S.A.

Since 2013, the Company has been offering innovative business services beyond traditional banking. Expanding its business activities into new market segments, in 2019 the company entered for the first time into the market of services for individual clients.

ING Usługi dla Biznesu operates in the following business areas:

• online database of companies (registry data, financial data) and an online B2B trade and auction platform run under the ALEO brand,

• a platform for invoicing and payment management once accounting and payroll services – under the ING Księgowość brand,

• distribution of software for robotisation of business processes – under the SAIO brand,

• an application for individual clients aggregating bills from many providers in one place – under the brand of imoje accounts.

Nowe Usługi S.A.

Nowe Usługi S.A. conducts educational and marketing activities. In the field of education, it runs the website Edukacjagieldowa.pl . This is a website about investing and the stock market, both for debuting and fully-fledged

investors. The knowledge database and investment-related materials are published on an ongoing basis on the website.

6

|

ING Bank Śląski S.A.

|

Report on non-financial information of ING Bank Śląski S.A. Group in 2021

Marketing activity centres around popularisation of ING Turbo certificates on the Polish market. The instruments are issued by ING Bank N.V. Amsterdam and quoted at the Warsaw Stock Exchange The main activities of the company are the organisation of marketing campaigns, ING Turbo helpline service or technical support while running the ingturbo.pl website.

Solver Sp. z o.o. in liquidation

The SOLVER company was established on 21 May 1996 in order to conduct business activities on behalf of the ING Children Foundation.

In recent years, the company’s activities have mainly involved organising holidays for employees and their families and pensioners of ING Bank Śląski S.A. This activity was carried out in the Training and Recreation Centre “Pan Tadeusz” in Krynica-Zdrój. In April 2021, in accordance with the decision of the Supervisory Board and the Shareholders’ Meeting, the company disposed of the said real estate. From that point on, it was no longer possible to carry out basic activities. As a result, the liquidation of the company began.

NN Investment Partners TFI S.A.

NN Investment Partners TFI S.A. has been present in Poland since 1997. It is the second largest TFI on the Polish market, managing PLN 26.2 billion (data of NN Investment Partners TFI S.A. as at the end of December 2021) located in funds and portfolios for a wide range of clients. It supports over 500 thousand clients by offering them a wide range of investment products. NN Investment Partners TFI SA is part of the international NN Group. It successfully combines global and local expertise to provide clients with investment solutions of the highest quality.

On 19 August 2021, NN Group announced that it has entered into an agreement under which Goldman Sachs Group will become the new owner of NN Investment Partners (NN IP) and will enter into a 10-year strategic partnership under which NN IP and Goldman Sachs Asset Management will continue to provide asset management services to NN Group. The transaction is expected to close by the end of Q1 2022, subject to customary closing conditions, including regulatory approvals and antitrust clearances. This announcement follows NN IP’s strategic review by NN Group.

Our clients

Business segments

We divide our business activities into two segments – the retail banking segment and the corporate banking segment. Other areas of activity, including e.g. treasury activities, are allocated between these two segments. Individual clients are served in the retail banking segment. As part of the corporate banking segment, we provide services to entrepreneurs and companies run on the basis of full accounting. We divide the corporate banking segment into three groups of clients, which depend on the value of the annual turnover – as per the diagram below:

As at the end of December 2021, the number of clients was 4.85 million and it was broken down into the following business segments:

• 4.35 million individual clients (up by 112 thousand clients y/y),

• 502 thousand corporate clients (up by 17 thousand y/y), including:

• 420 thousand entrepreneurs (up by 12 thousand),

• 79 thousand medium-sized and large companies (up by 5 thousand),

• 3.4 thousand strategic clients (flat y/y).

The growth of our client base is better described by the number of primary clients, i.e. those for whom we are the first choice bank and who hold several (specific) products. As at 2021 yearend, we had 2.18 million such clients in total, i.e. 105 thousand more than as at 2020 yearend, including:

• 2.02 million individual clients (up by 96 thousand clients y/y),

• 119 thousand entrepreneurs (up by 6 thousand y/y), and

• 39 thousand corporate clients (excluding strategic clients; up by 3 thousand y/y).

Primary clients accounted for 45% of all our clients as at 2021 yearend (similar to the end of 2020, but more than at the end of 2017 – 37%).

The constantly growing number of clients is the result of the activities pursued by us to foster long-term relationships with clients. These relationships are based on the trusted brand, transparent and flexible product offer and a continuously developed modern distribution and client service system.

7

|

ING Bank Śląski S.A.

|

Report on non-financial information of ING Bank Śląski S.A. Group in 2021

Our business model

We are a universal bank and along with other companies in the group we provide services to both individual clients and corporate clients.

Effective functioning of our business model relies on a group of over 8 thousand staff members. What we value is motivation, diversified experience, seniority and abundant knowledge. We base our work on our code of ethics – Orange Code or a set of ING Conduct and Values.

We are aware that we impact multiple economic processes and individual choices and it is up to our decisions what the world will look like and what reality will be there for the next generations. That is why in our business and non- business decisions we follow the principles of sustainable development.

As a public trust institution, we are aware of the importance of stability and an effective risk management system for the banking sector and the entire economy. In our bank, the system is constructed in compliance with best market standards on the basis of three lines of defence with the first line managing business, the second line managing risk and finances and the third line comprises internal audit and compliance . We also care for optimum management of the asset and liability structure of our balance sheet in line with our risk appetite limits.

Our mission is to support and inspire people to be one step ahead in life and business. In everybody’s life, roles in the society change: from a child, to student, parent, business person, bank employee, our vendor or employee of another company until retirees. This is a certain trip during which clients will make various important private and business choices. We, as a Bank, help them in taking the best financial decisions for them. That is why we share knowledge and provide tools to our clients as well as solutions that are simple, useful and suited to their needs. We make them better understand their own financial situation.

Our role is to provide opportunities for secure and effective savings. Deposits placed by certain clients fund loans granted to other clients which support the development of the society and economy alike. The financing granted supports purchases of housing, opening business activity or development of companies.

We take care that our payment and transactional systems are effective. And now – in view of the growing popularity of non-cash transactions – an efficient electronic payment system becomes increasingly important. We provide our clients with transactional banking, we process transfers, card, telephone or BLIK payments and we keep developing a network of devices for non-cash payments.

We offer our clients banking products and services (such as loans or savings accounts and transfers) as well as those that are unrelated to traditionally understood banking. Our competencies support us in building a positive client

experience. We also use big data and artificial intelligence and cooperate with fintechs to reach beyond. Those are not solely insurance products, accounting services or investment products. We offer our clients a broad range of tools for financial management.

We divide our clients into two main segments – retail clients and corporate clients.

Electronic and mobile banking are the core interaction channel with both retail and corporate clients. We want our clients to be able to access tools that will support their modern payments and remote handling of simple matters.

We also note the changing role of branch offices. That is why in 2019 we modified our distribution. Therefore, we do not refer to branches any more but to venues where we help in daily banking, in business development and in caring about financial future.

Corporate clients who expect high quality service may be serviced at a branch or their own offices as they may require. The task of our employees is to support them in taking financial decisions, inter alia by analysing their financial needs and objectives, financial condition or risk levels of investments.

8

|

ING Bank Śląski S.A.

|

Report on non-financial information of ING Bank Śląski S.A. Group in 2021

$C:\Users\BR41RU\AppData\Local\Microsoft\Windows\INetCache\Content.Word\ing-model-2-0 (3).png$

9

|

ING Bank Śląski S.A.

|

Report on non-financial information of ING Bank Śląski S.A. Group in 2021

Map of stakeholders

Our activities have an impact on clients, employees, shareholders, vendors and the wider social environment. We are aware that our stakeholders’ expectations are different. In our daily work, we work to respond to these different expectations. We ensure that our bank communicates in a professional yet straightforward manner with both the internal and external environment. We use specialised tools to develop the best practices of cooperation and dialogue with stakeholders.

We operate with awareness of and respect for international standards – the Universal Declaration of Human Rights and the UN Global Compact. We also apply the Principles of Good Banking Practice – we ensure equal treatment of all shareholders and attach importance to broad access to information and effective communication with capital market participants.

All our stakeholder groups are important from the perspective of business strategy, sustainability strategy, direct and indirect impacts of the organisation. We give a strategic dimension to the topics that are most relevant to them. This enables us to implement them effectively and quickly. Our stakeholders were identified during the production of the 2011-2012 CSR report. Since that time no changes have been made to the identification of stakeholders and at the workshop with employees in 2019 we decided that no changes were necessary in our map of stakeholders.

Communication with the environment is a key element of our core business. It is also a natural consequence of the bank’s social activity and the important role we play in local communities. In our dialogue with stakeholders we apply both highly parametrised tools (satisfaction surveys, audits) and daily contacts.

Clients

Clients are one of our most important stakeholder groups, because without them our organisation would not exist. Their opinions and needs are extremely important to us, so we collect them on an ongoing basis, analyse them and try to implement them into our products and services (the so-called voice of the client). Satisfaction surveys and other surveys e.g. NPS and FCR are conducted on a continuous basis. Our clients can contact us through various communication channels.

Investors, analysts and rating agencies

We are committed to equal treatment of all shareholders and attach importance to broad access to information and effective communication with capital market participants. We maintain regular contact and hold quarterly (and, due to the prevailing pandemic, virtual) meetings with management on the occasion of the publication of financial results. More information about our bank’s investor relations can be found on our website .

Media

We keep in touch with the media by, among other things, answering questions on an ongoing basis, distributing press releases and initiating meetings. More information about the press office can be found on our website .

Employees

We learn about employee opinions and evaluations through, among other things, the Organisational Health Interview (OHI) survey (conducted every 18 months, up to every two years) and the Pulse Check survey (once or twice a year). On the intranet, employees discuss via the community and blog with the CEO. We also organise anonymous chats with board members, where any employee can ask a question, which is answered every time. The interests of employees and their rights are represented by the employees’ organisations – the employees’ council and the trade unions. The employee council provides information and consults on the issues most important to employees.

ING volunteers

10

|

ING Bank Śląski S.A.

|

Report on non-financial information of ING Bank Śląski S.A. Group in 2021

Communication with ING Volunteers is very important to us. Daily we use all tools available at the Bank − Intranet, communities, “Good Idea” (Dobry Pomysł) platform. We conduct a survey once a year. Every year, the ING for Children Foundation organises dedicated training for volunteers. Ongoing dialogue is an element which enhances the employees’ commitment to local projects and actions. In 2021, most training and communication took place online.

NGOs

Communication with NGOs is very important to us. We keep in touch with them through a variety of tools. We invite you to meetings, enter into partnerships, engage in joint initiatives. In addition, we make financial and in-kind charitable donations to NGOs every year.

Academic environment

The academic community, especially students, is a very important stakeholder for us. We organise meetings with students and participate in initiatives organised for them. Every year we also organise an Internship with the Lion aimed at students who want to develop their career in banking. We are present at universities, among other things through our Ambassadors among students.

Vendors

The evaluation of vendor cooperation is examined once a year. Since 2018, we have introduced additional extended surveys in the area of social responsibility.

11

|

ING Bank Śląski S.A.

|

Report on non-financial information of ING Bank Śląski S.A. Group in 2021

Key non financial performance indicators

ING Bank Śląski S.A.

2017

2018

2019

2020

2021

Number of clients (thousand)

4,590

4,860

4,504

4,722

4,851

Number of employees (persons)

7,661

7,665

7,690

8,053

8,248

The ratio of basic salaries of women to men (%)

97%

99%

98%

100%

98%

Employee turnover ratio

8.2%

6.9%

7.3%

6.2%

6.9%

Electric energy usage (kWh)

31,530,936

30,558,890

31,920,924

27,666,453

25,709,631

Water consumption (m3)

55,541

57,130

58,284

65,693

40,438

ING Banku Śląskiego S.A. Capital Group

2017

2018

2019

2020

2021

Number of clients (thousand)

4,590

4,860

4,504

4,722

4,851

Number of employees (persons)

8,032

8,086

8,135

8,507

8,694

The ratio of basic salaries of women to men (%)

99%

100%

102%

101%

Employee turnover ratio

8.2%

7.0%

7.2%

6.3%

6.9%

Electric energy usage (kWh)

31,530,936

30,558,890

31,920,924

27,666,453

25,709,631

Water consumption (m3)

55,541

57,130

58,284

65,693

40,438

Sustainability Strategy “Our Responsibility”

In 2021, we implemented the Sustainability Strategy “Our responsibility". We focused on activities under 3 priorities: #ING for entrepreneurship, #ING for equal opportunities, #ING for the climate.

As part of our entrepreneurship activities, we supported Poles in making rational financial decisions so that they could be one step ahead in life and business, and we supported clients in setting up a company and growing their business. We also provided financial education aimed at all age groups. We encouraged employees to be more financially aware.

In pursuit of our equal opportunities objectives, we strive to make our products and services fully accessible. When offering our solutions we paid attention to the needs of all our clients. We also helped them take their first steps into digital reality and safety was our priority. All the time we make sure that everyone feels comfortable with us and can be themselves, because we believe that diversity is strength.

12

|

ING Bank Śląski S.A.

|

Report on non-financial information of ING Bank Śląski S.A. Group in 2021

The most important action related to climate action was the announcement of a new Environmental Declaration. But we continue to inspire others and build partnerships on sustainability, circular economy, climate change. We also reduce our negative impact on the environment.

The entire Sustainable Development Strategy for 2021 can be found at this link . A summary of the implementation

of the strategy for 2021 is available at this link .

13

|

ING Bank Śląski S.A.

|

Report on non-financial information of ING Bank Śląski S.A. Group in 2021

ESG Strategy

In the years 2022-2024, ING Bank Śląski will implement the ESG Strategy as part of its business strategy. The ESG Strategy will replace the Sustainability Strategy.

Environment (E)

Entrepreneurship and equal chances (S)

Ethics and compliance with regulations (G)

Priorities

WE

(we act by setting an example)

• We run sustainable internal administration.

• We digitalise processes considering their environmental footprint.

• We consider climate factors in our business decisions.

• We create work environment, where we care for the employees’ wellbeing (health, energy, activity and finances).

• We support the employees in being enterprising.

• We care for diversity and inclusion among the Bank employees.

• We build ESG awareness and culture among the employees, we develop ESG competences.

• We include ESG in the Bank’s strategy, its organisational structure, product development processes, risk management, procurement policy and corporate governance.

• We adapt to regulations – risk, finances, compliance and client portfolio.

Key goals

Achieving emission neutrality within scope I and II by 2030.

Keeping the Gender Pay Gap at 1% by 2024.

Setting at least 1 ESG-related goal for 100% of managers and 50% of employees by 2024.

Priorities

CLIENTS

(we inspire and support)

• We develop a pro-climate product offer for our clients.

• We finance sustainable projects.

• We support clients in their environmental transformation and in assessment of their business sustainability.

• We support clients in managing their finances and we educate them how to be enterprising.

• We facilitate technological and digital transformation to our business clients.

• We facilitate banking to groups at risk of exclusion.

• We build awareness and understanding of ESG business and regulatory issues among the clients.

• We care for our clients’ security.

Key goals

Providing PLN 4.5 billion to financing of renewable energy sources and pro-ecological projects in the corporate area, in line with the Green Statement, by the end of 2023.

Full adaptation of Moje ING mobile application, Moje ING online banking system and the Bank’s website to the WCAG 2.1 guidelines by 2024.

Achieving the clients’ satisfaction of the educational activities at the level of 4/5 by 2024.

Priorities

SOCIETY

(we build a better world together)

• We support innovations for climate (grants for startups and scientists).

• We support local environmental activities.

We support local social activities.

We share good practices and knowledge as part of our industry cooperation and with our stakeholders. We develop joint solutions.

Key goals

Organizing 6 editions of the grant program and providing PLN 6 million by 2024.

150 voluntary activities, as part of the Good Idea program, carried out with the ING for Children Foundation, 40 Smile Camps in Wisła organised by the Foundation by 2024.

Perception of ING as an active ecosystem facilitator, by organizing cyclical events, including 10 all-Poland conferences in cooperation with NGOs and industry organisations by 2024.

14

|

ING Bank Śląski S.A.

|

Report on non-financial information of ING Bank Śląski S.A. Group in 2021

Taxonomy disclosure

What is a Taxonomy?

Taxonomy is the colloquial name for a piece of European Union legislation on the establishment of harmonised Europe-wide principles to facilitate sustainable investment. These regulations are designed to increase the level of environmental protection by diverting capital from environmentally damaging investments to greener alternatives. The taxonomy does not prohibit investment in environmentally damaging activities, but gives additional preference to “green” solutions. The implementation of regulations defining what investments are environmentally sustainable will also make it possible to identify pseudo-environmental activities – concerning the unjustified claim by some entities that their activities are environmentally friendly, when there are no grounds for this – this phenomenon is called greenwashing.

On 30 December 2021, the EU Commission Delegated Regulation (2021/2178) to Article 8 of Regulation (EU) 2020/852 of the European Parliament and of the Council on the establishment of a framework to facilitate sustainable investment (the so-called Taxonomy) entered into force. It imposes an obligation on a number of European entities, including the banking sector and consequently ING Bank Śląski S.A., to report both quantitative and qualitative information on environmentally sustainable economic activities. This will be the first time this has happened in 2022 for 2021. The reporting of financial institutions in 2022, as well as in 2023, will be transitional, the scope of which is specified in Article 10 of the Delegated Regulation to Article 8 of the Taxonomy (in particular points 3 and 5).

Taxonomy objectives

Although the Taxonomy indicates 6 environmental objectives:

• climate change mitigation,

• climate change adaptation,

• sustainable use and protection of water and marine resources,

• the transition to a circular economy,

• pollution prevention and control,

• protection and restoration of biodiversity and ecosystems,

so far only the first two have been described. Therefore, in 2022, reporting only covers the first two objectives, i.e. the climate targets. It is worth noting that the taxonomic reporting framework is not yet a closed catalogue, and the current regulations leave a lot of room for interpretation. The scope of disclosure will increase from year to year and market interpretation and practice will systematically evolve.

The taxonomy does not specify which activities are “good” and which are “bad", but only describes in detail investments that are environmentally friendly. It is intended as a tool to support investors and entrepreneurs in making informed investment decisions towards actions that will contribute to the achievement of climate neutrality in the European Union by 2050.

Our reporting obligations

In accordance with Article 10(3)(a), during the period 2022-2023 we are obliged, as a bank, to report exposures to the Taxonomy-eligible economic activities and Taxonomy-non-eligible economic activities.

There will be further refinement of reporting from 2024 onwards. From the exposure to the economic sectors described in the Taxonomy as Taxonomy-eligible, those that are Taxonomy-aligned. To meet all these reporting obligations, we will rely on the data and information that our corporate clients will report, as well as on our own calculations.

ING Bank Śląski will endeavour to fulfil its disclosure obligations in the best and fullest way possible. We plan to embed all six EU taxonomy objectives into the way we work and ensure that technical classification criteria are incorporated into our risk, finance and front-office systems. This will help eliminate data discrepancies and increase awareness within our group of the impact of taxonomy regulation on our decisions and how we support clients. This will, for example, influence how we build our product offering.

Mandatory taxonomy disclosures

In order to meet the requirements of Article 10(3)(a) this year, we first had to define what we meant by economic activities. We decided not to limit the analysis only to exposures to our corporate clients and their economic activities, but also to include exposures to our retail clients, which in the future will also be a component of the green asset ratio (GAR).

With regard to our corporate segment exposures, as a first step we had to identify those corporate clients that are subject to the obligation to publish non-financial information under Directive 2013/34/EU, as only these clients will have to determine what proportion of their revenues (turnover), costs (operating expenses) and capital expenditures are related to the activities described in the Taxonomy. For this purpose, we have divided our Group’s Medium and Large Enterprises and Strategic Clients into 3 categories, taking into account the country of domicile of the company. We verified Polish clients based on the provisions of the Accounting Act. Other clients based in the European Economic Area were verified on the basis of the direct provisions of the Directive and, in selected cases,

15

|

ING Bank Śląski S.A.

|

Report on non-financial information of ING Bank Śląski S.A. Group in 2021

we supported ourselves by direct contact with the client. Clients outside the European Economic Area were not subject to further analysis. At this stage of the review, we have identified 81 clients (57 clients in the non-financial corporations category and 24 clients in the financial institutions category) subject to non-financial reporting obligations.

In a further step, we split on-balance sheet debt and equity exposures to these identified clients into those with a specific funding purpose and those of a general nature. We used the client’s main PKD/NACE codes when classifying clients to whom we provided general financing, for activities described and not described in the Taxonomy.

With regard to our retail segment exposures, we only analysed the mortgage-backed loan portfolio. Based on the data we have, we have selected only those loans whose purpose was to buy a property and exercise the ownership rights to that property. These exposures support the first climate objective of the Taxonomy, namely climate change mitigation.

Due to our cautious and conservative approach in selecting loans and debt securities to those described in the Taxonomy, we have not reviewed exposures to local governments and households for building renovation this year.

We present the calculations of all indicators in the tables below in two variants: 1) in relation to total assets arising from consolidated prudential reporting, which amounted to PLN 201,667.9 million at the end of 2021, and 2) in relation to the denominator of the GAR Green Asset Ratio (published from 2024), which amounted to PLN 151,720.1 million as at 2021 yearend. Compared to total assets, the denominator of the GAR mainly excludes non-financial assets, allowances for expected credit losses and exposures to central governments, central banks and supranational issuers.

Closing balance of gross carrying amount

PLN million

Percentage of total assets

Percentage of GAR denominator

Exposures to Taxonomy-eligible economic activities

47,349.5

23.5%

31.2%

towards financial institutions

0.0

0.0%

towards non-financial corporations

1,163.9

0.6%

0.8%

towards local and regional authorities

0.0

0.0%

towards households

46,185.6

22.9%

30.4%

Exposures to Taxonomy-non-eligible economic activities

4,065.8

2.0%

2.7%

towards financial institutions

284.9

0.1%

0.2%

towards non-financial corporations

3,780.9

1.9%

2.5%

towards local and regional authorities

0.0

0.0%

towards households

0.0

0.0%

Other exposures*

99,318.3

49.2%

65.5%

towards financial institutions*

509.7

0.3%

towards non-financial corporations*

63,485.6

31.5%

41.8%

towards local authorities*

2,978.9

1.5%

2.0%

towards households*

32,344.1

16.0%

21.3%

*additional voluntary disclosure; exposures not subject to Taxonomy eligibility review

The following table sets out the other information subject to mandatory disclosure under Article 10(3) of the Delegated Regulation to Article 8 of the Taxonomy.

16

|

ING Bank Śląski S.A.

|

Report on non-financial information of ING Bank Śląski S.A. Group in 2021

Closing balance of gross carrying amount

PLN million

Percentage of total assets

Percentage of GAR denominator

Exposures vis-à-vis central governments*

41,357.8

20.5%

27.3%

Exposures to central banks

515.8

0.3%

Exposures to supranational issuers

6,637.4

3.3%

4.4%

Derivatives

877.4

0.4%

0.6%

Exposures to companies that are not required to publish non-financial information

63,995.3

31.7%

42.2%

Trading portfolio

1,656.3

0.8%

1.1%

On-demand interbank lending

95.0

0.0%

0.1%

*together with exposures guaranteed by central governments

ING Bank Śląski’s trading portfolio as at 2021 yearend was in line with the product mandate and consisted of interest rate derivatives, FX derivatives, FX spot and Polish and Czech government bonds. We note that part of the IRS transactions secured loans granted to finance investments related to renewable energy sources. The portfolio characteristics did not differ significantly from the average risk exposure during the year.

Additional voluntary disclosures

As exposures to central governments are excluded from both the numerator and denominator of the GAR Green Asset Index (in accordance with Article 9(1)(a) of the Regulation delegated to Article 8 of the Taxonomy), we have decided to disclose, on a voluntary basis (in addition to the mandatory disclosures), the scale of our investments in green bonds of the Polish Treasury. Based on information contained in documents with emission conditions and in reports on the use of funds from emissions, it can be indicated that 72.5% of funds raised by the Polish Treasury (i.e. PLN 857.9 million out of PLN 1,184.1 billion) were used in accordance with the first environmental objective of the Taxonomy, i.e. for climate change mitigation.

Closing balance of gross carrying amount

PLN million

Percentage of total assets

Percentage of GAR denominator

Investment in green bonds of the Polish Treasury

1,184.1

0.6%

0.8%

Taxonomy-eligible

857.9

0.4%

0.6%

Taxonomy-non-eligible

326.2

0.2%

17

|

ING Bank Śląski S.A.

|

Report on non-financial information of ING Bank Śląski S.A. Group in 2021

Applied policies related to non financial issues and due diligence procedures

Social area-related policies

In our social activities, we mainly focus on financial education and support for entrepreneurship, as well as on actions for equal opportunities. We pursue goals related to those activities under the Sustainability Strategy in the area of #ING for entrepreneurship oraz #ING for equal opportunities. In the area of #ING for entrepreneurship we provide access to financial education to people who want to learn, to both children and adults. We have been increasing the number of beneficiaries of financial education activities and programmes. In the area of #ING for equal opportunities we remove barriers to access our services. We develop standards and tools that enhance the scope of simple communication. Bank also supports employee initiatives (volunteering, charity collections) and is involved as a social partner in national and local projects.

In the social area we are active ourselves and through two corporate foundations: ING for Children Foundation and ING Polish Art Foundation.

Since 2007 employees of the ING Group may use formal and legal solutions provided for the Labour-By Laws that facilitate voluntary activity. We warrant our employees 8 hours of work which they can use for voluntary activity. Volunteers carry out undertakings for schools, kindergartens, NGOs, and hospitals. They teach basics of finance and entrepreneurship. Together with kids, they refurbish, read, play sports or partake in blood donation initiatives and charity runs. Before Christmas, they prepare Christmas parcels for children at hospitals, community youth centres and children’s homes.

Since 2006, the ING Group employees have been participating in the Good Idea voluntary competition. In 2021, the ING Foundation for Children granted funding to 62 projects for a total of 315,299,93 PLN. In 2021, ING volunteers carried out 65 projects for local communities, foundations and schools for a total of PLN 291,299,93. For the sake of the health of both ING volunteers and children, all projects were carried out in an e-volunteering format. As part of this form of cooperation, online meetings were held. In addition, ING volunteers prepared audio/video recordings, multimedia presentations, instructions, crosswords, rebus, organised virtual walks and wrote traditional paper letters. The use of a particular form of e-volunteering was always tailored to the needs and capabilities of the target group and the technical capacity of the beneficiary. The 65 Good Ideas involved 304 ING volunteers and 3,162 children participated in the projects.

In 2021, ING Bank Śląski made 31 charitable donations of a financial nature. Donations were made on the basis of the Donations Policy of ING Bank Śląski S.A., which was updated on 1 June 2021. The Donation Policy defines the objectives that the bank supports as part of its donations, in selected areas of social investment:

• activities for children and young people, including leisure activities for children and young people – the bank made 5 donations totalling PLN 48,000,

• science, education and upbringing – especially in the area of financial and climate education – the bank made 9 donations totalling PLN 2,009,201,

• health care and prevention – the bank made 12 donations totalling PLN 259,500,

• environmental protection, combating climate change – 1 donation of PLN 29,975,

• financial support in case of special events involving an employee or his/her family member(s) – the bank made 4 donations totalling PLN 385,000.

The Bank also made donations to its corporate foundations: PLN 950 thousand to the ING Polish Art Foundation and PLN 2 052 thousand to the ING Children Foundation.

ING Lease sp. z o.o. has its own policy of donations. Other companies do not have their own policies of donations in place. Nonetheless, if needed, donations are made pursuant to resolutions of the management board.

We also have the Sponsorship Policy at ING Bank Śląski , which is further supplemented with detailed provisions of the Principles of Sponsorship at ING Bank Śląski. In 2021 ING Bank Śląski spent over PLN 3.5 million gross on all sponsorship activities (of which charges from sponsorship contracts include over PLN 2.7 million, and promotion of sponsorship events over PLN 750 thousand).

Breakdown of contractual sponsorship expenditure by category:

• activities aimed at entrepreneurs (including congresses, conferences, building and maintaining good business relations): PLN 972 thousand,

• activities targeting young people (including cooperation with universities, hackathons, science and education): PLN 659 thousand,

• activities related to social responsibility, ecology and environmental protection (including wellbeing): PLN 1,056 thousand,

• cooperation with foundations: PLN 86 thousand.

18

|

ING Bank Śląski S.A.

|

Report on non-financial information of ING Bank Śląski S.A. Group in 2021

Effects of applying policies

Policy deliverables of social area-related policies

2017

2018

2019

2020

2021

Number of hours used for volunteering

Bank

4,929

5,221

7,176

1,072

1,045

Capital Group

5,041

5,301

7,283

1,072

1,099

Employee issues related policies

The Group has 8,000 employees. To ensure that we are legally-compliant in business, we apply numerous documents which govern employee aspects.

The Labour By-Laws of ING Bank Śląski S.A. which define the organisational framework and workflow, as well as the related rights and obligations of the employer and employee is the key document. Their provisions apply to all employees, regardless of their position, type, and work time regime, or the term of the contract of employment. The remuneration policy is the Remuneration Policy in the ING Bank Śląski S.A.Capital Group. This policy sets out key assumptions for shaping the remuneration policy used to attract and retain employees by ensuring a competitive market level of remuneration and defines the components of remuneration. The remuneration policy applies to all employees of the ING Bank Śląski S.A.Capital Group. excluding members of the Management Board of ING Bank Śląski S.A., for which the Regulations for the remuneration of members of the Management Board of ING Bank Śląski S.A. apply In relation to members of the Supervisory Board of ING Bank Śląski S.A. the principles described in the Remuneration Policy for Members of the Supervisory Board of ING Bank Śląski S.A. apply introduced by the Resolution of the Ordinary General Meeting of ING Bank Śląski S.A. The Management Board of ING Bank Śląski S.A. ensures the development, implementation and updating of the Remuneration Policy and ensures consistency of remuneration regulations within the Capital Group ING Bank Śląski S.A. and the Management Boards of the entities of the ING Bank Śląski S.A.Capital Group ensure their implementation and updating in individual entities. The Work Regulations also supplement the Regulations of the annual talk process of ING Bank Śląski S.A. and Bonus Regulations for employees of ING Bank Śląski S.A.

At the Bank, we have more favourable solutions concerning occasional leaves than provided for in the Regulation of the Minister for Labour and Social Policy of 15 May 1996 on the manner of explaining one’s absence from work and granting employees the leaves of absence. Further, parents with disabled children are eligible for extra 5 days off during the calendar year. All entities of the Capital Group have separate regulations adapted to the organizational needs of individual companies, which remain consistent with the banking regulations.

We build an environment in which all employees have equal opportunities. As part of the package of benefits for people with disabilities, which supports employees and their families, we can find monthly, permanent allowances introduced from 2019, financed by the Company Social Benefits Fund for employees with a certificate of moderate or severe disability and bringing up children with a disability certificate. Supporting the caregivers of relatives with a moderate or severe degree of disability, we offer the possibility of taking advantage of an additional 2 days off when caring for a spouse / partner, parents, parents-in-law or grandparents. In the case of caring for a child with a certified disability degree, the employee may take advantage of an additional 5 days of care. Taking care of our employees with a certified mild degree of disability, we offer an additional 3 days off with the right to remuneration. The provisions of the Regulations are supplemented, among others, by The ING Diversity Declaration, which was adopted in all units of the ING Group around the world, and the Diversity Policy, which defines the areas and defines the way of managing diversity in our bank. At ING, we believe that everyone has a huge potential that can be realized. However, we expect our employees to treat others with kindness and respect.

An important element in terms of employee issues is also the Orange Code applicable to all employees of the Group. It is a set of Values, or promises that we make to the world, and Behaviors, or commitments that - as colleagues - we make to each other.

On the basis of the Orange Code, we have introduced the Rules of Professional Ethics that apply to the conduct of bank employees in connection with the performance of official duties, but may also apply to private activities that may adversely affect the bank's reputation or cause a conflict of interest. The rules of professional ethics are also enforced at the level of subsidiaries.

Employee issues are also an element of the ING Bank Śląski S.A. Sustainable Development Strategy. Additionally, in the #ING priority for equal opportunities, we have included goals regarding employee well-being and promoting diversity.

If the entities of the Capital Group are not included in the common policies, separate regulations are in place in all entities of the Capital Group, adjusted to the organizational needs of individual companies, which are consistent with banking policies.

19

|

ING Bank Śląski S.A.

|

Report on non-financial information of ING Bank Śląski S.A. Group in 2021

Effects of applying policies

Policy deliverables of employee issues-related policies

2017

2018

2019

2020

2021

Number of employees (persons

Bank

7,661

7,665

7,690

8,053

8,248

Capital Group

8,032

8,086

8,135

8,507

8,694

Ratio of basic salary of women to men

Bank

97%

99%

98%

100%

98%

Capital Group

99%

100%

102%

101%

Employee turnover ratio

Bank

8.2%

6.9%

7.3%

6.2%

6.9%

Capital Group

8.2%

7.0%

7.2%

6.3%

6.9%

Natural environment related policies

Environmental protection and sustainable growth are an important factor of our long-term strategy. We are aware of the perils arising from the excessive usage of natural resources. We are trying to counteract climate changes. We know that each aspect of our business has an environmental impact. We deeply believe that caring about the environment is not only the good will. It is our duty and an inherent element of doing business. Therefore, we proactively support and promote solutions related to the environmental protection.

Green Statement

Environmental degradation measurably and negatively affects our lives. If we do nothing about it, future generations will have to deal with the growing climate crisis. We feel that caring for the environment is our shared responsibility. That is why in July 2021, the ING Bank Śląski S.A. Group announced a new Green Statement. In this document, we committed ourselves to specific targets in the coming years.

In its new Green Statement, the bank has maintained the core principles of its 2017 Statement, in which it pledged that after 2025 it will not finance clients whose business is directly dependent on thermal coal to the extent of more than 5%. In line with its exclusion policy, in the interest of the environment the bank also does not finance, inter alia, activities related to the cultivation and production of tobacco and with a negative impact on protected areas, forestry and animal welfare.

We have committed to allocate by the end of 2023:

• PLN 4.5 billion in the corporate area to finance renewable energy sources and environmental projects,

• PLN 500 million to support Local Government Units in investing in pro-environmental projects (project: “Green municipality/community”),

• PLN 300 million for further support and promotion of electromobility – financing of electric and hybrid vehicles by ING Lease Polska, including construction of charging stations and promotion of driving electric vehicles.

By 2040, we also want to reduce the share of financing for the fossil fuel industry (in addition to coal, which the bank does not finance) by 19% with respect to 2019.

The bank will implement an offer for financing prosumer energy projects in the residential client segment. In 2021 we included housing loans in TERRA, ING Group’s initiative to, among other things, adopt long-term decarbonisation targets for lending in line with the Paris Agreement. At the same time, we will continue to offer financially beneficial green loans and mortgages for energy-efficient homes. The Bank also offers investment products based on ESG criteria, such as the NN (L) Global Responsible Investment fund.

ING Bank Śląski will also set up a grant fund of PLN 2 million per year for start-ups and young Polish scientists to implement projects in the area of sustainable development. At the same time, it will support initiatives that are a source of change and progress in the field of ecology.

One of the objectives enshrined in the new Green Statement is to achieve climate neutrality by 2030 (for more, see the section on The impact of operating activities on the natural environment and climate) in scope I and II.

In the area of ecology, the bank also focuses on educational activities. Together with the ING for Children Foundation it published the book “You too can save the world. Eco-tales from Pietruszkowa Wola”, which deals with environmental issues such as smog, global warming, the problem of plastic and consumerism. It was printed on eco-friendly paper using inks derived from renewable raw materials. By 2023, the bank will donate 25,000 books with lesson plans to schools and public libraries for free. It will also implement a climate change education programme for several hundred primary schools between 2021 and 2023 together with external partners. ING Bank Śląski will continue to actively support employee volunteering by setting up a special “My Environment” eco-fund worth PLN 300 thousand annually. This will enable employees to carry out environmental projects for the benefit of local communities.

We continue to manage our environmental impact and reduce negative impacts in line with the ING Group Environmental Programme:

• we will reduce our electricity consumption by 50% by the end of 2030 (base year 2014),

• we will reduce our water footprint by 20% by the end of 2022 (base year 2014),

20

|

ING Bank Śląski S.A.

|

Report on non-financial information of ING Bank Śląski S.A. Group in 2021

• we continue to recycle 100% of our waste,

• we will continue to use 100% renewable energy.

Our actions comply with business ethics, and we strive for transparent relations with vendors. Our vendors undertake to abide by the Vendors Code of Conduct which promotes human rights, fair market practices, environmental protection, and counteracting corruption.

Effects of applying policies

Total weight of hazardous waste, broken down by the following disposal methods

kg

2017

2018

2019

2020

2021

Recycling

17,894

4,130

1,487

1,162

670

100% of our waste is recycled.

Total weight of non-hazardous waste, broken down by the following disposal methods

kg

2017

2018

2019

2020

2021

Recycling

585,390

540,966

509,030

262,321

18,120

100% of our waste is recycled.

Total weight of non-hazardous waste per category

kg

2017

2018

2019

2020

2021

Waste paper

554,052

523,040

486,125

243,100

No data available*

Screens

14,094

570

1,487

1,162

560

Electronic equipment and bulk waste

16,976

13,796

18,154

15,510

14,795

Toners

3,800

3,560

3,264

2,549

2,765

Total waste

588,922

540,966

509,030

262,321

18,120*

Waste to be recycled

585,390

540,966

509,030

262,321

18,120*

Waste not to be recycled

3,532

0

*Changing safe containers for shredders in 2021 has changed the entire collection process for this waste. The management of waste paper has been taken over by municipalities, which do not keep quantitative records per producer of this waste. Therefore, the bank does not have data on the amount of waste paper generated for 2021.

The waste disposal method is determined by the company responsible for the recycling of the waste supplied by the Bank. The decrease is largely due to the epidemiological situation and, as a result, remote working and the change from safe containers to office containers. Changing safe containers for shredders in 2021 has changed the entire collection process for this waste. The management of waste paper has been taken over by municipalities, which do not keep quantitative records per producer of this waste. Therefore, the bank does not have data on the amount of waste paper generated for 2021. In the coming years, the bank will work the development of tools to estimate these quantities. In the case of toner cartridges, the increase is due to a change in the process of reporting for disposal – thanks to a more accessible format, users report this waste more quickly, so it is not stored in office spaces.

Electric energy consumption

kWh

2017

2018

2019

2020

2021

Electric energy

31,530,936

30,558,890

31,920,924

27,666,453

25,709,631

The decrease in energy consumption was mainly due to the remote work of most employees due to the coronavirus epidemic.

21

|

ING Bank Śląski S.A.

|

Report on non-financial information of ING Bank Śląski S.A. Group in 2021

Other types of energy (except for electric energy)

Other types of energy

2017

2018

2019

2020

2021

Natural gas (m3)

202,705

188,968

105,356

86,389

75,756

Heating oil (l)

17,000

13,012

20,511

10,500

9,666

The electricity we produce

The electricity we produce (photovoltaic panels)

kWh

2017

2018

2019

2020

2021

Electric energy

-

43,270

86,965

Water consumption

m3

2017

2018

2019

2020

2021

Water (the source of intake is municipal water supply system)

55,541

57,130

58,284

65,693

40,438

The reason for the increase in water consumption in 2020 were numerous failures and modernisations: refurbishment of the fire protection reservoir, filling and checking it several times, modernisation of the sprinkler system at Chorzowska Street, which required filling several times, we built a rainwater reservoir at Sokolska Street in the summer, which required leakage tests, failure of the sprinkler system at Sokolska Street, failure of hydrant pumps at Sokolska Street, replacement of utility water mains at Sokolska Street, replacement of main valves at Sokolska Street, refurbishment of main the ice water collector at Sokolska Street, modernisation of the technological heat collector at Sokolska Street, failure at the meeting place in Kielce, renovations in the buildings of the central headquarters and the city centre at Sokolska Street, failure at the meeting place in Kielce, repairs in headquarters and meeting place buildings.

Due to the fact that the subsidiaries of the Capital Group rent office space from ING Bank Śląski S.A. and pay the rental fee, which includes a flat-rate media fee, it is not possible to extract data by Bank and Capital Group. This is due to the lack of separate meters on the rented areas. Whenever possible, we will try to extract as much data as possible by Bank and Capital Group.

CO 2e emissions

In line with our Environmental Declaration 2021, we are working to reduce our carbon footprint – we have committed to achieving climate neutrality by 2030. We clarify that our commitment applies to Scope I (direct emissions) and II (indirect energy emissions). The base year in counting our emissions is pre-pandemic 2019. Until now, our carbon footprint has been calculated by ING Group in its GHG Protocol-based tool. In view of the target indicated in the Environmental Declaration 2021, we decided to have our carbon footprint independently calculated by an external company for the years 2019-2021 (the calculations were prepared by the National Energy Conservation Agency S.A.).

The difference in reported historical data in our previous reports relative to the data presented in this report (2019- 2020) is due to, among other things:

• Scope I:

• the consumption of gas, fuel oil and coal currently includes not only actual consumption but also consumption based on estimates,

• we have included in the calculation the diesel used in the chillers and the loss of refrigerant from the air conditioning,

• diesel and petrol for the car fleet currently account for 100% of consumption;

• Scope II:

• we have included electricity consumption above the volume of purchased guarantees of origin in 2019 and the volume of green certificates of the main energy vendor in 2020 (as a result of taking a broader view of energy consumption and adopting estimates for areas for which we do not have information on actual consumption),

• we estimated the consumption of district heating in all locations for which such data was not directly available;

• Scope III:

• we have extended the scope of business travel covered – rail travel and travel by taxi and coach have been added to air travel.

Emissions calculations are now prepared and reported in accordance with the Greenhouse Gas Protocol . The

calculation includes the bank and its subsidiaries (operational control; ING Commercial Finance Polska, ING Lease (Polska), ING Bank Hipoteczny, ING Services for Business and Nowe Usługi). For the preparation of the emission estimation the consumption of energy carriers was analysed in stationary sources for heating needs (natural gas, fuel oil, coal), consumption of liquid fuels for fuelling the car fleet and generators (petrol, diesel), losses of

22

|

ING Bank Śląski S.A.

|

Report on non-financial information of ING Bank Śląski S.A. Group in 2021

refrigerant from air-conditioning devices. For scope II of the analysis, the amount of electricity and district heat purchased was analysed. For scope III of the report, the focus is on emissions related to employee business travel (rail, air, taxi and coach), as well as water consumption, paper consumption and the amount of waste generated.

Calculations have been made assuming an operational approach and adopting a market-based method for calculating Scope II GHG emissions. In 2019, the bank obtained guarantees of origin for electricity from RES covering 97% of the total volume of consumption. In 2020 and 2021, the bank entered into an agreement with a general energy vendor to purchase an Eco-Premium product guaranteeing the supply of energy exclusively from renewable sources (as documented by the relevant certificates), while for the remaining volume of electricity the bank obtained guarantees of origin.

Data for 2019 and 2020 cover a full calendar year. For 2021, we did not have information on actual network heat consumption (Scope II) for December and estimates based on a regression of network heat consumption against the number of degree days in the month were adopted for this month. The source reports from the company calculating CO 2e emissions for us for each year are available at these links ( 2019 , 2020 , 2021 ). The reports contain

detailed information on the calculation methodology adopted and the estimates used for the calculations.

There are no direct CO 2 emissions from biogenic combustion in our emissions. 2019 has been adopted as the base year. In 2020 and 2021 we observe a decrease in emissions compared to the base year, mainly influenced by: pandemic and therefore a reduction in the occupancy of our offices due to remote working, a change in the structure of the car fleet (scope I), lower consumption of thermal energy and acquired guarantees of origin of electricity from RES (scope II), a very large reduction in business travel (scope III).

CO 2e emissions – a breakdown by emission source

tonnes of CO 2e

2019 (base year)

2020

2021

Scope I

5,271.3

3,472.4

3,283.1

Natural gas

664.7

639.3

601.9

Fuel oil

72.8

36.0

38.6

Coal

3.4

3.3

Petrol fuel

1,746.7

1,684.7

2,081.8

Diesel – car fleet

2,113.9

832.3

415.5

Diesel – generators

37.0

62.5

65.9

Refrigerants

632.7

214.3

76.0

Scope II

6,025.0

4,944.0

4,806.4

Electric energy

812.8

0.0

District heating

5,212.2

4,944.0

4,806.4

Scope III

746.7

171.7

153.9

Category 1

257.0

50.9

124.7

Paper

237.0

33.2

119.9

Water supply

20.0

17.8

4.8

Category 5

53.9

42.1

9.1

Waste

12.6

5.6

0.4

Water treatment

41.3

36.5

8.8

Category 6

435.8

78.6

20.1

Rail journeys

196.1

32.9

12.7

Air travels

232.4

37.9

2.6

Travel by taxi and bus

7.3

7.9

4.8

Scopes I-III total

12,043.0

8,588.1

8,243.4

23

|

ING Bank Śląski S.A.

|

Report on non-financial information of ING Bank Śląski S.A. Group in 2021

CO 2e emissions – breakdown by emitted gases (included in the Kyoto Protocol)

tones

2019 (base year)

2020

2021

Scope I

5,271.3

3,472.4

3,283.1

CO 2 – carbon dioxide

4,638.6

3,258.1

3,207.0

CH 4 – methane

0,00020

0.00013

N 2 O – nitrous oxide

0.00004

0.00002

HFCs – hydrofluorocarbons

0.247

0.112

0.045

PFCs – perfluorocarbons

0.0

SF 6 – sulphur hexafluoride

0.0

Scope II – location-based

28,976.2

24,112.2

22,310.2

CO 2 – carbon dioxide

28,976.2

24,112.2

22,310.2

CH 4 – methane

0.0

N 2 O – nitrous oxide

0.0

HFCs – hydrofluorocarbons

0.0

PFCs – perfluorocarbons

0.0

SF 6 – sulphur hexafluoride

0.0

Scope II – market-based

6,025.0

4,944.0

4,806.4

CO 2 – carbon dioxide

6,025.0

4,944.0

4,806.4

CH 4 – methane

0.0

N 2 O – nitrous oxide

0.0

HFCs – hydrofluorocarbons

0.0

PFCs – perfluorocarbons

0.0

SF 6 – sulphur hexafluoride

0.0

Scope III

746.7

171.7

153.9

CO 2 – carbon dioxide

689.3

170.6

153.4

CH 4 – methane

0.070

0.010

0.003

N 2 O – nitrous oxide

0.210

0.003

0.001

HFCs – hydrofluorocarbons

0.0

PFCs – perfluorocarbons

0.0

SF 6 – sulphur hexafluoride

0.0

Scopes I-III total – location-based (CO 2e )

34,994.2

27,756.4

25,747.2

Scopes I-III total – market-based (CO 2e )

12,043.0

8,588.1

8,243.4

In addition, we present emission performance indicators for the last three years. Our emissions per PLN 1 million of revenue and PLN 1 million of assets are falling dynamically. This is the result of both the reduction in Scope I-III emissions (2021 emissions were 31.6% lower than 2019 emissions), but also due to the increase in revenue (+19.0% in 2021 relative to 2019) and asset value (+27.1% in 2021 relative to 2019). The decline in emissions per FTE recorded a lower negative growth rate due to the lower growth rate of employment (+7.1% in 2021 relative to 2019) relative to the other two categories (income and assets).

Performance indicators related to CO 2e emissions

kg CO 2e

2019

2020

2021

CO 2e emissions per PLN 1 million of revenue*

Scope I

911.8

558.8

522.2

Scope II

1,039.4

793.5

696.9

Scope III

118.4

25.0

20.7

Total

2,069.7

1,377.3

1,239.8

CO 2e emissions per PLN 1 million of assets

Scope I

33.3

18.7

17.9

Scope II

38.0

26.5

23.8

Scope III

4.3

0.8

0.7

Total

75.6

46.0

42.4

CO 2e emissions per 1 FTE

Scope I

654.8

412.0

416.7

Scope II

746.4

585.0

556.1

Scope III

85.1

18.4

16.5

Total

1,486.3

1,015.4

989.3

*total including share in profit of associates

Due to the characteristics of the banking industry, emission rates (in particular per revenue and assets) should be analysed taking into account the emissions related to the bank’s client receivables portfolio. We do not currently have emissions data from the bank’s client receivables portfolio for 2019-2020. The emission factors including emissions from the client receivables portfolio in 2021 per 1 million PLN of revenue, 1 million PLN of assets and per 1 FTE are 852.7 tonnes CO 2e / 1 million PLN, 29.2 tonnes kg CO 2e / 1 million PLN and 680.5 tonnes kg CO 2e / 1 FTE respectively.

24

|

ING Bank Śląski S.A.

|

Report on non-financial information of ING Bank Śląski S.A. Group in 2021

CO 2e emissions from the portfolio of receivables from clients

We also performed a first quantification of the CO 2e emissions associated with the bank’s client receivables portfolio (own calculation, not verified by an external party). We have taken the decision to share our estimate to inform our stakeholders of our emissions in full – emissions from the receivables portfolio is a very important component of banks’ emissions (it falls under category III emission under category 15 corresponding to investments) and this component will be the main focus and priority for the bank to reduce the climate impact of our operations. We know that we are at the very beginning of this journey and therefore it is important to know our starting point. We will continue to work on our calculation of issues from the client receivables portfolio in the coming years, both in terms of the methodology itself and the greater availability of higher quality data. Therefore, we cannot exclude the possibility that we will make retrospective recalculations in the future as market practice develops.

Calculations are prepared for both the corporate and retail segments based on the Global GHG Accounting and

Reporting Standard for the Financial Industry . At the same time, it is worth noting that an estimate of emissions,

based on statistical methods, may not be precise. In future periods, the Bank will seek to improve the accuracy of its estimates, including by obtaining more precise data.

CO 2e emissions from the client receivables portfolio (Scope III, category 15 element) – data for 2021

CO 2e emissions (tonnes)

Value of exposure (PLN million)

Emission intensity (Co 2e tonnes per 1 million PLN of exposure)

Corporate portfolio (excluding entrepreneurs)

5,231,781

62,340.9

83.9

Group of sectors contributing significantly to climate change*

4 532 934

45,613.0

99.4

Other sectors

698,846

16,727.9

41.8

Mortgage-backed retail portfolio

641,153

50,005.5

12.8

Total

5,872,934

112,346.4

52.3

*Sectors which contribute significantly to climate change are defined as sections A to H and section L of the 2007 PKD classification in accordance with Annex I to Regulation (EC) No 1893/2006

Corporate segment

The calculation for the corporate segment portfolio includes exposures of ING Bank Śląski, ING Lease (Polska) and ING Commercial Finance Polska excluding loans to corporates, as at 31 December 2021. For the purposes of estimation, we used data on greenhouse gas emissions (CO 2 and Co 2e for other gases) by sector of activity. Data are

published annually by Eurostat, with the latest data available for 2020. On the basis of sector data, we have estimated emissions in relation to revenue generated and in relation to assets. We then translated the estimates at the level of national economic sectors to the bank’s corporate clients, using the client’s core business as the key.

The table above shows the calculations by the two groups of sectors, but excluding the commercial property sector. In total, the loan portfolio analysed represents 86% of receivables from clients in the area of Medium and Large Companies and Strategic Clients. For the first group of sectors contributing significantly to climate change, the average estimated emission was 99 tonnes of Co 2e per million gross carrying value (CO 2e / 1 million WBB). For the second group, the other sectors, the value of the indicator was 42 CO 2e / 1 million WBB, and for the analysed part of the corporate portfolio in total – 84 CO 2e / 1 million WBB.

For the analysis of the commercial real estate loan portfolio, a dedicated method for calculating the carbon performance should be used, using data on, inter alia, the energy classes of buildings, energy sources and floor areas. At the moment, the bank does not have an adequate database to perform such calculations.

Retail segment

Within the retail segment, we estimated emissions related to mortgage-backed loans. Due to the lack of information on the actual energy consumption of individual buildings and the lack of access to energy performance certificates, our approach was based on the year of construction of the property and the corresponding technical and building regulations. We also use information provided by the Central Statistical Office on the structure of household energy consumption, data from the European Environment Agency on emissions associated with electricity generation, and data from the 2006 IPCC Guidelines for National Green-house Gas Inventories .

The calculations presented in the table above include exposures of ING Bank Śląski S.A. and ING Bank Hipoteczny S.A. as at 31 December 2021. In accordance with the methodology in the Global GHG Accounting and Reporting Standard for the Financial Industry , the amount of emissions has been adjusted by the LTV (the ratio of the outstanding loan amount to the value of the collateral) to reflect the actual emission associated with our financial exposure. In the calculation, we focus on residential units and single-family buildings taking into account around 87% of the bank group’s total portfolio.

For the retail mortgage-backed segment portfolio, emissions in 2021 were 641,153 tonnes of CO 2e and the emission intensity was 12.8 tonnes of Co2e 2e per PLN 1 million of loan principal outstanding.

Human rights policies

Group activities affect diverse groups of stakeholders like clients, employees, and vendors. Representatives of each of these groups may and should expect fair treatment from us. In our business, we commit to respect and promote human rights with regard to all people we collaborate with.

25

|

ING Bank Śląski S.A.

|

Report on non-financial information of ING Bank Śląski S.A. Group in 2021

The human rights-related aspects can be found in a few documents. For employees – the provisions of the Labour By-Laws of ING Bank Śląski S.A. are fundamental in this regard. They read that as the employer we undertake to respect the dignity and other personal rights of employees, abide by the principles of equal treatment, while establishing and terminating the employment relationship, in relation to terms of employment, promotion opportunities, or access to training. Further, we commit ourselves to counteracting mobbing. All entities of the Capital Group have separate regulations adapted to the organizational needs of individual companies, which remain consistent with the banking regulations. In 2019 the Policy of Caring about Working Environment Free from Discrimination and Mobbing and the Procedure of Handling the Suspected Occurrence of Adverse Events came into effect. Additionally, each employee will be obliged to undergo e-learning course on “Work free from discrimination and mobbing”. The Procedure also lay down how to report (whistleblowing) the occurrence of events that may be improper and how verification of reports and explanatory proceedings look like.

The Labour By-Laws are completed by the provisions of the Orange Code, among other documents. In this paper, we clearly describe the values we believe in and the behaviours one can expect from us. The Orange Code promotes integrity, common sense and accountability, for example. . It is applied in many banking processes, e.g. in the employee performance evaluation (General Terms and Conditions of the Annual Performance Appraisal Interviews at ING Bank Śląski S.A. and General Terms and Conditions of Bonus Award to Employees of ING Bank Śląski S.A.). Further, it is an important element of the recruitment process and corporate culture. This also applies to employees of subsidiaries.

The Diversity Policy is another document which supports us in complying with and promoting human rights. The Policy is designed to build the awareness of the organisation in which the principles of equal treatment are applied, meaning no discrimination whatsoever, both directly and indirectly, because of: gender, age, disability, lifestyle, form, scope, and basis of employment, other cooperation types, as well as other triggers of discriminatory behaviours. Additionally, in January 2016 the Management Board of ING Bank Śląski adopted the ING Diversity Manifesto. Adoption of various perspectives is a driver of innovation, supports growth, adoption of proper decisions, and better performance delivery.

Through the Manifesto we want to express our openness and responsibility and knowingly affect mutual respect. We do care about creating a friendly workplace in which everyone can feel themselves. The ING Diversity Manifesto has been adopted by all ING Group entities worldwide. Employees may report all irregularities relating to violations of human rights using a special form, i.e. Whistleblowing. The form is anonymous and all Group employees can submit their reports. Reports are received by the Director of the Compliance Department, who will inform the President of the Management Board and agree with him actions to be taken. If a report is confirmed, appropriate corrective and preventing measures are taken for the future.

The General Principles of Environmental and Social Risk indicate business activities in which the Bank does not invest due to especially high risk of violation of human rights. We require that our clients to run their businesses in

compliance with the regulations governing social and environmental issues and that they should have all permits and licences required under the law. The General Principles are applied to clients to whom we offer lending products. We do not establish relations with clients whose core business activity is covered by the Policy of Exclusions. The key environmental and social risks related to violations of human rights as a result of forced labour, child labour, inappropriate working conditions, use of violence, predominantly occur in forestry and plantations and industrial processing.

All Group vendors represent that they observe the standards set out in the Vendors Code of Conduct of ING Bank Śląski S.A. Its observance is a prerequisite for starting and continuing cooperation with the Group. The key standards include: observing the applicable laws in relations with the employees, including the employees’ rights, as well as respecting their personal dignity, privacy, and individual rights. Vendors should also provide their employees with safe and harmless workplace in health terms and consider environment protection by striving for reducing environmental burden as part of their business and they ought to undertake actions leading to environment improvement. Moreover, vendors should observe prohibition of forced labour, child labour, corruption, and discrimination.

Effects of applying policies

• We apply the Vendors Code of Conduct of ING Bank Śląski S.A. to all suppliers, regardless of their place of business.

• 100% vendors of ING Bank Śląski S.A. declare to comply with the standards of the Code.

• Employees can anonymously report suspected crime and breach of professional ethics using a dedicated form. The report can also be submitted by name, and in this case, we ensure confidentiality and discretion, as well as protection against repressive actions. If the application is confirmed, appropriate corrective and preventive actions are taken for the future. Alternatively, the Bank's employees may also use the ethical breach reporting channel provided by the ING Group: telephone line, website or e-mail address where reports can be sent.

• In 2021, 24 reports qualifying for consideration under the procedure set out in the Policy were submitted, concerning, inter alia, discrimination, bullying or breaching of the bank’s internal regulations. After analysis and explanatory proceedings, irregularities were confirmed in 6 cases and corrective measures were applied.

• Every new employee of the bank undergoes mandatory training on reporting breaches of the law and professional ethics. In order to remind the principles for reporting illegal, improper or unethical behaviour, in Q3 2021, a communication was sent the bank employees indicating appropriate channels for reporting breaches ensuring confidentiality and anonymity. Alternatively, bank employees may report breaches of professional

26

|

ING Bank Śląski S.A.

|

Report on non-financial information of ING Bank Śląski S.A. Group in 2021

ethics using external reporting channels operated by an external entity, via a telephone line (available 24/7), website or email address.

Anti-corruption policies

As a public trust organisation, the Bank sees anti-corruption practices as the top priority in its relationships with clients, business partners, and government officials. Any and all forms of bribery or corruption are absolutely forbidden. All ING Group employees are obliged not to accept any actions suggesting an attempt to commit a crime or of corruption. The Regulations – Employee Business Ethics Standards of ING Bank Śląski S.A. , which lay down the principles of conduct for each employee in the context of anti-corruption and combating conflicts of interest, information protection, and the whistleblowing procedure is the formal document regulating those aspects.

The anti-corruption aspects are detailed in the Anti-Bribery and Corruption Policy which all our employees are required to comply with. The Policy provides for the restrictions on accepting and giving material and non-material benefits in contact with clients, business partners, and public servants as regards:

• gifts or invitations to events,

• cash or its equivalents,

• trip or accommodation funding,

• hiring a given person by the Bank or offering him or her a traineeship or internship,

• sponsoring or charity donations by the Bank,

• participation in business meals.

In line with the accepted Policy , the Group follows the rules of integrity and ethics and applies the “zero tolerance rule to unfair behaviour”.

The acceptance or provision of gifts or benefits by employees to attend special events must in all circumstances have a sound business justification. There must be always a legally compliant purpose of and accepting or giving gifts or benefits. No such action can entail a conflict of interest, or even imply that such a conflict has occurred. The Bank disapproves giving benefits being political donations on its behalf. Staff decisions concerning employee hiring and secondment have to be substantiated with professional and objective criteria and they cannot serve illegal exertion of influence. The Policy provides for the amount thresholds on the benefits being gifts and participation in events which can be given or accepted by our employees.

Furthermore, the Group maintains a Register of Benefits. Accepted or given gifts, participation in events or business meals – in contacts with clients, business partners, and public servants – may need to be reported depending on their value.

The above rules are an element of the Anti-corruption Declaration ING Bank Śląski S.A. , which is always enclosed with agreements made with vendors. As per the Declaration , the ING Group disapproves of actions which satisfy the criteria of or imply bribery, and expects its business partners to comply with the anti-corruption standards. Further, the Group does not cooperate with business partners who do not accept our standards.

All employees are required to report corruption- or conflicts of interest-related irregularities. Infringements of the above regulations and laws can be reported in person or anonymously via the whistleblowing procedure set out in the Whistleblowing Policy for Infringements of Law, Internal Regulations and Ethical Standards .

Compliance with policies is also ensured at the level of subsidiaries.

The text of the declaration can be found on our website .

Anti-bribery and corruption policy and Regulations - Rules of professional ethics of employees of ING Bank Śląski S.A. they are part of the employee documentation, knowledge of which is confirmed by the employee in connection with employment in the Group. Moreover, training courses are conducted in the field of counteracting corruption and conflicts of interest.

Effects of applying policies

At ING Bank Śląski we do not tolerate corruption. We raise the awareness of our employees in this regard, so that they can better recognize and counteract corruption through e-learning training and regular awareness-raising activities: We apply several straightforward rules:

• We do not accept or give any gifts or invitations to special events whose value exceeds the amount thresholds set, unless derogation from them has been accepted.

• We declare acceptance, refusal to accept or presentation of benefits above the permitted value to the electronic Register of Benefits – currently the threshold is PLN 200. We report such acceptance, refusal to accept or handing in relations with clients and business partners. In relations with public officials, we report each case of accepting, refusal to accept or giving benefits regardless of value.

We also require our vendors and business partners to comply with those rules. We encourage them to adopt the ING Bank Śląski S.A. Anti-Bribery Declaration.

Detailed information on suppliers can be found on our website .

27

|

ING Bank Śląski S.A.

|

Report on non-financial information of ING Bank Śląski S.A. Group in 2021

As part of the internal control system in place at the Bank, elements related to counteracting corruption are verified by:

• current verification, in particular regarding notifications entered into the Benefits Register,

• independent compliance tests,

• annual key control tests (KCT).

In 2021, no cases of bribery or corruption were identified.

28

|

ING Bank Śląski S.A.

|

Report on non-financial information of ING Bank Śląski S.A. Group in 2021

Description of significant risks for non-financial issues

Non-financial risks

Non-financial risks cover management functions of operational and compliance risk based on a common framework, setting forth clear principles and standards of risk identification, assessment, monitoring, mitigation and reporting. The Bank manages non-financial risks in compliance with the Strategy and Risk Appetite Statement for Non-financial Risks approved by the Bank’s Management Board that set forth risk limits and tolerance. Compliance with the declared risk appetite is monitored in a periodic report on non-financial risks (NFRD). Additionally, the bank operates the Non-financial Risk Committee appointed by the Bank’s Management Board – the Committee advises the Bank’s Management Board with respect to the management of non-financial risks. The Supervisory Board, with the support of the Risk Committee, supervises the management of operational risk by the Management Board and assesses the effectiveness of its activities in this respect at least once a year.

The common management framework of non-financial risks support the bank in active identification of core hazards and gaps and the related risks which may result in undesirable events. The framework supports such processes as self-assessment of risks and controls, scenario analyses, monitoring of key risk indicators or testing of key controls. The results of analyses of internal and external events keep improving the adequacy and effectiveness of the internal control system functioning in the bank.

We believe that an effective control environment is essential to building and maintaining a sustainable business, and retains and enhances the confidence of clients, employees and shareholders.

ESG risks

In early 2021, we approved a Risk Management Strategy which identified the identification, assessment, management and reporting of ESG risks as key objectives for 2021-2023.

The Management Board of our bank, the Supervisory Board and the management team attach particular importance to the identification of risks and opportunities and the management of ESG risks in the bank. Among other things, the Management Board has initiated the establishment of appropriate organisational structures that ensure a comprehensive approach to the ESG topic from the perspective of risk management, business issues and reporting/disclosures, as well as adequate information flow and knowledge sharing between the units responsible for the various ESG aspects, the Management Board and other employees.

Organisation of ESG risk management

The Board has established a comprehensive ESG Project, coordinating ESG issues within separate working teams focused on risk, business and reporting/disclosure.

The supervision of ESG risk management has been entrusted to the Member of the Management Board of the Bank supervising the CRO Division.

In 2021, operational oversight of ESG Risk issues was provided by the Credit Policy Committee. By decision of the Bank’s Management Board, an ESG Risk Committee was established on 8 February 2022 in the form of a standing committee. The main tasks of the ESG Risk Committee will be the creation of ESG risk management policies, approval of ESG risk management methodologies, approval of tools used for ESG risk assessment, determination of standards for ESG risk credit analysis and the ESG risk assessment and monitoring process, as well as principles of ESG risk consideration in collateral valuation.

Within the CRO Division, a unit has been identified responsible for managing ESG risk and initiating and coordinating further actions to comprehensively implement ESG risk management into the existing credit, market, liquidity and operational risk management system and to meet the expectations indicated in supervisory documents.

Principles for ESG risk management

ING Bank Śląski already implemented an environmental and social risk manual in 2009, setting out an approach to human rights and activities that may have a significant negative impact on the environment, which is regularly updated.

The environmental and social risk assessment covers the client and the transaction. We make our assessment to the best of our knowledge. At the client’s level, we assess whether the business is conducted with respect for human rights, environmental protection principles and is not covered by the exclusion policy. At the transaction level, we assess whether it complies with the requirements of the detailed policies.

The exclusion policy applies to activities with a particularly high risk of breach of human rights and the risk of a negative impact on the environment and the principles of sustainable development. We do not establish relationships with clients whose core business is covered by ING Bank Śląski’s exclusion policy.

We identify and properly manage relationships with clients who operate in areas more susceptible to social or environmental threats. We apply detailed policies to support environmental protection and minimize risks in exposed areas.

Detailed policies concern the following areas:

• well-being of animals,

• forestry and plantations,

• industrial processing,

• chemical industry and utilisation of chemicals,

29

|

ING Bank Śląski S.A.

|

Report on non-financial information of ING Bank Śląski S.A. Group in 2021

• defence and the arms industry,

• hard coal mining, coal-fired power industry, and related businesses,

• other mining and power industry, petrochemical industry and metal manufacturing.

The bank’s regulations support the identification of environmental and social risks and the appropriate management of relationships with clients who operate in areas that significantly affect the environment in which we live.

We have a detailed policy on defence financing and activities related to the arms industry. We are not opposed to establishing relationships with this type of client. We take the view that sovereign states, within the limits of the law, regulations, national and international conventions, have the right to maintain public order, to participate in joint military missions or peacekeeping missions, and to defend themselves and to have armed forces properly equipped. In addition to legal prohibitions, as ING Bank Śląski we believe that certain companies, weapons and activities violate our values and business ethics.

Due to the nature of the different types of weapons, we distinguish between Category A and Category B controversial weapons. Category A includes cluster munitions, anti-personnel mines, depleted uranium munitions and chemical and biological weapons. Category B includes nuclear weapons.

We do not fund controversial weapons and their key components. We do not finance clients or consortia directly involved in controversial weapons, due to their particularly destructive nature and the results of their use: mass casualties and destruction in the area under attack, from which it is difficult to exclude civilians. By key components of controversial weapons we mean infrastructure, equipment parts and materials, services and programmes and systems (mechanical, electronic and digital) specifically designed for controversial weapons.

We also do not finance transactions for the supply of arms, military equipment, technology or other goods where there is a high risk of them being used for internal repression, violations of international humanitarian law, inciting or prolonging armed conflict or aggravating existing tensions, or for other purposes that cannot be considered legitimate in relation to national security or defence. The restrictions shall not apply to the conduct of activities in connection with humanitarian missions or military peacekeeping missions established by international communities.

We also do not provide financial services to companies or consortia in the defence sector that are clearly in the business of providing arms, military equipment, technology or other goods to countries subject to UN, EU or US arms embargoes or to terrorist groups, rebels and other non-governmental groups without appropriate UN, EU or US approval.

As a bank, we have an influence on the financing and lending of projects that may have a significant negative impact on society and the environment. Respect for human rights, environmental protection and sustainable

development are an important element of our long-term value-building strategy. We are aware of the perils arising from irresponsible use of natural resources.

We support clients in conducting their business in a sustainable manner and encourage them to constantly improve themselves in this area. We require that our clients to run their businesses in compliance with the regulations governing social and environmental issues and that they should have all permits and licences required under the law. Therefore, in order to avoid the risks associated with financing projects that have a negative impact on the environment, we apply an environmental and social risk assessment as well as an exclusion policy.

In terms of client environmental and social impact, the most important risks for the bank include:

• breach of human rights as a result of forced labour, child labour, inadequate working conditions, use of violence; the risks occur mainly in forestry and plantations and industrial processing,

• health risks for workers and local communities due to environmental contamination, contact with harmful chemical materials, transmission of animal diseases to humans, non-compliance with labour laws; the risks are mainly related to the chemical industry, energy, mining, metal production and animal husbandry,

• risk to the health and life of consumers through the consumption of products that are harmful to health; the risk occurs mainly in the tobacco industry,

• a controversial trade policy of contracting extremely low prices for products manufactured in economically underdeveloped countries; the risk is mainly related to industrial processing,

• inhumane treatment of animals during breeding, transport, slaughter or medical experiments; the risk is mainly related to animal welfare activities,

• loss of biodiversity and uncontrolled spread of invasive species, including genetically modified species; erosion and soil degradation; the risks are mainly related to forestry and plantations,

• pollution of soil and water by heavy metals, waste, sewage and an increase in water consumption in water- scarce areas; the risks are mainly related to animal husbandry, forestry and plantations, industrial processing, the chemical industry, energy, mining and metal production.

Adaptation to supervisory requirements

Following the requirements of the European Central Bank and the requirements contained in the supervisory assessment of local financial supervision, on 30 June 2021 we implemented the recommendations of the EBA as set out in the Guidelines on Loan Origination and monitoring.

30

|

ING Bank Śląski S.A.

|

Report on non-financial information of ING Bank Śląski S.A. Group in 2021

The assessment of ESG risk of strategic clients and medium and large companies and the assessment of ESG risk at the level of these portfolios (by sector) is carried out as part of the standard credit process / credit risk management.

We have included in the internal regulations definitions of ESG risks and identified transformation and physical climate risks (chronic and sudden) that may have a potential impact on client performance and consequently on the quality of the loan portfolio.

Based on statistical data and expert assessment, we analysed the most important ESG risks by sector and drew up a heatmap of sector risks and designated high, medium and low ESG risk sectors.

We have included descriptions of key ESG risks, sample mitigating factors and preferred client profile in the sector guidance documents for each sector. In the credit analysis principles for corporate clients (excluding entrepreneurs) financed in the standard paths of the credit process, ESG risk assessment requirements have been added.

From an ESG risk perspective, we assess the client according to the double materiality rule, i.e. taking into account both the environmental impact of the client’s activities and the potential impact of environmental, climate and social factors on the client’s financial performance.

When examining the potential impact of ESG factors and climate risk on a client’s financial performance, we focus on the relevant risk factors and assess: the client’s sensitivity to ESG factors (whether they can increase credit risk) and the client’s ability to mitigate these risks, e.g. by having a strategy / action plan for transitioning to environmentally sustainable operations and other factors that mitigate ESG risk. If a high level of ESG risk is identified, it is possible to appeal (downgrade) a client’s rating.

Liquidity Climate Stress Test

Recognising the impact of ESG risk factors on the bank’s liquidity, we developed the 2021 Liquidity Climate Stress Test. The objective was to determine the impact of risks from climate change and pollution on the bank’s liquidity. The test scenarios identified risks, trends in climate, business, legal and social changes that affect the bank’s liquidity. The horizon of the Liquidity Climate Stress Test conducted was 20 years. The test results are positive, i.e. the bank’s liquidity is not at risk over the test horizon. The conclusions of the climate liquidity stress test will be used in determining the bank’s development directions.

Developing methodologies for ESG risk management

In setting the direction for building a comprehensive ESG risk management system, we build on the expectations of the European Central Bank as indicated in the “Guide on climate-related and Environmental risks – Supervisory expectations relating to risk management and disclosure”. With respect to this document, we have performed a compliance analysis, approved by the Credit Policy Committee. We have set out a detailed plan to achieve compliance with these requirements, spread over the coming years.

We continually monitor regulatory risks arising from changes in the legal environment in relation to the financial sector – following the work of regulators and legislative proposals. We participate in the work of the Polish Bank Association on the interpretation of ESG regulations.

Operational risk

The Bank’s objective in operational risk management is to ensure regular improvement of the safety of the Bank and its clients, reduction of operating costs and improvement of operating effectiveness.

The Bank’s Management Board – subject to approval of the Supervisory Board – has developed a strategy of operational risk management. The Bank’s management strategy of operational risk provides for legal and regulatory requirements and relies on good practices of the ING Group.

Additionally, the Management Board – also in agreement with the Supervisory Board – in its risk appetite statement defined the maximum acceptable loss limits, capital limits and risk scope that it is willing to accept in the pursuance of the planned business objectives – subject to full compliance with the law and regulations. The level of limit utilisation is monitored and periodically submitted to the Management Board, Risk Committee and the Supervisory Board.

The operational risk management system applies to all business spheres of the Bank and the activity of the Group, cooperation with clients, providers and partners. It is a cohesive, regular practice that covers the following elements:

• risk identification and assessment,

• mitigation or risks and monitoring of mitigation activities,

• performance of inspections,

• quality monitoring and assurance.

The Bank has a coherent and continuously updated set of internal normative documents in relation to operational risk management. The documents regulate the scope, principles and duties of organisational units and employees to mitigate the effects and likelihood of financial and reputational losses in that respect. The risk management culture including risk awareness is reinforced through a number of training and awareness programmes.

Compliance risk

The bank’s compliance mission is to build a corporate culture based on knowledge of and compliance with laws, internal regulations, market standards and ING Values and Behaviour, as defined in the Orange Code .

31

|

ING Bank Śląski S.A.

|

Report on non-financial information of ING Bank Śląski S.A. Group in 2021

Compliance risk management process

The Bank’s Supervisory Board oversees compliance risk management and the Bank’s Management Board is responsible for effective compliance risk management, including:

• the implementation of organisational arrangements, regulations and procedures that enable compliance risk to be managed effectively, and

• ensuring that the resources and means required to perform the tasks are adequate.

The Centre of Expertise – Compliance is an organisationally separate, independent unit that is responsible for the organisation and operation of the compliance risk management process. The aim of the Centre of Expertise – Compliance is to shape solutions for identifying, assessing, controlling and monitoring the risk of non-compliance of the bank’s activities with the law, internal regulations and market standards, and to provide reports in this respect. Compliance activities are aimed at the active participation of the bank’s employees in the compliance risk management by shaping a risk culture based on knowledge and compliance with the law, internal regulations and market standards.

Centre of Expertise – Compliance flexibly adapts organisationally to the changing external environment. The changes are necessary to further increase the effectiveness of compliance risk management and to effectively mitigate these risks. With this in mind, the Compliance unit:

• developed the required procedures and methodologies on the basis of which it carried out independent inspections, training programs, issued recommendations and recommendations in banking processes, including in the process of giving opinions on product and legislative changes and marketing materials,

• strengthen the competences of subordinate employees,

• implemented an automation plan in the area of compliance risk.

Major initiatives in 2021

In 2021, the bank continued work to improve the compliance risk management system, including the following elements:

• counteracting money laundering and terrorist financing, as well as regulations on counteracting the use of the financial sector for fiscal fraud,

• the requirements of the MIFID II Directive and Polish implementing regulations,

• reporting of tax schemes and tax avoidance (MDR),

• implementation of Recommendation Z on the principles of internal governance in banks, prepared and published by the PFSA,

• adoption of the Best Practice for WSE Listed Companies (with two exceptions described in detail in the section of the report on Corporate Governance Principles ).

The following regulations, among others, have been updated: “Know Your Client” Policy, Anti-bribery and corruption policy, Competition law compliance policy, Conflict of interest policy, Regulations – Principles of professional ethics for employees of ING Bank Śląski S.A., Policy for anonymous reporting of breaches of law, internal regulations and ethical standards, Market abuse policy. The Bank’s internal governance principles have been written down and published as new policies effective from 1 January 2022: Policy – principles of internal governance in ING Bank Śląski S.A. and Policy – principles of internal governance in ING Bank Śląski S.A. Group.

Transaction security and stability of IT systems

The security of the funds and data of clients and partners is a key issue to which the bank pays special attention in its day-to-day operations. It continuously monitors threats and analyses their impact on the ICT infrastructure (applications, systems, networks), as well as business processes, processes of its partners and service providers and their potential impact on clients. On that basis, it designs and implements appropriate organisational and technical solutions in the areas of prevention, detection and response.

The bank’s ICT systems protect multi-layered cyber security mechanisms and systems.

Another major aspect of the bank’s efforts to ensure an appropriate level of banking services to clients is to ensure stable operations of our systems. To attain this goal, various measures are taken such as:

• ensuring an appropriate process of change management in IT systems, which guarantees adequate tests of the impact of changes on the operation of systems,

• ensuring proper architecture of critical systems to guarantee full redundancy of components and fail-safe operations,

• implementation of a mechanism for monitoring the correct operation of systems, allowing for early detection of symptoms of malfunctioning components and quick diagnostics of errors,

• implementation of the process of managing the increase in demand for resources ensuring that hardware and software resources are adapted to changes in business volumes and changes in the way clients operate.

32

|

ING Bank Śląski S.A.

|

Report on non-financial information of ING Bank Śląski S.A. Group in 2021

IT security management process

Ensuring security for IT systems and the data processed in them is a priority for the bank, therefore its aspects are embedded in every process or area of the bank’s operations. The processes aimed at ensuring safety are subject to constant effectiveness control, which allows us to constantly improve procedures related to preventing, detecting and responding to threats, as well as taking actions to eliminate their potential effects (e.g. unavailability of banking services).

The bank’s approach to security management in the IT area is systemic and continuous, identifying threats regularly, strengthening protection mechanisms, and implementing a long-term cybersecurity strategy. IT security processes and roles are organized in accordance with the best and recognized international standards.

IT security activities are supervised by the Bank’s Management Board and by a dedicated IT Security and Risk Council established by the Board. It comprises, among others, the leadership of the Business, Tech, Cyber Security, Operational Risk, Data Security, Fraud Prevention, Audit and Compliance units. The Council regularly assesses the bank’s resistance to known threats and issues directional technological and procedural decisions in the scope ensuring an adequate level of the bank’s cybersecurity.

A dedicated unit is responsible for cyber security tasks, including continuous security monitoring. Nevertheless, the bank adopts the principle that each employee is responsible for ensuring the security of data and ICT systems to the extent adequate to their functions, tasks performed and their powers. Raising the awareness and competence of employees in the field of protection against threats is a permanent element of training and awareness-raising campaigns.

The bank constantly improves security solutions and systems used to protect its clients, as well as the bank itself, constantly testing their real effectiveness through, among others, penetration tests of banking infrastructure and applications, APT tests (Advanced Persistent Threat), tests of immunity to DDoS (Distributed Denial of Service) and many others.

The bank designs and updates the security standards and architectures applicable at the bank on an ongoing basis. Based on their requirements, ICT systems are designed, built and implemented according to the principle to ensure safety at the earliest possible stages of their life. During development, before implementation and periodically after implementation, the systems are subjected to various tests, verifying the resistance of systems and applications to attempts to breach their integrity and to bypass the applied security measures.

Components of the ICT system are subject to a continuous scanning process aimed at detecting any vulnerabilities and eliminating them immediately. In addition, banking systems (network, infrastructure and applications) have security monitoring in place to detect any anomalies, adverse effects and security incident attempts. Multi-layered protection against malware (such as ransomware) is also implemented.

As part of the activities increasing the level of security, mechanisms of multi-factor authentication of users’ access to ICT systems and data and monitoring of their activity are implemented.

The bank develops model security requirements for each ICT technology and specific application solution, and their effectiveness and correctness of implementation is regularly verified as part of security tests and reviews, as well as internal and external audits. Such audits and tests are performed by renowned expert companies.

The Bank has maintained and updated existing and implement new tools for early detection of all types of fraud and abuse, advanced targeted attacks, including preventing information leakage or execution of unauthorized transfer of large amounts of money from the banking system.

The Bank uses solutions of leading providers of tools and services in the area of cyber security and unique solutions developed in-house by specialists. At the same time, the bank constantly cooperates with ING Group member companies and other companies and organisations in Poland (banks, internet service providers, trade associations). This allows it to observe trends, detect new vulnerabilities and counteract IT security threats in advance.

The bank actively cooperates with governmental and financial supervision institutions, complying with all recommendations and recommendations of these institutions, including the requirements for the operator of the key service, which the bank has been designated pursuant to the Act on the National Cybersecurity System.

In activities related to ensuring the security of client data, the bank is not limited only to the bank’s infrastructure, but also requires an equally high level of security from its partners, both by means of appropriate contractual provisions with IT security requirements and verification of their fulfilment as part of periodically performed audits.

In its online banking applications, the bank uses the following solutions to increase client security:

• Authorisation of operations (transactions, logins, data changes, etc.) with a one-time code or the PUSH method – this method enables authorisation of instructions in the internet banking system by means of an authorisation code or confirmation of a message in the mobile application Moje ING. Along with the request for transaction confirmation, the client is provided with comprehensive information on the details of the transaction, which allows for additional verification of the instruction.

• Hard daily limit – the amount limit to which transfers can be made on a given day in Internet banking.

• Encrypted Internet connection – access to banking systems is possible only after entering an ID and password. Communication between clients’ computers and the bank’s server is encrypted with the TLS protocol. The ingbank.pl service and the internet banking system are protected by digital certificates with a high level of trust, which secure the connection via an encrypted HTTPS protocol. This guarantees fully secure data transfer in encrypted form, protects the data against third-party modifications and authenticates the computers that communicate with each other.

33

|

ING Bank Śląski S.A.

|

Report on non-financial information of ING Bank Śląski S.A. Group in 2021

• 3D Secure (a standard of card payments over the Internet) – when our clients pay with cards in an Internet store handling 3D Secure, the payment is additionally confirmed with a one-off SMS code. In order to use 3D Secure payments in our Bank, you don’t need to run or activate anything – just a card that supports on-line payments.

• Masked password – logging into the internet banking system is done without entering the whole password – the system automatically draws only selected characters.

• Automatic logout in the event of user inactivity.

• Behavioural biometrics – analysis of user interactions with a computer in order to detect possible interference by undesirable persons. During this verification, it is not checked what a given user does, but how he/she does it. The Bank collects and analyses, inter alia , information on how fast and often the user clicks on individual keys on the keyboard, how to scroll the screen, how fast and often the user clicks the computer mouse. The user profile is built only after logging into the Moje ING online banking system and the user’s behaviour is compared after each login.

• Transaction monitoring – the bank monitors the use of internet banking in real time, both in detection and prevention modes.

• Malware detection – a tool has been implemented to detect malware activity at the client’s station when using online banking.

With regard to mobile banking, the bank applies the following security solutions:

• Authorization of transactions in the mobile application – this method is available to clients who use the Moje ING internet banking system, make a transfer on their computer and have Moje ING mobile application installed; it is used interchangeably with SMS code.

• Fingerprint or FaceID login – this option is available for phones with a fingerprint reader. Activation of this login method is available after logging into the application.

• Hard daily limit – the amount limit to which transfers can be made on a given day via mobile banking application.

• Automatic logout in the event of user inactivity.

In the event of a justified suspicion of a threat of cybercrime or fraud against clients, the bank takes preventive measures, e.g. rejects transactions, blocks services, protecting clients against taking over their data or funds by unauthorized persons.

Personal data security

The stability of IT systems also means protecting personal data of clients, business partners and employees. However, apart from IT security, the bank also cares about the physical security of the data and information stored in the bank and constantly improves its approach to personal data protection. The bank’s internal regulations strictly define the permissibility and principles of the presence of outsiders in the offices and exclude the connection of unverified devices to the bank’s ICT network.

Physical security features are tested on a regular basis and the conclusions of the inspection inspire change. Testing physical security and any method of remote access to systems has become an integral part of the bank’s APT testing of the bank’s cyber security resilience.

Management of personal data security

In 2021, the bank found no substantiated complaints of breaches of client privacy, although administrative proceedings are pending in three cases.

Bank employees demonstrate a high level of awareness of personal, financial and business data protection by completing mandatory training cycles on an ongoing basis.

Programs aimed at continuous improvement of employees’ competences in the field of data protection are constantly implemented, indicating how important it is to protect the privacy of clients, business partners and employees themselves. In this respect, the bank uses meetings, workshops, as well as periodic communication to employees.

The security of using banking services also depends on clients, so the bank shares with them information about potential threats and recommends security solutions on devices supporting Internet banking transactions made by the clients. The Bank provides each client with a set of principles for the correct use of online banking:

• showing you how to create a secure password,

• keeping you informed about the risks in Internet banking,

• reminding you of the principles of safe banking,

• explaining how to protect against data theft on the Internet,

• teaching you how to protect your clients’ devices,

• blocking services when reasonable to protect clients against unauthorized access to their data,

• making you aware of the dangers during conversations with clients who visit us at the facility,

34

|

ING Bank Śląski S.A.

|

Report on non-financial information of ING Bank Śląski S.A. Group in 2021

• attending workshops for academic circles aimed at raising awareness,

• carries out numerous awareness-raising activities using bank communication channels and organises webinars on cyber-security and data protection.

The bank cares for both the safety of retail clients and the safety of corporate clients. As in previous years, conferences for corporate and strategic clients are held, during which the bank presents threats related to cybercrime and the mechanisms of applications and solutions to counteract abuse.

The bank has not only implemented the requirements related to the implementation of the European Union Regulation on the protection of personal data, but also analyses the changes and incorporates them without unnecessary delay into the procedures and internal regulations. As in previous years, as part of the Polish Bank Association, the bank is working with other banks to develop a common code of conduct, as well as to develop consistent solutions related to the protection of personal data.

Cyber security

The specific situation caused by the pandemic has meant that the frequency of attacks by cybercriminals is constantly increasing. Fraudsters use both modern technical means and social engineering in their attacks, while at the same time constantly modifying attack scenarios, which requires very high flexibility and speed of reaction from the bank. In view of the high and continuing trend of fraud against the bank’s clients, a dedicated unit was set up in the bank in March 2021 to coordinate all fraud activities and to respond quickly and adapt preventive measures to the activity of fraudsters. One of the obstacles to banks’ effective response to emerging threats is legislation that has not kept pace with developments in technology and financial services, as well as low client interest in fraud awareness campaigns.

Phishing remains the most common method of attack, but nevertheless the biggest losses for clients have been in investment scams, in which fraudsters use social engineering to defraud clients’ funds under the pretext of high returns after investing them on cryptocurrency exchanges.

There has been a significant increase in the number of attacks using telephone calls (spoofing). Spoofing fraudsters pretend to be the bank’s helpline or security department, using appropriate techniques so that the client’s phone displays the bank’s real helpline number when they call. The criminals are persuading clients to install additional software that allows them to take control of the client’s device.

The degree of advancement of targeted attacks on enterprises and institutions (mainly financial) carried out by organised groups of cybercriminals was similar to the previous years.

As in previous years, the environment in which we live and function is changing dynamically. New technologies and the methods of their use are rapidly developing, which not only affects the convenience, efficiency and effectiveness, but also carries many risks.

Bearing this in mind, we are constantly strengthening and developing our own cybersecurity system at the local level and across the ING Group in order to prevent acts of cybercrime against clients, employees and our bank’s information and communication system.

Due to the activities undertaken in the area of cybersecurity, the bank did not record any significant incidents or frauds resulting from the weakness of the banking security system.

Cybercrime resistance is one of the basic principles of building client interaction channels by our bank. Due to the continuous development of new, advanced attack methods, the bank’s security teams are constantly improving existing systems and building new, more effective detection and prevention mechanisms. An important element of our development strategy is the constant improvement of the competences of security specialists as well as testing systems, processes and people as part of numerous exercises and tests. All these activities are aimed at protecting the bank’s resources from threats from inside and outside and thus protecting our clients and the funds entrusted to us.

We are actively developing behavioural verification methods to identify potential attempts at criminal activity in the area of electronic banking channels. Thanks to this solution, we can prevent the impersonation of third parties as Moje ING users. Behavioural verification allows for a better adjustment of protective mechanisms to the user of electronic banking by creating a dedicated behavioural profile of the client. These methods are used after obtaining the consent of the client. In order to encourage clients to use this type of solution, we launched appropriate information campaigns.

We also improve mechanisms for detecting anomalies both in the bank’s transaction system itself and in transactions ordered by clients, thus catching suspicious transactions – ordered by unauthorised persons – and we take care of the integrity of transactions ordered by clients, reducing the risk of internal fraud.

We are constantly developing tools, algorithms and rules to detect various types of fraud and abuse, including preventing data leakage. We execute many of these tasks together with other ING Group member companies, as well as in cooperation with financial institutions, state bodies and law enforcement agencies. We establish cooperation with suppliers of modern technologies in order to introduce new authorisation methods based, for example, on biometrics or client behaviour.

We care about the awareness of our clients and employees. We carry out many educational activities on cyber security risks and programmes to improve the skills and knowledge of IT staff and teams responsible for ensuring the bank’s cyber security is adequate.

In addition, information campaigns for our bank’s clients warning them of current risks are already a regular feature of the services we provide. On current basis we keep our clients informed about existing threats through our websites, social media and educate them and show them how to behave in order to use online and mobile banking safely. Such activities are visible in our e-banking system for each user, and information is systematically placed on