TRANSLATORS’ EXPLANATORY NOTE

The English content of this report is a free translation of the statutory auditor’s report of the below-mentioned Polish Company. In Poland statutory accounts as well as the auditor’s report should be prepared and presented in Polish language and in accordance with Polish legislation, and the accounting principles and practices generally adopted in Poland.

The accompanying translation has not been reclassified or adjusted in any way to conform to the accounting principles generally accepted in countries other than Poland, but certain terminology current in Anglo-Saxon countries has been adopted to the extent practicable. In the event of any discrepancies in interpreting the terminology, the Polish language version is binding.

PricewaterhouseCoopers Polska spółka z ograniczoną odpowiedzialnością Audyt sp. k. , International Business Center, ul. Polna 11, 00-633 Warsaw, Poland, T: +48 (22) 746 4000,

PricewaterhouseCoopers Polska spółka z ograniczoną odpowiedzialnością Audyt sp. k. is entered into the National Court Register maintained by the District Court for the Capital City of Warsaw, under KRS number 0000750050, NIP 526-021-02-28. The seat of the Company is in Warsaw at Polna 11.

Independent Statutory Auditor’s Report

To the General Shareholders’ Meeting and the Supervisory Board of XTB S.A.

Report on the audit of consolidated financial statements

In our opinion, the accompanying annual consolidated financial statements:

• give a true and fair view of the consolidated financial position of XTB S.A. (the “Parent Company”) and its subsidiaries (together the “Group”) as at 31 December 2024 and the Group’s consolidated financial performance and the consolidated cash flows for the year then ended in accordance with the applicable International Financial Reporting Standards as adopted by the European Union and the adopted accounting policies;

• comply in terms of form and content with the laws applicable to the Group and the Parent Company’s Articles of Association .

Our opinion is consistent with our additional report to the Audit Committee of the Parent Company issued on the date of this report.

What we have audited

We have audited the annual consolidated financial statements of the Group XTB S.A. which comprise:

• the consolidated statement of financial position as at 31 December 2024;

and the following prepared for the financial year then ended:

• the consolidated statement of profit or loss and other comprehensive income;

• the consolidated statement of changes in equity;

• the consolidated cash flow statement, and

• the notes to consolidated financial statements, comprising material accounting policy information and other explanatory information.

We believe that the audit evidence we have obtained is sufficient and appropriate to provide a basis for our opinion.

We are independent of the Group in accordance with “the Handbook of the International code of ethics for professional accountants (including International independence standards) (Code of ethics) as adopted by resolution of the National Board of Statutory Auditors and other ethical requirements that are relevant to our audit of the consolidated financial statements in Poland. We have fulfilled our other ethical responsibilities in accordance with these requirements and the Code of ethics. During the audit, the key statutory auditor and the audit firm remained independent of the Group in accordance with the independence requirements set out in the Act on Statutory Auditors and in the EU Regulation.

Overview

As part of designing our audit, we determined materiality and assessed the risks of material misstatement in the consolidated financial statements. In particular, we considered where the Parent Company’s Management Board made subjective judgements; for example, in respect of significant accounting estimates that involved making assumptions and considering future events that are inherently uncertain. As in all of our audits we also addressed the risk of management override of internal controls, including among other matters, consideration of whether there was evidence of bias that represented a risk of material misstatement due to fraud.

Materiality

The scope of our audit was influenced by our application of materiality. An audit is designed to obtain reasonable assurance whether the consolidated financial statements are free from material misstatement. Misstatements may arise due to fraud or error. They are considered material if,

3

Based on our professional judgement, we determined certain quantitative thresholds for materiality, including the overall materiality for the consolidated financial statements as a whole, as set out in the table below. These, together with qualitative considerations, helped us to determine the scope of our audit and the nature, timing and extent of our audit procedures and to evaluate the effect of misstatements, if any, both individually and in aggregate on the consolidated financial statements as a whole.

We agreed with the Audit Committee of the Parent Company that we would report to them misstatements of the consolidated financial statements identified during our audit above PLN 2.620 thousand, as well as misstatements below that amount that, in our view, warranted reporting for qualitative reasons.

How we tailored our Group audit scope

We tailored the scope of our audit in order to perform sufficient work to enable us to provide an opinion on the consolidated financial statements as a whole, taking into account the structure of the Group, the accounting processes and controls, and the industry in which the Group operates.

We have audited the separate financial information of the Parent Company and the financial information of subsidiaries whose financial situation and financial results, in our opinion, have a material impact on the consolidated financial statements. The scope of our audit was appropriately adjusted to cover all material items included in the consolidated financial statements.

Key audit matters

4

Responsibility of the Management and Supervisory Board of the Parent Company for the consolidated financial statements

In preparing the consolidated financial statements, the Parent Company’s Management Board is responsible for assessing the Group’s ability to continue as a going concern, disclosing, as applicable,

5

The Parent Company’s Management Board and members of the Supervisory Board are obliged to ensure that the consolidated financial statements comply with the requirements specified in the Accounting Act of 29 September 1994 (“the Accounting Act”). Members of the Supervisory Board are responsible for overseeing the financial reporting process.

Auditor’s responsibility for the audit of the consolidated financial statements

The scope of the audit does not include an assurance on the Group’s future profitability nor the efficiency and effectiveness of conducting its affairs by the Parent Company’s Management Board, now or in future.

As part of an audit in accordance with NSA, we exercise professional judgement and maintain professional scepticism throughout the audit. We also:

• identify and assess the risks of material misstatement of the consolidated financial statements, whether due to fraud or error, design and perform audit procedures responsive to those risks, and obtain audit evidence that is sufficient and appropriate to provide a basis for our opinion. The risk of not detecting a material misstatement resulting from fraud is higher than for one resulting from error, as fraud may involve collusion, forgery, intentional omissions, misrepresentations, or the override of internal control;

• obtain an understanding of internal control relevant to the audit in order to design audit procedures that are appropriate in the circumstances, but not for the purpose of expressing an opinion on the effectiveness of the Group’s internal control;

• evaluate the appropriateness of accounting policies used and the reasonableness of accounting estimates and related disclosures made by the Parent Company’s Management Board;

• conclude on the appropriateness of the Parent Company’s Management Board’s use of the going concern basis of accounting and, based on the audit evidence obtained, whether a material uncertainty exists related to events or conditions that may cast significant doubt on the Group’s ability to continue as a going concern. If we conclude that a material uncertainty exists, we are required to draw attention in our auditor’s report to the related disclosures in the consolidated financial statements or, if such disclosures are inadequate, to modify our opinion. Our conclusions are based on the audit evidence obtained up to the date of our auditor’s report. However, future events or conditions may cause the Group to cease to continue as a going concern;

• evaluate the overall presentation, structure and content of the consolidated financial statements, including the disclosures, and whether the consolidated financial statements represent the underlying transactions and events in a manner that achieves fair presentation;

• plan and perform the group audit to obtain sufficient appropriate audit evidence regarding the financial information of the entities or business units within the Group as a basis for forming an opinion on the consolidated financial statements. We are responsible for the direction, supervision and review of the audit work performed for the purpose of the group audit. We remain solely responsible for our audit opinion.

6

We also provide the Audit Committee of the Parent Company with a statement that we have complied with relevant ethical requirements regarding independence, and communicate with them all relationships and other matters that may reasonably be thought to bear on our independence, and where applicable, actions taken to eliminate threats or safeguards applied.

From the matters communicated to the Audit Committee of the Parent Company, we determine those matters that were of most significance in the audit of the consolidated financial statements of the current period and are therefore the key audit matters. We describe these matters in our auditor’s report unless law or regulation precludes public disclosure about the matter or when, in extremely rare circumstances, we determine that a matter should not be communicated in our report because the adverse consequences of doing so would reasonably be expected to outweigh the public interest benefits of such communication.

Other information comprise:

• a Management Board Report on the Operations of the XTB Group and XTB S.A. Company for the financial year ended 31 December 2024 (“the Joined Report on the operations”) and the corporate governance statement which is a separate part of the Joined Report on the operations,

• [other documents comprising the Annual Report for the financial year ended 31 December 2024 (“the Annual Report”),

(together “Other Information”).

Other information does not include the financial statements and our auditor’s report thereon.

We obtained the annual report before the date of this audit report, except for the Supervisory Board's Statement on the assessment, along with the justification, regarding the report on the issuer's activities and the financial statements in terms of their compliance with records, documents, and the actual state of affairs referred to in Article 71(1)(12) of the Regulation of the Minister of Finance of March 29, 2018, on current and periodic information provided by issuers of securities and the conditions for recognizing information required by the laws of a non-member state as equivalent (the "Regulation on Current Information"), which will be available after this date.

Responsibility of the Management and Supervisory Board of the Parent Company

The Management Board of the Parent Company is responsible for the preparation of the Other Information in accordance with the law.

The Parent Company’s Management Board and the members of the Supervisory Board are obliged to ensure that the Joined Report on the operations including its separate part complies with the requirements of the Accounting Act.

Statutory auditor’s responsibility

Our opinion on the consolidated financial statements does not cover the Other Information.

In connection with our audit of the consolidated financial statements, our responsibility under NSA is to read the Other Information and, in doing so, consider whether the Other Information is materially inconsistent with the information in the consolidated financial statements, our knowledge obtained in our audit, or otherwise appears to be materially misstated. If, based on the work performed, we

7

In accordance with the requirements of the Act on the Statutory Auditors, we are also obliged to issue an opinion on whether the Joined Report on the operations has been prepared in accordance with the law, is consistent with information included in annual consolidated financial statements and to issue a statement as to whether, in the light of the knowledge about the Group and its environment obtained during the audit, any material misstatements have been identified in the Joined Report on the operations to the extent not related to sustainability reporting, and an indication of what any such material misstatement is.

Moreover, we are obliged to issue an opinion on whether the Group provided the required information in its corporate governance statement.

Statement on the Other information

We declare, based on the knowledge of the Group and its environment obtained during our audit, that we have not identified any material misstatements in the Joined Report on the operations, to the extent not related to sustainability reporting, and in the remaining Other information.

The Joined Report on the operations, to the extent related to sustainability reporting, for the financial year ended 31 December 2024 was the subject of our separate limited assurance engagement, from which on 20 March 2025 we issued a report, containing an unmodified opinion.

As a result of our procedures under the NSA regarding identification of material misstatements in the Joined Report on the operations, to the extent related to sustainability reporting, we have no matters to report in this respect.

In the event that, after reviewing the Supervisory Board's Statement on the assessment, including justification, regarding the issuer's activity report and the financial statements in terms of their compliance with records, documents, and the actual state of affairs referred to in Article 71(1)(12) of the Regulation on Current Information, we identify a material misstatement, we are obliged to inform the Parent Company's Supervisory Board.

Opinion on the Joined Report on the operations to the extent not related to sustainability reporting

Based on the work we carried out during our audit, in our opinion, the Joined Report on the operations, to the extent not related to sustainability reporting,:

• has been prepared in accordance with the requirements of Article 49 of the Accounting Act and para. 71 of the Regulation of the Minister of Finance dated 29 March 2018 on current and periodical information submitted by issuers of securities and conditions for considering as equivalent the information required under the legislation of a non-Member State (“Regulation on current information”);

• is consistent with the information in the consolidated financial statements.

Opinion on the corporate governance statement

In our opinion, in its corporate governance statement, the Group included information set out in para. 70.6 (5) of the Regulation on current information. In addition, in our opinion, information specified in paragraph 70.6 (5)(c)–(f), (h) and (i) of the said Regulation included in the corporate governance statement are consistent with the applicable provisions of the law and with information included in the consolidated financial statements.

8

Report on other legal and regulatory requirements

In connection with the audit of consolidated financial statements we have been engaged by the Parent Company’s Management Board as part of our audit engagement letter to conduct a reasonable assurance engagement to express an opinion whether the consolidated financial statements of the Group as at and for the year ended 31 December 2024 prepared in the single electronic format contained in the file named XBRL XTB-2024-12-31-0-pl.zip (the “consolidated financial statements in the ESEF format”) was marked up in accordance with the requirements in the article 4 of the Commission Delegated Regulation (EU) 2019/815 of 17 December 2018 supplementing Directive 2004/109/EC of the European Parliament and of the Council with regard to regulatory technical standards on the specification of a single electronic reporting format (the “ESEF Regulation”).

Description of a subject matter and applicable criteria

The consolidated financial statements in the ESEF format were prepared by the Parent Company’s Management Board to comply with the technical requirements regarding the specification of a single electronic reporting format and marking up, which are set out in the ESEF Regulation.

The subject matter of our assurance engagement is the compliance of the consolidated financial statements in the ESEF format with the requirements of the ESEF Regulation and the requirements of this regulation, in our view, constitute appropriate criteria to form an opinion.

Responsibility of the Management Board and the Supervisory Board of the Parent Company

The Parent Company’s Management Board is responsible for the preparation of the consolidated financial statements in the ESEF format in accordance with the technical requirements regarding the specification of a single electronic reporting format which are set out in the ESEF Regulation. This responsibility includes the selection and application of appropriate markups in iXBRL using taxonomy specified in the ESEF Regulation. The responsibility of the Management Board of the Parent Company also includes designing, implementing and maintaining internal controls relevant for the preparation of the consolidated financial statements in the ESEF format which are free from material non-compliance with the requirements of the ESEF Regulation and their marking-up in compliance with these requirements .

Members of the Parent Company’s Supervisory Board are responsible for overseeing the financial reporting process, which also includes the preparation of the consolidated financial statements in accordance with the format that is compliant with legal requirements.

Our responsibility

Our objective was to express an opinion, based on the conducted reasonable assurance engagement, whether the consolidated financial statements prepared in the ESEF format were marked up, in all material respects, with the requirements of the ESEF Regulation.

We conducted our engagement in accordance with the National Standard on Assurance Engagements other than Audit and Review 3001PL – “Audit of financial statements prepared in the single electronic reporting format” (“KSUA 3001PL”) and where relevant with the National Standard on Assurance Engagements 3000 (R) in the wording of the International Standard on Assurance Services 3000 (Revised) - ‘Assurance Engagements other than Audits and Reviews of Historical Financial Information’ (“KSUA 3000(R)”).

Reasonable assurance is a high level of assurance, but it does not guarantee that the engagement performed in accordance with KSUA 3001PL and, where relevant, in accordance with KSUA 3000 (R) will always detect the material misstatement (significant non-compliance with the requirements).

The selection of the procedures depends on the auditor's judgement, including the auditor's assessment of the risk of material misstatements, whether due to fraud or error. In performing the assessments of this risk, the auditor shall consider the internal control related to the preparation of the consolidated financial statements in the ESEF format in order to plan appropriate procedures to provide the auditor with sufficient evidence appropriate to the circumstances. The assessment of the functioning of the internal control system was not carried out in order to express an opinion on the effectiveness of its operation.

Quality management and ethical requirements

We apply the National Standard on Quality Control 1 in the wording of the International Standard on Quality Management (PL) 1 – “Quality Management for Firms that Perform Audits or Reviews of Financial Statements, or Other Assurance or Related Services Engagements” as issued by the International Auditing and Assurance Standards Board and adopted by the resolution of the Council of the Polish Agency for Audit Oversight (“NSQC 1”). In accordance with the requirements of NSQC 1, we operate a system of quality management including documented policies or procedures regarding compliance with ethical requirements, professional standards and applicable legal and regulatory requirements.

When performing the engagement, we have complied with the independence and other ethical requirements in the Code of ethics. The Code of ethics is founded on fundamental principles of integrity, objectivity, professional competence and due care, confidentiality and professional behaviour. We also complied with other independence and ethical requirements that apply to this assurance engagement in Poland.

Summary of the work performed

Our planned and performed procedures were aimed at obtaining reasonable assurance whether the consolidated financial statements in the ESEF format were marked-up, in all material respects, in compliance with the applicable requirements. Our procedures included in particular:

• obtaining an understanding of the process of preparation of the consolidated financial statements in the ESEF format, including the process of selection and application by the Group of the XBRL tags and ensuring the compliance with the ESEF Regulation, including understanding the mechanism of the internal control system related to this process;

• reconciliation, on a selected sample, of the marked-up information contained in the consolidated financial statements in the ESEF format to the audited consolidated financial statements;

• evaluating of compliance with the technical standards regarding the specification of a single electronic reporting format, including the use of XHTML, using a specialised IT tool;

• evaluating the completeness of marking up the consolidated financial statements in the ESEF format using the iXBRL tags;

• evaluating the appropriateness of the use of XBRL tags selected from the taxonomy defined in the ESEF Regulation and whether the extension markups were used appropriately where no suitable element in taxonomy defined in the ESEF Regulation has been identified;

We believe that the evidence we have obtained is sufficient and appropriate to provide a basis for our opinion.

Opinion

In our opinion, based on the procedures performed, the consolidated financial statements in the ESEF format were marked-up, in all material respects, in compliance with the requirements of the ESEF Regulation.

Information on compliance with prudential regulations

The Management Board of the Parent Company is responsible for complying with the applicable prudential regulations set out in separate legislation, and in particular, for the correct determination of the capital ratios.

The capital ratios as at 31 December 2024 have been presented in Note 35 of the consolidated financial statements.

We are obliged to give information in our report on the audit of the consolidated financial statements as to whether the Group has complied with the applicable prudential regulations set out in separate legislation, and in particular, whether the Group has correctly determined its capital ratios. For the purposes of the said information, the following legal acts are understood as separate legislation: Regulation (EU) No 575/2013 of the European Parliament and of the Council of 26 June 2013 on prudential requirements for credit institutions and investment firms and amending Regulation (EU) No 648/2012, as amended (“CRR”), the Act of 5 August 2015 on macro-prudential supervision over the financial system and on crisis management in the financial system (“the Act on macro-prudential supervision”), Regulation of the Minister of Development and Finance of 25 April 2017 on the internal capital, risk management system, supervisory evaluation program and supervisory review and evaluation process, and remuneration policy in a brokerage house; Regulation of the Minister of Finance of 1 July 2016 on the types of brokerage house exposures excluded from large exposure limits, and Regulation of the Minister of Finance of 27 June 2016 on the treatment by brokerage houses of large blocks of shares of non-financial sector entities referred to in Article 89(3) of Regulation 575/2013.

It is not the purpose of an audit of the consolidated financial statements to present an opinion on compliance with the applicable prudential regulations specified in the separate legislation specified above, and in particular, on the correct determination of the capital ratios, and therefore, we do not express such an opinion.

Based on the work performed by us, we inform you that we have not identified:

• any cases of non-compliance by the Group with the applicable prudential regulations set out in the separate legislation referred to above, in the period from 1 January to 31 December 2024;

• any irregularities in the determination by the Group of the capital ratios as at 31 December 2024 in accordance with separate legislation referred to above,

which would have a material impact on the consolidated financial statements.

Statement on the provision of non-audit services

To the best of our knowledge and belief, we declare that the non-audit services prohibited under Article 5(1) of the EU regulation and Article 136 of the Act on Statutory Auditors were not provided and

The non-audit services which we have provided to the Parent Company during the period from the beginning of the audited period to the date of issuing this report are disclosed in the note 30 to the consolidated financial statements.

Appointment

We were first appointed to audit the annual consolidated financial statements of the Group by resolution 45/2028 of the Supervisory Board of the Parent Company dated 7 November 2028 and re- appointed by resolutions dated 4 May 2021 and 21 Febaruary 2024. We have been auditing the Group’s consolidated financial statements without interruption since the financial year ended 31 December 2019, i.e. for six consecutive years.

The Key Statutory Auditor responsible for the audit on behalf of PricewaterhouseCoopers Polska spółka z ograniczoną odpowiedzialnością Audyt sp.k., a company entered on the list of audit firms with the number 144., is Anna Bączyk.

Original report is signed in Polish language

Anna Bączyk

Key Statutory Auditor

No. in the registry 11810

Warsaw, 20 March 2025