Introduction This section describes the market risks that we are exposed to, along with the tools and methodologies used to measure these risks as of December 31, 2025. We face market risk as an inherent aspect of our lending, trading and investment operations. Market risk represents the potential loss due to adverse changes in market prices of financial instruments driven by fluctuations in interest rates, foreign exchange rates, equity prices and other risk factors, such as sovereign risk. Our risk management strategy, called the 'Integrated Risk Management Strategy', is based on principles set by international bodies and by Colombian regulations, and is guided by our corporate strategy. The primary objective of the Integrated Risk Management Strategy is to identify, measure, coordinate, monitor, report and propose policies for market and liquidity risks, thereby facilitating the efficient management of our assets and liabilities. To formalize the approach to market risk management, the Board of Directors and senior management have established policies, procedures, strategies and rules for market risk administration in the 'Market Risk Manual'. This manual defines the roles and responsibilities of each subdivision and their interaction to ensure effective market risk administration. Our Market Risks Management Department is responsible for: (a) identifying, measuring, monitoring, analyzing and controlling the market risk inherent in our businesses, (b) analyzing our exposure under stress scenarios and confirming compliance with our risk management policies, (c) analyzing the methodologies designed by the official price vendor for valuation of the market value securities and financial instruments, (d) reporting to senior management and the Board of Directors any violation of our risk management policies, (e) reporting to the senior management on a daily basis the levels of market risk associated with the trading instruments recorded in its treasury book (the 'Treasury Book'), and (f) proposing policies to the Board of Directors and to senior management that ensure the maintenance of predetermined risk levels. We have also implemented an approval process for new products across each of our subdivisions. This process ensures that each subdivision is prepared to incorporate the new product into its procedures, that all risks are considered prior to incorporation, and that approval from the Board of Directors is obtained before the new product is offered. Our assets include both trading and non-trading instruments. Trading instruments are recorded in the Treasury Book and include fixed income securities, foreign exchange (FX) and bond futures, as well as over-the-counter plain vanilla and exotic derivatives. Derivative trading includes forward contracts on foreign currency operations, forward contracts on fixed income securities, plain vanilla options on foreign currency, Asian options on U.S. dollar/COP, cross currency swaps and interest rate swaps. Non-trading instruments are recorded in our banking book (the 'Banking Book'), which primarily includes loans, time deposits, checking accounts and savings accounts.We use a Value-at-Risk ('VaR') calculation to manage our exposure to market risk in the Treasury Book, applying two different VaR methodologies: (1) the standard methodology required by the SFC, used to report market risk exposure to the regulator (this is the methodology applied in the analysis below); and (2) an internal historical simulation methodology, used to monitor the VaR limit structure trading activities. The Board of Directors is responsible for establishing the maximum VaR based on the assessment of the appropriate level of risk for Cibest Corporate Group. The Corporate Market, Liquidity and Interest Rate Risk Committee is responsible for establishing the maximum VaR by type of investment. These limits are supervised daily by our Market Risk Management Office. We are exposed to foreign currency exchange rate risk due to mismatches between assets and liabilities and off-balance sheet items denominated in different currencies.These mismatches may arise from trading activities or during the normal course of business operations. Our principal foreign currency exposure is to the U.S. dollar, which is actively managed by the Treasury Division and monitored through positions, VaR, and daily results.To manage interest rate risk associated with banking activities, we conduct a thorough analysis of mismatches between interest earning assets and interest-bearing liabilities. This analysis evaluates the potential impact of interest rate shocks on both the economic value of equity (EVE) and net interest income (NII). In addition, the foreign currency exchange rate exposures arising from the Banking Book are provided to the Treasury Division, where these positions are consolidated and effectively managed. Trading Instruments Market Risk Measurement We also measure the Treasury Book’s exposure to market risk (including over-the-counter derivatives positions) as well as the currency risk exposure of the Banking Book, which is provided to the Treasury Division, using a VaR methodology established in accordance with Chapter XXXI of the Basic Accounting Circular issued by the SFC. This methodology is based on the model recommended by the Amendment to the Capital Accord to Incorporate Market Risks by the Basel Committee of 2005, which focuses on the Treasury Book and excludes investments measured under amortized cost that are not pledged as collateral, as well as any other investment that comprises the Banking Book, such as non-trading positions except for the currency risk position stemming from investment in affiliated but not consolidated entities denominated in foreign currencies. In addition, the methodology aggregates all risks using correlations, through an allocation system based on defined zones and bands, adjusted by specific sensitivity factors. Our total market risk is calculated through the arithmetical aggregation of the VaR calculated for each subsidiary. For purposes of VaR calculations, a risk exposure category is any market variable capable of causing potential changes in the portfolio value. Considering a given risk exposure, the VaR model assesses the maximum loss that does not exceed a specified confidence level over a given period of time. The fluctuations in the portfolio’s VaR depend on volatility, modified duration and positions changes relating to the different instruments that are subject to market risk. The relevant risk exposure categories for which VaR is computed by Cibest Corporate Group according to Chapter XXXI, appendix VI of the Basic Accounting Circular are: (i) interest rate risks relating to local currency, foreign currency and UVR; (ii) currency risk; (iii) stock price risk; (iv) fund risk and (v) credit default swaps. Interest Rate Risk (Treasury Book) The interest rate risk is the probability of decline in the market value of a position due to fluctuations in market interest rates. We calculate the interest rate risk for positions in local currency, foreign currency and UVR separately, in accordance with Chapter XXXI of the Basic Accounting Circular issued by the SFC. The calculation of the interest rate risk begins with determining the net position in each instrument and estimating its sensitivity, calculated by multiplying its net present value (NPV) by its “modified duration” and by the interest rate’s estimated fluctuation (as defined by the Superintendency of Finance). The interest rate’s fluctuations are established by the SFC according to historical market performance, as shown in the following table: Figure 1. Interest Risk – Sensitivity by Bands and Zones Modified Duration Interest rate fluctuations (basis points) Zone Band Low High Pesos UVR USD Zone 1 1 0 0.08 274 274 100 2 0.08 0.25 268 274 100 3 0.25 0.5 259 274 100 4 0.5 1 233 274 100 Zone 2 5 1 1.9 222 250 90 6 1.9 2.8 222 250 80 7 2.8 3.6 211 220 75 Zone 3 8 3.6 4.3 211 220 75 9 4.3 5.7 172 200 70 10 5.7 7.3 162 170 65 11 7.3 9.3 162 170 60 12 9.3 10.6 162 170 60 13 10.6 12 162 170 60 14 12 20 162 170 60 15 20 - 162 170 60 After calculating the sensitivity factor for each position, modified duration is applied to classify positions into their respective bands. A net sensitivity is then calculated for each band, by determining the difference between the sum of all long-positions and the sum of all short-positions. Subsequently, a net position is calculated for each zone, comprising a series of bands defined by the SFC. The final step involves adjusting within each band, across bands and within each zone, culminating in the computation of the interest rate risk VaR by currency. All adjustments are executed in accordance with the guidelines issued by the Superintendency of Finance. Our exposure to interest rate risk primarily arises from investments in Colombian government’s treasury bonds (TES) and other securities issued by the Colombian government. Currency (Treasury and Banking Book), Equity (Treasury Book) and Fund Risk (Treasury Book) The VaR model uses a sensitivity factor to estimate the probability of loss due to fluctuations in the prices of stocks, funds and currencies in which we hold positions. As previously indicated, the methodology used in this Annual Report to quantify such risk consists of computing VaR, calculated by multiplying the position by the maximum probable variation in the price of such positions (Δp). The Δp is determined by the SFC, as shown in the following table: Figure 2. Sensitivity Factor for Currency Risks, Equity Risks and Fund Risks Currency Sensitivity Factor USD 12.49 % Euro 11.00 % Other currencies 13.02 % Equity and Fund Risk 14.70 % Interest rate fluctuations and the sensitivity of exchange rate risk, share prices, and collective portfolios used in the model are established by the SFC in accordance with historical market behavior. Total Market Risk VaR This VaR is calculated as the algebraic sum of the interest rate risk, currency risk, stock price risk, fund risk and credit default swaps risk. These components are calculated by aggregating our and our subsidiaries’ exposures to each respective risk. At present, we do not have exposure to credit default swaps risk. Our exposure to market risk decreased by 28.5%, from COP 1,697,565 in December 2024 to COP 1,213,155 in December 2025. There was a notable decrease in the exchange rate factor due to lower exposure to the U.S. dollar, driven by lower exposure to foreign currency securities. Meanwhile, the share price factor increased due to greater exposure to equity instruments, as did the collective portfolio factor, which also increased due to the valuation of the Colombia Real Estate Fund. Assumptions and Limitations of VaR Models: While VaR models are widely recognized as a valuable tool for risk management, they have inherent limitations, including their reliance on historical data, which may not be indicative of future market conditions or trading patterns. Consequently, VaR models should not be viewed as predictive indicators of future results. We may incur losses that could be materially in excess of the amounts estimated by the models for a particular trading day or over a specific period, and there have been instances when results have fallen outside the values generated by our VaR models. A VaR model does not estimate the greatest possible loss. The outcomes derived from these models, as well as the subsequent analysis, are subject to prudent judgment of our risk management personnel. The chart below provides information about our VaR for trading instruments at the end of December 2024 and December 2025. December 2025 In millions of COP Factor December 31 Average Maximum Minimum Interest Rate Risk VaR 534,919 552,803 499,712 524,034 Foreign Exchange Rate Risk VaR 182,077 282,154 751,796 79,062 Equity Risk VaR 407,177 380,326 367,615 375,015 Fund Risk VaR 88,982 51,683 35,781 36,608 Total Value at Risk 1,213,155 1,266,967 As of December 31, 2024, the proprietary portfolio of Wenia amounted to USD -74.3 thousand, with a Value at Risk (VaR) of USD 3.8 thousand. The VaR was calculated using an internal methodology based on a Dynamic Conditional Correlation (DCC) GARCH model, with a one-day time horizon and a 99% of confidence level. Non-Trading Instruments Market Risk Measurement The relevant risk exposure in the Banking Book is interest rate risk, defined as the probability of unexpected changes in net interest income due to changes in market interest rates. Changes in interest rates affect our earnings as a result of timing differences on the repricing of the assets and liabilities. We manage interest rate risk arising from banking activities in non-trading instruments by analyzing the interest rate mismatches between its interest earning assets and its interest-bearing liabilities. The foreign currency exchange rate exposures associated with the Banking Book are provided to the Treasury Division where these positions are aggregated and managed. Interest Risk Exposure (Banking Book) We performed a sensitivity analysis of market risk sensitive instruments, estimating the impact on the net interest income for each position in the Banking Book, using a repricing model and assuming positive parallel shifts of 100 basis points (bps). Table 1 provides information about our interest rate sensitivity for the items on the statement of financial position that comprises the Banking Book: Table 1. Sensitivity to Interest Rate Risk of the Banking Book The chart below provides information about our interest rate risk sensitivity in local currency (COP) at December 31, 2025 and December 31, 2024: Interest Rate Risk As of December 31, December 31, 2025 December 31, 2024 In millions of COP Assets sensitivity 100 bps 1,314,604 1,262,776 Liabilities sensitivity 100 bps 870,619 915,528 Net interest income sensitivity 100 bps 443,985 347,248 The chart below provides information about our interest rate risk sensitivity in foreign currency (USD) at December 31, 2025 and December 31, 2024: Interest Rate Risk As of December 31, December 31, 2025 December 31, 2024 In thousands of USD Assets sensitivity 100 bps 95,344 76,219 Liabilities sensitivity 100 bps 110,682 83,051 Net interest income sensitivity 100 bps (15,337) (6,832) A positive net sensitivity denotes a higher sensitivity of assets than of liabilities and implies that a rise in interest rates will positively affect our net interest income. A negative sensitivity denotes a higher sensitivity of liabilities than of assets and implies that a rise in interest rates will negatively affect our net interest income. In the event of a decrease in interest rates, the impacts on net interest income would be opposite to those described above. Total Exposure As of December 31, 2025, the net sensitivity of the banking book in legal currency to positive and parallel variations in interest rates of 100 basis points was COP 443,985. The variation in interest rate risk sensitivity between 2025 and 2024 is due to the increase in the portfolio balance and accounting hedges. On the other hand, the sensitivity of the net interest margin in foreign currency, assuming a parallel shift of 100 basis points, amounted to USD 15,337. This represents an increase compared to December 31, 2024, primarily driven by higher balances in rate‑sensitive deposit accounts and certificates of deposit. Assumptions and Limitations Net interest income sensitivity analysis is based on the repricing model and incorporates the following key assumptions: (a) the effect of new transactions, defaults, etc. is not considered (b) the sensitivity of the fixed-rate balance sheet considers amounts maturing in less than one year, assuming that these will be placed again at market rates; and (c) changes in interest rates are presented immediately and in parallel in the yield curves for assets and liabilities. Structural Equity Risk Exposure (Banking Book) Grupo Cibest's Investment Banking unit, in its capacity as a financial corporation, holds structural capital investments directly and through its affiliated companies. These investments are mainly concentrated in the industrial and financial sectors. The market value of these positions grew 25.5%, going from COP 36,226 million at the end of 2024 to COP 45,460 million at the end of 2025, mainly as a result of the appreciation of ENKA's shares. The structural equity positions are exposed to market risk. Sensitivity calculations are made for those positions: As of December 31, 2025 2024 In millions of COP Market Value 45,460 36,226 Delta 14.70 % 14.70 % Sensitivity 6,683 5,325 A negative impact of 14.70% on the value of structural shares as of December 2025 would result in a COP 6,683 million drop in their market value.