A.History and development of the company Pursuant to the Corporate Structure Changes mentioned in the Explanatory Note to this Annual Report, Grupo Cibest began operations in May 2025 consolidating its role as the holding company for Grupo Bancolombia. Through this structure, Grupo Cibest brings together several specialized companies, offering a comprehensive portfolio of financial services including banking, leasing, digital financial solutions, and an extensive range of both financial and complementary products. Cibest Corporate Group is one of the largest Colombian financial groups, with presence in other countries such as Panama, El Salvador, Puerto Rico, Guatemala and the United States, delivering innovative financial solutions tailored to regional markets. We provide a wide range of financial and nonfinancial products and services to a diversified individual, corporate and government customer base. Grupo Cibest is a stock company (sociedad anónima) domiciled in Medellín, Colombia, and operates under Colombian laws and regulations. Grupo Cibest was incorporated in Colombia in 2024, and is incorporated until December 8, 2144. Since 2025, Grupo Cibest’s Common Shares have traded on the Colombian Stock Exchange under the symbol 'CIBEST'. Grupo Cibest has also maintained a listing on the NYSE, where its ADSs are traded under the symbol 'CIB,' and on the Colombian Stock Exchange, where its Preferred Shares are traded under the symbol 'PFCIBEST.' Pursuant to Rule 12g-3(a) under the Exchange Act, Grupo Cibest was established as a successor issuer to Bancolombia with respect to the Grupo Cibest ADSs. See Item 9. The Offer and Listing. Grupo Cibest's headquarters are located at Carrera 48 # 26-85, Medellín, Colombia, and the telephone number is + (57) 601 488-5950. Grupo Cibest's website is: https://www.grupocibest.com Grupo Cibest's agent for service of process in the United States is Puglisi & Associates, located at 850 Library Avenue, Suite 204, Newark, Delaware 19711. The SEC maintains a website at http://www.sec.gov that contains reports, proxy and information statements, and other information regarding issuers that file electronically with the SEC. Recent developments Share buyback program On June 9, 2025, at the Extraordinary General Shareholders’ Meeting, Shareholders approved the creation of a reserve for share repurchases and the appropriation of one trillion three hundred and fifty billion Colombian pesos (COP 1,350,000,000,000) from the legal reserve, authorizing its use for purposes of executing a share buyback program. The approved share buyback program includes the repurchase of Grupo Cibest’s Common Shares, Preferred Shares, and ADSs (the 'Buyback Program') for an aggregate amount of up to one trillion three hundred and fifty billion Colombian pesos (COP 1,350,000,000,000), over a period of up to one (1) year, commencing on July 17, 2025, following the approval of the Buyback Program’s regulations by the Board of Directors on June 24, 2024. There is no minimum number of securities required to be acquired under the Buyback Program. The Buyback Program is being carried out in Colombia through the trading systems of the Colombian Stock Exchange (Bolsa de Valores de Colombia) via Valores Bancolombia, and in the United States through an enhanced open market repurchase program executed by Morgan Stanley & Co. LLC. For additional information regarding the Buyback Program, see Item 16.E. “Purchases of Equity Securities by the Issuer and Affiliated Purchasers. Corporate reorganization of Banistmo and other subsidiaries in Panama On September 29, 2025, the Superintendency of Banks of Panama authorized the implementation of a corporate reorganization involving its Panamanian subsidiary, Banistmo and other subsidiaries of Grupo Cibest in Panama. The corporate reorganization included the following transactions: •The partial spin off by Valores Banistmo S.A. ('Valores Banistmo') and Banistmo Capital Markets Group Inc. of certain portfolios of assets in favor of Sociedad Beneficiaria VB Panamá S.A. ('Sociedad Beneficiaria VB'), followed by the merger of Sociedad Beneficiaria VB into Banistmo. Sociedad Beneficiaria VB was a Panamanian corporation wholly owned by Banistmo. •The distribution by Banistmo of 100% of the shares it held in Valores Banistmo in favor of Cibest Panamá Assets S.A. ('Cibest Panamá Assets'), a Panamanian corporation wholly owned by Grupo Cibest. As a result, Valores Banistmo ceased to be directly owned by Banistmo and became controlled by Cibest Panamá Assets, a subsidiary of Grupo Cibest. On October 21, 2025, the corporate reorganization was completed and Valores Banistmo remained a subsidiary of Grupo Cibest, with no changes to its ultimate shareholders or control structure. Likewise, Valores Banistmo retained its licenses as a securities brokerage firm and investment manager, both granted by the Superintendency of the Securities Market of Panama. See Agreement for the Sale of Banistmo for the subsequent agreement for the sale of Banistmo. Nequi's authorization certificate (operating permit) On November 6, 2025, the SFC, through Resolution No. 2002 dated October 31, 2025, as amended by Resolution No. 2021 dated November 4, 2025 (the 'Resolution'), authorized Nequi to operate and carry out, throughout Colombia, the activities related to the corporate purpose of a financing company. Nequi will begin operations as a standalone company once all additional procedures required in connection with the process to operate as a financing company have been completed. Notwithstanding this authorization, Nequi will remain part of Grupo Cibest, and, for customers, this development will not represent any change in how they access or use products and services. For more information, see Note 1. Reporting Entity, Agreement for the Sale of Banistmo On December 18, 2025, Grupo Cibest reached an agreement with Inversiones Cuscatlán Centroamérica S.A. for the sale of 100% of the shares of Banistmo. The agreed sale price was USD 1.418 billion, representing a Price/Earnings ratio for the last 12 months as of September 30, 2025, of 17.1x and a Price/Book Value ratio of 1.2x. The purchase price is subject to customary closing adjustments and is to be paid on the closing date of the transaction, once the required regulatory approvals in Panama are obtained and other customary conditions under the sale and purchase agreement are satisfied. As a result, the assets and liabilities of Banistmo were reclassified to 'Assets related to investments in subsidiaries held for sale' and 'Liabilities included in disposal groups classified as held for sale' in the consolidated balance sheet as of December 31, 2025, respectively. In addition, the profit (loss) of these companies was recognized under 'Profit / (loss) from discontinued operations, net in the consolidated income statement for the year ended December 31, 2025. In accordance with IFRS 5, for comparative purposes the profit (loss) of these companies for the years ended December 31, 2024 and 2023 was also reclassified under the heading '(loss) / gain from discontinued operation, net.' In addition, in accordance with IFRS 5, and following IFRS 8 'Information by business segments', information on the Banking Panama segment in which the Discontinued operation is recognized, is provided for the years ended December 31, 2025, 2024 and 2023. For more information, see Note 1. Reporting Entity, Note 2.D.12 Material Accounting Policies - Assets held for sale and discontinued operations and Note 31. Discontinued Operation. Public takeover offers In 2025, and as of the date of this Annual Report, there have been no public takeover offers by third parties for Grupo Cibest's shares or by us for other companies’ shares. Capital acquisitions and divestitures During 2025, total capital expenditures for Cibest Corporate Group amounted to COP 786.3 billion. Such investments were mainly focused on distribution channels and technology assets (COP 687.7 billion) driven by investments in digital transformation and fixed assets (COP 98.6 billion). For 2026, we expect to invest approximately COP 1,066 billion up 36% from 2025, mainly on the evolution and transformation of digital channels. This investment aims to ensure operational continuity, enhance customer experience, and mitigate vulnerabilities and risks across branches and self-service channels. We continue to invest in data management, analytics, and artificial intelligence to design personalization strategies aimed at delivering unique experiences, strengthening customer engagement and loyalty. In parallel, investment in processes and service models for corporate, institutional, and investor clients is being maintained to enhance the value proposition for this segment. The following table summarizes Grupo Cibest’s principal capital acquisitions and divestitures of interests in other companies, for the years ending December 31, 2025, 2024 and 2023: Capital acquisitions(1) Type of investment For the year ended December 31, Total 2025 2024 2023 In millions of COP Purchases of investments Derecho Fiduciario P.A. Selecto E1 T1 Financial instrument 41,138 - - 41,138 Derecho Fiduciario P.A. Selecto E1 T2 Financial instrument 36,234 - - 36,234 Inversión Derecho Fid Mokana Financial instrument 34,000 - - 34,000 Fideicomiso Selecto Terrazu Etapa 1 Torre 1 Subsidiary 15,633 - - 15,633 Fideicomiso Selecto Terrazu Etapa 1 Torre 2 Subsidiary 14,903 - - 14,903 Fideicomiso Mokana Recursos Subsidiary 13,053 - - 13,053 Fideicomiso Lote C6 Carton de Colombia Subsidiary 7,019 - - 7,019 Suncolombia Sas Financial instrument 6,079 - - 6,079 P.A. CEDIS Sodimac Subsidiary - 462,442 - 462,442 FCP Pactia Inmobiliario Financial instrument - 230,674 - 230,674 P.A. Linz Granz del Rio Subsidiary - 6,490 - 6,490 P.A. Coba Joint venture - 5,823 - 5,823 Ozone Financial Technology Limited Financial instrument - 3,908 - 3,908 Fideicomiso Selecto Terrazu E1 Subsidiary - 3,516 - 3,516 P.A. Acelera TI Joint venture - 560 - 560 P.A. Nomad Central Subsidiary - - 106,020 106,020 P.A. Calle 84(2) Subsidiary - - 104,617 104,617 Holding Bursátil Regional S.A.(3) Financial instrument - - 78,139 78,139 P.A. Galería la 33 Subsidiary - - 30,139 30,139 Pexton Holdings Limited Financial instrument - - 3,681 3,681 P.A. Wenia Subsidiary - - 2,210 2,210 Capital acquisitions(1) Type of investment For the year ended December 31, Total 2025 2024 2023 In millions of COP Expenditures Inversiones Cibest S.A.S.(4) Subsidiary 1,063,507 - - 1,063,507 P.A. Nomad Distrito Vera Subsidiary 85,848 31,409 - 117,257 P.A. Nomad Salitre Subsidiary 70,956 52,920 27,930 151,806 P.A. Nomad Nexo Subsidiary 63,696 - - 63,696 P.A Nomad Central 2 Subsidiary 59,290 - - 59,290 Cibest Panama Assets, S.A.(5) Subsidiary 49,044 - - 49,044 Cibest Investment Management S.A.S.(4) Subsidiary 43,500 - - 43,500 Cibest Inversiones Estrategicas S.A.S.(4) Subsidiary 43,500 - - 43,500 Valores Cibest S.A.S.(4) Subsidiary 43,500 - - 43,500 P.A. Lote Palermo Associate 36,984 - - 36,984 Wenia Ltd. Subsidiary 31,629 30,463 61,566 123,658 P.A. Calle 84(2) Subsidiary 28,910 60,760 - 89,670 Wompi S.A.S. Subsidiary 25,000 - 41,000 66,000 Nequi S.A. Subsidiary 20,000 90,000 - 110,000 P.A. Tokenización Novus(5) Subsidiary 7,250 - - 7,250 Veronorte S.A.S. Financial instrument 3,100 - - 3,100 P.A. Muverang Joint venture 3,070 1,952 3,305 8,327 Titularizadora Colombiana S.A. Associate 2,923 - - 2,923 Ecosistemas Digitales S.A.S. Joint venture 2,792 7,015 8,642 18,449 Anthemis Venture Fund Iii Lp Financial instrument 2,079 - - 2,079 P.A Coba Joint venture 1,928 - - 1,928 Bancolombia Capital Holdings USA LLC Subsidiary 1,243 5,386 8,488 15,117 P.A. La Felicidad Associate 1,108 - - 1,108 Internacional Ejecutiva de Aviación S.A.S. Associate 453 3,000 - 3,453 Compañía de Financiamiento Tuya S.A. Joint venture - 76,750 62,500 139,250 Inversiones CFNS S.A.S. Subsidiary - 50,000 - 50,000 P.A. Nomad Central Subsidiary - 40,670 - 40,670 P.A. El Bosque Associate - 25,376 16,665 42,041 P.A. Distrito Vera Associate - 5,188 6,227 11,415 Servicios de Identidad Digital S.A.S. Associate - 2,487 2,433 4,920 P.A. FAI Calle 77 Subsidiary - 826 3,469 4,295 Sistema de Inversiones y Negocios S.A. Subsidiary - - 75,505 75,505 P.A. Mercurio Subsidiary - - 7,833 7,833 P.A. El Otoño Associate - - 8,055 8,055 P.A. Viva Malls Associate - - 3,192 3,192 P.A. Laurel Joint venture - - 3,156 3,156 P.A. Blup Joint venture - - 2,353 2,353 P.A. Mirador de la Ciénaga Associate - - 155 155 Agricapital S.A.S. Associate - - 97 97 Others 1,404 4,168 3,199 8,771 Total acquisitions 1,860,773 1,201,783 670,576 3,733,132 (1)The amounts in this table correspond to the consideration paid as a result of the acquisition of each investment. (2)The amount includes the capital acquisitions in P.A. Calle 84 (2) and P.A. Calle 84 (3). (3)In November 2023, the integration of the stock exchanges of Colombia, Chile, and Peru was perfected, resulting in the creation of the Regional Stock Holding. As a result of this integration, 5,992,160 shares of the Bolsa de Valores de Colombia S.A. were delisted for COP 56,146, and 3,606,223 shares were recognized in the Regional Stock Holding for COP 78,139, this transaction generated an income in results of COP 21,993, see Note 25.5. Dividends and net income on equity investments. Bancolombia retains 134 shares that were not included in this transaction, valued at COP 2. (4)These companies were created in relation to the evolution of the corporate structure of Grupo Cibest and its subsidiaries, completed on May 16, 2025. See Note 1. Reporting Entity and Note 2.C1 Subsidiaries. (5)These companies were created during the year 2025. Capital divestitures(1) Type of investment As of December 31, Total 2025 2024 2023 In millions of COP Sales of investments Fideicomiso Lote Distrito Vera B1B2 Subsidiary 37,150 - - 37,150 P.A. Galería la 33 Subsidiary 26,768 - - 26,768 P.A. Laurel Joint venture 26,492 - - 26,492 Banco Latinoamericano De Comercio Exterior Financial instrument 11,813 - - 11,813 Residual Rights Financial instrument 3,650 18,516 8,958 31,124 Fideicomiso Irrevocable de Garantía, Fuente de Pago y Administración Inmobiliaria Polaris Subsidiary - 51,098 - 51,098 Fideicomiso Lote Distrito Vera B4 Subsidiary - 26,358 - 26,358 Bolsa de Valores de Colombia Financial instrument - - 56,146 56,146 Fideicomiso Lote B6 Ciudad del Río Subsidiary - - 34,031 34,031 Diversitures P.A. El Bosque Associate 7,288 - - 7,288 P.A Mirador de La Ciénaga Associate 4,483 3,053 - 7,536 P.A. Boreal Associate 3,597 520 864 4,981 P.A. El Otoño Associate 2,854 2,894 - 5,748 P.A. Distrito Vera Associate 2,728 - - 2,728 P.A. Sodimac Subsidiary 1,398 - - 1,398 P.A. Madrid II Associate 972 11,278 - 12,250 P.A. La Felicidad Associate - 3,168 3,636 6,804 Banco Latinoamericano de Comercio Exterior Financial instrument - 520 - 520 Others 1,266 954 724 2,944 Total divestitures 130,459 118,359 104,359 353,177 (1)The amounts in this table correspond to the consideration received as a result of the sale of each investment.. B.Business overview B.1General Company description We are a full‑service financial group offering a broad range of financial products and services to a diversified customer base of nearly 33 million individual and corporate clients through our subsidiaries. We deliver our products and services through a regional platform that includes, as of the date of this Annual Report, Colombia’s largest nongovernment banking network, El Salvador’s leading financial conglomerate, Guatemala’s fifth‑largest bank in terms of deposits and loans, and Panama’s second‑largest bank in terms of deposits and loans. The Panamanian bank, Banistmo, is currently classified as a discontinued operation following the execution of a promise‑to‑purchase‑shares agreement with Inversiones Cuscatlán Centroamérica S.A. for the sale of 100% of its shares. Our network also includes offshore banking subsidiaries in Panama and Puerto Rico, as well as other adjacent businesses, which are discussed in further detail in the sections that follow. Main lines of business We manage our subsidiaries' business through seven main operating segments: Banking Colombia, Banking Panama, Banking El Salvador, Banking Guatemala, Leases, International Banking, and All Other. For a description and discussion of these segments, please see Item 5. Operating and Financial Review and Prospects – A. Operating Results – Results by Segment. PRODUCTS AND SERVICES The main products and services offered by Grupo Cibest's operating subsidiaries are listed below. Not all products and services below are offered in every country where Grupo Cibest's subsidiaries operate. Savings and Investment: Checking accounts, savings accounts, fixed-term deposits and a variety of investment products designed to meet the specific transactional needs of each client across different income brackets. Financing: Wide range of credit alternatives, including trade financing, loans funded by domestic development banks, working capital loans, mortgages, credit cards, personal loans, vehicle loans, payroll loans and overdrafts. Factoring: Solutions for managing working capital and maximizing asset turnover through comprehensive solutions to manage accounts receivable financing. Financial and Operating Leases: Financial and operating leases specifically designed for the acquisition of fixed assets. Capital Markets: Assistance in mitigating market risk through hedging instruments such as futures, forwards, options and swaps. Trading: Bancolombia offers an app and an internet-based trading platform for retail and institutional clients, which allows them to buy and sell securities on the Colombian Stock Exchange. Bancolombia also performs interbank lending, repurchase agreements (repos), foreign exchange transactions, as well as sovereign and corporate securities sales and trading. Bancolombia is an active player in the 'market-makers' scheme for trading Colombian sovereign debt (TES bonds). Bancolombia offers its clients direct access to local and international capital markets through a full range of brokerage and investment advisory services that cover equities and fixed-income securities, proprietary trading and third-party asset management products, such as mutual funds, private equity funds, and privately managed investment accounts for institutional, corporate and private bank clients. Cash Management: Support through cash management services, including a portfolio of standard products that allows clients to make payments and collections through different channels. Payables and receivables services. Design and creation of products to address clients’ specific payment and collection needs. These include a variety of real time web services, straight-through processing (STP) and messaging through SWIFT Net solutions. Foreign Currency and Trade Finance: Specialized solutions for clients’ foreign currency investment, financing and payment needs, as well as trade finance solutions with products such as letters of credit, standby letters of credit and bills collection. Bancassurance and Insurance: Bancolombia distributes a diverse range of insurance products (life, health, agriculture, pets, debtors, and homeowner's insurance) written by Seguros Generales Suramericana S.A. and Seguros de Vida Suramericana S.A., two of the main insurance companies in Colombia. In addition, Bancolombia offers unemployment and theft insurance written by Cardif Colombia Seguros Generales S.A. Bancoagrícola and Bam offer voluntary and credit‑related insurance products across life, property, fraud, unemployment, and other general insurance lines. These products are part of their value proposition and are distributed through their own channels under a partnership model with reputable insurance companies. In the case of Bancoagrícola, policies are underwritten by Asesuisa and Assa. Bam, meanwhile, operates through its affiliated insurer, Seguros Agromercantil. Investment Banking: Bancolombia's through its subsidiary, Banca de Inversión Bancolombia, offers a wide variety of value-added services, including structuring of leverage finance (project finance, acquisitions, and large corporate loans), loan syndication, debt and equity capital markets, principal investments (in alternative assets), mergers and acquisitions (M&A), hedging strategy advisory, restructurings, across multiple economic sectors, with coverage in Colombia and Central America. Trust and Fiduciary Services: Bancolombia, through its subsidiary Fiduciaria Bancolombia, offers a broad portfolio of services tailored for companies and individuals. These services include managing escrow accounts, multiple investment funds, and real estate funds. Bancoagrícola also offers trust services and has a 94% share of the private trust market. The service is aimed at both individuals and businesses, offering different types of trusts, such as investment trusts, payment source trusts, and guarantee trusts, among others. Nequi (Digital): Nequi is a fully digital business line focused on financial inclusion, everyday transactions, and intensive use of technology, with the purpose of improving people’s financial management and meeting customers’ financial needs. Users interact with Nequi through a mobile application and fully digital processes, without paperwork or physical branches. Nequi offers a wide range of products, including: savings accounts, physical and virtual debit cards, loans, the ability to receive remittances, PayPal integration, and both proprietary and third-party financial services such as utility bill payments, mobility top-ups, and entertainment. NEW PRODUCTS AND SERVICES Below is a brief description of the new products and services that the operating subsidiaries of Grupo Cibest introduced in 2025: Bre-B: Colombia's new instant and interoperable payment system, powered by the Central Bank was launched in 2025, and Bancolombia now offers connection to Bre-B. This platform connects banks, cooperatives, and fintechs into a single network, allowing Colombians to send and receive money between different banks and entities in seconds, with 24/7 availability. Transfers within the Bre-B system are carried out using 'keys,' eliminating the need to share traditional banking information. The new system strengthens security and standardizes inter-institutional payments. By the end of December 2025, more than 96 million keys were registered with the Central Bank of Colombia, corresponding to 33 million clients. Cibest Corporate Group and its customers hold 51 million registered keys through Bancolombia and Nequi, representing 53% of the Bre-B system. Mortgage Lending Business as a Driver of Customer Preference: Our Subsidiaries have strengthened their relationship with payroll clients through differentiated pricing experiences, enabling them access competitive financing options. Additionally, they promote housing financing through proactive approvals under the Payroll-Based Secured Sale model (Venta Cierta Nóminas), reaffirming Cibest Corporate Group commitment to closeness, operational agility, and the financial well-being of our users. This initiative represents a strategic partnership with companies that have payroll agreements with Bancolombia, strengthening ties with the country’s business sector and contributing to the development of the real estate ecosystem. Payments Through Wompi in the Real Estate Sector: Bancolombia integrated Wompi as a new payment channel in both the Online Business Branch and the Online Personal Branch. This significantly improves customer experience through faster, modern, and accessible payment solutions, facilitating efficient product management in the real estate sector. Inflation-Indexed Sustainability Loans: Grupo Cibest's subsidiaries offer new inflation-indexed corporate loans promote sustainable infrastructure. The loans are indexed to the Real Value Unit (UVR), an index that is based on the Consumer Price Index, reflecting the purchasing power of the Colombian peso. The loans offer a 100 basis point benefit to the borrower. Salud para ti: Grupo Cibest's subsidiaries offer a health insurance policy that allows clients and their families to access medical services including general practitioner and specialist consultations, laboratory tests, reimbursement for medications prescribed under the plan, and a hospital care allowance, among other benefits. The services provided are timely, accessible and reliable. The product was initially launched through Sura Telesales and, as of October 21, 2025, is also available at our branches and through our commercial teams. Use of AI We are developing a corporate strategy focused on data, analytics and machine-learning-based AI. We aim to build organization-wide capabilities and foster the adoption of AI across business units. The main objective is to enhance decision-making and develop new products and services, strengthening our competitive advantage. We are focusing our efforts on ensuring that business units with the greatest potential impact on our results adopt best practices for AI use and risk mitigation. As of the date of this Annual Report, we have started to use machine learning within Cibest Corporate Group but do not currently use generative AI with customers, however we plan to initiate AI consumer use in 2026. Further details on the various risks to which we are exposed in connection with the use of artificial intelligence are discussed in Item 3.D. Risk Factors. B.2Operations See Note 3 to the Consolidated Financial Statements included in this Annual Report for a description of the principal markets in which we compete, including a breakdown of total interest and valuation income by category of activity and geographic market for each of the last three fiscal years. B.3Seasonality of deposits Bancolombia, our main operating subsidiary, has historically experienced some seasonality in demand deposits, with lower average balances during the first months of the year and higher average balances at the end of the year. This behavior is explained primarily by the increased liquidity provided by the Central Bank and the Colombian National Treasury at year end, as economic activity tends to be higher during this period, resulting in a greater number of transactions. During 2025, monetary conditions in Colombia contributed to the seasonal pattern of Bancolombia's deposits. In the first half of the year, the Central Bank lowered its benchmark rate as inflation declined, supporting stable liquidity but not altering the usual slowdown in deposit growth. In the second half, inflation increased and the policy rate stabilized. Credit demand remained moderate, and deposits followed their typical year‑end increase. These factors, together with the seasonal behavior of deposits, resulted in excess liquidity during the year. However, we do not consider the seasonality of demand deposits to have a significant impact on our business, since any excess or shortage of liquidity has been managed through the treasury portfolio. B.4Raw materials We are not dependent on sources or availability of raw materials. B.5DISTRIBUTION NETWORK We provide our products and services through a traditional branch network, sales and customer representatives, as well as through mobile branches (Puntos de Atención Móviles), an ATM network, online and computer banking, telephone banking, mobile phone banking services, and points of sale (Puntos de Atención Cercano), among others. In Colombia, transactions performed through electronic channels represented more than 94.80% of all transactions in 2025, compared to 95.74% of all transactions in 2024. The following are the distribution channels offered by Cibest Corporate Group as of December 31, 2025: Branch Network1 As of December 31, 2025, our consolidated branch network consisted of 912 offices, including 564 Bancolombia offices, 37 Renting Colombia offices, 93 Bancoagrícola offices, 37 Banistmo offices, 142 Bam offices and 39 offices of other subsidiaries. Number of branches 2025 Number of branches 2024 Number of branches 2023 Company (1) Bancolombia (Colombia) 564 575 578 Bam (Guatemala) 142 151 155 Renting Colombia (2) 37 37 63 Bancoagrícola 93 91 91 Banistmo 37 37 39 Valores Bancolombia 17 17 19 Fiduciaria Bancolombia 8 8 8 Financomer 1 1 3 SUFI 1 2 2 Inversiones CFNS S.A.S. 2 2 2 Banca de Inversión 2 2 2 Bancolombia Panamá 1 1 1 Bancolombia S.A Panamá Branch 1 1 1 Cibest Capital Panamá S.A. 1 1 1 Bancolombia Puerto Rico International Inc. 1 1 1 Arrendadora Financiera S.A. 1 1 1 Valores Banagricola, S.A. de C.V. 2 1 1 Cibest Capital Holdings USA LLC 1 1 1 Total 912 930 969 (1)For some subsidiaries, the main office is considered a branch. 13 Localiza and 13 Puntos Éxito were closed Banking Correspondents A banking correspondent is a platform that allows nonfinancial institutions, such as retail stores that are open to the public, to provide financial services and transactions in locations where banks and financial institutions have limited or no presence. As of December 31, 2025, we had 37,045 banking correspondents, including 28,640 in Colombia, 395 in Panama, 6,168 in Guatemala and 1,842 in El Salvador, of which 955 are outsourced banking correspondents. Puntos de Atención Móviles (PAMs) PAMs are commercial advisors who visit small towns periodically to offer our products and services. As of December 31, 2025, there were 486 PAMs (458 in Colombia, 10 in Guatemala and 18 in El Salvador). Panama has no PAMs. Kiosks Kiosks are located inside our branches, in malls and in other public places and allow our clients to conduct a variety of self-service transactions. As of December 31, 2025, there were a total of 500 kiosks, 213 in El Salvador and 287 in Colombia. Panama and Guatemala have no kiosks. 1 ATMs We have a total of 6,149 ATMs, including 5,212 in Colombia, 599 in El Salvador and 338 in Panama. Bam sold its Guatemalan ATM network (155 ATMs) to 5B in November 2023 and outsources ATM services to 5B. Online/Computer Banking We offer multiple online and computer-based banking alternatives designed to fit the specific needs of our different client segments. Through a variety of platforms (computer and internet-based solutions) our clients can review their account balances and monitor transactions in their deposit accounts, loans and credit cards, make virtual term investments, access funds from pre-approved loans, make payroll and supplier payments, make purchases and bill payments, negotiate stocks, learn about products and services and complete other transactions in real time. Telephone Banking We provide customized and convenient advisory services to customers of all segments through automatic interactive voice response (IVR) operations and a 24/7 contact center. Mobile Banking Service Our clients can conduct a variety of transactions using their mobile phones, including fund transfers between Bancolombia accounts, account balance inquiries, QR code payments and payment of bills and invoices. Business Connections Banking Service Business Connections is a differentiating feature of Bancolombia's product line. It consists of a direct connection between Bancolombia's servers and the client, allowing transactions and document exchange to take place, supplementing our cash management and factoring products. It offers a secure and efficient option for clients to handle their funds, particularly their cash management needs. B.6Patents, licenses and contracts We are not dependent on patents or licenses, nor is it substantially dependent on any industrial, commercial or financial contracts (including contracts with customers or suppliers). However, we have entered into contracts with third parties who provide certain services that are important to our business. These services include core banking services, online banking platforms, data processing and payment services, clearing and settlement services, software for processing credit and debit card services, and technological infrastructure, including cloud services where our data will be stored, among others. B.7Competition The competition faced by Grupo Cibest depends primarily on the markets in which its respective subsidiaries operate. In particular, a relevant portion of said subsidiaries carries out their activities within the financial system of the countries and jurisdictions in which we have a presence. The competition of Grupo Cibest is described below: Colombian financial system description Overview The recent history of Colombia’s banking sector is marked by consolidation and internationalization. A series of major bank mergers and acquisitions took place in 2013, with Bancolombia and Grupo Aval both acting as active participants, while several foreign banks entered the market the same year, increasing competition. New financial entities entered the market in 2014, while Corpbanca acquired Helm Bank and GNB Sudameris acquired nearly all of HSBC Colombia, expanding into Paraguay, Peru, and Uruguay. Further consolidation occurred in 2015, including the merger of Chile’s CorpBanca with Brazil’s Itaú, while Bancolombia sold 50% of its shares in Tuya to Grupo Éxito and bought a stake in Guatemala’s Grupo Agromercantil, taking full ownership in 2020. Several banks underwent transitions in 2015, including Serfinanza, a commercial financing company that become the 26th bank in the financial system in February 2015. In 2020 four financing companies went through changes in their shareholder structures: in January, Credifinanciera acquired Procredit Bank, rebranding as Banco Credifinanciera; that April, Coltefinanciera acquired the rights and obligations of Multibank, which ceased to act as a bank; in August, Leasing Bancoldex merged with Arco Bancoldex; and, in November, Pagos Internacional was acquired by Banco W. In 2021, Lulo Bank became the first digital bank in Colombia, and in December of that year insurance brokerage BTG Pactual became the 28th bank in the financial system. In 2022 commercial financing company Banco Unión, previously called Giros y Finanzas, became the 29th bank in the financial system, and microfinancing company Banco Contactar became the 30th bank in the financial system in 2024. Nubank began operations as a financing company in 2024, offering savings accounts at the beginning of the year and expanding into consumer loans and term deposits by the end of the year. In 2025, Banco Davivienda gave notice of its intention to integrate with Scotiabank Colpatria by 2026, with Scotiabank Colpatria transferring all its loans and deposits to Banco Davivienda and taking a 20% stake in the combined entity. The alliance will create the second-largest bank in Colombia and significantly enhance Banco Davivienda’s presence in Central America. It is expected to leverage Banco Davivienda's scale to offer wealth management, corporate banking, investment advisory and other services. The SFC approved operating licenses for other digital players in 2025, such as Cobre, Revolut, and Nequi, which are expected to begin operations in 2026. As of December 31, 2025, according to the SFC, the main participants in the Colombian financial system were 30 commercial banks (19 domestic private banks, 10 foreign banks, and one domestic state-owned bank), six financial corporations and 15 financing companies. In addition, trust companies, cooperatives, insurance companies, insurance brokerages and securities intermediaries, special state-owned institutions, and severance payments and pension funds also participate in the Colombian financial system. Evolution of market and credit institutions in 2025 Loan growth at Colombian credit institutions was 8.2% in 2025, compared with 3.4% in 2024. Commercial loans grew by 6.2% in 2025, compared with 5.8% the previous year. Consumer loans increased 6.8% in 2025, compared with a decrease of 3.2% in 2024. Mortgage loans increased 14.6% in 2025, compared to 8.0% in 2024, and small business loans grew 12% in 2025 compared with 8.5% in 2024. The credit institutions' level of past-due loans, as a percentage of the total loan portfolio, stood at 3.8% in December 2025, down from 4.7% in December 2024. In addition, the coverage ratio – measured as the ratio of allowances for loan losses (principal) to past-due loans (over 30 days) – ended 2025 at 143.4%, compared with 129.2% at the end of 2024. In December 2025, the loan portfolio represented 62.4% of total assets, slightly higher than the 61.8% recorded the previous year. Investments and derivative transactions, as a percentage of total assets, remained at 23.3% at the end of 2025, the same level as at the end of 2024. Deposits also increased as a percentage of total liabilities, reaching 76% in 2025 compared with 75.4% in 2024. Credit institutions recorded COP 1.135 trillion in total assets on December 2025, a 7.1% increase from the previous year. Based on total assets held by Colombian credit institutions, banks had a market share of 93.9%, followed by financial corporations with 3.1%, financing companies with 2.5%, and financial cooperatives with 0.5%. The capital adequacy ratio (Tier 1 + Tier 2) for credit institutions was 17.8% in December 2025 (including banks, financial corporations, financing companies and financial cooperatives), which is above the minimum legal requirement of 9% pursuant to Decree 1477 of 2018. Bancolombia and its competitors The following table shows a comparison between the key profitability, capital adequacy and loan portfolio quality indicators for Bancolombia and its main competitors, unconsolidated, based on IFRS information as applicable under Colombian regulations and published by the SFC. ROE(1) ROA(2) Past-due loans/ Total loans Allowances/Past-due loans Capital Adequacy Dic-25 Dec-24 Dic-25 Dec-24 Dic-25 Dec-24 Dic-25 Dec-24 Dic-25 Dec-24 Bancolombia 24.7 % 13.2 % 2.4 % 2.1 % 3.5 % 4.4 % 176.5 % 158.0 % 14.4 % 18.5 % Banco de Bogotá 7.6 % 7.0 % 0.9 % 0.9 % 3.8 % 4.4 % 119.2 % 107.5 % 18.1 % 18.8 % Davivienda 12.2 % 5.8 % 1.2 % 0.6 % 4.4 % 5.5 % 121.2 % 112.4 % 18.9 % 18.6 % BBVA 6.5 % (5.6 %) 0.4 % (0.4 %) 3.5 % 4.6 % 148.2 % 128.0 % 13.4 % 13.1 % Banco de Occidente 9.4 % 9.0 % 0.6 % 0.7 % 3.2 % 3.3 % 144.5 % 144.1 % 12.5 % 12.7 % Itaú Corpbanca 1.4 % 2.4 % 0.1 % 0.3 % 4.0 % 4.5 % 124.6 % 123.5 % 16.6 % 16.3 % Scotiabank Colpatria (0.9) % (5.9) % (0.1) % (0.4) % 4.1 % 5.0 % 135.2 % 119.0 % 11.5 % 11.7 % Source: SFC. (1)ROE is return on average stockholders’ equity. (2)ROA is return on average assets The following tables illustrate the market share of Bancolombia and its main competitors, on an unconsolidated basis, with respect to various key products, based on figures published by the SFC for 2025 and 2024: Total Net Loans Market Share Total Net Loans – Market Share (%) 2025 2024 Bancolombia 27.6 % 27.2 % Davivienda 16.0 % 15.6 % Banco de Bogotá 12.8 % 12.9 % BBVA 10.8 % 11.0 % Banco de Occidente 7.1 % 7.3 % Scotiabank Colpatria 4.0 % 4.0 % Itaú Corpbanca 2.5 % 2.7 % Others(1) 19.2 % 19.3 % Source: Ratios are calculated by Bancolombia based on figures published by the SFC. (1)Nubank was registered as financial company so is not included in others Checking Accounts Market Share Checking Accounts – Market Share (%) 2025 2024 Bancolombia 26.4 % 27.4 % Banco de Bogotá 17.1 % 18.1 % Davivienda 12.2 % 11.0 % BBVA 10.6 % 10.3 % Banco de Occidente 8.8 % 8.7 % Itaú Corpbanca 2.3 % 2.3 % Scotiabank Colpatria 2.3 % 2.5 % Others(1) 20.3 % 19.7 % Source: Ratios are calculated by Bancolombia based on figures published by the SFC. (1)Nubank was registered as financial company so is not included in others Time Deposits Market Share Time Deposits – Market Share (%) 2025 2024 Bancolombia 22.2 % 22.2 % Davivienda 16.8 % 17.9 % Banco de Bogotá 14.8 % 13.9 % BBVA 12.6 % 13.1 % Scotiabank Colpatria 5.1 % 4.6 % Banco de Occidente 5.2 % 4.7 % Itaú Corpbanca 3.0 % 3.2 % Others(1) 20.2 % 20.4 % Source: Ratios are calculated by Bancolombia based on figures published by the SFC. (1)Nubank was registered as financial company so is not included in others Saving Accounts Market Share Saving Accounts – Market Share (%) 2025 2024 Bancolombia 31.8 % 30.7 % Davivienda 12.7 % 12.5 % Banco de Bogotá 10.4 % 10.8 % BBVA 9.8 % 10.4 % Banco de Occidente 9.0 % 9.1 % Scotiabank Colpatria 3.2 % 3.5 % Itaú Corpbanca 1.8 % 1.8 % Others(1) 21.3 % 21.2 % Source: Ratios are calculated by Bancolombia based on figures published by the SFC. (1)Nubank was registered as financial company so is not included in others Bancoagrícola and its competitors In 2025, Bancoagrícola continued to lead the Salvadoran financial system and ranked first in terms of total assets, loans, total deposits, stockholders’ equity and profits. The information presented in the following tables shows Bancoagrícola and its competitors on a stand-alone basis and was prepared based on publicly available information from the Financial System Superintendency (SSF), in accordance with Salvadoran accounting standards. The following table illustrates the market share for the main institutions of the Salvadoran financial system as of December 31, 2025: Assets Stockholders’ Equity Loans Deposits Profits Banco Agrícola 24.4% 23.5% 24.8% 25.6% 39.5% Cuscatlán 17.0% 17.2% 17.4% 17.6% 18.1% Davivienda 13.1% 13.5% 14.3% 13.1% 8.3% BAC 14.1% 13.9% 15.5% 14.5% 10.3% Hipotecario 8.4% 8.3% 5.7% 7.4% 8.1% Promérica 5.5% 4.2% 5.6% 5.5% 2.6% Otros 17.5% 19.4% 16.7% 16.3% 13.1% Source: SSF (Superintendencia del Sistema Financiero) The following tables illustrate the market share of Bancoagrícola and its main competitors, based on figures published by the Financial System Superintendency (SSF), as of December 31, 2025 and 2024: Total Loans Market Share Total Loans – market Share (%) 2025 2024 Banco Agrícola 24.8% 24.2% Cuscatlán 17.4% 17.9% Davivienda 14.3% 14.2% BAC 15.5% 15.6% Hipotecario 5.7% 6.2% Promérica 5.6% 5.7% Otros(1) 16.7% 16.2% (1) In 2024, Sociedad de Ahorro y Crédito Apoyo Integral, S.A. became the thirteenth bank in El Salvador's Financial System, now known as Banco Apoyo Integral. Checking and Saving Accounts Market Share Checking and Saving Accounts – Market Share (%) 2025 2024 Banco Agrícola 30.7% 31.3% Cuscatlán 19.0% 18.7% Davivienda 12.4% 12.6% BAC 15.5% 15.6% Hipotecario 6.1% 6.0% Promérica 4.8% 5.0% Otros(1) 11.5% 10.8% (1) In 2024, Sociedad de Ahorro y Crédito Apoyo Integral, S.A. became the thirteenth bank in El Salvador's Financial System, now known as Banco Apoyo Integral. Time Deposits Market Share Time Deposits – Market Share (%) 2025 2024 Banco Agrícola 16.8% 15.1% Cuscatlán 15.2% 15.0% Davivienda 14.4% 15.2% BAC 12.7% 14.2% Hipotecario 9.7% 12.0% Promérica 6.5% 7.2% Otros(1) 24.7% 21.3% (1) In 2024, Sociedad de Ahorro y Crédito Apoyo Integral, S.A. became the thirteenth bank in El Salvador's Financial System, now known as Banco Apoyo Integral. Banistmo and its competitors Banistmo (discontinued operation) is one of Panama’s leading banks, the second-largest bank in terms of balance sheet (total assets plus total liabilities), and the third-largest in terms of its loan portfolio, with a market share of 7.9%. The following table illustrates the market share of the main institutions in the Panamanian financial system as of December 31, 2025. MARKET SHARE Assets Equity Loans Deposits Profits Banistmo 7.3 % 7.0 % 7.9 % 9.2 % 4.5 % Banco General 13.3 % 11.0 % 13.3 % 19.5 % 24.7 % Global Bank 6.4 % 5.0 % 7.1 % 7.2 % 1.9 % Banesco 4.1 % 2.7 % 4.3 % 5.9 % 2.3 % BAC 9.1 % 25.6 % 6.6 % 8.3 % 29.4 % Others 59.8 % 48.7 % 60.8 % 49.9 % 37.2 % Source: Banistmo based on data by SBP (Superintendency of Banks of Panama) The following tables illustrate the market share of Banistmo and its main competitors, based on figures published by the Superintendency of Banks of Panama, as of December 31, 2025, and December 31, 2024: Total Loans Market Share Total Loans - Market Share (%) 2025 2024 Banistmo 7.9 % 8.3 % Banco General 13.3 % 13.1 % Global Bank 7.1 % 6.9 % Banesco 4.3 % 4.4 % BAC 6.6 % 6.2 % Others 60.8 % 61.1 % Source: Banistmo based on data by SBP (Superintendency of Banks of Panama) Saving Accounts Market Share Saving Account - Market Share (%) 2025 2024 Banistmo 9.7 % 10.2 % Banco General 28.4 % 29.1 % Global Bank 7.1 % 7.4 % Banesco 6.8 % 7.4 % BAC 5.1 % 5.2 % Others 42.9 % 40.7 % Source: Banistmo based on data by SBP (Superintendency of Banks of Panama) Checking Accounts Market Share Checking Accounts - Market Share (%) 2025 2024 Banistmo 8.3 % 9.0 % Banco General 24.0 % 23.2 % Global Bank 3.5 % 3.8 % Banesco 10.1 % 10.0 % BAC 12.3 % 11.1 % Others 41.8 % 42.9 % Source: Banistmo based on data by SBP (Superintendency of Banks of Panama) Time Deposits Market Share Time Deposits - Market Share (%) 2025 2024 Banistmo 9.3 % 10.0 % Banco General 15.0 % 14.9 % Global Bank 8.2 % 8.3 % Banesco 4.4 % 4.4 % BAC 8.3 % 9.7 % Others 54.8 % 52.7 % Source: Banistmo based on data by SBP (Superintendency of Banks of Panama) Bam and its competitors Bam is the fifth-largest bank in the banking system in Guatemala, measured by total assets, deposits and net loans, and the sixth in terms of stockholders’ equity. As of December 31, 2025, the Bank Superintendency of Guatemala (SIB) has 19 banking entities under its supervision and inspection. The information presented in the following tables was prepared in accordance with Guatemalan banking regulations, as reported to the SIB. The following table illustrates the market share for the main institutions of the banking system at the end of 2025: MARKET SHARE Assets Stockholders’ Equity Net Loans Deposits Profits Banco Agromercantíl 7.5 % 6.2 % 9.3 % 7.6 % 1.2 % Banco Industrial 28.8 % 22.8 % 28.6 % 26.6 % 25.2 % Banrural 22.3 % 24.8 % 17.4 % 24.1 % 35.2 % Banco G&T Continental 12.0 % 10.9 % 11.5 % 12.0 % 11.3 % BAC-Reformador 7.7 % 7.7 % 9.8 % 7.8 % 6.5 % Bantrab 7.1 % 11.6 % 8.0 % 7.3 % 7.9 % Banco Promerica 5.3 % 5.3 % 6.7 % 5.3 % 4.9 % Others(1) 9.3 % 10.7 % 8.7 % 9.3 % 7.8 % (1) Others . Includes the following banks: Internacional, Crédito Hipotecario Nacional, Ficohsa, Azteca, Cuscatlán, De Antigua, Vivibanco, Citibank, N.A. de Guatemala, Inv, Credicorp, Nexa and Multimoney. Source: Bank Superintendency of Guatemala (SIB). The following tables illustrate the market share of Bam on a standalone basis and its main competitors, based on figures published by the SIB, under Guatemalan banking regulations, as of December 31, 2025, and 2024: Net Loans Market Share Net Loans - Market Share (%) 2025 2024 Banco Agromercantil 9.3 % 10.0 % Banco Industrial 28.6 % 29.2 % Banrural 17.4 % 16.3 % Banco G&T Continental 11.5 % 11.2 % BAC-Reformador 9.8 % 9.9 % Bantrab 8.0 % 8.2 % Banco Promerica 6.7 % 7.0 % Others(1) 8.7 % 8.2 % (1) Others . Includes the following banks: Internacional, Crédito Hipotecario Nacional, Ficohsa, Azteca, Cuscatlán, De Antigua, Vivibanco, Citibank, N.A. de Guatemala, Inv, Credicorp, Nexa and Multimoney. Source: Bank Superintendency of Guatemala (SIB). Checking Accounts Market Share Checking Accounts - Market Share (%) 2025 2024 Banco Agromercantil 5.4 % 5.9 % Banco Industrial 34.0 % 33.9 % Banrural 24.7 % 24.0 % Banco G&T Continental 12.0 % 12.1 % BAC-Reformador 10.9 % 11.0 % Banco Promerica 3.4 % 3.5 % Bantrab 1.9 % 2.1 % Others(1) 7.7 % 7.5 % (1) Others . Includes the following banks: Internacional, Crédito Hipotecario Nacional, Ficohsa, Azteca, Cuscatlán, De Antigua, Vivibanco, Citibank, N.A. de Guatemala, Inv, Credicorp, Nexa and Multimoney. Source: Bank Superintendency of Guatemala (SIB). Time Deposits Market Share Time Deposits - Market Share (%) 2025 2024 Banco Agromercantil 8.0 % 8.7 % Banco Industrial 23.6 % 23.1 % Banrural 17.7 % 16.5 % Bantrab 12.9 % 13.7 % Banco Promerica 9.3 % 9.4 % Banco G&T Continental 8.9 % 8.8 % BAC-Reformador 6.7 % 8.2 % Others(1) 12.9 % 11.6 % (1) Others . Includes the following banks: Internacional, Crédito Hipotecario Nacional, Ficohsa, Azteca, Cuscatlán, De Antigua, Vivibanco, Citibank, N.A. de Guatemala, Inv, Credicorp, Nexa and Multimoney. Source: Bank Superintendency of Guatemala (SIB). Saving Accounts Market Share Saving Accounts - Market Share (%) 2025 2024 Banco Agromercantil 9.7 % 9.3 % Banrural 31.7 % 30.2 % Banco Industrial 21.7 % 23.2 % Banco G&T Continental 16.0 % 16.8 % Bantrab 6.5 % 6.1 % BAC-Reformador 5.6 % 5.9 % Banco Promerica 2.3 % 2.4 % Others(1) 6.5 % 6.1 % (1) Others . Includes the following banks: Internacional, Crédito Hipotecario Nacional, Ficohsa, Azteca, Cuscatlán, De Antigua, Vivibanco, Citibank, N.A. de Guatemala, Inv, Credicorp, Nexa and Multimoney. Source: Bank Superintendency of Guatemala (SIB). B.8Supervision and regulation Grupo Cibest, as an issuer of securities listed on the Colombian Stock Exchange (Bolsa de Valores de Colombia, or BVC) and registered in the Colombian National Registry of Securities and Issuers (Registro Nacional de Valores y Emisores, or RNVE), is under the exclusive control of the SFC in Colombia pursuant to Law 964 of 2005, Decree 2555 of 2010, External Circular 6 of 2025 (the SFC’s Basic Legal Circular) and External Circular 100 of 1995 (the SFC’s Basic Accounting and Financial Circular). The regulatory framework that governs Grupo Cibest is based mainly on general commercial laws, such as the Colombian Commercial Code and Law 222 of 1995, as well as specific regulations governing securities issuers, including Law 964 of 2005, Decree 2555 of 2010, and SFC regulations. The SFC’s oversight includes verifying compliance with all Colombian laws related to corporate governance for issuers. This encompasses, among other things, the disclosure of material information to the market, submission of periodic reports to both the SFC and the market, and adherence to minimum corporate governance standards. In addition, under External Circular 6 of 2025 , Grupo Cibest must implement and maintain a comprehensive Anti-Money Laundering and Counter-Terrorism Financing system (Sistema Integral para la Prevención y Control de Lavado de Activos y de la Financiación del Terrorismo – SIPLA), which includes policies, procedures, and internal controls to prevent, detect, and report activities related to money laundering and terrorism financing, in compliance with Colombian regulations and international standards. Pursuant to Law 1870 of 2017, Grupo Cibest is part of the financial conglomerate defined as the Sura-Bancolombia Financial Conglomerate. This conglomerate includes all supervised entities in Colombia, intermediate holding companies, and foreign financial entities of Sura and Bancolombia. Consequently, Grupo Cibest is subject to cross-border consolidated supervision based on four pillars: (i) integrated risk management, (ii) prudential requirements, (iii) cooperation and information exchange, and (iv) protocols for cross-border investment management. While Grupo Cibest is regulated primarily as an registered issuer listed on the BVC and subject to the SFC’s exclusive control in that capacity, our business is also influenced by the regulatory framework applicable to our Subsidiaries, which are described below. Colombia Bancolombia is our main operating subsidiary and a Colombian credit institution supervised by the SFC. In practice, many regulatory requirements applicable at the level of Bancolombia, particularly those related to solvency and capital buffers, liquidity standards, large exposures and related‑party limits, enterprise risk management, cybersecurity and consumer protection, can affect Grupo Cibest on a consolidated basis. Colombian banking regulators The Colombian Constitution grants the Congress of Colombia the power to prescribe the general legal framework of the financial system, and the Government issues regulations within that framework. Multiple agencies have the authority to regulate the financial system, including the board of directors of the Central Bank, the Ministry of Finance and Public Credit (the Ministry of Finance), the SFC, the SIC and the Self-Regulatory Organization (Autoregulador del Mercado de Valores or AMV). Regulatory framework for Colombian banking institutions The basic regulatory framework of the Colombian financial sector is described below. Decree 663 of 1993, as amended, defines the structure of the Colombian financial system and establishes the permitted forms of business entities and their authorized activities. Furthermore, Decree 663 of 1993 sets forth (i) licensing requirements, (ii) the procedure applicable for mergers and acquisitions, spin-offs, and other corporate reorganizations of the aforementioned entities, (iii) specific regulations that apply to the issuance and sale of shares and other securities by such entities, and (iv) certain rules regarding the activities of officers and directors of such institutions, among others. Decree 2555 of 2010 contains regulations regarding banking, insurance and securities market activities, capital adequacy requirements, financial institutions’ corporate governance and principles relating to the determination, dissemination and publication of rates and prices of products and financial services, lending activities and resolution procedures. External Circular 6 of 2025 and External Circular 100 of 1995 contain the rules and regulations issued by the SFC that apply to financial institutions and other entities under its supervision and control. Financial institutions are subject to further rules if they engage in additional activities. Law 964 of 2005 regulates securities activities, which banks may undertake, and securities issuers. External Resolution 1 of 2018 (foreign exchange regulations), and External Resolution 4 of 2006 issued by the board of directors of the Central Bank, define the different activities that banks, including Bancolombia, may perform as foreign exchange market intermediaries, including lending in foreign currencies and investing in foreign securities. Violations of any of the above statutes and their relevant regulations are subject to administrative sanctions and, in some cases, criminal sanctions. Interest rates Article 884 of the Colombian Commercial Code provides for a limit on the amount of interest that may be charged in commercial transactions. The limit is 1.5 times the current banking interest rate (interés bancario corriente, or IBC), certified and calculated by the SFC as the weighted average rate of interest ordinarily charged by banks for loans made during a specified period. The certification process is carried out for the following credit portfolios: consumer and ordinary; small loans; and microcredit (which is further divided into five subcategories). As of December 31, 2025, the maximum banking lending rates certified by the SFC for the credit portfolios are: (i) 24.36% for consumer and ordinary loans; (ii) 68.85% for small loans; and (iii) between 27.98% and 89.75% for the five remaining microcredit subcategory rates. Capital adequacy requirements – Basel III Capital adequacy requirements for Colombian financial institutions (set forth in Decree 2555 of 2010, as amended) are based on most of the Basel III standards. This regulation provides for a gradual implementation plan beginning in 2021 and ending in 2024 for requirements regarding solvency ratios and capital buffers. The SFC issued External Circular 020 of 2019, which sets capital adequacy requirements for credit institutions and requirements for reporting information to the SFC. Some of the highlights of this regulation are as follows: The regulatory capital (patrimonio técnico) is calculated as the sum of the Common Equity Tier 1 Capital (patrimonio básico ordinario), the Additional Tier 1 Capital (patrimonio básico adicional) and the Tier 2 Capital (patrimonio adicional). Revised criteria for debt and equity instruments to be considered Common Equity Tier 1 Capital, Additional Tier 1 Capital, and Tier 2 Capital were established. In addition, the SFC reviews whether a given instrument adequately complies with the applicable criteria in order for an instrument to be considered Tier 1 Capital or Tier 2 Capital, upon request of the issuer. Debt and equity instruments that have not been classified by the SFC as Tier 1 Capital or Tier 2 Capital shall not be considered Tier 1 Capital or Tier 2 Capital for the purposes of capital adequacy requirements. The Capital Adequacy Ratio is set at a minimum of 9% of the financial institution’s total risk-weighted assets. However, each entity must comply with: (i) a minimum basic solvency ratio of 4.5% (which is defined as the ordinary basic capital after deductions divided by the financial institution’s total risk-weighted assets and off-balance sheet items); (ii) a minimum additional basic solvency ratio (which is defined as the sum of Common Equity Tier 1 Capital after deductions and Additional Tier 1 Capital, divided by the financial institution’s total risk-weighted assets and off-balance-sheet items) of 4.875%, which began on January 1, 2021, increasing gradually to 6% by January 1, 2024; (iii) a capital conservation buffer (which is defined as the Common Equity Tier 1 Capital after deductions divided by the financial institution’s total risk-weighted assets and off-balance-sheet items) of 0.375% starting on January 1, 2021, increasing gradually to 1.5% by January 1, 2024; (iv) a systemically important institution buffer (which is defined as the Common Equity Tier 1 after deductions divided by the financial institution’s total risk-weighted assets and off-balance-sheet items) of 0.25% starting on January 1, 2021, increasing gradually to 1% on January 1, 2024 (Bancolombia has been recognized by the SFC as a domestic systemically important institution in Colombia); and (v) a combined buffer equivalent to the sum of the aforementioned buffers as of January 1, 2024. These ratios apply to credit institutions individually and on a consolidated basis. Credit establishments must comply with a minimum leverage ratio of 3%, which is defined as the sum of the Common Equity Tier 1 Capital after deductions and the Additional Tier 1 Capital, divided by the leverage value. The leverage value is the sum of all net assets, the net exposures in all repo, simultaneous transactions and temporary transfer of securities, the credit exposures in all derivative instruments, and the exposure value of all contingencies. Credit establishments must comply with minimum capital requirements for operational risk. This new capital requirement will be determined by the product of the Business Indicator (indicador de negocio), the Operational Risk Coefficient (coeficiente de riesgo operacional) and the Internal Loss Multiplier (indicador de pérdida interna). The Operational Risk Coefficient will be 12% of the Business Indicator, but if the Business Indicator exceeds COP 3 billion, the coefficient will be 15% for the excess amount. Each entity was required to comply with the requirement as of January 1, 2021. For more information, see Item 5. Operating and Financial Review and Prospects - B1 Liquidity and Funding. Capital Adequacy. The minimum capital requirement for applying for a banking charter on an unconsolidated basis is established in Article 80 of Decree 633 of 1993. This capital requirement for banks in 2025 is set at COP 140,254 million. Failure to meet the requirement could result in the SFC taking of possession (toma de posesión) of the bank (see Item 4. Information on the Company – B. Business Overview – B.8 –Supervision and Regulation – Bankruptcy Considerations). Mandatory investments The Central Bank regulations require financial institutions, including Bancolombia, to hold minimum mandatory investments in debt instruments issued by Fondo para el Financiamiento del Sector Agropecuario ('Finagro'), a Colombian public financial institution that finances production and rural activities to support the agriculture sector. The amount of these mandatory investments is calculated by applying a fixed percentage (ranging from 4.3% to 5.8%, depending on the type of liability) to the quarterly average of the end-of-day balances of certain liabilities, primarily deposits and short-term debt. The investment balance is calculated at the end of each quarter. Any required adjustment (due to a change in the quarterly average between periods) results in the purchase of additional securities or may result in the redemption by Finagro of securities in excess of the requirement. The purchase of additional securities takes place during the month following the date on which the calculation was performed. Foreign currency requirements According to External Resolution 1 of 2018 issued by the board of directors of the Central Bank, as amended or supplemented ('Resolution 1 of 2018'), a financial institution’s foreign currency position is the difference between the institution’s foreign currency-denominated assets and liabilities (including any off-balance-sheet items). In the case of foreign exchange market intermediaries that consolidate financial statements and have controlled foreign investments, such as Bancolombia, (i) the value of controlled foreign investments, and (ii) the value of derivatives and other liabilities designated by the intermediary as hedging instruments for the controlled foreign investments are excluded from its foreign currency position. In addition, Resolution 1 of 2018 provides foreign currency position limits, such that a financial institution's positions may not exceed certain percentages of its technical capital in specific periods. It also requires banks to calculate a gross leverage position (posición bruta de apalancamiento) as it relates to its foreign currency position. Reserve requirements Credit institutions are required to satisfy reserve requirements with respect to deposits and other cash demands, which are held by the Central Bank in the form of cash deposits. The reserve requirements for Colombian banks are measured bi-weekly and the amount depends on the class of deposits. According to External Resolution 3 of 2024, which amends External Resolution of 2008, the Central Bank require credit institutions to maintain reserves of (i) 7% over private demand deposits, government demand deposits, other deposits and liabilities; (ii) 2.5% over term deposits with maturities fewer than 540 days and (iii) 0% over term deposits with maturities greater than or equal to 540 days. Nonperforming loan allowance The SFC maintains rules on nonperforming loan allowances for financial institutions. The allowance level of these loans is determined by the profile and risk conditions of the clients and the specific conditions of the loan. These rules apply to Bancolombia’s financial statements on a standalone basis for Colombian regulatory purposes. Nonperforming loan allowances in the Consolidated Financial Statements are calculated according to IFRS. Large exposures and concentration limits The government, through Decree 1533 of 2022 and the SFC’s External Circular 3 of 2024, adopted the Basel Committee’s international standard on Large Exposures (LEX), which as of August 2025 modified the current rules on legal lending limits. The set of regulations establishes: (i) a 25% exposure limit of Tier 1 Capital with respect to the same counterparty or group of connected counterparties; (ii) the definition of a Large Exposure as an exposure that represents more than 10% of the Tier 1 Capital; (iii) metrics that align the measurement of exposures with metrics on the risk-weighted assets in terms of capital adequacy; and (iv) the criteria for the identification of connected counterparties, including control relationship, financial conglomerates, and economic interdependence. In addition, Decree 1358 of 2024 included a 25% limit for transactions with related parties that will apply from May 2026. Payments system External Circular DSP-465 issued by the Central Bank establishes standards for interoperability, governance, and operational procedures of the new interoperable Immediate Payments System managed by the Central Bank (Bre-B), which started operations in September 2025. Decree 1069 of 2025 issued by the Ministry of Finance governs payment orders and fund transfers, imposing enhanced obligations on participating entities to ensure security, efficiency, and standardized practices. These measures create a legal and technical foundation for real-time, interoperable payments, fostering competition and financial inclusion. Internal capital and liquidity assessment process The SFC, through External Circular 025 of 2025, adopted Basel Pillar 2 recommendations, focusing on the supervisory review process requiring banks to assess their own capital adequacy beyond Pillar 1, through the implementation of capital and liquidity self-assessment programs (ICAAP-ILAAP) and the update of stress tests, which will be mandatory as of January 2028. The results of the ICAAP will be binding on credit establishments starting in January 2029. Bankruptcy considerations Colombian banks and other financial institutions are subject to special regulations regarding insolvency, restructuring and liquidation. Under Colombian banking law, the SFC has the power to intervene in the operations of a bank to prevent, or to control and reduce the effects of, a bank failure. The SFC also conducts periodic visits to financial institutions and may impose capital or solvency obligations on financial institutions without taking control of such financial institutions. The SFC may require corrective and recovery measures, including enhanced supervision, mandatory recapitalization, transfers of assets and liabilities, mergers or other restructuring actions, and, if the situation is deemed critical, may take possession of a financial institution either to manage it or to coordinate its liquidation. Colombia’s financial conglomerates framework also strengthened crisis management tools applicable to deposit-taking institutions, including the use of bridge bank mechanisms to facilitate the transfer of assets and liabilities from a failing institution. Upon taking possession, the SFC appoints a special agent designated by Fogafín to manage the financial institution, and Colombian banking rules generally restrict creditors from initiating or continuing collection or enforcement actions, or creating liens over the financial institution's assets, during the possession process. If the financial institution is ultimately liquidated, certain savings instruments, including deposits, are excluded from the estate and paid prior to other liabilities, and the remaining claims are satisfied in accordance with statutory priority rules, with subordinated debt ranking junior to external liabilities and senior only to equity. Deposit insurance—troubled financial institutions Subject to specific limitations, Fogafin is authorized to provide equity (whether or not reducing the par value of the recipient’s shares) and/or secured credits to troubled financial institutions, and to insure deposits of commercial banks and certain other financial institutions. To protect the customers of commercial banks and certain financial institutions, Resolution 1 of 2012 of the board of directors of Fogafin, as amended, requires mandatory deposit insurance. Banks must pay an annual premium of 0.30% of total funds received on savings accounts, checking accounts, certificates of deposit and other deposits, which is paid in four quarterly installments. If a bank is liquidated, the deposit insurance will cover the funds deposited by an individual or corporation with the bank up to a maximum of COP 50,000,000, regardless of the number of accounts held. Risk management systems Commercial banks must have risk administration systems to meet the SFC minimum standards for compliance and to avoid and mitigate the following risks: (i) credit; (ii) liquidity; (iii) market; (iv) operational; (v) money laundering and terrorism; (vi) counterparty; (vii) interest rate risk in the banking book; and (viii) country risk. Through External Circular 18 of 2021, the SFC issued the regulatory framework for the Comprehensive Risk Management System (Sistema Integral de Administración de Riesgos, or SIAR), which has been in effect since June 1, 2023, except for certain provisions related to risk data aggregation and reporting, which became effective on December 31, 2023. These provisions require financial entities to have a global vision of the risks to which they are exposed, since it integrates the management of credit, market, operational, liquidity, counterparty, guarantee, insurance and country risks. Internal control system framework The SFC updated its Internal Control System Framework with External Circular 8 of 2023, aiming to converge on international best practices and promote the development of robust corporate governance structures, adopting the recommendations of the Internal Control—Integrated Framework of the Committee of Sponsoring Organizations of the Treadway Commission (COSO), the Three Lines Model of the Chartered Institute of Internal Auditors (IIA) and the guidelines defined by the Basel Committee on Banking Supervision (BCBS) on corporate governance. These new rules came into effect on May 16, 2024. Cybersecurity regulation External Circular 7 of 2018 issued by the SFC, modified by External Circular 33 of 2020, contains the cybersecurity risk framework for financial institutions. These rules were adopted to enhance cyber risk management and promote the adoption of best practices. The framework (i) provides financial entities with a set of minimum requirements for information security and cybersecurity management; (ii) defines a single taxonomy to standardize the reporting of metrics and incidents related to information security and cybersecurity; and (iii) adopts the Traffic Light Protocol (TLP). External Circular 004 of 2024 issued by the SFC includes requirements for financial institutions to review the cybersecurity conditions of critical third-party providers; and rules over the framework of open finance services, including the limitation of web-scraping. Anti-money laundering provisions for financial institutions The regulatory framework to prevent and control money laundering is contained in, among others, Decree 663 of 1993; External Circular 6 of 2025; and the Colombian Criminal Code, as amended. Colombian laws adopt the latest guidelines related to anti-money laundering and other terrorist activities established by the Financial Action Task Force on Money Laundering ('FATF'). Colombia, as a member of the GAFI-SUD (a FATF-style regional body), follows the FATF’s recommendations. In 2022, the SFC introduced new requirements for financial entities and their risk management systems for Anti-Money Laundering/Combating the Financing of Terrorism (AML/CFT) – in Colombia referred to as the Sistema de Administración del Riesgo de Lavado de Activos y de la Financiación del Terrorismo ('SARLAFT'). The new SARLAFT requirements include due diligence on ultimate beneficial owners and politically exposed persons; countermeasures to circumstances that involve high-risk countries; information requirements in international and domestic transactions; supervision in correspondent activities; enhancement of technology tools, among others. Financial institutions must cooperate with the appropriate authorities to prevent and control money laundering and terrorism financing. Finally, the Colombian Criminal Code introduced criminal rules and regulations to prevent, control, detect, eliminate and adjudicate all matters related to terrorism financing and money laundering, including the omission of reports on cash transactions, mobilization or storage of cash, and the lack of controls. Consumer protection Law 1328 of 2009 establishes a set of rights and responsibilities for customers of the financial system and a set of obligations for financial institutions in order to minimize disputes. This law also gives foreign banks more flexibility to operate in Colombia through 'branches.' Pursuant to External Circular 23 of 2021 issued by the SFC, Smartsupervision technology was implemented to provide a mechanism for the detailed monitoring of petitions, complaints or claims (Peticiones, Quejas & Reclamos or 'PQR'). This mechanism, provided by the SFC, allows financial consumers to submit petitions, complaints or claims and for them to be answered in due time and in an appropriate manner. Regulatory framework for Colombian subsidiaries that are non-participants in the financial sector Grupo Cibest and its Colombian subsidiaries that do not provide financial services are governed by the laws and regulations embodied in the Colombian Civil Code and the Colombian Commercial Code, as well as any regulations issued by the SIC and the Superintendency of Corporations or any other type of special regulations that may be applicable to the commercial and industrial activities carried out by Grupo Cibest and these subsidiaries. Panama Regulatory framework for Panamanian banking institutions The banking business in Panama is regulated by Law Decree 9 of 1998 (as amended to date, including by means of Law Decree 2 of 2008, the 'Banking Law'). Pursuant to the Banking Law, the Superintendency of Banks of Panama (the Superintendency of Banks of Panama), as banking supervisor, has the power to issue accords and resolutions to regulate the banking system. To implement Basel III capital standards, the Superintendency of Banks of Panama issued Accord 1-2015 establishing capital adequacy standards. This accord establishes new requirements for the composition of a banking entity's capital base, as well as for capital adequacy ratios, including the core Tier 1 capital ratio and the Tier 1 capital ratio, all in line with Basel III standards. This accord took effect in June 2016 and, as of January 1, 2019, the new rules were fully implemented. In addition, in October 2023, the Superintendency of Banks of Panama issued Accord 5-2023, which establishes rules on the capital conservation buffer to ensure that banks accumulate reserves that can be used in the event of incurring losses. According to this new Accord, banks must establish a capital conservation buffer of 2.5% of risk-weighted assets (credit, market and operational), comprised of ordinary primary capital and in addition to all minimum regulatory capital requirements. This accord took effect on July 1, 2024, and banks have until July 2026 to comply. In July 2025, the Superintendency of Banks issued a regulation introducing additional capital buffer requirements for domestic systemic banks, which will take effect in July 2027 with a transition period through July 2032. These additional capital buffers may require affected banks to maintain higher capital levels, which could limit capital distributions (such as dividends) or impact return on equity (ROE). In terms of liquidity, banks with a general license are required to maintain 30% of their global deposits in liquid assets (which include short-term loans to other banks and other liquid assets) of the type prescribed by the Superintendency of Banks of Panama. Additionally, banks with a general license are required to maintain assets in Panama of not less than 60% of their local deposits or any other percentage set by the Superintendency of Banks of Panama. Under the Banking Law, central bank deposits and other similar deposits of international reserves of sovereign states enjoy immunity from seizure or attachment proceedings. In 2018, the Superintendency of Banks of Panama, moving forward with the implementation of Basel III liquidity standards, issued a Liquidity Coverage Ratio ('LCR') Accord that requires general license banks to maintain high-quality liquid assets in relation to their short-term net cash outflows. Daily compliance with the LCR (high-quality liquid assets as a percentage of net cash outflows) was implemented progressively, starting in December 2018 with a compliance rate of 25%, reaching a compliance rate of 100% in December 2022. In 2025, the Superintendency of Banks of Panama issued a regulation that expanded the scope of High-Quality Liquid Assets (HQLA) and revised credit rating criteria applicable to certain financial instruments. In addition, another standard amended existing regulations to recognize the Panama Guarantee Fund as an eligible credit risk mitigant for capital adequacy purposes. The Superintendency of Banks of Panama has also issued regulations consistent with Basel III standards regarding capital requirements for market risk in the trading book, regulations to improve country risk management and operational risk management, as well as governance and controls relating to investment in securities. Regarding credit risk, in March 2016, the Superintendency of Banks of Panama issued Accord 3-2016, which establishes rules for the determination of risk-weighted assets applicable to on- and off-balance-sheet credit exposures, which are more risk-sensitive in line with Basel II and Basel III standards. This accord introduced the treatment of counterparty exposures in derivative transactions, as well as credit risk mitigation techniques, such as the treatment of financial guarantees. In Panama, banks are prohibited from granting, directly or indirectly, to any natural or legal person, including any entity that is part of a bank's economic group, any loan or line of credit, guarantee or any other obligation (other than credit facilities fully secured by deposits in the bank) in favor of such person that exceeds at any time, individually or jointly, 25% of the bank's total regulatory capital. Related party obligations (as defined in the applicable regulations) exceeding (i) 5% of its total capital, in the case of unsecured transactions, and (ii) 10% of its total capital, in the case of secured transactions (other than loans secured by deposits with the bank) are prohibited. The Superintendency of Banks of Panama is empowered to assume administrative and operational control of a bank, including the possession of its assets and the exercise of its administration, to defend the best interests of the bank's depositors and creditors, under any of the following situations: (i) at the request of the bank; (ii) if the bank is unable to continue its operations without endangering the interests of depositors; (iii) as a consequence of the evaluation of an advisor's report; (iv) failure to comply with measures ordered by the Superintendency of Banks of Panama; (v) if the bank conducts its operations in an illegal, negligent or fraudulent manner; (vi) if the bank has suspended payment of its obligations; and (vii) if the Superintendency of Banks of Panama determines that the capital adequacy, solvency or liquidity of the bank has deteriorated so as to require the intervention of the Superintendency of Banks of Panama. Upon expiration of the administrative control period, the Superintendent will decide whether to proceed with the reorganization of the bank, the compulsory liquidation of the bank or the return of administrative and operational control to the directors or legal representatives of the bank. The Superintendency of Banks of Panama is also in charge of the supervision and oversight of the trust business, regulated by (i) Law 1 of 1984, which establishes aspects such as minimum requirements for trust contracts, characteristics of trusts, rights and responsibilities of settlors, trustees and beneficiaries and (ii) Law 21 of 2017 which strengthens the supervisory and regulatory capacities of the Superintendency of Banks of Panama with respect to the trust business and imposes rules with respect to trust licensing, accounting, corporate governance and reporting. Economic and Business Environment and Regulatory Framework Operations primarily conducted in Panama are characterized by an economy that uses the U.S. dollar as legal tender, a service-oriented financial sector, and an open economy with a high degree of integration into international markets. The country’s economic performance may be influenced by factors such as trade growth, financial services, foreign investment, logistics activity, and global economic conditions. Panama updated its preferential mortgage interest framework to modernize subsidies for primary residence loans and align them with housing policy. The reform introduced tiered interest subsidies for new mortgages up to a defined threshold, administered through licensed banks. Later adjustments temporarily reinstated the prior regime and subsequently extended subsidy terms and revised calculation methods, effective January 2026. These measures form part of Panama’s housing finance system and may influence mortgage origination volumes, pricing, and operational processes within the local banking sector. Other regulations in Panama Securities market activities in Panama are subject to the supervision, control, and oversight of the Superintendency of the Securities Market Panama (the 'Superintendency of the Securities Market of Panama'). These activities are mainly regulated by Law Decree 1 of 1999, as amended to date (the 'Securities Law'), which establishes the regulatory framework for the Panamanian securities market. Among the most important aspects of the Securities Law are: (i) the establishment of a system of coordination and cooperation among financial supervisors, which allows for a broader supervision of financial conglomerates; (ii) the creation of the Superintendency of the Securities Market of Panama as a supervisory entity replacing the former National Securities Commission; (iii) the authorization of the Superintendency of the Securities Market of Panama to carry out consolidated supervision, as the national supervisor of intermediaries with agencies abroad, and to enter into cooperation agreements with foreign supervisors to facilitate consolidated supervision; (iv) the regulation of foreign currency exchange as a securities activity; (v) the introduction of provisions regarding the clearing and settlement of securities and financial instruments; and (vi) the creation of new participants to promote over-the-counter transactions. The main aspects of the securities business covered by the Securities Law and the accords and resolutions issued by the Superintendency of the Securities Market are (i) licensing requirements for securities brokers, investment advisors, fund managers and self-regulatory organizations; (ii) registration requirements for risk rating agencies, providers of securities prices, securities, public offerings, funds and providers of securities market administrative services; (iii) authorization to solicit proxy votes in respect of registered securities; (iv) public offering notification requirements for the acquisition of registered shares; (v) options, futures and derivatives contracts; (vi) custody, clearing and settlement of securities; (vii) penalty and sanction procedures; (viii) voluntary liquidation, reorganization and bankruptcy of broker-dealers, self-regulatory organizations, funds and fund administrators; (ix) reporting by registered issuers of securities, broker-dealers, investment advisers, funds, fund administrators, self-regulatory organizations and other registered entities; (x) on-site inspection of broker-dealers, investment advisers, self-regulatory organizations, funds, fund administrators, securities market administrative service providers, securities pricing providers and rating agencies; (xi) capital requirements, liquidity requirements, risk assessment, confidentiality, conflict of interest, suitability, compliance and asset laundering of securities brokers; and (xii) communication of material events by registered securities issuers. In May 2024, the Superintendency of the Securities Market issued Accord 5-2024, which set requirements for obtaining a securities firm license. Securities firms must provide an operating manual that must contain: (i) a detailed, step-by-step description of the entity's processes, including orders, times, flow charts and persons responsible for all activities carried out by the securities firm under its business plan; and (ii) the rules or policies of the securities firm. In addition, the securities firm must make a brochure of fees, approved by its board of directors, available to clients on its website. Panama has also enacted a series of laws to prevent, detect and sanction money laundering activities such as: (i) Executive Decree 947 of 2014 reorganizing the Financial Analysis Unit for the Prevention of Money Laundering, Terrorism Financing, and Financing of the Proliferation of Weapons of Mass Destruction (the 'UAF'); (ii) Law 23 of 2015 adopting measures to prevent money laundering, terrorism financing, and financing of the proliferation of weapons of mass destruction; and (iii) Executive Decree 35 of September 6, 2022, which regulates Law 23 of 2015 and establishes the measures that banks and other regulated entities must adopt for the prevention, identification and reporting to the UAF of suspicious transactions. Law 23 of 2015 and Accord 7-2015 issued by the Superintendency of Banks of Panama define regulated financial entities for purposes of money laundering, financing of terrorism or any other illicit activity. Following the recommendations of the Financial Action Task Force ('FATF'), Panama enacted Law 70 of 2019, which amended the Criminal Code imposing the penalty of imprisonment for persons who engage in tax fraud, and Law 254 of 2021, which includes provisions on tax transparency, prevention of money laundering, and accounting records, due diligence, and beneficial owners. In October 2016, Panama approved an agreement with the U.S. government to improve international tax compliance and to implement FATCA; in February 2017, it approved the Convention on Mutual Administrative Assistance in Tax Matters; and in October 2020 it approved the Multilateral Convention to Implement Tax Treaty Related Measures to Prevent Base Erosion and Profit Shifting. All the above has enabled the exchange of information on tax matters between Panamanian tax authorities and a broader set of countries. In May 2017, the obligations and responsibilities of banking institutions with respect to due diligence procedures to identify reportable accounts were set forth in regulations, as well as the responsibilities with respect to the control measures and information requirements necessary to comply with international agreements. In addition, in February 2025, the Superintendency of Banks of Panama issued a regulation adopting an indicative guide on Politically Exposed Persons (PEPs), expanding PEP definitions, mandating enhanced due diligence, extended monitoring up to two years post-tenure, and requiring updated PEP categorization lists by obligated entities, in line with FATF Recommendation 12 and best international AML/CFT practices. Cybersecurity regulation Panama has several laws that regulate incidents related to technology systems. The Criminal Code establishes penalties between two and eight years in prison to anyone who unduly enters or uses a database, network, or computer system, as well as to anyone who unduly seizes, copies, uses or modifies the data in transit or contained in a database or computer system, or interferes, intercepts, hinders or prevents its transmission. It also establishes the same penalties for anyone who alters, modifies, or manipulates programs, databases, networks, or computer systems to the detriment of a third party. Law 81 of 2019 and Executive Decree No. 285 of 2021 establish the principles, rights, obligations, and procedures that regulate the protection of personal data. Law 81 of 2019 requires the persons responsible for the processing of personal data contained in databases to establish protocols, processes and procedures for management and secure transfer, protecting the rights of data owners over their data. In 2013, Panama approved the Budapest Convention on cybercrime, by which Panama committed, among other things, to adopt legislative measures related to computer crimes and crimes against confidentiality, integrity and availability of data and computer systems. Additionally, through Resolution No. 17 of September 10, 2021, the National Council for Government Innovation approved the National Cybersecurity Strategy for the period 2021-2024. The Superintendency of Banks of Panama, through Accord 8-2010, established provisions for the integral comprehensive management of risks to banks, including information technology risk and, through Accord 3-2012, developed the measures that banks must adopt in relation to information technology risk. These include, among others, establishing policies, strategic plans and procedures, as well as allocating necessary resources for information technology management and having an information technology committee, to oversee the management of the bank's information technology. Additionally, Accord 6-2011 established the guidelines for electronic banking and related risk management and Accord 6-2016 establishes guidelines for risk management regarding money laundering, terrorism financing and financing of the proliferation of weapons of mass destruction, which may arise with respect to new products and new technologies. El Salvador Regulatory framework for El Salvador banking institutions El Salvador's Supervision and Regulation of the Financial System Law establishes the institutional framework for regulatory and supervisory bodies, mandating the Superintendency of the Financial System (SSF) to oversee all financial entities and the Central Reserve Bank (BCR) to issue necessary regulations. Its main objectives are to preserve stability, ensure efficiency, transparency, and security, and align with international best practices through consolidated supervision, risk management, and corporate governance. The Banking Law establishes the legal framework for the authorization, operation, and supervision of banking institutions, defining requirements for capital adequacy, liquidity, liquidity reserve requirements, corporate governance, and risk management. The law regulates key aspects such as deposit-taking, lending, foreign exchange operations, and the provision of payment services, ensuring prudential standards aligned with international best practices. It also mandates liquidity reserve requirements determined by the Superintendency of the Financial System based on deposits and liabilities, and sets rules for transparency, consumer protection, and reporting obligations. Over time, the law has been amended to strengthen stability and adapt to changes in the market , including the repeal of certain chapters in 2025 following the enactment of the Law for the Stability of the Financial System and Deposit Guarantee, which strengthened deposit insurance regime. Reserve Requirements According to the Temporary Technical Standards (NPBT‑16), which took effect on October 8, 2025, reserve requirements range from 1% to 16%, depending on the type of deposit or obligation. Entities must maintain a balance in the 'Cash Holdings' account equal to or greater than 68% of the amount reported as of September 30, 2022. These Temporary Standards expire on March 24, 2026. Asset and Liquidity Risk Requirements The Technical Standards for Liquidity Risk Management (NRP‑05) regulate minimum guidelines and methodologies for managing liquidity risk in financial entities. The Central Reserve Bank, effective January 2, 2026, introduced the following ratios: High-Quality Liquid Assets (HQLA), the Liquidity Coverage Ratio (LCR), and the Net Stable Funding Ratio (NSFR), with progressive compliance targets through 2031. The Technical Standards for Liquid Assets (NRP‑87), effective February 8, 2025, require banks to maintain an average of 3% in high-quality liquid assets, defining eligible instruments, calculation methodology, and reporting obligations. The standards aim to bring banks to the required level of liquid assets within 16 months, starting from February 8, 2025, and ending by May 5, 2026. Liquid assets must be composed of easily realizable foreign securities, deposits in foreign banks, or deposits at the central bank. Monetary Integration Law In November 2000, El Salvador's Congress enacted the Monetary Integration Law, adopting the U.S. dollar as the sole legal currency at a fixed exchange rate of 8.75 SVC per USD 1.00. Since its implementation, all financial operations – including deposits, loans, pensions, securities offerings, and accounting records – must be expressed in U.S. dollars. Transactions made in Salvadoran colones before the law’s effective date were converted at the established exchange rate. Investment Funds Law Enacted in October 2014, the Investment Funds Law aims to promote economic activity by granting investors access to capital markets, diversifying the market and channeling of savings into productive sectors. It establishes the regulatory framework for the supervision of investment funds, their participation shares, and the companies that manage them, as well as other related participants. It also regulates the marketing of participation shares in foreign investment funds. The law provides for the creation of investment fund managers, responsible for all actions, contracts, and operations necessary for fund administration. Technical Standards issued by the Central Reserve Bank in October 2016 govern permitted transactions, disclosure requirements, and risk management. Financial Inclusion Enacted in 2015, the Financial Inclusion Law promotes access to formal financial services through electronic money and simplified accounts subject to balance and transaction limits. Technical Standards NASF‑11, in effect since 2022, allow banks and other entities to operate through physical, digital, and mobile correspondents, expanding coverage in underserved areas under defined risk and reporting requirements. Consumer Protection Law In force since September 2005, the law covers all commercial activities, including online sales (e‑commerce), and sets basic protection and legal security for consumers. In June 2024, reforms tightened price transparency, limited the collection/transfer of personal and credit data without authorization, created procedures to remove dangerous products/ services from the market, added compliance measures. These provisions are complemented by technical standards issued by the Central Reserve Bank. For financial services, the law imposes special rules on banks and other providers: a cap on default interest of ≤5% per year, respect for the consumer’s choice of insurer, and enhanced digital channel/e‑commerce obligations. Bitcoin Law Congress enacted bitcoin as legal tender in El Salvador, effective September 7, 2021. The law required the Central Reserve Bank to register bitcoin service providers and issue technical standards (NRP‑29) and guidelines for bitcoin and dollar services, applicable to banks, cooperative banks, savings and credit entities, and electronic money issuers. On January 29, 2025, the law was amended to remove bitcoin’s status as legal tender and eliminate the term “currency” when referring to bitcoin, while continuing to allow bitcoin to circulate.. Acceptance became voluntary for private entities and individuals, while tax payments and transactions with the State must be made in U.S. dollars. Public entities are no longer obliged to provide conversion mechanisms. The Central Reserve Bank and the Superintendency issued updated technical regulations to align with these changes, maintaining oversight of bitcoin service providers under the new framework. Cybersecurity regulation The Technical Standards for Information Security Management (NRP‑23), effective July 1, 2020, set minimum cybersecurity requirements based on each entity’s size, risk profile, and operations. On March 8, 2022, NRP‑32 introduced mandatory controls for digital channels, including secure data handling and authentication. In May 2022, the government adopted a National Cybersecurity Policy to strengthen the legal framework and create mechanisms for information sharing and cybercrime response. On November 23, 2024, the Cybersecurity and Information Security Law came into force, creating the State Cybersecurity Agency (ACE) to classify critical infrastructure operators and submit them for presidential ratification. Banks may be designated as essential service providers only if confirmed by the President of the Republic. Once classified, they must comply with ACE regulations, implement robust incident‑response plans and report cybersecurity breaches. AML/CFT Standards On October 17, 2025, El Salvador’s Special Law for the Prevention, Control and Sanction of Money Laundering, Terrorist Financing and Financing of the Proliferation of Weapons of Mass Destruction took effect, replacing the previous AML law. The new law strengthens the national Financial Investigation Unit (FIU), creates an interagency committee, CIPLAFT, reduces the number of obligated entities while adding digital‑asset providers and political parties, and raises the cross‑border cash declaration threshold. It adopts a risk‑based approach that prohibits blanket de‑risking and requires individual customer assessments. Key changes include: beneficial ownership rules, reporting timelines, compliance, an enhanced sanction regime with severe/very severe categories and significant fines (including personal ineligibility for directors/managers), and migration to the United Nations goAML reporting platform. The UIF must issue guidelines within six months, with institutions given twelve months to adapt; until then, existing 2022–2023 standards remain applicable. These changes form part of El Salvador’s ongoing efforts to address the findings and recommendations of GAFILAT’s fourth round mutual evaluation and to align its AML/CFT framework with international standards. The Instructive for the Prevention, Detection and Control of Money and Asset Laundering, Terrorist Financing and Financing of the Proliferation of Weapons of Mass Destruction, issued on June 7, 2022, establishes rules for cash transaction monitoring, identity verification prior to onboarding, and reporting of international transactions. Amendments effective September 27, 2023, reinforced annual internal audits, mandatory reporting to the Board and Compliance Officer, and enhanced profiling for high-risk customers and Politically Exposed Persons (PEPs). Technical Standards for Money and Asset Laundering Risk Management, Terrorist Financing and Financing of the Proliferation of Weapons of Mass Destruction (NRP‑36), issued by the Central Reserve Bank and effective since October 10, 2022, align supervisory obligations with the UIF instructive and set detailed guidelines for governance, risk-based controls, detection and reporting of unusual operations, and overall AML/CFT compliance. Financial stability regulations (troubled financial institutions) On May 3, 2022, the Central Reserve Bank’s Technical Standards for the Preparation of Financial stability recovery plans entered into force, requiring institutions to maintain plans with stress scenarios, indicators, trigger processes, and communication protocols. In 2025, the Law for the Stability of the Financial System and Deposit Guarantee was approved, establishing a resolution regime for failing institutions, and establishing the Financial Stability Committee and the Deposit Guarantee Institute (IGD), and repealing Titles IV and VI of the Banking Law, related to regularization, intervention, liquidation and the prior IGD framework. It also includes a gradual increase in the premiums that banks contribute to the IGD, rising from 0.10% to 0.15% of average, calculated quarterly on the daily average of total deposits, with the IGD board empowered to set higher risk‑based rates. Credit card system The Credit Card System Law, enacted in November 2009, establishes the legal framework for El Salvador’s credit card system, regulating the authorization of card issuers, credit card contracts, statements of account, relationships with affiliated merchants, and enforcement/sanctions for violations. Reforms effective July 20, 2022 strengthened consumer protections by eliminating membership fees on cards with limits ≤ US$2,000, prohibiting unsolicited card issuance and persistent direct promotion, removing overdraft surcharges when no purchase transactions occur, and barring cancellations due to inactivity without prior notice. Digital assets issuance The Digital Asset Issuance Law entered into force on February 2, 2023, creating a legal framework for public offerings of digital assets and establishing an alternative market to traditional securities. It introduced rules for issuers and service providers, aiming to promote innovation while ensuring investor protection. Personal data protection On November 23, 2024, El Salvador’s Personal Data Protection Law entered into force, guaranteeing the right to privacy and informational self‑determination and establishing rules for the collection, processing, storage, and transfer of personal data. The law grants ARCO rights (rights of access, rectification, cancellation, and opposition) and requires prior consent or legal cause and security measures for data processing. In 2025, the ACE, as the supervisory authority, issued policies to regulate the handling and protection of personal data by public and private entities. Investment banking In 2025, El Salvador approved the Investment Banking Law, which establishes a regulatory framework for specialized entities authorized to provide complex financial services, including structured financing, mergers and acquisitions advisory, and digital asset management. The law introduces a combined licensing regime for financial intermediation and digital asset service provision, subject to applicable regulatory oversight. Alternative Private Investment Funds In 2025, El Salvador enacted the Alternative Private Investment Funds Law, which provides a framework for the formation and operation of private collective investment vehicles targeting sophisticated investors. The law permits investments in both traditional and digital assets and requires compliance with international accounting and auditing standards. Public security In 2025, El Salvador remained under a state of exception first declared on March 27, 2022, and extended consecutively, under which certain constitutional guarantees have been suspended nationwide. The measure is not specific to the financial sector. However, it is part of the broader operating context and should be taken into account when assessing of the legal and institutional environment. Bancoagrícola continues to conduct its operations under the applicable regulatory framework and maintains its governance and compliance standards. Guatemala Regulatory framework for Guatemalan banking institutions The Guatemalan financial system operates under a regulatory framework primarily established by Decree No. 19-2002, the Banks and Financial Groups Law (Ley de Bancos y Grupos Financieros) and Decree No. 18-2002, the Financial Supervision Law (Ley de Supervisión Financiera). These laws define the structure and organization of the financial system and grant supervisory authority to the Guatemalan Superintendency of Banks, which is responsible for overseeing financial institutions and ensuring compliance with prudential and regulatory standards. The Financial Supervision Law establishes the Guatemalan Superintendency of Banks and regulates its functions. The law establishes the scope of the Superintendency as the entity responsible for the supervision and inspection of the financial system in Guatemala, ensuring its stability and security. Cybersecurity regulation Resolution JM-98-2025, the Regulation for the Administration of Technology Risk (Reglamento para la Administración del Riesgo Tecnológico) establishes minimum guidelines that institutions within the financial system must observe for the administration of technology risk, including aspects related to information technology infrastructure, information systems, databases, technology services, information security, cybersecurity, disaster recovery planning, and the processing and/or storage of information. The regulation incorporates a specific chapter on cybersecurity, with management procedures focused on governance, identification, protection, detection, response, and recovery, as well as provisions for the organization of cyber incident response teams and the exchange of information among institutions. In addition, it regulates the use of artificial intelligence systems, requiring the identification, assessment, and monitoring of associated risks, human oversight, and the application of principles of security, resilience, privacy, transparency, and fairness. Resolution JM-91-2024, the Regulation on Security Measures in Electronic Channels (Reglamento de Medidas de Seguridad en Canales Electrónicos) establishes minimum security standards for banks, financial institutions, and offshore entities to manage risk in electronic transactions and prevent fraud. It defines electronic channels as platforms used to conduct transactions and exchange information. The regulation establishes a Fraud Risk Monitoring and Prevention Center to analyze complaints, issue alerts, and propose preventive measures to the Risk Management Committee. It also mandates the creation of a User Service Unit responsible for documenting cases, reporting fraud, and promoting education on security in electronic channels. Other Regulations in Guatemala Decree No. 67-2001, the Law Against the Laundering of Money or Other Assets (Ley Contra el Lavado de Dinero u Otros Activos), and Governmental Agreement No. 118-2002, Regulations to the Law against the Laundering of Money or Other Assets (Reglamento de la Ley Contra el Lavado de Dinero u Otros Activos) were enacted for the purpose of preventing, controlling, monitoring, and punishing the laundering of money or other assets derived from the commission of any crime. These regulations also established a Special Verification Intendancy (IVE) within the Superintendency of Banks, which is responsible for requesting and receiving information related to financial, commercial, or business transactions that may be linked to money laundering and for reporting such information to the competent authorities. Resolution JM-117-2009, the Regulation for the Administration of Liquidity Risk (Reglamento para la Administración del Riesgo de Liquidez) establishes rules for banks, financial companies, and offshore entities to manage liquidity risk and their liquidity risk management strategy, based on the credit profile of the institution. These rules include prudential policies and processes to identify, quantify, monitor, and control liquidity risk, the capacity to manage liquidity on a day-to-day basis, and contingency plans to address liquidity problems. Resolution JM-47-2022, the Regulation for the Administration of Credit Risk (Reglamento para la Administración del Riesgo de Crédito) regulates certain activities of banks, offshore entities, and financing subsidiaries, establishing rules on the minimum information required from applicants and borrowers, as well as the valuation of credit assets. Resolution JM-67-2023, Amendments to the Regulation for the Administration of Credit Risk (Modificaciones al Reglamento para la Administración del Riesgo de Crédito) amends Resolution JM-47-2022 to facilitate the implementation of the Regulation for the Administration of Credit Risk and help maintain the stability of the supervised banking system. Resolution JM-86-2023, the Collective Insurance Regulation (Reglamento del Seguro Colectivo) modernizes the legal framework for the management of collective insurance, focusing on optimizing performance and highlighting insurers’ obligations regarding customer service and communication with insured parties, improving transparency and protection for policyholders. Important aspects of the regulation include changes to placement and coverage guidelines and rules regarding electronic insurance contracting, among others. Agreement No. 6-2014, Instructions for the Disclosure of Information by Banks, Financial Companies, Microfinance Entities, General Deposit Warehouses, and Holding Companies or Companies Responsible for a Financial Group, as amended by Agreement No. 40-2023, establishes general guidelines for the disclosure of information by such entities. The purpose of the agreement is to ensure that economic agents have access to accurate, sufficient, and reliable data regarding the activities, financial position, risk exposure, and risk assessment of these institutions, promoting transparency, market discipline, and user confidence when making financial decisions. Agreement No. 41-2023 of the Guatemalan Superintendency of Banks, amending Agreement No. 7-2014, Instructions for the Disclosure of Information by Insurance and Reinsurance Companies, aims to improve transparency and accessibility of certain financial information, including updated disclosure guidelines and requirements regarding timeliness and accuracy. Decree No. 2-2024, the Credit Cards Law (Ley de Tarjetas de Crédito) regulates credit card operations, promotes transparency between issuers and users, and protects cardholders. The law establishes provisions regarding contracts, interest rates, fees, and sanctions. It highlights the creation of the Financial Services Protection Unit within the Consumer Assistance Directorate, which is responsible for supervising compliance with the law, handling complaints, and imposing sanctions for violations. The law also defines criminal offenses such as card cloning and fraudulent use and imposes administrative fines based on the seriousness of the violations. Resolution JM-56-2024, Regulations to the Credit Cards Law (Reglamento de la Ley de Tarjetas de Crédito), in force since September 1, 2024, complements the Credit Cards Law. Key aspects include the assessment of applicants’ payment capacity, the prohibition of interest on interest, reasonable calculation of minimum payments, disclosure of credit card terms and conditions, and supervision by the Guatemalan Superintendency of Banks to ensure compliance. Decree No. 23-2024, the Competition Law (Ley de Competencia) aims to promote competition, strengthen economic efficiency, and protect consumers in Guatemala. It regulates anticompetitive practices such as the abuse of economic power, collusion, price fixing, and restrictions on production. The law establishes general and supplementary scopes of application for sectors regulated by specific laws and creates the Superintendency of Competition as an autonomous entity responsible for investigating violations, imposing sanctions, and promoting competition awareness. Sanctions include fines of up to 200,000 times the daily minimum wage for serious violations. The law incorporates payment capacity assessments and the imposition of interest for noncompliance, and establishes administrative procedures based on principles of due process and procedural efficiency. International regulations that apply to us FATCA FATCA, a U.S. federal tax law enacted in 2010, imposes a 30% withholding tax on 'withholdable payments' made to non-U.S. financial institutions that do not participate in the FATCA program or that fail (or, in some cases, that have affiliates in which they hold an interest of more than 50% and which are also non-U.S. financial institutions that fail) to provide certain information regarding their U.S. account holders and/or certain U.S. investors, such as U.S. account holders and U.S. investors ('U.S. account holders') to the IRS. Among the countries where Grupo Cibest operates, Colombia and Panama have signed an IGA Model 1 (an intergovernmental agreement between the U.S. and a partner jurisdiction, through which the latter commits to reporting information to the IRS about financial accounts held by U.S. persons in Foreign Financial Institutions ('FFIs') within its territory. Under this model, FFIs report the collected information to their local tax authority, which is responsible for automatically transmitting it to the IRS. In addition, certain subsidiaries of Grupo Cibest located in other countries have transmitted directly to the IRS the information required pursuant to FATCA, since those other countries have not entered into an IGA. CRS The Common Reporting Standard ('CRS'), approved by the OECD Council in 2014, is applicable to signatory countries of the Multilateral Competent Authority Agreement ('MCAA') and requires signatory countries to obtain information from their financial institutions and automatically exchange that information with other jurisdictions on an annual basis. The CRS defines (i) which financial institutions are required to report; (ii) the types of accounts covered; and (iii) the due diligence procedures that financial institutions must follow to identify the reporting information. Among the countries where Grupo Cibest operates, Colombia and Panama have entered into the MCAA. Compliance with the terms of the international conventions signed for the exchange of information under CRS, the laws or any other regulations enforced in the relevant jurisdictions may increase Grupo Cibest compliance costs. B.9 ESG2 As ESG-related requirements and expectations continue to evolve globally, we monitor and seek to comply with current regulations, including with respect to information that must be reported to our stakeholders under applicable law. See Item 3.D. Risk Factors – We are exposed to environmental, social, governance and sustainability risks that could affect our financial condition and operating results. In addition, we have adopted policies, including those related to environmental and social risk analysis, environmental management, controversial issues in financing and investment, responsible investment, climate change and sustainable procurement. Subject to applicable law, we are integrating ESG measures into our business strategy, including retail banking, wealth management, corporate banking, asset management and project finance. To that end, we have set a goal of financing COP 700 trillion before 2030 through credit and other financial services. In our risk management strategy, we develop a risk map, which is designed to allow us to consolidate relevant information and knowledge from various experts, supplementing the management of traditional financial risks with information on emerging risks such as climate change. As part of this process, social and environmental risks – including climate change – have been integrated for analysis alongside traditional financial risks. This approach allow us to strengthen our climate change responses and prepares us for opportunities in a changing business environment. As part of our climate commitment, we have set goals in financing for the transition to a low carbon economy by 2030. We have sought to establish an enriching work environment that actively contributes to the well-being of our employees and their families and to their personal development. Our goal is to be the place where talent chooses not only to grow, but also to thrive. Our methodology and measurement tool, the Voice of the Employee, integrates several instruments and touchpoints to listen to our employees and measure their perception of organizational culture, employee wellbeing, and their work experience. We use strategic indicators such as employee engagement, experience versus expectations, intention to remain in the organization, and well-being. These efforts led to 92% participation in our annual survey carried out in Bancolombia and its subsidiaries, Bancoagrícola, Bam, and Banistmo, which showed 94% favorability in engagement with the following subindicators: 96% would recommend the organization to people they know as an excellent place to work, 93% believe that their job gives them a sense of personal achievement, and 92% feel motivated to exceed expectations in their work. We also create events and initiatives designed to strengthen our brand and position ourselves as one of the best companies to work for in the countries where we operate. These initiatives were focused on retaining employees with key knowledge and, in turn, attracting new professionals in strategic areas, such as technology, cybersecurity, design, analytics, and artificial intelligence. The overall ESG strategy guidelines are established by the Board of Directors, which is responsible for defining our strategy and long-term objectives. The Board’s Audit, Corporate Governance and Risk committees have direct responsibility for overseeing ESG issues and strategy, according to the roles and responsibilities of each committee. C.Organizational Structure The following chart summarizes the organizational structure of Grupo Cibest and certain subsidiaries, mostly involved in financial or capital market activities 2 Additional ESG-related information is available in our corporate management report, prepared in compliance with Colombian regulations, and on our sustainability website. Information included in our corporate management report or accessible through our website or the website of any of our subsidiaries is not incorporated into this Annual Report. This chart does not reflect any intermediate holding companies or special purpose vehicles owned by one or more of the entities included in the table. The following is a list of subsidiaries of Grupo Cibest as of December 31, 2025: Entity Jurisdiction of Incorporation Business Proportion of Ownership Interest and Voting Power Held by Grupo Cibest 2025 Valores Cibest S.A.S.(1) Colombia Investments 100.00 % Inversiones Cibest S.A.S.(1) Colombia Investments 100.00 % Cibest Investment Management S.A.S.(1) Colombia Investments 100.00 % Cibest Inversiones Estratégicas S.A.S.(1) Colombia Investments 100.00 % Bancolombia S.A.(1) Colombia Banking 100.00 % Fiduciaria Bancolombia S.A. Sociedad Fiduciaria Colombia Trust 98.81 % Banca de Inversión Bancolombia S.A. Corporación Financiera Colombia Investment banking 100.00 % Valores Bancolombia S.A. Comisionista de Bolsa Colombia Securities brokerage 100.00 % Wompi S.A.S. Colombia Technology services provider 100.00 % Renting Colombia S.A.S. Colombia Operating leasing 100.00 % Inversiones CFNS S.A.S. Colombia Investments 100.00 % P.A Tokenización Novus(2) Colombia Trust for administration and payments 100.00 % Negocios Digitales Colombia S.A.S. Colombia Payment solutions 100.00 % Fondo de Capital Privado Fondo Inmobiliario Colombia Colombia Real estate investment fund 78.48 % P.A. Inmuebles CEM Colombia Mercantile trust 78.48 % P.A. Calle 92 FIC-11 Colombia Mercantile trust 51.01 % P.A. FIC Edificio Corfinsura Colombia Mercantile trust 78.48 % P.A. FIC-A5 Colombia Mercantile trust 78.48 % P.A. FIC Inmuebles Colombia Mercantile trust 78.48 % P.A. FIC Clínica de Prado Colombia Mercantile trust 60.47 % P.A. FIC A6 Colombia Mercantile trust 78.48 % P.A. Central Point Colombia Mercantile trust 58.86 % P.A. Fideicomiso Twins Bay Colombia Mercantile trust 78.48 % Fideicomiso Lote Av San Martín Colombia Mercantile trust 78.48 % P.A. Fideicomiso Lote 30 Colombia Mercantile trust 78.48 % Fideicomiso Fondo Inmobiliario Bancolombia Colombia Mercantile trust 78.48 % P.A. Florencia Ferrara Colombia Mercantile trust 43.16 % P.A. Flor Morado Plaza Colombia Mercantile trust 78.48 % P.A. Linz Granz del Rio Colombia Mercantile trust 43.16 % Fideicomiso Selecto Terrazu Etapa 1 Torre 1 Colombia Mercantile trust 62.79 % Fideicomiso Selecto Terrazu Etapa 1 Torre 2(3) Colombia Mercantile trust 62.79 % Fideicomiso Lote C6 Carton de Colombia(3) Colombia Mercantile trust 43.16 % Fideicomiso Mokana Recursos(3) Colombia Mercantile trust 39.24 % Fideicomiso River Park(3) Colombia Mercantile trust 43.16 % Valores Simesa S.A. Colombia Investments 57.40 % P.A. FAI Calle 77 Colombia Mercantile trust 98.00 % P.A. Nomad Salitre Colombia Mercantile trust 98.00 % P.A. Nomad Central-2 Colombia Mercantile trust 98.00 % P.A. Calle 84 (2) Colombia Mercantile trust 98.00 % P.A. Calle 84 (3) Colombia Mercantile trust 98.00 % P.A. Nomad Distrito Vera Colombia Mercantile trust 98.00 % P.A. Nexo Colombia Mercantile trust 98.00 % P.A. Mercurio Colombia Mercantile trust 100.00 % P.A. CEDIS Sodimac Colombia Mercantile trust 100.00 % Wenia S.A.S Colombia Technology services 100.00 % P.A. Wenia Colombia Mercantile trust 100.00 % Nequi S.A. Compañía de Financiamiento Colombia Financial services 100.00 % P.A Títulos de Pagos por Ejecución(4) Colombia Mercantile trust 100.00 % Cibest Panamá Assets, S.A(5) Panama Investment 100.00 % Cibest Capital Panamá, S.A. (before Valores Banistmo S.A.)(5) Panama Purchase and sale of securities 100.00 % Bancolombia Panamá S.A. Panama Banking 100.00 % Sistemas de Inversiones y Negocios S.A. Sinesa Panama Investments 100.00 % Banagrícola S.A. Panama Holding 99.17 % Banistmo S.A. Panama Banking 100.00 % Banistmo Investment Corporation S.A. Panama Trust 100.00 % Leasing Banistmo S.A. Panama Leasing 100.00 % Banistmo Panamá Fondos de Inversión S.A.(6) Panama Investment fund holder 100.00 % Desarrollo de Oriente S.A.(6) Panama Real estate 100.00 % Banistmo Capital Markets Group Inc.(6)(7) Panama Purchase and sale of securities 100.00 % Anavi Investment Corporation S.A.(6)(7) Panama Real estate 100.00 % Steens Enterprises S.A.(6)(7) Panama Portfolio holder 100.00 % Ordway Holdings S.A.(6)(7) Panama Real estate broker 100.00 % Grupo Agromercantil Holding S.A. Panama Holding 100.00 % Banco Agromercantil de Guatemala S.A. Guatemala Banking 99.68 % Seguros Agromercantil de Guatemala S.A. Guatemala Insurance agency 79.92 % Financiera Agromercantil S.A. Guatemala Financial services 100.00 % Agrovalores S.A. Guatemala Securities brokerage 100.00 % Arrendadora Agromercantil S.A. Guatemala Financial Leasing 100.00 % Asistencia y Ajustes S.A. Guatemala Roadside and medical assistance services 100.00 % Serproba S.A. Guatemala Maintenance and remodeling services 100.00 % Servicios de Formalización S.A. Guatemala Loans formalization 100.00 % Conserjeria, Mantenimiento y Mensajería S.A.“En liquidación” Guatemala Maintenance services 100.00 % Mercom Bank Ltd.(8) Barbados Banking 99.68 % New Alma Enterprises Ltd. Bahamas Investments 99.68 % Bancolombia Puerto Rico Internacional Inc. Puerto Rico Banking 100.00 % Sinesa Cayman, Inc.(9) Cayman Islands Banking 100.00 % Banco Agrícola S.A. El Salvador Banking 97.36 % Arrendadora Financiera S.A. Arfinsa El Salvador Leasing 97.37 % Accelera S.A. de C.V. El Salvador Credit card services 97.36 % Valores Banagrícola S.A. de C.V. El Salvador Securities brokerage 98.89 % Inversiones Financieras Banco Agrícola S.A. IFBA El Salvador Holding 98.89 % Gestora de Fondos de Inversión Banagrícola S.A. El Salvador Administers investment funds 98.89 % Bagrícola Costa Rica S.A. Costa Rica Business and management advising 99.17 % Cibest Capital Holdings USA LLC (before Bancolombia Capital Holdings USA LLC) United States Holding 100.00 % Cibest Capital Advisory Services LLC (before Bancolombia Capital Advisers LLC) United States Investment advisor 100.00 % Cibest Capital Securities LLC (before Bancolombia Capital LLC) United States Securities brokerage 100.00 % Wenia Ltd. Bermuda Technology services 100.00 % (1) Incorporation of subsidiaries due to changes in the corporate structure, whereby Grupo Cibest became the holding company of all financial entities and other companies within the group, including Bancolombia. For further information, see Consolidated Financial Statement, the Explanatory Note and Note 1. Reporting Entity. (2) Trust for administration and payments consolidated by Inversiones CFNS S.A.S as of December 2025. (3) Trust funds consolidated through Fondo de Capital Privado Fondo Inmobiliario Colombia: Fideicomiso Selecto Terrazu Etapa 1 Torre 2 as of May 2025; Fideicomiso Lote C6 Cartón de Colombia and Fideicomiso Mokana as of September 2025; and Fideicomiso River Park as of November 2025. (4) Company consolidated as of December 2025 through Bancolombia. (5) Investments of Grupo Cibest resulting from the partial spin-off by Banistmo of 100% of the shares it held in Cibest Capital Panamá, S.A. (before Valores Banistmo S.A.), in favor of Cibest Panamá Assets. For further information, see Consolidated Financial Statement, Item 4.A History and Development of the Company and Note 1. Reporting Entity. (6) On December 18, 2025, Grupo Cibest informed to the market the execution of a share purchase agreement with Inversiones Cuscatlán Centroamérica S.A. for the sale of 100% of the shares of Banistmo. For further information, see Consolidated Financial Statement, Item 4.A History and Development of the Company, Item 10. B. Material Contracts and Note 1. Reporting Entity. (7) Investments in non-operational stage. (8) On September 30, 2021, Mercom Bank Ltd shareholder authorized the beginning of an organized and gradual process to transfer of the assets and liabilities of Mercom Bank, Ltd., to Bam. or other companies of Cibest Corporate Group. For further information, see Consolidated Financial Statement, Note 1. Reporting Entity. (9) On October 5, 2020, the Board of Directors of Bancolombia Panamá (the subsidiary’s parent company), approved the commencement of a gradual wind-up process of Sinesa Cayman, Inc.'s operations (formerly Bancolombia Cayman). For further information, see Consolidated Financial Statement, Note 1. Reporting entity. D.PREMISES AND EQUIPMENT As of December 2025, our premises and equipment include Bancolombia's main office located on Avenida Los Industriales in Medellín, as well as other owned and leased facilities primarily located in Colombia, with an approximate total area of 414,351 square meters. In 2025, our subsidiaries carried out improvements, openings, and renovations of some properties where branches, ATMs, and administrative offices operate. These improvements involved the execution of refurbishing and maintenance activities. The financing for these works was from our funds, totaling approximately COP 183,896 million. We carried out a comprehensive evaluation of the physical risks affecting Grupo Cibest's ans its subsidiaries facilities, including branches, ATMs, administrative buildings, warehouses, and other assets. This analysis identified that the main risks these assets are exposed to are: •Landslides: massive movements of rocks, debris, earth, or mud on slopes, which may compromise the stability of infrastructures •Flooding: the occupation of normally dry areas due to sudden water accumulation, either from river overflow or coastal flooding •Wildfires: uncontrolled fire spread in forested or wild land areas, affecting surrounding vegetation, flora, and fauna •Intense rainfall, snow, or hail that may impact infrastructure and operations •Cyclones: low-pressure systems with intense rains and strong winds that can cause significant damage In 2026, efforts related to branches, ATMs and facilities will be focused exclusively on ensuring the operational continuity of the properties, prioritizing maintenance, preservation and minor improvements necessary to keep the infrastructure in optimal operating condition and no projects with material scope are planned. We expect to invest approximately COP 63,552 million in the refurbishing of owned and leased properties. Our total premises and equipment for own use had a net book value as of December 31, 2025, of COP 2,410,891 million and the book value of right of use assets related to branches and rented offices amounts to COP 1,281,175 million. Banistmo, presents premises and equipment for own use net of COP 90,536 million and the book value of right of use assets related to branches and rented offices amounts to COP 188,545 million. The following table provides information on our main owned and leased facilities where administrative activities, banking business activities, and data processing center operations take place: Building / Facility Location Area (square meters) Dirección General (Torre Norte, Torre Sur and Torre Oriente and Ciudad del Río) Medellín, Colombia 117,118 Torre Atrio Bogotá, Colombia 21,084 Niquía Bello, Colombia 4,070 Edificio 9211 Bogotá, Colombia 9,578 Torre Barranquilla Barranquilla, Colombia 8,801 Twins Bay 1 Cartagena, Colombia 2,866 Sucursal 8111 Bogotá, Colombia 679 Banca Personas Cali Cali, Colombia 3,379 Sucursal Centro Comercial Santa Fe Bogotá, Colombia 425 Gerencia de Zona Bucaramanga Bucaramanga, Colombia 1,869 During 2025, in the ordinary course of business, we entered into new lease agreements for properties used in branch operations and self-service halls, resulting in an approximate increase of COP 32,996 million in the right-of-use asset. Notable among these new agreements are properties located in Colombia, which represented an increase in the right-of-use asset by approximately COP 19,135 million. For further information relating to our branch network, see Item 4. Information on the Company, B5. Distribution Network. Accounting recognition for premises and equipment are described in Note 2 'Significant Accounting Policies' and Note 10 'Premises and Equipment, Net' to the Consolidated Financial Statements. E.SELECTED STATISTICAL INFORMATION The following information should be read together with the Consolidated Financial Statements as well as Item 5. Operating and Financial Review and Prospects. This information has been prepared based on our financial records, which are prepared in accordance with IFRS as issued by the IASB and the related interpretations issued by the IFRIC. The consolidated selected statistical information refer to us, including all subsidiaries. E.1DISTRIBUTION OF ASSETS, LIABILITIES AND STOCKHOLDERS’ EQUITY; INTEREST RATES AND INTEREST DIFFERENTIAL Average balances for each of the years ended December 31, 2025, 2024 and 2023 have been calculated as the arithmetic average of the last 13 monthly IFRS balances. In addition, the interest rate subtotals are based on the weighted average of domestic and foreign assets and liabilities. Average statement of financial position The following tables show, for the years ended December 31, 2025, 2024 and 2023, respectively: (i) average balances for all of our assets and liabilities; (ii) interest earned and interest paid amounts; and (iii) average nominal interest rates/yield for our interest-earning assets and interest-bearing liabilities. For the year 2025, the average balances of all of our assets and liabilities, as well as the amounts of interest earned and interest paid, include the effects of the classification of Banistmo S.A. as an asset held for sale since December 18, 2025. Average statement of financial position and income from interest-earning assets for the fiscal year ended December 31,(2) 2025(1) 2024 2023 Average balance Interest income earned Average Yield / Rate Average balance Interest income earned Average Yield / Rate Average balance Interest income earned Average Yield / Rate In millions of COP, except percentages ASSETS Interest-earning assets Interbank borrowings Domestic activities 163,720 9,373 5.73 % 98,288 8,507 8.66 % 91,258 10,028 11.00 % Foreign activities 2,049,202 91,368 4.46 % 3,197,413 199,984 6.25 % 2,981,291 187,279 6.30 % Total 2,212,922 100,741 4.55 % 3,295,701 208,491 6.33 % 3,072,549 197,307 6.40 % Reverse repurchase agreements and other similar secured loans Domestic activities 3,245,865 143,663 4.43 % 4,343,154 284,814 6.56 % 2,676,670 292,971 10.90 % Foreign activities 34,754 1,137 3.27 % 96,642 15,401 15.94 % 73,920 11,777 15.90 % Total 3,280,619 144,800 4.41 % 4,439,796 300,215 6.76 % 2,750,590 304,748 11.10 % Debt instruments(3) Domestic activities 20,819,348 1,582,154 7.60 % 15,172,478 1,144,392 7.54 % 10,599,721 1,376,246 13.00 % Foreign activities 10,101,857 512,596 5.07 % 15,663,891 1,189,523 7.59 % 16,826,459 281,213 1.70 % Total 30,921,205 2,094,750 6.77 % 30,836,369 2,333,915 7.57 % 27,426,180 1,657,459 6.00 % Loans and advances to customers, net Domestic activities 192,434,712 24,263,989 12.61 % 178,959,009 25,309,441 14.14 % 172,515,187 27,947,473 16.20 % Foreign activities 56,154,842 4,972,013 8.85 % 87,001,331 7,304,110 8.40 % 89,986,484 7,293,314 8.10 % Total 248,589,554 29,236,002 11.76 % 265,960,340 32,613,551 12.26 % 262,501,671 35,240,787 13.40 % Total interest-earning assets Domestic activities 216,663,645 25,999,179 12.00 % 198,572,929 26,747,154 13.47 % 185,882,836 29,626,718 15.90 % Foreign activities 68,340,655 5,577,114 8.16 % 105,959,277 8,709,018 8.22 % 109,868,154 7,773,583 7.10 % Total 285,004,300 31,576,293 11.08 % 304,532,206 35,456,172 11.64 % 295,750,990 37,400,301 12.60 % Total non-interest-earning assets Domestic activities 24,551,716 - - 20,705,057 - - 23,428,476 - - Foreign activities(4) 62,058,763 - - 23,959,853 - - 24,158,685 - - Total 86,610,479 - - 44,664,910 - - 47,587,161 - - Total interest and non-interest earnings assets Domestic activities 241,215,361 25,999,179 10.78 % 219,277,986 26,747,154 12.20 % 209,311,312 29,626,718 14.20 % Foreign activities(4) 130,399,418 5,577,114 4.28 % 129,919,130 8,709,018 6.70 % 134,026,839 7,773,583 5.80 % Total 371,614,779 31,576,293 8.50 % 349,197,116 35,456,172 10.15 % 343,338,151 37,400,301 10.90 % (1)The accumulated value as of December 31, 2025 includes the effects of the classification of Banistmo S.A. as an asset held for sale since December 18, 2025. For more information, see Note 1. Reporting Entity, Note 2.D12. Significant Accounting Policies - Assets Held for Sale and Discontinued Operations, and Note 31. Discontinued Operation. (2)Our average total assets and total liabilities and stockholder's equity were calculated considering the last 13 monthly IFRS balances. (3)Tax-exempt income of tax-exempt investment securities has not been calculated on a tax equivalent basis because the effect of such calculation would not be material. (4)The percentage of total average assets attributable to foreign activities was 35.1%, 37.2% and 39.0%, respectively, for the fiscal years ended December 31, 2025, 2024 and 2023. Average statement of financial position and interest paid on interest-bearing liabilities for the fiscal year ended December 31(2) 2025(1) 2024 2023 Average balance Interest income earned Average Yield / Rate Average balance Interest income earned Average Yield / Rate Average balance Interest income earned Average Yield / Rate In millions of COP, except percentages LIABILITIES AND STOCKHOLDERS’ EQUITY Interest-bearing liabilities: Checking accounts Domestic activities 23,927,038 21,270 0.09 % 22,466,429 23,764 0.11 % 22,001,228 22,131 0.10 % Foreign activities 13,531,155 93,466 0.69 % 17,357,904 81,415 0.47 % 18,432,636 68,657 0.40 % Total 37,458,193 114,736 0.31 % 39,824,333 105,179 0.26 % 40,433,864 90,788 0.20 % Saving accounts Domestic activities 97,619,091 2,498,147 2.56 % 83,711,882 2,676,437 3.20 % 79,151,508 3,463,957 4.40 % Foreign activities 23,699,277 531,486 2.24 % 27,779,679 463,925 1.67 % 29,694,615 395,108 1.30 % Total 121,318,368 3,029,633 2.50 % 111,491,561 3,140,362 2.82 % 108,846,123 3,859,065 3.50 % Time deposits Domestic activities 64,039,718 5,965,943 9.32 % 60,786,003 6,880,218 11.32 % 54,810,787 7,586,429 13.80 % Foreign activities 28,248,027 1,219,213 4.32 % 44,402,637 2,089,914 4.71 % 42,637,064 1,787,234 4.20 % Total 92,287,745 7,185,156 7.79 % 105,188,640 8,970,132 8.53 % 97,447,851 9,373,663 9.60 % Repurchase agreements and other similar secured borrowing Domestic activities 1,890,926 151,329 8.00 % 1,068,567 45,253 4.23 % 968,917 160,766 16.60 % Foreign activities 323,032 9,507 2.94 % 226,752 17,641 7.78 % 54,757 6,968 12.70 % Total 2,213,958 160,836 7.26 % 1,295,319 62,894 4.86 % 1,023,674 167,734 16.40 % Borrowings from other financial institutions(3) Domestic activities 5,173,286 465,515 9.00 % 5,662,586 669,512 11.82 % 5,645,529 798,977 14.20 % Foreign activities 4,826,075 360,946 7.48 % 8,518,466 680,401 7.99 % 11,769,294 860,019 7.30 % Total 9,999,361 826,461 8.27 % 14,181,052 1,349,913 9.52 % 17,414,823 1,658,996 9.50 % Interbank deposits(3)(4) Domestic activities 73,448 16,713 22.75 % - 2,958 - % 71,595 11,260 15.70 % Foreign activities - 35 - % 639,639 19,348 3.02 % 723,898 19,280 2.70 % Total 73,448 16,748 22.80 % 639,639 22,306 3.49 % 795,493 30,540 3.80 % Debt instruments in issue Domestic activities 2,191,337 237,165 10.82 % 3,211,356 591,122 18.41 % 4,602,387 895,296 19.50 % Foreign activities 5,808,472 445,158 7.66 % 11,248,144 610,990 5.43 % 12,856,710 531,319 4.10 % Total 7,999,809 682,323 8.53 % 14,459,500 1,202,112 8.31 % 17,459,097 1,426,615 8.20 % Lease liability Domestic activities 1,147,601 98,607 8.59 % 1,105,501 95,481 8.64 % 987,982 71,808 7.30 % Foreign activities 179,074 12,507 6.98 % 703,013 40,065 5.70 % 802,540 42,007 5.20 % Total 1,326,675 111,114 8.38 % 1,808,514 135,546 7.49 % 1,790,522 113,815 6.40 % Total interest-bearing liabilities Domestic activities 196,062,445 9,454,689 4.82 % 178,012,324 10,984,745 6.17 % 168,239,933 13,010,624 7.70 % Foreign activities 76,615,112 2,672,318 3.49 % 110,876,234 4,003,699 3.61 % 116,971,514 3,710,592 3.20 % Total 272,677,557 12,127,007 4.45 % 288,888,558 14,988,444 5.19 % 285,211,447 16,721,216 5.90 % Total non-interest bearing liabilities Domestic activities 17,096,243 - - 16,624,159 - - 15,982,833 - - Foreign activities 38,711,644 - - 2,947,687 - - 3,298,036 - - Total 55,807,887 - - 19,571,846 - - 19,280,869 - - Stockholders' equity Domestic activities 35,566,709 - - 32,207,927 - - 29,371,732 - - Foreign activities 7,562,626 - - 8,528,785 - - 9,474,103 - - Total 43,129,335 - - 40,736,712 - - 38,845,835 - - Total interest and non-interest bearing liabilities and stockholders’ equity(5) Domestic activities 248,725,401 9,454,689 3.80 % 226,844,411 10,984,745 4.84 % 213,594,498 13,010,624 6.10 % Foreign activities(5) 122,889,378 2,672,318 2.17 % 122,352,705 4,003,699 3.27 % 129,743,653 3,710,592 2.90 % Total 371,614,779 12,127,007 3.26 % 349,197,116 14,988,444 4.29 % 343,338,151 16,721,216 4.90 % (1)The accumulated value as of December 31, 2025 includes the effects of the classification of Banistmo as an asset held for sale since December 18, 2025. For more information, see Note 1. Reporting Entity, Note 2.D12. Significant Accounting Policies - Assets Held for Sale and Discontinued Operations, and Note 31. Discontinued Operation. (2)Our average of total assets and total liabilities and stockholder's equity were calculated considering the last 13 monthly IFRS balances. (3)Includes both short-term and long-term borrowings. (4)Includes borrowings from banks located outside Colombia. (5)The percentage of foreign activities over total average liabilities attributable was 35.1%, 36.9% and 39.5%, respectively, for the fiscal years ended December 31, 2025, 2024 and 2023. Changes in net interest income and expenses- volume and rate analysis The following table allocates, for domestic and foreign activities, changes in our net interest income to changes in average volume, changes in nominal rates and the net variance caused by changes in both average volume and nominal rate for the year ended December 31, 2025 compared with the year ended December 31, 2024; and the year ended December 31, 2024, compared with the year ended December 31, 2023. Volume and rate variances have been calculated based on movements in average balances over the period and changes in nominal interest rates on average interest-earning assets and average interest-bearing liabilities. Net changes attributable to changes in both volume and interest rate have been allocated to the change due to changes in volume. December 31, 2025(1)-December 31, 2024 December 31, 2024-December 31, 2023 Increase (decrease) due to changes in: Increase (decrease) due to changes in: Volume Rate Net Change Volume Rate Net Change In millions of COP Interest-earning assets Interbank borrowings Domestic activities 1,762 (896) 866 867 (2,388) (1,521) Foreign activities (60,357) (48,259) (108,616) 13,513 (808) 12,705 Total (58,595) (49,155) (107,750) 14,380 (3,196) 11,184 Reverse repurchase agreements and other similar secured loans Domestic activities (61,729) (79,422) (141,151) (22,904) 14,747 (8,157) Foreign activities (6,365) (7,899) (14,264) 3,621 3 3,624 Total (68,094) (87,321) (155,415) (19,283) 14,750 (4,533) Debt instruments(2) Domestic activities 429,066 8,696 437,762 (8,116,489) 7,884,635 (231,854) Foreign activities (349,933) (326,994) (676,927) (18,060) 926,370 908,310 Total 79,133 (318,298) (239,165) (8,134,549) 8,811,005 676,456 Loans and advances to customers, net Domestic activities 2,375,393 (3,420,845) (1,045,452) 1,099,138 (3,737,170) (2,638,032) Foreign activities (2,756,961) 424,864 (2,332,097) (134,170) 144,966 10,796 Total (381,568) (2,995,981) (3,377,549) 964,968 (3,592,204) (2,627,236) Total interest-earning assets Domestic activities 2,744,492 (3,492,467) (747,975) (7,039,388) 4,159,824 (2,879,564) Foreign activities (3,173,616) 41,712 (3,131,904) (135,096) 1,070,531 935,435 Total (429,124) (3,450,755) (3,879,879) (7,174,484) 5,230,355 (1,944,129) Interest-bearing liabilities: Checking accounts Domestic activities 1,713 (4,207) (2,494) 474 1,159 1,633 Foreign activities (10,533) 22,584 12,051 (3,702) 16,460 12,758 Total (8,820) 18,377 9,557 (3,228) 17,619 14,391 Saving accounts Domestic activities 885,310 (1,063,600) (178,290) 214,206 (1,001,726) (787,520) Foreign activities (50,634) 118,195 67,561 (23,282) 92,099 68,817 Total 834,676 (945,405) (110,729) 190,924 (909,627) (718,703) Time deposits Domestic activities 396,543 (1,310,818) (914,275) 1,051,429 (1,757,640) (706,211) Foreign activities (708,971) (161,730) (870,701) 76,300 226,380 302,680 Total (312,428) (1,472,548) (1,784,976) 1,127,729 (1,531,260) (403,531) Repurchase agreements and other similar secured borrowing Domestic activities 49,198 56,878 106,076 18,507 (134,020) (115,513) Foreign activities 17,524 (25,658) (8,134) 12,180 (1,507) 10,673 Total 66,722 31,220 97,942 30,687 (135,527) (104,840) Borrowings from other financial institutions Domestic activities (54,181) (149,816) (203,997) 2,421 (131,886) (129,465) Foreign activities (278,560) (40,895) (319,455) (270,890) 91,272 (179,618) Total (332,741) (190,711) (523,452) (268,469) (40,614) (309,083) Interbank deposits Domestic activities 13,755 — 13,755 (3,523) (4,779) (8,302) Foreign activities (9,648) (9,665) (19,313) (409) 477 68 Total 4,107 (9,665) (5,558) (3,932) (4,302) (8,234) Debt instruments in issue Domestic-activities (154,081) (199,876) (353,957) (258,246) (45,928) (304,174) Foreign-activities (1,103,175) 937,343 (165,832) (52,660) 132,331 79,671 Total (1,257,256) 737,467 (519,789) (310,906) 86,403 (224,503) Lease liability Domestic-activities 3,614 (488) 3,126 9,165 14,508 23,673 Foreign-activities (39,515) 11,957 (27,558) (6,840) 4,898 (1,942) Total (35,901) 11,469 (24,432) 2,325 19,406 21,731 Total interest-bearing liabilities Domestic-activities 1,141,871 (2,671,927) (1,530,056) 1,034,433 (3,060,312) (2,025,879) Foreign-activities (2,183,512) 852,131 (1,331,381) (269,303) 562,410 293,107 Total (1,041,641) (1,819,796) (2,861,437) 765,130 (2,497,902) (1,732,772) (1)The accumulated value as of December 31, 2025 includes the effects of the classification of Banistmo as an asset held for sale since December 18, 2025. For more information, see Note 1. Reporting Entity, Note 2.D12. Significant Accounting Policies - Assets Held for Sale and Discontinued Operations, and Note 31. Discontinued Operation. (2)Tax-exempt income of tax-exempt investment securities has not been calculated on a tax equivalent basis because the effect of such calculation would not be material. Interest -earning assets-net interest margin and spread The following table presents our levels of average interest-earning assets and net interest income and illustrates the comparative net interest margin and interest spread obtained for the fiscal years ended December 31, 2025, 2024 and 2023, respectively. Interest earning assets yield for the fiscal Year ended December 31, 2025(1) 2024 2023 In millions of COP, except percentages Total average interest-earning assets Domestic activities 216,663,645 198,572,929 185,882,836 Foreign activities 68,340,655 105,959,277 109,868,154 Total 285,004,300 304,532,206 295,750,990 Net interest income(2) Domestic activities 16,544,490 15,762,409 16,616,094 Foreign activities 2,904,796 4,705,319 4,062,991 Total 19,449,286 20,467,728 20,679,085 Average yield on interest-earning assets Domestic activities 12.00 % 13.47 % 15.94 % Foreign activities 8.16 % 8.22 % 7.08 % Total 11.08 % 11.64 % 12.65 % Net interest margin(3) Domestic activities 7.64 % 7.94 % 8.94 % Foreign activities 4.25 % 4.44 % 3.70 % Total 6.82 % 6.72 % 6.99 % Interest spread(4) Domestic activities 7.18 % 7.30 % 8.21 % Foreign activities 4.67 % 4.61 % 3.90 % Total 6.63 % 6.45 % 6.78 % (1)The accumulated value as of December 31, 2025 includes the effects of the classification of Banistmo as an asset held for sale since December 18, 2025. For more information, see Note 1. Reporting Entity, Note 2.D12. Significant Accounting Policies - Assets Held for Sale and Discontinued Operations, and Note 31. Discontinued Operation. (2)Net interest income is interest income on loans less interest expense and includes interest earned on investments, as presented in the previous table “Average statement of financial position”. (3)Net interest margin is net interest income divided by total average interest-earning assets. (4)Interest spread is the difference between the average yield on interest-earning assets and the average rate accrued on interest-bearing liabilities. E.2INVESTMENT PORTFOLIO DEBT INSTRUMENTS PORTFOLIO MATURITY The following table summarizes the maturities and weighted average nominal yields of our debt instruments at amortized cost and debt instruments at fair value through other comprehensive income as of December 31, 2025: Maturity less Maturity between Maturity between Maturity More than 1 year 1 and 5 Years 5 and 10 Years Than 10 Years Total yield Yield %(1) Yield %(1) Yield %(1) Yield %(1) Yield %(1) Securities issued or secured by: Foreign currency.-denominated(2): Colombian Government 6.10 % 5.99 % 6.63 % - % 6.13 % Other financial entities 5.68 % 5.89 % 4.77 % - % 5.65 % Foreign Governments 3.58 % 5.69 % 5.71 % 5.95 % 5.10 % Corporate bonds - % 5.03 % 4.52 % 6.57 % 4.93 % Subtotal yield 4.00 % 5.28 % 4.78 % 6.53 % 5.04 % Securities issued or secured by: Peso-denominated(2) Other financial entities 12.14 % 15.79 % 26.48 % - % 19.45 % Corporate bonds - % 12.29 % - % 18.79 % 14.95 % Colombian Government 9.52 % - % - % - % 9.52 % Other Government entities 5.58 % - % 9.13 % - % 5.63 % Subtotal yield 7.15 % 12.44 % 17.77 % 18.79 % 8.44 % Total yield 6.93 % 6.78 % 5.49 % 14.72 % 7.10 % (1)Yield was calculated using the internal rate of return (IRR) as of December 31, 2025, includes the effects of Banistmo's classification as asset held for sale since December 18, 2025. For more information see Consolidated Financial Statements, Note 1. Reporting Entity, Note 2.D.12 Material Accounting Policies - Assets held for sale and discontinued operations and Note 31. Discontinued Operation. (2)Yields on tax-exempt obligations have not been calculated on a tax equivalent basis because the effect of such calculation would not be material. E.3LOAN PORTFOLIO Maturity of loans and advances to customers The following table shows the maturities of our loan portfolio as of December 31, 2025: In one year or less After one year through five years After five years through 15 years After 15 years Total In millions of COP Commercial Corporate 20,753,064 33,460,016 19,965,253 1,828,625 76,006,958 SME 4,070,363 8,539,793 1,060,389 186,436 13,856,981 Others 12,878,463 17,705,008 18,311,380 869,132 49,763,983 Total commercial 37,701,890 59,704,817 39,337,022 2,884,193 139,627,922 Consumer Credit card 39,952 10,351,902 2,088,614 3,451 12,483,919 Vehicle 136,130 2,704,055 1,955,420 365 4,795,970 Payroll loans 2,209,043 1,812,470 2,800,720 12,514 6,834,747 Others 3,007,927 19,959,456 5,451,660 219,867 28,638,910 Total consumer 5,393,052 34,827,883 12,296,414 236,197 52,753,546 Mortgage VIS 19,358 300,678 3,002,419 9,851,053 13,173,508 Non-VIS 801,434 683,013 7,694,010 12,064,407 21,242,864 Total mortgage 820,792 983,691 10,696,429 21,915,460 34,416,372 Financial Leases 2,283,462 8,690,954 13,328,370 4,190,343 28,493,129 Small Business Loan 53,098 987,314 20,720 1,880 1,063,012 Total gross loans and advances to customers 46,252,294 105,194,659 75,678,955 29,228,073 256,353,981 In general, the initial term of a loan will depend on the type of guarantee or collateral, the credit history of the borrower and the purpose of the loan. As of December 31, 2025, 59.08% of our loan portfolio had a maturity of five years or less. Loans interest rate allocation The following table shows the interest rate allocation of our loan portfolio by type due after one year and within one year or less: As of December 31, 2025 In millions of COP Loans with term of 1 year or more: Variable Rate Domestic-denominated 101,354,974 Commercial 76,800,325 Consumer 5,632,930 Mortgage 7,241 Financial Leases 18,914,478 Small business loan - Foreign-denominated 10,828,935 Commercial 6,179,840 Consumer 3,437,749 Mortgage 14,243 Financial Leases 15,006 Small business loan 1,182,097 Total 112,183,909 Fixed Rate Domestic-denominated 80,339,377 Commercial 9,965,789 Consumer 34,273,740 Mortgage 983,453 Financial Leases 7,086,676 Small business loan 28,029,719 Foreign-denominated 17,578,401 Commercial 8,980,078 Consumer 4,016,075 Mortgage 4,977 Financial Leases 193,507 Small business loan 4,383,764 Total 97,917,778 Loans with term of less than 1 year: Domestic-denominated 33,466,415 Commercial 30,189,409 Consumer 907,889 Mortgage 46,350 Financial Leases 2,277,133 Small business loan 45,634 Foreign-denominated 12,785,879 Commercial 7,512,481 Consumer 4,485,163 Mortgage 6,748 Financial Leases 6,329 Small business loan 775,158 Total 46,252,294 Total gross loans and advances to customers 256,353,981 E.4SUMMARY OF LOAN LOSS EXPERIENCE Allowance for credit losses to total loans The following table shows the allowance for credit losses to total loans outstanding for the years ended December 31, 2025 and 2024: Year ended December 31, 2025 2024 Allowance for credit losses to total loans. 5.17 % 5.79 % The loss allowance for the loan portfolio and financial leasing operations decreased to 5.17% in 2025 from 5.79% in 2024. For more information see Note 6. Loans and advances to customers, net. This decrease is attributable to: The allowance for expected credit losses decreased compared to the prior year, primarily driven by the overall improvement in the credit performance of all portfolios compared to 2024. This improvement is evidenced by a reduction in past-due indicators, with loans past due more than 30 days decreasing from 5.20% in 2024 to 3.95% in 2025, and loans past due more than 90 days declining from 3.85% to 2.96% over the same period. Consequently, a lower proportion of exposures was classified under Stage 2 and Stage 3, reflecting a reduction in credit risk deterioration. In addition with the reclassification of Banistmo in 2025 both the loan and the allowance balance decreased. However, if the reclassification had not been made the ratio of allowance to loans would have been even lower in 2025 because of the high percentage of collateralized loans in Banistmo. For more information on the classification of Banistmo S.A. as an asset held for sale please refer to Note 1. Reporting Entity, Note 2.D.12 Material Accounting Policies - Assets held for sale and discontinued operations and Note 31. Discontinued Operation. For more information on the variation in the Provision for impairment of loan portfolio and financial leasing operations over the client loan portfolio from 2024 to 2023, please refer to Note 6 of the Consolidated Financial Statements, "Loans And Advances to Customers, Net," under "Loans and financial leasing operating portfolio and Allowance for loans losses" and "Impact of movements in the value of the portfolio and loss allowance by Stage" as well as the "Risk management" note in the "Credit risk" section. Ratio of charge-offs to average outstanding loans The ratio of charge-offs to average outstanding loans for the years ended December 31, 2025 and 2024 was as follows: Year ended December 31, 2025 2024 Ratio of charge-offs to average outstanding loans 2.28 % 2.95 % Commercial 0.88 % 0.68 % Consumer 8.33 % 11.67 % Mortgage 0.19 % 0.37 % Financial Leases 0.95 % 0.83 % Small Business Loan 3.42 % 8.60 % The decrease in the charge‑off ratio in 2025 compared with the prior year is mainly attributable to the reduction in the nonperforming consumer loan portfolio throughout the period, supported by lower roll rates and enhanced recovery management effectiveness. E.5DEPOSITS Uninsured deposits An uninsured deposit is any deposit that does not have a mechanism to protect and secure the depositor’s resources (either natural or legal person) in the event of insolvency or settlement of any financial institution. The amount of uninsured deposits for 2025 and 2024 is COP 189,722,405 and COP 190,359,916, respectively. The following table shows the time deposits held by us as of December 31, 2025 and 2024, unsecured: At December 31, 2025 Unsecured Peso -Denominated Unsecured Foreign Exchange- Denominated Total In millions of COP Up to 3 months 21,456,254 10,775,018 32,231,272 From 3 to 6 months 9,461,473 7,056,727 16,518,200 From 6 to 12 months 4,101,153 6,886,199 10,987,352 More than 12 months 12,933,262 1,529,356 14,462,618 Total time deposits 47,952,142 26,247,300 74,199,442 At December 31, 2024 Unsecured Peso - Denominated Unsecured Foreign Exchange- Denominated Total In millions of COP Up to 3 months 17,810,529 10,773,646 28,584,175 From 3 to 6 months 7,967,231 6,678,490 14,645,721 From 6 to 12 months 5,179,422 8,418,227 13,597,649 More than 12 months 15,895,727 1,545,271 17,440,998 Total time deposits 46,852,909 27,415,634 74,268,543 For further information about deposits by customers, see Consolidated Financial Statement, Note 15. Deposits by customers. F.Unresolved Staff Comments None.