A.[Reserved] B.Capitalization and Indebtedness Not applicable. C.Reasons for the Offer and Use of Proceeds Not applicable. 9 Table of Contents Presentation of certain financial and other information Accounting Principles The Consolidated Financial Statements for the years ended December 31, 2025 and 2024, and our Consolidated Statements of Income, Consolidated Statements of Comprehensive Income, Consolidated Statements of Changes in Equity and Consolidated Statements of Cash Flows for the years ended December 31, 2025, 2024 and 2023, and related notes included in this Annual Report have been prepared in accordance with IFRS as issued by the IASB as well as the interpretations issued by the IFRS-IC. All data included in this report has been prepared in accordance with IFRS as issued by the IASB, except for the data included in Item 4. B.7 Competition, which has been prepared in accordance with the local generally accepted accounting practices of each subsidiary. Our Consolidated Financial Statements include entities that we control, directly or indirectly. See Item 4. Information on the Company – C. Organizational Structure for a summary of the organizational structure of Cibest Corporate Group and certain subsidiaries involved in financial or capital markets. Currencies Our Consolidated Financial Statements are presented in Colombian pesos, which is our functional currency and the presentation currency for the Consolidated Financial Statements. The Consolidated Financial Statements and amounts as of December 31, 2025 and 2024, and for the three fiscal years ended December 31, 2025, 2024 and 2023, contained in this Annual Report are expressed in millions or billions of pesos (where indicated), except earnings per share, diluted earnings per share and the exchange rate, which are stated in units of Colombian pesos, while other currencies (dollars, euro, pounds, etc.) are stated in thousands. This Annual Report translates certain peso amounts into U.S. dollars at specified rates solely for the convenience of the reader. Unless otherwise indicated, the exchange rate used in this Annual Report is indicated in Note 2.D Material Accounting Policies, section 1. Functional currency, transactions and balances in foreign currency. Rounding Discrepancies Certain monetary amounts, percentages and other figures included in this Annual Report have been subject to rounding. Accordingly, figures shown as totals in certain tables may not be the arithmetic aggregation of the figures that precede them, and figures expressed as percentages in the text may not total 100% or, as applicable, when aggregated may not be the arithmetic aggregation of the percentages that precede them. Websites We maintain a website at http://www.grupocibest.com/. In addition, certain of our subsidiaries referred to in this Annual Report maintain separate websites. For example, Bancolombia maintains a website at https://www.grupobancolombia.com/Bancoagrícola and Bam maintain websites at http://www.bancoagricola.com/ and https://www.bam.com.gt/, respectively. Information included on or accessible through our website or the website of any of the subsidiaries is not incorporated into this Annual Report or the filing. All references in this Annual Report to these and other websites are inactive textual references to these URLs, or 'uniform resource locators', and are for reference only. D.Risk Factors Investors should consider the following risks and uncertainties along with the other factors presented in this Annual Report when evaluating the report's forward-looking statements, any document incorporated by reference, our future public filings or press releases, or future oral statements made by us, our officers or other people acting on our behalf. If any of the following risks occur, our business, operating results and financial condition, as well as our ability to raise capital and access funding, could be materially and adversely affected, and, we could suffer possible reputational damage. These risk factors should not be considered a complete list, and the headings below do not indicate that a given risk applies only to the heading under which it is located. Summary of Risk Factors 10 Risk factors relating to Colombia and other countries where we operate •Changes in economic and political conditions in the countries where we operate, may adversely affect our financial condition and operating results. •The countries where we operate are vulnerable to external effects, such as economic difficulties experienced by major regional trading partners or general contagion from economic or geopolitical shocks, which could have a material adverse effect on economic growth in these countries and their ability to service their public debt. •Colombia and El Salvador have experienced several periods of violence and instability that could affect those economies and our business. •Any additional taxes resulting from changes to tax regulations or the interpretations of tax regulations in the countries where we operate could adversely affect our results. •Allegations of corruption against the governments, politicians and the private sector in the countries where we operate could create economic and political uncertainty and could expose us to additional credit risk. Risk factors relating to our subsidiaries' business and the banking industry •We are subject to credit risk, and estimating our exposure involves economic projections and financial estimates and availability, quality and timeliness of information may affect our exposure to credit risk. •We are subject to risks from concentration in our loan portfolio. Problems with one or more of our largest borrowers may adversely affect our financial condition and operating results. •The value of our loan collateral may be insufficient to cover the outstanding principal and interest. In addition, we may be unable to realize the full value of the collateral in the event of default. •Downgrades in our or our subsidiaries' credit ratings would increase our cost of borrowing funds and make it more difficult for us or our subsidiaries to raise new funds, attract deposits or renew maturing debt. •Changes in banking regulations in Colombia and in other jurisdictions where we operate could adversely affect our results. •Our operating results are sensitive to fluctuations in interest rates. •We are subject to market risk and the income from our proprietary trading activities is highly volatile. •We have significant exposure to sovereign risk, especially in Colombia, the United States, El Salvador, Guatemala and Panama. Our results could be adversely affected by decreases in the value of our sovereign debt instruments. •We are subject to credit, market, liquidity and operational risks associated with other banking businesses, including securities investments and derivatives transactions. •We are subject to regulatory inspections, examinations, inquiries and audits in Colombia and in other countries where we operate. Any sanctions, fines and other penalties resulting from such inspections, examinations, inquiries or audits could materially and adversely affect our business, financial condition, operating results and reputation. •We are subject to the U.S. Foreign Account Tax Compliance Act of 2010 and the OECD’s Automatic Exchange of Information - Common Reporting Standard (CRS). •The tax haven regulations in the countries where we operate could adversely affect our business and financial results. •Our financial results may be negatively affected by changes to accounting standards. •We face risks relating to regulatory compliance in general and, in particular, with respect to laws relating to anticompetitive practices, consumer protection and protection of personal data. •Future restrictions on interest rates or banking fees could negatively affect our profitability. •Our results could be adversely affected by high levels of inflation. •Our activities may be interrupted or affected by external factors, such as climate change and its effect on weather and natural disasters. •We are exposed to environmental, social, governance and sustainability risks that could affect our financial condition and operating results. •Our ability to attract and retain specialized talent, and the lack of professional training in the areas where we operate, could affect our business objectives, operating results and financial condition. •We may be exposed to increased costs and liabilities in the event of the failure of our service providers to perform their obligations under key services contracts. •Our businesses rely heavily on data collection, processing and storage systems, the failure of which could materially and adversely affect the effectiveness of our risk management, reputation and internal control system as well as our financial condition and operating results. •Risks relating to the use of quantitative models and information may adversely impact our business strategies and results. •We are subject to a wide range of information security and cybersecurity incidents that can have a material adverse effect on our business. •Acquisitions and strategic alliances may not perform as expected or may disrupt our operations and adversely affect our profitability. •We are subject to increasing competition in the rapidly evolving financial services industry, and may face challenges in the adoption of emerging technologies, such as artificial intelligence, which could result in competitive disadvantage and may adversely affect our operating results. •We are subject to operational risks and losses. •Our financial results may be negatively affected by changes to assumptions supporting the value of our goodwill. •Digital misinformation could adversely affect our reputation as well as our operating and financial results. •Our policies and procedures may not be able to detect money laundering, terrorism financing, corruption or other illegal or improper activities fully or on a timely basis. Risk factors relating to our financial holding company structure •We may not succeed in implementing our strategy to take advantage of, or we may fail to realize the anticipated benefits of, our financial holding company structure. •As a holding company, Grupo Cibest depends on limited forms of funding to fund its operations. Risk factors relating to Grupo Cibest’s Preferred Shares and ADSs •Preemptive rights may not be available to holders of ADRs evidencing ADSs. •Exchange rate fluctuations may adversely affect the Colombian economy, the market price of Grupo Cibest’s ADSs, and the dividends payable to holders of Grupo Cibest’s ADSs. •Grupo Cibest’s Preferred Shares have limited voting rights. •Holders of Grupo Cibest’s ADSs may encounter difficulties in the exercise of dividend and voting rights. •Relative illiquidity of the Colombian securities markets may impair the ability of an ADS holder to sell Preferred Shares. •Changes in Colombia’s tax regime may affect the tax treatment of ADSs. Risk factors relating to Colombia and other countries where we operate Changes in economic and political conditions in the countries where we operate, may adversely affect our financial condition and operating results. Our financial condition, operating results and asset quality depend on the macroeconomic and political conditions in Colombia, El Salvador, Guatemala and Panama. An economic slowdown or contraction, inflation, shifts in economic policy, or changes in judicial interpretation of exchange controls could affect the overall business climate and negatively impact our financial performance and results. Other risk factors in these countries include currency depreciation, interest rate fluctuation, changes in taxation and banking laws and regulations, and other political or economic developments. The governments of Colombia, El Salvador, Guatemala and Panama have historically exercised substantial influence on their economies and may, in the future, take steps that could affect our businesses and operating results, market conditions and the prices and rates of return on securities issued by local issuers (including Grupo Cibest's securities). Potential changes in laws, public policies and regulations could create instability in these countries and their respective markets. Future developments in government policies could negatively affect our business, financial and commercial condition, as well as the market value of Grupo Cibest's securities. It is likely that these risks will become more significant in the coming years, due to election 'pendulum swings,' political polarization, increasing global tensions, international conflicts, dissatisfaction with government and growing social discontent. This combination of factors could lead to greater instability and political risks in the medium term than in the recent past. Colombia In Colombia, significant uncertainty remains with respect to the GDP outlook, reflecting, among other factors, the outcome of the March 2026 congressional elections and upcoming presidential elections in May 2026. Inflation could prove more persistent than anticipated due to a 23% increase in the minimum wage, indexation effects, supply-side shocks, or external pressures. In response to inflationary pressures and economic performance, the Central Bank increased its benchmark monetary policy rate by 100 basis points to 10.25% in January 2026, reversing its prior policy of maintaining lower interest rates. Further tightening of monetary policy, or the persistence of elevated interest rates, could adversely affect economic activity, borrowing costs and financial conditions. Additionally, measures taken by the Colombian government under the declaration of an economic emergency, along with reforms in sectors such as labor, healthcare, and public services, will continue to introduce uncertainty for the private sector, potentially adversely impacting business and consumer confidence. Concerns over fiscal sustainability and potential disruptions in capital markets may further dampen investment dynamics, posing downside risks to GDP growth. A sustained decline in private investment to an almost two-decade low poses a risk to Colombia's long-term economic growth, which in turn could undermine future fiscal revenue expansion and compromise fiscal consolidation efforts. In 2025, two credit rating agencies that rate Colombia's sovereign debt downgraded Colombia's long-term foreign currency rating to BB rating (non-investment grade) which highlights these challenges, emphasizing the persistent high cost to the government of its debt interest payments, elevated fiscal deficits, and Colombia's continued reliance on commodities. As Colombia approaches the end of the current government term and the start of electoral campaigns, additional regulatory initiatives are expected. Some of these measures could conflict with Colombia's existing constitutional and legal framework, creating regulatory uncertainty and potential impacts on legal stability in certain sectors, including financial services. Even initiatives presented as temporary could result in adverse financial effects. El Salvador El Salvador faces multiple economic risks, including a slowdown in growth from 2.8% in 2025 to approximately 2.5% in 2026 due to weaker external demand, amid stable global growth and persistent international trade tariff tensions. Inflationary pressures could resurface, driven by adverse weather conditions and potential fuel price increases under the U.S. administration. The country’s high reliance on remittances (23% of GDP) makes El Salvador vulnerable to shifts in U.S. immigration policy, while the current account deficit, which fell from 1.9% in 2024 to 1.2% in 2025 but is projected to widen again to 1.5% of GDP in 2026, and limited access to capital markets pose external financing challenges. El Salvador continues to face medium-term challenges with its public finances, and the fiscal outlook is uncertain. While government action and an agreement with the International Monetary Fund (IMF) provided some fiscal relief and reduced the risks of sovereign default, public spending remains high, and the fiscal deficit stood at around 3.0% of GDP in 2025. This fiscal uncertainty has reduced El Salvador’s access to capital markets, making it dependent on capital flows from multilateral organizations and other countries. Adding to this pressure is the country’s B‑ credit rating, which reflects persistent concerns over fiscal and debt sustainability. Achieving long-term fiscal sustainability is El Salvador's biggest economic challenge, and while the government has made efforts to reduce debt, the fiscal deficit is expected to remain high in the medium term. Guatemala Guatemala faces structural risks due to its high dependence on remittances, more than 90% of which come from the United States. While the economy’s recent performance (3.8% GDP growth in 2025) has been moderately better than expected, driven by strong remittance flows, changes in U.S. migration policies could negatively impact remittances going forward. A weakening of the U.S. labor market or a potential slowdown of the U.S. economy could also negatively affect Guatemala’s GDP for 2026, as could the effects of protectionist measures by the U.S. on Guatemalan exports and foreign investment. Panama Tensions between China and the United States, as well as conflicts in Ukraine and in the Middle East, including the recent military action in Iran by the United States and Israel, may adversely impact global trade and flow through the Panama Canal in the medium term, posing a significant risk to Panama’s economy. This risk is heightened by the stance of the U.S. administration on China, which could lead to trade restrictions or geopolitical tensions that further reduce transit through the canal. In the short term, uncertainty persists over the closure of the Cobre Panamá copper mine, which halted copper exports in November 2023, leading to an increase in the trade deficit that was only partially offset by growth in service exports. In addition, despite President José Raúl Mulino’s commitment to fiscal consolidation, progress may be constrained by weak tax revenues and structural rigidity in public spending. The countries where we operate are vulnerable to external effects, such as economic difficulties experienced by major regional trading partners or general contagion from economic or geopolitical shocks, which could have a material adverse effect on economic growth in these countries and their ability to service their public debt. A significant decline in economic growth or a sustained economic downturn in the regional trading partners of Colombia, El Salvador, Guatemala or Panama could have a material adverse impact on foreign trade, remittance flows, and foreign direct investment in the four countries and a decrease in their economic growth. Similarly, lower growth in countries with close economic ties, such as the European Union, the United States, China and other Latin American countries in the case of Colombia, and the United States and the European Union in the case of Guatemala, El Salvador and Panama, could also have a material adverse impact. Additionally, any deterioration in the economic and political conditions of neighboring countries could adversely affect the economies of Colombia, El Salvador, Guatemala and Panama, and cause instability and disrupt their commercial or diplomatic relationships. Any future tensions could lead to political and economic uncertainty, instability, market volatility, low confidence levels and heightened risk aversion among investors and market participants, which could adversely affect economic activity in any of those countries. In a global context, on April 2, 2025, U.S. President Donald Trump announced new tariffs on imports into the United States. These tariffs include a 'baseline' tariff of 10% on imports from many countries, including Colombia. More recently, in February 2026, the U.S. Supreme Court held that certain tariffs imposed under the International Emergency Economic Powers Act (IEEPA) were beyond the President's statutory authority, vacating significant components of the tariff regime and reinforcing that tariff-setting power resides with Congress. While the decision has limited the legal basis for the broad emergency tariffs originally imposed, legal and policy uncertainty remains as the U.S. administration has signaled its intentions to pursue alternative statutory authorities to re-impose or raise global tariffs to 15% and may enact across-the-board levies under other provisions of U.S. trade law. The imposition of these tariffs may have significant adverse effects on global trade, which could have a material adverse effect on Colombia's economy, trade balance, and key industries, including its banking industry. Because a significant portion of Colombia's exports are directed to the United States, it is vulnerable to changes in U.S. trade policy. Higher tariffs could reduce demand for Colombia's goods in the United States, disrupt supply chains, and lead to job losses in affected industries. Additionally, retaliatory measures by other nations could exacerbate economic uncertainty, impacting investor confidence and foreign direct investment, and countries facing even higher tariff rates could decide to sell excess products into the Colombian market, adversely affecting Colombian producers. The tariffs may also contribute to global trade tensions and volatility in currency markets, which could put pressure on exchange rates and inflation. See "Risk factors relating to Colombia and other countries where we operate - Changes in economic and political conditions in the countries where we operate, may adversely affect our financial condition and operating results." Recent global geopolitical fragmentation has led to decreased capital flows to emerging economies and heightened volatility in commodity prices, particularly oil. Inflation trends have already been affected, especially in El Salvador, Guatemala and Panama, and this effect may persist. In addition, the escalation of geopolitical tensions, including the conflict between Russia and Ukraine and the frictions in the Middle East, including the recent military action in Iran by the U.S. and Israel, and growing disputes between China and the U.S. could further disrupt global trade, continue to generate uncertainty and volatility in international markets. In addition, Panama Ports Company has started international arbitration proceedings against Panama after Panama’s Supreme Court annulled its licenses to operate two Panama Canal ports. These developments may lead to restrictions on commodity supplies, driving up energy and food prices. Tighter monetary policies and financial conditions could weigh on global economic growth. Higher interest rates may also trigger capital outflows, leading to depreciation of currencies such as the Colombian peso and the Guatemalan quetzal, increased domestic interest rates and renewed inflationary pressures. In addition, ongoing political and economic instability in Venezuela continues to pose additional regional risks, potentially amplifying volatility and affecting economic conditions across neighboring markets. On January 3, 2026, the United States conducted a military intervention in Venezuela, and captured Nicolas Maduro. While the impact of these developments in Venezuela remains to be seen as of the date of this Annual Report, their effects could result in additional uncertainty, which could have a negative impact on Colombia's economy, including fluctuations in oil prices, potential regime transition volatility, civil unrest, and a further breakdown of the rule of law. A worsening of this crisis could trigger unprecedented migration flows into Colombia, straining local public infrastructure and labor markets, while simultaneously escalating cross-border security threats from non-state armed groups. These factors may result in supply chain disruptions, increased operational costs, and heightened currency volatility, all of which could materially and adversely affect our financial condition and operating results. The expectation of global economic slowdown and the possibility of persistently high interest rates could create periods of volatility and risk aversion. This environment would exacerbate financial stress, particularly in emerging economies, which remain highly sensitive to capital flows. It is reasonable to expect that public debt service payments will remain historically high. The combination of low economic growth and high interest rates represents a short-term risk, particularly in Colombia and El Salvador, where the main challenge will be managing public finances and generating enough tax revenue to meet spending goals in 2026 and beyond. Events in markets where we do not operate may also affect us, for example by causing international investors to have an increased risk perception of the entire region or class of investment, which could negatively affect market prices and liquidity of securities issued or held by Grupo Cibest. These factors could have a material adverse impact on economic growth and fiscal stability in the countries where we operate, and could negatively affect our business, financial and commercial condition, as well as the market value of Grupo Cibest's securities. Colombia and El Salvador have experienced several periods of violence and instability that could affect those economies and our business. Colombia has experienced periods of criminal violence over the past five decades, primarily due to the activities of guerilla groups and drug cartels. In recent years, the security situation has deteriorated, with rising violence linked to criminal organizations and armed groups. The government has lost control over certain territories, and coca cultivation areas have expanded significantly, while efforts at eradication have decreased. The government has implemented a peace treaty with the Revolutionary Armed Forces of Colombia (FARC), while negotiations with several other rebel groups are stalled. If there is an escalation of violence or drug-related crime, it could lead to a downgrade of sovereign ratings, higher funding costs, lower foreign investment and economic slowdown. In El Salvador, rising violence led the Legislative Assembly to adopt exceptional measures on March 27, 2022, granting certain powers to the Executive Branch and suspending four constitutional guarantees. The suspension of these constitutional guarantees has been extended 48 times, with the most recent extension lasting from February 1, 2025, to March 31, 2026. Any additional taxes resulting from changes to tax regulations or the interpretations of tax regulations in the countries where we operate could adversely affect our results. Uncertainty related to tax legislation represents a constant risk for us. Changes in legislation, regulation, and developments resulting from judicial decisions, could affect our tax burden by increasing tax rates and fees, creating new taxes, limiting deductions and exemptions, and eliminating incentives and untaxed income. We do not take aggressive positions on tax law interpretation. However, the national or local tax authorities could apply tax law in a way that we do not expect, which could result in tax audits, litigation and associated costs, and could negatively affect our results. Allegations of corruption against the governments, politicians and the private sector in the countries where we operate could create economic and political uncertainty and could expose us to additional credit risk. Allegations of corruption against the governments, politicians and the private sector in the countries where we operate could create economic and political uncertainty. For example, findings, convictions or allegations of illicit conduct, including by government officials, could have adverse effects on the political and economic stability of the countries where we operate. Investigations, public allegations, and restrictive measures adopted by foreign authorities, including agencies such as the Office of Foreign Assets Control (OFAC) of the United States Department of the Treasury, against high-ranking government officials, their relatives, or close associates may increase political and legal volatility in the countries where we operate. In October 2025, the President of Colombia, Gustavo Francisco Petro Urrego was included in the Specially Designated Nationals List (SDN List) under Executive Order 14059, together with members of his immediate family and a close associate. These measures, which result in the blocking of assets under U.S. jurisdictions and the prohibition of transactions with designated persons or entities, may negatively impact the institutional stability of Colombia, perception of country risk and our business by depressing business volumes or reducing our ability to recover amounts we have lent to persons or projects involved in illicit or allegedly illicit conduct. Risk factors relating to our subsidiaries' business and the banking industry We are subject to credit risk, and estimating our exposure involves economic projections and financial estimates and availability, quality and timeliness of information may affect our exposure to credit risk. Several of our products expose us to credit risk. These products include loans, financial leases, guarantees, financial derivatives and lending commitments. We establish credit risk reserves and determine expected credit loss based on established methodologies that incorporate economic projections, available borrower information, and estimates of borrower repayment capacity. Although our risk rating systems are designed to appropriately reflect credit exposure and are supported by internal controls and governance mechanisms intended to ensure data quality, model performance and process integrity, these methodologies may be subject to variations as a result of availability, quality, and/or timeliness of the information used, which may, in turn, influence decision-making. In addition, third-party infrastructure limitations may affect the timeliness or accuracy of our identification of changes to the risk profile of certain clients, which may increase our exposure to credit risk. If we are unable to effectively control the level of non-performing or poor credit quality loans in the future, or if our loan loss reserves are insufficient to cover future loan losses, our financial condition and results may be materially and adversely affected. The amount of our non-performing loans could increase in the future as a result of factors beyond our control, such as changes in the payment capacity of our borrowers, increases in inflation or interest rates, the impact of macroeconomic trends and political events, climate change or events affecting specific industries, affecting Colombia and other jurisdictions in which we operate. Any of these developments could have a negative effect on the quality of our loan portfolio, requiring us to increase provisions for loan losses resulting in reduced profits or in losses. We are subject to risks from concentration in our loan portfolio. Problems with one or more of our largest borrowers may adversely affect our financial condition and operating results. As of December 31, 2025, the aggregate outstanding principal amount of Grupo Cibest’s 20 largest economic groups, on a consolidated basis, represented 119.4% of Grupo Cibest’s Tier 1 Capital and 18.0% of the total loan portfolio. The largest individual exposure accounted for 2.1% of our loan portfolio. Problems with one or more of our largest borrowers could materially and adversely affect our operating results and financial position. The value of our loan collateral may be insufficient to cover the outstanding principal and interest. In addition, we may be unable to realize the full value of the collateral in the event of default. Our loan collateral primarily includes real estate, owned assets used for financial leasing transactions and other assets that are located primarily in Colombia, El Salvador, Guatemala and Panama, the value of which may significantly fluctuate or decline due to factors beyond our control. These can include market factors, environmental risks, macroeconomic factors and political events affecting the local economy. In addition, we may face difficulties in enforcing our rights as a secured creditor. Delays, procedural problems and local protectionism may make foreclosures and enforcement of judgments difficult. Any decline in the value of the collateral securing our loans may result in a reduction in the recovery from collateral realization and may have an adverse impact on our operating results and financial condition. Downgrades in our or our subsidiaries' credit ratings would increase our cost of borrowing funds and make it more difficult for us or our subsidiaries to raise new funds, attract deposits or renew maturing debt. Our and our subsidiaries' credit ratings are an important component of our liquidity profile. Our ability to successfully compete in the banking industry depends on our and our subsidiaries' credit ratings. A downgrade in our, or in any of our subsidiaries' credit ratings would increase the cost of raising funds, potentially result in additional collateral requirements and reduce demand for our securities among institutional investors. Our ability to renew maturing debt could become restricted and the terms for such renewal could become more expensive. Our lenders and counterparties in derivative transactions are also sensitive to the risk of a credit rating downgrade. A downgrade in our or our subsidiaries' credit ratings could negatively affect market perceptions of our financial strength and reduce our ability to attract deposits. This, in turn, could weaken our competitive position in attracting deposits and originating loans. On December 16, 2025, Fitch downgraded Colombia's long-term foreign currency rating from BB+ to BB and revised the outlook from negative to stable. Similarly, in June 2025, Standard & Poor's downgraded Colombia's long‑term foreign currency rating from BB+ to BB and maintained a negative outlook, while Moody's downgraded the sovereign rating from Baa2 to Baa3 and changed the outlook to stable. Both agencies pointed to persistent fiscal deterioration, higher debt and interest burdens, and a challenging policy environment as key drivers. In line with the sovereign ratings, the agencies revised Colombian banks' credit ratings in 2025. Fitch affirmed the BB+ ratings of Bancolombia and Grupo Cibest throughout the year but reduced their outlooks to negative in March, and returned them to stable in December, leaving both entities rated above the sovereign's BB level. S&P lowered the ratings of both Bancolombia and Grupo Cibest following its sovereign downgrade, in line with its practice of not rating Colombian financial institutions above the foreign currency sovereign. Moody's downgraded Bancolombia's long-term deposit and counterparty ratings in June 2025 in response to the sovereign downgrade, while it left Grupo Cibest's ratings unchanged. Changes in banking regulations in Colombia and in other jurisdictions where we operate could adversely affect our results. Banking laws and regulations, or their official interpretation in Colombia and other jurisdictions in which we operate, have a material effect on our business and operations. Banking laws and regulations may change frequently, and changes may be adopted, enforced or interpreted in a manner that may have an adverse effect on our business. In Colombia, Decree 1474 of December 2025, issued under the economic emergency declared by Decree 1390 of 2025, introduced an additional 15% income tax surcharge applicable to financial institutions, increasing the aggregate corporate income tax burden to 50% for fiscal year 2026. The decree also established new taxes applicable to the oil and gas and mining sectors, increased wealth tax rates, and raised Value‑Added Tax (VAT) rates for certain goods, including alcoholic beverages and tobacco products. However, the economic emergency decree (Decree 1390 of 2025), which provided the Government with temporary legislative powers to enact these measures, has been provisionally suspended by the Colombian Constitutional Court as part of the automatic judicial review applicable to emergency legislation. As a result, Decree 1474 of 2025 is currently not producing legal effects, pending a final decision by the Constitutional Court on the constitutionality of the emergency declaration and the related implementing measures. Decree 150 of February 2026, which is also subject to judicial review by the Colombian Constitutional Court, declared a new state of economic, social and ecological emergency in certain regions of the country and empowered the Government to adopt extraordinary and temporary measures to address the impacts of an exceptional rainy season affecting eight departments. The emergency framework authorizes the issuance of legislative decrees that include, among others, adjustments to wealth tax rates, the implementation of credit relief and guarantee programs, modifications to the operation of mandatory investment schemes, the reinstatement of certain VAT measures previously introduced under Decree 1474 of 2025, and the establishment of new credit‑related mechanisms aimed at facilitating credit origination and providing financial relief in the affected regions. Additionally, while the Constitutional Court has not yet completed the judicial review of the pension reform approved in 2024 in Colombia, if this law is enacted, it would redirect a substantial share of mandatory contributions from private pension funds to the public pillar administered by Colpensiones. As private pension funds are the largest institutional investors in Colombia, this reallocation would significantly reduce the assets under their management and, consequently, their participation in the local capital markets, which may result in risks to financial stability and funding sources for the capital markets where we participate. The Ministry of Finance submitted for public comment a decree on the mandatory open finance system in Colombia. This decree will establish an open data framework in accordance with Law 2294 of 2023 (National Development Plan) and may result in regulatory arbitrage against banking institutions, which would be required to share their data with other financial institutions. As a result, banks would be placed at a competitive disadvantage, as they would not be able to access or benefit from the data of other financial institutions during the initial phase in which only their own data must be disclosed. Resolution 10 of 2025 issued by the National Commission for Agricultural Credit (CNCA) in Colombia, introduces new specific requirements for the substitutive agricultural investments that banks may use in place of the mandatory investments. These changes could increase the proportion of the agricultural credit portfolio allocated to mandatory investments, which generally yield lower returns. In 2025, the government launched a public initiative to modify how financial services are provided through local banking correspondents, a channel that has supported financial inclusion and access to products and services in Colombia for over two decades, where Bancolombia has maintained nationwide leadership. This initiative could lead to a new regulatory framework that may require a reassessment of the operating and financial model used by Bancolombia. Our operating results are sensitive to fluctuations in interest rates. We hold a substantial portfolio, including loans, deposits, securities, bonds, long-term debt and short-term borrowings and derivatives such as swaps that have both fixed and floating interest rates. Therefore, changes in interest rates could adversely affect our net interest margins, the value of the debt instruments, as well as the profitability of the funds under our management, leading to client outflows and a reduction in our fee income, which could negatively impact our operating results; additionally it could reduce the market value of our debt instruments, leading to smaller gains or larger losses on these investments (a 100 basis point increase in interest rates could reduce the market value of the debt instruments by approximately 1.3%). Sustained high interest rates have historically discouraged customers from borrowing and have resulted in increased delinquencies in outstanding loans and deterioration in the quality of assets. On the other hand, cuts in interest rates may cause margin compression and lower net interest income, as we usually hold more assets than liabilities at variable rates. Typically, in a declining interest rate environment, prepayment activity tends to increase, reducing the weighted average maturity of our interest-earning assets and adversely affecting our operating results. Prepayment risk also has a significant adverse impact on our earnings from credit card and collateralized mortgage obligations, as prepayments could shorten the weighted average life of these assets, which may result in funding mismatches or in reinvestment of the prepayment proceeds at lower yields. In addition, these risks could materially affect our own portfolio as well as those managed by us on behalf of third parties. Consequently, any withdrawals of third-party assets could negatively impact our asset management revenues and related income streams. We are subject to market risk and the income from our proprietary trading activities is highly volatile. We are directly and indirectly affected by changes in market conditions. Market risk, or the risk of losses in positions arising from movements in market prices, is inherent in the products and instruments associated with our operations, including securities, bonds, proprietary trading in assets and liabilities, and derivatives, among others. Changes in market conditions that may affect our financial condition and operating results include fluctuations in interest rates, currency exchange rates, securities prices, and changes in the implied volatility of interest rates and foreign currency exchange rates, among others. We derive a portion of our profits from our proprietary trading activities. Income from this activity is highly volatile and depends on numerous factors beyond our control, such as the general market environment, overall market trading activity, interest rate levels, fluctuations in exchange rates, oil prices and general market volatility. A significant decline in our trading income, or the occurrence of a trading loss, could adversely affect our operating results and financial position. Therefore, we continuously monitor the level of risk and the sensitivity of portfolio value to possible changes in interest rates. As of December 2025, the modified duration of our sovereign debt proprietary trading portfolio, subject to change in interest rate, was 1.3, reflecting a moderate level of sensitivity in the value of the bonds to changes in interest rates. We have significant exposure to sovereign risk, especially in Colombia, the United States, El Salvador, Guatemala and Panama. Our results could be adversely affected by decreases in the value of our sovereign debt instruments. Our debt portfolio is primarily composed of sovereign debt securities. Therefore, our results are exposed to credit, market, and liquidity risk associated with sovereign debt and, in particular, risk associated with securities issued or guaranteed by the Colombian Government. As of December 31, 2025, our total debt instruments represented 10.28% of our total assets, and the securities issued by the governments of Colombia, the United States, Panama, Guatemala, and El Salvador represented 39.56%, 18.39%, 5.89%, 5.46%, and 4.19% respectively, of our total debt instruments. A significant decline in the value of these securities could affect our debt instruments portfolio and, consequently, our operating results and financial position. In addition, during the past year, sovereign risk associated with securities issued or guaranteed by the government of Colombia has increased. The 5-year credit default swap (CDS), credit derivative contracts that allow investors to hedge against credit risk on a company, a country or another entity, showed an increase during 2025 due to political uncertainty as well as fiscal challenges in Colombia. We are subject to credit, market, liquidity and operational risks associated with other banking businesses, including securities investments and derivatives transactions. We are exposed to credit risk arising from other banking businesses, including investing in securities, entering into derivative contracts under which counterparties have obligations to make payments to us, and executing securities or currency trades from our proprietary trading desk that fail to settle at the required time due to non-delivery by the counterparty or system failures by clearing agents, exchanges, clearing houses, or other financial intermediaries. A significant increase in exposure to any of these risks, or a significant decline in the credit quality or the insolvency of any of the counterparties, could materially and adversely affect our operating results and financial position. We engage in derivative transactions both for hedging purposes on our own account and on behalf of our customers. These transactions expose us to a variety of risks, including market risk and liquidity risk (due to the difficulty in closing out a trade prior to maturity if bid-ask spreads are too large, representing a significant cost). They also expose us to operational risk, including basis risk (the risk of loss associated with variations in the spread between the asset yield and the funding and/or hedge cost) and credit or default risk (the risk of insolvency or other inability of a counterparty to meet its obligations). Furthermore, the market practice and documentation for derivative transactions is less developed in the jurisdictions where we operate compared to other more economically developed countries, and the court systems in these jurisdictions have limited experience in dealing with issues related to derivative transactions. As a result, there are increased operating and structural risks associated with derivatives transactions in these jurisdictions. In addition, the execution and performance of derivatives transactions depend on our ability to develop adequate control and administrative systems, and to hire and retain qualified personnel. Moreover, our ability to adequately monitor, analyze and report these derivative transactions depends, to a great extent, on our information technology systems. These factors may further increase the risks associated with these transactions and could materially and adversely affect our operating results and financial position. We are subject to regulatory inspections, examinations, inquiries and audits in Colombia and in other countries where we operate. Any sanctions, fines and other penalties resulting from such inspections, examinations, inquiries or audits could materially and adversely affect our business, financial condition, operating results and reputation. We are subject to comprehensive regulation and supervision by the financial authorities of Colombia, El Salvador, Guatemala, Panama and other jurisdictions where we do business. These authorities have broad powers to adopt regulations or impose other requirements that could affect or restrict our capitalization, organization and operations. These include the imposition of anti-money laundering measures and the authority to regulate the terms and conditions under which we can extend credit. In the event of noncompliance with applicable regulations, we could face fines, sanctions or the revocation of licenses or permits to operate our business. In Colombia, for instance, if Bancolombia encounters significant financial problems or becomes insolvent or in danger of becoming insolvent, banking authorities would have the power to take over Bancolombia's management and operations. Any sanctions, fines or other penalties resulting from noncompliance with regulations in Colombia, El Salvador, Guatemala, Panama and other jurisdictions where we operate could materially and adversely affect our business, financial condition, operating results and reputation. We are subject to the U.S. Foreign Account Tax Compliance Act of 2010 and the OECD’s Automatic Exchange of Information - Common Reporting Standard (CRS). Bancolombia, Bam, Bancoagrícola and Banistmo are considered foreign financial institutions (FFIs) under the Foreign Account Tax Compliance Act of 2010 (FATCA) (See Item 4. Information on the Company – B. Business Overview – B.8. Supervision and Regulation – International regulations applicable). Additionally, Bancolombia and Banistmo are subject to reporting obligations derived from the Common Reporting Standard (CRS) Multilateral Competent Authority Agreement (MCAA) developed by the OECD. However, if these entities fail to comply with these requirements, they may be subject to withholding under FATCA or other penalties that tax authorities may impose according to their domestic regulations. Such withholding or penalties could adversely affect our operating results and financial condition. In addition, compliance with the provisions of the intergovernmental agreements (IGA), FFI agreements entered into with the IRS, the CRS-MCAA, domestic laws or any other regulations enforced in the relevant jurisdictions may increase our compliance costs. The tax haven regulations in the countries where we operate could adversely affect our business and financial results. As a result of the tax haven regulation adopted in Colombia and El Salvador, our clients who are residents of territories designated as tax havens may face: (i) Higher withholding tax rates on interest and dividends, mainly derived from investments in the securities market. (ii) Requests by the tax authorities for the disclosure of additional information for transactions with related companies. (iii) Increased probability of tax audits. Furthermore, Bancolombia, Bancolombia's Financial Subsidiaries and Banagrícola may face non-deductibility of payments made to such residents or entities, unless the required tax amount has been withheld. Any of these conditions could negatively affect our operations by increasing costs, reducing our client returns and increasing administrative burdens, impacting our profitability and relationships with clients operating in these territories. Our financial results may be negatively affected by changes to accounting standards. Our financial statements are prepared in accordance with the IFRS, issued by the IASB, as well as the interpretations issued by the IFRS-IC. Changes to the IFRS or its interpretations may cause our future reported results and financial position to differ from current expectations. Such changes may also affect our regulatory capital and financial ratios. Our management monitors potential accounting changes and, when possible, determines their potential impact, disclosing significant future changes in our consolidated financial statements that are expected to result from those changes. For further information about developments in financial accounting and reporting standards, see Note 2.F. Material accounting policies. – Recently issued accounting pronouncements. We face risks relating to regulatory compliance in general and, in particular, with respect to laws relating to anticompetitive practices, consumer protection and protection of personal data. We are subject to compliance with laws and regulations with respect to anticompetitive practices, merger control, unfair competition provisions, personal data protection and cybersecurity requirements. While we have a unit responsible for overseeing the implementation of new regulations using a risk-based approach and have developed a comprehensive data protection program to attempt to ensure compliance with personal data law, noncompliance with these laws and regulations may result in significant sanctions. We may not be able to prevent all risks associated with regulatory compliance or detect all instances of noncompliance, which could result in substantial fines and penalties, or operational restrictions, adversely affecting our operating results and damaging our reputation. Additionally, due to the nature of their financial activities, Bancolombia’s Financial Subsidiaries, Bancoagrícola, Bam and Banistmo, remain exposed to consumer protection risks under local regulatory frameworks, and noncompliance with these regulations may result in significant sanctions for those entities. Future restrictions on interest rates or banking fees could negatively affect our profitability. In the past, regulators in the jurisdictions where we operate have considered legislative and regulatory initiatives regarding limits on interest rates and banking fees. Although most such initiatives have not been adopted, there may be renewed attempts to impose or strengthen ongoing restrictions on interest rates or banking fees in the future. If we are prohibited or otherwise limited (including by limits on pricing) from continuing to charge our clients for certain products or services, including specified types of transactions, or from imposing charges for products or services that might be introduced in the future, our operating results and financial condition could be adversely affected. Our results could be adversely affected by high levels of inflation. High inflation increases the cost of funding and credit risk, while it slows the pace of loan origination and reduces the market value of our debt instruments. Inflation that is higher than the nominal interest rate can discourage savings and increase uncertainty and risk in the loan and stock markets. In Colombia, annual inflation began to decline gradually in the second quarter of 2023, dropping from 9.3% in 2023 to 5.2% in 2024, and further to 5.1% by the end of 2025. There are risks it could rebound toward levels closer to 6.0% in 2026. This level remains above the medium-term target of 3% set by the Central Bank. There are persistent risks indicating that inflation may accelerate further, driven by the 23% minimum wage increase and upward pressures on certain regulated goods and services, such as tolls. It is reasonable to expect that credit portfolio demand will remain moderate, partly due to a potential increase in interest rates by the Central Bank. In contrast, the inflationary challenge that began in 2022 has been largely addressed in El Salvador, Guatemala and Panama, and inflation in these countries has remained stable compared to 2024. CPI inflation went from 0.3% at the end of 2024 to 0.91% at the end of 2025 in El Salvador, while remaining stable at 1.7% in Guatemala and at -0.2% in Panama at the end of 2025. Therefore, 2026 could be a challenging year for financial intermediation operations, due to inflationary risk that will continue to be more pronounced in Colombia compared to other major economies in Latin America, the United States and the European Union. Our activities may be interrupted or affected by external factors, such as climate change and its effect on weather and natural disasters. In the past decade, the “El Niño” and “La Niña” have intensified, increasing the risk of extreme climate events, such as floods, landslides, wildfires, droughts, increased temperature and rising sea and river levels, among others, as well as related water scarcity, which may affect our infrastructure and business operations. The “El Niño” phenomenon is characterized by: (i) the lack of rainfall, which may drastically decrease surface waterbodies flows, affecting both freshwater use and wastewater discharges because of the reduction on dilution potential of receiving waterbodies, (ii) increased temperatures, which causes heat waves and could have a direct impact on the health of our workers and cause an increase in epidemics and diseases, and (iii) potential negative impact on energy supply due to the decrease in the level of the rivers that feed the hydroelectric generation system of the country. In addition to the “El Niño” climate phenomenon, some basins in Colombia may be affected by seasonal variability in some periods of the year (normally January to March - June to July), which could reduce water flows, affecting freshwater withdrawals and surface discharges, as mentioned previously. Furthermore, the “La Niña” climate phenomenon is characterized by increased rainfall, which can generate frequent landslides and flooding, which may cause infrastructure loses. The physical risks of climate change for some of our clients are compounded by their dependence on natural resources, exposure to biodiversity loss, impacts on critical ecosystems, and deforestation. Serious climate events or natural or manmade disasters could result in unanticipated problems that could have a material adverse effect on our and our client’s abilities to conduct business in the affected regions, particularly if those problems affect its computer-based data processing, transmission, storage and retrieval systems and destroy data. In addition, if a significant number of our and our client’s employees and managers become unavailable due to such an event or disaster, our and our client’s ability to effectively conduct business could be severely compromised. Our inability to manage the risks related to such events or disasters could negatively impact the value of our and our clients’ assets, including our buildings, branches and ATMs. With respect to our clients, these risks could negatively affect their financial health, operational results, cash flows, and ultimately, their ability to meet payment obligations. We are exposed to environmental, social, governance and sustainability risks that could affect our financial condition and operating results. Companies in the financial sector are facing significant scrutiny from a wide range of stakeholders on social, environmental, governance and sustainability issues, including climate change and diversity. This includes the role of financial institutions in providing financing to sustainability projects, in supporting sustainable business practices, and in assessing and managing nonfinancial and emerging risks including those associated with environmental and social factors. Moreover, our customers, investors, regulators, employees and other stakeholders have differing requirements, expectations, demands and perspectives on these topics, which are continuing to evolve and diverge. We may not be able to meet the differing requirements, expectations and demands of all of our stakeholders, which could harm our reputation, subject us to legal and operational risks, impact customer demand, and adversely affect our financial condition and operating results. Additionally, the regulatory environment in the jurisdictions where we operate has become more complex due to the adoption of new laws, regulations and policies that often diverge from, or conflict with each other. These developments coupled with the accelerated pace of regulatory change, increases the risks, complexity and cost of compliance. Even though we strive to monitor and update policies, processes, and reporting systems to comply with the evolving requirements and to mitigate regulatory and reputational risks, we note that our failure to comply with any applicable requirement or with regulatory expectations in any jurisdiction in which we operate, even if based on good-faith interpretations, can result in sanctions, fines, liability, reputational damage, and significant operational costs. For example, in Colombia, we are required to meet sustainability-related regulatory requirements, particularly those established in External Circular 031 of 2021 and External Circular 005 of 2024, issued by the SFC. External Circular 031 requires financial institutions to disclose climate-related financial risks and their potential impact, in line with the Sustainability Accounting Standards Board (SASB) and Task Force on Climate-Related Financial Disclosures (TCFD) frameworks, while Circular 005 focuses on the management and disclosure of environmental, social, governance and sustainability risks arising from exposure to investment portfolios managed by third parties, where we may have limited control over investment decisions but may still face financial, regulatory or reputational risks. Similarly, NPR-53 applies in El Salvador, Agreement 11-2022 in Panama, and Law 68-86 in Guatemala, each with specific obligations for ESG risk management. Conversely, in the U.S. and other jurisdictions, there has been an increase in regulatory scrutiny on corporate and diversity related initiatives, which has led and is likely to continue to lead to new laws, regulations and policies seeking to limit, discourage or prohibit such initiatives. Our ability to attract and retain specialized talent, and the lack of professional training in the areas where we operate, could affect our business objectives, operating results and financial condition. Our constantly evolving business model requires talent with creativity, innovation and flexibility to keep up with technological advances and the growing demand for new products and services. The skills of our employees, the competitiveness and talent of our team, and the management of our culture and work processes are essential for our long-term success. Since our strategic objectives depend largely on our human capital, any shortfall in skills, whether due to the difficulty in attracting and retaining highly qualified professionals, the lack of professional training in the areas where we operate, or the loss of key employees, could translate into reduced efficiency and a limited capacity to adapt quickly to market changes. In this regard, financial holding companies and institutions, including Grupo Cibest, face challenges identifying and retaining workers for positions that require highly developed and specialized knowledge. We may be exposed to increased costs and liabilities in the event of the failure of our service providers to perform their obligations under key services contracts. We enter into contracts with third parties who provide certain key services that are essential to the evolution of our business. These services include core banking services, online banking platforms, data and payment processing services, clearing and settlement services, software for processing credit and debit card transactions and technological infrastructure, among others. Our primary risk with service providers stems from potential operational disruptions, failures, or capacity limitations arising from our reliance on these external providers for critical components of our systems. In October 2025, a third-party service provider experienced a disruption in a region where certain of Bancolombia’s services are hosted. The disruption resulted from a failure in the provider’s internal systems responsible for coordinating information across services and led to delays and connectivity issues. As a result, more than 100 of Bancolombia’s digital services were impacted, including payments, collections, and transfers. In the same month, Bancolombia also experienced a general interruption in the connectivity of one if its data centers caused by a software error in the equipment responsible for managing the data center’s network, which simultaneously affected certain of Bancolombia’s digital and physical services. In February 2026, Bancolombia experienced a service interruption during a planned migration of certain services from its principal data center to an alternate data center. Issues with the replication of information between the two data centers and a subsequent failure at the principal data center, related to an authorization system component operated by a third-party provider, resulted in the intermittent or complete unavailability of certain physical and digital banking services, including payment, transfer and digital banking platforms, for approximately two days. The disruption limited customers’ ability to carry out certain transactions and access banking services and resulted in a significant volume of customer complaints during the period of service interruption. While we conduct due diligence before engaging service providers and monitor their business continuity plans, as well as their cybersecurity and data protection measures, we do not control their operations. If any of our key service providers fail to meet their contractual obligations or cause service disruptions (including failure to handle current or increased transaction volumes, inadequate service performance, or failure to comply with applicable laws and regulations), there can be no assurance that we will succeed in attracting and retaining the human resources necessary for the success of our businesses or in limiting cost increases from wages and other employee benefits, which could reduce the profitability of our businesses. In addition, we may incur significant additional costs in securing substitute service providers. The unavailability of services provided by some technologies and other service providers could result in the interruption of services on certain channels through which our customers conduct transactions until a substitute provider is engaged, which could result in lost revenue, additional costs and, potentially, adverse regulatory consequences and reputational harm. Our businesses rely heavily on data collection, processing and storage systems, the failure of which could materially and adversely affect the effectiveness of our risk management, reputation and internal control system as well as our financial condition and operating results. All of our principal businesses are highly dependent on the ability to timely collect and process a large amount of financial and other information at our various digital and physical channels across numerous markets, at a time when transaction processes have become increasingly complex and volumes have increased. The proper functioning of financial control, accounting or other data collection and processing systems is critical to our businesses and to our ability to compete effectively. While we conduct simulations to ensure business continuity and disaster recovery in the event of a system failure or cybersecurity attack, and have measures in place to control vulnerabilities, there can be no guarantee that these measures will successfully eliminate or substantially mitigate the risk associated with any failure of our data collection, processing or storage systems. A partial or complete failure of any of these systems could materially and adversely affect our decision-making, risk management and internal control systems, the quality of our service, and our ability to respond to rapidly changing market conditions. A system disruption or slowdown could also cause information, including data related to customer requests and other client information, to be lost, compromised or delivered to clients with delays or errors. While Bancolombia, Fiduciaria Bancolombia and Valores Bancolombia have experienced third-party service disruptions, these disruptions have not compromise our data security. Any failure of data collection, processing, storage or management systems could result in loss of business, additional costs and regulatory penalties (including fines and penalties by regulators) that could materially and adversely affect our business, financial condition, reputation and operating results. Risks relating to the use of quantitative models and information may adversely impact our business strategies and results. We rely on analytical models to manage financial and nonfinancial risks and to support critical internal processes. However, these models are inherently subject to limitations and uncertainty and may not perform as expected, particularly under changing market, macroeconomic, behavioral or regulatory conditions. Model risk may arise from potential errors in design, implementation, or use, as well as from the quality, completeness, or governance of data inputs. Furthermore, our increasing adoption of advanced technologies, including generative artificial intelligence (GenAI), introduces additional complexities, such as challenges in explainability, potential algorithmic bias, the risk of inaccurate or inconsistent outputs, and the risk of misuse or misinterpretation by users. Failures in these models could lead to inaccurate risk assessment and decision-making, resulting in financial losses, increased regulatory scrutiny or supervisory remediation requirements, or reputational harm. Reliance on flawed models may adversely impact critical operations, including strategic planning, position valuation, stress testing, capital adequacy measurement, client asset management, the accuracy of public disclosures, and compliance with regulatory requirements. While we attempt to address these risks through governance frameworks and validation processes, model risk remains inherent to our operations. We are subject to a wide range of information security and cybersecurity incidents that can have a material adverse effect on our business. As we continue to evolve our business model towards an open finance ecosystem, leveraging emerging technologies like the Application Programming Interfaces (APIs) and Artificial Intelligence (AI), we face growing challenges and risks, especially related to information security and cybersecurity. Cybercriminals could use AI, particularly generative AI (GenAI), to create sophisticated content for malicious purposes, including advanced cyberattacks, automated fraud, manipulation of financial markets, operational disruptions, manipulation of digital assets, and information leakage, as well as risk arising from inadequate data management that could lead to incorrect decision-making. Emerging risks such as the increased incidence of supply chain attacks, the exploitation of vulnerabilities in third-party systems, and the evolution of ransomware toward more disruptive models continue to affect our business. Our dependence on critical software vendors, cloud services and security tools can concentrate risk and amplify the impact of an external breach or disruption. Interruptions or failures in third-party systems caused by lack of supply or poor quality of the contracted services, among other factors, could further adversely affect our business as well as our clients. Ransomware campaigns have incorporated double and triple extortion tactics, combining encryption, exfiltration, and public or regulatory pressure, faster lateral movement and the deletion of backups, increasing the likelihood of material disruptions, remediation costs, and reputational exposure. Our security measures may also be breached due to human error, malfeasance, fraud or malice by our employees, accidental technological failures, system errors or vulnerabilities, or other irregularities. Rapid technological obsolescence, coupled with dynamic advancements such as quantum computing, can generate new vulnerabilities and compromise existing cryptographic schemes. Preparing for post-quantum scenarios demands high costs, operational complexity, and potential temporary impacts on our customers' experience. In this context, coordination with strategic partners and suppliers is essential to maintain consistent levels of operational resilience. Should these risks materialize, they could adversely and materially affect our business, financial condition, and operating results. In particular, we could face disruptions in the provision of critical financial services, incur significant economic losses, confront legal and compliance risks related to data protection, operational resilience, and reporting to authorities and counterparties, and we could experience reputational damage and a loss of customer and investor confidence that could affect our competitive position. We could also incur significant increases in operating and capital expenditures to implement additional security measures, hire specialized talent, and transition to post-quantum cryptographic controls. We also operate digital businesses, which are fundamental to our diversification and growth strategy. The operation and expansion of these businesses involve significant risks associated with technological integration, cybersecurity, operational continuity, and compliance with regulatory requirements that are constantly evolving. These processes create additional challenges for our operations, including those related to risk management and information technology systems, as well as adjustments to standards, controls, procedures, and policies. They may also affect the customer experience and our ability to retain personnel with specialized knowledge, in addition to exposing us to external factors such as rapid technological evolution, the emergence of new competitors, and potential risk scenarios that may impact cybersecurity, all of which may delay or reduce the achievement of expected benefits. Our strategy, operating results and financial condition could be materially affected by cybersecurity risks and future material incidents. A failure to comply with our cybersecurity policies, procedures or controls, employee misconduct, or human, governance or technological errors could also jeopardize our ability to protect ourselves against cyberattacks. For further information, see Item 16 k. Cybersecurity. Acquisitions and strategic alliances may not perform as expected or may disrupt our operations and adversely affect our profitability. We are exposed to financial risks if the value of our acquisitions, joint ventures or strategic alliances decline. In particular, we hold a 50% stake in Compañía de Financiamiento Tuya S.A., which experienced a recovery in 2025, driven by improved business performance, compared with the impairment losses that adversely affected our financial results for 2024. Future declines in the value of our investments could negatively impact our financial condition and operating results. See “Risk factors relating to our subsidiaries' business and the banking industry - Our financial results may be negatively affected by changes to assumptions supporting the value of our goodwill”. We are subject to increasing competition in the rapidly evolving financial services industry, and may face challenges in the adoption of emerging technologies, such as artificial intelligence, which could result in competitive disadvantage and may adversely affect our operating results. We operate in a highly competitive environment, and management expects an increase in competition in jurisdictions where we operate. Intensified merger activity in the financial services industry has resulted in larger, better capitalized and more geographically diverse firms that can offer a wider array of financial products and services to segments of clients similar or the same as those we provide services to. In addition, the consolidation of financial technology companies (fintechs) and unregulated financial intermediaries (shadow banking), may increase our competitive risks as their digital‑first business models could allow them to offer products and services at more competitive prices. During 2026, we expect Bre-B, the Colombian Central Bank’s instant payment system, to be fully consolidated, allowing interoperable payments and transfers that work with 'keys', unique identifiers that are linked to a bank account. We expect this will result in wider financial inclusion and lower costs associated with cash management. While Bancolombia and Nequi have secured a portion of such keys and underlying customers, failure to maintain these customers in the future who could migrate their keys to other competitors could jeopardize our market leadership and market share. In addition, the implementation of instant payment systems such as Bre-B may increase our exposure to fraud, which may result in us being required to issue refunds to customers or incur additional losses as a result of unauthorized transactions, which could have an adverse impact on our operating results. In addition, we continue to face the risk that existing or potential competitors accelerate the adoption of potentially disruptive innovations using artificial intelligence, optimizing their operations, personalizing their customer service and increasing their efficiency. Our ability to maintain our competitive position, and our business, depends on: (i) fulfilling new customers’ needs through the development of new products and services; (ii) strengthening our customer base through cross-selling and deepening relationships with customers in our existing portfolio, thereby remaining the primary bank of our customers; (iii) continuing our digital and technological transformation to support growth while gaining productivity and efficiency; and (iv) attracting and retaining talent. A failure to achieve any of these goals could adversely impact our operations. We are subject to operational risks and losses. We are exposed to operational risks that include fraud by employees or third parties, human error, inadequate process definition and technical failures that have impacted and could in the future affect the availability of services or result in improper processing of transactions. Internal fraud, in particular, refers to intentional acts of misconduct by employees, such as misappropriation of assets, manipulation or leakage of financial information, corruption, or unauthorized actions that violate established policies. These incidents not only cause financial losses but can also damage our reputation and negatively affect the trust of our stakeholders. The financial sector is particularly vulnerable to the risk of fraud due to the accelerated digital transformation, the growth in transaction volumes and the development of new forms of fraud, all of which become a challenge for operational risk management. We depend on an extensive network of suppliers to do business, and any failures or weaknesses in these suppliers or an inability to manage their risks could result in increased costs, compromised confidential information and a decline in the quality or continuity of our products and services. Given customers’ increasing demands to migrate from the physical to the digital world, we aim to offer a stronger value proposition through digital channels, the design of new business models and the adoption of new technologies and systems. However, these new technologies and business models may introduce new risks or amplify existing ones. Our financial results may be negatively affected by changes to assumptions supporting the value of our goodwill. We test the goodwill of our operating segments for impairment at least annually. The impairment test requires management to make assumptions regarding estimated earnings, discount rates, and long-term growth rates affecting the goodwill associated with each operating segment, as well as estimates of the carrying amounts of the operating segments to which the goodwill relates. Additionally, the impairment test requires management to analyze the macroeconomic and political environment of the geographies in which each cash-generating unit (CGU) is located. If actual results in future periods deviate from the earnings and other assumptions on which the impairment testing is based, the value of the goodwill in any one or more of our businesses may become impaired in the future, resulting in expense charges. In December 2025, Grupo Cibest entered into an agreement to sell Banistmo and the assets and liabilities of this entity were classified as held for sale as of December 31, 2025. Upon classification as held for sale, the assets and liabilities were measured at the lower of their carrying value or fair value less costs to sell. This resulted in a goodwill impairment allocated to Banistmo (Banking Panama Discontinued Operation) of COP 5,022,822 million during 2025. No impairment charges were recorded in prior periods, as the previous annual impairment testing indicated that the value in use of the reporting unit exceeded its carrying amount based on projected future cash flows from continuing operations. For further information, see Note 1. Reporting entity, Note 2. D and E to the consolidated financial statements, material accounting policies, use of estimates and judgments and Note 12. Goodwill and intangible assets, net. Digital misinformation could adversely affect our reputation as well as our operating and financial results. We are subject to the risk of digital misinformation and the possibility of false news (either fabricated or misleading) about us being disseminated in the media and/or social media, which could increase negative sentiment towards us and negatively affect the trust of customers and other stakeholders. The growth of digital connectivity has made it easier for content to spread quickly through social media. In 2025, Bancolombia had a strong digital presence, reaching approximately 31 million users, and 499.000 mentions of Bancolombia by users on social media, which is significant among financial institutions in Colombia. Given this level of exposure, certain online mentions have been used to attempt fraud or disseminate misleading information, including in connection with service disruption reported at Bancolombia in February 2026, when inaccurate public reports regarding the security of customer funds circulated widely, amplifying reputational risk. Similar events could negatively affect our business, market share and operating results. Our policies and procedures may not be able to detect money laundering, terrorism financing, corruption or other illegal or improper activities fully or on a timely basis. We are subject to anti-money laundering and anti-terrorism, related laws and regulations in the jurisdictions in which we operate. These requirements mandate the adoption and enforcement of 'Know Your Counterpart’ and 'Know Your Customer’ policies and procedures, as well as the reporting of suspicious transactions to the relevant authorities. Notwithstanding these requirements, our policies, procedures and internal controls may not be effective in all instances to prevent violations or regulatory breaches. We are subject to anti-corruption laws and regulations, including the U.S. Foreign Corrupt Practices Act and Colombian regulations on transnational bribery, domestic bribery and others forms of corruption. While the system is designed to detect and prevent corrupt behavior, it does not eliminate the risk of corrupt practices. Financial crime and the surrounding regulation landscape are continually evolving. As a result, we may not be able to identify, investigate and report suspicious activities fully or on a timely basis. Noncompliance with applicable laws and regulations may expose us to fines, penalties, or operational restrictions. Furthermore, our reputation and ability to conduct business could be negatively affected if we fail to effectively prevent and address instances of money laundering, terrorism financing, corruption, or other unlawful activities. Risk factors relating to our financial holding company structure We may not succeed in implementing our strategy to take advantage of, or we may fail to realize the anticipated benefits of, our financial holding company structure. We were established as a new financial holding company in May 2025 pursuant to completion of the Corporate Structure Changes. See "Explanatory Note." The realization of the anticipated benefits of the new holding company structure could be blocked, delayed or reduced by many factors, some of which may be outside of our control. These factors include: •difficulties in successfully predicting, designing or implementing any new or enhanced risk management operations and controls or information technology systems, personnel, policies or procedures required by the Corporate Structure Changes; •failure to leverage the holding company structure to realize operational efficiencies; •difficulties in reorganizing personnel, networks and administrative functions; •restrictions under applicable financial conglomerates regulations and other regulations on transactions between the holding company and, or among, its subsidiaries; and unforeseen contingent risks relating to the Corporate Structure Changes that may become apparent in the future. As a holding company, Grupo Cibest depends on limited forms of funding to fund its operations. We do not have significant assets other than the shares of our subsidiaries. Our primary sources of funding and liquidity are the dividends from our subsidiaries, sales of interests in our subsidiaries and direct borrowings and issuances of equity or debt securities at the holding company level. The ability to meet our obligations to our direct creditors and employees, satisfy our other liquidity needs and regulatory requirements and pay dividends on our Common and Preferred Shares depends on timely and adequate dividend distributions from our subsidiaries and the ability to sell our securities or obtain credit from its lenders. Adverse developments at our subsidiaries therefore would have a magnified effect on our liquidity and solvency. The ability of our subsidiaries, including Bancolombia, to pay dividends to us depends on their financial condition and operating results and may be subject to regulatory restrictions under applicable law. Our subsidiaries may enter into agreements, such as credit agreements with lenders or indentures relating to senior or subordinated debt instruments, that impose restrictions on their ability to make distributions to us, and the terms of future obligations and the operation of Colombian law could prevent our subsidiaries from making sufficient distributions to allow us to make payments on our outstanding obligations. Any delay in receipt of or shortfall in payments to us from our subsidiaries could result in an inability to meet our liquidity needs, regulatory requirements and pay dividends on our Common and Preferred Shares. In addition, our creditors generally have no direct claim to the assets of our subsidiaries. As for any holding company, our inability to sell our securities or obtain funds from our lenders on favorable terms, or at all, could also result in an inability to meet our liquidity needs and regulatory requirements. Risks relating to the Preferred Shares and the ADSs. Preemptive rights may not be available to holders of ADRs evidencing ADSs. Grupo Cibest’s bylaws and Colombian law require that, whenever Grupo Cibest issues new shares of any outstanding class, it must offer the holders of each class of shares (including holders of ADSs) the right to purchase a number of shares of the same class sufficient to maintain their existing percentage ownership of the aggregate capital stock of Grupo Cibest. These rights are called preemptive rights. United States holders of ADSs may not be able to exercise their preemptive rights through The Bank of New York Mellon, which acts as depositary (the 'Depositary') for Grupo Cibest’s ADR facility, unless a registration statement under the Securities Act is effective with respect to such rights and class of shares or an exemption from the registration requirement is available. Grupo Cibest is obligated to file a registration statement or find a corresponding exemption only if it determines to extend the rights to holders of the ADSs. Although it is not obligated to do so, Grupo Cibest intends to consider at the time of any rights offering the costs and potential liabilities associated with any such registration statement, the benefits to Grupo Cibest from enabling the holders of the ADSs to exercise those rights and any other factors deemed appropriate at the time before it makes a decision as to whether to file a registration statement. Accordingly, Grupo Cibest may, in some cases, decide not to file a registration statement. Under the deposit agreement between Grupo Cibest and the Depositary, only the Depositary is entitled to exercise preemptive rights, and the Depositary has no obligation to make available preemptive rights to holders of ADSs. If Grupo Cibest offers or causes to be offered to the holders of any deposited securities, including Preferred Shares of Grupo Cibest, any rights to subscribe for additional Preferred Shares of Grupo Cibest or any rights of any other nature, the Depositary has discretion as to the procedure to be followed in making such rights available to any holders of ADSs or in disposing of such rights on behalf of any holders of ADSs and making the net proceeds available to such holders of ADSs. If, by the terms of such rights offering or for any other reason, the Depositary does not either make such rights available to any holders of ADSs or dispose of such rights and make the net proceeds available to such holders of ADSs, then the Depositary will allow the rights to lapse. Whenever the rights are sold or lapse, the equity interests of the holders of ADSs will be proportionately diluted. Exchange rate fluctuations may adversely affect the Colombian economy, the market price of Grupo Cibest’s ADSs, and the dividends payable to holders of Grupo Cibest’s ADSs. Colombia has adopted a floating exchange rate system, but the Central Bank maintains the power to intervene in the exchange market in order to consolidate or dispose of international reserves, and to control any volatility in the exchange rate. From time to time, and in particular during the past two years, the Colombian peso has fluctuated significantly against the U.S. dollar. Unforeseen events in the international markets, fluctuations in interest rates, oil price volatility, changes in capital flows, or government operations involving the monetization of dollars in the local foreign exchange market may cause exchange rate instability that could generate sharp movements in the value of the peso. Because a portion of our assets and liabilities are denominated in, or indexed to, foreign currencies, especially the U.S. dollar, sharp movements in exchange rates may negatively impact our results. In addition, exchange rate fluctuations may adversely impact the value of dividends paid to holders of our ADSs, as well as the market price and liquidity of Grupo Cibest's ADSs. Grupo Cibest’s Preferred Shares have limited voting rights. Grupo Cibest’s corporate affairs are governed by its bylaws and Colombian law. Under Grupo Cibest’s bylaws and Colombian law, Grupo Cibest’s preferred stockholders may have fewer rights than stockholders of a corporation incorporated in a U.S. jurisdiction. Under Grupo Cibest’s bylaws and Colombian corporate law, holders of Preferred Shares (and, consequently, holders of ADSs) have no voting rights in respect of Preferred Shares, other than in limited circumstances as described in Item 10. Additional Information – B. Memorandum and Articles of Association – Voting Rights – Preferred Shares. Holders of Grupo Cibest’s Preferred Shares, including holders of ADSs, are not entitled to vote for the election of directors or to influence Grupo Cibest’s management policies. Holders of Grupo Cibest’s ADSs may encounter difficulties in the exercise of dividend and voting rights. Holders of Grupo Cibest’s ADSs may encounter difficulties in the exercise of some of their rights with respect to the shares underlying the ADRs. If Grupo Cibest makes a distribution to holders of underlying shares in the form of securities, the Depositary is allowed, at its discretion, to sell those securities on behalf of ADS holders and instead distribute the net proceeds to the ADS holders. In addition, even in those limited instances in which the Preferred Shares represented by the ADSs have the power to vote, under some circumstances, ADS holders may not be able to vote by giving instructions to the Depositary. This may occur if ADS holders do not receive from the Depositary a notice of meeting sufficiently prior to the instruction date to ensure that the Depositary will vote the Preferred Shares represented by the ADSs in accordance with instructions received from such holders. There are no circumstances in which holders of ADSs may vote in a way other than by providing instructions to the Depositary. Relative illiquidity of the Colombian securities markets may impair the ability of an ADS holder to sell Preferred shares. Grupo Cibest’s Common and Preferred shares are listed on the Colombian Stock Exchange, which is relatively small and illiquid compared to securities exchanges in major financial centers. In addition, a small number of issuers represent a disproportionately large percentage of market capitalization and trading volume on the Colombian Stock Exchange. A liquid trading market for Grupo Cibest’s securities might not develop on the Colombian Stock Exchange. A limited trading market could impair the ability of an ADS holder to sell Preferred Shares (obtained upon withdrawal of such shares from the ADR facility) on the Colombian Stock Exchange in the amount and at the price and time such holder desires and could increase the volatility of the price of the ADSs. Changes in Colombia’s tax regime may affect the tax treatment of ADSs. ADSs do not have the same tax treatment as other equity investments in Colombia. ADSs represent Grupo Cibest Preferred Shares and are held through a fund of foreign capital in Colombia that is subject to a specific tax regulatory regime. Accordingly, the Colombia law applicable to equity investments, in particular those relating to dividends and profits from sale, do not apply to ADSs, including Grupo Cibest ADSs. Notwithstanding the above, the tax regime applicable to ADSs may change, considering that the Colombian tax regime has undergone several changes in recent years. For more information, see Item 10. Additional Information. – E. Taxation – Colombia Taxation.