The Bank has established an Anti-corruption Policy to demonstrate our commitment to zero tolerance for all forms of corruption and bribery, and be an operational framework for compliance by directors, executives and employees, covering corruption risk assessment and management as well as whistleblowing and complaint channels. We also conduct an annual performance assessment of compliance with the policy and conduct regular training to raise awareness and understanding of all forms of corruption, impacts and practical implementation for all employees. In the case of violation or non-compliance of the policy by any employee, we will conduct an investigation according to the disciplinary procedures and impose appropriate penalties, ranging from a verbal warning to employment termination and pursuing legal action. The Bank has continuously been recognized as a financial institution that plays an important role in fostering anti-corruption and we have been a certified member of the Thai Private Sector Collective Action Against Corruption (CAC) since 2015. Most recently, in 2025 the Bank was upgraded to CAC Change Agent status, with an additional role in expanding anti- corruption engagement by inviting and supporting our suppliers and business partners to join the Thai Private Sector Collective Action Against Corruption. Besides, the Bank does not support and is not directly or indirectly involved in any activities related to lobbyists, political contributions, political parties, political candidates or political influencers.

Corruption Risk Management

We have established an effective corruption risk management process and steps that are aligned with our business context as follows: 1. Identification of corruption risk and risk assessment. 2. Adoption of preventative and control measures. Executives or supervisors involved with each risk issue will oversee the first two steps on an annual basis. 3. Controlling, monitoring and auditing under the Three Lines of Defense principle. Responsible persons in business units, as the first line of defense, manage risks pertaining to their units. The Risk Management Division and Compliance Unit, the second line of defense, oversees and monitors corruption risk management. The third line of defense, the Audit and Control Division, independently audits matters related to corruption and reports to responsible management according to the line of command. In 2025 the Bank was not subject to any allegations or complaints related to corruption and bribery or conflicts of interest from the Bank of Thailand, the Office of Securities and Exchange Commission, the Office of the National Anti-corruption Commission and the Anti-money Laundering Office.

Digital-age financial scams, such as online fraud and opening bank accounts to be used by others with the account owners’ consent (Mule Account) to support various illegal activities, including money laundering and modern slavery within scammer networks, have inflicted increasingly widespread damage on the lives, physical and mental wellbeing, and property of citizens. This has become a significant problem in Thai society that requires serious and urgent attention. The Bank prioritizes building trust in the security of our online financial services. This is coupled with collaboration with government agencies and other financial institutions in exchanging information on fraudulent accounts through the Central Fraud Registry (CFR). We also have improved detection and expanded the scope of investigations into suspicious accounts to more effectively prevent online financial fraud. The following key measures have been implemented:

1. Prevention of Financial Transaction Fraud via Bangkok Bank Mobile Banking Service
   
   
   • We do not attach links via SMS, emails or social media.
   • We limit the use of Bangkok Bank Mobile Banking service to one user account per mobile banking service and to one device only.
   • We provide identity verification for transactions via Bangkok Bank Mobile Banking service using Face ID and biometric forgery detection for transfer, payment, or top up of Baht 50,000 or more, or transfer, payment, or money top up totaling Baht 200,000 within one day, or an increase in the maximum daily transfer limit.
   • We check for changes to the Bangkok Bank Mobile Banking application every time a user logs in (Anti-tampering) and will not allow unauthorized use of the application if any changes or modifications to the application are detected.
   • We prohibit the Bangkok Bank Mobile Banking application from running on a mobile device that other applications with system behavior that might pose a risk of identity theft and fraudulent transactions are running on behalf of users, such as applications that can remotely control mobile devices.
2. Customer Due Diligence
   
   We assess and determine the risk level of customers and conduct Enhanced Due Diligence (EDD) in the case of high-risk customers to examine their factual information in greater depth. If we are unable to ascertain the facts about a customer, we will take action in accordance with the Anti-money Laundering Act, such as by refusing to establish a business relationship, refusing to conduct transactions, or terminating the business relationship, etc.
3. Limiting Damages and Managing Mule Accounts
   
   
   • We will immediately notify customers whenever money is withdrawn from their deposit accounts for transactions executed through digital channels via various communication channels free of charge, such as notifications via Bangkok Bank Mobile Banking, LINE, SMS and email.
   • We will suspend transactions from the announced or suspected mules’ accounts and notify the next bank or the next operator receiving the transfer, as well as enter the information into the information disclosure system or process, or into the information exchange process, in accordance with the law and regulatory requirements.
   • When we receive a list of high-risk account holders from the Anti-money Laundering Office (AMLO) or from the Central Fraud Registry (CFR) system, we will take action in accordance with the risk level, such as suspending all incoming and outgoing funds in all accounts of the account holders and refusing to open new accounts for the account holders.
   • We set a maximum limit per day for transactions via mobile banking for each customer to align with the customer profile.
4. Procedures for Reporting Technological Crimes Victims of financial fraud can contact the Bank’s official channel 24 hours a day at 1333 or +66 2645 5555, press *3 (after selecting the language).
   
   We are committed to continuously raising awareness about online financial threats among customers, vulnerable groups, and the general public by disseminating knowledge about fraudulent schemes, how to spot suspicious activities, prevention methods, and what to do if you become a victim, through various online and offline communication channels. We have also organized lectures on the topic of Safe Seniors: Knowing the Tricks of Fraudsters under the Happy Retirement financial literacy project for the Bang Rak Senior Citizens Club to build financial resilience, as well as on the topic of Cyber Threats and Modern Fraud for the Visually Impaired under the Fin Lit for the Blind project for the Cooperative of the Blind in Thailand to educate them about modern fraudulent tactics.

Respect for Human Rights

Managing human rights helps prevent human rights violations, whether direct or indirect, from occurring in the Bank’s business operations, reduces reputational risk, and builds trust both internally and externally. We strictly comply with international and local human rights principles and standards, such as the Universal Declaration of Human Rights (UDHR) and the International Labour Organization (ILO) Conventions. In addition, we have adopted the United Nations Guiding Principles on Business and Human Rights (UNGP) as guidelines for our human rights management. In this regard, we have established a Human Rights Policy and Practice, and have also conducted Human Rights Due Diligence (HRDD) every three years to assess human rights risks and impacts that may occur as a result of business activities, the activities of our suppliers, and our customers throughout the business value chain, including companies in which the Bank holds a stake above 10 percent. The human rights due diligence covers all groups of stakeholders including vulnerable groups such as female laborers, child workers, migrant workers, daily wage workers, minorities, people with disabilities and LGBTQIA+ group. We have established appropriate measures to prevent and mitigate significant risks and provided channels for complaints from both internal and external stakeholders.

Respect for Employee Rights

The Bank respects the rights of employees and treats all employees equally without discrimination on the grounds of race, religion, education, skin color, gender or sexual orientation. We strictly comply with labor laws and regulations. Meanwhile, if the Bank is obliged to terminate a contract with an employee due to a cause other than misconduct or retirement, it will ensure compliance with regulations regarding termination of employment by paying severance as required by law and a family allowance according to the Bank’s regulations. We respect the rights of our employees to exercise freedom of association and engage in collective bargaining activities for labor rights in accordance with the law. We allow all employees to join the Bank’s labor unions. The unions negotiate in the interests of their members and the successfully negotiated terms and conditions will likewise apply to non-member employees. In addition, we offer opportunities for union representatives to raise significant issues, including occupational health and safety issues for discussion with the management to find solutions and prevent problems that may arise in the future. The unions’ requests and suggestions have been duly accommodated by the Bank. We have zero tolerance for any kind of discrimination or harassment as set out in our Non-discrimination and Anti- harassment Policy. The policy provides a guideline to prevent discrimination and harassment behavior within the organization, whether it is physical, verbal or sexual. It also serves as a guideline for responding to cases of discrimination or harassment. If there is a case of discrimination or harassment that is against the policy, we will conduct an investigation and take disciplinary action against the offender in accordance with the Bank’s regulations.

To promote respect for human rights, non-discrimination, diversity and inclusion in the organization, we offer online training courses to raise awareness and promote understanding among all employees such as a Human Rights, Non-discrimination and Anti-harassment course which covers the principles and rationale for respecting human rights, the Bank’s policies and practices, and the use of reporting channels. The Foundation of Diversity, Equity and Inclusion course highlights the importance of valuing and embracing employee diversity, as well as promoting equity and fostering an inclusive environment across the organization. Additionally, we have always prioritized empowering the vulnerable groups and reducing inequality of opportunity in society. In 2025 we provided vocational support to a total of 188 people with disabilities nationwide, totaling over Baht 22,644,600, through various foundations and associations working to promote and improve the quality of life for people with disabilities.

We recognize that receiving fair service is our customers’ right. Providing fair service not only maximizes customer benefits but also fosters trust and a positive relationship between the Bank and our customers. We offer products and services fairly, aligning them with customers’ needs, acceptable risk levels, financial literacy, ability to repay debt, and sufficient remaining funds for a decent standard of living. Furthermore, we do not discriminate against customers based on age, gender, race, nationality, religion, beliefs, culture or socioeconomic status. We have established the following policies and practices related to market conduct per the following:

1. Corporate Culture and Roles and Responsibilities of the Board of Directors and Senior Management The Board of Directors and senior management are responsible for fostering ethical market conduct as part of the Bank’s corporate culture.
2. Product/Service and Channel Development and Client Segmentation We develop products and service channels that are suitable for the needs, financial ability and comprehension ability of each target group of customers, with due consideration of our employees’ selling capabilities and knowledge, our work systems and ability to assure quality of sales so that customers receive suitable products with good quality. Furthermore, we recognize that in determining product terms such as benefits, prices and fees, we must consider fairness to customers and associated actual costs, while not joining with other providers to specify terms that are against customers’ interests, nor offering bundled products unless it is justified on the grounds of risk protection of the main product.
3. Remuneration Scheme Remuneration and punishment are determined for employees concerned with selling or providing products/services to customers as well as executives who are responsible for monitoring compliance with the market conduct. Key Performance Indicators are clearly defined to prevent irresponsible sales propositions and mis-selling.
4. Sales Process Customers must not have their privacy invaded when we are trying to sell products and services to them. Information provided to customers must be complete, not misrepresented or distorted so that customers receive products or services that are suitable for their needs and affordability. Systems to regularly check selling and service quality have been put in place, such as call backs, welcome calls and mystery shopping.
5. Communication and Training We regularly communicate with employees to raise awareness and organize training programs to provide knowledge about market conduct to ensure their compliance. This includes providing detailed information about new products or services, guidance on sales approaches using simple language, teaching about the rights of customers, customer care and protection so that employees can conduct themselves properly.
6. Data Privacy We protect the privacy of personal customer data by strictly complying with applicable laws. The Bank has designed, developed and tested the work system to ensure data security and has defined the authority and duties of employees who look after data security under the three lines of defense principle.
7. Problem and Complaint Handling We have established processes for problem resolution, complaint handling, whistleblowing, as well as remedies that are effective, clear, fast and fair.
8. Three Lines of Defense We have established processes for controlling, monitoring and auditing compliance with market conduct requirements to detect risks and anomalies while an after-sale self-monitoring system is in place to ensure compliance with the Bank’s guidelines.
9. Operation and Business Continuity We have put in place operating systems and business continuity plans that cover operations in both normal circumstances and emergencies as well as preparing a manual and checklist for employees to ensure that customers’ needs are addressed in an accurate, comprehensive and timely manner and to prevent operational mistakes.

Managing the supply chain with environmental, social and governance (ESG) risks in mind helps prevent negative impacts from the operations of the Bank’s suppliers. This includes potential impacts on the suppliers themselves, the Bank as a contributor, and other stakeholders. This reduces the risk of supply chain disruptions and fosters collaboration between the Bank and its suppliers in creating value for society. We have established a comprehensive Supplier Code of Conduct, encompassing aspects in ESG such as respect for human rights, labor rights and community rights, to reflect our expectations about suppliers’ operations. We have communicated the Supplier Code of Conduct to all suppliers and encourage all suppliers to fully comply with the Supplier Code of Conduct. Furthermore, we manage ESG aspects throughout our supply chain, promote the procurement of environmentally-friendly products, and organize knowledge sharing on ESG for our suppliers on an annual basis. “Supplier” in the Bank’s supply chain is classified into three categories: 1. Suppliers of supplies and equipment used in business operations under the responsibility of the Bank’s procurement section 2. Contractors providing services such as repairs, renovations and maintenance of the Bank’s equipment and office buildings 3. External service providers contracted by the Bank for specific tasks. In 2025 the Bank had a total of 2,788 registered suppliers (35 new suppliers), comprising 2,388 domestic suppliers and 400 international suppliers. We entered into procurement contracts with a total of 1,308 suppliers.

ESG Management in the Supply Chain

ESG management in the Bank’s supply chain includes the following elements: communicating the Supplier Code of Conduct to all suppliers, screening new suppliers by considering important ESG issues as part of the evaluation, regularly assessing ESG risks associated with critical suppliers, managing risks at an acceptable level and establishing a process for monitoring suppliers’ compliance with the Supplier Code of Conduct. We encourage all suppliers to fully comply with the Supplier Code of Conduct. In addition, we also encourage the Bank’s suppliers and business partners to join the Thai Private Sector Collective Action Against Corruption to elevate the fight against corruption of all forms.

We have established a policy outlining guidelines for using external service providers covering criteria for selecting service providers, risk management, internal controls, data security and confidentiality, as well as labor practices. The Screening Committee for External Service Providers is responsible for overseeing the use of external services. Business units using outsourced services are responsible for considering and proposing the work requiring outsourced services and suitable external service providers to the designated screening committee as well as overseeing compliance with contracts, monitoring, auditing and evaluating the performance of suppliers. This also includes monitoring information and news related to non- compliance with laws and the Bank’s Supplier Code of Conduct. Such information and news will be used as part of the consideration when reviewing the supplier registry in the following year or once the contract is due for renewal. The Bank has also adopted the Three Lines of Defense principle to manage risks within its supply chain. The Procurement Unit has a duty to monitor and review suppliers’ performance. The Compliance Unit is responsible for ensuring that procurement activities comply with the Bank’s regulations as well as applicable laws and regulations. The Audit and Control Division is tasked with reviewing operations related to procurement activities. If any stakeholders are negatively impacted by the operations or activities of the Bank’s contracted supplier, they may file complaints through the Bank’s complaint filing channels.

Assessment of ESG Risks in the Supply Chain

We regularly assess ESG risks arising from the operations of our suppliers with a focus on critical suppliers. These include suppliers from whom the Bank purchases goods and services with significant transaction values (high spending), suppliers of goods and services essential to the Bank’s operations (critical component) and suppliers providing goods and services that cannot be sourced from alternative suppliers (non-substitutable). The Bank has identified significant risks, considering both the likelihood and the severity of the impact, as follows: Environmental Risks - 1. Greenhouse gas emissions 2. Energy management 3. Waste and hazardous material management. Social Risks - 1. Human rights 2. Labor practices 3. Occupational health and safety at the workplace. Governance Risks - 1. Corruption 2. Personal data protection 3. Fraud. In cases where the risk level is found to be higher than the Bank’s acceptable threshold, it will consider implementing additional or more stringent risk mitigation measures as necessary. In 2025 the ESG risks associated with the Bank’s suppliers were deemed to be within acceptable levels, and the economic risks posed by the suppliers were considered insignificant.

Supplier Screening

In the supplier screening process, we follow a comprehensive screening approach that thoroughly addresses material issues such as the quality of products and services, stability and trustworthiness, production and service capabilities and the supplier’s ESG practices. All suppliers, both new and existing, are required to complete an ESG self assessment covering critical areas including environmental impact management, adherence to international human rights principles and standards, respect for fundamental workplace rights in accordance with the core labor rights conventions of the International Labour Organization (ILO), no illegal use of child labor and forced labor, compliance with personal data protection regulations, anti-corruption measures and handling of complaints. Suppliers are required to meet the Bank’s evaluation criteria before they can be registered and enter into a procurement contract with the Bank. Once the supplier screening process is complete, the Bank will invite the potential supplier to present information about their products and services for its consideration and also to acknowledge the Bank’s Supplier Code of Conduct and practices. Moreover, the Bank may conduct site visits to the supplier’s business for further inspection and assessment as appropriate.

Transparent and Environmentally-friendly Procurement

We have implemented an online auction (e-Auction) system for procurement to foster transparency and fair competition. Moreover, we have procured a range of environmentally-conscious products, including photocopy paper made from environmentally-friendly pulp, document forms made from recycled paper, printing toner certified to meet international environmental standards, employee uniforms bearing the Cool Mode label, non CFC water-mist fire extinguishers, products manufactured through recycling and upcycling processes, bottled water packaging made from rPET (recycled PET) instead of PET, water-saving sanitary fixtures, office supplies certified by Leadership in Energy and Environmental Design (LEED), office furniture certified for compliance with international environmental standards, and energy-saving computers.

Whistleblowing and filing complaints serve as an important mechanism that enables the Bank to receive information about its own operations and about actions of the individuals involved in the Bank’s business activities, from both internal and external stakeholders. This mechanism allows the Bank to address any resulting impacts and to develop preventive measures to avoid recurrence. The Bank has established a Whistleblowing Policy as a guideline for all stakeholders to send information or file complaints related to the actions of the Bank and its related parties including directors, executives, employees and contract employees who are suspected to have committed frauds or to be in violation of laws, regulations, the Code of Conduct and Business Ethics, and policies and practices of the Bank, or information or complaints about inaccurate financial reports, or instances of failure of internal control systems.

In 2025 the Bank received a total of 591 whistleblowing cases or complaints, with 539 of these investigated, evaluated and closed, consisting of 14 cases from operating system failure, 16 cases from operational mistakes and slow responses from employees, and the remaining 509 cases resulting from customers’ misunderstanding of the Bank’s operations and other issues not related to the Bank’s mistakes such as requests to check transactions in a deposit account, opening an account, closing an account and freezing an account, and rejection of credit card payments for products and services.

Employee Complaint Management

We provide channels for employees to file complaints related to unfair treatment at work, and other forms of intimidation or harassment, whether it is physical, verbal or sexual harassment. When an incident of unfair discrimination, intimidation or harassment takes place at work, an affected employee can tell the instigating employee to stop the action immediately or, if the instigating employee still continues to behave in such a way, the affected employee can report or consult with his supervisor to find a solution. If the issue is not resolved satisfactorily, a complaint can be filed in writing to the Employee Relations Unit under the Human Resources Division, which then submits it to the Disciplinary and Petition Committee. The Employee Relations Unit will investigate the facts and submit the conclusion of the complaint to the meeting of the Disciplinary and Petition Committee within 60 days from the date of receipt of the complaint. If it is found that there was a case of unfair discrimination, intimidation or harassment which breaks the Bank’s rules or the law, the case will be referred to the Audit and Control Division and the division/department in which the violator works will be asked to consider appropriate disciplinary action and punishment. The penalty for wrongdoers is based on the severity of the case, ranging from warnings to pay cuts and termination of employment. Note that the Bank ensures that all parties are treated fairly through a transparent and equitable investigation process. The person filing the complaints is protected and their secret and personal information is kept confidential, while the victims receive remedies properly and fairly. In 2025 there were no cases of complaints about unfair discrimination, intimidation or harassment.

Total number of breaches

Raising Awareness and Understanding of Employees We promote awareness and understanding about conducting business with ethics among employees by organizing several training courses as follows: