Performance and operations

Company profile

NEPI Rockcastle is the premier owner and operator of shopping centres in Central and Eastern Europe (CEE), with a presence in eight countries and an investment portfolio of €8.2 billion.

The Group benefits from a highly-skilled internal management team which combines asset management, development, investment, leasing and financial expertise. Geographically diverse management skills allow NEPI Rockcastle to pursue CEE property opportunities efficiently, benefiting from a strategic advantage in the acquisition, development and management of properties.

NEPI Rockcastle owns and operates 57 retail properties which attracted more than 354 million visits in 2025.

With Group level management of tenant relationships and a focus on cross-country collaboration, the Group is the leading strategic partner for major retailers in the CEE countries.

The Group's financial strategy includes maintaining a profile of adequate liquidity, conservative loan-to-value (LTV), and a diverse debt structure, which combines secured and unsecured bank debt with unsecured bonds listed on the Irish Stock Exchange. The Group is currently assigned a long-term corporate credit rating of BBB (positive outlook) from Standard & Poor’s Rating Services and BBB+ (stable outlook) from Fitch Ratings.

The Company’s shares are listed on the Main Board of the JSE Limited (JSE), Euronext Amsterdam and A2X. NEPI Rockcastle uses distribution per share as its key performance measure for trading statement purposes, in accordance with the JSE Listings Requirements.

Property portfolio by country

CEO's statement

I am pleased to report that 2025 was another outstanding year for NEPI Rockcastle. We achieved record distributable earnings of €441 million, up 6.7% on the prior year, and net operating income (NOI) of €618 million, an 11.2% increase. These results were driven by the acquisitions made at the end of 2024, reduced vacancy, indexation, rental uplifts and higher basket spend all while keeping a firm control of costs. These results were at the top end of our revised guidance provided in August and demonstrate the fundamental strength of our business model. Our portfolio reached a valuation of €8.2 billion, reinforcing our standing as one of Europe’s fastest growing retail real estate platforms and the largest owner, operator and developer of shopping centres across CEE markets.

Consumer spending across our malls kept climbing, reinforcing just how resilient the CEE shopper continues to be. Tenant turnover grew 3.6% on a like-for-like basis, and average spend per visit rose again. Retailer demand for space in our properties stayed strong, pushing overall occupancy to 98.8%. These results speak to the strength of our business model, the quality of our retail destinations across the region, and the lasting attractiveness of well-managed, dominant shopping centres in Central and Eastern Europe.

Financial discipline remains central to how we run the business, and our balance sheet is in strong shape. We closed the year with total liquidity exceeding €1 billion, having successfully issued a €500 million green bond in September to proactively manage upcoming debt maturities, while also expanding our revolving credit facilities to €740 million. With a loan-to-value ratio (LTV) of 32.8%, we have good capacity to pursue growth while keeping leverage at prudent levels.

Looking ahead, we have over €840 million development projects in the pipeline, including extensions, refurbishments and other value-enhancing work, that will strengthen our position further. On the sustainability front, our renewable energy programme continues to grow. Photovoltaic installations now cover 6% of our electricity needs, and our greenfield solar projects in Romania are on track to start generating power in 2026 and 2027. The first greenfield photovoltaic plant of the Group, in Chisineu-Cris (54 MW), went already online and will increase the energy self-production to 18% of the estimated needs.

On a personal note, this is my final commentary as CEO of NEPI Rockcastle. Over the past four years, I’ve had the privilege of leading a company that has gone from strength to strength. We’ve stayed disciplined in executing our growth strategy – actively recycling capital through acquisitions and disposals, optimising our assets, delivering developments at scale, unlocking new income streams through our renewable energy programme and taking care of our strong balance sheet.

This strategy has delivered substantial value for shareholders and business partners as the CEE region continues to record higher rates of economic growth and gains in household disposable income than Western Europe. I’m confident the Company is in excellent hands going forward. My colleague Marek Noetzel takes over as CEO on 1 April 2026, and his deep knowledge of the business and relentless focus on operational excellence make him the right person to lead NEPI Rockcastle into its next chapter.

I extend my gratitude to our shareholders, partners and colleagues for their support and look forward to watching
the Company’s future progress.

17 March 2026

RÜDIGER DANY
Chief Executive Officer

Chairman's statement

NEPI Rockcastle delivered another year of excellent performance in 2025. Distributable earnings per share increased to an all-time high, in line with revised guidance and demonstrating the resilience of our business model in what proved to be a year of considerable macroeconomic uncertainty in some of our markets. The Board declared a dividend of 27.88 euro cents per share for the second half of the year, maintaining our consistent 90% distribution payout ratio.

Our portfolio now stands at a valuation of €8.2 billion, underpinned by a fair value gain of €162 million driven by the operational performance of our properties. A significant share of this uplift came from recently acquired properties - a validation of the disciplined acquisition strategy we have pursued in recent years. Net operating income grew by 11.2% to €618 million, benefiting from the full-year contribution of properties acquired in 2024, reduced vacancy and improved cost recovery.

Perhaps no single metric captures the quality of our portfolio better than our retail vacancy rate, which has fallen to a record low of 1.0%. This is not an accident — it is the product of years of focused asset management, deep retailer relationships and an unwavering commitment to owning the best properties in the markets we serve. It is an achievement of which every member of our team should be proud.

Financial strength is the platform upon which all else rests. In 2025, that platform was reinforced considerably. Our €500 million green bond issuance attracted more than 190 investors and was oversubscribed more than eight times — a powerful expression of the capital markets' confidence in NEPI Rockcastle's credit quality and long-term direction. With substantial undrawn revolving facilities complementing this access, the Group has the firepower to pursue value-accretive opportunities decisively. The affirmation of our investment-grade ratings by both Standard & Poor's and Fitch reflects the conservative capital discipline that has always distinguished us.

Sustainability continues to be a key focus. The Group has made substantial progress and is on track to achieve its science-based target for 2030. Our expanding green energy programme is transforming the Group's energy profile – our installed photovoltaic capacity reached 92 MW (including the landmark Chisineu-Cris greenfield plant in Romania), enough to cover 18% of portfolio electricity needs. Recognition from multiple environmental standard setters confirms that NEPI Rockcastle is regarded as a leader in responsible real estate investment.

NEPI Rockcastle's admission to the FTSE EPRA NAREIT Global Emerging Index in June 2025 was a further milestone — independent recognition of our standing as a leading real estate investment platform and a signal to international investors of the quality and ambition of this organisation.

This year also marked a defining moment in our leadership journey, through the completion of our CEO succession process. On behalf of the Board, I extend our sincere gratitude to Rüdiger Dany for his outstanding contribution to the Group's development. The appointment of Marek Noetzel as Chief Executive Officer with effect from 1 April 2026 reflects the strength of our leadership development programme and provides continuity of strategic vision. The subsequent appointment of Marius Barbu as Chief Operating Officer demonstrates the depth of talent within the organisation and our commitment to internal succession planning.

The Group is well positioned for continued growth. A substantial development pipeline of approximately €840 million, which includes our green energy expansion programme, provides clear pathways to future value creation. The economic fundamentals in Central and Eastern Europe continue to support retail consumption, and the Board remains confident in our ability to capitalise on attractive investment opportunities as they arise. The strategic priorities we have pursued—asset quality, financial discipline, sustainability leadership and talent development—will continue to deliver superior returns for shareholders over the long-term.

On behalf of the Board, I congratulate NEPI Rockcastle's management and employees for their exceptional achievements in 2025 and thank our shareholders for their continued support. We look forward to building upon this success in the years ahead.

17 March 2026

GEORGE AASE
Chairman

Directors' report

Highlights

• Distributable earnings per share (DEPS) for the second half (H2) of 2025 was 30.98 euro cents, which, when combined with the interim DEPS of 31.05 euro cents, results in annual DEPS of 62.03 euro cents, a 3.1% growth relative to 2024 (60.17 euro cents). DEPS growth came in at the higher end of the guidance we issued in August 2025. Distributable earnings for the period amounted to €441 million, up 6.7% from 2024.

• The Board has declared a dividend of 27.88 euro cents per share for H2 2025, corresponding to a 90% dividend pay-out ratio. This will be settled as capital repayment (default option) or NEPI Rockcastle shareholders can elect for the settlement of the same dividend amount as an ordinary cash dividend out of distributable profits.

• NOI was €618 million in 2025, 11.2% higher than in previous year. Like-for-like (LFL) NOI growth was 4.4% (excluding the impact from acquisitions completed in 2024).

• Green energy activity contributed €9.6 million to 2025’s NOI, up 6.5% from 2024.

• Property operating expenses increased by 9.2% year on year, largely due to the additional costs associated with assets acquired in 2024. The cost recovery rate improved to 94.8%.

• Tenant turnover increased by 3.6% (excluding hypermarkets) compared to 2024 on a LFL basis, above inflation.

• Footfall was marginally lower by 0.5% on a LFL basis, compared to 2024.

• The continuing trend of increased spend per visitor was evidenced by average basket size growing by 4.4% LFL and by 8% overall (including the impact of acquisitions completed in 2024).

• The occupancy cost ratio (OCR) was 12.4% in 2025 (excluding hypermarkets), slightly up from 12.2% in 2024. The OCR has held steady since 2022, demonstrating the Group’s ability to capture income growth from improved tenant performance while maintaining mutually beneficial partnerships with its retailers.

• The collection rate was 99.5% of 2025 reported revenues as of mid-February 2026, indicating the high level of operational discipline and the quality of NEPI Rockcastle’s tenants.

• Investment property as of 31 December 2025 amounted to €8.2 billion, compared to €7.9 billion at the end of 2024. The increase is due to positive fair value adjustments of €162 million and capital expenditure.

• The revaluation uplift was driven by higher NOI, supported by the superior performance of the assets. Valuation yields remained stable with no significant changes compared to prior year.

• European Public Real Estate Association (EPRA) vacancy decreased to 1.2%, from 1.7% in 2024. For retail properties, which represent 97.3% of total gross lettable area (GLA), the EPRA vacancy rate was 1.0% (down from 1.4% in the previous year). The Group continued to reduce vacancy from already low levels, a testament to the expertise of its leasing team and the premium quality of its assets that remain highly sought after by retailers.

• EPRA Net Reinstatement Value (NRV) per share was €7.68 as of 31 December 2025, a 4.1% increase compared to €7.38 as of 31 December 2024.

• The Group’s development pipeline totals over €840 million in new developments, extensions, refurbishments and green energy programme over the coming years, in line with its strategy to enhance the quality and attractiveness of its portfolio.

• Key projects under construction include the extension of Promenada Bucharest, the redevelopment of Bonarka City Center and the refurbishment of Arena Mall Budapest. The extension of Pogoria Shopping Centre opened on 5 February 2026.

• Projects under permitting include the development of a large shopping centre in Plovdiv (Bulgaria), a retail park in Galati (Romania) and an extension to the Karolinka Shopping Centre in Poland.

• The second phase of the green energy programme is progressing well, with 22 on-site plants outside Romania in different stages of installation.

• The third phase of the green energy programme, comprising off-site plants development, is advancing, with the Chisineu-Cris greenfield photovoltaic plant (54 MW) expected to commence commercial operations soon, and the Aricestii Rahtivani plant (60 MW) expected to start commercial operations by the end of 2026.

• The Group’s liquidity position as of 31 December 2025 was over €1 billion, including €314 million in cash and €740 million in undrawn committed credit facilities.

• LTV was 32.8% as of 31 December 2025, comfortably below the 35% long-term strategic threshold.

• In September 2025, the Group issued a €500 million unsecured eight-year green bond at a 3.875% coupon maturing in September 2033. Proceeds were used to manage the upcoming maturities in October 2026 and July 2027, with €250 million of each tranche refinanced.

• In December 2025, the Group signed a new green unsecured facility with Raiffeisen Bank dedicated to refinancing photovoltaic solar plants in Romania, with a total commitment of €45 million and a 10-year tenure. The first tranche of €21 million was disbursed in December 2025.

• In December 2025, the Group increased one of its existing secured loans in Romania by €32 million to further strengthen its liquidity position, with proceeds being disbursed in December 2025.

• The Group’s weighted average effective interest rate on outstanding debt for the period was 3.75% (2024: 3.55%). Including the commitment fees incurred on the undrawn revolving credit facility, the all-in cost of maintaining the Group’s total committed debt facilities was 3.2% on a blended basis (2024: 3%). Interest rate risk is hedged for 84% of outstanding debt.

• The Group is currently assigned a long-term corporate credit rating of BBB (positive outlook) from Standard & Poor’s Rating Services and BBB+ (stable outlook) from Fitch Ratings.

Operating performance

The Group delivered a solid performance across its portfolio in 2025, demonstrating resilience despite macroeconomic headwinds in certain markets. Consumer spending held up well, with tenant sales rising by 3.6% on a LFL basis. Occupancy reached 98.8%, reflecting continued retailer demand for space in our properties. The leasing market remained supportive across all our geographies.

On a LFL basis, footfall was marginally lower by 0.5% compared to 2024. However, customers continued to spend more per visit, with the average basket size increasing by 4.4% on a LFL basis.

Tenant sales performance varied by country, with strong results in Poland (+5.0%), Bulgaria (+6.2%), and Hungary (+5.1%). Romania achieved moderate growth of 2.1% despite new taxes introduced in September.

The OCR has remained consistent over the past four years. In 2025, it stood at 12.4% (excluding hypermarkets), marginally higher than 12.2% in 2024 and broadly in line with 2022 and 2023 levels. This consistent and relatively low level reflects the alignment of interests between the Group and its retail partners, ensuring that the benefits of improved trading performance are shared.

Tenant sales increased across most retail categories. The fastest growing were Health & Beauty (+9.5%), Fashion Complements (+8.8%), Entertainment (+7.8%) and Services (+7.0%), in line with the trends of previous years. Fashion, the largest segment, increased by 1.5%. Electronics (-2.3%) and Sporting Goods (-4.7%) declined due to changes in tenant mix.

Property operating expenses increased by 9.2% year on year, largely driven by incremental costs from assets acquired in 2024. Efficient cost management measures contributed to a higher recovery rate of 94.8%.

The Group achieved a market leading EPRA retail vacancy rate of 1.0% on 31 December 2025, lower than the 1.4% at 31 December 2024, due to very strong tenant demand for space in the Group’s properties. Overall EPRA vacancy was 1.2% at the end of 2025 (down from 1.7% on 31 December 2024).

NEPI Rockcastle signed 500 new leases (for 113,000m², representing 4.7% of total GLA) in 2025, with international tenants accounting for 63% of the total. Another 951 leases were renewed during the year. The blended rental uplift in 2025 was 4.6% above indexation for new leases and renewals, the result of active leasing management.

The Group’s properties continue to be the preferred choice for tenants expanding into new markets. Examples of debut store openings in the country included: Notino in Arena Centar (Croatia), Rituals in Mammut Shopping Centre (Hungary), TOUS in Paradise Center (Bulgaria), BIPA in Mega Mall (Romania), and Tatuum in Mega Mall (Romania). Other notable openings in 2025 include flagship stores for Half Price in Magnolia Park (Poland), Zara and Nike in Arena Centar (Croatia), Zara and Reserved in Arena Mall (Hungary), Sports Direct in Promenada Craiova (Romania).

NEPI Rockcastle is growing its partnerships with top global brands, resulting in multiple store openings in various locations across the portfolio, such as Popeyes (six locations signed in 2025), dm drogerie markt (five stores opened), Adidas (five locations signed), Rituals (four new stores opened), and Skechers (four new stores opened). The Group’s prime locations continue to attract unique concepts, such as the Influcenter in Bonarka City Center (Poland), combining digital and physical experiences run by popular internet influencers. The scale of our offering for key tenants looking to grow quickly in the region is unrivalled.

Development update

The Group invested approximately €200 million in developments, photovoltaic plants and capex in 2025. Projects currently under construction include the extension of Promenada Bucharest, the redevelopment of Bonarka City Center and the refurbishment of Arena Mall Budapest. The extension of Pogoria Shopping Centre was successfully opened on 5 February 2026, with the extension fully leased.

Projects under permitting include the development of a large shopping centre in Plovdiv (Bulgaria) with expected opening in H1 2028, a retail park in Galati (Romania) with expected opening in Q1 2027, and the Karolinka Shopping Centre extension in Opole (Poland).

Each development project currently underway continues to progress according to its planned construction timeline.

In 2025, NEPI Rockcastle’s photovoltaic energy production covered 6% of the Group’s electricity consumption needs. The second phase of the renewable energy programme is progressing with 22 new plants outside Romania in different stages of installation. The third phase, involving greenfield photovoltaic plants in Romania, is advancing well: the Chisineu-Cris plant (54 MW) is expected to commence commercial operations in Q1 2026, and the Aricestii Rahtivani plant (60 MW) is expected to start commercial operations by the end of 2026.

The total cost of projects under construction or permitting is approximately €840 million, of which €326 million has already been invested as at 31 December 2025.

Acquisitions and disposals

In 2025, the Group focused on organic growth through its development pipeline and green energy investments, with no major acquisitions completed during the year. The Group continues to monitor opportunities for acquisitions and maintains a watchlist of potential targets.

Sustainability focus

The Group remains on track to achieve its sustainability commitments, including its SBTi‑validated net‑zero target for 2030.

The Group’s installed photovoltaic capacity reached 92MW across 31 installations (annualised, including the 54MW Chisineu-Cris greenfield plant). The 2026-2027 outlook includes an additional 15MW of rooftop capacity, targeting 47% coverage from own generation and a 37% reduction in emissions (relative to a context in which the Group would use only non-renewable energy sources).

The entire eligible portfolio is BREEAM-certified, with 95% rated “Very Good” or above. The Group received strong external ESG recognition in 2025, including EPRA Gold, GRESB 5-star ratings for both operational and development portfolios, MSCI AAA rating, and CDP B ratings for climate and water.

Corporate Governance

The Board concluded its CEO succession process and appointed Marek Noetzel as Chief Executive Officer with effect from 1 April 2026 succeeding Rüdiger Dany, whose mandate as CEO concludes on 31 March 2026. Mr Noetzel has served as the Group’s Chief Operating Officer since June 2022, with responsibility for operations across 60 properties in eight countries. He joined Rockcastle Global Real Estate in 2016 and has held positions as Board Member and Director of Retail in Poland before becoming COO. On 17 December 2025, the Board appointed Marius Barbu as Chief Operating Officer with effect from 1 April 2026, to succeed Mr Noetzel.

Mr Barbu has been nominated as a director and will stand for election at the annual general meeting in May 2026. He is currently the Group’s Asset Management Director, a position he has held since June 2022, and has over 25 years of experience in asset management, real estate and retail. Mr Barbu joined the Group in 2012 and has progressively expanded his oversight from the country level in Romania to eight geographies across Central and Eastern Europe.

These appointments demonstrate the effectiveness of the Company’s talent management and leadership development strategy.

NEPI Rockcastle was included in the FTSE EPRA NAREIT Global Emerging Index, effective 23 June 2025. The FTSE EPRA NAREIT Index Series is the leading global benchmark for listed real estate investments, and inclusion recognises the Company’s scale, liquidity and adherence to best practices in the sector. This milestone is expected to enhance visibility among global investors, improve share liquidity through eligibility for index-tracking investors, and provide external validation of the Company’s operational transparency and governance standards.

Independent auditor's report

The review report on the Group’s condensed consolidated financial statements published on 24 February 2026 has been issued by Ernst & Young Inc. (EY South Africa), who expressed an unmodified review report thereon.

The audit report on the consolidated and separate financial statements for the year ended 31 December 2025, included in  this annual report, is issued by Ernst & Young Inc. (EY South Africa) and EY Accountants B.V. (EY Netherlands).

Accounting and valuation matters

NEPI Rockcastle fair values its portfolio twice a year. Fair value is determined by external, independent professional valuers, with appropriate and recognised qualifications and recent experience in the geography and category of properties being assessed.

For the year ended 31 December 2025, the Group recognised a fair value gain in relation to investment property portfolio of €162 million.

EPRA indicators

1. Certain of these EPRA indicators are considered to be pro forma financial information in terms of the JSE Listings Requirements. Please refer to chapter EPRA Performance measures.
2. Does not include investment property held for sale.

Cash management and debt

The Group had very strong liquidity as of 31 December 2025, with €314 million in cash and €740 million in undrawn committed credit facilities.

NEPI Rockcastle’s LTV ratio (interest bearing debt less cash, divided by investment property plus cost incurred for photovoltaic plants) was 32.8% as of 31 December 2025, below the long-term strategic threshold of 35% and comfortably within debt covenants.

Ratios for unsecured loans and bonds showed ample headroom compared to covenant thresholds as of 31 December 2025, as follows:

• Solvency Ratio: 0.38 actual, compared to maximum 0.6 requirement;

• Consolidated Coverage Ratio: 5.04 actual, compared to minimum 2 requirement; and

• Unencumbered consolidated total assets/unsecured consolidated total debt: 266% actual compared to a minimum 150% requirement.

NEPI Rockcastle extended the contractual maturities related to its unsecured committed revolving credit facilities in 2025, as follows:

• ING Bank’s facility was extended to a maturity of three years, with two additional one-year extension options, currently expiring in July 2028, with the maximum principal available maintained at €100 million;

• The facility from a three-bank syndicate (BRD-Groupe Société Générale, Garanti Bank and Unicredit Bank) was extended to a maturity of three years, with two additional one-year extension options, currently expiring in July 2028, with the maximum principal available increased from €170 million to €190 million;

• A four-bank syndicate facility led by Deutsche Bank AG as arranger was extended for one year, until January 2029, with the maximum principal available increased to €250 million from €200 million, with JP Morgan joining the syndicate; and

• The facility from Raiffeisen Bank International was extended for one year, until January 2029, with the maximum principal available maintained at €200 million.

Consequently, the revolving credit facilities’ capacity amounts to €740 million (31 December 2024: €670 million) which was available and undrawn as at 31 December 2025.

In September 2025, the Group issued a €500 million green unsecured Eurobond, having an eight-year tenor and maturing in September 2033. The bond carries a 3.875% coupon, with an issue price of 99.353%. Proceeds were used to manage the upcoming maturities in October 2026 and July 2027, with €250 million of each tranche refinanced. The allocation of the proceeds will be aligned to the Group’s Green Finance Framework.

The Group increased one of its existing secured loans in Romania by €32 million in December 2025, to strengthen its liquidity position further. The maturity of the loan remains unchanged.

The Group signed a new green unsecured facility with Raiffeisen Bank in December 2025, dedicated to refinancing the photovoltaic solar plants being developed in Romania. The facility has a 10-year tenor and a total commitment of €45 million. The first tranche of €21 million was disbursed in December 2025, while the second tranche is expected to be drawn in 2026.

In total, 88% of the Group’s funding has green or sustainability-linked features as at 31 December 2025.

The Company repurchased 1,640,511 own shares in April 2025, (representing 0.23% of outstanding ordinary shares in issue) on the market for a total consideration of €10 million. The cost of repurchased shares was recognised in the treasury shares reserve.

In February 2026, the Group signed a €225 million green term facility agreement with a five-year maturity, arranged with a consortium of three banks — ING, SMBC, and Intesa. The facility strengthens the Group’s liquidity position and is in line with the Group’s Green Finance Framework.

The Company evaluates its financing options constantly, including debt and equity capital raising alternatives, to support its future growth and assesses market opportunities as they arise, while keeping in mind the strategic objective to broaden its shareholder base and maintain an optimal capital structure.

The Group’s weighted average effective interest rate on outstanding debt for the period was 3.75% (2024: 3.55%). Including the commitment fees incurred on the undrawn revolving credit facility, the all-in cost of maintaining the Group’s total committed debt facilities was 3.2% on a blended basis (2024: 3%). Management considers the all-in cost to be a relevant measure as it reflects the full cost of securing and maintaining the Group’s available financing capacity.

Unsecured debt represented 87% of NEPI Rockcastle’s outstanding debt as of 31 December 2025. The unhedged balance represents 16% of the total outstanding debt and corresponds mainly to the IFC loan balance.

Earnings distribution 2025

The Board has declared a dividend of 27.88 euro cents per share for H2 2025, corresponding to a 90% dividend pay-out ratio, to be settled as capital repayment (default option). NEPI Rockcastle shareholders can also elect for the settlement of the same dividend amount as an ordinary cash dividend out of distributable profits.

In line with Dutch legislation, the capital repayment will be paid to shareholders unless they elect to receive the ordinary cash distribution option.

A circular containing full details of the dividend settlement, accompanied by announcements on the Stock Exchange  News Service (SENS) of the JSE, A2X and Euronext Amsterdam  has been issued on 27 February 2026, with the dividend settlement scheduled for 17 April 2026.

Prospects and earnings guidance

Distributable earnings per share for 2026 is expected to be approximately 3% higher than the 2025 distributable earnings per share of 62.03 euro cents, with no change in the Company’s current 90% dividend payout ratio. This guidance does not consider the impact of potential further political instability in the region, or systemic macroeconomic disruptions, which are outside the influence of the Board of Directors, and assumes a continuation of the trading trends observed to date. This guidance can be modified or withdrawn in the future if material changes unfold.

This guidance which has been prepared in accordance with IFRS and is consistent with the Company’s accounting policies, has not been reviewed or reported on by NEPI Rockcastle’s auditors and is the responsibility of the Board of Directors.

17 March 2026

Strong strategic positioning

Pillar 1 – Growth		Pillar 2 – Sustainability
	Preserve a high-quality portfolio of dominant assets and enhance their Net Operating Income		Foster a strong financial discipline, including adequate liquidity, conservative LTV and a diverse debt structure, to support growth directions
	Delivering on development pipeline, positively contributing to the property portfolio and income generation		Focus on ESG, to deliver on sustainable and responsible growth
	Identify new income streams - green energy
	Value enhancing asset rotation

Preserve a high-quality portfolio of dominant assets

Active property management of the Group assets creates significant growth opportunities. Capitalising on its comprehensive in-house expertise in the CEE retail markets, the Group delivers year on year best-in-class results, such as high collection and occupancy rates, reasonable tenant occupancy cost, growing tenant sales and footfall. Preventive maintenance decreases long-term capital expenditure, service charge levels, non-recoverable expenses and maintains the portfolio in good shape. With a broad platform across eight CEE countries, the Group manages to adapt its business to the changing consumer preferences and to build strong, trust-based relationships with leading retailers.

Delivering on the development pipeline

NEPI Rockcastle pursues low-risk development, redevelopment and extension opportunities, in a non-speculative, phased manner. Construction costs are committed to on a gradual basis, in line with leasing milestones, but at the same time secured to mitigate the inflationary trends and the supply chains challenges. Delivering on its strategy, the Group has 194,000m² retail GLA and 33,000m² residential GSA (gross sellable area) under construction or permitting, translating to €718 million investments (excluding in green energy projects) under permitting and construction to be delivered during 2026-2028.

Identify new income streams - green energy

In 2025, NEPI Rockcastle produced solar power energy from 38 MW of power-generating capacity installed on 27 properties in Romania and one in Lithuania, leading to €9.6 million net operating income. The second phase of this renewable energy programme will add another 15 MW accross 22 plants outside Romania in different stages of installation. The third phase of the green energy programme, comprising off-site greenfield photovoltaic plants in Romania is advancing, with the Chisineu-Cris plant (54 MW) expected to commence commercial operations in first quarter of 2026, and the Aricestii Rahtivani plant (60 MW) expected to start commercial operations by the end of 2026. These projects are expected to significantly expand the Group’s green energy generating capacity, and increase the coverage of electricity consumption needs of its tenants, enhancing the revenues from green energy production.

Value enhancing asset rotation

The Group is committed to invest selectively in assets that meet its rigorous investment criteria. Pursued retail assets must already be or have the potential to become dominant. Size is critical to achieve a comprehensive offering and an optimum tenant mix, including a large proportion of food and fashion anchors and substantial leisure and entertainment area.

Good location, access, visibility, design and technical specifications, as well as a potential for extension, reduce the threat of significant competition and enable the asset’s dominance in its catchment area. Delivering on its strategic focus, the Group added €57.8 million Net Operating Income in 2025 through its acquisitions completed in late 2024 in Poland (2024: €8 million).

Financial stability

The Group's financing strategy relies on maintaining a strong financial discipline, revolving around an adequate liquidity, prudent LTV, and a diverse debt and equity structure, to support business growth. Growth is funded through a combination of secured and unsecured debt (including bonds) and equity.

The Group prioritises its investment grade credit rating and its green portfolio profile, to maintain diversity and optionality in its financing sources, and optimise the cost of debt. Delivering on its financing strategy during 2025, the Group kept an LTV level of 32.8%, below the long-term strategic threshold of 35% and comfortably within debt covenants, while ensuring an adequate maturity profile.

ESG focus

NEPI Rockcastle makes a commitment to invest into initiatives that will not only enable it to meet sustainability and ESG targets, but will also generate a positive bottom-line impact, recognising the synergies between responsible citizenship and profitability. The Group formulated its sustainability strategy on four pillars: investing in healthy and sustainable buildings, being a trusted partner for stakeholders, pursuing energy leadership, creating an attractive, professional and ethical work environment.

In line with its strategic directions, the Group continued its commitment to maintain a BREEAM-certified retail and office portfolio and planned significant investment in on-site and off-site renewable electricity production that started in 2022 and will be delivered by 2028.

Value creation through the six capitals

Portfolio at a glance

Geographical property portfolio profile

Sectorial property portfolio profile

Key property information

1. Including right-of-use assets of €91.3 million for 2025 (2024: €85.9 million) representing long-term land concessions associated to part of the Group’s properties located in Poland. Including held for sale properties
2. Including residential project with 21,500m² GSA
3. The two indicators differ in their methodology: the Annualised Property Yield includes variable rental income, while the EPRA NIY reflects only passing rent at year end. Estimated purchaser's costs are factored into the EPRA NIY but are excluded from the Annualised Property Yield

Overview of valuation yields

1. Source: Colliers International, Cushman & Wakefield, and Jones Lang LaSalle (JLL) Q4 2025
2. Percentages represent averages weighted by Market Values and rounded to the closest 25 bps
3. Prime yield in Hungary is based on market sentiment considering there have been no transactions of prime shopping centres in recent years in the country. The Group’s properties’ capitalisation rates are impacted by their performance and retail properties transactions in the wider CEE region

Rental escalations

Out of the total operational GLA as at the year-end, the weighted average rental escalation (related to 2026 indexation) by rentable area is presented below:

The majority of the leases are subject to indexation based on 12-month average rate of change of the European Consumer Price Index (EU CPI).

Vacancy profile

EPRA vacancy rate is calculated by dividing the estimated rental value of vacant space (€/annum) by estimated rental value of the property (€/annum).

The EPRA vacancy rate for income-producing properties at the end of 2025 was 1.2% (excluding one non-core retail property and one industrial property held for sale), split as follows: retail 1.0% and office 15.4%.

Future minimum lease payments

1. Figures computed based
   on contractual lease maturity date

Expiry profile¹

Tenant profile

Type A: Large international and national tenants, large listed tenants, government and major franchises (companies with assets and/or turnovers in excess of €200 million).

Type B: Smaller international and national tenants, smaller listed tenants and medium to large professional firms (companies with assets and/or turnovers ranging
from €100 to €200 million).

Type C: Smaller regional tenants that do not meet the criteria for categorisation as Type A or Type B.

Top 10 retail tenants

The top 10 retail tenants accounted for 25.7% of the annualised passing rent of the Group as at 31 December 2025. Tenant concentration risk is very low, as shown by the graph below:

Romania

With a total of 28 regional malls and community centres, the Group is the largest owner of retail space in the country.

In 2025, significant progress was made on the Promenada Bucharest extension, including an enlargement and refurbishment of the food court area, with new brands openings such as Taco Bell, Wendy's and Hesburger.

2025 marked also the signing of the first agreement with Primark for the Group's Romanian portfolio, the new store being planned to open in Shopping City Sibiu in 2026. Given its vast portfolio, the Group secured and opened a few notable market entries such as Sports Direct in Promenada Craiova and Tatuum in Mega Mall.

Mega Mall Bucharest GLA 75,900m2 Valuation €346.0 million Passing rent €22.6 million EPRA Occupancy 98.8%

City Park Constanta GLA 51,900m2 Valuation €254.1 million Passing rent €17.1 million EPRA Occupancy 99.8%

Promenada Bucharest Bucharest GLA 39,300m2 Valuation €232.1 million Passing rent €15.2 million EPRA Occupancy 100%

Promenada Craiova Craiova GLA 63,700m2 Valuation €160.8 million Passing rent €12.4 million EPRA Occupancy 99.4%

Shopping City Timisoara Timisoara GLA 57,000m2 Valuation €158.7 million Passing rent €12.3 million EPRA Occupancy 99.6%

Shopping City Ploiesti Ploiesti GLA 52,300m2 Valuation €155.2 million Passing rent €11.6 million EPRA Occupancy 99.9%

Shopping City Galati Galati GLA 49,200m2 Valuation €155.1 million Passing rent €11.4 million EPRA Occupancy 99.8%

Shopping City Sibiu Sibiu GLA 83,200m2 Valuation €149.9 million Passing rent €12.5 million EPRA Occupancy 98.4%

Shopping City Targu Mures Targu Mures GLA 40,200m2 Valuation €116.9 million Passing rent €8.9 million EPRA Occupancy 99.9%

Promenada Sibiu Sibiu GLA 42,500m2 Valuation €115.8 million Passing rent €9.7 million EPRA Occupancy 98.2%

Iris Titan Shopping Center Bucharest GLA 43,100m2 Valuation €113.3 million Passing rent €10.0 million EPRA Occupancy 100%

Shopping City Deva Deva GLA 50,700m2 Valuation €109.6 million Passing rent €8.6 million EPRA Occupancy 100%

Braila Mall Braila GLA 52,900m2 Valuation €100.7 million Passing rent €8.0 million EPRA Occupancy 99.1%

Vulcan Value Centre Bucharest GLA 25,000m2 Valuation €82.3 million Passing rent €6.0 million EPRA Occupancy 100%

Shopping City Buzau Buzau GLA 23,700m2 Valuation €76.0 million Passing rent €5.7 million EPRA Occupancy 99.2%

Shopping City Satu Mare Satu Mare GLA 29,400m2 Valuation €72.7 million Passing rent €5.8 million EPRA Occupancy 100%

Shopping City Piatra Neamt Piatra Neamt GLA 28,000m2 Valuation €68.5 million Passing rent €5.3 million EPRA Occupancy 100%

Shopping City Ramnicu Valcea Ramnicu Valcea GLA 29,200m2 Valuation €67.3 million Passing rent €5.1 million EPRA Occupancy 98.8%

Shopping City Targu Jiu Targu Jiu GLA 27,200m2 Valuation €66.7 million Passing rent €4.8 million EPRA Occupancy 100%

Severin Shopping Center Drobeta Turnu Severin GLA 23,200m2 Valuation €49.5 million Passing rent €3.9 million EPRA Occupancy 100%

Pitesti Retail Park Pitesti GLA 21,500m2 Valuation €39.9 million Passing rent €3.1 million EPRA Occupancy 96.8%

Regional strip centres Alba-Iulia, Alexandria, Brasov, Petrosani, Sfantu Gheorghe, Sighisoara, Vaslui GLA 30,200m2 Valuation €49.2 million Passing rent €4.0 million EPRA Occupancy 99.1%

Poland

In 2025, Poland has strengthened its position as one of the two principal markets in NEPI Rockcastle portfolio. The full-year contribution of Magnolia Park and Silesia City Center, acquired in late 2024, combined with strong like-for-like tenant sales growth of 5%, drove an impressive uplift in portfolio value across the country.

The tenant mix was enriched with new functions, including the Just Gym fitness club and the Fikolki children’s activity centre,

as well as new fashion brands such as Medicine, Worldbox, and Verona.

The multi-stage refurbishment of Bonarka City Center reached significant milestones in 2025, including a complete redesign of the food court and common areas to integrate more natural light and greenery, ensuring it remains the dominant retail destination in southern Poland.

Silesia City Center Katowice GLA 85,300m2 Valuation €447.8 million Passing rent €31.0 million EPRA Occupancy 100%

Bonarka City Center Krakow GLA 76,300m2 Valuation €429.9 million Passing rent €26.5 million EPRA Occupancy 99.1%

Magnolia Park Wroclaw GLA 100,900m2 Valuation €397.3 million Passing rent €25.2 million EPRA Occupancy 100%

Forum Gdansk Shopping Center Gdansk GLA 63,500m2 Valuation €347.2 million Passing rent €19.8 million EPRA Occupancy 98.8%

Galeria Warminska Olsztyn GLA 42,900m2 Valuation €167.2 million Passing rent €11.3 million EPRA Occupancy 100%

Focus Mall Zielona Gora Zielona Gora GLA 44,100m2 Valuation €166.2 million Passing rent €12.2 million EPRA Occupancy 97.1%

Karolinka Shopping Centre Opole GLA 67,500m2 Valuation €161.4 million Passing rent €12.4 million EPRA Occupancy 99.5%

Copernicus Shopping Centre Torun GLA 48,000m2 Valuation €134.8 million Passing rent €10.3 million EPRA Occupancy 99.8%

Alfa Centrum Bialystok Bialystok GLA 38,200m2 Valuation €90.3 million Passing rent €8.6 million EPRA Occupancy 97.0%

Solaris Shopping Centre Opole GLA 26,400m2 Valuation €72.0 million Passing rent €6.2 million EPRA Occupancy 99.5%

Pogoria Shopping Centre Dabrowa Gornicza GLA 37,700m2 Valuation €65.5 million Passing rent €6.0 million EPRA Occupancy 99.8%

Aura Centrum Olsztyn GLA 25,400m2 Valuation €65.2 million Passing rent €6.3 million EPRA Occupancy 100%

Galeria Wolomin Wolomin GLA 33,600m2 Valuation €59.5 million Passing rent €5.2 million EPRA Occupancy 100%

Platan Shopping Centre Zabrze GLA 39,900m2 Valuation €59.2 million Passing rent €5.6 million EPRA Occupancy 98.6%

Focus Mall Piotrkow Trybunalski Piotrkow Trybunalski GLA 35,100m2 Valuation €42.4 million Passing rent €5.7 million EPRA Occupancy 99.1%

Galeria Tomaszow Tomaszow Mazowiecki GLA 18,200m2 Valuation €25.7 million Passing rent €3.0 million EPRA Occupancy 100%

Bulgaria

The Group owns Paradise Center, the largest retail centre in the country and Serdika Center, a modern shopping centre benefiting from an excellent location in Sofia together with Serdika Office, a Class A office situated atop the shopping centre.

In 2025 the centres went through major renovations of the food courts, delivering to the customer an elevated dining experience.

The tenant mix of the centers was further improved by adding key fashion names like Weekend by Max Mara and Marc Cain in Paradise Center, Mohito and Celio in Serdika Center. Reconfiguration and extension of retail space in both centres have started, so that increased market demand can be met and newest flagship concepts of international brands can be opened.

Paradise Center Sofia GLA 85,200m2 Valuation €363.5 million Passing rent €27.7 million EPRA Occupancy 99.9%

Serdika Center Sofia GLA 52,200m2 Valuation €213.1 million Passing rent €17.0 million EPRA Occupancy 100%

Hungary

The Group's Budapest portfolio comprises Arena Mall, the second largest shopping centre in the city, and Mammut Shopping Centre, giving NEPI Rockcastle an unrivalled retail presence in the Hungarian capital.

The refurbishment of Arena Mall Budapest reached major milestones in 2025 with 90% of the refurbished GLA

already pre-leased, ensuring the asset retains its status as Hungary’s premier retail destination. 

Hungary remained a key target for retailers' expansion, highlighted by the debut of Rituals in Mammut Shopping Centre. Additionally, Arena Mall strengthened its fashion leadership with the opening of high-profile flagship stores for Zara and Reserved.

Arena Mall Budapest GLA 65,900m2 Valuation €299.4 million Passing rent €19.9 million EPRA Occupancy 99.6%

Mammut Shopping Centre Budapest GLA 57,400m2 Valuation €238.4 million Passing rent €16.1 million EPRA Occupancy 92.7%

Slovakia

In Slovakia, the Group operates five regional malls alongside an office building in Kosice, the country's second largest city, forming one of the most extensive retail networks in the market.

The signing of Victoria's Secret at Aupark Kosice Mall, Rituals at Aupark Zilina and Galeria Mlyny in Nitra is a clear signal that well-known international brands increasingly recognise the appeal and strategic value of Slovakia's regional cities.

Aupark Kosice Mall Kosice GLA 33,100m2 Valuation €176.8 million Passing rent €11.7 million EPRA Occupancy 95.4%

Galeria Mlyny Nitra GLA 32,500m2 Valuation €137.3 million Passing rent €9.3 million EPRA Occupancy 95.3%

Aupark Zilina Zilina GLA 25,100m2 Valuation €136.8 million Passing rent €9.5 million EPRA Occupancy 98.0%

Aupark Shopping Center Piestany Piestany GLA 10,300m2 Valuation €43.2 million Passing rent €2.7 million EPRA Occupancy 93.6%

Korzo Shopping Centrum Prievidza GLA 16,300m2 Valuation €41.4 million Passing rent €3.8 million EPRA Occupancy 100%

Croatia

The Group owns the largest shopping destination in Zagreb, Arena Centar and Retail Park, comprising a shopping mall of 67,300m² and an adjacent retail park of 8,000m².

An extensive refurbishment programme launched in 2025 is transforming the mall's offer, with works including the relocation of the food court, a redesigned sports cluster, and the enlargement and full refurbishment of Zara.

The relocation of Bershka further elevates the tenant mix. At the Retail Park, a new KFC drive-thru has been developed and opened, adding GLA to the asset.

Czech Republic

The Group owns two dominant malls in the Czech Republic: Forum Usti nad Labem and Forum Liberec Shopping Centre, both situated in the northern part of the country.

After the complete refurbishment of Forum Liberec Shopping Centre, the tenant mix stays strong which is translated into the record lowest vacancy.

The opening of WorldBox and Tatuum further confirms the attractivity of Forum Liberec Shopping Centre for international brands. Forum Usti nad Labem enjoyed solid performance, attracting interest of well-known international brands and opening stores such as Sinsay and JD Sports.

Forum Liberec Shopping Centre Liberec GLA 46,400m2 Valuation €99.1 million Passing rent €6.6 million EPRA Occupancy 97.4%

Forum Usti nad Labem Usti nad Labem GLA 27,800m2 Valuation €95.5 million Passing rent €6.3 million EPRA Occupancy 99.1%

Lithuania

The Group owns Ozas Shopping and Entertainment Centre, one of Vilnius’ leading retail and entertainment assets, distinguished by its prime location and a well‑balanced portfolio of international tenants.

Ozas retains a strong competitive position through a distinctive mix of fashion and lifestyle brands, including the only Peek & Cloppenburg store in Vilnius,

alongside new-concept stores from all LPP Group brands, CCC, JD Sports and Douglas.

The centre is equally recognised as one of the city's leading entertainment destinations, home to Adventica, Action! by Apollo, Multikino, the Plaukimo Šeima swimming and education pool and fitness club GYM+ — one of the broadest leisure propositions in Vilnius.

Office

Serdika Office and Aupark Kosice Tower are the two office properties owned by the Group, both integrated with the shopping malls creating synergies with the retail component.

Serdika Office
Sofia, Bulgaria

GLA	28,500m2
Valuation	€47.6 million
Passing rent	€3.0 million
EPRA Occupancy	81.5%

Aupark Kosice Tower
Kosice, Slovakia

GLA	12,800m2
Valuation	€21.5 million
Passing rent	€1.6 million
EPRA Occupancy	92.3%

Industrial

The Group owns one industrial property, Rasnov Industrial Facility in Brasov county, Romania. As at 31 December 2025 this property was reclassified as held for sale.

Development and extensions pipeline

NEPI Rockcastle will continue to invest in developments contributing to growth and improving long-term portfolio prospects, proactively monitoring and revising the development pipeline in line with its evolving objectives and constraints. The total investment value of projects under construction or permitting is approximately

€845 million, of which €326 million was spent by 31 December 2025. During 2026, the Group estimates to invest €338 million in development and capital expenditure related to its ongoing projects and will consider new development opportunities depending on how market circumstances evolve.

1. GSA - Gross sellable area
2. Refurbishment and extension costs are allocated on the existing assets. The properties (including the refurbishment costs) are subject to fair valuation at half year and year-end
3. Opened in February 2026
4. Including residential project with 21,500m² GSA

Promenada Bucharest - extension Bucharest, Romania The extension will add 55,400m2 GLA of retail, office and hotel space to the existing shopping centre. Opening of the retail part is estimated for the first quarter of 2027. Ownership 100% Lettable area - property in use 39,300m2 Estimated lettable area - retail 32,000m2 Estimated lettable area - office 13,400m2 Estimated lettable area - hotel 10,000m2 Target opening - retail Q1 2027

Bonarka City Center - refurbishment Krakow, Poland A refurbishment which includes the extension by 4,700m2 of GLA. The estimated completion date is in the first quarter of 2027. Ownership 100% Lettable area - property in use 76,300m2 Estimated lettable area 4,700m2 Target opening Q1 2027

Pogoria Shopping Centre - extension Dabrowa Gornicza, Poland A refurbishment which includes the extension by 4,800m2 of GLA that was completed in February 2026. Ownership 100% Lettable area - property in use 37,700m2 Estimated lettable area 4,800m2 Opening Q1 2026

Arena Mall - refurbishment Budapest, Hungary Refurbishment of the actual space to be completed by second quarter of 2028. Ownership 100% Lettable area - property in use 65,900m2 Estimated lettable area N/A Target opening Q2 2028

Photovoltaic installations (PV) All portfolio The second phase of the Group's renewable energy programme will add another 15 MW in 21 of NEPI Rockcastle’s properties outside Romania (22 installations). Individual projects are under various stages of installation, completion estimated by the end of 2026. Total estimate installed power 15 MW Total number of locations1 21 Countries 6 Target opening 2026 22 installations on 21 properties in 6 countries outside Romania and Lithuania

Greenfield developments of Photovoltaic projects Romania The third phase of the Group's renewable energy programme involves investment in greenfield photovoltaic plants in Romania with a combined capacity of 159 MW. The first plant in Chisineu-Cris (54 MW) was completed in 2025 and is expected to commence commercial operations in Q1 2026, with the second plant in Aricestii Rahtivani expected to be operational by the end of 2026. Total estimate installed power 105 MW Location 1 Country Romania Target opening 2026

EPRA Performance measures

EPRA Performance measures

European Public Real Estate Association (EPRA), the representative organisation of the publicly listed real estate industry in Europe, has established a set of Best Practice Recommendation Guidelines (EPRA BPR), which focus on the key measures of the most relevance to investors. These recommendations aim to give financial statements of public real estate companies more clarity, more transparency and comparability across European peers.

The Group has been awarded for the last six years with Gold Award for BPR for financial reporting, the highest standard for transparency of financial performance measures.

Certain of these EPRA performance measures are considered to be pro forma financial information in terms of the JSE Listings Requirements. These include EPRA earnings (euro thousand), EPRA earnings per share (euro cents per share), EPRA net reinstatement value (NRV) (euro per share), EPRA net tangible assets (NTA) (euro per share) and EPRA net disposal value (NDV) (euro per share). These measures have been extracted, without adjustment, from the Group’s consolidated financial statements for the year ended 31 December 2025 and are the same as presented in the appendix titled EPRA Performance Measures as included in the reviewed condensed consolidated financial results of the Group for the year ended 31 December 2025, issued on 23 February 2026 and opined on by Ernst & Young Inc.

EPRA performance measures reported by NEPI Rockcastle are set out below:

1. Does not include investment property held for sale.

EPRA Earnings

EPRA Earnings presents the underlying operating performance of a real estate company excluding fair value gains or losses on investment property, profit or loss on disposals, deferred tax, and other non-recurring items, that are not considered to be part of the core activity of the Group.

1. Excludes 1,640,511 treasury shares as at 30 June 2025 and as at 31 December 2025.

EPRA Net Asset Value metrics (NAV)

The EPRA NAV set of metrics make adjustments to the NAV per the IFRS financial statements to provide stakeholders with the most relevant information on the fair value of the assets and liabilities of a real estate investment company, under different scenarios.

EPRA Net Reinstatement Value (NRV)

The objective of the EPRA Net Reinstatement Value measure is to highlight the value of net assets on a long-term basis. Assets and liabilities that are not expected to crystallise in normal circumstances such as the fair value movements on financial derivatives and deferred taxes on property valuation surpluses are therefore excluded. Since the aim of the metric is to also reflect what would be needed to recreate the company through the investment markets based on its current capital and financing structure, related costs such as real estate transfer taxes should be included.

EPRA Net Tangible Assets (NTA)

The underlying assumption behind the EPRA Net Tangible Assets calculation assumes entities buy and sell assets, thereby crystallising certain levels of deferred tax liability.

EPRA Net Disposal Value (NDV)

The EPRA Net Disposal Value provides the reader with a scenario where deferred tax, financial instruments, and certain other adjustments are calculated as to the full extent of their liability, including tax exposure not reflected in the Balance Sheet, net of any resulting tax. This measure should not be viewed as a “liquidation NAV” because, in many cases, fair values do not represent liquidation values.

For more detailed explanations of EPRA adjustments and requirements please refer to the EPRA Best Practices Recommendations (EPRA_BPR_Guidelines)

EPRA Net Asset Values as of 31 December 2025

1. The net deferred tax liability has been adjusted to account for the crystallization effect. This adjustment is based on management's estimation and reflects the anticipated future tax implications.
2. Calculated using publicly available quoted prices.
3. Excludes 1,640,511 treasury shares as at 31 December 2025.

EPRA Net Asset Values as of 31 December 2024

1. The net deferred tax liability has been adjusted to account for the crystallization effect. This adjustment is based on management's estimation and reflects the anticipated future tax implications.
2. Calculated using publicly available quoted prices.

EPRA NIY and “topped-up” NIY

The EPRA Net Initial Yield (NIY) is calculated as the annualised rental income based on passing cash rents, less non-recoverable property operating expenses, divided by the gross market value of the property.

In EPRA “topped-up” NIY, the net rental income is “topped-up” to reflect rent after the expiry of lease incentives such as rent-free periods and rental discounts.

1. Annualised passing rent computed based on the contractual rental amounts effective as at that date.
2. Exclude the impact of one-off or non-recurring effects on service charges incurred in the period.
3. Adjustment for unexpired lease incentives such as rent-free periods, discounted rent periods and step rents. The adjustment includes the annualised cash rent that will apply at the expiry of the lease incentive.

EPRA Vacancy Rate

The EPRA Vacancy Rate estimates the percentage of the total potential rental income not received due to vacancy.

The EPRA Vacancy Rate is calculated by dividing the estimated rental value of vacant premises by the estimated rental value of the entire property portfolio if all premises were fully leased. The EPRA vacancy rate is calculated using valuation reports performed by independent experts.

1. Excludes non-core properties.

EPRA Cost ratio

EPRA Cost ratios reflect the relevant administrative and operating costs of the business and provide a recognised and understood reference point for analysis of a company’s costs.

The EPRA Cost ratio (including direct vacancy costs) includes all administrative and operating expenses in the IFRS statements (net of any service fees).

The EPRA Cost ratio (excluding direct vacancy costs) is calculated as above, but with an adjustment to exclude vacancy costs.

EPRA loan-to-value (EPRA LTV)

The LTV ratio is an important metric that assesses the lending risk a lender bears by providing a loan as per the borrower's requirement and it shows the relation of debt to the fair value of the assets. NEPI Rockcastle has chosen to disclose, among other indicators, the EPRA LTV ratio, calculated in accordance with EPRA Best Practices Recommendations.

There are a few changes compared to existing LTVs. One of the main changes is that the current net receivables/payables amount is included in the calculation of EPRA LTV. Another company-specific change is that Group LTV considers property, plant and equipment related to its energy producing assets (photovoltaic installations) in the calculation.

Corporate insights

Executive Directors

		RÜDIGER DANY (63) Chief Executive Officer BSc
		Rüdiger Dany has extensive professional experience in international environments across Europe for some of the largest international retail and real estate companies including ECE, Atrium and Multi Corporation. During his tenure with Multi Corporation (affiliated with Blackstone), Mr Dany played an important role in optimising and expanding their property management portfolio for institutional investors. As a Board Member and COO of Multi, his major achievement was the value enhancement of Blackstone’s property portfolio and the successful opening of new shopping centres, developments and extensions of existing shopping centres. Mr Dany has also driven the creation of an innovation group within Multi to elaborate business opportunities by using modern PropTech tools, both B2B and B2C. Mr Rüdiger Dany was appointed as an Executive Director and Chief Operating Officer on 18 August 2021, and as Interim Chief Executive Officer on 1 February 2022. He was confirmed as CEO on a permanent basis on 1 June 2022. Mr Dany holds German nationality. Mr Dany's mandate concludes on 31 March 2026. He will be succeeded by Mr Marek Noetzel as Chief Executive Officer, effective 1 April 2026.

		ELIZA PREDOIU (41) Chief Financial Officer BCom, ACCA
		Eliza Predoiu has diverse finance and real estate expertise, including eleven years in the Company. She has proven expertise in multi-million funding projects, complex business transactions and integration processes of mergers, systems and controls. Prior to joining NEPI, she was Deputy Manager at PricewaterhouseCoopers, where she spent six years handling local and cross-border audit assignments and advisory projects in the Romanian and Cypriot offices. Mrs Predoiu joined the Company in 2014 and was promoted as Deputy Chief Financial Officer in 2018. She was appointed as Interim Chief Financial Officer on 1 February 2022 and from 1 June 2022 she was confirmed in her role on a permanent basis. Mrs Predoiu holds Romanian nationality.

		MAREK NOETZEL (47) Chief Operating Officer MSc, MRICS
		Marek Noetzel has been active on the Polish retail real estate market since 2002, gaining his professional experience at Cushman & Wakefield. As Head of the Retail department, he was responsible for commercialisation, development, asset management, investment and financial consultancy services, working for multiple international and national clients. Mr Noetzel joined Rockcastle in 2016 and played an important role in establishing the office in Poland and expanding operations abroad. He was appointed as an Executive Director of NEPI Rockcastle on 15 May 2017, responsible for the asset management of Company’s properties in Poland, Hungary, Slovakia, Czech Republic and Lithuania. He was appointed as Chief Operating Officer effective from 1 June 2022. Mr Noetzel holds Polish nationality. Mr Noetzel has been appointed as Chief Executive Officer, effective 1 April 2026. Mr Marius Barbu was appointed as Chief Operating Officer with effect from 1 April 2026, to succeed Mr Noetzel.

Corporate governance

Corporate Governance Framework

Based on King IV and Dutch governance codes, the Group governance framework comprehensively covers key governance areas and core principles:

• leadership, ethics, corporate citizenship and sustainability

• strategy, performance and reporting

• governing structure and delegation of authority

• functional areas governance

• stakeholders relationship management, including organisation of general shareholders' meetings

• misconduct and irregularities management

• takeover guidelines

Core leadership principles at Board level

The Board adopts best practice governance policies designed to align the interests of the Company, Board and management with those of the stakeholders, and promote the highest standards of ethical behaviour and risk management. The members of the Board individually and collectively cultivate a strong set of values, setting the company culture and leading by example.

Company’s culture

NEPI Rockcastle's culture is foundational to achieving its strategic objectives and delivering sustainable long-term value for all stakeholders. The Board recognises that a strong, ethical and purpose-driven culture underpins sound governance, operational excellence and stakeholder trust.

Purpose and values

The Group's purpose is to create vibrant retail destinations that enrich communities, support tenant success and generate sustainable returns for shareholders.
NEPI Rockcastle's core values guide decision-making at all levels and shape the Group's approach to business. These include:

Embedding culture throughout the organisation

The Board sets the tone from the top by demonstrating ethical leadership and holding management accountable for embedding the desired culture throughout the organisation. Key mechanisms for promoting and sustaining the Group's culture include:

• Code of Ethics: The Group's Code of Ethics sets clear expectations for behaviour and conduct across all levels of the organisation, covering matters such as integrity, conflicts of interest, fair dealing, confidentiality and compliance with laws and regulations. All employees and Directors are required to acknowledge and adhere to the Code, and regular training is provided to reinforce its principles

• Whistleblowing and speak-up culture: The Group maintains a confidential whistleblowing channel enabling employees, contractors and external parties to report concerns about unethical conduct, fraud, corruption or breaches of policy without fear of retaliation. The Audit Committee oversees the whistleblowing management process, ensuring that all reports are appropriately addressed

• Employee engagement and wellbeing: NEPI Rockcastle is committed to creating a positive working environment where employees feel valued, respected and empowered to contribute to the Group's success. Regular employee engagement surveys are conducted to gather feedback and identify areas for improvement. The Group invests in training and professional development to support employee growth, and promotes work-life balance

• Diversity and inclusion: The Group is committed to building a diverse and inclusive workforce. The Diversity Policy applies to the Board and management, promoting diversity across dimensions including gender, age, nationality, education and background. The Group has set measurable targets and monitors progress

• Performance and recognition: The remuneration framework is designed to align individual and team performance with the Group's strategic objectives and cultural values. Both financial and non-financial performance metrics are considered, including adherence to ethical standards and contribution to sustainability goals

Monitoring and assessing culture

The Board monitors the health of the organisation's culture through a range of indicators and reporting mechanisms, including employee engagement survey results, staff turnover and retention rates, whistleblowing reports and their resolution, compliance with the Code of Ethics, conflicts of interests review and monitoring risk reports. Management reports to the Board include various cultural aspects, and the Board considers culture as part of its annual evaluation of the effectiveness of governance arrangements.

The Board is satisfied that the Group's culture is aligned with its purpose, values and strategy, and that appropriate mechanisms are in place to embed, promote and monitor the desired culture across the organisation. The Board remains committed to fostering a culture of ethical conduct, accountability and continuous improvement as the foundation for long-term sustainable success.

Strategic oversight

In carrying out their oversight role, the Board actively engages in setting the long-term strategic goals of the organisation, ensures sustainable value creation, reviews and approves business strategy, corporate financial objectives, financial and funding plans (ensuring consistency with strategic goals) and monitors the Group's performance.

The Group has a robust strategic framework for long-term value creation, that has been reviewed and endorsed by the Board.

When approving the strategy, the Board considered:

• the Group’s impact on sustainability, including impact on the people and planet

• making a fair contribution to the countries in which the Group operates

• the impact of new technology and changing business models

The Board is essential in helping the Company articulate and pursue its purpose, with a focus on addressing issues increasingly important to investors, communities it operates in, clients and consumers.

The Board strongly believes that the Company's ability to design a strong long-term strategy and to manage environmental, social and governance matters, demonstrates the good governance ultimately required to achieve sustainable growth in the long-term. In this regard, the Board ensures that the organisation's strategy, risk management and sustainability considerations are integrated, recognising that sustainable business practices contribute to long-term value creation for all stakeholders.

The Group's strategy is designed and proposed by the management team and adopted by the Board. It is structured around major strategic directions, with each of the directions further developing into more granular objectives.

The Board takes an active role in monitoring how the Company is achieving its strategic objectives, based on regular management reports.

Role of the Board

The Board assumes collective responsibility for directing and governing the Group, ensuring effective corporate governance, promoting an ethical culture and overseeing that the organisation is a responsible corporate citizen. In line with King IV's stakeholder-inclusive approach, the Board ensures that the legitimate and reasonable needs, interests and expectations of all material stakeholders are balanced in the best interests of the organisation over time. This includes consideration of the interests of shareholders, funding partners, employees, tenants, visitors, suppliers, the community, the broader environment. Furthermore, the Board acts as a link between key stakeholders and the Group, by overseeing that transparent and effective communication mechanisms are in place.

A clear division of responsibilities at Board level is in place to ensure a balance of power and authority, including between the roles of Chairman, Lead Independent Director and Chief Executive Officer, roles which are clearly defined and segregated. This was designed to ensure that, either at Board or management level, no individual can hold single and unlimited control over the significant decision-making process. The Board delegates to management the authority and responsibility for day-to-day affairs through an Operational Mandate, while monitoring performance and overseeing compliance. This ensures that delegation to management contributes to role clarity and to the effective exercise of authority and responsibility.

In line with the governance framework, the Board meets regularly, at least four times a year.

No external advisors attend Board meetings on a regular basis, but they may be invited on a need basis to address various topics, as the Chairman deems necessary.

The Board holds two fundamental roles:

In line with the Articles of Association and the adopted Corporate Governance Framework, the Board:

• adopts the Group's strategy and budget based on management's proposal

• establishes a framework for the delegation of authority to Executive Directors and subsequent lines of management

• steers the Group in achieving its core targets including the execution of the investment and development strategy and monitors performance

• makes strategic decisions regarding significant financing transactions, following CFO’s recommendation

• oversees equity management

• monitors the financial performance of the business, including its going concern and viability, reviews the financial and operational results and approves the financial statements and the Group Annual Report

• facilitates effective communication and engagement with key stakeholders

• ensures that the Group's IT systems are integrated and support the delivering of the business strategy and internal processes

• oversees the enterprise risk management framework and approves the Group's Risk Policy and Risk Appetite

• oversees business conduct and ethical culture, by:

  • defining and approving key policies such as the Group Code of Ethics, Compliance Policy and Whistleblowing Policy

  • monitoring that management fosters a culture of ethical conduct and overseeing that it has implemented proper policies and procedures in line with the governance framework, the Board approved policies and the Company’s risk appetite

• oversees the overall effectiveness of the internal controls framework, designed to ensure that assets are safeguarded, operations are run efficiently, effectively and economically, proper accounting records are maintained, the published financial information is reliable, laws and regulations are complied with

• ensures an effective, risk-based, independent internal audit function

• oversees that the combined assurance model covers effectively the organisation's significant risks and material matters, through a combination of:

  • line functions that own and manage risks on a daily basis

  • specialist functions that facilitate and oversee risk management and compliance

  • internal auditors

  • independent external assurance service providers, such as external auditors

  • other external assurance providers, such as sustainability and credit rating agencies

Some of the duties above are delegated to specialised Committees, while the Board collectively retains accountability.

The Chairman of the Board is an Independent non-Executive Director who acts as a link between the Board and the Executive Management. According to the Group's Corporate Governance Framework, the Chairman:

• cannot be appointed as member or Chair of the Audit Committee or of the Risk and Compliance Committee

• cannot chair the Remuneration Committee

• must be a member of the Nomination Committee and can chair it

• cannot be appointed Chief Executive Officer or an Executive Director

The Chairman has the following main responsibilities:

• sets the ethical tone

• fosters corporate governance

• oversees the formal succession plan for Board members

• oversees the performance evaluation process, the onboarding of new Directors and the continuous development of Board members

• takes a lead role in removing non-performing Directors

• ensures that any material misconduct amongst the members of the Board is investigated and properly responded to

• ensures that Directors are mindful of their duties and responsibilities and foster proper functioning of the Board and Committees

• ensures that the Board's agenda reserves sufficient time for strategic discussions, including long-term value creation, sustainability, stakeholder relations and emerging risks

• sees that a Lead Independent Director is nominated

• ensures that amicable relationships are maintained with major shareholders and other key stakeholders

Supporting the Chairman, the Lead Independent Director has the following responsibilities:

• leads in the absence of the Chairman

• serves as a trusted advisor of the Chairman

• acts as a mediator between the Chairman and other members of the Board, if necessary

• chairs discussions and decision-making by the Board on matters where the Chairman may have a conflict of interest

• leads the performance appraisal of the Chairman

Group governance structure

The Executive Directors on the Board are the Chief Executive Officer (CEO), the Chief Financial Officer (CFO), the Chief Operating Officer (COO), and they are responsible for:

CEO

• ensures that a long-term strategy, in line with the Group's mission, is developed, advanced to the Board for approval and deployed

• establishes performance goals and allocates resources to ensure growth, achievement of strategic objectives, compliance with applicable laws and regulations and responsible citizenship, as well as ensures that the strategy supports sustainable long-term value creation

• ensures that a positive and ethical work environment exists and that the policies approved by the Board are implemented

• acts as a chief spokesman for the Group

• fosters communication between the Executive Directors, Management and non-Executive Directors

• maintains investor relations

The CEO is not a member of governing bodies outside the Group, except for private companies managing personal investments.

CFO

• manages the financial function of the Group, including the implementation of effective accounting, financial and fiscal policies

• takes responsibility for financial and fiscal compliance, as well as general reporting of business performance

• oversees the compilation of realistic budgets and their execution, including the analysis of variations

• identifies funding needs and ensures these can be met in a cost-effective manner

• supervises fiscal research, projections, analysis and optimisation

• interacts and maintains relationships with external auditors, regulators, analysts, rating agencies

• maintains investor relations together with the CEO

The CFO is not a member of governing bodies outside the Group, except for private companies managing personal investments.

COO

• drives strategy setting for the Group’s portfolio and ensures implementation, monitoring and performance reporting

• drives opportunity analysis for each asset and proposes potential shifts in assets management strategy

• contributes to the capital allocation decisions

• assesses the Group’s operations, profitability and sustainability, coordinates improvement proposals and the implementation of core initiatives in the Group’s assets and operations

• coordinates tenants engagement strategy, optimising returns and monitoring tenants performance and occupancy cost

• ensures swift, efficient and integrated processes and drives necessary performance improvement initiatives across the Group

• drives the setting of a customer-centric culture

The COO is not a member of governing bodies outside the Group, except for private companies managing personal investments.

Employees representatives are not appointed in the Board, nor participate in Board meetings. While employees are not formally represented on the Board, the Board ensures that mechanisms are in place to enable employee engagement and to receive employee feedback.

Board appointments

In accordance with the Articles of Association, Directors are appointed, suspended or removed by the shareholders. Appointment is made based on the Board’s binding nomination, which can be deprived of its binding character by the shareholders decision. The Board can suspend Executive Directors, while the suspension can be lifted by the shareholders.

To facilitate the Board’s regular refreshing, the Group has a retiring-by-rotation policy, which means that each year, at least one third of the Directors retire by rotation and may stand for re-appointment by the shareholders. Therefore, within a three-year period, all Directors retire at least once.

The Board appointments are conducted in a formal and transparent manner following recommendations made by the Nomination Committee to the Board. Candidates’ profiles are carefully analysed and the Board considers whether they have the necessary background, experience, competencies, independence and diversity, as set out in the Board Profile Paper and in the Group Diversity Policy. High-profile and experienced recruitment agencies may be used to identify and assess new Director candidates, based on the decision of the Nomination Committee. The candidates’ background and references are analysed, and multiple information sources are used for the assessment.

The independence of newly proposed Directors is evaluated by the Nomination Committee and presented to the Board, as well as reassessed annually, based on clear criteria defined in the Corporate Governance Framework, formalised and approved by the Board.

A formal onboarding programme is in place when new Directors join the Company, under the close coordination of the Chairman of the Board, with support from the CEO and the Company Secretary. The onboarding programme is designed to help the new Director become familiar with the Group’s business, strategy, policies and structure, as well as the operational approach in the Board and Committees activity. The programme covers general financial, social, legal affairs and financial reporting, as well as aspects that are specific to the Group and its business.

Board profile, diversity and independence assessment

Non-Executive Directors are key advisors to management, counselling on the strategic direction, while considering business opportunities and the Group’s risk appetite.

In order to ensure that the Directors’ varied backgrounds and experience provide NEPI Rockcastle with an appropriate combination of knowledge and expertise that is necessary to manage the business effectively, the Group developed a Board Profile. The profile sets the competencies, expertise and background expected from the Directors. It also sets out principles of diversity, independence, and representation of Executive versus non-Executive Directors.

When selecting members of the Board, the following factors will be relevant:

• responsible performance of the duties attributed to the Board by legislation, the Dutch Corporate Governance Code, JSE regulations, the Company’s Articles of Association and other regulations and code of conduct

• balance between nationalities, gender, age, education, experience and background of each of the members of the Board

• experience and affinity with the nature and culture of the business of the NEPI Rockcastle Group

• political landscape understanding and cultural knowledge of the countries where the NEPI Rockcastle Group operates

• international knowledge of and experience in financial, legal, economic, commercial, social and marketing areas

The Group Diversity Policy was formalised in 2022 to align to Dutch legislation. It applies to the Board and to management, and strives to ensure that no team, business function or management level comprises more than 70% of the same gender or age group.

When examining Board composition, the Group approaches diversity in a broad sense, covering factors such as nationality, gender, age, education and work background.

During 2025, 33% of the Executive Directors and 22% of the non-Executive Directors were female.

In order to close the gap to the Diversity Policy, new appointments of non-Executive Directors will continue to be made considering the required diversity quota.

Management Board (i.e. Executive Directors) composition is in line with the Diversity Policy provisions, therefore no additional short-term measures are envisaged by the Group.

Senior management composition, i.e. function leads, is in line with the Diversity Policy provisions (with 38% female – 62% male), therefore no additional short-term measures are planned by the Group. Middle management and subject-matter employees composition is also in line with the Diversity Policy (with 69% female – 31% male), with no additional initiatives planned by the Group.

On 31 December 2025, the Board, based on an annual self-assessment of the Group’s current set-up and needs, was satisfied with the skill set, mix of knowledge and diversity of culture and background of its Directors.

Age	Executive / non-Executive
Experience	Independence of non-Executive Directors
Gender	Country of nationality

Independent non-Executive Directors play a crucial role in acting as a sounding panel to the Executives and the non-Independent, non-Executive Directors, ensuring Board discussions and decisions are conducted in an objective manner and in the best interest of the Group.

Specific guidance provided by King IV and the Dutch Corporate Governance Code has been followed by the Group in establishing, in its Corporate Governance Framework, the criteria for evaluating the Directors’ independence on an annual basis.

The following criteria have been used by the Nomination Committee to assess the independence of the Board’s non-Executive Directors in 2025. The Director or close family members:

1. have not been an employee or Executive Director of NEPI Rockcastle (including associated companies, in the five years prior to the appointment) or have temporarily performed management duties during the previous twelve months in the absence or incapacity of any Executive Director

2. have not received personal financial compensation from NEPI Rockcastle or a company associated with it (including by participating in the Group’s share incentive scheme), contingent on Group performance and in so far as this is not in the normal course of the business, other than the fixed compensation received for the work performed as a board member

3. have not had an important business relationship with NEPI Rockcastle or a company associated with it in the year prior to the appointment (note: this includes in any event the case where the board member, or the firm of which he/she is a shareholder, partner, associate or advisor, has acted as advisor to NEPI Rockcastle - consultant, civil notary or lawyer - and the case where the board member is a management board member or an employee of a bank with which NEPI Rockcastle has a lasting and significant relationship)

4. are not a member of the management board of a company in which an Executive Director of NEPI Rockcastle is a supervisory board member

5. do not have a shareholding in NEPI Rockcastle or have not provided financing, material to his/her wealth, taking into account the shareholding of natural persons or legal entities cooperating with him or her on the basis of an express or tacit, verbal or written agreement

6. are not an employee, member of the management board (or executive director) or Board of Directors (or supervisory board) – or is not a representative in some other way – of a legal entity that is a significant funding provider (equity or debt), unless the entity is a NEPI Rockcastle Group company

7. have not been an external auditor of the Group or a key member of the external audit engagement team during the preceding 3 financial years

The Board members are independent from one another and are able to operate critically vis-a-vis one another. The independence assessment criteria was applied to all non-Executive Directors and only one in nine Directors did not meet all independence criteria. The Director considered a non-Independent non-Executive Director (Mr Steven Brown, who is also the CEO of Fortress Real Estate Investments Limited) was nominated by one of the shareholders representing more than 10% in the Company’s shares and voting rights.

The Board confirms that the independence provisions required by the Dutch Corporate Governance Code and King IV were complied with during the non-Executive Directors independence assessment. In accordance with the Dutch Corporate Governance Code, the Board is mindful that extended tenure beyond eight years warrants heightened scrutiny regarding continued independence. Non-Executive Directors who have served beyond eight years have been subject to enhanced assessment by the Nomination Committee and the Board, confirming that their independence of mind and judgement remains unimpaired. During the independence assessment process, substantive independence factors were considered. The Nomination Committee and the Board assessed whether the Directors:

• meet all other independence criteria under the corporate governance requirements

• have been involved in any confirmed conflict‑of‑interest situation during their service

• have exercised objective judgment, with no interest, position, association, or relationship that could unduly influence or bias decision‑making or oversight responsibilities

• hold direct or indirect participations in the Group and if the director declared those were immaterial to the overall net wealth

• have served in different board committees along the years, mitigating the risk of entrenchment associated with long continuous service

• have limited overlap with current executives - the period of service alongside the present management team has not been extensive, reducing the risk of close alignment over time

• maintain personal ties with management or controlling shareholders - no relationships exist that could compromise objective judgment or create perceived dependence

• receive remuneration that is not material relative to their personal finances and hold a limited number of committee roles—reducing financial dependence and entrenchment risk

• maintain a reputation and external standing that are not overly tied to the company, supporting independence of mind and perception

• demonstrate openness and remain up to date with evolving governance practices

• encourage contributions from newer or younger directors, supporting diversity of viewpoints and constructive challenge to management

• apply active oversight and rigorous challenge by preparing thoroughly, asking probing questions, and verifying information, thereby demonstrating independence in practice

The Board will continue to monitor long-tenured directors closely and ensure appropriate succession planning to maintain Board refreshment.

The Directors tenure in NEPI Rockcastle, as of the end of 2025, is depicted below.

The Board of Directors continued to have a stable structure in 2025. In accordance with  the Company's Articles of Association, at least one-third of the Directors retire by rotation at each annual General Meeting and, if willing, may stand for re-election; whilst this rotation mechanism operates

within the four-year maximum appointment term prescribed by best practice provision the Dutch Corporate Governance Code, it ensures that Directors are reconfirmed by shareholders more frequently.

Details of the non-Executive Directors background and expertise as of December 2025

	George Aase (63) BSc, CPA
Career George Aase is an experienced Chief Financial Officer, with expertise gained in publicly traded real estate firms, technology companies and Fortune 100 US multinational industrial firms. He is a highly strategic and business-oriented senior finance executive with extensive experience in leadership roles. His core specialties include corporate finance, capital markets, IPO transactions, debt financing, international financial operations, international finance and controlling and investor relations, with over 12 years’ experience in the real estate sector. He led three major initial public offerings in London, Zurich and Frankfurt. Mr Aase also possesses extensive financing and debt restructuring experience and has managed various portfolios connected with major acquisitions and underwriting. Mr Aase holds dual citizenship in the United States and Switzerland. Mr Aase was appointed as Independent non-Executive Director on 28 August 2018 and as Chairman of the Board effective 18 August 2021. Mr Aase was re-appointed by the shareholders as an Independent non-Executive Director upon Company migration to the Netherlands in 2022.
Appointments as of 31 December 2025 NEPI Rockcastle Chairman of the Board Chairman of the Nomination Committee Member of the Investment Committee Member of the Remuneration Committee Other listed companies SMG Hospitality – Board member

	Andreas Klingen (61) MBA (RSM)
Career Mr Klingen has more than 30 years of experience in the financial services sector, most of which is in Banking in Central Eastern Europe and Commonwealth of Independent States (CIS). He held various senior positions within Investment Banking at Lazard, Frankfurt and JP Morgan, London. Thereafter, he became Head of Group Development of Erste Group, Vienna, and Deputy CEO of Erste Bank, Kiev. He has been working as an independent advisor since 2013. Since 2005, Mr Klingen served as a Supervisory Board member or a non-Executive Director in 14 institutions in 11 countries, including listed and regulated entities. Mr Klingen holds German citizenship. He was appointed as an Independent non-Executive Director of NEPI Rockcastle on 17 April 2019 and as Lead Independent Director effective 28 September 2020. Mr Klingen was re-appointed by the shareholders as an Independent non-Executive Director upon Company's migration to the Netherlands in 2022.
Appointments as of 31 December 2025 NEPI Rockcastle Lead Independent Director of the Board Chairman of the Audit Committee Member of the Sustainability Committee Member of the Nomination Committee Other listed companies None

	Antoine Dijkstra (62) MSc, COL (INSEAD)
Career Antoine Dijkstra started his career at Credit Agricole in Rotterdam, Paris and Frankfurt. Mr Dijkstra has extensive experience in banking and investment management, with a focus on public sector related entities and financial institutions. He held various board and managing roles within AIG, NIBC (Netherlands), Harcourt Investment Management (Zurich), JP Morgan/Bear Stearns (UK) and Gulf International Bank (Bahrain). Currently he is a senior advisor to several companies, member of the Board of Trustees of SMU University and member of the Executive Committee of Cox School of business in Texas, USA. Mr Dijkstra holds Dutch citizenship. Mr Dijkstra was appointed as Independent non-Executive Director of NEPI in 2016 and Independent non-Executive Director of NEPI Rockcastle on 15 May 2017. Mr Dijkstra was re-appointed by the shareholders as an Independent non-Executive Director upon Company's migration to the Netherlands in 2022.
Appointments as of 31 December 2025 NEPI Rockcastle Chairman of the Risk and Compliance Committee Member of the Audit Committee Member of the Nomination Committee Member of the Sustainability Committee Other listed companies None

	André van der Veer (57) BPL, MPL
Career After completing a Masters’ degree in Banking and Economics in 1991, Andre van der Veer joined Rand Merchant Bank (RMB) where he founded the agricultural commodities and derivatives trading group in 1995. He headed the trading, derivatives structuring and proprietary trading teams and in 2003 joined the RMB Equity Global Markets team. He became Head of RMB Equity Proprietary Trading desk in 2009, with a mandate to invest in debt and equity instruments globally. Mr van der Veer founded Foxhole Capital during 2012 as a family office specialising in global real estate securities in listed and private equity markets. He was a non-Executive Director of Rockcastle from 2014 to 2017, and also the Chair of Rockcastle’s Investment Committee. Mr van der Veer holds South-African citizenship. Mr van der Veer was appointed as Independent non-Executive Director of NEPI Rockcastle on 15 May 2017. Mr van der Veer was re-appointed by the shareholders as an Independent non-Executive Director upon Company's migration to the Netherlands in 2022.
Appointments as of 31 December 2025 NEPI Rockcastle Chairman of the Investment Committee Member of the Audit Committee Member of the Risk and Compliance Committee Member of the Remuneration Committee Other listed companies None

	Andries de Lange (52) CA (SA), CFA
Career After qualifying as a chartered accountant, Mr Andries de Lange joined the Industrial Development Corporation of South Africa Limited and then Nedbank Limited where he gained experience in debt finance, debt and equity restructurings and private equity. He joined Resilient REIT Limited, a South African based property focused company which listed on the JSE in 2004, holding several positions including Financial Director between 2006 and 2011, and thereafter Chief Operating Officer from 2011 until 2020. Mr de Lange holds South-African citizenship. Starting May 2020, Mr De Lange was appointed non-Independent non-Executive Director in NEPI Rockcastle. Mr de Lange was re-appointed by the shareholders as an Independent non-Executive Director upon Company's migration to the Netherlands in 2022.
Appointments as of 31 December 2025 NEPI Rockcastle Chairman of the Remuneration Committee Member of the Nomination Committee Other listed companies None

	Steven Brown (45) CA (SA), CFA
Career Mr Brown has a strong background in the property industry, commencing as a listed property analyst in 2008 for Corovest. Following this, he joined Standard Bank’s Global Markets division in the equity derivatives finance team and thereafter joined the South African real estate division focusing on structured lending and equity transactions. Since 2013, Mr Brown has been involved with a number of listed real estate companies focusing on deal origination and structuring. Mr Brown is currently the Chief Executive Officer and Managing Director of Fortress Real Estate Investments Limited, a company that he joined in December 2015, following the acquisition by Fortress Real Estate Investments Limited of Capital Property Fund. Mr Brown holds dual citizenship in the South-Africa and UK. He was appointed as non-Independent non-Executive Director of NEPI Rockcastle on 28 April 2020. Mr Brown was re-appointed by the shareholders as a non-Independent non-Executive Director upon Company's migration to the Netherlands in 2022.
Appointments as of 31 December 2025 NEPI Rockcastle Member of the Investment Committee Member of the Risk and Compliance Committee Member of the Sustainability Committee Member of the Nomination Committee Other listed companies CEO Fortress Real Estate Investments Limited

	Ana Maria Mihaescu (70) BSc, IDP (INSEAD)
Career Ana Maria Mihaescu has 30 years of banking and finance experience. Ms Mihaescu worked for the International Finance Corporation (IFC) for 20 years, most recently as IFC’s Regional Manager for Central and Eastern Europe. She also represented the IFC on the boards of investee companies, banks, leasing companies and private equity funds. Ms Mihaescu was the first Country Manager for IFC in Romania. She is an alumna of the Bucharest Academy of Economic Studies and received a certificate for the International Directors Program from INSEAD. Ms Mihaescu holds Romanian citizenship. Ms Mihaescu was appointed as an Independent non-Executive Director effective 18 August 2021. Ms Mihaescu was re-appointed by the shareholders as an Independent non-Executive Director upon Company's migration to the Netherlands in 2022.
Appointments as of 31 December 2025 NEPI Rockcastle Chairwoman of the Sustainability Committee Member of the Audit Committee Member of the Remuneration Committee Other listed companies Non-Executive Director Medlife

	Jonathan Lurie (49) MBA
Career Jonathan Lurie has 25 years of investment and management experience in the European shopping centre industry. Mr Lurie is the Managing Partner of Realty Corporation Ltd, a real estate and PropTech investment and advisory firm, and a senior advisor to McKinsey & Co, where he provides strategic advice on real estate transactions, financing, capital allocation, management, and operations, to leading institutional investors and developers globally. Mr Lurie previously held various senior executive positions at Blackstone and was Executive Director and Head of Real Estate Investment Management – Europe for Goldman Sachs. Mr Lurie has held management and supervisory board positions in several large-scale European property companies such as OfficeFirst AG (IVG), Multi Corporation, Anticipa, Logicor, Blackstone Property Management, GSW AG, Songbird Estates plc (owner of Canary Whart Group plc) and TLG Immobilien. Mr Lurie serves as an independent member of the Standards and Regulations Board of the Royal Institution of Chartered Surveyors (RICS). Mr Lurie graduated as an Economics Major with Highest Honors from Princeton University and has an MBA from the Wharton School, University of Pennsylvania. He is a member of the International Council of Shopping Centers (ICSC). Mr Lurie was appointed as an Independent non-Executive Director effective 18 August 2021. Mr Lurie was re-appointed by the shareholders as an Independent non-Executive Director upon Company's migration to the Netherlands in 2022.
Appointments as of 31 December 2025 NEPI Rockcastle Member of the Investment Committee Member of the Risk and Compliance Committee Other listed companies SGS Finco Ltd – non-Executive Director

	Jeanine Holscher (60) CFA
Career Jeanine Holscher possesses over 25 years of leadership experience spanning retail, travel, services industries, and international strategy consulting. Ms Holscher brings a wealth of leadership experience, having served in various high-profile roles within the retail and service sectors. Notably, Ms Holscher has held the positions of CEO at Blokker (Dutch household chain with over 400 stores), where she orchestrated a significant turnaround strategy, and COO of Mirage Retail Group (holding company for Blokker, Intertoys and Miniso retail chains in the Netherlands), managing a portfolio that generated turnover in excess of €1 billion. Her career is marked by a series of strategic leadership roles that have contributed to her deep understanding of the retail industry and its operational, financial, and digital transformation challenges. In addition to her executive roles, Ms Holscher has demonstrated her commitment to corporate governance through her involvement on supervisory boards, where she has provided invaluable oversight and strategic direction. Ms Holscher is an alumnus of the Nyenrode Business Universiteit in the Netherlands, and her extensive experience is complemented by a solid educational foundation in business and leadership. Ms Holscher holds Dutch citizenship. Ms Holscher was appointed as an Independent non-Executive Director effective 14 May 2024.
Appointments as of 31 December 2025 NEPI Rockcastle Member of the Sustainability Committee Member of the Nomination Committee Other listed companies Non-Executive Director Cabka NV

The Board and Committees 2025 calendar and attendance information

Note: Considering the CEO succession process, the Nomination Committee organised three additional meetings to interview suitable candidates for the position, and all members participated.

1. Mr Steven Brown was appointed a member in the Nomination Committee effective 7 July 2025. Presence records are counted after this date

Development, evaluation and succession planning

In accordance with the Corporate Governance Framework, the Board is responsible to ensure that its performance, profile, composition, competences and expertise, and those of its Committees, support continued improvement.

Overview of the 2025 evaluation process:

• Independent evaluation: Korn Ferry facilitated a comprehensive board review in late 2025, agreed in advance with the Chair to align with the Board’s calendar and focus on priority areas. The objective was to assess board effectiveness, composition, processes, and alignment with governance best practices

• Survey and interviews: All directors (executive and non-executive) participated in a confidential online questionnaire. This was followed by two one-on-one interviews with the Chair and the newly appointed non-Executive Director in 2024, to probe deeper insights and context behind the survey answers

• Confidentiality: All feedback was anonymised and handled with strict confidentiality, encouraging directors to provide candid input. Neither individual survey responses nor interview comments were attributed in the report, fostering an environment of trust throughout the process

• Reporting: Korn Ferry adapted the questionnaire and interview findings into a forward-looking report with actionable recommendations. A draft was first discussed with the Chair and Company Secretary, then the final findings were presented to the full Board in January 2026. The report highlighted the Board’s strengths and development areas, forming the basis for an agreed action plan to enhance board effectiveness going forward

As part of this process, the Board reflected on its role in strategy oversight, succession planning, Board composition, decision making processes, and the functioning of Committees. The review confirmed that the Board is operating effectively, while also identifying opportunities to further strengthen strategic ownership, long-term stewardship, and succession readiness.

Key areas covered during the evaluation included:

• the structure, composition, and effectiveness of the Board and its Committees, including diversity, expertise, and mix of skills

• the quality of Board processes, decision making, dynamics, teamwork, and collaboration, as well as the display of ethical values, independence, and objectivity

• the Board’s contribution to strategy, performance monitoring, risk management, succession planning, remuneration, and corporate governance

Based on the outcomes of the review, the Board agreed a set of forward-looking priorities aimed at further enhancing its effectiveness, with particular focus on strategy ownership, succession planning, Board renewal, and the prioritisation of Board and Committee agendas. Progress against these priorities will be monitored.

The key findings of the 2025 evaluation revealed:

• a well-functioning Board, effective oversight processes and governance fundamentals

• continuous focus areas: strategy oversight, succession planning, optimization of topics coverage between the Board and its Committees

The findings of the evaluation process were discussed at committees level and within the Board, and specific action plans have been agreed.

Keeping abreast of developments in governance practices, regulatory requirements, market and industry trends, sustainability, digital and technological topics, and broader economic and social considerations remains a priority for the Board. The Directors’ development program includes dedicated sessions addressing these areas to support informed and effective oversight.

A formal succession process is in place to ensure continuity for the critical executive and board positions and that changes compliment the knowledge and experience at Board level. Succession planning includes:

• identifying the knowledge, skills and experience the Board should collectively possess to effectively fulfil its roles and responsibilities

• ensuring an appropriate balance in terms of diversity, expertise and knowledge among the Directors, in accordance with the targeted Board Profile

• identifying in due time qualified individuals suitable for nomination and recommending them to the shareholders at the Annual General Meeting (AGM)

• achieving continuity through a smooth succession of Directors (including Board and Committees leadership) that balances perspective and independence with experience and knowledge

• satisfying compliance within the legal and regulatory framework applicable to the Group

Succession plans and the results of the succession management process were timely communicated during 2025: effective 1 April 2026, Mr Marek Noetzel, Group COO, was appointed Group CEO, replacing Rüdiger Dany, the current Group CEO. Mr Marius Barbu, currently Group Asset Director, was appointed Group COO, effective the same date.

Directors’ dealings and related party transactions

Dealing in Company’s securities by Directors, their associates and key Group employees, is regulated and monitored in accordance with the applicable stock exchange listing requirements, guidelines, legislation, regulations and directives.

To prevent the risk of insider trading and to ensure that none of the restricted persons abuse, and do not place themselves under suspicion of abusing inside privileged information, the Group has adopted a formal Dealing Code, available and communicated to all employees and Directors.

The Dealing Code sets out obligations for the Group’s Directors, managers, staff and persons closely associated with them, under the Market Abuse Regulation and stock exchange listing requirements and guidelines, regarding clearance to deal and notification of transactions in the Group’s securities. The Group prohibits all Directors and employees from using confidential information, not generally known or available to the public, for personal benefit.

NEPI Rockcastle maintains a closed period from the end of a financial period until publication of the financial results for that period and a prohibited period when sensitive information not yet publicly available is known by the Company’s employees or Directors. The Group announces closed and other prohibited periods to its employees and the Company’s Directors, and, during such periods, all those with insider knowledge are banned from dealing.

In compliance with JSE Listings Requirements, the Company announces publicly all its Directors’ dealings in the Company’s securities, through SENS.

Directors and Directors’ associates interests are disclosed in line with the Declaration of Interests Policy. Directors’ direct and indirect holdings as of year-end are published in the Annual Report. Moreover, the Group formalised its related party transactions policy, in line with JSE Listings Requirements and applicable international accounting standards.

According to the Group Code of Ethics, Board members must be alert to conflicts of interest and uphold ethical conduct. They should refrain from the following:

• engaging in personal business that may compete with the Group

• demanding or accepting substantial gifts from the Group or from any of its employees or partners, for themselves or their spouse, registered partner or other life companion, foster child or relative by blood or marriage up to the second degree

• providing unjustified advantages to third parties at the Group’s expense

• taking advantage of business opportunities that the Group would be entitled to

• allowing in any other way the influence of third parties to compromise or override independent judgement

• using confidential information related to the Group for their own personal benefit

• making use of inside information to make a profitable investment

• taking advantage of their position as Directors to earn profit for him/her-self

• making personal use or advantage of an opportunity obtained through the Group

Potential conflicts of interest related to topics on the agenda are checked at each Board and Committee meeting. Any potential conflict of interest would be declared and discussed in the Board meeting. The Board needs to decide on the measures to be implemented and the degree of further involvement of the respective Director in the matter at hand.

Any actual conflict of interest deemed significant by the Board during the year would be disclosed in the Annual Report. Such information considers, but is not limited to, related party transactions and cross-shareholdings.

Related party transactions will be entered into, only if beneficial to the Group entities and on the customary market terms that they would have been concluded with an independent party (arm’s length principle). The Group ensures that identification, negotiation, conclusion of related party transactions by Group entities are governed by:

• fairness

• objectivity

• arm's length

• proper record keeping

No actual conflicts of interest have been identified in 2025 and no related party transactions, as defined in the internal policy, have been carried out by the Group entities, besides those detailed in the Related Party Transactions note and/or the Remuneration Report.

Company Secretary

The Company Secretary assists the Board in overseeing that the Group complies with statutory and regulatory requirements and ensures that the Board members are informed of their legal responsibilities. More specifically, the Company Secretary is tasked with the following:

• ensures that the procedures for the appointment of Directors are observed and that the process is traceable

• ensures that Board matters such as onboarding of new members, development programmes, training and evaluation are properly organised and any activity or information related to the Board is properly stored

• supports the Chairman in making the Board members aware of significant relevant laws, regulations and codes, as well as circulating emerging information to Group entities

• sees that agenda and materials are distributed in time, that detailed minutes of Board meetings are kept and that Board decisions are distributed, tracked and reported upon in collaboration with the Executive Directors

• ensures that proper procedures are followed at Board level and that the statutory obligations and obligations under the Articles of Association are complied with

• oversees compliance with the conflict of interest rules applicable to the Board under the Declaration of Interests Policy and Code of Ethics, and maintains records as evidence thereof

• provides corporate governance advice to the Board members

• generally supports the Chairman of the Board in the organisation of the affairs of the Board

• coordinates and guides the activity of other persons appointed as Secretary of Board Committees

The Board is satisfied with the competence, qualifications, experience and support provided by the Company Secretary in 2025.

Delegation to Committees

Without abdicating accountability, the Board delegates certain functions to certain committees. The following requirements are considered when appointing committee roles, in line with the governance framework:

• the Chairman of the Audit and the Remuneration Committees must be an Independent Director

• the Nomination and Remuneration Committee should only consist of non-Executive Directors, and the majority should be independent

• directors who are not members of a Committee may attend based on invitation meetings to gain/offer information, but will not vote

• the CEO cannot be a member of the Remuneration, Audit or Nomination Committees, but may attend by invitation their meetings

The Board considers the allocation of roles and responsibilities and the composition of membership across committees holistically, to achieve the following:

• effective collaboration through cross-membership between Committees where required, coordinated timing of meetings and avoidance of duplication or fragmented functioning in so far as possible

• where more than one committee has jurisdiction to deal with a specific matter, the role and positioning of each committee in relation to such matter are defined, to ensure complementary rather than competing approaches

• a balanced distribution of power in respect to membership across committees, so that no individual would dominate the decision-making process and no undue reliance would be placed on a single individual

The role of each Committee, together with responsibilities, accountability and operating guidelines, are documented in the Committees Charters, available, together with the Corporate Governance Framework document on the corporate website.

The Committees Charters are approved by the Board and are reviewed periodically, considering regulatory guidance and industry best practices, to ensure the Board and its Committees are adaptive and responsive to new requirements and continue to practice strong oversight.

The Committee members are appointed by the Board, and any of the members may be removed by the Board, except for the Audit Committee, for which membership is voted in the AGM. The Committees activity is reviewed by the Board, to ensure effective discharge of their duties and oversight through an appropriate mix of knowledge, background and independence.

Audit Committee

According to the corporate governance requirements and in full alignment with best practices, the Audit Committee:

• consists of at least three Independent non-Executive Directors

• is chaired by an Independent non-Executive Director who is not the Chairman of the Board

• consists of members fully conversant with finance and accounting principles, and who are knowledgeable about the affairs of the Company

• consists of members who must have a fair understanding of International Financial Reporting Standards, internal controls, external and internal audit processes, corporate law, sustainability issues and information technology

The Chairman of the Board may attend meetings by invitation but cannot be nominated as member or Chair.

According to its charter, the Audit Committee is responsible to:

A. In relation to external audit:

• nominate for appointment the external auditors

• review the auditors' fees and terms of engagement, and ensure that the appointment complies with relevant legislation

• assess the external auditors' independence and objectivity

• review external audit reports to ensure that prompt action is taken by management in all relevant areas

• review any significant disagreement between management and the external auditors

• evaluate the performance of the external auditors and the quality and effectiveness of the audit process

• develop a process to ensure that the Audit Committee receives notice of any irregularities reported to the Independent Regulatory Board for Auditors

B. With respect to financial reporting:

• evaluate the Group Annual Report for reasonability, completeness, consistency and accuracy prior to approval by the Board

• evaluate significant management decisions affecting the financial statements, including changes in accounting policy, resolutions requiring a major element of judgement and the clarity and completeness of proposed disclosures

• oversee compliance with tax regulations, ensure that the Company has implemented a transparent taxation policy and that this is appropriately disclosed, as well as advise management on various decisions related to taxation matters

• in consultation with external and internal auditors, review the integrity of the Group's financial reporting processes

• consider the quality and appropriateness of the Company's accounting policies

• determine whether and how the external auditors should be involved in the review of the content of financial reports published, other than the financial statements

• review complex and/or unusual transactions

• recommend to the Board whether it should issue a going concern statement, based on the assessment provided by the CFO

C. With respect to internal controls:

• gain an understanding of the Group's key risk areas and the internal controls structure

• evaluate whether management is setting the appropriate control culture

• monitor the effectiveness and efficiency of the internal controls and risk management system, considering the Company’s Risk Appetite, the key company risks as identified in the risk management process overseen by the Risk and Compliance Committee and management’s reports

• review the substantiation process based on management’s reports and the appropriateness of the statement on internal controls and risk management (including alignment to Dutch Corporate Governance Code requirements)

• consider how management is held accountable for the security of computer systems, applications and networks, and for setting contingency plans in the event of a disaster, systems breakdown, fraud or misuse

• gain an understanding of whether internal control recommendations made by internal and external auditors have been implemented by management

• prioritise and direct the audit effort to high-risk areas of the business

D. In relation to internal audit:

• review and approve the Internal Audit Charter

• review the effectiveness of the Internal Audit function, its staffing and resources and its capacity to carry out the Annual Audit Plan

• review the activities and organisational structure of the Internal Audit function and ensure no unjustified restrictions or limitations exist and that the Internal Audit function remains independent

• ensure that internal audit activities comply with relevant standards and regulations

• review and approve the risk assessment results and the Annual Audit Plan

• review internal audit reports, including management's action plans to address risk and control deficiencies noted by the Internal Audit function

• monitor the implementation of action plans based on reports provided by the Internal Audit function

• escalate to the Board, if necessary, significant audit findings and control deficiencies which require Board attention and prioritisation

E. With respect to ethical and legal compliance:

• oversee controls implemented to address compliance with applicable laws, regulations and policies

• oversee whistleblowing process and investigation results

• review internal audit reports concerning compliance reviews and investigations

• review management's monitoring of compliance with the Board's guidelines

F. With respect to information technology management:

• ensure that a technology architecture that enables the achievement of strategic and operational objectives has been defined

• oversee that information technology management processes are formalised and that an effective control environment for managing key risks and achieving objectives, as well as preserving information privacy and security, has been designed and implemented

• ensure that proper policies and processes have been implemented to enable ethical and responsible use and disposal of technology and information, both hardware and software

• oversee information security risk, status of mitigating measures, information on attacks and vulnerabilities, based on reports provided by management periodically, but at least twice a year

• oversee that effective mechanisms have been implemented to identify and respond to security incidents

• oversee that monitoring of advancements in technology is in place, including the capturing of potential opportunities and the management of disruptive effects on the organisation and its business model

• ensure that proper value assessments are performed before investing in information and technology

The Board supports and endorses the Audit Committee, which operates independently of management and is free from any organisational impairment.

The Audit Committee assists the Board in fulfilling its responsibilities and has unrestricted access to information, including records, property and personnel of the Group.

The Audit Committee has considered and found:

• the expertise and experience of the Chief Financial Officer are appropriate for the position, and the arrangements for the Finance function are adequate, for the size and complexity of the Group

• the expertise and experience of the Internal Audit Director are appropriate for the position, and the arrangements for the Internal Audit function are adequate given the size and complexity of the Group

The Audit Committee, following the mandate received at the AGM, approved the 2025 external auditors' terms of engagement, fees and scope of work at Group level. Based on interactions with the external auditors and the quality of the external auditors' reports, the Audit Committee considered the expertise and independence of the external auditors, including the Partner Rotation Policy, and concluded they are satisfactory.

In order to fulfil its responsibility to monitor the integrity of financial reports issued, the Audit Committee has reviewed the accounting principles, policies and practices adopted during the preparation of financial statements and examined relevant documentation related to the Annual Report. The Committee is comfortable that appropriate financial reporting procedures have been established.

The Audit Committee reviewed:

• the clarity of the disclosures included in the Financial Statements

• the basis for significant estimates and judgements

The Audit Committee complied with its Charter, as well as its legal and regulatory responsibilities.

Risk and Compliance Committee

The Risk and Compliance Committee takes a forward-looking view regarding the risks that the Group may face and aims to enable the effective implementation of mitigating measures and overall enterprise risk management.

The Risk and Compliance Committee:

• consists of at least three Directors

• is chaired by an Independent non-Executive Director, who is not the Chairman of the Board

• includes members with sufficient knowledge about the affairs of the Group, qualifications and experience to fulfil their duties effectively

The Risk and Compliance Committee assumed the following responsibilities during 2025:

With respect to risk management framework:

• oversee the annual review of the risk management policies, and recommend them for Board’s approval

• monitor application of the Risk Management Policy, processes and organisation

• make recommendations to the Board concerning the Group risk appetite and risk profile and monitor that risks are managed within those levels, as approved by the Board

• oversee that the risk management plan is widely disseminated throughout the Group and integrated into day-to-day activities

• acknowledge risk response and implementation status for major risks at Group level

• review the Risk management and compliance section included in the Annual Report

• assess compliance with relevant legislation and regulations, including regulations concerning risk reporting

With respect to the compliance management system:

• oversee the compliance management framework, the review of the compliance policies, and recommend updates for Board’s approval

• supervise implementation of the compliance policy, processes and organisation, including rules and mechanisms to ensure compliance with laws, prevention of fraud and corruption and avoidance of conflict of interest

Sustainability Committee

The Sustainability Committee oversees and reports on the Group’s organisational ethics, responsible corporate citizenship (including the environment, health and safety, the impact of the Group’s activities and of its products and services), sustainable development and stakeholder relationship management. The members of the Committee are knowledgeable and mindful of economic, social and governance matters and the Group’s material issues.

The Committee oversees how the consequences of the Group’s activities and outputs affect its status as a responsible corporate citizen, covering the following areas:

• environment, i.e. minimise the effects of the Group through responsible use of resources, controlled pollution and waste disposal, controlled carbon footprint, green buildings, protection of biodiversity

• economy, including the communities support and contribution to creating new jobs

• workplace, including employment equity, diversity and inclusion, fair remuneration, health and safety

• society, including public health and safety, consumer protection, community development and protection of human rights

• governance, including how the Board is steering the Company based on an ethical foundation

The Sustainability Committee endorses the ESG strategy, verifies progress towards the implementation of such strategy and reviews the Group’s Sustainability Report. The CFO, as the Executive Director part of the Sustainability Committee, is the executive manager overseeing the overall ESG agenda in the Group, while the CEO is ultimately responsible to plan the ESG strategy and monitor implementation.

Remuneration Committee

The Remuneration Committee:

• consists of at least three Directors, the majority of whom must be Independent non-Executive Directors

• is chaired by an Independent non-Executive Director, who is not the Chairman of the Board

The Remuneration Committee is responsible according to its charter, to:

• oversee the review of the Remuneration Policy and principles

• monitor implementation and administration of the Remuneration Policy

• determine remuneration for Executive Directors, in alignment with the Remuneration Policy and targets achievement

• monitor remuneration principles implemented to ensure that employees are properly incentivised based on individual and Group performance

• ensure that the Group’s remuneration principles are aligned with the strategy, in order to create long-term value

• recommend the fees to be paid to non-Executive Directors

When determining the Remuneration Policy and practices, the Remuneration Committee is guided by the following principles: clarity, simplicity, risk, predictability, proportionality and alignment to Group culture.

Nomination Committee

The Nomination Committee:

• consists of at least three Directors, the majority of whom must be Independent non-Executive Directors

• is chaired by an Independent non-Executive Director, who may also be the Chairman of the Board

The Nomination Committee is tasked with the following:

• periodically assess the skill set required to competently discharge the Board’s duties, considering the Group’s strategic direction

• review and make recommendations regarding Board composition, competencies, structure, size and diversity, to ensure that vacancies are filled with suitable candidates, in line with criteria defined in the Board Profile Paper

• develop strategies to address Board diversity

• develop and review Board succession plans, Director induction programmes and continuing development programmes, aiming to maintain an appropriate mix of skills, experience, expertise and diversity

• identify Directors due for retirement by rotation on an annual basis

• arrange the performance evaluation for Board members

• review and make recommendations regarding Board appointments, re-elections and terminations

• prepare a description of the role and skill set required for appointments

• identify suitable candidates to fill Board vacancies

• propose extension of Board appointments

• ensure that, upon appointment, all Directors receive a formal letter of appointment that sets out the duration and responsibilities of the appointment

• review disclosures made by the Group regarding Board appointments, re-elections and terminations

Investment Committee

Members of the Investment Committee must have significant property investment, retail and relevant market knowledge. The Investment Committee Chair must be a non-Executive Director with adequate financial and investment experience.

The senior management of the Group is responsible for identifying new investment opportunities, optimising the performance of existing assets (for example, through refurbishments, extensions and re-tenanting), and, where necessary, proposing the disposal of assets which no longer contribute to the Group’s income growth strategy. The CEO will coordinate and monitor all acquisitions, capital expenditures and disposals, and will recommend those which exceed his mandate to the Investment Committee.

The Committee formulates the overall investment strategy of the Group and establishes investment guidelines. The Committee’s activity complies with all applicable fiduciary, prudence and due diligence requirements, which experienced investment professionals would utilise, and with all applicable laws, rules and regulations issued by relevant local and international bodies.

The Investment Committee:

• considers management recommendations for mergers, acquisitions, investments, capital expenditure and disposals, and makes proposals to the Board for approval

• authorises transactions that fall within its mandate, analyses and recommends to the Board those that fall outside its mandate

• evaluates and monitors investments performance over time

The Board and the Committees considered their activity during 2025 and confirm that they are satisfied that they have fulfilled their responsibilities in accordance with their charters and the Corporate Governance Framework.

Stakeholder engagement and relationship management

The Board oversees stakeholder relationship management, while responsibility for the day-to-day execution has been delegated to the Executive Directors and, further on, to line management.

NEPI Rockcastle has a transparent information communication policy, enabling stakeholders to assess the Group’s economic value and prospects. The Company encourages proactive engagement with shareholders, including during the Company’s semi-annual results presentations and AGMs, where Directors are available to respond to shareholders’ inquiries on how the Board has executed its governance duties.

The Executive Directors have regular discussions on operational trends and financial performance with relevant stakeholders, where they believe this to be in the Group’s best interest. The Chairman of the Board meets with all major shareholders every second year to gather direct feedback on their questions and concerns. No information is shared preferentially only to some shareholders.

The Group’s Directors ensure that all shareholders are treated equally and equitably, and that management recognises, protects and facilitates the exercise of all shareholders’ rights through constant, open and timely communication. The Board seeks to protect the interests of minority shareholders while the Dealing Code and the Related Party Transactions Policy are designed to ensure such protection.

The Group actively manages its relationship with stakeholders and communicates formally in a number of ways:

• news, announcements, press releases were issued under routine reporting obligations or to communicate ad-hoc events

• SENS announcements were made to disclose changes in Board and Committees structure, Directors’ and associates’ dealings, major acquisitions and disposals

• business updates were published regularly, depicting Company’s performance

• various events such as property tours (with investors), capital market day (with representatives of capital markets), retail day (with representatives of tenants) were organised

• the Reviewed Interim Condensed Consolidated Financial report was published in August, outlining six-month performance. The Interim Condensed Consolidated Financial Statements included in the report were reviewed by a South African auditor (EY South Africa) and were not reviewed by a Dutch auditor. The results announcement was followed by Results Presentations and investor calls. The presentation and the reports are posted on the Group’s website, open to and accessible to any interested stakeholder

• the Reviewed Condensed Consolidated Financial Statements for the year ended 31 December 2025, including detailed management commentary, were published in February. These were followed by Results Presentations announced publicly on the corporate website, open and accessible to any interested stakeholder

• the Annual Report, including audited consolidated financial statements of the Group and separate financial statements of the Company, is published in March each year, comprising reporting on all relevant matters

The Board is required through the applicable governance codes to provide a fair, balanced and understandable assessment of the Group’s position and prospects in its external reporting. The Board considers that this Annual Report and the Audited Consolidated Financial Statements of the Group and Separate Financial Statements of the Company, taken as a whole, meet all requirements and provide the information necessary for shareholders to assess the Directors’ governance of the Group.

General meetings of shareholders

Meetings

The Company is required to hold an Annual General Meeting no later than the end of June each year. Other General Meetings may be held at the discretion of the Board or to comply with Applicable Listing Requirements.

The Board is responsible for giving notice of General Meetings, ensuring that it is given to all Shareholders entitled to vote and that it complies with the statutory notice period of 42 calendar days and Applicable Listing Requirements. The notice must include the subjects to be discussed, venue and time of the meeting, the requirements for admittance, and the Company's website address. Additional communications can be made in a separate document deposited at the Company's office for inspection, with a reference made in the notice.

General Meetings can be held in Amsterdam or Haarlemmermeer, as chosen by the Board. The Chairman of the Board will chair the general meeting, unless otherwise decided by the Board. Minutes of the meeting will be kept.

The record date for each General Meeting will be determined in accordance with the law and Applicable Listing Requirements to identify voting rights and eligible attendees, and instructions on how to register and exercise rights will be included in the meeting notice.

To attend a General Meeting, a person or their proxy must notify the Company in writing at the specified address and by the deadline indicated in the meeting notice, and the proxy must provide written evidence of their authorisation.

Shareholders and/or other persons entitled to attend the General Meeting, who, alone or jointly, meet the requirements set forth in section 2:114a subsection 2 of the Dutch Civil Code will have the right to request the Board to place items on the agenda of the General Meeting, provided the reasons for the request are being stated therein and the request is received by the Chairman or the Chief Executive Officer in writing at least sixty (60) calendar days before the date of the General Meeting.

Share capital

The authorised capital of the Company amounts to twenty six million euro (€26,000,000) and is divided into two billion six hundred million (2,600,000,000) shares, having a nominal value of one euro cent (€0.01) each. On 31 December 2025 the issued share capital amounted to €7,123,573 divided into 712,357,309 shares. All shares are fully paid. There are currently no limitations either under the Dutch law or the Articles of Association to the transfer of the shares.

In April 2025, the Company repurchased 1,640,511 own shares (representing 0.23% of outstanding ordinary shares in issue). Treasury shares do not carry the right to vote at general meetings, to distribution and to the surplus assets of the Group on winding-up.

During the 2025 Annual General Meeting, the shareholders resolved to authorise the Board to issue shares for cash up to 10% of the issued shares, to repurchase shares up to 10% of the issued shares and to cancel repurchased shares.

Main powers of the General Meeting of Shareholders

The main powers of the General Meeting of Shareholders include:

1. discussion of the board report

2. discussion and adoption of the annual financial statements

3. dividend proposal (if applicable)

4. appointment of Directors (if applicable)

5. appointment of an Independent Auditor (if applicable)

6. adoption of amendments to the Articles of Association

7. other subjects presented for discussion or voting by the Board, such as the release of Directors from liability, discussion of the policy on reserves and dividends, authorisation of the Board to issue shares, authorisation of the Board to decide that the Company should acquire own shares

At the General Meeting, each share carries one vote and resolutions must be adopted by an absolute majority, unless a greater majority is required. A quorum of at least three shareholders with 25% voting rights is required, and votes can be cast by electronic means or by mail. If a quorum is not present at a General Meeting, the Board is authorised to call for a new General Meeting where resolutions can be passed regardless of the capital represented in the meeting.

The structure of the Company's capital has been presented in this Report, each share carrying a right to vote in accordance with the Articles of Association of the Company and the applicable law. There are no classes of shares; no special restrictions on transfers; no special control rights; no agreements between shareholders which are known to the Company and may result in restrictions on the transfer of securities and/or voting rights; no significant agreements to which the Company is a party and which take effect, alter or terminate upon a change of control of the Company following a takeover bid, and the effects thereof; no agreements between the Company and its board members or employees providing for compensation if they resign or are made redundant without valid reason or if their employment ceases because of a takeover bid.

Internal controls and risk management statement

In line with its charter, the Audit Committee monitors the effectiveness of the internal controls system, addressing risks and control objectives in the financial reporting, sustainability reporting, operations and compliance.

NEPI Rockcastle Group applies the three lines of defence approach, with a view to further strengthen the system of internal controls and track compliance with relevant laws and regulations:

• the first line of defence, line management (senior management, local management), is the function that owns risk and is responsible for operational processes within the Group. Line management is in charge of defining guidelines, implementing and executing internal controls, embedding risk management in the day-to-day operations, comparing performance against targets, monitoring achievement, ensuring compliance and sufficient security

• the second line of defence has an advice and monitoring role, and consists of functions such as Compliance, Risk Management and Data Privacy. These functions are primarily involved in monitoring laws, regulations and emerging risks, and providing support and advice to management in ensuring compliance. They monitor and facilitate the implementation of effective risk and compliance management practices and assist the risk owners in identifying, assessing and reporting adequate risk information. In the consideration of their monitoring role, they recommend new controls or risk mitigating measures to be embedded in current processes and practices

• the third line of defence, the Internal Audit function, is in charge of providing independent assurance on the effectiveness of the internal controls and risk management, including on how the first two lines discharge their duties

A risk-based approach, the proportionality principle and key controls such as segregation of duties and four eyes principle are considered when developing the policies, procedures and control activities at Group level, covering:

• efficiency, effectiveness and economy of operations

• safeguarding of assets

• reliability of financial reporting

• compliance with laws and regulations

In substantiating and formalising its internal controls system, the Group used the COSO for Internal Controls framework, following the key steps described below:

• list all its processes and sub-processes and prioritise processes in scope based on pre-defined criteria

• perform risk assessment for the in-scope processes

• based on the risks and control objectives identified, perform evaluation and documentation of the control activities

• information and communication with process owners, management, second and third line of defence functions

• mapping of testing and control monitoring activities performed throughout 2025

The Group documented and assessed its control activities over a wide range of topics, and categorises its internal controls, in line with COSO framework, as follows:

• entity level controls - set the tone for integrity, ethics, and accountability and are the foundation for all other components

• process level controls - key controls designed to address key business objectives (including fraud mitigation and financial reporting assertions)

• compliance level controls - additional key controls (not embedded in the core business processes) managed generally by Compliance, Risk management, Data protection, meant to address specific compliance control objectives or to monitor compliance thereto

• IT general computer and cyber controls - embedded in the IT management processes to ensure proper use of technology and cyber-resilience

The testing and monitoring activities performed in 2025 comprised of: (i) confirmation of control design and operating effectiveness by process owners through management self-assessments; (ii) verification of key compliance areas by the Risk and Compliance function; and (iii) independent audits by Internal Audit addressing design and effectiveness of key controls in core operations (asset management, development and leasing), payroll and remuneration, selected IT computer controls.

Part of its monitoring activities, the Group performs under the coordination of the Risk and Compliance Officer a dedicated fraud risk assessment on an annual basis, with the results described in more detail in the Risk management and compliance section of this Annual Report, page .

Based on the above-described assessment activities, the Group affirms that:

• this Annual Report provides sufficient insights, including the potential for any failings in the effectiveness of the internal risk management and the control systems with regard to internal and external material risks that the Group may face. Strategic, operational, compliance and reporting risk areas are identified and presented together with uncertainties, to the extent that they are relevant to the expectation of the Group’s continuity for the period of twelve months after the preparation of the report. Details are included in the Risk management and compliance section, page

• risks have been managed considering the approved Group risk appetite limits (presented in more detail in the Risk management and compliance section, page ). The occurrence and criticality of monitored risks have been reassessed quarterly and reported to the Risk and Compliance Committee, with the most important risk areas disclosed in the Risk management and compliance section, page

• considering the set of controls in place as well as the external assurance process, the internal controls system provides reasonable assurance that the financial reporting does not contain material inaccuracies

• considering the set of controls in place as well as the external assurance process, the internal controls system provides limited assurance that the sustainability reporting, compiled in line with the EU Corporate Sustainability Reporting Directive and the EU Taxonomy Regulation is free from material misstatements

• in light of the control framework in place and the monitoring activities carried out throughout 2025, management has obtained a sufficient level of comfort over the effective management of operational and compliance risks. A significant number of key controls are formalised in policies and procedures which were in place throughout the year, and some were supported in the IT platforms, while all staff was reminded of these through the annual Risk and Compliance awareness campaign.
  Management acknowledges however, that certain external risks—such as geopolitical, macroeconomic, fiscal policy risks, remain outside the Company’s full control and that the effectiveness of compliance measures also depends on the conduct and judgement of employees across a geographically diverse portfolio. These risks are described in detail in the Risk management and compliance section, page .
  Sufficient comfort is defined as the level of assurance derived from management’s assessment of the design and operating effectiveness of its internal risk management and control systems, considering the comprehensiveness of the control framework, the results of monitoring activities, and the Group's risk appetite. While management does not have absolute assurance that no failures will occur, it can state that its internal risk management and control systems are designed and operating effectively to manage material operational and compliance risks

• having considered the potential impact of the geopolitical conflictual context and the overall macroeconomic environment on the Group revenues, profits, cash flows, operations, liquidity position and debt, as well as in the consideration of the above mentioned risk categories and approved Group risk appetite, management concludes that there are no material uncertainties relating to the Group’s ability to continue its activities and prepared its financial statements on a going concern basis.

No major deficiencies in the Group’s internal control system or risk management approach were identified in 2025, that could result in material financial loss, misstatement, fraud, or corruption. While certain operational control gaps and opportunities for enhancement were noted at the transaction level, Management has implemented compensating controls with broader coverage, operating on a monthly or a quarterly basis, designed to detect and correct material issues.

Management intends to continue the Company’s digital transformation initiatives in 2026, including the further strengthening of some transaction level controls and the enhancement of testing and monitoring activities. These measures are expected to support the Group’s progress from a moderate to a higher level of certainty regarding the effectiveness of its operational and compliance controls. The key areas for improvement were presented in detail in the internal management’s report towards the Audit Committee.

Internal audit

The Group has an in-house Internal Audit function. The activity of Internal Audit, its mandate, responsibilities and access are regulated through the Internal Audit Charter, endorsed by the Audit Committee and approved by the Board. In accordance with its Audit Charter, Internal Audit reports functionally to the Audit Committee.

Internal Audit is centralised at Group level and has unrestricted access to Company's resources, information and people, to effectively discharge its responsibilities, with no restrictions placed upon the scope of work.

The function carries out independent risk-based audits, under the oversight of the Audit Committee.

The Audit Committee therefore:

• defines the Internal Audit mandate and ensures no unjustified restrictions or limitations exist

• reviews the performance and effectiveness of the Internal Audit function and its capacity to carry out the Annual Audit Plan

• safeguards the independence of the Internal Audit function, through the functional reporting line and the direct unrestricted access

Internal Audit reviews aim to assess the effectiveness of the Group's governance and internal controls, and if they are properly designed to ensure safeguarding of assets, efficiency, economy and effectiveness of operations, adherence to applicable laws and regulations, reliability of financial and operational reporting.

External audit 

EY Accountants B.V. (EY Netherlands) and Ernst & Young Incorporated (EY South Africa) were appointed as Group independent external auditors in 2022 under the endorsement of the shareholders, for a period of three consecutive financial years, with the possibility of automatic yearly extensions until a replacement is approved. The Group's audit rotation policy is to organise tenders for audit services regularly, to ensure auditors' independence, as well as verify that audit fees are in line with the market.

The external auditors' scope of work include:

• review by EY South Africa of Interim Condensed Consolidated Financial Statements of the Group as at 30 June

• audit by EY South Africa of the Annual Consolidated Financial Statements of the Group and the standalone financial statements of the Company, prepared in accordance with IFRS as issued by the International Accounting Standards Board (IASB), the SAICA Financial Reporting Guides as issued by the Accounting Practices Committee, Financial Pronouncements as issued by the Financial Reporting Standards Council, the JSE Listings Requirements

• audit by EY Netherlands of the annual consolidated financial statements of the Group and the standalone financial statements of the Company, prepared in accordance with IFRS as adopted by the European Union and with Title 9 of Book 2 of the Dutch Civil Code

• audit of the financial statements of selected NEPI Rockcastle entities, prepared in accordance with local accounting principles

The fees incurred for audit services are disclosed in the notes to the financial statements. No non-assurance services have been performed.

The Audit Committee and the external auditors have communicated on all matters required by Dutch Standard 260 / International Standard on Auditing No. 260 (Revised) 'Communication of audit matters with those in charge with governance'.

In addition, the external auditor has communicated that in respect of JSE Listings Requirements paragraph 5.7(h):

• the audit firm has met all the criteria stipulated in the requirements, including that the audit regulator has completed a firm-wide independent quality control inspection of the audit firm (Ernst & Young Inc.) and on the designated individual auditor during its previous inspection cycle

• the auditors have provided to the Audit Committee the required inspection decision letters, findings report and the proposed remedial action to address the findings at audit firm and individual auditor levels, and have confirmed that there have been no legal or disciplinary proceedings brought against either of the two within the past 7 years

• the audit firm and the individual auditor understand their roles and have the competence, expertise, experience and skills required to discharge their specific audit and financial reporting responsibilities

In accordance with best practice and the principle of direct, independent communication between the Audit Committee and the external auditors, the Audit Committee was provided with the auditors' report including significant auditing matters and observations related to the internal control environment and management's response. The Audit Committee reviewed the report and discussed the findings directly with the external auditor. The external auditors had private meetings with the Audit Committee, without the management team present and had unrestricted access to communicate privately to the Audit Committee any issue they may have considered necessary.

The external auditors confirmed their independence to the Audit Committee in respect of: relationships between EY Accountants B.V., Ernst & Young Inc. and the Group; relationships and investments of individuals employed by EY Accountants B.V. and Ernst & Young Inc. in the Group; employment of EY Accountants B.V. and Ernst & Young Inc. staff by the Group; business relationships; other services provided by EY Accountants B.V. and Ernst & Young Inc. to the Group. The external auditors also confirmed there has been no contingent fees, no services granted by EY Accountants B.V. and Ernst & Young Inc. to Directors and/or senior management of the Group and no gifts or hospitality.

The auditors have additionally confirmed compliance of the firm and individual audit partners with all internal EY Accountants B.V. and Ernst & Young Inc. independence requirements and rotation policies, as well as relevant regulatory and professional requirements, and have affirmed that their integrity, objectivity and independence have not been compromised.

The Audit Committee is satisfied with the information received based on which it concluded that EY Accountants B.V. and Ernst & Young Inc. and the audit partners in charge, are independent of the Group.

Risk management and compliance

Risk Management and Compliance Overview

NEPI Rockcastle recognises the importance of enterprise risk management and considers risk in both the strategy-setting process and in driving and controlling performance. The Group further acknowledges that risk management is an increasingly important business driver and, together with compliance management, is embedded in all business processes, and is the responsibility of every employee.

Under the Group’s three lines of defence approach, described in the Corporate Governance section of this report, the Risk Management and Compliance functions share the second line of defence, a symbiosis supporting and strengthening the internal control system by capitalising on alignment and synergies. The Risk Management and Compliance function is primarily charged with oversight of the risk and compliance management frameworks and processes, while encouraging risk owners to report relevant risk-related information, highlight new risk triggers and monitor emerging risks. The Risk Management and Compliance function works in collaboration with risk owners for identifying and implementing new mitigating measures in business processes or mitigating threats, all facilitating effective risk management. Risk Management and Compliance partners (the "Risk and Compliance Partners") have been assigned at the level of each business area, aiming to embed risk management and compliance in business processes, to promote risk management and compliance culture among Group personnel, as well as to facilitate collaboration with the Group’s Risk Management and Compliance Officer.

Governance and Oversight

The Group developed a comprehensive framework for the management of risks, aiming to increase overall awareness among personnel and enable the management functions responsible for managing risks to better identify, assess and control risks within their areas.

The risk management and compliance framework has been designed and implemented to:

• align and integrate risk management with strategy and business objective setting

• create a culture of risk management, supported by recurring awareness and training programmes

• ensure all current and potential material risk exposures are identified, assessed, quantified and appropriately managed

• enable compliance with relevant laws, regulations and best practices

• enable financial stability and sustainable business growth

• foster an educated approach towards risks and provide a Group-level risk assessment methodology and tools

• integrate the best practice principles set forth under the Committee of Sponsoring Organizations (COSO) framework and International Organization for Standardization (ISO) 31000

The Group integrates Enterprise Risk Management (ERM) with strategy and performance to identify, assess and manage risks in pursuit of creating, preserving, and realising value. This approach strengthens risk‑aware culture and governance, while embedding risk considerations into all levels of decision‑making. This approach is underpinned by the following core principles that shape the Group’s ERM framework:

• strengthen governance and strategic alignment: Anchor ERM in board oversight and leadership tone, define the Group’s risk appetite, and embed it into strategic planning, resource allocation, performance management, and all core business processes

• manage risks through a portfolio perspective: Maintain a comprehensive, enterprise‑wide view of risks with clear ownership, consistent assessment criteria, and explicit links to strategic objectives, KPIs, and business outcomes; engage stakeholders throughout the entire lifecycle

• apply an iterative, end‑to‑end risk management process: Define scope, context, and criteria; identify, analyse, and evaluate risks; determine and implement treatment options; monitor and review performance; record and report outputs; support consistent, evidence‑based assessment and decision‑making, selecting techniques aligned to the complexity and nature of the risk

• enhance risk information and reporting: Establish robust data flows and reporting mechanisms that support timely, informed, and risk‑aware decisions, while ensuring transparency for internal and external stakeholders

• continuously enhance ERM: Regularly reassess the ERM approach as strategy, operating context, and performance evolve, ensuring the framework remains relevant, effective, and aligned with value creation

Framework and Policy Foundations

The Group’s operations are subject to various statutory regulations and standards throughout different jurisdictions. Across the entire Group, NEPI Rockcastle promotes integrity and compliance with the legal and ethical frameworks.

A comprehensive compliance framework has been implemented, defining uniform rules and practices applicable to all Group entities which are therefore focused on conducting business activities lawfully and consistent with the Group's compliance obligations.

In line with its Risk Appetite Statement approved by the Board, the Group is committed to identifying, preventing and managing risks, for which purpose relevant controls have been embedded in both business and support processes. To uphold this commitment, the Group has embedded controls across business and support processes addressing key risk areas, including:

• potential conflicts of interest

• related party transactions which may not be transparent or at arm’s length

• breach of confidentiality and professional secrecy

• non-transparent and incomplete financial reporting or communications

• non-compliance with fiscal regulations within a complex tax environment

• use of privileged information and insider trading

• money-laundering and the financing of terrorism

• inadequate adherence to anticorruption, anti-fraud and competition rules

• inefficient delegation of authority required to maintain the correct balance between flexibility, speed and span of control

The Group’s policies and procedures are periodically reviewed and revised to ensure permanent alignment to the applicable legal and regulatory framework as well as a practice to promote a continuously evolving business environment.

Risk Management Strategy and Risk Governance

To ensure the efficient implementation of risk management principles and increase the overall risk-aware culture, the Group focuses its efforts on:

Information is essential for effective and sound risk management, and the Group ensures that relevant risk‑related information is shared and escalated transparently across the business. To support this, management provides the Risk Management and Compliance Officer, the Risk Management and Compliance Committee ('the Committee'), and the Board of Directors with the appropriate level of timely, relevant, and reliable information needed to oversee risk management practices and evaluate their effectiveness.

The Group considers it a priority to ensure that risk management is properly overseen and embedded within the strategy and objective‑setting process. The risk mapping exercise enables the identification of risks and their alignment to one or more strategic goals. This mapping is reviewed annually, in parallel with the development of the following year’s strategy, to support an efficient assessment of risks and to enable early evaluation of their potential impact.

The Committee was established to support the Board in exercising oversight over Enterprise Risk Management and Compliance processes, ensuring that the Group has implemented an effective approach that will enhance its ability to achieve strategic and business objectives.

The risk management oversight role of the Board and of the Committee is enhanced by the Directors’ independence and mix of skills, expertise, experience and business knowledge. Board oversight (directly or through the Committee) covers scrutinising key management decisions, presenting alternative views, offering sound judgement, challenging potential organisational biases, determining the appropriate course of action in the event of a breach of Group policies or procedures. The Board advises and challenges management without assuming the operational role of management.

The detailed responsibilities and duties of the Board and Committee are defined in their respective charters and the Group’s Corporate Governance Framework and are presented in the Corporate Governance section of this Annual Report, page .

A Risk Management and Compliance Officer, reporting to the Committee, is mandated by the Board of Directors with overseeing compliance and enterprise risk management as a second line of accountability. The Risk Management and Compliance Officer's detailed responsibilities are set forth in its mandate granted by the Board of Directors.

The Board ensures that risk management policies and procedures, as well as the Compliance Risk Framework, designed and implemented by the Risk Management and Compliance Officer with the endorsement of the Committee, are:

• consistent with the Group’s strategy and Risk Appetite

• rely on an enterprise-wide culture that supports appropriate risk awareness, behaviours and decisions

The Board will also provide oversight of the implementation of the General Compliance Policy, Code of Ethics, Whistleblowing Policy and overall Risk Management and Compliance system, based on regular reports provided by management, the Risk Management and Compliance Officer and Internal Audit Director.

Management embeds risk management practices into day-to-day operations and ensures that these practices are applied consistently, seeking to (i) build a risk-aware culture, (ii) agree risk management performance targets, (iii) ensure implementation of risk management recommendations and (iv) identify and report incidents, changed circumstances or emerging risks. Within the risk appetite approved by the Board, management also decides whether to proceed with mitigation strategies and implement contingencies, while the Board directly, and through the Committee, exercises oversight.

When it comes to Risk Management, every employee has a responsibility to:

• understand and implement risk management processes

• report inefficient, unnecessary or unworkable risk management measures

• report loss events and near-miss incidents

• cooperate with management on incident investigation

Risk and Compliance Partners have been designated for each area of expertise within the Group to support the Risk Management and Compliance Officer in identifying, assessing, and addressing risk triggers. Acting as ambassadors for risk and compliance, they provide frontline support in detecting and escalating potential risks across the organisation. Drawing on their knowledge and functional expertise, the Risk and Compliance Partners contribute to evaluating the impact and probability of identified risk triggers and recommend appropriate mitigation measures. Their role as the first point of contact within their respective areas helps ensure that emerging risks are recognised early and managed effectively.

As the Group operates in multiple jurisdictions and has a complex structure comprising a holding and financing entity, operational and management company subsidiaries, the Risk Management and Compliance Officer, in consultation with both management and the Committee has defined a structure of roles and responsibilities at management level, to ensure an effective framework for managing risks for each entity and local jurisdictions it operates in.

In consideration of its power to challenge management on the Risk Management system and based on the reports it receives directly and/or through the Committee, the Board may decide to request independent assurance on the effectiveness of Risk Management processes from external parties (consultants, auditors etc.).

Risk management effectiveness is supported by the framework design, operation, monitoring and reporting. Appropriate measures have been implemented to ensure such effectiveness:

• the risks associated with the strategy and activities of the Group are identified and regularly assessed, covering strategic, operational, compliance and reporting matters

• the risk appetite has been defined and approved by the Board, necessary risk mitigants have been implemented and are regularly reviewed

• the risk and compliance management function, as well as the overall internal controls system are in place and operating effectively in circumstances where no significant changes or breaches of policy or procedure have occurred in the previous financial year

• the material changes in external factors and their impact on the Group’s activities have been considered, assessed and monitored, while tailored action plans have been defined with the support of the management, monitored regularly and reported

• the Risk Management and Compliance Officer provides quarterly reports to the Risk and Compliance Committee on the progress of monitored risks and highlights any emerging risks. Additionally, the Officer reports on the overall performance of the Risk Management and Compliance function and may raise any significant issues that could impact Group operations or the broader internal control environment

Operational and compliance risks are managed effectively in line with the Group’s risk appetite and the design of its internal risk management and control systems. While many internal risks fall within the Group’s ability to influence and control, certain risks - by their nature - cannot be fully mitigated or managed directly. As such, they remain only partially within the control of Group management, including:

• employees acting in breach of internal policies or applicable laws: The Group implemented policies and procedures describing processes, flows, responsibilities, embedded controls, a Code of Ethics describing the rules for ethical business conduct and adequate management of the conflict of interest situations, training and awareness campaigns are organised to ensure employees are up to date about new internal regulations or updates to existing ones. However, the Group is partly dependent on the behaviour of its employees whose behaviour cannot reasonably be continuously controlled or fully embedded in procedures

• legislative and regulatory volatility: Amid a shifting geopolitical landscape and global economic uncertainty, the Group is exposed to increasing legislative volatility across its jurisdictions. This includes the emergence of inconsistent or rapidly evolving legal initiatives that may significantly impact operations. Aiming to ensure mitigation and timely reaction, the Group undertakes advocacy activities through the business associations of which NEPI Rockcastle is a member and promotes the interests of the real estate industry, leverages synergies with other impacted business sectors, ensures the monitoring of legislative proposals at all levels of national lawmakers etc.

• market risk: Strategic/Systemic risk resulting from changes in an asset losing attractiveness (due to tenant mix and reduction of the overall appeal), increase of competition, degrading market conditions, fiscal changes likely to impact customers‘ purchasing power, potentially affecting the performance of the Group's shopping centres. To mitigate these risks, the Group carries out regular market analysis to identify shifts in consumer behaviour and competitive activity, tailors its tenant mix to local demand and emerging categories, and cultivates synergies between anchor and smaller tenants to drive footfall and extend visit duration. The Group also invests in placemaking initiatives — including events, green spaces and cultural exhibitions — and upgrades amenities and common areas to enhance the overall visitor experience

• reputational risk: This risk can be classified as both an internal and an external risk, because the Group’s reputation can be affected by factors originating inside the company as well as by events or influences from outside. Elements like negative media coverage or social media backlash, customer complaints and public dissatisfaction, security incidents caused by external attackers, misconduct by third-party vendors or partners, industry wide events impacting public perception are external risk triggers that could harm the organization’s public image and market credibility, however not under full direct control of the Group. To mitigate such factors, the Group engages reputable specialised consultants, maintains an experienced public relations team on standby to manage crisis communication, implemented crisis communication policies and cultivates good relations with relevant media

• geopolitical and economic factors: Political instability, international tensions, regulatory changes, or macroeconomic fluctuations on the retail property market, shifting trade policies that affect consumer goods supply, economic downturns that reduce consumer spending, sanctions or tariffs that disrupt tenant operations, inflation that increases development or maintenance costs, and political unrest that may deter investment or affect property values are risk factors that can influence tenant demand, occupancy rates, rental income, long-term asset performance, thus affecting Group operations, however not under full direct control of the Group. To mitigate such factors, the Group defined a resilient investment strategy and asset appraisal process, monitors macroeconomic and property market trends, monitors country specific credit ratings, creates emergency response plans, maintains a diversified risk profile from particular country risk perspective, ensures sustained monitoring of market data for Group's publicly traded securities, interest rate position, liquidity, availability of cash resources and counterparty exposure and performs periodical business continuity testing

Risk Appetite

The Group seeks to embed risk appetite in its processes, thus ensuring alignment with strategic objectives and external risks, which improves consistency and traceability in decision‑making:

• strategic alignment. Appetite and tolerances define acceptable risk‑return trade‑offs, translated into adequate approval limits and control points

• transparent and traceable decision-making. Clear, pre‑agreed limits reduce uncertainty and escalation

• consistent resource allocation. Adequately operationalised risk appetite (e.g. loss limits, downtime tolerances, compliance thresholds) enables efficient budget and resource allocation

• early detection and course correction. Tolerance limits are monitored and timely addressed

• regulatory credibility and assurance. Ensuring a demonstrable link from board‑approved appetite to operational limits, monitoring, and responses

• bias reduction and transparency. Structured thresholds and exceptions management are aimed to reduce bias, improving transparency in decision-making

The Group closely monitors risks with a potential impact on strategic goals, assessed in accordance with the risk evaluation methodology. The Group considers in its periodic assessment risk triggers such as fluctuations in the Group’s financial results, changes in political, social, legal, regulatory or economic conditions, inflation, interest rates, fluctuation in exchange rates, deflation, the Group’s ability to successfully implement business strategies, future investments, acquisitions and competition.

The Group has developed and approved criteria defining its risk appetite regarding critical activities creating, preserving and realising value. Such critical activities, processes and topics include asset management, leasing, investments, tax structure management, treasury operations, tenant relationship, data privacy, human resources, and Group Know-Your-Counterparty Procedure.

The Group has set the following financing-related targets to ensure risks are managed properly:

• a weighted average debt maturity of at least three years at any given time

• at least 70% of property portfolio should be unencumbered

• LTV ratio below 35% (maximum 40% in the short-term)

The Group has zero tolerance towards risks related to:

• health and safety (for example structural integrity of properties, fire security and serious pollution)

• fraud and corruption

• doing business with clients/partners not carrying out legal and legitimate activities or rejecting transparency

• money laundering and terrorism financing

• non-compliance with international sanctions

• serious violation of the Code of Ethics by employees or Directors

• damage to the Group's reputation materially affecting its ability to attract funding, personnel or relationships with business partners

• non-compliance with material regulatory requirements (for example competition, data privacy)

• exposing the Group and its employees, collaborators or Directors to any criminal liability

• market abuse practices as defined by the rules and regulations of the markets where the Group's debt or equity instruments are trading

The Group defines its Risk Appetite for each material area as follows:

Data privacy. The Group has zero tolerance towards (i) material regulatory non-compliance, significantly affecting data subjects’ rights and liberties; (ii) intrusive, disproportionate or unlawful data processing; (iii) personnel misconduct leading to material reputational and/or financial consequences for the Group.

Taxation. The Group has a low risk tolerance towards matters which may trigger in the future a risk of interpretation by the tax authorities as being non-compliant with applicable laws. In this respect, the Group (i) is continuously monitoring the tax legislative developments as well as the European Court of Justice cases on the abuse of EU law, (ii) has a prudent approach on its tax structure and ensures that the Group companies are economically embedded within the structure and are equipped with sufficient functions and activities.

Treasury operations. The Group has a very limited appetite for investments in listed securities and any actions in respect of listed securities portfolio are taken based on the decision of the Investment Committee.

Acquisitions. The Group does not invest in properties that do not fulfil cumulatively specific pre-set criteria, such as country risk, positioning, demographics, GLA, quality, profile of tenants, etc.

Construction works. The Group has (i) zero tolerance to any risk that would compromise safety on the construction site and later on during the exploitation of the property; (ii) zero tolerance to using construction materials, installations and equipment that are not fully compliant with applicable laws and regulations and/or that are dangerous for the workers, staff or visitors; (iii) very limited tolerance towards making savings in the development budget if by doing so it creates a risk of compromising the quality of the property, while at all times and in any circumstances the safety of property and people should not be at risk; (iv) zero tolerance to starting development works based on non-compliant or incomplete planning or permitting approvals to works that require additional costs in absence of appropriate approvals.

Tenants. The Group has a low appetite towards (i) making compromises to the overall tenants mix quality, accepted only on a short-term basis and in exceptional situations, determined by the social-economic environment, usually triggered by emergency episodes (such as pandemic, calamities etc.) or local/regional particular context; (ii) tenants with a track record of not paying their debts; (iii) accepting tenants that cannot provide adequate creditworthiness documentation. To this end, thorough creditworthiness assessments are conducted prior to signing lease agreements, whereas the Group may also require rental deposits, bank or corporate guarantees, and other similar instruments, as appropriate, to mitigate counterparty risk. Such measures consider the tenant's financial condition and the Group's overall exposure, ensuring adequate coverage of operating costs based on the level of exposure.

Political environment. The Group has (i) a low appetite towards extending its portfolio in jurisdictions that could determine uncertainty and/or delays in executing the Group’s strategy; (ii) zero tolerance towards any request or initiative of financial support (sponsorship, donation, any other in-kind benefits, etc.) to any political party and/or politically exposed person, as well as to involvement in political issues of the countries where it is present.

IT infrastructure. The Group does not tolerate (i) operating without business operations back-up and disaster recovery of critical IT infrastructure; (ii) risks that would materially impair the reliability of the Group’s IT infrastructure; (iii) operating without having in place measures and processes designed to deter or pro-actively prevent any form of cyber-attacks such as spam, phishing, malware, ransomware campaigns.

Management of the Group’s assets. The Group (i) does not accept impairing the state and condition of its properties for the sake of short-term income increase or cost savings; (ii) has a very low appetite towards compromising the long-term prospects and the sustainability of the property for short-terms gains; (iii) accepts the risk of failure in respect of innovative initiatives such as PropTech, retail transformation, etc. as long as the financial impact is within budget and there is no other material impact such as on reputation, non-compliance or health and safety.

Know-Your-Counterparty. The Group's policy is to work only with clients/partners who carry out legal and legitimate activities and maintain business transparency. The Know-Your-Counterparty process focuses on the assessment of the identity of clients/partners, as well as of their potential involvement in acts of corruption, fraud, terrorism financing, money laundering. The Group’s risk assessment methodology is supported by a risk-based approach, which involves the use of evidence-based decision-making to target the risks of money laundering and terrorism financing.

The end-to-end Know-Your-Counterparty process has been automated, based on the eligibility criteria and risk matrix as defined in the Group Know-Your-Counterparty Procedure. Also, the Group developed a Sanctions Policy, seeking to ensure the Group’s compliance with all applicable sanctions laws and regulations, whereas relevant controls are embedded in the business processes.

Competition. The Group has zero-tolerance towards risks related to non-compliance with material regulatory requirements concerning competition. Therefore, the Group is committed to high standards of ethical, moral and legal business conduct, as well as to observing antitrust laws promoting free and open competition in the marketplace. Anticompetitive practices are, as a rule, prohibited. An anticompetitive practice is a conduct which severely prevents, restricts, distorts or otherwise affects the competition on the market.

The Group deploys periodical training and awareness campaigns, therefore a dedicated competition compliance program has been implemented at Group level to help employees identify such sensitive aspects in their activity. The competition compliance training sessions focused on general legal requirements in competition area, accepted and unaccepted competitive practices, examples of behaviours that might occur in the daily activities, rules to be observed during potential competition authorities’ investigations.

Also, as part of Group’s ongoing efforts (i) to enable a unitary approach and common practices at Group level, (ii) to obtain the comfort that tenders follow an ethical, anti-money laundering, anti-corruption and anti-collusion wise process, as well as (iii) to ensure a fair competition between the participants to the tender process and to keep Group entities safe from litigation risk, sanction and/or reputational risks and financial losses, a standard tender process and specific documentation have been implemented and are periodically reviewed.

Employees/collaborators of the Group have an obligation and responsibility to ensure that their actions do not infringe competition compliance rules and requirements.

When determining the risk appetite for a particular risk that does not fall into the zero-tolerance category, the capacity of the Group to absorb the risk in the pursuit of its strategy and business objectives shall be considered, as well as the Group’s tolerance. Tolerance represents the acceptable variation in performance in relation to the targets, as they are defined by the Group strategy and further on cascaded based on specific performance indicators per area of activity and per individuals.

Exceptions to risk appetite are extremely rare and always follow the escalation process, while risk undertaking is transparently embedded in the business processes.

Risk Management Process and Responsibilities

The Risk Management Policy approved by the Board provides a framework for the management of risks, to increase overall risk awareness and to enable the management functions responsible for managing the encountered risks in pursuing approved strategy and business objectives, to better identify, assess and control risks within their areas.

In line with Group risk assessment methodology, every identified risk is mapped to one or more of the Company’s strategic goals. This mapping is reviewed annually - after the strategy for the upcoming year is approved to ensure continued relevance and alignment. The mapping strengthens the Group’s ability to assess risks by highlighting which risks could hinder the achievement of specific strategic goals. It also supports a more sophisticated view of interdependence, enabling analysis of stochastic correlations between risks and improving the overall understanding of the aggregated risk profile.

Before implementing adequate mitigation measures, the Group undertakes a detailed assessment as to the probability and impact of each major risk category.

For significant risks, detailed contingency plans are formulated and regularly updated by the Group for each risk that may materialise. Such plans detail a series of actions to be carried out either prior to or during the event, and have a double purpose:

• mitigation: Contingency plans help manage risks by providing a structured approach to addressing them. They outline specific actions to minimise the impact of adverse events

• monitoring and evaluation: Properly executed contingency plans allow for ongoing monitoring of risk treatment progress. They also facilitate the evaluation of residual risk, ensuring that any remaining risk is within acceptable limits

Risk awareness is important for all employees, as it helps identify threats as well as actual risks that could impact on the Group’s operations. Additionally, management plays a key role in bringing emerging risk factors to the attention of the Risk Management and Compliance Officer, the Committee, and the Board, when necessary.

In the process of identifying, assessing, responding to and reporting on risks, the Group uses dedicated tools:

Crisis Management

Under the wider umbrella of the Group Business Continuity arrangements, the Group implemented a Crisis Communication Procedure that defines the Group’s crisis‑communication framework, detailing the processes that enable rapid detection, escalation, decision‑making, and coordinated response to crisis events. It also sets out the standards for crafting and delivering key messages and provides a uniform, Group‑wide protocol outlining how all personnel must communicate and act during a crisis.

Employees are trained to report incidents of malfunction, suspicious activities, threats or weaknesses potentially affecting health and safety, information security, physical security, information systems continuity, privacy or other relevant areas. If a crisis occurs, the crisis management team will respond according to the rules set forth by the Incident and Crisis Management Policy, in line with the following key principles:

• highest priority on people’s safety: employees, clients, visitors, partners, emergency responders and community members, as best practice proves that personnel are more likely to co-operate with the extra demands during a disruptive incident, if their welfare needs are met

• preserve landlord’s and tenants’ assets: ensure the integrity and safety of property goods and tenants’ products for sale

• operational resilience: protect assets and ensure continuity of business processes

• integrity and reputation: ensure the preservation of the Group’s brand reputation by consistently acting and making decisions in accordance with the Group’s core values

• regulatory compliance: comply with all applicable national and international laws, rules and regulations

• transparency and disclosure: make public disclosures that are fair, accurate, timely and understandable, regarding the impact of the crisis on the Group’s facilities, associates, customers, operations and communities

• communication: share pertinent information with relevant stakeholders, in a timely manner

Senior management is responsible for the design and implementation of effective crisis management strategy, plans, processes and organisation. The Group sets up a Crisis Management Team (CMT), to manage major events and those categorised as crisis. The composition of the CMT and response depend on the scope, nature and (potential) impact. The CMT is authorised to mobilise all internal and external resources that it deems necessary to manage a crisis, such as law firms, technicians, consultants, public relations companies, third-party logistics, employee assistance providers, etc.

The CMT is accountable for the Group’s response to a crisis and for addressing the concerns of staff and key stakeholders, for example the Group’s leadership, investors, key customers, suppliers and government officials.

Compliance and Risk Management in 2025

a. Internal regulatory framework

During 2025, the Group conducted the periodic internal review of the Enterprise Risk Management and Compliance Management system, considering observed weaknesses, instances of misconduct and irregularities, indications from whistleblowers, lessons learned and findings from the internal audit function and the external auditor, as the case may be. As part of this review, the Risk Management and Compliance Framework underwent amendments to ensure a tailored approach to risk assessment and mitigation. These amendments and overall efforts focused on the review and enhancement of the operation of the internal risk management and control systems, particularly on the following areas:

• overall corporate governance framework has been revised following the yearly review exercise

• the new Operational Incidents and Management Procedure brings clear rules for the efficient handling of operational incidents in commercial centres, defines specific roles and responsibilities based on where an event occurs, and sets mandatory communication requirements, detailing who must be informed, including authorities and media, and the appropriate channels to be used

• the updated Group Sustainability framework is part of the Group’s wider efforts to enhance internal compliance with the overall ESG regulatory framework (e.g. Environmental Policy, Utility Consumption Data Collection, Climate Change Policy, Sustainable Development Policy)

• in line with the Corporate Sustainability Reporting Directive (CSRD), the European Sustainability Reporting Standards (ESRS) and the EU Taxonomy Regulation, the new Sustainability Reporting Procedure governs the preparation and disclosure of sustainability information in accordance with applicable mandatory or voluntary reporting frameworks

• the revised Guide on Anti-harassment in the workplace seeks to enhance compliance with relevant legal requirements deriving from the provisions of two European Directives regulating anti-harassment in the workplace (moral and sexual harassment)

• the new Human Rights Due Diligence Policy reflects Group’s commitment to ethical and responsible business conduct, in line with the relevant Minimum Safeguard requirements from EU Taxonomy, aims to meet international standards and regulatory expectations, and to embed human rights considerations across Group operations and value chain

• the updates to the Group Whistleblowing Policy bring additional clarifications regarding the overall reporting and investigation processes

• in response to the growing trend of international sanctions, a Sanctions Policy has been implemented, aiming to ensure proper handling and compliance, raising awareness and embedding relevant controls that prevent violations and exposure to risks

• the updates to the Sponsorship and Donations Procedure bring clarifications regarding the handling of potential conflict-of-interest situations that risk impacting transparency in decision-making process

• the Watchlist Procedure has been revised to include enhanced process transparency, as well as additional listing criteria to support an efficient due diligence process

• a new Payments Policy defines standardised, enforceable, and auditable payment terms and workflows that ensure compliance with legal and contractual obligations, predictable cash flow and working capital management and enhanced supplier relationship management

• the annual business impact assessment has been performed, and the business continuity arrangements have been tested to confirm resilience of critical processes, systems, as well as identify and address potential gaps impacting recovering within required timeframes

• in line with Group Risk Appetite and in response to an increasingly challenging and volatile geopolitical environment, the Know-Your-Counterparty process has been optimised to ensure enhanced due diligence, screening and portfolio monitoring, aiming to prevent legal, financial, and reputational risks and avoid partnerships with untrustworthy and non-compliant counterparties

• the Group procurement procedures have been revised to ensure more clarity on process steps, approval and signing matrix and rules

• definition of specific controls and segregation of duties rules to be embedded in business processes and supporting technology (e.g. optimised leasing process, redesigned Group procurement processes)

• increasing efficiency of the partnership between Risk Management, Compliance Officer and Risk and Compliance Partners to optimise risk triggers collection and mitigation

• embedding compliance and risk management in key Group projects, especially in the digital transformation and process automation initiatives

• training and awareness programs for all staff, focusing mainly on prevention of corruption, gifts policy, whistleblowing rules and channels, competition law requirements, Know-Your-Counterparty process rules and eligibility criteria, conflict of interest

• in line with the Policy Framework Procedure, the Compliance and Risk Management function coordinates the methodological process at group level and is in charge with appropriate communication among group employees whenever existing policies and procedures change or new ones are approved, aiming to ensure proper and timely implementation; all policies, procedures and guidelines are uploaded in a dedicated location on SharePoint and made available to employees on Group’s SPOT platform

b. Business continuity framework

The Group business impact assessment methodology and the business continuity arrangements followed the usual annual review process.

The analysis covered all processes and subprocess, especially new ones, interdependencies between areas and departments, resources, people, assets and suppliers’ availability, critical systems and flows. Processes and subprocesses are aligned to top risks, while hypothetical disruptions in critical processes are assessed based on a risk matrix, designed to consider the potential financial impact, as well as the impact on partners, operations, legal/regulatory obligations and reputation exposure of the Group.

Dedicated training and awareness programs are periodically developed for senior management, Risk and Compliance Partners and all staff, aiming to increase crisis risk culture, responsiveness and adaptability to incidents and crisis management.

As part of its ongoing monitoring and enhancement efforts in the area of internal risk management operation and internal controls efficiency, the Group focused in 2025 on the following areas:

• improvement and update of the internal regulatory framework to ensure alignment with legal requirements and internal optimisation and automation initiatives

• optimisation and digitalisation of business and support processes, while embedding adequate controls

• review of the business impact assessment and testing of the business continuity arrangements and framework

• training and awareness programs in compliance and risk management areas

• intensifying collaboration with risk and compliance partners

• ongoing consultation and collaboration between the 2^nd and 3^rd levels of internal control system

As part of Group Compliance landscape, the Risk and Compliance function, with the support of Internal Audit, performs periodically a dedicated risk assessment covering in detail areas mostly exposed to fraud risk, such as ethics in business conduct, controls in processes, financial statements and reporting fraud, employment- and employee - associated risks, sponsorships and donations, supplier and tenant fraud risk, M&A and disposals, information assets, outsourced services. Such assessment is based on most relevant fraud risk scenarios and a risk-based approach, where probability and impact are assessed both as gross and net values, i.e., before and after mitigation, according to the risk assessment methodology defined in the Group Risk Management Policy.

The risk assessment refers to the overall internal regulatory framework, processes and systems, aiming:

• to detect potential risk triggers for the risk areas identified as relevant

• to recommend implementation of proper procedures, delegation of authority, job descriptions

• to develop fraud risk awareness and training programs

Following this review, further mitigation measures have been planned for 2026:

• optimise controls and monitoring in business and support processes, in the context of wider digitalization and automation process

• internal audits consider fraud risk as part of each audit program

• roll out Microsoft Dynamics implementation, to ensure processes automation, embedment of needed controls and segregation of duties, less fraud risk exposure

• annual training and awareness program for areas in scope for this risk assessment (e.g. ethics, fraud risk)

• roll out Data Governance project (data cleansing, storage/archiving rules, data ownership)

• align all policies and procedures to the new process defined under digitalization and automation projects and other platforms supporting business processes

• identify not regulated processes and flows and document them adequately in internal procedures

• continue recurrent meetings between internal control functions so that to ensure alignment, timely information sharing, and coordinated responses

• digitalization initiatives aiming to address supplier- and fraud-risks, and payment fraud

Following such assessment, the Group derives the priorities for the following year in terms of key risk areas and expected mitigation effort. General measures, such as increased awareness and training, policy development and periodic updates are derived and prioritised. The status of action plan is reported to the Risk and Compliance Committee on a quarterly basis.

The Risk Management and Compliance Officer sets general priorities and key focus areas for the following year, which are included in the Compliance Program, and progress is also reported quarterly to the Risk and Compliance Committee.

In addition to ad-hoc meetings that are held whenever needed to consider special matters, to enhance the effectiveness of the risk management process, the Risk Management and Compliance Committee is convening on a quarterly basis. Any incidents and matters which are relevant in determining the level of effectiveness of the Group’s risk management are raised by management, through the Risk and Compliance Officer, to the Committee. Ultimately, the Internal Audit function, as the third line of defence in the internal controls system, assesses the effectiveness of risk management carried out by the first two lines of defence, i.e., Risk Management and Compliance, and business management.

Any significant incidents, misalignments between the decision, actions and activities of the Group and its risk appetite or ineffective processes or controls were addressed through appropriate measures, such as revision of existing or implementation of additional policies or procedures.

Training and awareness programs have been organised for new joiners and all staff during 2025, supporting implementation of the new policies and procedures, reminding of Risk Management and Compliance essentials, aiming to raise risk awareness and develop a proactive risk awareness culture among Group personnel. Regular posts on internal communication platform covered ethical conduct, gifts policy, whistleblowing values and available channels, and encouraged the tone at the top and speak-up culture. Also, awareness campaigns on ethics and anti-corruption practices were organised to cover Group partners, clients and suppliers, raising awareness about Group ethical commitments and inviting to speak up in case they suspect any misalignment between such commitments and Group personnel business conduct.

To maintain transparent communication as part of an efficient Risk Management process, regular alignment workshops continued in 2025 between functions responsible for the second line of defence (Risk Management and Compliance) and the third line of defence (Internal Audit), aiming to foster a unified Group-wide approach to preventing risk exposure and enhancing the efficiency of overall Risk Management practices.

Additionally, to ensure that strategy and business goals were considered when setting and adjusting the Risk Management system, as well as to enhance the tone at the top culture, the Risk Management and Compliance Officer, Chief Executive Officer, Chief Financial Officer, Internal Audit Director and Group Legal Counsel, all permanent guests in the Risk and Compliance Committee, continued periodical consultations focusing on projects and initiatives, process optimisation, potential risks and mitigation factors, especially in the context of a changeable socio-economic environment requiring fast strategic decisions and an adaptable risk management approach.

The Business Continuity Plan has been successfully tested in 2025, followed by a regular review of the business continuity internal framework. Awareness and training, tone from the top promoting a risk culture, timely communication, remain key success factors for an efficient business continuity system management, especially in the current political and economic context. Learning from recent crisis episodes (e.g., pandemics, regional conflicts and energy crisis) where timely reaction proved to be crucial, the Group continued to closely monitor the overall geo-political and economic landscape, while preserving business continuity and agility to react where immediate action is needed. Throughout the difficult and complex geo-political and economic context that extended to 2025, the Group’s focus has always been on preserving people safety, assets protection, processes continuity, functional partnerships with clients and suppliers, successful and transparent internal and external communication.

The Group corporate governance framework has been reviewed and adjusted to align to the evolving and demanding legal and regulatory environment, as well as to support the dynamic of internal business optimisation projects and initiatives.

Risk management, Compliance and Internal Audit are involved in Group optimisation and digital transformation projects so that they may recommend the most efficient control approach. Furthermore, Compliance validates all policies and procedures, and ensures coordination of the wider internal methodological process, enabling it to recommend needed controls and raise potential concerns in a timely manner.

The Risk Management and Compliance Officer ensures (i) all policies and procedures are available to all employees on the Group’s SPOT platform and are regularly consulted, (ii) relevant changes are shared by the means of internal communication channels, so that all Group existing personnel as well as new joiners may easily become familiar with the internal regulatory framework updates, (iii) guidance and advice to all staff regarding their roles and responsibilities, with the aim to maintain full compliance with internal regulatory framework.

Management assesses the risks of material misstatements in the financial statements due to fraud, by continuous evaluation of the design and relevant aspects of the system of internal controls, as well as among others the code of ethics and whistleblowing procedure. Mitigation of the risk of material misstatements in the financial statements is achieved through:

• implementation of a financial reporting calendar, as well as relevant internal controls, routines, checks and balances in the reporting process

• ensuring an appropriately sized and experienced finance and reporting team

• reconciling monthly, budget and forecast numbers to actuals, with quarterly review performed by the Audit Committee

• Audit Committee’s review of significant management estimates and accounting policies

• development of a single integrated, secure and performant IT architecture for ERP, Budget and Forecasting, Leasing, Procure-to-Pay, Master Data Management and Group Financial and Operational Reporting, delivering digital capability for end-to-end business management

• periodic internal and external auditors’ review

The Group implemented comprehensive Procurement Policies and a supplier due diligence process, to ensure that responsible purchasing is conducted and that procurement decisions are in the best interest of the Group. Responsible purchasing is aimed at Group level through:

• implementation of sound policies, promoting objectivity and transparency throughout the procurement processes, including during pre-tender phase, and monitoring of compliance thereto

• implementation of aligned requirements and controls in property management/project management contracts, to ensure that the same principles are applied by outsourced property and project managers

• design of a detailed supplier risk assessment and due diligence, including suppliers’ green assessment

• win-win partnerships with some Group suppliers, based on sustainable business practices, where the Group and its suppliers may thrive and grow

The Group rolled out a Leasing Policy, to ensure that tenant relationships are managed with professionalism and at high standards across the Group, and that internal controls are implemented, fostering transparency and enabling the achievement of the Group’s objectives. A risk assessment and due diligence process are applied when onboarding new clients and periodical revisions are performed thereafter.

The Board is responsible for the governance and ongoing oversight of internal controls, including information and technology. The Board confirms that processes exist ensuring timely, relevant, accurate and accessible reporting, communication and data storage. To this end, the Board ensures that the Group’s IT processes and systems are integrated with the overall business strategy and objectives, monitoring that:

• processes, people and information technology are integrated seamlessly across the Group

• hard and soft infrastructure supports the achievement of the Group’s strategy

• proper arrangements are implemented for business continuity and disaster recovery

• proper security measures have been implemented to ensure that confidential data is safeguarded and easily accessible, while complying with the relevant cybersecurity, data protection or other applicable laws and regulations

• proper investments in information technology are made with a view to enabling the above

The Board has delegated the responsibility for IT and security to the CEO through the Operational Mandate and the CEO has further cascaded these to the Group Technology Director. Where IT processes are outsourced to third-party service providers, these are governed by service level agreements, with compliance monitored by management.

Appropriate IT security and business continuity management policies have been developed and implemented across the Group.

The Group demonstrates a strong commitment to cybersecurity. By implementing extensive measures, they aim to safeguard against material data breaches, information leakage, and the loss of critical data. A Data Governance project has been launched at Group level seeking to ensure implementation of adequate organisational and security measures meant to enhance information assets protection and security.

The Group continued in 2025 its Cybersecurity Program, focused on awareness, prevention (through regular training programmes for all employees at least on an annual basis) and security by design. The Group implemented and communicated a clear escalation mechanism where any suspected attack can be reported and analysed. The 2025 awareness and prevention programme focused on training programmes for all employees meant to raise awareness of emerging security threats, key vulnerabilities, Group’s policies, procedures and support functions. The Group was the target of cybersecurity attacks during the year, while none had serious consequences due to the safeguards implemented – close monitoring and tracking are in place. No attack led to either a significant leakage, loss of personal data and business secrets, or to the unavailability of technology and business interruptions in the three years preceding this report date.

With a focus to enhance internal controls, increase efficiency, transparency and traceability, and to operate in a paperless environment (to the extent possible and within current legal constraints in various jurisdictions), the Group continued its journey of digitalisation and process automation across various areas and processes, as a medium-term strategic priority.

The Group implemented and periodically reviews the General Compliance Policy aiming to guide compliance by: (i) setting a clear compliance framework; (ii) promoting consistent, rigorous and comprehensive practices throughout the Group; and (iii) stimulating a culture of compliance, including ethics and integrity.

The Compliance and Risk Management function covers the following responsibilities at Group level:

• advisory: counsels all management levels and personnel on compliance with laws, rules and standards, including keeping them informed on legislative developments and emerging exposure

• education: assists senior management in educating staff on compliance issues

• identification, measurement and assessment of compliance risks: evaluates the compliance risks associated with business activities, including the development of new business practices and new partnerships

• monitoring, testing and reporting: periodically assesses compliance and monitors risks in all jurisdictions and emerging legislation

The Board and the Risk and Compliance Committee monitor the compliance management system structured on three pillars: (i) build awareness and enable prevention; (ii) deploy sufficient detection and investigation mechanisms; and (iii) implement appropriate response, mitigation and consequence management.

The Group Risk and Compliance Officer has the following responsibilities:

• assist the Board of Directors, Risk and Compliance Committee and management in fulfilling their respective risk and compliance responsibilities

• establish and maintain ongoing enterprise risk and compliance management practices

• build and maintain relationships with those responsible for managing risks throughout the Group

• report on incidents and significant risks to the CEO and Risk and Compliance Committee

• propose, based on the relevant input from management, changes to the Group's risk appetite

• develop and periodically review the Compliance and Risk Management Framework, methodology and operational processes at Group level, seeking to prevent Group exposure to excessive risks

• establish the annual Compliance Program and report periodically to the Risk and Compliance Committee, on the risk and compliance management status

• advise on the impact of legal and regulatory changes, as well as on emerging best practices and legislative trends

• ensure deployment of training and awareness programs for Group personnel, on a risk-based approach, aiming to develop the risk management culture

• perform periodical compliance checks seeking to ensure that the implemented processes are aligned to the internal and legal framework, as well as that the appropriate controls are in place to prevent compliance risk from materialising

The Group implemented privacy policies and procedures across the Group, based on a zero tolerance to major information loss or leakage, and these are deployed and monitored by an experienced Data Protection Officer. The Group's approach to privacy includes:

• embedding privacy-by-design principle in core processes

• embedding data privacy clauses in supplier and customer contracts

• providing clear and relevant information to all data subjects regarding their rights and the coordination of processing

• making sure that data is processed only for the purpose it has been collected

• following the data minimisation principle, as well as the applicable data retention periods

• properly protecting personal data from loss or unauthorised access

No breach resulting in a major leakage, loss or unavailability of personal data occurred in 2025.

The Group's policies and procedures are available to all employees in a shared location, promoted on internal communication channels and periodically acknowledged by the Group personnel. Training and awareness programs are regularly organised, at least on an annual basis.

Operational compliance is monitored for all companies in the Group and reported to the Risk and Compliance Committee on a quarterly basis. The Group would disclose in the Annual Report if it were to incur material or repeated regulatory penalties, sanctions or fines for breaches of, or non-compliance with, statutory obligations. On the date of this report, there were no material regulatory penalties, sanctions or fines for breach or non-compliance with statutory obligations imposed on Group companies or any of their Directors or officers.

Considering that the Group operates in many countries, through its activities or commercial campaigns and projects it carries out, and in line with the intention to bring more transparency to business processes and clarity on the split of responsibility, the sponsorship and donations process is formalised in a dedicated policy and the needed controls are adequately embedded. It is part of the Group’s commitment to responsible corporate behaviour to exercise social responsibility through donations and sponsorships wherever it operates. The Group aims to ensure any donation, sponsorship and related funding fully comply with applicable laws, its business ethics principles and conflict of interest avoidance rules, as stated in its Code of Ethics, and cannot be perceived by a third party to be for the purpose of corruption.

To efficiently manage operational risk, fraud risk and financial losses, the Group assesses periodically the way existing and optimised activities, processes and flows are documented, and relevant controls are embedded therein. Where the need, process steps, rules and responsibilities are mapped and documented in detail in dedicated internal policies and procedures which are further on implemented and supported by training and awareness campaigns in focus groups.

As regards ESG material impacts, they maintain an important place in Group risk assessment landscape. According to its approved Risk Appetite Statement, the Group has zero tolerance against the following topics and areas of concern, of relevance also from sustainability perspective: health and safety of Group staff and visitors such as but not limited to risks related to structural integrity of the properties, fire security, serious pollution, fraud and corruption, non-compliance with material regulatory requirements, any failure in being fully compliant with financial reporting standards. Group Risk Appetite and tolerance limits are considered in all risk reviews, partners due diligence, as well as all business decisional processes. Additionally, the Group performs double materiality assessment, aiming to identify the ESG challenges that need to be prioritised, especially in the light of recent developments in reporting requirements and in the consideration of Group strategic objectives. The Group Head of Sustainability acts also as Risk Management and Compliance Partner and supports the Group Risk Management and Compliance Officer in periodical risks review exercises. Detailed double materiality assessment impacts, risks and opportunities are monitored on a granular level by the Group Head of Sustainability, and they have been clustered under several topics for the Group Risk Management umbrella. Among the most relevant risks that have been identified in the sustainability area, and which are monitored and reported to the Risk and Compliance Committee on a quarterly basis, we note the following:

• risk of non-compliance with sustainability related legislation and regulations, considering the breach of relevant environmental legislation might trigger financial and reputation loss, sanctions, negative media, damages to third parties

• greenwashing risk, considering the risk of not ensuring transparent and correct disclosure, thus causing reputational damage, regulatory and legal repercussions, misleading of investors, financial losses, as well as diverting resources from genuinely sustainable initiatives, hindering real environmental progress

• superimposed taxation, considering the risk of non-compliance with relevant environmental legislation, best practices and operations, thus potentially leading to financial and reputation loss, sanctions, negative media, damages to third parties

• transition to EPC level A, alignment with the EU Taxonomy, and compliance with EU Directives, considering the risk of not ensuring timely compliance, thus triggering financial and reputation loss, sanctions and higher insurance/credit premiums, or inadequate investment decisions that may also trigger financial loss and penalties

• climate change physical risks, where a lack of climate adaptation plans for the Group’s assets may trigger financial and reputational loss, potentially decreasing valuation of the assets, as well as insurance premium increase

Planned Areas of Future Focus for 2026 and onward

Annually, the Risk Management and Compliance Officer performs a risk assessment, to determine the focus areas for the following year and whether there is a need to update the Group internal regulatory framework and refine the Annual Compliance Program.

Considering the instability of the broader geopolitical environment, rising inflation and price pressures across goods and services, ongoing unpredictability in key areas, and the growing need for digitalization and automation to reduce overall risk exposure, the Group will focus on the following priority areas in 2026: strengthening process controls and monitoring, embedding fraud‑risk considerations into audit programs, advancing digitalization initiatives, and enhancing training and awareness activities.

Embedding risk management in strategy and business objectives setting as well as in the execution process, is key to successful and effective enterprise risk management, so this goal remains a top priority for the Group in 2026 and onward. As such, the digitalisation and automation of core processes, accommodating internal controls, segregated roles and action rules, as well as documentation of relevant processes and flows in internal policies and procedures will remain a priority in 2026.

Enhancing information assets governance continues to be a priority also in 2026, aiming to improve overall data management: ownership responsibilities, electronical storage and physical archiving rules, adequate labelling and access controls embedded in business processes, monitoring and continuous improvement, partnership with specialised companies in physical storage management in order to safeguard integrity, security and confidentiality of data and information.

Information technology and cybersecurity have continued to undergo material mitigation in 2025 and will remain a focus in 2026, especially in the following directions: (i) the redesign of shopping centres’ network infrastructure, given the associated risk exposure to financial and reputational losses triggered by potential incidents, data breaches, impact on Group confidential information and individuals’ data, (ii) the implementation of additional tools and features meant to enhance access management policy and to harden existing security defensive environment, as well as (iii) the training and awareness programs intended to increase knowledge and develop detection skills for Group personnel enabling easy identification of unusual conduct targeting to compromise data and information security or integrity.

Increasing risk awareness and encouraging a more proactive instead of reactive risk management culture among Group personnel are always part of the agenda of the Risk Management and Compliance Officer, the Risk and Compliance Committee, and the management team for the next years, as a critical success factor in achieving Group’s strategic and business objectives. Also, resilience and crisis oriented management culture is of particular interest, and employees will be trained to react appropriately when facing a crisis, as this might not only save lives but also increase the efficiency of remedial actions.

Training and awareness programs also remain a priority for Group personnel, with a particular emphasis on areas with higher exposure to risks. In addition, regular awareness campaigns will continue to be carried out for third party partners, including suppliers and clients, to encourage them to raise any legitimate concerns regarding the conduct and interactions of Group personnel. These concerns can be reported confidentially through the Group’s whistleblowing channels.

Key Risk Areas

Unexpected significant developments in the political, economic, financial, regulatory, geopolitical, social or health environments in the jurisdictions where the Group operates, may have an impact on Group’s assets, financial results, distribution policy, development and extension initiatives and investment/divestment approach.

Therefore, Key strategic directions are periodically reassessed, ensuring identified risks are aligned to moving business objectives, while adequately and efficiently addressing potential negative impact on Group’s activities or correctly weighing the potential opportunities.

The Group expresses its openness to disclosing relevant information on significant events that could challenge its risk management framework and/or the key mitigating actions, while reasonably preserving information sensitivity and observing confidentiality.

In the risk assessments performed in 2025, the Group focused on the following risk triggers:

• macroeconomic pressures. Gas/oil crisis, utilities cost increases, inflation, pricing, unemployment, and shifts in consumer preferences, potentially causing rise in operating costs, squeeze margins, changes in cost structures and strategic planning to maintain profitability and competitiveness

• supply chain disruption. Global disruptions affecting resilience, business continuity, and pricing

• utilities unavailability. Potential outages leading to business and supply-chain interruption or disruption, financial losses, while challenging resilience and customers’ trust

• geopolitical escalation. Heightened and escalating geopolitical tensions can create supply‑chain instability, increase operational and financial risks, and force businesses to manage uncertainty through higher costs, disrupted markets, and the need for rapid strategic adjustments

• fraud risk. Elevated exposure to fraud scenarios that may cause increased financial losses, operational disruptions, and reputational damage, while forcing business to strengthen controls, allocating more resources to risk management, and absorbing higher compliance and remediation costs

• expansion of international sanctions regimes. The increasing scope and frequency of international sanctions heighten compliance and operational risks, require enhanced due diligence processes, may necessitate supply chain adjustments, and increase exposure to legal, financial, and reputational risks

• human rights impacts. Embedding the Human Rights Due Diligence Policy and EU Taxonomy Minimum Safeguards across operations and the value chain strengthens compliance and stakeholder trust, while requiring enhanced oversight and monitoring, processes and governance adjustments

• KYC/counterparty integrity (AML/CFT). Enhanced Know‑Your‑Counterparty due diligence, automated risk scoring, and sanctions compliance embedded in processes

• operational compliance and regulatory change. Ongoing monitoring of operational compliance, evolving regulatory requirements, and enforcement risk across jurisdictions

Dedicated action planning followed risk assessment initiatives and relevant measures were implemented to mitigate identified risks.

The key risk areas outlined below represent the most significant risk triggers identified and monitored by the Group, together with their associated business impacts, mitigating actions, and expected future trends. This list is not intended to be exhaustive but rather reflects the risks most relevant to the Group’s operating environment. Additional risk factors, while continuously monitored, are not included here either because their likelihood of occurrence is low or their potential impact across the portfolio is not considered material.