Table ofContents

AS FILED WITH THE SECURITIES AND EXCHANGE COMMISSION ON APRIL 8, 2026

UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

WASHINGTON, DC 20549

FORM 20-F

(Mark One)

☐	REGISTRATION STATEMENT PURSUANT TO SECTION 12(b) OR (g) OF THE SECURITIES EXCHANGE ACT OF 1934

OR

☒	ANNUAL REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

For the fiscal year ended December 31, 2025

OR

☐	TRANSITION REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

For the transition period from ___________ to ___________

OR

☐	SHELL COMPANY REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

Date of event requiring this shell company report ___________

Commission file number: 001-32535

GRUPO CIBEST S.A.

(Exact name of Registrant as specified in its charter)

N/A

(Translation of Registrant’s name into English)

Republic of Colombia

(Jurisdiction of incorporation or organization)

Carrera 48 # 26-85, Avenida Los Industriales

Medellín, Colombia

(Address of principal executive offices)

Catalina Tobón Rivera, Investor Relations Director

Tel. +57 6014885950, e-mail: ctobon@grupocibest.com.co

Carrera 11 # 91-42 – Edificio FIC 9211, Bogotá, Colombia

(Name, Telephone, E-Mail and/or Facsimile number and Address of Company Contact Person)

Securities registered or to be registered pursuant to Section 12(b) of the Act.

Title of each Class	Trading Symbol(s)	Name of each exchange on which registered
American Depositary Shares	CIB	New York Stock Exchange
Preferred Shares		New York Stock Exchange*

______________________________________________________________

*Grupo Cibest’s Preferred Shares are not listed for trading directly, but only in connection with its American Depositary Shares, which are evidenced by American Depositary Receipts, each representing four Preferred Shares.

Securities registered or to be registered pursuant to Section 12(g) of the Act.

Not applicable

(Title of Class)

Securities for which there is a reporting obligation pursuant to Section 15(d) of the Act.

Not applicable

(Title of Class)

Indicate the number of outstanding shares of each of the issuer’s classes of capital or common stock as of the close of the period covered by the annual report.

Common Shares	509,103,132
Preferred Shares	444,111,532

Indicate by check mark if the registrant is a well-known seasoned issuer, as defined in Rule 405 of the Securities Act.

Yes ☒ No ☐

If this report is an annual or transition report, indicate by check mark if the registrant is not required to file reports pursuant to Section 13 or 15(d) of the Securities Exchange Act of 1934.

Yes ☐ No ☒

Indicate by check mark whether the registrant (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days.

Yes ☒ No ☐

Indicate by check mark whether the registrant has submitted electronically every Interactive Data File required to be submitted pursuant to Rule 405 of Regulation S-T during the preceding 12 months (or for such shorter period that the registrant was required to submit such files).

Yes ☐No ☒

Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, or an emerging growth company. See the definitions of “large accelerated filer”, “accelerated filer” and “emerging growth company” in Rule 12b-2 of the Exchange Act.:

Large accelerated filer	☒	Accelerated filer	☐	Non-accelerated filer	☐
				Emerging growth company	☐

If an emerging growth company that prepares its financial statements in accordance with U.S. GAAP, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards† provided pursuant to Section 13(a) of the Exchange Act. ☐

Indicate by check mark whether the registrant has filed a report on and attestation to its management’s assessment of the effectiveness of its internal control over financial reporting under Section 404(b) of the Sarbanes-Oxley Act (15 U.S.C. 7262(b)) by the registered public accounting firm that prepared or issued its audit report. ☒

If securities are registered pursuant to Section 12(b) of the Act, indicate by check mark whether the financial statements of the registrant included in the filing reflect the correction of an error to previously issued financial statements. ☐

Indicate by check mark whether any of those error corrections are restatements that required a recovery analysis of incentive-based compensation received by any of the registrant’s executive officers during the relevant recovery period pursuant to §240.10D-1(b). ☐

Indicate by check mark which basis of accounting the registrant has used to prepare the financial statements included in this filing:

U.S. GAAP ☐	International Financial Reporting Standards as issued<br><br>by the International Accounting Standards Board ☒	Other ☐

If “Other” has been checked in response to the previous question, indicate by check mark which financial statement item the registrant has elected to follow.

Item 17 ☐ Item 18 ☐

If this is an annual report, indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Exchange Act).

Yes ☐ No ☒

(APPLICABLE ONLY TO ISSUERS INVOLVED IN BANKRUPTCY PROCEEDINGS DURING THE PAST FIVE YEARS.)

Indicate by check mark whether the registrant has filed all documents and reports required to be filed by Section 12, 13 or 15(d) of the Securities Exchange Act of 1934 subsequent to the distribution of securities under a plan confirmed by a court.

Yes ☐ No ☐

Table ofContents

TABLE OF CONTENTS

EXPLANATORY NOTE				4
CERTAIN DEFINED TERMS				5
CAUTIONARY NOTE REGARDING FORWARD-LOOKING STATEMENTS				7
PRESENTATION OF CERTAIN FINANCIAL AND OTHER INFORMATION				10
PART I				9
ITEM 1		IDENTITY OF DIRECTORS, SENIOR MANAGEMENT AND ADVISERS		9
ITEM 2		OFFER STATISTICS AND EXPECTED TIMETABLE		9
ITEM 3		KEY INFORMATION		9
	A.	SELECTED FINANCIAL DATA		9
	B.	CAPITALIZATION AND INDEBTEDNESS		9
	C.	REASONS FOR THE OFFER AND USE OF PROCEEDS		9
	D.	RISK FACTORS		10
ITEM 4		INFORMATION ON THE COMPANY		28
	A.	HISTORY AND DEVELOPMENT OF THE COMPANY		28
	B.	BUSINESS OVERVIEW		32
		B.1	GENERAL	32
		B.2	OPERATIONS	35
		B.3	SEASONALITY OF DEPOSITS	35
		B.4	RAW MATERIALS	35
		B.5	DISTRIBUTION NETWORK	35
		B.6	PATENTS, LICENSES AND CONTRACTS	37
		B.7	COMPETITION	38
		B.8	SUPERVISION AND REGULATION	45
		B.9	ESG	59
	C.	ORGANIZATIONAL STRUCTURE		59
	D.	PREMISES AND EQUIPMENT		62
		E.	SELECTED STATISTICAL INFORMATION	63
		E.1	DISTRIBUTION OF ASSETS, LIABILITIES AND STOCKHOLDERS’ EQUITY; INTEREST RATES AND INTEREST DIFFERENTIAL	64
		E.2	INVESTMENT PORTFOLIO	69
		E.3	LOAN PORTFOLIO	70
		E.4	SUMMARY OF LOAN LOSS EXPERIENCE	72
		E.5	DEPOSITS	72
	F.	UNRESOLVED STAFF COMMENTS		73
ITEM 5		OPERATING AND FINANCIAL REVIEW AND PROSPECTS		73
	A.	OPERATING RESULTS		74
			GENERAL DISCUSSION OF THE CHANGES IN RESULTS FOR 2025VERSUS 2024	80
	B.	LIQUIDITY AND CAPITAL RESOURCES		92
		B.1	LIQUIDITY AND FUNDING	92
		B.2	FINANCIAL INSTRUMENTS AND TREASURY ACTIVITIES	97
		B.3	COMMITMENT FOR CAPITAL EXPENDITURES	98
	C.	RESEARCH AND DEVELOPMENT, PATENTS AND LICENSES, ETC.		98
	D.	TREND INFORMATION		98
	E.	CRITICAL ACCOUNTING POLICIES AND ESTIMATES		100
ITEM 6		DIRECTORS, SENIOR MANAGEMENT AND EMPLOYEES		101
	A.	DIRECTORS AND SENIOR MANAGEMENT		101
	B.	COMPENSATION OF DIRECTORS AND OFFICERS		105
	C.	BOARD PRACTICES		106
	D.	EMPLOYEES		110

Table ofContents

	E.	SHARE OWNERSHIP		111
	F	DISCLOSURE OF A REGISTRANT'S ACTION TO RECOVER ERRONEOUSLY AWARDED COMPENSATION		112
ITEM 7		MAJOR STOCKHOLDERS AND RELATED PARTY TRANSACTIONS		112
	A.	MAJOR STOCKHOLDERS		112
	B.	RELATED PARTY TRANSACTIONS		114
	C.	INTEREST OF EXPERTS AND COUNSEL		114
ITEM 8		FINANCIAL INFORMATION		114
	A.	CONSOLIDATED FINANCIAL STATEMENTS AND OTHER FINANCIAL INFORMATION		114
		A.1	CONSOLIDATED FINANCIAL STATEMENTS	115
		A.7	LEGAL PROCEEDINGS	115
		A.8	DIVIDEND POLICY	115
	B.		SIGNIFICANT CHANGES	115
ITEM 9		THE OFFER AND LISTING		116
	A.	OFFER AND LISTING DETAILS		116
	B.	PLAN OF DISTRIBUTION		116
	C.	MARKETS		116
	D.	SELLING STOCKHOLDERS		117
	E.	DILUTION		117
	F.	EXPENSES OF THE ISSUE		117
ITEM 10		ADDITIONAL INFORMATION		117
	A.	SHARE CAPITAL		117
	B.	MEMORANDUM AND ARTICLES OF ASSOCIATION		117
	C.	MATERIAL CONTRACTS		125
	D.	EXCHANGE CONTROLS		125
	E.	TAXATION		125
	F.	DIVIDENDS AND PAYING AGENTS		130
	G.	STATEMENT BY EXPERTS		130
	H.	DOCUMENTS ON DISPLAY		130
	I.	SUBSIDIARY INFORMATION		130
ITEM 11		QUANTITATIVE AND QUALITATIVE DISCLOSURES ABOUT MARKET RISK		130
ITEM 12		DESCRIPTION OF SECURITIES OTHER THAN EQUITY SECURITIES		135
PART II				136
ITEM 13		DEFAULTS, DIVIDEND ARREARAGES AND DELINQUENCIES		136
ITEM 14		MATERIAL MODIFICATIONS TO THE RIGHTS OF SECURITY HOLDERS AND USE OF PROCEEDS		136
ITEM 15		CONTROLS AND PROCEDURES		136
ITEM 16		RESERVED		137
	A.	AUDIT COMMITTEE FINANCIAL EXPERT		#
	B.	CORPORATE GOVERNANCE AND CODE OF ETHICS		137
	C.	PRINCIPAL ACCOUNTANT FEES AND SERVICES		138
	D.	EXEMPTIONS FROM THE LISTING STANDARDS FOR AUDIT COMMITTEE		138
	E.	PURCHASES OF EQUITY SECURITIES BY THE ISSUER AND AFFILIATED PURCHASERS		138
	F.	CHANGE IN REGISTRANT’S CERTIFYING ACCOUNTANT		139
	G.	CORPORATE GOVERNANCE		140
	H.	MINE SAFETY DISCLOSURES		141
	I.	DISCLOSURE REGARDING FOREIGN JURISDICTIONS THAT PREVENT INSPECTIONS		141
	J.	INSIDER TRADING POLICIES		141
	K.	CYBERSECURITY		141
PART III				144
ITEM 17		FINANCIAL STATEMENTS		144
ITEM 18		FINANCIAL STATEMENTS		144
ITEM 19		EXHIBITS		144

Table ofContents

EXPLANATORY NOTE

On May 16th 2025, Bancolombia announced that it had successfully completed the procedures aimed at enhancing the corporate structure of Bancolombia and its subsidiaries ('Grupo Bancolombia'). These procedures included the establishment of a new holding company for Grupo Bancolombia named Grupo Cibest and the execution of a series of related corporate transactions (the 'Corporate Structure Changes').

As part of the Corporate Structure Changes, Bancolombia’s shareholders (excluding Grupo Cibest) became shareholders of Grupo Cibest. Grupo Cibest issued, on their behalf, the same number and class of shares (Common Shares and Preferred Shares with no voting rights), under the same terms and conditions as those previously held in Bancolombia. This ensured that shareholders maintained the same ownership percentage they previously held in Bancolombia. In turn, their shares in Bancolombia (excluding those held by Grupo Cibest) were cancelled. Holders of Bancolombia American Depositary Receipts received equivalent ADRs of Grupo Cibest. Trading on Grupo Cibest shares began on May 19 2025.

Following the Corporate Structure Changes, Grupo Cibest became the parent, or holding company, of all financial entities and other companies that were part of Grupo Bancolombia, including Bancolombia, and became a successor issuer to Bancolombia under the Exchange Act with respect to the Grupo Cibest ADSs, and to disclose certain other matters.

Cibest Corporate Group's business and operations after the Corporate Structure Changes are identical to those of Bancolombia and its subsidiaries immediately prior to the restructuring. Thus, unless otherwise expressly stated, all historical financial data included in this annual report for periods prior to May 16, 2025, reflects Bancolombia and its subsidiaries on a consolidated basis.

Bancolombia remains Grupo Cibest's largest operating subsidiary as of the date of this report, comprising 74.84% of total consolidated net income from continuing operations for Cibest Corporate Group, and 67.76% of Assets.

Table ofContents

CERTAIN DEFINED TERMS

Unless otherwise specified or if the context so requires, in this annual report:

Entities

'Bam' - Banco Agromercantil de Guatemala S.A., a banking institution organized under the laws of the Republic of Guatemala, and its subsidiaries on a consolidated basis.

'Banagrícola' - Banagrícola S.A., a Panamanian company that is the parent company of Banco Agrícola S.A., and its consolidated subsidiaries.

'Bancoagrícola' - Banco Agrícola S.A., an El Salvador bank and its subsidiaries on a consolidated basis.

'Bancolombia' - Bancolombia S.A., a Colombian bank.

'Bancolombia's Financial Subsidiaries' - Banca de Inversión Bancolombia S.A., Fiduciaria Bancolombia S.A. and Valores Bancolombia S.A.

'Banca de Inversión Bancolombia' - Banca de Inversión Bancolombia S.A. Corporación Financiera, a Colombian investment banking subsidiary.

'Bancolombia Panamá' - Bancolombia Panamá S.A., a Panamanian subsidiary that provides banking services to non-Panamanian customers.

'Bancolombia Puerto Rico' - Bancolombia Puerto Rico Internacional Inc., a Puerto Rican subsidiary that provides banking services to customers who reside outside Puerto Rico.

'Banistmo' - Banistmo S.A., a Panamanian bank, and its subsidiaries on a consolidated basis, which constitutes a discontinued operation following the execution of a sale agreement. See "Agreement for the Sale of Banistmo" for further information regarding the sale of Banistmo.

'Cibest Capital' - Cibest Capital Holdings USA LLC, a U.S. brokerage and asset management company.

'Cibest Corporate Group', 'we', 'us' and 'our' - Grupo Cibest S.A. and its subsidiaries.

'Cibest Panamá Assets' - Cibest Panamá Assets S.A., a Panamanian subsidiary wholly owned by Grupo Cibest.

'Fiduciaria Bancolombia' - Fiduciaria Bancolombia S.A. Sociedad Fiduciaria, a Colombian trust and fund management subsidiary.

'Foreign Banks' - Bam, Banistmo and Bancoagrícola.

'Foreign Subsidiaries' - Grupo Cibest's foreign subsidiaries.

'Grupo Agromercantil' 'GAH' - Grupo Agromercantil Holding S.A., a Panamanian company and the parent company of Bam.

'Grupo Cibest' - Grupo Cibest S.A., a Colombian company.

'Nequi' - a 100% digital business line with a strong focus on financial inclusion, that operates under Bancolombia's license.

'Renting Colombia' - Renting Colombia S.A.S., a Colombian lease and fleet management subsidiary.

'Valores Bancolombia' - Valores Bancolombia S.A. Comisionista de Bolsa, a securities broker and the Colombian parent of brokerage and asset management company Cibest Capital Holdings USA LLC.

'Wenia' - Wenia Ltd., a Bermudian subsidiary, that allows individuals to buy, convert, receive, send and sell digital assets.

'Wompi' - Wompi S.A.S., a Colombian subsidiary and a payment platform.

Table ofContents

Other Terms

'ADR program' - Grupo Cibest’s established framework to issue American Depositary Receipts (ADRs) representing American Depositary Shares (ADS) in the United States.

'ADSs' - Grupo Cibest’s American Depositary Shares (one ADS represents four Preferred Shares).

'Annual Report' - this annual report on Form 20-F.

'ATM' - automated teller machine.

'Board of Directors,' 'the Board' - the board of directors of Grupo Cibest.

'Central Bank' - Banco de la República, the central bank of Colombia.

'Consolidated Financial Statements' - our audited consolidated financial statements for fiscal years 2025, 2024 and 2023. Our fiscal year ends on December 31.

'DTF' - Depósitos a Término Fijo, the commercial interest rate for 90-day deposits in Colombia.

'ESG' - the Environmental, Social and Governance criteria.

'Grupo Sura' - Grupo de Inversiones Suramericana S.A., a Colombian holding company of the Sura‑Bancolombia Financial Conglomerate.

'IASB' - International Accounting Standards Board.

'IFRS' - International Financial Reporting Standards issued by the IASB.

'IFRS - IC' - International Financial Reporting Interpretations Committee.

'IRS' - U.S. Internal Revenue Service.

'NYSE' - New York Stock Exchange.

'OCI' - Other Comprehensive Income.

'Peso', 'pesos' or 'COP' - the Colombian peso.

'Preferred Shares' and 'Common Shares' - Grupo Cibest's outstanding, fully paid-in preferred and common shares ("acciones con dividendo preferencial sin derecho a voto" and "acciones ordinarias," respectively).

'Representative Market Rate' - Tasa Representativa del Mercado, the U.S. dollar market rate certified by Colombia's SFC.

'SEC' - the U.S. Securities and Exchange Commission.

'SMEs' - Small and Medium Enterprises.

'SMMLV' - Salario Mínimo Mensual Legal Vigente, the effective legal minimum monthly salary in Colombia. In 2025, the SMMLV in Colombia was COP 1,423,500.

'SOX' - refers to the U.S. Sarbanes-Oxley Act of 2002, as amended.

'Financial Superintendency' or 'SFC' - Superintendencia Financiera de Colombia, the Finance and Public Credit Ministry agency that exercises the inspection, oversight, and control over persons who engage in financial, securities, insurance activities, and any other activities related to the management, use, or investment of funds collected from the public.

Table ofContents

'Superintendency of Industry and Commerce' or 'SIC' - Superintendencia de Industria y Comercio de Colombia, an agency of the Ministry of Commerce, Industry and Tourism that regulates competition in the financial services and other industries.

'Support Committees' - Committees composed of Board members, established to assist the Board of Directors in developing and strengthening its responsibilities and competencies.

'U.S.' or 'United States' - the United States of America.

'USD' - U.S. dollar.

'UVR' - Unidades de Valor Real, a Central Bank inflation-adjusted index used for pricing home mortgage loans.

Cautionary note regarding forward-looking statements

This Annual Report contains statements that may constitute forward-looking statements within the meaning of the safe harbor provisions of the U.S. Private Securities Litigation Reform Act of 1995. These forward-looking statements are not based on historical facts but instead represent only our belief regarding future events, many of which, by their nature, are inherently uncertain and outside our control.

The words 'anticipate,' 'believe,' 'estimate,' 'expect,' 'intend,' 'plan,' 'predict,' 'target,' 'forecast,' 'guideline,' 'should,' 'project' and similar words and expressions are intended to identify forward-looking statements. It is possible that our actual results may differ, possibly materially, from the anticipated results indicated in or implied by these forward-looking statements.

Information regarding important factors that could cause actual results to differ, perhaps materially, from those in our forward-looking statements appears in a number of places in this Annual Report, including in Item 3 Key Information, Section D, Risk Factors and Item 5 Operating and Financial Review and Prospects.

These factors include, but are not limited to:

(1) Changes in general economic, business, political, social, fiscal or other conditions in Colombia, or in any of the other countries where we operate, taking into account

(a) The potential for slower economic growth, inflation, currency depreciation and political instability

(b) Changes to regulations, fiscal policy, government aid to sectors where we offer services, among other government decisions, could affect our financial situation.

(2) Changes in capital markets or in markets in general that may affect policies, overall liquidity or attitudes towards lending

(3) Unanticipated increases in financing and other costs, or the inability to obtain additional debt or equity financing on attractive terms

(4) Prolonged inflation, or changes in foreign exchange rates, interest rates or unemployment rates

(5) Sovereign risks

(6) Liquidity risks

(7) Increases in delinquencies by our borrowers

(8) Lack of acceptance of new products or services by our target customers

(9) Competition in the banking, financial services, credit card services, insurance, asset management or remittances businesses or other industries in which we operate

(10) Adverse determination of legal or regulatory disputes or proceedings and the consequences thereof

Table ofContents

(11) Changes in official policies, regulations and the Colombian government’s banking policy as well as changes in laws, regulations or policies in other jurisdictions where we do business

(12) Factors specific to us, including changes to the estimates and assumptions underlying our financial statements; our success in identifying risks (such as the incidence of loan delinquencies) and managing risks; an inability to achieve our financial and capital targets, which may result in failure to achieve the expected benefits of our strategies; a reduction in our credit ratings, which would decrease our funding availability

(13) Failure to achieve regulatory stress testing

(14) Changes to the reliability and security of our data management, data privacy, information and technology infrastructure, including cyberattack threats, which may impact our ability to serve clients

(15) Failure to attract, hire or retain key talent

Forward-looking statements apply only as of the date they are made and are subject to change, and, except as required

by law, we do not intend, and do not assume any obligation, to update these forward-looking statements in light

of new information or future events arising after the date of this Annual Report.

Table ofContents

PART I

ITEM 1      Identity of Directors, Senior Management and Advisers

Not applicable.

ITEM 2      Offer Statistics and Expected Timetable

Not applicable.

ITEM 3      Key Information

A.[Reserved]

B.Capitalization and Indebtedness

Not applicable.

C.Reasons for the Offer and Use of Proceeds

Not applicable.

Table ofContents

Presentation of certain financial and other information

Accounting Principles

The Consolidated Financial Statements for the years ended December 31, 2025 and 2024, and our Consolidated Statements of Income, Consolidated Statements of Comprehensive Income, Consolidated Statements of Changes in Equity and Consolidated Statements of Cash Flows for the years ended December 31, 2025, 2024 and 2023, and related notes included in this Annual Report have been prepared in accordance with IFRS as issued by the IASB as well as the interpretations issued by the IFRS-IC. All data included in this report has been prepared in accordance with IFRS as issued by the IASB, except for the data included in Item 4. B.7 Competition, which has been prepared in accordance with the local generally accepted accounting practices of each subsidiary.

Our Consolidated Financial Statements include entities that we control, directly or indirectly. See Item 4. Information on the Company – C. Organizational Structure for a summary of the organizational structure of Cibest Corporate Group and certain subsidiaries involved in financial or capital markets.

Currencies

Our Consolidated Financial Statements are presented in Colombian pesos, which is our functional currency and the presentation currency for the Consolidated Financial Statements. The Consolidated Financial Statements and amounts as of December 31, 2025 and 2024, and for the three fiscal years ended December 31, 2025, 2024 and 2023, contained in this Annual Report are expressed in millions or billions of pesos (where indicated), except earnings per share, diluted earnings per share and the exchange rate, which are stated in units of Colombian pesos, while other currencies (dollars, euro, pounds, etc.) are stated in thousands.

This Annual Report translates certain peso amounts into U.S. dollars at specified rates solely for the convenience of the reader. Unless otherwise indicated, the exchange rate used in this Annual Report is indicated in Note 2.D Material Accounting Policies, section 1. Functional currency, transactions and balances in foreign currency.

Rounding Discrepancies

Certain monetary amounts, percentages and other figures included in this Annual Report have been subject to rounding. Accordingly, figures shown as totals in certain tables may not be the arithmetic aggregation of the figures that precede them, and figures expressed as percentages in the text may not total 100% or, as applicable, when aggregated may not be the arithmetic aggregation of the percentages that precede them.

Websites

We maintain a website at http://www.grupocibest.com/. In addition, certain of our subsidiaries referred to in this Annual Report maintain separate websites. For example, Bancolombia maintains a website at https://www.grupobancolombia.com/Bancoagrícola and Bam maintain websites at http://www.bancoagricola.com/ and https://www.bam.com.gt/, respectively. Information included on or accessible through our website or the website of any of the subsidiaries is not incorporated into this Annual Report or the filing. All references in this Annual Report to these and other websites are inactive textual references to these URLs, or 'uniform resource locators', and are for reference only.

D.Risk Factors

Investors should consider the following risks and uncertainties along with the other factors presented in this Annual Report when evaluating the report's forward-looking statements, any document incorporated by reference, our future public filings or press releases, or future oral statements made by us, our officers or other people acting on our behalf.

If any of the following risks occur, our business, operating results and financial condition, as well as our ability to raise capital and access funding, could be materially and adversely affected, and, we could suffer possible reputational damage. These risk factors should not be considered a complete list, and the headings below do not indicate that a given risk applies only to the heading under which it is located.

Summary of Risk Factors

Risk factors relating to Colombia and other countries where we operate

•Changes in economic and political conditions in the countries where we operate, may adversely affect our financial condition and operating results.

•The countries where we operate are vulnerable to external effects, such as economic difficulties experienced by major regional trading partners or general contagion from economic or geopolitical shocks, which could have a material adverse effect on economic growth in these countries and their ability to service their public debt.

•Colombia and El Salvador have experienced several periods of violence and instability that could affect those economies and our business.

•Any additional taxes resulting from changes to tax regulations or the interpretations of tax regulations in the countries where we operate could adversely affect our results.

•Allegations of corruption against the governments, politicians and the private sector in the countries where we operate could create economic and political uncertainty and could expose us to additional credit risk.

Risk factors relating to our subsidiaries' business and the banking industry

•We are subject to credit risk, and estimating our exposure involves economic projections and financial estimates and availability, quality and timeliness of information may affect our exposure to credit risk.

•We are subject to risks from concentration in our loan portfolio. Problems with one or more of our largest borrowers may adversely affect our financial condition and operating results.

•The value of our loan collateral may be insufficient to cover the outstanding principal and interest. In addition, we may be unable to realize the full value of the collateral in the event of default.

•Downgrades in our or our subsidiaries' credit ratings would increase our cost of borrowing funds and make it more difficult for us or our subsidiaries to raise new funds, attract deposits or renew maturing debt.

•Changes in banking regulations in Colombia and in other jurisdictions where we operate could adversely affect our results.

•Our operating results are sensitive to fluctuations in interest rates.

•We are subject to market risk and the income from our proprietary trading activities is highly volatile.

•We have significant exposure to sovereign risk, especially in Colombia, the United States, El Salvador, Guatemala and Panama. Our results could be adversely affected by decreases in the value of our sovereign debt instruments.

•We are subject to credit, market, liquidity and operational risks associated with other banking businesses, including securities investments and derivatives transactions.

•We are subject to regulatory inspections, examinations, inquiries and audits in Colombia and in other countries where we operate. Any sanctions, fines and other penalties resulting from such inspections, examinations, inquiries or audits could materially and adversely affect our business, financial condition, operating results and reputation.

•We are subject to the U.S. Foreign Account Tax Compliance Act of 2010 and the OECD’s Automatic Exchange of Information - Common Reporting Standard (CRS).

•The tax haven regulations in the countries where we operate could adversely affect our business and financial results.

•Our financial results may be negatively affected by changes to accounting standards.

•We face risks relating to regulatory compliance in general and, in particular, with respect to laws relating to anticompetitive practices, consumer protection and protection of personal data.

•Future restrictions on interest rates or banking fees could negatively affect our profitability.

•Our results could be adversely affected by high levels of inflation.

•Our activities may be interrupted or affected by external factors, such as climate change and its effect on weather and natural disasters.

•We are exposed to environmental, social, governance and sustainability risks that could affect our financial condition and operating results.

•Our ability to attract and retain specialized talent, and the lack of professional training in the areas where we operate, could affect our business objectives, operating results and financial condition.

•We may be exposed to increased costs and liabilities in the event of the failure of our service providers to perform their obligations under key services contracts.

•Our businesses rely heavily on data collection, processing and storage systems, the failure of which could materially and adversely affect the effectiveness of our risk management, reputation and internal control system as well as our financial condition and operating results.

•Risks relating to the use of quantitative models and information may adversely impact our business strategies and results.

•We are subject to a wide range of information security and cybersecurity incidents that can have a material adverse effect on our business.

•Acquisitions and strategic alliances may not perform as expected or may disrupt our operations and adversely affect our profitability.

•We are subject to increasing competition in the rapidly evolving financial services industry, and may face challenges in the adoption of emerging technologies, such as artificial intelligence, which could result in competitive disadvantage and may adversely affect our operating results.

•We are subject to operational risks and losses.

•Our financial results may be negatively affected by changes to assumptions supporting the value of our goodwill.

•Digital misinformation could adversely affect our reputation as well as our operating and financial results.

•Our policies and procedures may not be able to detect money laundering, terrorism financing, corruption or other illegal or improper activities fully or on a timely basis.

Risk factors relating to our financial holding company structure

•We may not succeed in implementing our strategy to take advantage of, or we may fail to realize the anticipated benefits of, our financial holding company structure.

•As a holding company, Grupo Cibest depends on limited forms of funding to fund its operations.

Risk factors relating to Grupo Cibest’s Preferred Shares and ADSs

•Preemptive rights may not be available to holders of ADRs evidencing ADSs.

•Exchange rate fluctuations may adversely affect the Colombian economy, the market price of Grupo Cibest’s ADSs, and the dividends payable to holders of Grupo Cibest’s ADSs.

•Grupo Cibest’s Preferred Shares have limited voting rights.

•Holders of Grupo Cibest’s ADSs may encounter difficulties in the exercise of dividend and voting rights.

•Relative illiquidity of the Colombian securities markets may impair the ability of an ADS holder to sell Preferred Shares.

•Changes in Colombia’s tax regime may affect the tax treatment of ADSs.

Risk factors relating to Colombia and other countries where we operate

Changes in economic and political conditions in the countries where we operate, may adversely affect our financial condition and operating results.

Our financial condition, operating results and asset quality depend on the macroeconomic and political conditions in Colombia, El Salvador, Guatemala and Panama. An economic slowdown or contraction, inflation, shifts in economic policy, or changes in judicial interpretation of exchange controls could affect the overall business climate and negatively impact our financial performance and results. Other risk factors in these countries include currency depreciation, interest rate fluctuation, changes in taxation and banking laws and regulations, and other political or economic developments.

The governments of Colombia, El Salvador, Guatemala and Panama have historically exercised substantial influence on their economies and may, in the future, take steps that could affect our businesses and operating results, market conditions and the prices and rates of return on securities issued by local issuers (including Grupo Cibest's securities). Potential changes in laws, public policies and regulations could create instability in these countries and their respective markets. Future developments in government policies could negatively affect our business, financial and commercial condition, as well as the market value of Grupo Cibest's securities.

It is likely that these risks will become more significant in the coming years, due to election 'pendulum swings,' political polarization, increasing global tensions, international conflicts, dissatisfaction with government and growing social discontent. This combination of factors could lead to greater instability and political risks in the medium term than in the recent past.

Colombia

In Colombia, significant uncertainty remains with respect to the GDP outlook, reflecting, among other factors, the outcome of the March 2026 congressional elections and upcoming presidential elections in May 2026. Inflation could prove more persistent than anticipated due to a 23% increase in the minimum wage, indexation effects, supply-side shocks, or external pressures. In response to inflationary pressures and economic performance, the Central Bank increased its benchmark monetary policy rate by 100 basis points to 10.25% in January 2026, reversing its prior policy of maintaining lower interest rates. Further tightening of monetary policy, or the persistence of elevated interest rates, could adversely affect economic activity, borrowing costs and financial conditions. Additionally, measures taken by the Colombian government under the declaration of an economic emergency, along with reforms in sectors such as labor, healthcare, and public services, will continue to introduce uncertainty for the private sector, potentially adversely impacting business and consumer confidence.

Concerns over fiscal sustainability and potential disruptions in capital markets may further dampen investment dynamics, posing downside risks to GDP growth.

A sustained decline in private investment to an almost two-decade low poses a risk to Colombia's long-term economic growth, which in turn could undermine future fiscal revenue expansion and compromise fiscal consolidation efforts. In 2025, two credit rating agencies that rate Colombia's sovereign debt downgraded Colombia's long-term foreign currency rating to BB rating (non-investment grade) which highlights these challenges, emphasizing the persistent high cost to the government of its debt interest payments, elevated fiscal deficits, and Colombia's continued reliance on commodities.

As Colombia approaches the end of the current government term and the start of electoral campaigns, additional regulatory initiatives are expected. Some of these measures could conflict with Colombia's existing constitutional and legal framework, creating regulatory uncertainty and potential impacts on legal stability in certain sectors, including financial services. Even initiatives presented as temporary could result in adverse financial effects.

El Salvador

El Salvador faces multiple economic risks, including a slowdown in growth from 2.8% in 2025 to approximately 2.5% in 2026 due to weaker external demand, amid stable global growth and persistent international trade tariff tensions. Inflationary pressures could resurface, driven by adverse weather conditions and potential fuel price increases under the U.S. administration. The country’s high reliance on remittances (23% of GDP) makes El Salvador vulnerable to shifts in U.S. immigration policy, while the current account deficit, which fell from 1.9% in 2024 to 1.2% in 2025 but is projected to widen again to 1.5% of GDP in 2026, and limited access to capital markets pose external financing challenges.

El Salvador continues to face medium-term challenges with its public finances, and the fiscal outlook is uncertain. While government action and an agreement with the International Monetary Fund (IMF) provided some fiscal relief and reduced the risks of sovereign default, public spending remains high, and the fiscal deficit stood at around 3.0% of GDP in 2025. This fiscal uncertainty has reduced El Salvador’s access to capital markets, making it dependent on capital flows from multilateral organizations and other countries. Adding to this pressure is the country’s B‑ credit rating, which reflects persistent concerns over fiscal and debt sustainability. Achieving long-term fiscal sustainability is El Salvador's biggest economic challenge, and while the government has made efforts to reduce debt, the fiscal deficit is expected to remain high in the medium term.

Guatemala

Guatemala faces structural risks due to its high dependence on remittances, more than 90% of which come from the United States. While the economy’s recent performance (3.8% GDP growth in 2025) has been moderately better than expected, driven by strong remittance flows, changes in U.S. migration policies could negatively impact remittances going forward. A weakening of the U.S. labor market or a potential slowdown of the U.S. economy could also negatively affect Guatemala’s GDP for 2026, as could the effects of protectionist measures by the U.S. on Guatemalan exports and foreign investment.

Panama

Tensions between China and the United States, as well as conflicts in Ukraine and in the Middle East, including the recent military action in Iran by the United States and Israel, may adversely impact global trade and flow through the Panama Canal in the medium term, posing a significant risk to Panama’s economy. This risk is heightened by the stance of the U.S. administration on China, which could lead to trade restrictions or geopolitical tensions that further reduce transit through the canal.

In the short term, uncertainty persists over the closure of the Cobre Panamá copper mine, which halted copper exports in November 2023, leading to an increase in the trade deficit that was only partially offset by growth in service exports. In addition, despite President José Raúl Mulino’s commitment to fiscal consolidation, progress may be constrained by weak tax revenues and structural rigidity in public spending.

The countries where we operate are vulnerable to external effects, such as economic difficulties experienced by major regional trading partners or general contagion from economic or geopolitical shocks, which could have a material adverse effect on economic growth in these countries and their ability to service their public debt.

A significant decline in economic growth or a sustained economic downturn in the regional trading partners of Colombia, El Salvador, Guatemala or Panama could have a material adverse impact on foreign trade, remittance flows, and foreign direct investment in the four countries and a decrease in their economic growth. Similarly, lower growth in countries with close economic ties, such as the European Union, the United States, China and other Latin American countries in the case

of Colombia, and the United States and the European Union in the case of Guatemala, El Salvador and Panama, could also have a material adverse impact.

Additionally, any deterioration in the economic and political conditions of neighboring countries could adversely affect the economies of Colombia, El Salvador, Guatemala and Panama, and cause instability and disrupt their commercial or diplomatic relationships. Any future tensions could lead to political and economic uncertainty, instability, market volatility, low confidence levels and heightened risk aversion among investors and market participants, which could adversely affect economic activity in any of those countries.

In a global context, on April 2, 2025, U.S. President Donald Trump announced new tariffs on imports into the United States. These tariffs include a 'baseline' tariff of 10% on imports from many countries, including Colombia. More recently, in February 2026, the U.S. Supreme Court held that certain tariffs imposed under the International Emergency Economic Powers Act (IEEPA) were beyond the President's statutory authority, vacating significant components of the tariff regime and reinforcing that tariff-setting power resides with Congress. While the decision has limited the legal basis for the broad emergency tariffs originally imposed, legal and policy uncertainty remains as the U.S. administration has signaled its intentions to pursue alternative statutory authorities to re-impose or raise global tariffs to 15% and may enact across-the-board levies under other provisions of U.S. trade law.

The imposition of these tariffs may have significant adverse effects on global trade, which could have a material adverse effect on Colombia's economy, trade balance, and key industries, including its banking industry. Because a significant portion of Colombia's exports are directed to the United States, it is vulnerable to changes in U.S. trade policy. Higher tariffs could reduce demand for Colombia's goods in the United States, disrupt supply chains, and lead to job losses in affected industries. Additionally, retaliatory measures by other nations could exacerbate economic uncertainty, impacting investor confidence and foreign direct investment, and countries facing even higher tariff rates could decide to sell excess products into the Colombian market, adversely affecting Colombian producers. The tariffs may also contribute to global trade tensions and volatility in currency markets, which could put pressure on exchange rates and inflation.

See "Risk factors relating to Colombia and other countries where we operate - Changes in economic and political conditions in the countries where we operate, may adversely affect our financial condition and operating results."

Recent global geopolitical fragmentation has led to decreased capital flows to emerging economies and heightened volatility in commodity prices, particularly oil. Inflation trends have already been affected, especially in El Salvador, Guatemala and Panama, and this effect may persist. In addition, the escalation of geopolitical tensions, including the conflict between Russia and Ukraine and the frictions in the Middle East, including the recent military action in Iran by the U.S. and Israel, and growing disputes between China and the U.S. could further disrupt global trade, continue to generate uncertainty and volatility in international markets. In addition, Panama Ports Company has started international arbitration proceedings against Panama after Panama’s Supreme Court annulled its licenses to operate two Panama Canal ports. These developments may lead to restrictions on commodity supplies, driving up energy and food prices. Tighter monetary policies and financial conditions could weigh on global economic growth. Higher interest rates may also trigger capital outflows, leading to depreciation of currencies such as the Colombian peso and the Guatemalan quetzal, increased domestic interest rates and renewed inflationary pressures.

In addition, ongoing political and economic instability in Venezuela continues to pose additional regional risks, potentially amplifying volatility and affecting economic conditions across neighboring markets. On January 3, 2026, the United States conducted a military intervention in Venezuela, and captured Nicolas Maduro. While the impact of these developments in Venezuela remains to be seen as of the date of this Annual Report, their effects could result in additional uncertainty, which could have a negative impact on Colombia's economy, including fluctuations in oil prices, potential regime transition volatility, civil unrest, and a further breakdown of the rule of law. A worsening of this crisis could trigger unprecedented migration flows into Colombia, straining local public infrastructure and labor markets, while simultaneously escalating cross-border security threats from non-state armed groups. These factors may result in supply chain disruptions, increased operational costs, and heightened currency volatility, all of which could materially and adversely affect our financial condition and operating results.

The expectation of global economic slowdown and the possibility of persistently high interest rates could create periods of volatility and risk aversion. This environment would exacerbate financial stress, particularly in emerging economies, which remain highly sensitive to capital flows. It is reasonable to expect that public debt service payments will remain historically high. The combination of low economic growth and high interest rates represents a short-term risk, particularly in Colombia and El Salvador, where the main challenge will be managing public finances and generating enough tax revenue to meet spending goals in 2026 and beyond.

Events in markets where we do not operate may also affect us, for example by causing international investors to have an increased risk perception of the entire region or class of investment, which could negatively affect market prices and liquidity of securities issued or held by Grupo Cibest.

These factors could have a material adverse impact on economic growth and fiscal stability in the countries where we operate, and could negatively affect our business, financial and commercial condition, as well as the market value of Grupo Cibest's securities.

Colombia and El Salvador have experienced several periods of violence and instability that could affect those economies and our business.

Colombia has experienced periods of criminal violence over the past five decades, primarily due to the activities of guerilla groups and drug cartels. In recent years, the security situation has deteriorated, with rising violence linked to criminal organizations and armed groups. The government has lost control over certain territories, and coca cultivation areas have expanded significantly, while efforts at eradication have decreased. The government has implemented a peace treaty with the Revolutionary Armed Forces of Colombia (FARC), while negotiations with several other rebel groups are stalled. If there is an escalation of violence or drug-related crime, it could lead to a downgrade of sovereign ratings, higher funding costs, lower foreign investment and economic slowdown.

In El Salvador, rising violence led the Legislative Assembly to adopt exceptional measures on March 27, 2022, granting certain powers to the Executive Branch and suspending four constitutional guarantees. The suspension of these constitutional guarantees has been extended 48 times, with the most recent extension lasting from February 1, 2025, to March 31, 2026.

Any additional taxes resulting from changes to tax regulations or the interpretations of tax regulations in the countries where we operate could adversely affect our results.

Uncertainty related to tax legislation represents a constant risk for us. Changes in legislation, regulation, and developments resulting from judicial decisions, could affect our tax burden by increasing tax rates and fees, creating new taxes, limiting deductions and exemptions, and eliminating incentives and untaxed income. We do not take aggressive positions on tax law interpretation. However, the national or local tax authorities could apply tax law in a way that we do not expect, which could result in tax audits, litigation and associated costs, and could negatively affect our results.

Allegations of corruption against the governments, politicians and the private sector in the countries where we operate could create economic and political uncertainty and could expose us to additional credit risk.

Allegations of corruption against the governments, politicians and the private sector in the countries where we operate could create economic and political uncertainty. For example, findings, convictions or allegations of illicit conduct, including by government officials, could have adverse effects on the political and economic stability of the countries where we operate.

Investigations, public allegations, and restrictive measures adopted by foreign authorities, including agencies such as the Office of Foreign Assets Control (OFAC) of the United States Department of the Treasury, against high-ranking government officials, their relatives, or close associates may increase political and legal volatility in the countries where we operate. In October 2025, the President of Colombia, Gustavo Francisco Petro Urrego was included in the Specially Designated Nationals List (SDN List) under Executive Order 14059, together with members of his immediate family and a close associate. These measures, which result in the blocking of assets under U.S. jurisdictions and the prohibition of transactions with designated persons or entities, may negatively impact the institutional stability of Colombia, perception of country risk and our business by depressing business volumes or reducing our ability to recover amounts we have lent to persons or projects involved in illicit or allegedly illicit conduct.

Risk factors relating to our subsidiaries' business and the banking industry

We are subject to credit risk, and estimating our exposure involves economic projections and financial estimates and availability, quality and timeliness of information may affect our exposure to credit risk.

Several of our products expose us to credit risk. These products include loans, financial leases, guarantees, financial derivatives and lending commitments. We establish credit risk reserves and determine expected credit loss based on established methodologies that incorporate economic projections, available borrower information, and estimates of borrower repayment capacity. Although our risk rating systems are designed to appropriately reflect credit exposure and are supported by internal controls and governance mechanisms intended to ensure data quality, model performance and process integrity, these methodologies may be subject to variations as a result of availability, quality, and/or timeliness of the information used, which may, in turn, influence decision-making. In addition, third-party infrastructure limitations may affect the timeliness or accuracy of our identification of changes to the risk profile of certain clients, which may increase our exposure to credit risk.

If we are unable to effectively control the level of non-performing or poor credit quality loans in the future, or if our loan loss reserves are insufficient to cover future loan losses, our financial condition and results may be materially and adversely affected. The amount of our non-performing loans could increase in the future as a result of factors beyond our control, such as changes in the payment capacity of our borrowers, increases in inflation or interest rates, the impact of macroeconomic trends and political events, climate change or events affecting specific industries, affecting Colombia and other jurisdictions in which we operate. Any of these developments could have a negative effect on the quality of our loan portfolio, requiring us to increase provisions for loan losses resulting in reduced profits or in losses.

We are subject to risks from concentration in our loan portfolio. Problems with one or more of our largest borrowers may adversely affect our financial condition and operating results.

As of December 31, 2025, the aggregate outstanding principal amount of Grupo Cibest’s 20 largest economic groups, on a consolidated basis, represented 119.4% of Grupo Cibest’s Tier 1 Capital and 18.0% of the total loan portfolio. The largest individual exposure accounted for 2.1% of our loan portfolio. Problems with one or more of our largest borrowers could materially and adversely affect our operating results and financial position.

The value of our loan collateral may be insufficient to cover the outstanding principal and interest. In addition, we may be unable to realize the full value of the collateral in the event of default.

Our loan collateral primarily includes real estate, owned assets used for financial leasing transactions and other assets that are located primarily in Colombia, El Salvador, Guatemala and Panama, the value of which may significantly fluctuate or decline due to factors beyond our control. These can include market factors, environmental risks, macroeconomic factors and political events affecting the local economy. In addition, we may face difficulties in enforcing our rights as a secured creditor. Delays, procedural problems and local protectionism may make foreclosures and enforcement of judgments difficult. Any decline in the value of the collateral securing our loans may result in a reduction in the recovery from collateral realization and may have an adverse impact on our operating results and financial condition.

Downgrades in our or our subsidiaries' credit ratings would increase our cost of borrowing funds and make it more difficult for us or our subsidiaries to raise new funds, attract deposits or renew maturing debt.

Our and our subsidiaries' credit ratings are an important component of our liquidity profile. Our ability to successfully compete in the banking industry depends on our and our subsidiaries' credit ratings. A downgrade in our, or in any of our subsidiaries' credit ratings would increase the cost of raising funds, potentially result in additional collateral requirements and reduce demand for our securities among institutional investors. Our ability to renew maturing debt could become restricted and the terms for such renewal could become more expensive. Our lenders and counterparties in derivative transactions are also sensitive to the risk of a credit rating downgrade. A downgrade in our or our subsidiaries' credit ratings could negatively affect market perceptions of our financial strength and reduce our ability to attract deposits. This, in turn, could weaken our competitive position in attracting deposits and originating loans.

On December 16, 2025, Fitch downgraded Colombia's long-term foreign currency rating from BB+ to BB and revised the outlook from negative to stable. Similarly, in June 2025, Standard & Poor's downgraded Colombia's long‑term foreign currency rating from BB+ to BB and maintained a negative outlook, while Moody's downgraded the sovereign rating from Baa2 to Baa3 and changed the outlook to stable. Both agencies pointed to persistent fiscal deterioration, higher debt and interest burdens, and a challenging policy environment as key drivers.

In line with the sovereign ratings, the agencies revised Colombian banks' credit ratings in 2025. Fitch affirmed the BB+ ratings of Bancolombia and Grupo Cibest throughout the year but reduced their outlooks to negative in March, and returned them to stable in December, leaving both entities rated above the sovereign's BB level. S&P lowered the ratings of both Bancolombia and Grupo Cibest following its sovereign downgrade, in line with its practice of not rating Colombian financial institutions above the foreign currency sovereign. Moody's downgraded Bancolombia's long-term deposit and counterparty ratings in June 2025 in response to the sovereign downgrade, while it left Grupo Cibest's ratings unchanged.

Changes in banking regulations in Colombia and in other jurisdictions where we operate could adversely affect our results.

Banking laws and regulations, or their official interpretation in Colombia and other jurisdictions in which we operate, have a material effect on our business and operations. Banking laws and regulations may change frequently, and changes may be adopted, enforced or interpreted in a manner that may have an adverse effect on our business.

In Colombia, Decree 1474 of December 2025, issued under the economic emergency declared by Decree 1390 of 2025, introduced an additional 15% income tax surcharge applicable to financial institutions, increasing the aggregate corporate

income tax burden to 50% for fiscal year 2026. The decree also established new taxes applicable to the oil and gas and mining sectors, increased wealth tax rates, and raised Value‑Added Tax (VAT) rates for certain goods, including alcoholic beverages and tobacco products. However, the economic emergency decree (Decree 1390 of 2025), which provided the Government with temporary legislative powers to enact these measures, has been provisionally suspended by the Colombian Constitutional Court as part of the automatic judicial review applicable to emergency legislation. As a result, Decree 1474 of 2025 is currently not producing legal effects, pending a final decision by the Constitutional Court on the constitutionality of the emergency declaration and the related implementing measures.

Decree 150 of February 2026, which is also subject to judicial review by the Colombian Constitutional Court, declared a new state of economic, social and ecological emergency in certain regions of the country and empowered the Government to adopt extraordinary and temporary measures to address the impacts of an exceptional rainy season affecting eight departments. The emergency framework authorizes the issuance of legislative decrees that include, among others, adjustments to wealth tax rates, the implementation of credit relief and guarantee programs, modifications to the operation of mandatory investment schemes, the reinstatement of certain VAT measures previously introduced under Decree 1474 of 2025, and the establishment of new credit‑related mechanisms aimed at facilitating credit origination and providing financial relief in the affected regions.

Additionally, while the Constitutional Court has not yet completed the judicial review of the pension reform approved in 2024 in Colombia, if this law is enacted, it would redirect a substantial share of mandatory contributions from private pension funds to the public pillar administered by Colpensiones. As private pension funds are the largest institutional investors in Colombia, this reallocation would significantly reduce the assets under their management and, consequently, their participation in the local capital markets, which may result in risks to financial stability and funding sources for the capital markets where we participate.

The Ministry of Finance submitted for public comment a decree on the mandatory open finance system in Colombia. This decree will establish an open data framework in accordance with Law 2294 of 2023 (National Development Plan) and may result in regulatory arbitrage against banking institutions, which would be required to share their data with other financial institutions. As a result, banks would be placed at a competitive disadvantage, as they would not be able to access or benefit from the data of other financial institutions during the initial phase in which only their own data must be disclosed.

Resolution 10 of 2025 issued by the National Commission for Agricultural Credit (CNCA) in Colombia, introduces new specific requirements for the substitutive agricultural investments that banks may use in place of the mandatory investments. These changes could increase the proportion of the agricultural credit portfolio allocated to mandatory investments, which generally yield lower returns.

In 2025, the government launched a public initiative to modify how financial services are provided through local banking correspondents, a channel that has supported financial inclusion and access to products and services in Colombia for over two decades, where Bancolombia has maintained nationwide leadership. This initiative could lead to a new regulatory framework that may require a reassessment of the operating and financial model used by Bancolombia.

Our operating results are sensitive to fluctuations in interest rates.

We hold a substantial portfolio, including loans, deposits, securities, bonds, long-term debt and short-term borrowings and derivatives such as swaps that have both fixed and floating interest rates. Therefore, changes in interest rates could adversely affect our net interest margins, the value of the debt instruments, as well as the profitability of the funds under our management, leading to client outflows and a reduction in our fee income, which could negatively impact our operating results; additionally it could reduce the market value of our debt instruments, leading to smaller gains or larger losses on these investments (a 100 basis point increase in interest rates could reduce the market value of the debt instruments by approximately 1.3%). Sustained high interest rates have historically discouraged customers from borrowing and have resulted in increased delinquencies in outstanding loans and deterioration in the quality of assets.

On the other hand, cuts in interest rates may cause margin compression and lower net interest income, as we usually hold more assets than liabilities at variable rates. Typically, in a declining interest rate environment, prepayment activity tends to increase, reducing the weighted average maturity of our interest-earning assets and adversely affecting our operating results.

Prepayment risk also has a significant adverse impact on our earnings from credit card and collateralized mortgage obligations, as prepayments could shorten the weighted average life of these assets, which may result in funding mismatches or in reinvestment of the prepayment proceeds at lower yields. In addition, these risks could materially affect our own portfolio as well as those managed by us on behalf of third parties. Consequently, any withdrawals of third-party assets could negatively impact our asset management revenues and related income streams.

We are subject to market risk and the income from our proprietary trading activities is highly volatile.

We are directly and indirectly affected by changes in market conditions. Market risk, or the risk of losses in positions arising from movements in market prices, is inherent in the products and instruments associated with our operations, including securities, bonds, proprietary trading in assets and liabilities, and derivatives, among others. Changes in market conditions that may affect our financial condition and operating results include fluctuations in interest rates, currency exchange rates, securities prices, and changes in the implied volatility of interest rates and foreign currency exchange rates, among others.

We derive a portion of our profits from our proprietary trading activities. Income from this activity is highly volatile and depends on numerous factors beyond our control, such as the general market environment, overall market trading activity, interest rate levels, fluctuations in exchange rates, oil prices and general market volatility. A significant decline in our trading income, or the occurrence of a trading loss, could adversely affect our operating results and financial position. Therefore, we continuously monitor the level of risk and the sensitivity of portfolio value to possible changes in interest rates. As of December 2025, the modified duration of our sovereign debt proprietary trading portfolio, subject to change in interest rate, was 1.3, reflecting a moderate level of sensitivity in the value of the bonds to changes in interest rates.

We have significant exposure to sovereign risk, especially in Colombia, the United States, El Salvador, Guatemala and Panama. Our results could be adversely affected by decreases in the value of our sovereign debt instruments.

Our debt portfolio is primarily composed of sovereign debt securities. Therefore, our results are exposed to credit, market, and liquidity risk associated with sovereign debt and, in particular, risk associated with securities issued or guaranteed by the Colombian Government. As of December 31, 2025, our total debt instruments represented 10.28% of our total assets, and the securities issued by the governments of Colombia, the United States, Panama, Guatemala, and El Salvador represented 39.56%, 18.39%, 5.89%, 5.46%, and 4.19% respectively, of our total debt instruments. A significant decline in the value of these securities could affect our debt instruments portfolio and, consequently, our operating results and financial position.

In addition, during the past year, sovereign risk associated with securities issued or guaranteed by the government of Colombia has increased. The 5-year credit default swap (CDS), credit derivative contracts that allow investors to hedge against credit risk on a company, a country or another entity, showed an increase during 2025 due to political uncertainty as well as fiscal challenges in Colombia.

We are subject to credit, market, liquidity and operational risks associated with other banking businesses, including securities investments and derivatives transactions.

We are exposed to credit risk arising from other banking businesses, including investing in securities, entering into derivative contracts under which counterparties have obligations to make payments to us, and executing securities or currency trades from our proprietary trading desk that fail to settle at the required time due to non-delivery by the counterparty or system failures by clearing agents, exchanges, clearing houses, or other financial intermediaries. A significant increase in exposure to any of these risks, or a significant decline in the credit quality or the insolvency of any of the counterparties, could materially and adversely affect our operating results and financial position.

We engage in derivative transactions both for hedging purposes on our own account and on behalf of our customers. These transactions expose us to a variety of risks, including market risk and liquidity risk (due to the difficulty in closing out a trade prior to maturity if bid-ask spreads are too large, representing a significant cost). They also expose us to operational risk, including basis risk (the risk of loss associated with variations in the spread between the asset yield and the funding and/or hedge cost) and credit or default risk (the risk of insolvency or other inability of a counterparty to meet its obligations). Furthermore, the market practice and documentation for derivative transactions is less developed in the jurisdictions where we operate compared to other more economically developed countries, and the court systems in these jurisdictions have limited experience in dealing with issues related to derivative transactions. As a result, there are increased operating and structural risks associated with derivatives transactions in these jurisdictions.

In addition, the execution and performance of derivatives transactions depend on our ability to develop adequate control and administrative systems, and to hire and retain qualified personnel. Moreover, our ability to adequately monitor, analyze and report these derivative transactions depends, to a great extent, on our information technology systems. These factors may further increase the risks associated with these transactions and could materially and adversely affect our operating results and financial position.

We are subject to regulatory inspections, examinations, inquiries and audits in Colombia and in other countries where we operate. Any sanctions, fines and other penalties resulting from such inspections, examinations, inquiries or audits could materially and adversely affect our business, financial condition, operating results and reputation.

We are subject to comprehensive regulation and supervision by the financial authorities of Colombia, El Salvador, Guatemala, Panama and other jurisdictions where we do business. These authorities have broad powers to adopt regulations or impose other requirements that could affect or restrict our capitalization, organization and operations. These include the imposition of anti-money laundering measures and the authority to regulate the terms and conditions under which we can extend credit. In the event of noncompliance with applicable regulations, we could face fines, sanctions or the revocation of licenses or permits to operate our business.

In Colombia, for instance, if Bancolombia encounters significant financial problems or becomes insolvent or in danger of becoming insolvent, banking authorities would have the power to take over Bancolombia's management and operations. Any sanctions, fines or other penalties resulting from noncompliance with regulations in Colombia, El Salvador, Guatemala, Panama and other jurisdictions where we operate could materially and adversely affect our business, financial condition, operating results and reputation.

We are subject to the U.S. Foreign Account Tax Compliance Act of 2010 and the OECD’s Automatic Exchange of Information - Common Reporting Standard (CRS).

Bancolombia, Bam, Bancoagrícola and Banistmo are considered foreign financial institutions (FFIs) under the Foreign Account Tax Compliance Act of 2010 (FATCA) (See Item 4. Information on the Company – B. Business Overview – B.8. Supervision and Regulation – International regulations applicable). Additionally, Bancolombia and Banistmo are subject to reporting obligations derived from the Common Reporting Standard (CRS) Multilateral Competent Authority Agreement (MCAA) developed by the OECD.

However, if these entities fail to comply with these requirements, they may be subject to withholding under FATCA or other penalties that tax authorities may impose according to their domestic regulations. Such withholding or penalties could adversely affect our operating results and financial condition. In addition, compliance with the provisions of the intergovernmental agreements (IGA), FFI agreements entered into with the IRS, the CRS-MCAA, domestic laws or any other regulations enforced in the relevant jurisdictions may increase our compliance costs.

The tax haven regulations in the countries where we operate could adversely affect our business and financial results.

As a result of the tax haven regulation adopted in Colombia and El Salvador, our clients who are residents of territories designated as tax havens may face:

(i) Higher withholding tax rates on interest and dividends, mainly derived from investments in the securities market.

(ii) Requests by the tax authorities for the disclosure of additional information for transactions with related companies.

(iii) Increased probability of tax audits.

Furthermore, Bancolombia, Bancolombia's Financial Subsidiaries and Banagrícola may face non-deductibility of payments made to such residents or entities, unless the required tax amount has been withheld.

Any of these conditions could negatively affect our operations by increasing costs, reducing our client returns and increasing administrative burdens, impacting our profitability and relationships with clients operating in these territories.

Our financial results may be negatively affected by changes to accounting standards.

Our financial statements are prepared in accordance with the IFRS, issued by the IASB, as well as the interpretations issued by the IFRS-IC. Changes to the IFRS or its interpretations may cause our future reported results and financial position to differ from current expectations. Such changes may also affect our regulatory capital and financial ratios. Our management monitors potential accounting changes and, when possible, determines their potential impact, disclosing significant future changes in our consolidated financial statements that are expected to result from those changes. For further information

about developments in financial accounting and reporting standards, see Note 2.F. Material accounting policies. – Recently issued accounting pronouncements.

We face risks relating to regulatory compliance in general and, in particular, with respect to laws relating to anticompetitive practices, consumer protection and protection of personal data.

We are subject to compliance with laws and regulations with respect to anticompetitive practices, merger control, unfair competition provisions, personal data protection and cybersecurity requirements. While we have a unit responsible for overseeing the implementation of new regulations using a risk-based approach and have developed a comprehensive data protection program to attempt to ensure compliance with personal data law, noncompliance with these laws and regulations may result in significant sanctions. We may not be able to prevent all risks associated with regulatory compliance or detect all instances of noncompliance, which could result in substantial fines and penalties, or operational restrictions, adversely affecting our operating results and damaging our reputation.

Additionally, due to the nature of their financial activities, Bancolombia’s Financial Subsidiaries, Bancoagrícola, Bam and Banistmo, remain exposed to consumer protection risks under local regulatory frameworks, and noncompliance with these regulations may result in significant sanctions for those entities.

Future restrictions on interest rates or banking fees could negatively affect our profitability.

In the past, regulators in the jurisdictions where we operate have considered legislative and regulatory initiatives regarding limits on interest rates and banking fees. Although most such initiatives have not been adopted, there may be renewed attempts to impose or strengthen ongoing restrictions on interest rates or banking fees in the future. If we are prohibited or otherwise limited (including by limits on pricing) from continuing to charge our clients for certain products or services, including specified types of transactions, or from imposing charges for products or services that might be introduced in the future, our operating results and financial condition could be adversely affected.

Our results could be adversely affected by high levels of inflation.

High inflation increases the cost of funding and credit risk, while it slows the pace of loan origination and reduces the market value of our debt instruments. Inflation that is higher than the nominal interest rate can discourage savings and increase uncertainty and risk in the loan and stock markets. In Colombia, annual inflation began to decline gradually in the second quarter of 2023, dropping from 9.3% in 2023 to 5.2% in 2024, and further to 5.1% by the end of 2025. There are risks it could rebound toward levels closer to 6.0% in 2026. This level remains above the medium-term target of 3% set by the Central Bank.

There are persistent risks indicating that inflation may accelerate further, driven by the 23% minimum wage increase and upward pressures on certain regulated goods and services, such as tolls. It is reasonable to expect that credit portfolio demand will remain moderate, partly due to a potential increase in interest rates by the Central Bank. In contrast, the inflationary challenge that began in 2022 has been largely addressed in El Salvador, Guatemala and Panama, and inflation in these countries has remained stable compared to 2024. CPI inflation went from 0.3% at the end of 2024 to 0.91% at the end of 2025 in El Salvador, while remaining stable at 1.7% in Guatemala and at -0.2% in Panama at the end of 2025.

Therefore, 2026 could be a challenging year for financial intermediation operations, due to inflationary risk that will continue to be more pronounced in Colombia compared to other major economies in Latin America, the United States and the European Union.

Our activities may be interrupted or affected by external factors, such as climate change and its effect on weather and natural disasters.

In the past decade, the “El Niño” and “La Niña” have intensified, increasing the risk of extreme climate events, such as floods, landslides, wildfires, droughts, increased temperature and rising sea and river levels, among others, as well as related water scarcity, which may affect our infrastructure and business operations.

The “El Niño” phenomenon is characterized by: (i) the lack of rainfall, which may drastically decrease surface waterbodies flows, affecting both freshwater use and wastewater discharges because of the reduction on dilution potential of receiving waterbodies, (ii) increased temperatures, which causes heat waves and could have a direct impact on the health of our workers and cause an increase in epidemics and diseases, and (iii) potential negative impact on energy supply due to the decrease in the level of the rivers that feed the hydroelectric generation system of the country. In addition to the “El Niño” climate phenomenon, some basins in Colombia may be affected by seasonal variability in some periods of the year (normally January to March - June to July), which could reduce water flows, affecting freshwater withdrawals and surface

discharges, as mentioned previously. Furthermore, the “La Niña” climate phenomenon is characterized by increased rainfall, which can generate frequent landslides and flooding, which may cause infrastructure loses.

The physical risks of climate change for some of our clients are compounded by their dependence on natural resources, exposure to biodiversity loss, impacts on critical ecosystems, and deforestation. Serious climate events or natural or manmade disasters could result in unanticipated problems that could have a material adverse effect on our and our client’s abilities to conduct business in the affected regions, particularly if those problems affect its computer-based data processing, transmission, storage and retrieval systems and destroy data.

In addition, if a significant number of our and our client’s employees and managers become unavailable due to such an event or disaster, our and our client’s ability to effectively conduct business could be severely compromised. Our inability to manage the risks related to such events or disasters could negatively impact the value of our and our clients’ assets, including our buildings, branches and ATMs. With respect to our clients, these risks could negatively affect their financial health, operational results, cash flows, and ultimately, their ability to meet payment obligations.

We are exposed to environmental, social, governance and sustainability risks that could affect our financial condition and operating results.

Companies in the financial sector are facing significant scrutiny from a wide range of stakeholders on social, environmental, governance and sustainability issues, including climate change and diversity. This includes the role of financial institutions in providing financing to sustainability projects, in supporting sustainable business practices, and in assessing and managing nonfinancial and emerging risks including those associated with environmental and social factors. Moreover, our customers, investors, regulators, employees and other stakeholders have differing requirements, expectations, demands and perspectives on these topics, which are continuing to evolve and diverge. We may not be able to meet the differing requirements, expectations and demands of all of our stakeholders, which could harm our reputation, subject us to legal and operational risks, impact customer demand, and adversely affect our financial condition and operating results.

Additionally, the regulatory environment in the jurisdictions where we operate has become more complex due to the adoption of new laws, regulations and policies that often diverge from, or conflict with each other. These developments coupled with the accelerated pace of regulatory change, increases the risks, complexity and cost of compliance. Even though we strive to monitor and update policies, processes, and reporting systems to comply with the evolving requirements and to mitigate regulatory and reputational risks, we note that our failure to comply with any applicable requirement or with regulatory expectations in any jurisdiction in which we operate, even if based on good-faith interpretations, can result in sanctions, fines, liability, reputational damage, and significant operational costs.

For example, in Colombia, we are required to meet sustainability-related regulatory requirements, particularly those established in External Circular 031 of 2021 and External Circular 005 of 2024, issued by the SFC. External Circular 031 requires financial institutions to disclose climate-related financial risks and their potential impact, in line with the Sustainability Accounting Standards Board (SASB) and Task Force on Climate-Related Financial Disclosures (TCFD) frameworks, while Circular 005 focuses on the management and disclosure of environmental, social, governance and sustainability risks arising from exposure to investment portfolios managed by third parties, where we may have limited control over investment decisions but may still face financial, regulatory or reputational risks. Similarly, NPR-53 applies in El Salvador, Agreement 11-2022 in Panama, and Law 68-86 in Guatemala, each with specific obligations for ESG risk management. Conversely, in the U.S. and other jurisdictions, there has been an increase in regulatory scrutiny on corporate and diversity related initiatives, which has led and is likely to continue to lead to new laws, regulations and policies seeking to limit, discourage or prohibit such initiatives.

Our ability to attract and retain specialized talent, and the lack of professional training in the areas where we operate, could affect our business objectives, operating results and financial condition.

Our constantly evolving business model requires talent with creativity, innovation and flexibility to keep up with technological advances and the growing demand for new products and services. The skills of our employees, the competitiveness and talent of our team, and the management of our culture and work processes are essential for our long-term success.

Since our strategic objectives depend largely on our human capital, any shortfall in skills, whether due to the difficulty in attracting and retaining highly qualified professionals, the lack of professional training in the areas where we operate, or the loss of key employees, could translate into reduced efficiency and a limited capacity to adapt quickly to market changes.

In this regard, financial holding companies and institutions, including Grupo Cibest, face challenges identifying and retaining workers for positions that require highly developed and specialized knowledge.

We may be exposed to increased costs and liabilities in the event of the failure of our service providers to perform their obligations under key services contracts.

We enter into contracts with third parties who provide certain key services that are essential to the evolution of our business. These services include core banking services, online banking platforms, data and payment processing services, clearing and settlement services, software for processing credit and debit card transactions and technological infrastructure, among others. Our primary risk with service providers stems from potential operational disruptions, failures, or capacity limitations arising from our reliance on these external providers for critical components of our systems.

In October 2025, a third-party service provider experienced a disruption in a region where certain of Bancolombia’s services are hosted. The disruption resulted from a failure in the provider’s internal systems responsible for coordinating information across services and led to delays and connectivity issues. As a result, more than 100 of Bancolombia’s digital services were impacted, including payments, collections, and transfers. In the same month, Bancolombia also experienced a general interruption in the connectivity of one if its data centers caused by a software error in the equipment responsible for managing the data center’s network, which simultaneously affected certain of Bancolombia’s digital and physical services. In February 2026, Bancolombia experienced a service interruption during a planned migration of certain services from its principal data center to an alternate data center. Issues with the replication of information between the two data centers and a subsequent failure at the principal data center, related to an authorization system component operated by a third-party provider, resulted in the intermittent or complete unavailability of certain physical and digital banking services, including payment, transfer and digital banking platforms, for approximately two days. The disruption limited customers’ ability to carry out certain transactions and access banking services and resulted in a significant volume of customer complaints during the period of service interruption.

While we conduct due diligence before engaging service providers and monitor their business continuity plans, as well as their cybersecurity and data protection measures, we do not control their operations. If any of our key service providers fail to meet their contractual obligations or cause service disruptions (including failure to handle current or increased transaction volumes, inadequate service performance, or failure to comply with applicable laws and regulations), there can be no assurance that we will succeed in attracting and retaining the human resources necessary for the success of our businesses or in limiting cost increases from wages and other employee benefits, which could reduce the profitability of our businesses.

In addition, we may incur significant additional costs in securing substitute service providers. The unavailability of services provided by some technologies and other service providers could result in the interruption of services on certain channels through which our customers conduct transactions until a substitute provider is engaged, which could result in lost revenue, additional costs and, potentially, adverse regulatory consequences and reputational harm.

Our businesses rely heavily on data collection, processing and storage systems, the failure of which could materially and adversely affect the effectiveness of our risk management, reputation and internal control system as well as our financial condition and operating results.

All of our principal businesses are highly dependent on the ability to timely collect and process a large amount of financial and other information at our various digital and physical channels across numerous markets, at a time when transaction processes have become increasingly complex and volumes have increased. The proper functioning of financial control, accounting or other data collection and processing systems is critical to our businesses and to our ability to compete effectively.

While we conduct simulations to ensure business continuity and disaster recovery in the event of a system failure or cybersecurity attack, and have measures in place to control vulnerabilities, there can be no guarantee that these measures will successfully eliminate or substantially mitigate the risk associated with any failure of our data collection, processing or storage systems.

A partial or complete failure of any of these systems could materially and adversely affect our decision-making, risk management and internal control systems, the quality of our service, and our ability to respond to rapidly changing market conditions. A system disruption or slowdown could also cause information, including data related to customer requests and other client information, to be lost, compromised or delivered to clients with delays or errors. While Bancolombia, Fiduciaria Bancolombia and Valores Bancolombia have experienced third-party service disruptions, these disruptions have not compromise our data security.

Any failure of data collection, processing, storage or management systems could result in loss of business, additional costs and regulatory penalties (including fines and penalties by regulators) that could materially and adversely affect our business, financial condition, reputation and operating results.

Risks relating to the use of quantitative models and information may adversely impact our business strategies and results.

We rely on analytical models to manage financial and nonfinancial risks and to support critical internal processes. However, these models are inherently subject to limitations and uncertainty and may not perform as expected, particularly under changing market, macroeconomic, behavioral or regulatory conditions. Model risk may arise from potential errors in design, implementation, or use, as well as from the quality, completeness, or governance of data inputs.

Furthermore, our increasing adoption of advanced technologies, including generative artificial intelligence (GenAI), introduces additional complexities, such as challenges in explainability, potential algorithmic bias, the risk of inaccurate or inconsistent outputs, and the risk of misuse or misinterpretation by users.

Failures in these models could lead to inaccurate risk assessment and decision-making, resulting in financial losses, increased regulatory scrutiny or supervisory remediation requirements, or reputational harm. Reliance on flawed models may adversely impact critical operations, including strategic planning, position valuation, stress testing, capital adequacy measurement, client asset management, the accuracy of public disclosures, and compliance with regulatory requirements. While we attempt to address these risks through governance frameworks and validation processes, model risk remains inherent to our operations.

We are subject to a wide range of information security and cybersecurity incidents that can have a material adverse effect on our business.

As we continue to evolve our business model towards an open finance ecosystem, leveraging emerging technologies like the Application Programming Interfaces (APIs) and Artificial Intelligence (AI), we face growing challenges and risks, especially related to information security and cybersecurity. Cybercriminals could use AI, particularly generative AI (GenAI), to create sophisticated content for malicious purposes, including advanced cyberattacks, automated fraud, manipulation of financial markets, operational disruptions, manipulation of digital assets, and information leakage, as well as risk arising from inadequate data management that could lead to incorrect decision-making.

Emerging risks such as the increased incidence of supply chain attacks, the exploitation of vulnerabilities in third-party systems, and the evolution of ransomware toward more disruptive models continue to affect our business. Our dependence on critical software vendors, cloud services and security tools can concentrate risk and amplify the impact of an external breach or disruption. Interruptions or failures in third-party systems caused by lack of supply or poor quality of the contracted services, among other factors, could further adversely affect our business as well as our clients. Ransomware campaigns have incorporated double and triple extortion tactics, combining encryption, exfiltration, and public or regulatory pressure, faster lateral movement and the deletion of backups, increasing the likelihood of material disruptions, remediation costs, and reputational exposure. Our security measures may also be breached due to human error, malfeasance, fraud or malice by our employees, accidental technological failures, system errors or vulnerabilities, or other irregularities.

Rapid technological obsolescence, coupled with dynamic advancements such as quantum computing, can generate new vulnerabilities and compromise existing cryptographic schemes. Preparing for post-quantum scenarios demands high costs, operational complexity, and potential temporary impacts on our customers' experience. In this context, coordination with strategic partners and suppliers is essential to maintain consistent levels of operational resilience.

Should these risks materialize, they could adversely and materially affect our business, financial condition, and operating results. In particular, we could face disruptions in the provision of critical financial services, incur significant economic losses, confront legal and compliance risks related to data protection, operational resilience, and reporting to authorities and counterparties, and we could experience reputational damage and a loss of customer and investor confidence that could affect our competitive position. We could also incur significant increases in operating and capital expenditures to implement additional security measures, hire specialized talent, and transition to post-quantum cryptographic controls.

We also operate digital businesses, which are fundamental to our diversification and growth strategy. The operation and expansion of these businesses involve significant risks associated with technological integration, cybersecurity, operational continuity, and compliance with regulatory requirements that are constantly evolving.

These processes create additional challenges for our operations, including those related to risk management and information technology systems, as well as adjustments to standards, controls, procedures, and policies. They may also affect the customer experience and our ability to retain personnel with specialized knowledge, in addition to exposing us to external factors such as rapid technological evolution, the emergence of new competitors, and potential risk scenarios that may impact cybersecurity, all of which may delay or reduce the achievement of expected benefits.

Our strategy, operating results and financial condition could be materially affected by cybersecurity risks and future material incidents. A failure to comply with our cybersecurity policies, procedures or controls, employee misconduct, or human, governance or technological errors could also jeopardize our ability to protect ourselves against cyberattacks.

For further information, see Item 16 k. Cybersecurity.

Acquisitions and strategic alliances may not perform as expected or may disrupt our operations and adversely affect our profitability.

We are exposed to financial risks if the value of our acquisitions, joint ventures or strategic alliances decline. In particular, we hold a 50% stake in Compañía de Financiamiento Tuya S.A., which experienced a recovery in 2025, driven by improved business performance, compared with the impairment losses that adversely affected our financial results for 2024. Future declines in the value of our investments could negatively impact our financial condition and operating results. See “Risk factors relating to our subsidiaries' business and the banking industry - Our financial results may be negatively affected by changes to assumptions supporting the value of our goodwill”.

We are subject to increasing competition in the rapidly evolving financial services industry, and may face challenges in the adoption of emerging technologies, such as artificial intelligence, which could result in competitive disadvantage and may adversely affect our operating results.

We operate in a highly competitive environment, and management expects an increase in competition in jurisdictions where we operate.

Intensified merger activity in the financial services industry has resulted in larger, better capitalized and more geographically diverse firms that can offer a wider array of financial products and services to segments of clients similar or the same as those we provide services to. In addition, the consolidation of financial technology companies (fintechs) and unregulated financial intermediaries (shadow banking), may increase our competitive risks as their digital‑first business models could allow them to offer products and services at more competitive prices.

During 2026, we expect Bre-B, the Colombian Central Bank’s instant payment system, to be fully consolidated, allowing interoperable payments and transfers that work with 'keys', unique identifiers that are linked to a bank account. We expect this will result in wider financial inclusion and lower costs associated with cash management. While Bancolombia and Nequi have secured a portion of such keys and underlying customers, failure to maintain these customers in the future who could migrate their keys to other competitors could jeopardize our market leadership and market share. In addition, the implementation of instant payment systems such as Bre-B may increase our exposure to fraud, which may result in us being required to issue refunds to customers or incur additional losses as a result of unauthorized transactions, which could have an adverse impact on our operating results.

In addition, we continue to face the risk that existing or potential competitors accelerate the adoption of potentially disruptive innovations using artificial intelligence, optimizing their operations, personalizing their customer service and increasing their efficiency. Our ability to maintain our competitive position, and our business, depends on: (i) fulfilling new customers’ needs through the development of new products and services; (ii) strengthening our customer base through cross-selling and deepening relationships with customers in our existing portfolio, thereby remaining the primary bank of our customers; (iii) continuing our digital and technological transformation to support growth while gaining productivity and efficiency; and (iv) attracting and retaining talent. A failure to achieve any of these goals could adversely impact our operations.

We are subject to operational risks and losses.

We are exposed to operational risks that include fraud by employees or third parties, human error, inadequate process definition and technical failures that have impacted and could in the future affect the availability of services or result in improper processing of transactions. Internal fraud, in particular, refers to intentional acts of misconduct by employees, such as misappropriation of assets, manipulation or leakage of financial information, corruption, or unauthorized actions that violate established policies. These incidents not only cause financial losses but can also damage our reputation and negatively affect the trust of our stakeholders.

The financial sector is particularly vulnerable to the risk of fraud due to the accelerated digital transformation, the growth in transaction volumes and the development of new forms of fraud, all of which become a challenge for operational risk management. We depend on an extensive network of suppliers to do business, and any failures or weaknesses in these

suppliers or an inability to manage their risks could result in increased costs, compromised confidential information and a decline in the quality or continuity of our products and services.

Given customers’ increasing demands to migrate from the physical to the digital world, we aim to offer a stronger value proposition through digital channels, the design of new business models and the adoption of new technologies and systems. However, these new technologies and business models may introduce new risks or amplify existing ones.

Our financial results may be negatively affected by changes to assumptions supporting the value of our goodwill.

We test the goodwill of our operating segments for impairment at least annually. The impairment test requires management to make assumptions regarding estimated earnings, discount rates, and long-term growth rates affecting the goodwill associated with each operating segment, as well as estimates of the carrying amounts of the operating segments to which the goodwill relates. Additionally, the impairment test requires management to analyze the macroeconomic and political environment of the geographies in which each cash-generating unit (CGU) is located.

If actual results in future periods deviate from the earnings and other assumptions on which the impairment testing is based, the value of the goodwill in any one or more of our businesses may become impaired in the future, resulting in expense charges.

In December 2025, Grupo Cibest entered into an agreement to sell Banistmo and the assets and liabilities of this entity were classified as held for sale as of December 31, 2025. Upon classification as held for sale, the assets and liabilities were measured at the lower of their carrying value or fair value less costs to sell. This resulted in a goodwill impairment allocated to Banistmo (Banking Panama Discontinued Operation) of COP 5,022,822 million during 2025. No impairment charges were recorded in prior periods, as the previous annual impairment testing indicated that the value in use of the reporting unit exceeded its carrying amount based on projected future cash flows from continuing operations.

For further information, see Note 1. Reporting entity, Note 2. D and E to the consolidated financial statements, material accounting policies, use of estimates and judgments and Note 12. Goodwill and intangible assets, net.

Digital misinformation could adversely affect our reputation as well as our operating and financial results.

We are subject to the risk of digital misinformation and the possibility of false news (either fabricated or misleading) about us being disseminated in the media and/or social media, which could increase negative sentiment towards us and negatively affect the trust of customers and other stakeholders.

The growth of digital connectivity has made it easier for content to spread quickly through social media. In 2025, Bancolombia had a strong digital presence, reaching approximately 31 million users, and 499.000 mentions of Bancolombia by users on social media, which is significant among financial institutions in Colombia. Given this level of exposure, certain online mentions have been used to attempt fraud or disseminate misleading information, including in connection with service disruption reported at Bancolombia in February 2026, when inaccurate public reports regarding the security of customer funds circulated widely, amplifying reputational risk. Similar events could negatively affect our business, market share and operating results.

Our policies and procedures may not be able to detect money laundering, terrorism financing, corruption or other illegal or improper activities fully or on a timely basis.

We are subject to anti-money laundering and anti-terrorism, related laws and regulations in the jurisdictions in which we operate. These requirements mandate the adoption and enforcement of 'Know Your Counterpart’ and 'Know Your Customer’ policies and procedures, as well as the reporting of suspicious transactions to the relevant authorities.

Notwithstanding these requirements, our policies, procedures and internal controls may not be effective in all instances to prevent violations or regulatory breaches.

We are subject to anti-corruption laws and regulations, including the U.S. Foreign Corrupt Practices Act and Colombian regulations on transnational bribery, domestic bribery and others forms of corruption. While the system is designed to detect and prevent corrupt behavior, it does not eliminate the risk of corrupt practices.

Financial crime and the surrounding regulation landscape are continually evolving. As a result, we may not be able to identify, investigate and report suspicious activities fully or on a timely basis. Noncompliance with applicable laws and regulations may expose us to fines, penalties, or operational restrictions. Furthermore, our reputation and ability to conduct business could be negatively affected if we fail to effectively prevent and address instances of money laundering, terrorism financing, corruption, or other unlawful activities.

Risk factors relating to our financial holding company structure

We may not succeed in implementing our strategy to take advantage of, or we may fail to realize the anticipated benefits of, our financial holding company structure.

We were established as a new financial holding company in May 2025 pursuant to completion of the Corporate Structure Changes. See "Explanatory Note."

The realization of the anticipated benefits of the new holding company structure could be blocked, delayed or reduced by many factors, some of which may be outside of our control. These factors include:

•difficulties in successfully predicting, designing or implementing any new or enhanced risk management operations and controls or information technology systems, personnel, policies or procedures required by the Corporate Structure Changes;

•failure to leverage the holding company structure to realize operational efficiencies;

•difficulties in reorganizing personnel, networks and administrative functions;

•restrictions under applicable financial conglomerates regulations and other regulations on transactions between the holding company and, or among, its subsidiaries; and unforeseen contingent risks relating to the Corporate Structure Changes that may become apparent in the future.

As a holding company, Grupo Cibest depends on limited forms of funding to fund its operations.

We do not have significant assets other than the shares of our subsidiaries. Our primary sources of funding and liquidity are the dividends from our subsidiaries, sales of interests in our subsidiaries and direct borrowings and issuances of equity or debt securities at the holding company level. The ability to meet our obligations to our direct creditors and employees, satisfy our other liquidity needs and regulatory requirements and pay dividends on our Common and Preferred Shares depends on timely and adequate dividend distributions from our subsidiaries and the ability to sell our securities or obtain credit from its lenders. Adverse developments at our subsidiaries therefore would have a magnified effect on our liquidity and solvency.

The ability of our subsidiaries, including Bancolombia, to pay dividends to us depends on their financial condition and operating results and may be subject to regulatory restrictions under applicable law. Our subsidiaries may enter into agreements, such as credit agreements with lenders or indentures relating to senior or subordinated debt instruments, that impose restrictions on their ability to make distributions to us, and the terms of future obligations and the operation of Colombian law could prevent our subsidiaries from making sufficient distributions to allow us to make payments on our outstanding obligations. Any delay in receipt of or shortfall in payments to us from our subsidiaries could result in an inability to meet our liquidity needs, regulatory requirements and pay dividends on our Common and Preferred Shares.

In addition, our creditors generally have no direct claim to the assets of our subsidiaries. As for any holding company, our inability to sell our securities or obtain funds from our lenders on favorable terms, or at all, could also result in an inability to meet our liquidity needs and regulatory requirements.

Risks relating to the Preferred Shares and the ADSs.

Preemptive rights may not be available to holders of ADRs evidencing ADSs.

Grupo Cibest’s bylaws and Colombian law require that, whenever Grupo Cibest issues new shares of any outstanding class, it must offer the holders of each class of shares (including holders of ADSs) the right to purchase a number of shares of the same class sufficient to maintain their existing percentage ownership of the aggregate capital stock of Grupo Cibest. These rights are called preemptive rights. United States holders of ADSs may not be able to exercise their preemptive rights through The Bank of New York Mellon, which acts as depositary (the 'Depositary') for Grupo Cibest’s ADR facility, unless a registration statement under the Securities Act is effective with respect to such rights and class of shares or an exemption from the registration requirement is available.

Grupo Cibest is obligated to file a registration statement or find a corresponding exemption only if it determines to extend the rights to holders of the ADSs. Although it is not obligated to do so, Grupo Cibest intends to consider at the time of any

rights offering the costs and potential liabilities associated with any such registration statement, the benefits to Grupo Cibest from enabling the holders of the ADSs to exercise those rights and any other factors deemed appropriate at the time before it makes a decision as to whether to file a registration statement. Accordingly, Grupo Cibest may, in some cases, decide not to file a registration statement.

Under the deposit agreement between Grupo Cibest and the Depositary, only the Depositary is entitled to exercise preemptive rights, and the Depositary has no obligation to make available preemptive rights to holders of ADSs. If Grupo Cibest offers or causes to be offered to the holders of any deposited securities, including Preferred Shares of Grupo Cibest, any rights to subscribe for additional Preferred Shares of Grupo Cibest or any rights of any other nature, the Depositary has discretion as to the procedure to be followed in making such rights available to any holders of ADSs or in disposing of such rights on behalf of any holders of ADSs and making the net proceeds available to such holders of ADSs. If, by the terms of such rights offering or for any other reason, the Depositary does not either make such rights available to any holders of ADSs or dispose of such rights and make the net proceeds available to such holders of ADSs, then the Depositary will allow the rights to lapse. Whenever the rights are sold or lapse, the equity interests of the holders of ADSs will be proportionately diluted.

Exchange rate fluctuations may adversely affect the Colombian economy, the market price of Grupo Cibest’s ADSs, and the dividends payable to holders of Grupo Cibest’s ADSs.

Colombia has adopted a floating exchange rate system, but the Central Bank maintains the power to intervene in the exchange market in order to consolidate or dispose of international reserves, and to control any volatility in the exchange rate. From time to time, and in particular during the past two years, the Colombian peso has fluctuated significantly against the U.S. dollar. Unforeseen events in the international markets, fluctuations in interest rates, oil price volatility, changes in capital flows, or government operations involving the monetization of dollars in the local foreign exchange market may cause exchange rate instability that could generate sharp movements in the value of the peso.

Because a portion of our assets and liabilities are denominated in, or indexed to, foreign currencies, especially the U.S. dollar, sharp movements in exchange rates may negatively impact our results. In addition, exchange rate fluctuations may adversely impact the value of dividends paid to holders of our ADSs, as well as the market price and liquidity of Grupo Cibest's ADSs.

Grupo Cibest’s Preferred Shares have limited voting rights.

Grupo Cibest’s corporate affairs are governed by its bylaws and Colombian law. Under Grupo Cibest’s bylaws and Colombian law, Grupo Cibest’s preferred stockholders may have fewer rights than stockholders of a corporation incorporated in a U.S. jurisdiction. Under Grupo Cibest’s bylaws and Colombian corporate law, holders of Preferred Shares (and, consequently, holders of ADSs) have no voting rights in respect of Preferred Shares, other than in limited circumstances as described in Item 10. Additional Information – B. Memorandum and Articles of Association – Voting Rights – Preferred Shares. Holders of Grupo Cibest’s Preferred Shares, including holders of ADSs, are not entitled to vote for the election of directors or to influence Grupo Cibest’s management policies.

Holders of Grupo Cibest’s ADSs may encounter difficulties in the exercise of dividend and voting rights.

Holders of Grupo Cibest’s ADSs may encounter difficulties in the exercise of some of their rights with respect to the shares underlying the ADRs. If Grupo Cibest makes a distribution to holders of underlying shares in the form of securities, the Depositary is allowed, at its discretion, to sell those securities on behalf of ADS holders and instead distribute the net proceeds to the ADS holders. In addition, even in those limited instances in which the Preferred Shares represented by the ADSs have the power to vote, under some circumstances, ADS holders may not be able to vote by giving instructions to the Depositary. This may occur if ADS holders do not receive from the Depositary a notice of meeting sufficiently prior to the instruction date to ensure that the Depositary will vote the Preferred Shares represented by the ADSs in accordance with instructions received from such holders. There are no circumstances in which holders of ADSs may vote in a way other than by providing instructions to the Depositary.

Relative illiquidity of the Colombian securities markets may impair the ability of an ADS holder to sell Preferred shares.

Grupo Cibest’s Common and Preferred shares are listed on the Colombian Stock Exchange, which is relatively small and illiquid compared to securities exchanges in major financial centers. In addition, a small number of issuers represent a disproportionately large percentage of market capitalization and trading volume on the Colombian Stock Exchange. A liquid trading market for Grupo Cibest’s securities might not develop on the Colombian Stock Exchange. A limited trading market could impair the ability of an ADS holder to sell Preferred Shares (obtained upon withdrawal of such shares from

the ADR facility) on the Colombian Stock Exchange in the amount and at the price and time such holder desires and could increase the volatility of the price of the ADSs.

Changes in Colombia’s tax regime may affect the tax treatment of ADSs.

ADSs do not have the same tax treatment as other equity investments in Colombia. ADSs represent Grupo Cibest Preferred Shares and are held through a fund of foreign capital in Colombia that is subject to a specific tax regulatory regime.

Accordingly, the Colombia law applicable to equity investments, in particular those relating to dividends and profits from sale, do not apply to ADSs, including Grupo Cibest ADSs.

Notwithstanding the above, the tax regime applicable to ADSs may change, considering that the Colombian tax regime has undergone several changes in recent years.

For more information, see Item 10. Additional Information. – E. Taxation – Colombia Taxation.

ITEM 4           Information about the Company

A.History and development of the company

Pursuant to the Corporate Structure Changes mentioned in the Explanatory Note to this Annual Report, Grupo Cibest began operations in May 2025 consolidating its role as the holding company for Grupo Bancolombia. Through this structure, Grupo Cibest brings together several specialized companies, offering a comprehensive portfolio of financial services including banking, leasing, digital financial solutions, and an extensive range of both financial and complementary products. Cibest Corporate Group is one of the largest Colombian financial groups, with presence in other countries such as Panama, El Salvador, Puerto Rico, Guatemala and the United States, delivering innovative financial solutions tailored to regional markets. We provide a wide range of financial and nonfinancial products and services to a diversified individual, corporate and government customer base.

Grupo Cibest is a stock company (sociedad anónima) domiciled in Medellín, Colombia, and operates under Colombian laws and regulations. Grupo Cibest was incorporated in Colombia in 2024, and is incorporated until December 8, 2144.

Since 2025, Grupo Cibest’s Common Shares have traded on the Colombian Stock Exchange under the symbol 'CIBEST'. Grupo Cibest has also maintained a listing on the NYSE, where its ADSs are traded under the symbol 'CIB,' and on the Colombian Stock Exchange, where its Preferred Shares are traded under the symbol 'PFCIBEST.' Pursuant to Rule 12g-3(a) under the Exchange Act, Grupo Cibest was established as a successor issuer to Bancolombia with respect to the Grupo Cibest ADSs. See Item 9. The Offer and Listing.

Grupo Cibest's headquarters are located at Carrera 48 # 26-85, Medellín, Colombia, and the telephone number is + (57) 601 488-5950.

Grupo Cibest's website is: https://www.grupocibest.com

Grupo Cibest's agent for service of process in the United States is Puglisi & Associates, located at 850 Library Avenue, Suite 204, Newark, Delaware 19711. The SEC maintains a website at http://www.sec.gov that contains reports, proxy and information statements, and other information regarding issuers that file electronically with the SEC.

Recent developments

Share buyback program

On June 9, 2025, at the Extraordinary General Shareholders’ Meeting, Shareholders approved the creation of a reserve for share repurchases and the appropriation of one trillion three hundred and fifty billion Colombian pesos (COP 1,350,000,000,000) from the legal reserve, authorizing its use for purposes of executing a share buyback program.

The approved share buyback program includes the repurchase of Grupo Cibest’s Common Shares, Preferred Shares, and ADSs (the 'Buyback Program') for an aggregate amount of up to one trillion three hundred and fifty billion Colombian pesos (COP 1,350,000,000,000), over a period of up to one (1) year, commencing on July 17, 2025, following the approval of the Buyback Program’s regulations by the Board of Directors on June 24, 2024. There is no minimum number of securities required to be acquired under the Buyback Program.

The Buyback Program is being carried out in Colombia through the trading systems of the Colombian Stock Exchange (Bolsa de Valores de Colombia) via Valores Bancolombia, and in the United States through an enhanced open market repurchase program executed by Morgan Stanley & Co. LLC. For additional information regarding the Buyback Program, see Item 16.E. “Purchases of Equity Securities by the Issuer and Affiliated Purchasers.

Corporate reorganization of Banistmo and other subsidiaries in Panama

On September 29, 2025, the Superintendency of Banks of Panama authorized the implementation of a corporate reorganization involving its Panamanian subsidiary, Banistmo and other subsidiaries of Grupo Cibest in Panama.

The corporate reorganization included the following transactions:

•The partial spin off by Valores Banistmo S.A. ('Valores Banistmo') and Banistmo Capital Markets Group Inc. of certain portfolios of assets in favor of Sociedad Beneficiaria VB Panamá S.A. ('Sociedad Beneficiaria VB'), followed by the merger of Sociedad Beneficiaria VB into Banistmo. Sociedad Beneficiaria VB was a Panamanian corporation wholly owned by Banistmo.

•The distribution by Banistmo of 100% of the shares it held in Valores Banistmo in favor of Cibest Panamá Assets S.A. ('Cibest Panamá Assets'), a Panamanian corporation wholly owned by Grupo Cibest. As a result, Valores Banistmo ceased to be directly owned by Banistmo and became controlled by Cibest Panamá Assets, a subsidiary of Grupo Cibest.

On October 21, 2025, the corporate reorganization was completed and Valores Banistmo remained a subsidiary of Grupo Cibest, with no changes to its ultimate shareholders or control structure. Likewise, Valores Banistmo retained its licenses as a securities brokerage firm and investment manager, both granted by the Superintendency of the Securities Market of Panama. See Agreement for the Sale of Banistmo for the subsequent agreement for the sale of Banistmo.

Nequi's authorization certificate (operating permit)

On November 6, 2025, the SFC, through Resolution No. 2002 dated October 31, 2025, as amended by Resolution No. 2021 dated November 4, 2025 (the 'Resolution'), authorized Nequi to operate and carry out, throughout Colombia, the activities related to the corporate purpose of a financing company.

Nequi will begin operations as a standalone company once all additional procedures required in connection with the process to operate as a financing company have been completed.

Notwithstanding this authorization, Nequi will remain part of Grupo Cibest, and, for customers, this development will not represent any change in how they access or use products and services.

For more information, see Note 1. Reporting Entity,

Agreement for the Sale of Banistmo

On December 18, 2025, Grupo Cibest reached an agreement with Inversiones Cuscatlán Centroamérica S.A. for the sale of 100% of the shares of Banistmo.

The agreed sale price was USD 1.418 billion, representing a Price/Earnings ratio for the last 12 months as of September 30, 2025, of 17.1x and a Price/Book Value ratio of 1.2x. The purchase price is subject to customary closing adjustments and is to be paid on the closing date of the transaction, once the required regulatory approvals in Panama are obtained and other customary conditions under the sale and purchase agreement are satisfied.

As a result, the assets and liabilities of Banistmo were reclassified to 'Assets related to investments in subsidiaries held for sale' and 'Liabilities included in disposal groups classified as held for sale' in the consolidated balance sheet as of December 31, 2025, respectively. In addition, the profit (loss) of these companies was recognized under 'Profit / (loss) from discontinued operations, net in the consolidated income statement for the year ended December 31, 2025. In accordance with IFRS 5, for comparative purposes the profit (loss) of these companies for the years ended December 31, 2024 and

2023 was also reclassified under the heading '(loss) / gain from discontinued operation, net.' In addition, in accordance with IFRS 5, and following IFRS 8 'Information by business segments', information on the Banking Panama segment in which the Discontinued operation is recognized, is provided for the years ended December 31, 2025, 2024 and 2023. For more information, see Note 1. Reporting Entity, Note 2.D.12 Material Accounting Policies - Assets held for sale and discontinued operations and Note 31. Discontinued Operation.

Public takeover offers

In 2025, and as of the date of this Annual Report, there have been no public takeover offers by third parties for Grupo Cibest's shares or by us for other companies’ shares.

Capital acquisitions and divestitures

During 2025, total capital expenditures for Cibest Corporate Group amounted to COP 786.3 billion. Such investments were mainly focused on distribution channels and technology assets (COP 687.7 billion) driven by investments in digital transformation and fixed assets (COP 98.6 billion).

For 2026, we expect to invest approximately COP 1,066 billion up 36% from 2025, mainly on the evolution and transformation of digital channels. This investment aims to ensure operational continuity, enhance customer experience, and mitigate vulnerabilities and risks across branches and self-service channels.

We continue to invest in data management, analytics, and artificial intelligence to design personalization strategies aimed at delivering unique experiences, strengthening customer engagement and loyalty. In parallel, investment in processes and service models for corporate, institutional, and investor clients is being maintained to enhance the value proposition for this segment.

The following table summarizes Grupo Cibest’s principal capital acquisitions and divestitures of interests in other companies, for the years ending December 31, 2025, 2024 and 2023:

Capital acquisitions(1)		Type of investment		For the year ended December 31,				Total
	2025		2024		2023
				In millions of COP
Purchases of investments
Derecho Fiduciario P.A. Selecto E1 T1		Financial instrument		41,138		-	-	41,138
Derecho Fiduciario P.A. Selecto E1 T2		Financial instrument		36,234		-	-	36,234
Inversión Derecho Fid Mokana		Financial instrument		34,000		-	-	34,000
Fideicomiso Selecto Terrazu Etapa 1 Torre 1		Subsidiary		15,633		-	-	15,633
Fideicomiso Selecto Terrazu Etapa 1 Torre 2		Subsidiary		14,903		-	-	14,903
Fideicomiso Mokana Recursos		Subsidiary		13,053		-	-	13,053
Fideicomiso Lote C6 Carton de Colombia		Subsidiary		7,019		-	-	7,019
Suncolombia Sas		Financial instrument		6,079		-	-	6,079
P.A. CEDIS Sodimac		Subsidiary		-		462,442	-	462,442
FCP Pactia Inmobiliario		Financial instrument		-		230,674	-	230,674
P.A. Linz Granz del Rio		Subsidiary		-		6,490	-	6,490
P.A. Coba		Joint venture		-		5,823	-	5,823
Ozone Financial Technology Limited		Financial instrument		-		3,908	-	3,908
Fideicomiso Selecto Terrazu E1		Subsidiary		-		3,516	-	3,516
P.A. Acelera TI		Joint venture		-		560	-	560
P.A. Nomad Central		Subsidiary		-		-	106,020	106,020
P.A. Calle 84(2)		Subsidiary		-		-	104,617	104,617
Holding Bursátil Regional S.A.(3)		Financial instrument		-		-	78,139	78,139
P.A. Galería la 33		Subsidiary		-		-	30,139	30,139
Pexton Holdings Limited		Financial instrument		-		-	3,681	3,681
P.A. Wenia		Subsidiary		-		-	2,210	2,210
Capital acquisitions(1)		Type of investment		For the year ended December 31,				Total
---	---	---	---	---	---	---	---	---
	2025		2024		2023
				In millions of COP
Expenditures
Inversiones Cibest S.A.S.(4)		Subsidiary		1,063,507		-	-	1,063,507
P.A. Nomad Distrito Vera		Subsidiary		85,848		31,409	-	117,257
P.A. Nomad Salitre		Subsidiary		70,956		52,920	27,930	151,806
P.A. Nomad Nexo		Subsidiary		63,696		-	-	63,696
P.A Nomad Central 2		Subsidiary		59,290		-	-	59,290
Cibest Panama Assets, S.A.(5)		Subsidiary		49,044		-	-	49,044
Cibest Investment Management S.A.S.(4)		Subsidiary		43,500		-	-	43,500
Cibest Inversiones Estrategicas S.A.S.(4)		Subsidiary		43,500		-	-	43,500
Valores Cibest S.A.S.(4)		Subsidiary		43,500		-	-	43,500
P.A. Lote Palermo		Associate		36,984		-	-	36,984
Wenia Ltd.		Subsidiary		31,629		30,463	61,566	123,658
P.A. Calle 84(2)		Subsidiary		28,910		60,760	-	89,670
Wompi S.A.S.		Subsidiary		25,000		-	41,000	66,000
Nequi S.A.		Subsidiary		20,000		90,000	-	110,000
P.A. Tokenización Novus(5)		Subsidiary		7,250		-	-	7,250
Veronorte S.A.S.		Financial instrument		3,100		-	-	3,100
P.A. Muverang		Joint venture		3,070		1,952	3,305	8,327
Titularizadora Colombiana S.A.		Associate		2,923		-	-	2,923
Ecosistemas Digitales S.A.S.		Joint venture		2,792		7,015	8,642	18,449
Anthemis Venture Fund Iii Lp		Financial instrument		2,079		-	-	2,079
P.A Coba		Joint venture		1,928		-	-	1,928
Bancolombia Capital Holdings USA LLC		Subsidiary		1,243		5,386	8,488	15,117
P.A. La Felicidad		Associate		1,108		-	-	1,108
Internacional Ejecutiva de Aviación S.A.S.		Associate		453		3,000	-	3,453
Compañía de Financiamiento Tuya S.A.		Joint venture		-		76,750	62,500	139,250
Inversiones CFNS S.A.S.		Subsidiary		-		50,000	-	50,000
P.A. Nomad Central		Subsidiary		-		40,670	-	40,670
P.A. El Bosque		Associate		-		25,376	16,665	42,041
P.A. Distrito Vera		Associate		-		5,188	6,227	11,415
Servicios de Identidad Digital S.A.S.		Associate		-		2,487	2,433	4,920
P.A. FAI Calle 77		Subsidiary		-		826	3,469	4,295
Sistema de Inversiones y Negocios S.A.		Subsidiary		-		-	75,505	75,505
P.A. Mercurio		Subsidiary		-		-	7,833	7,833
P.A. El Otoño		Associate		-		-	8,055	8,055
P.A. Viva Malls		Associate		-		-	3,192	3,192
P.A. Laurel		Joint venture		-		-	3,156	3,156
P.A. Blup		Joint venture		-		-	2,353	2,353
P.A. Mirador de la Ciénaga		Associate		-		-	155	155
Agricapital S.A.S.		Associate		-		-	97	97
Others				1,404		4,168	3,199	8,771
Total acquisitions				1,860,773		1,201,783	670,576	3,733,132

(1)The amounts in this table correspond to the consideration paid as a result of the acquisition of each investment.

(2)The amount includes the capital acquisitions in P.A. Calle 84 (2) and P.A. Calle 84 (3).

(3)In November 2023, the integration of the stock exchanges of Colombia, Chile, and Peru was perfected, resulting in the creation of the Regional Stock Holding. As a result of this integration, 5,992,160 shares of the Bolsa de Valores de

Colombia S.A. were delisted for COP 56,146, and 3,606,223 shares were recognized in the Regional Stock Holding for COP 78,139, this transaction generated an income in results of COP 21,993, see Note 25.5. Dividends and net income on equity investments. Bancolombia retains 134 shares that were not included in this transaction, valued at COP 2.

(4)These companies were created in relation to the evolution of the corporate structure of Grupo Cibest and its subsidiaries, completed on May 16, 2025. See Note 1. Reporting Entity and Note 2.C1 Subsidiaries.

(5)These companies were created during the year 2025.

Capital divestitures(1)		Type of investment		As of December 31,				Total
	2025		2024		2023
				In millions of COP
Sales of investments
Fideicomiso Lote Distrito Vera B1B2		Subsidiary		37,150		-	-	37,150
P.A. Galería la 33		Subsidiary		26,768		-	-	26,768
P.A. Laurel		Joint venture		26,492		-	-	26,492
Banco Latinoamericano De Comercio Exterior		Financial instrument		11,813		-	-	11,813
Residual Rights		Financial instrument		3,650		18,516	8,958	31,124
Fideicomiso Irrevocable de Garantía, Fuente de Pago y Administración Inmobiliaria Polaris		Subsidiary		-		51,098	-	51,098
Fideicomiso Lote Distrito Vera B4		Subsidiary		-		26,358	-	26,358
Bolsa de Valores de Colombia		Financial instrument		-		-	56,146	56,146
Fideicomiso Lote B6 Ciudad del Río		Subsidiary		-		-	34,031	34,031
Diversitures
P.A. El Bosque		Associate		7,288		-	-	7,288
P.A Mirador de La Ciénaga		Associate		4,483		3,053	-	7,536
P.A. Boreal		Associate		3,597		520	864	4,981
P.A. El Otoño		Associate		2,854		2,894	-	5,748
P.A. Distrito Vera		Associate		2,728		-	-	2,728
P.A. Sodimac		Subsidiary		1,398		-	-	1,398
P.A. Madrid II		Associate		972		11,278	-	12,250
P.A. La Felicidad		Associate		-		3,168	3,636	6,804
Banco Latinoamericano de Comercio Exterior		Financial instrument		-		520	-	520
Others				1,266		954	724	2,944
Total divestitures				130,459		118,359	104,359	353,177

(1)The amounts in this table correspond to the consideration received as a result of the sale of each investment..

B.Business overview

B.1General

Company description

We are a full‑service financial group offering a broad range of financial products and services to a diversified customer base of nearly 33 million individual and corporate clients through our subsidiaries. We deliver our products and services through a regional platform that includes, as of the date of this Annual Report, Colombia’s largest nongovernment banking network, El Salvador’s leading financial conglomerate, Guatemala’s fifth‑largest bank in terms of deposits and loans, and Panama’s second‑largest bank in terms of deposits and loans. The Panamanian bank, Banistmo, is currently classified as a discontinued operation following the execution of a promise‑to‑purchase‑shares agreement with Inversiones Cuscatlán Centroamérica S.A. for the sale of 100% of its shares. Our network also includes offshore banking subsidiaries in Panama and Puerto Rico, as well as other adjacent businesses, which are discussed in further detail in the sections that follow.

Main lines of business

We manage our subsidiaries' business through seven main operating segments: Banking Colombia, Banking Panama, Banking El Salvador, Banking Guatemala, Leases, International Banking, and All Other. For a description and discussion of these segments, please see Item 5. Operating and Financial Review and Prospects – A. Operating Results – Results by Segment.

PRODUCTS AND SERVICES

The main products and services offered by Grupo Cibest's operating subsidiaries are listed below. Not all products and services below are offered in every country where Grupo Cibest's subsidiaries operate.

Savings and Investment: Checking accounts, savings accounts, fixed-term deposits and a variety of investment products designed to meet the specific transactional needs of each client across different income brackets.

Financing: Wide range of credit alternatives, including trade financing, loans funded by domestic development banks, working capital loans, mortgages, credit cards, personal loans, vehicle loans, payroll loans and overdrafts.

Factoring: Solutions for managing working capital and maximizing asset turnover through comprehensive solutions to manage accounts receivable financing.

Financial and Operating Leases: Financial and operating leases specifically designed for the acquisition of fixed assets.

Capital Markets: Assistance in mitigating market risk through hedging instruments such as futures, forwards, options and swaps.

Trading: Bancolombia offers an app and an internet-based trading platform for retail and institutional clients, which allows them to buy and sell securities on the Colombian Stock Exchange.

Bancolombia also performs interbank lending, repurchase agreements (repos), foreign exchange transactions, as well as sovereign and corporate securities sales and trading. Bancolombia is an active player in the 'market-makers' scheme for trading Colombian sovereign debt (TES bonds).

Bancolombia offers its clients direct access to local and international capital markets through a full range of brokerage and investment advisory services that cover equities and fixed-income securities, proprietary trading and third-party asset management products, such as mutual funds, private equity funds, and privately managed investment accounts for institutional, corporate and private bank clients.

Cash Management: Support through cash management services, including a portfolio of standard products that allows clients to make payments and collections through different channels. Payables and receivables services. Design and creation of products to address clients’ specific payment and collection needs. These include a variety of real time web services, straight-through processing (STP) and messaging through SWIFT Net solutions.

Foreign Currency and Trade Finance: Specialized solutions for clients’ foreign currency investment, financing and payment needs, as well as trade finance solutions with products such as letters of credit, standby letters of credit and bills collection.

Bancassurance and Insurance: Bancolombia distributes a diverse range of insurance products (life, health, agriculture, pets, debtors, and homeowner's insurance) written by Seguros Generales Suramericana S.A. and Seguros de Vida Suramericana S.A., two of the main insurance companies in Colombia. In addition, Bancolombia offers unemployment and theft insurance written by Cardif Colombia Seguros Generales S.A.

Bancoagrícola and Bam offer voluntary and credit‑related insurance products across life, property, fraud, unemployment, and other general insurance lines. These products are part of their value proposition and are distributed through their own channels under a partnership model with reputable insurance companies.

In the case of Bancoagrícola, policies are underwritten by Asesuisa and Assa. Bam, meanwhile, operates through its affiliated insurer, Seguros Agromercantil.

Investment Banking: Bancolombia's through its subsidiary, Banca de Inversión Bancolombia, offers a wide variety of value-added services, including structuring of leverage finance (project finance, acquisitions, and large corporate loans),

loan syndication, debt and equity capital markets, principal investments (in alternative assets), mergers and acquisitions (M&A), hedging strategy advisory, restructurings, across multiple economic sectors, with coverage in Colombia and Central America.

Trust and Fiduciary Services: Bancolombia, through its subsidiary Fiduciaria Bancolombia, offers a broad portfolio of services tailored for companies and individuals. These services include managing escrow accounts, multiple investment funds, and real estate funds.

Bancoagrícola also offers trust services and has a 94% share of the private trust market. The service is aimed at both individuals and businesses, offering different types of trusts, such as investment trusts, payment source trusts, and guarantee trusts, among others.

Nequi (Digital): Nequi is a fully digital business line focused on financial inclusion, everyday transactions, and intensive use of technology, with the purpose of improving people’s financial management and meeting customers’ financial needs. Users interact with Nequi through a mobile application and fully digital processes, without paperwork or physical branches.

Nequi offers a wide range of products, including: savings accounts, physical and virtual debit cards, loans, the ability to receive remittances, PayPal integration, and both proprietary and third-party financial services such as utility bill payments, mobility top-ups, and entertainment.

NEW PRODUCTS AND SERVICES

Below is a brief description of the new products and services that the operating subsidiaries of Grupo Cibest introduced in 2025:

Bre-B: Colombia's new instant and interoperable payment system, powered by the Central Bank was launched in 2025, and Bancolombia now offers connection to Bre-B. This platform connects banks, cooperatives, and fintechs into a single network, allowing Colombians to send and receive money between different banks and entities in seconds, with 24/7 availability. Transfers within the Bre-B system are carried out using 'keys,' eliminating the need to share traditional banking information. The new system strengthens security and standardizes inter-institutional payments. By the end of December 2025, more than 96 million keys were registered with the Central Bank of Colombia, corresponding to 33 million clients. Cibest Corporate Group and its customers hold 51 million registered keys through Bancolombia and Nequi, representing 53% of the Bre-B system.

Mortgage Lending Business as a Driver of Customer Preference: Our Subsidiaries have strengthened their relationship with payroll clients through differentiated pricing experiences, enabling them access competitive financing options. Additionally, they promote housing financing through proactive approvals under the Payroll-Based Secured Sale model (Venta Cierta Nóminas), reaffirming Cibest Corporate Group commitment to closeness, operational agility, and the financial well-being of our users. This initiative represents a strategic partnership with companies that have payroll agreements with Bancolombia, strengthening ties with the country’s business sector and contributing to the development of the real estate ecosystem.

Payments Through Wompi in the Real Estate Sector: Bancolombia integrated Wompi as a new payment channel in both the Online Business Branch and the Online Personal Branch. This significantly improves customer experience through faster, modern, and accessible payment solutions, facilitating efficient product management in the real estate sector.

Inflation-Indexed Sustainability Loans: Grupo Cibest's subsidiaries offer new inflation-indexed corporate loans promote sustainable infrastructure. The loans are indexed to the Real Value Unit (UVR), an index that is based on the Consumer Price Index, reflecting the purchasing power of the Colombian peso. The loans offer a 100 basis point benefit to the borrower.

Salud para ti: Grupo Cibest's subsidiaries offer a health insurance policy that allows clients and their families to access medical services including general practitioner and specialist consultations, laboratory tests, reimbursement for medications prescribed under the plan, and a hospital care allowance, among other benefits. The services provided are timely, accessible and reliable. The product was initially launched through Sura Telesales and, as of October 21, 2025, is also available at our branches and through our commercial teams.

Use of AI

We are developing a corporate strategy focused on data, analytics and machine-learning-based AI. We aim to build organization-wide capabilities and foster the adoption of AI across business units. The main objective is to enhance

decision-making and develop new products and services, strengthening our competitive advantage. We are focusing our efforts on ensuring that business units with the greatest potential impact on our results adopt best practices for AI use and risk mitigation. As of the date of this Annual Report, we have started to use machine learning within Cibest Corporate Group but do not currently use generative AI with customers, however we plan to initiate AI consumer use in 2026. Further details on the various risks to which we are exposed in connection with the use of artificial intelligence are discussed in Item 3.D. Risk Factors.

B.2Operations

See Note 3 to the Consolidated Financial Statements included in this Annual Report for a description of the principal markets in which we compete, including a breakdown of total interest and valuation income by category of activity and geographic market for each of the last three fiscal years.

B.3Seasonality of deposits

Bancolombia, our main operating subsidiary, has historically experienced some seasonality in demand deposits, with lower average balances during the first months of the year and higher average balances at the end of the year. This behavior is explained primarily by the increased liquidity provided by the Central Bank and the Colombian National Treasury at year end, as economic activity tends to be higher during this period, resulting in a greater number of transactions.

During 2025, monetary conditions in Colombia contributed to the seasonal pattern of Bancolombia's deposits. In the first half of the year, the Central Bank lowered its benchmark rate as inflation declined, supporting stable liquidity but not altering the usual slowdown in deposit growth. In the second half, inflation increased and the policy rate stabilized. Credit demand remained moderate, and deposits followed their typical year‑end increase. These factors, together with the seasonal behavior of deposits, resulted in excess liquidity during the year.

However, we do not consider the seasonality of demand deposits to have a significant impact on our business, since any excess or shortage of liquidity has been managed through the treasury portfolio.

B.4Raw materials

We are not dependent on sources or availability of raw materials.

B.5DISTRIBUTION NETWORK

We provide our products and services through a traditional branch network, sales and customer representatives, as well as through mobile branches (Puntos de Atención Móviles), an ATM network, online and computer banking, telephone banking, mobile phone banking services, and points of sale (Puntos de Atención Cercano), among others. In Colombia, transactions performed through electronic channels represented more than 94.80% of all transactions in 2025, compared to 95.74% of all transactions in 2024.

The following are the distribution channels offered by Cibest Corporate Group as of December 31, 2025:

Branch Network1

As of December 31, 2025, our consolidated branch network consisted of 912 offices, including 564 Bancolombia offices, 37 Renting Colombia offices, 93 Bancoagrícola offices, 37 Banistmo offices, 142 Bam offices and 39 offices of other subsidiaries.

	Number <br>of <br>branches <br>2025	Number <br>of <br>branches <br>2024	Number <br>of <br>branches <br>2023
Company (1)
Bancolombia (Colombia)	564	575	578
Bam (Guatemala)	142	151	155
Renting Colombia (2)	37	37	63
Bancoagrícola	93	91	91
Banistmo	37	37	39
Valores Bancolombia	17	17	19
Fiduciaria Bancolombia	8	8	8
Financomer	1	1	3
SUFI	1	2	2
Inversiones CFNS S.A.S.	2	2	2
Banca de Inversión	2	2	2
Bancolombia Panamá	1	1	1
Bancolombia S.A Panamá Branch	1	1	1
Cibest Capital Panamá S.A.	1	1	1
Bancolombia Puerto Rico International Inc.	1	1	1
Arrendadora Financiera S.A.	1	1	1
Valores Banagricola, S.A. de C.V.	2	1	1
Cibest Capital Holdings USA LLC	1	1	1
Total	912	930	969

(1)For some subsidiaries, the main office is considered a branch.

13 Localiza and 13 Puntos Éxito were closed

Banking Correspondents

A banking correspondent is a platform that allows nonfinancial institutions, such as retail stores that are open to the public, to provide financial services and transactions in locations where banks and financial institutions have limited or no presence. As of December 31, 2025, we had 37,045 banking correspondents, including 28,640 in Colombia, 395 in Panama, 6,168 in Guatemala and 1,842 in El Salvador, of which 955 are outsourced banking correspondents.

Puntos de Atención Móviles (PAMs)

PAMs are commercial advisors who visit small towns periodically to offer our products and services. As of December 31, 2025, there were 486 PAMs (458 in Colombia, 10 in Guatemala and 18 in El Salvador). Panama has no PAMs.

Kiosks

Kiosks are located inside our branches, in malls and in other public places and allow our clients to conduct a variety of self-service transactions. As of December 31, 2025, there were a total of 500 kiosks, 213 in El Salvador and 287 in Colombia. Panama and Guatemala have no kiosks.

ATMs

We have a total of 6,149 ATMs, including 5,212 in Colombia, 599 in El Salvador and 338 in Panama. Bam sold its Guatemalan ATM network (155 ATMs) to 5B in November 2023 and outsources ATM services to 5B.

Online/Computer Banking

We offer multiple online and computer-based banking alternatives designed to fit the specific needs of our different client segments. Through a variety of platforms (computer and internet-based solutions) our clients can review their account balances and monitor transactions in their deposit accounts, loans and credit cards, make virtual term investments, access funds from pre-approved loans, make payroll and supplier payments, make purchases and bill payments, negotiate stocks, learn about products and services and complete other transactions in real time.

Telephone Banking

We provide customized and convenient advisory services to customers of all segments through automatic interactive voice response (IVR) operations and a 24/7 contact center.

Mobile Banking Service

Our clients can conduct a variety of transactions using their mobile phones, including fund transfers between Bancolombia accounts, account balance inquiries, QR code payments and payment of bills and invoices.

Business Connections Banking Service

Business Connections is a differentiating feature of Bancolombia's product line. It consists of a direct connection between Bancolombia's servers and the client, allowing transactions and document exchange to take place, supplementing our cash management and factoring products. It offers a secure and efficient option for clients to handle their funds, particularly their cash management needs.

B.6Patents, licenses and contracts

We are not dependent on patents or licenses, nor is it substantially dependent on any industrial, commercial or financial contracts (including contracts with customers or suppliers).

However, we have entered into contracts with third parties who provide certain services that are important to our business. These services include core banking services, online banking platforms, data processing and payment services, clearing and settlement services, software for processing credit and debit card services, and technological infrastructure, including cloud services where our data will be stored, among others.

B.7Competition

The competition faced by Grupo Cibest depends primarily on the markets in which its respective subsidiaries operate. In particular, a relevant portion of said subsidiaries carries out their activities within the financial system of the countries and jurisdictions in which we have a presence. The competition of Grupo Cibest is described below:

Colombian financial system description

Overview

The recent history of Colombia’s banking sector is marked by consolidation and internationalization. A series of major bank mergers and acquisitions took place in 2013, with Bancolombia and Grupo Aval both acting as active participants, while several foreign banks entered the market the same year, increasing competition. New financial entities entered the market in 2014, while Corpbanca acquired Helm Bank and GNB Sudameris acquired nearly all of HSBC Colombia, expanding into Paraguay, Peru, and Uruguay.

Further consolidation occurred in 2015, including the merger of Chile’s CorpBanca with Brazil’s Itaú, while Bancolombia sold 50% of its shares in Tuya to Grupo Éxito and bought a stake in Guatemala’s Grupo Agromercantil, taking full ownership in 2020. Several banks underwent transitions in 2015, including Serfinanza, a commercial financing company that become the 26th bank in the financial system in February 2015.

In 2020 four financing companies went through changes in their shareholder structures: in January, Credifinanciera acquired Procredit Bank, rebranding as Banco Credifinanciera; that April, Coltefinanciera acquired the rights and obligations of Multibank, which ceased to act as a bank; in August, Leasing Bancoldex merged with Arco Bancoldex; and, in November, Pagos Internacional was acquired by Banco W. In 2021, Lulo Bank became the first digital bank in Colombia, and in December of that year insurance brokerage BTG Pactual became the 28th bank in the financial system.

In 2022 commercial financing company Banco Unión, previously called Giros y Finanzas, became the 29th bank in the financial system, and microfinancing company Banco Contactar became the 30th bank in the financial system in 2024. Nubank began operations as a financing company in 2024, offering savings accounts at the beginning of the year and expanding into consumer loans and term deposits by the end of the year. In 2025, Banco Davivienda gave notice of its intention to integrate with Scotiabank Colpatria by 2026, with Scotiabank Colpatria transferring all its loans and deposits to Banco Davivienda and taking a 20% stake in the combined entity. The alliance will create the second-largest bank in Colombia and significantly enhance Banco Davivienda’s presence in Central America. It is expected to leverage Banco Davivienda's scale to offer wealth management, corporate banking, investment advisory and other services. The SFC approved operating licenses for other digital players in 2025, such as Cobre, Revolut, and Nequi, which are expected to begin operations in 2026.

As of December 31, 2025, according to the SFC, the main participants in the Colombian financial system were 30 commercial banks (19 domestic private banks, 10 foreign banks, and one domestic state-owned bank), six financial corporations and 15 financing companies. In addition, trust companies, cooperatives, insurance companies, insurance brokerages and securities intermediaries, special state-owned institutions, and severance payments and pension funds also participate in the Colombian financial system.

Evolution of market and credit institutions in 2025

Loan growth at Colombian credit institutions was 8.2% in 2025, compared with 3.4% in 2024. Commercial loans grew by 6.2% in 2025, compared with 5.8% the previous year. Consumer loans increased 6.8% in 2025, compared with a decrease of 3.2% in 2024. Mortgage loans increased 14.6% in 2025, compared to 8.0% in 2024, and small business loans grew 12% in 2025 compared with 8.5% in 2024.

The credit institutions' level of past-due loans, as a percentage of the total loan portfolio, stood at 3.8% in December 2025, down from 4.7% in December 2024. In addition, the coverage ratio – measured as the ratio of allowances for loan losses (principal) to past-due loans (over 30 days) – ended 2025 at 143.4%, compared with 129.2% at the end of 2024. In December 2025, the loan portfolio represented 62.4% of total assets, slightly higher than the 61.8% recorded the previous year. Investments and derivative transactions, as a percentage of total assets, remained at 23.3% at the end of 2025, the same level as at the end of 2024. Deposits also increased as a percentage of total liabilities, reaching 76% in 2025 compared with 75.4% in 2024.

Credit institutions recorded COP 1.135 trillion in total assets on December 2025, a 7.1% increase from the previous year. Based on total assets held by Colombian credit institutions, banks had a market share of 93.9%, followed by financial corporations with 3.1%, financing companies with 2.5%, and financial cooperatives with 0.5%. The capital adequacy ratio (Tier 1 + Tier 2) for credit institutions was 17.8% in December 2025 (including banks, financial corporations, financing companies and financial cooperatives), which is above the minimum legal requirement of 9% pursuant to Decree 1477 of 2018.

Bancolombia and its competitors

The following table shows a comparison between the key profitability, capital adequacy and loan portfolio quality indicators for Bancolombia and its main competitors, unconsolidated, based on IFRS information as applicable under Colombian regulations and published by the SFC.

	ROE(1)				ROA(2)				Past-due loans/ <br>Total loans				Allowance<br><br>s/<br><br>Past-due loans				Capital Adequacy
	Dic-25		Dec-24		Dic-25		Dec-24		Dic-25		Dec-24		Dic-25		Dec-24		Dic-25		Dec-24
Bancolombia	24.7	%	13.2	%	2.4	%	2.1	%	3.5	%	4.4	%	176.5	%	158.0	%	14.4	%	18.5	%
Banco de Bogotá	7.6	%	7.0	%	0.9	%	0.9	%	3.8	%	4.4	%	119.2	%	107.5	%	18.1	%	18.8	%
Davivienda	12.2	%	5.8	%	1.2	%	0.6	%	4.4	%	5.5	%	121.2	%	112.4	%	18.9	%	18.6	%
BBVA	6.5	%	(5.6	%)	0.4	%	(0.4	%)	3.5	%	4.6	%	148.2	%	128.0	%	13.4	%	13.1	%
Banco de Occidente	9.4	%	9.0	%	0.6	%	0.7	%	3.2	%	3.3	%	144.5	%	144.1	%	12.5	%	12.7	%
Itaú Corpbanca	1.4	%	2.4	%	0.1	%	0.3	%	4.0	%	4.5	%	124.6	%	123.5	%	16.6	%	16.3	%
Scotiabank Colpatria	(0.9)	%	(5.9)	%	(0.1)	%	(0.4)	%	4.1	%	5.0	%	135.2	%	119.0	%	11.5	%	11.7	%

Source: SFC.

(1)ROE is return on average stockholders’ equity.

(2)ROA is return on average assets

The following tables illustrate the market share of Bancolombia and its main competitors, on an unconsolidated basis, with respect to various key products, based on figures published by the SFC for 2025 and 2024:

Total Net Loans

Market Share

Total Net Loans – Market Share (%)	2025		2024
Bancolombia	27.6	%	27.2	%
Davivienda	16.0	%	15.6	%
Banco de Bogotá	12.8	%	12.9	%
BBVA	10.8	%	11.0	%
Banco de Occidente	7.1	%	7.3	%
Scotiabank Colpatria	4.0	%	4.0	%
Itaú Corpbanca	2.5	%	2.7	%
Others(1)	19.2	%	19.3	%

Source: Ratios are calculated by Bancolombia based on figures published by the SFC.

(1)Nubank was registered as financial company so is not included in others

Checking Accounts

Market Share

Checking Accounts – Market Share (%)	2025		2024
Bancolombia	26.4	%	27.4	%
Banco de Bogotá	17.1	%	18.1	%
Davivienda	12.2	%	11.0	%
BBVA	10.6	%	10.3	%
Banco de Occidente	8.8	%	8.7	%
Itaú Corpbanca	2.3	%	2.3	%
Scotiabank Colpatria	2.3	%	2.5	%
Others(1)	20.3	%	19.7	%

Source: Ratios are calculated by Bancolombia based on figures published by the SFC.

(1)Nubank was registered as financial company so is not included in others

Time Deposits

Market Share

Time Deposits – Market Share (%)	2025		2024
Bancolombia	22.2	%	22.2	%
Davivienda	16.8	%	17.9	%
Banco de Bogotá	14.8	%	13.9	%
BBVA	12.6	%	13.1	%
Scotiabank Colpatria	5.1	%	4.6	%
Banco de Occidente	5.2	%	4.7	%
Itaú Corpbanca	3.0	%	3.2	%
Others(1)	20.2	%	20.4	%

Source: Ratios are calculated by Bancolombia based on figures published by the SFC.

(1)Nubank was registered as financial company so is not included in others

Saving Accounts

Market Share

Saving Accounts – Market Share (%)	2025		2024
Bancolombia	31.8	%	30.7	%
Davivienda	12.7	%	12.5	%
Banco de Bogotá	10.4	%	10.8	%
BBVA	9.8	%	10.4	%
Banco de Occidente	9.0	%	9.1	%
Scotiabank Colpatria	3.2	%	3.5	%
Itaú Corpbanca	1.8	%	1.8	%
Others(1)	21.3	%	21.2	%

Source: Ratios are calculated by Bancolombia based on figures published by the SFC.

(1)Nubank was registered as financial company so is not included in others

Bancoagrícola and its competitors

In 2025, Bancoagrícola continued to lead the Salvadoran financial system and ranked first in terms of total assets, loans, total deposits, stockholders’ equity and profits. The information presented in the following tables shows Bancoagrícola and

its competitors on a stand-alone basis and was prepared based on publicly available information from the Financial System Superintendency (SSF), in accordance with Salvadoran accounting standards.

The following table illustrates the market share for the main institutions of the Salvadoran financial system as of December 31, 2025:

	Assets	Stockholders’ Equity	Loans	Deposits	Profits
Banco Agrícola	24.4%	23.5%	24.8%	25.6%	39.5%
Cuscatlán	17.0%	17.2%	17.4%	17.6%	18.1%
Davivienda	13.1%	13.5%	14.3%	13.1%	8.3%
BAC	14.1%	13.9%	15.5%	14.5%	10.3%
Hipotecario	8.4%	8.3%	5.7%	7.4%	8.1%
Promérica	5.5%	4.2%	5.6%	5.5%	2.6%
Otros	17.5%	19.4%	16.7%	16.3%	13.1%

Source: SSF (Superintendencia del Sistema Financiero)

The following tables illustrate the market share of Bancoagrícola and its main competitors, based on figures published by the Financial System Superintendency (SSF), as of December 31, 2025 and 2024:

Total Loans

Market Share

Total Loans – market Share (%)	2025	2024
Banco Agrícola	24.8%	24.2%
Cuscatlán	17.4%	17.9%
Davivienda	14.3%	14.2%
BAC	15.5%	15.6%
Hipotecario	5.7%	6.2%
Promérica	5.6%	5.7%
Otros(1)	16.7%	16.2%

(1) In 2024, Sociedad de Ahorro y Crédito Apoyo Integral, S.A. became the thirteenth bank in El Salvador's Financial System, now known as Banco Apoyo Integral.

Checking and Saving Accounts

Market Share

Checking and Saving Accounts – Market Share (%)	2025	2024
Banco Agrícola	30.7%	31.3%
Cuscatlán	19.0%	18.7%
Davivienda	12.4%	12.6%
BAC	15.5%	15.6%
Hipotecario	6.1%	6.0%
Promérica	4.8%	5.0%
Otros(1)	11.5%	10.8%

(1) In 2024, Sociedad de Ahorro y Crédito Apoyo Integral, S.A. became the thirteenth bank in El Salvador's Financial System, now known as Banco Apoyo Integral.

Time Deposits

Market Share

Time Deposits – Market Share (%)	2025	2024
Banco Agrícola	16.8%	15.1%
Cuscatlán	15.2%	15.0%
---	---	---
Davivienda	14.4%	15.2%
BAC	12.7%	14.2%
Hipotecario	9.7%	12.0%
Promérica	6.5%	7.2%
Otros(1)	24.7%	21.3%

(1) In 2024, Sociedad de Ahorro y Crédito Apoyo Integral, S.A. became the thirteenth bank in El Salvador's Financial System, now known as Banco Apoyo Integral.

Banistmo and its competitors

Banistmo (discontinued operation) is one of Panama’s leading banks, the second-largest bank in terms of balance sheet (total assets plus total liabilities), and the third-largest in terms of its loan portfolio, with a market share of 7.9%.

The following table illustrates the market share of the main institutions in the Panamanian financial system as of December 31, 2025.

	MARKET SHARE
	Assets	Equity	Loans	Deposits	Profits
Banistmo	7.3 %	7.0 %	7.9 %	9.2 %	4.5 %
Banco General	13.3 %	11.0 %	13.3 %	19.5 %	24.7 %
Global Bank	6.4 %	5.0 %	7.1 %	7.2 %	1.9 %
Banesco	4.1 %	2.7 %	4.3 %	5.9 %	2.3 %
BAC	9.1 %	25.6 %	6.6 %	8.3 %	29.4 %
Others	59.8 %	48.7 %	60.8 %	49.9 %	37.2 %

Source: Banistmo based on data by SBP (Superintendency of Banks of Panama)

The following tables illustrate the market share of Banistmo and its main competitors, based on figures published by the Superintendency of Banks of Panama, as of December 31, 2025, and December 31, 2024:

Total Loans

Market Share

Total Loans - Market Share (%)	2025		2024
Banistmo	7.9	%	8.3	%
Banco General	13.3	%	13.1	%
Global Bank	7.1	%	6.9	%
Banesco	4.3	%	4.4	%
BAC	6.6	%	6.2	%
Others	60.8	%	61.1	%

Source: Banistmo based on data by SBP (Superintendency of Banks of Panama)

Saving Accounts

Market Share

Saving Account - Market Share (%)	2025		2024
Banistmo	9.7	%	10.2	%
Banco General	28.4	%	29.1	%
Global Bank	7.1	%	7.4	%
Banesco	6.8	%	7.4	%
BAC	5.1	%	5.2	%
Others	42.9	%	40.7	%

Source: Banistmo based on data by SBP (Superintendency of Banks of Panama)

Checking Accounts

Market Share

Checking Accounts - Market Share (%)	2025		2024
Banistmo	8.3	%	9.0	%
Banco General	24.0	%	23.2	%
Global Bank	3.5	%	3.8	%
Banesco	10.1	%	10.0	%
BAC	12.3	%	11.1	%
Others	41.8	%	42.9	%

Source: Banistmo based on data by SBP (Superintendency of Banks of Panama)

Time Deposits

Market Share

Time Deposits - Market Share (%)	2025		2024
Banistmo	9.3	%	10.0	%
Banco General	15.0	%	14.9	%
Global Bank	8.2	%	8.3	%
Banesco	4.4	%	4.4	%
BAC	8.3	%	9.7	%
Others	54.8	%	52.7	%

Source: Banistmo based on data by SBP (Superintendency of Banks of Panama)

Bam and its competitors

Bam is the fifth-largest bank in the banking system in Guatemala, measured by total assets, deposits and net loans, and the sixth in terms of stockholders’ equity.

As of December 31, 2025, the Bank Superintendency of Guatemala (SIB) has 19 banking entities under its supervision and inspection.

The information presented in the following tables was prepared in accordance with Guatemalan banking regulations, as reported to the SIB.

The following table illustrates the market share for the main institutions of the banking system at the end of 2025:

	MARKET SHARE
	Assets	Stockholders’ Equity	Net Loans	Deposits	Profits
Banco Agromercantíl	7.5 %	6.2 %	9.3 %	7.6 %	1.2 %
Banco Industrial	28.8 %	22.8 %	28.6 %	26.6 %	25.2 %
Banrural	22.3 %	24.8 %	17.4 %	24.1 %	35.2 %
Banco G&T Continental	12.0 %	10.9 %	11.5 %	12.0 %	11.3 %
BAC-Reformador	7.7 %	7.7 %	9.8 %	7.8 %	6.5 %
Bantrab	7.1 %	11.6 %	8.0 %	7.3 %	7.9 %
Banco Promerica	5.3 %	5.3 %	6.7 %	5.3 %	4.9 %
Others(1)	9.3 %	10.7 %	8.7 %	9.3 %	7.8 %

(1) Others . Includes the following banks: Internacional, Crédito Hipotecario Nacional, Ficohsa, Azteca, Cuscatlán, De Antigua, Vivibanco, Citibank, N.A. de Guatemala, Inv, Credicorp, Nexa and Multimoney.

Source: Bank Superintendency of Guatemala (SIB).

The following tables illustrate the market share of Bam on a standalone basis and its main competitors, based on figures published by the SIB, under Guatemalan banking regulations, as of December 31, 2025, and 2024:

Net Loans

Market Share

Net Loans - Market Share (%)	2025		2024
Banco Agromercantil	9.3	%	10.0	%
Banco Industrial	28.6	%	29.2	%
Banrural	17.4	%	16.3	%
Banco G&T Continental	11.5	%	11.2	%
BAC-Reformador	9.8	%	9.9	%
Bantrab	8.0	%	8.2	%
Banco Promerica	6.7	%	7.0	%
Others(1)	8.7	%	8.2	%

(1) Others . Includes the following banks: Internacional, Crédito Hipotecario Nacional, Ficohsa, Azteca, Cuscatlán, De Antigua, Vivibanco, Citibank, N.A. de Guatemala, Inv, Credicorp, Nexa and Multimoney.

Source: Bank Superintendency of Guatemala (SIB).

Checking Accounts

Market Share

Checking Accounts - Market Share (%)	2025	2024
Banco Agromercantil	5.4 %	5.9 %
Banco Industrial	34.0 %	33.9 %
Banrural	24.7 %	24.0 %
Banco G&T Continental	12.0 %	12.1 %
BAC-Reformador	10.9 %	11.0 %
Banco Promerica	3.4 %	3.5 %
Bantrab	1.9 %	2.1 %
Others(1)	7.7 %	7.5 %

(1) Others . Includes the following banks: Internacional, Crédito Hipotecario Nacional, Ficohsa, Azteca, Cuscatlán, De Antigua, Vivibanco, Citibank, N.A. de Guatemala, Inv, Credicorp, Nexa and Multimoney.

Source: Bank Superintendency of Guatemala (SIB).

Time Deposits

Market Share

Time Deposits - Market Share (%)	2025	2024
Banco Agromercantil	8.0 %	8.7 %
Banco Industrial	23.6 %	23.1 %
Banrural	17.7 %	16.5 %
Bantrab	12.9 %	13.7 %
Banco Promerica	9.3 %	9.4 %
Banco G&T Continental	8.9 %	8.8 %
BAC-Reformador	6.7 %	8.2 %
Others(1)	12.9 %	11.6 %

(1) Others . Includes the following banks: Internacional, Crédito Hipotecario Nacional, Ficohsa, Azteca, Cuscatlán, De Antigua, Vivibanco, Citibank, N.A. de Guatemala, Inv, Credicorp, Nexa and Multimoney.

Source: Bank Superintendency of Guatemala (SIB).

Saving Accounts

Market Share

Saving Accounts - Market Share (%)	2025	2024
Banco Agromercantil	9.7 %	9.3 %
Banrural	31.7 %	30.2 %
Banco Industrial	21.7 %	23.2 %
Banco G&T Continental	16.0 %	16.8 %
Bantrab	6.5 %	6.1 %
BAC-Reformador	5.6 %	5.9 %
Banco Promerica	2.3 %	2.4 %
Others(1)	6.5 %	6.1 %

(1) Others . Includes the following banks: Internacional, Crédito Hipotecario Nacional, Ficohsa, Azteca, Cuscatlán, De Antigua, Vivibanco, Citibank, N.A. de Guatemala, Inv, Credicorp, Nexa and Multimoney.

Source: Bank Superintendency of Guatemala (SIB).

B.8Supervision and regulation

Grupo Cibest, as an issuer of securities listed on the Colombian Stock Exchange (Bolsa de Valores de Colombia, or BVC) and registered in the Colombian National Registry of Securities and Issuers (Registro Nacional de Valores y Emisores, or RNVE), is under the exclusive control of the SFC in Colombia pursuant to Law 964 of 2005, Decree 2555 of 2010, External Circular 6 of 2025 (the SFC’s Basic Legal Circular) and External Circular 100 of 1995 (the SFC’s Basic Accounting and Financial Circular). The regulatory framework that governs Grupo Cibest is based mainly on general commercial laws, such as the Colombian Commercial Code and Law 222 of 1995, as well as specific regulations governing securities issuers, including Law 964 of 2005, Decree 2555 of 2010, and SFC regulations.

The SFC’s oversight includes verifying compliance with all Colombian laws related to corporate governance for issuers. This encompasses, among other things, the disclosure of material information to the market, submission of periodic reports to both the SFC and the market, and adherence to minimum corporate governance standards. In addition, under External Circular 6 of 2025 , Grupo Cibest must implement and maintain a comprehensive Anti-Money Laundering and Counter-Terrorism Financing system (Sistema Integral para la Prevención y Control de Lavado de Activos y de la Financiación del Terrorismo – SIPLA), which includes policies, procedures, and internal controls to prevent, detect, and report activities related to money laundering and terrorism financing, in compliance with Colombian regulations and international standards.

Pursuant to Law 1870 of 2017, Grupo Cibest is part of the financial conglomerate defined as the Sura-Bancolombia Financial Conglomerate. This conglomerate includes all supervised entities in Colombia, intermediate holding companies, and foreign financial entities of Sura and Bancolombia. Consequently, Grupo Cibest is subject to cross-border consolidated supervision based on four pillars: (i) integrated risk management, (ii) prudential requirements, (iii) cooperation and information exchange, and (iv) protocols for cross-border investment management.

While Grupo Cibest is regulated primarily as an registered issuer listed on the BVC and subject to the SFC’s exclusive control in that capacity, our business is also influenced by the regulatory framework applicable to our Subsidiaries, which are described below.

Colombia

Bancolombia is our main operating subsidiary and a Colombian credit institution supervised by the SFC. In practice, many regulatory requirements applicable at the level of Bancolombia, particularly those related to solvency and capital buffers, liquidity standards, large exposures and related‑party limits, enterprise risk management, cybersecurity and consumer protection, can affect Grupo Cibest on a consolidated basis.

Colombian banking regulators

The Colombian Constitution grants the Congress of Colombia the power to prescribe the general legal framework of the financial system, and the Government issues regulations within that framework. Multiple agencies have the authority to regulate the financial system, including the board of directors of the Central Bank, the Ministry of Finance and Public Credit (the Ministry of Finance), the SFC, the SIC and the Self-Regulatory Organization (Autoregulador del Mercado de Valores or AMV).

Regulatory framework for Colombian banking institutions

The basic regulatory framework of the Colombian financial sector is described below.

Decree 663 of 1993, as amended, defines the structure of the Colombian financial system and establishes the permitted forms of business entities and their authorized activities. Furthermore, Decree 663 of 1993 sets forth (i) licensing requirements, (ii) the procedure applicable for mergers and acquisitions, spin-offs, and other corporate reorganizations of the aforementioned entities, (iii) specific regulations that apply to the issuance and sale of shares and other securities by such entities, and (iv) certain rules regarding the activities of officers and directors of such institutions, among others.

Decree 2555 of 2010 contains regulations regarding banking, insurance and securities market activities, capital adequacy requirements, financial institutions’ corporate governance and principles relating to the determination, dissemination and publication of rates and prices of products and financial services, lending activities and resolution procedures.

External Circular 6 of 2025 and External Circular 100 of 1995 contain the rules and regulations issued by the SFC that apply to financial institutions and other entities under its supervision and control.

Financial institutions are subject to further rules if they engage in additional activities. Law 964 of 2005 regulates securities activities, which banks may undertake, and securities issuers. External Resolution 1 of 2018 (foreign exchange regulations), and External Resolution 4 of 2006 issued by the board of directors of the Central Bank, define the different activities that banks, including Bancolombia, may perform as foreign exchange market intermediaries, including lending in foreign currencies and investing in foreign securities.

Violations of any of the above statutes and their relevant regulations are subject to administrative sanctions and, in some cases, criminal sanctions.

Interest rates

Article 884 of the Colombian Commercial Code provides for a limit on the amount of interest that may be charged in commercial transactions. The limit is 1.5 times the current banking interest rate (interés bancario corriente, or IBC), certified and calculated by the SFC as the weighted average rate of interest ordinarily charged by banks for loans made during a specified period. The certification process is carried out for the following credit portfolios: consumer and ordinary; small loans; and microcredit (which is further divided into five subcategories).

As of December 31, 2025, the maximum banking lending rates certified by the SFC for the credit portfolios are: (i) 24.36% for consumer and ordinary loans; (ii) 68.85% for small loans; and (iii) between 27.98% and 89.75% for the five remaining microcredit subcategory rates.

Capital adequacy requirements – Basel III

Capital adequacy requirements for Colombian financial institutions (set forth in Decree 2555 of 2010, as amended) are based on most of the Basel III standards. This regulation provides for a gradual implementation plan beginning in 2021 and ending in 2024 for requirements regarding solvency ratios and capital buffers. The SFC issued External Circular 020 of 2019, which sets capital adequacy requirements for credit institutions and requirements for reporting information to the SFC. Some of the highlights of this regulation are as follows:

The regulatory capital (patrimonio técnico) is calculated as the sum of the Common Equity Tier 1 Capital (patrimonio básico ordinario), the Additional Tier 1 Capital (patrimonio básico adicional) and the Tier 2 Capital (patrimonio adicional).

Revised criteria for debt and equity instruments to be considered Common Equity Tier 1 Capital, Additional Tier 1 Capital, and Tier 2 Capital were established. In addition, the SFC reviews whether a given instrument adequately complies with the applicable criteria in order for an instrument to be considered Tier 1 Capital or Tier 2 Capital, upon request of the issuer. Debt and equity instruments that have not been classified by the SFC as Tier 1 Capital or Tier 2 Capital shall not be considered Tier 1 Capital or Tier 2 Capital for the purposes of capital adequacy requirements.

The Capital Adequacy Ratio is set at a minimum of 9% of the financial institution’s total risk-weighted assets. However, each entity must comply with: (i) a minimum basic solvency ratio of 4.5% (which is defined as the ordinary basic capital after deductions divided by the financial institution’s total risk-weighted assets and off-balance sheet items); (ii) a minimum additional basic solvency ratio (which is defined as the sum of Common Equity Tier 1 Capital after deductions and Additional Tier 1 Capital, divided by the financial institution’s total risk-weighted assets and off-balance-sheet items) of 4.875%, which began on January 1, 2021, increasing gradually to 6% by January 1, 2024; (iii) a capital conservation buffer (which is defined as the Common Equity Tier 1 Capital after deductions divided by the financial institution’s total risk-weighted assets and off-balance-sheet items) of 0.375% starting on January 1, 2021, increasing gradually to 1.5% by January 1, 2024; (iv) a systemically important institution buffer (which is defined as the Common Equity Tier 1 after deductions divided by the financial institution’s total risk-weighted assets and off-balance-sheet items) of 0.25% starting on January 1, 2021, increasing gradually to 1% on January 1, 2024 (Bancolombia has been recognized by the SFC as a domestic systemically important institution in Colombia); and (v) a combined buffer equivalent to the sum of the aforementioned buffers as of January 1, 2024. These ratios apply to credit institutions individually and on a consolidated basis.

Credit establishments must comply with a minimum leverage ratio of 3%, which is defined as the sum of the Common Equity Tier 1 Capital after deductions and the Additional Tier 1 Capital, divided by the leverage value. The leverage value is the sum of all net assets, the net exposures in all repo, simultaneous transactions and temporary transfer of securities, the credit exposures in all derivative instruments, and the exposure value of all contingencies.

Credit establishments must comply with minimum capital requirements for operational risk. This new capital requirement will be determined by the product of the Business Indicator (indicador de negocio), the Operational Risk Coefficient (coeficiente de riesgo operacional) and the Internal Loss Multiplier (indicador de pérdida interna). The Operational Risk Coefficient will be 12% of the Business Indicator, but if the Business Indicator exceeds COP 3 billion, the coefficient will be 15% for the excess amount. Each entity was required to comply with the requirement as of January 1, 2021.

For more information, see Item 5. Operating and Financial Review and Prospects - B1 Liquidity and Funding. Capital Adequacy.

The minimum capital requirement for applying for a banking charter on an unconsolidated basis is established in Article 80 of Decree 633 of 1993. This capital requirement for banks in 2025 is set at COP 140,254 million. Failure to meet the requirement could result in the SFC taking of possession (toma de posesión) of the bank (see Item 4. Information on the Company – B. Business Overview – B.8 –Supervision and Regulation – Bankruptcy Considerations).

Mandatory investments

The Central Bank regulations require financial institutions, including Bancolombia, to hold minimum mandatory investments in debt instruments issued by Fondo para el Financiamiento del Sector Agropecuario ('Finagro'), a Colombian public financial institution that finances production and rural activities to support the agriculture sector. The amount of

these mandatory investments is calculated by applying a fixed percentage (ranging from 4.3% to 5.8%, depending on the type of liability) to the quarterly average of the end-of-day balances of certain liabilities, primarily deposits and short-term debt. The investment balance is calculated at the end of each quarter. Any required adjustment (due to a change in the quarterly average between periods) results in the purchase of additional securities or may result in the redemption by Finagro of securities in excess of the requirement. The purchase of additional securities takes place during the month following the date on which the calculation was performed.

Foreign currency requirements

According to External Resolution 1 of 2018 issued by the board of directors of the Central Bank, as amended or supplemented ('Resolution 1 of 2018'), a financial institution’s foreign currency position is the difference between the institution’s foreign currency-denominated assets and liabilities (including any off-balance-sheet items). In the case of foreign exchange market intermediaries that consolidate financial statements and have controlled foreign investments, such as Bancolombia, (i) the value of controlled foreign investments, and (ii) the value of derivatives and other liabilities designated by the intermediary as hedging instruments for the controlled foreign investments are excluded from its foreign currency position.

In addition, Resolution 1 of 2018 provides foreign currency position limits, such that a financial institution's positions may not exceed certain percentages of its technical capital in specific periods. It also requires banks to calculate a gross leverage position (posición bruta de apalancamiento) as it relates to its foreign currency position.

Reserve requirements

Credit institutions are required to satisfy reserve requirements with respect to deposits and other cash demands, which are held by the Central Bank in the form of cash deposits. The reserve requirements for Colombian banks are measured bi-weekly and the amount depends on the class of deposits.

According to External Resolution 3 of 2024, which amends External Resolution of 2008, the Central Bank require credit institutions to maintain reserves of (i) 7% over private demand deposits, government demand deposits, other deposits and liabilities; (ii) 2.5% over term deposits with maturities fewer than 540 days and (iii) 0% over term deposits with maturities greater than or equal to 540 days.

Nonperforming loan allowance

The SFC maintains rules on nonperforming loan allowances for financial institutions. The allowance level of these loans is determined by the profile and risk conditions of the clients and the specific conditions of the loan. These rules apply to Bancolombia’s financial statements on a standalone basis for Colombian regulatory purposes. Nonperforming loan allowances in the Consolidated Financial Statements are calculated according to IFRS.

Large exposures and concentration limits

The government, through Decree 1533 of 2022 and the SFC’s External Circular 3 of 2024, adopted the Basel Committee’s international standard on Large Exposures (LEX), which as of August 2025 modified the current rules on legal lending limits. The set of regulations establishes: (i) a 25% exposure limit of Tier 1 Capital with respect to the same counterparty or group of connected counterparties; (ii) the definition of a Large Exposure as an exposure that represents more than 10% of the Tier 1 Capital; (iii) metrics that align the measurement of exposures with metrics on the risk-weighted assets in terms of capital adequacy; and (iv) the criteria for the identification of connected counterparties, including control relationship, financial conglomerates, and economic interdependence. In addition, Decree 1358 of 2024 included a 25% limit for transactions with related parties that will apply from May 2026.

Payments system

External Circular DSP-465 issued by the Central Bank establishes standards for interoperability, governance, and operational procedures of the new interoperable Immediate Payments System managed by the Central Bank (Bre-B), which started operations in September 2025.

Decree 1069 of 2025 issued by the Ministry of Finance governs payment orders and fund transfers, imposing enhanced obligations on participating entities to ensure security, efficiency, and standardized practices. These measures create a legal and technical foundation for real-time, interoperable payments, fostering competition and financial inclusion.

Internal capital and liquidity assessment process

The SFC, through External Circular 025 of 2025, adopted Basel Pillar 2 recommendations, focusing on the supervisory review process requiring banks to assess their own capital adequacy beyond Pillar 1, through the implementation of capital and liquidity self-assessment programs (ICAAP-ILAAP) and the update of stress tests, which will be mandatory as of January 2028. The results of the ICAAP will be binding on credit establishments starting in January 2029.

Bankruptcy considerations

Colombian banks and other financial institutions are subject to special regulations regarding insolvency, restructuring and liquidation. Under Colombian banking law, the SFC has the power to intervene in the operations of a bank to prevent, or to control and reduce the effects of, a bank failure. The SFC also conducts periodic visits to financial institutions and may impose capital or solvency obligations on financial institutions without taking control of such financial institutions.

The SFC may require corrective and recovery measures, including enhanced supervision, mandatory recapitalization, transfers of assets and liabilities, mergers or other restructuring actions, and, if the situation is deemed critical, may take possession of a financial institution either to manage it or to coordinate its liquidation. Colombia’s financial conglomerates framework also strengthened crisis management tools applicable to deposit-taking institutions, including the use of bridge bank mechanisms to facilitate the transfer of assets and liabilities from a failing institution. Upon taking possession, the SFC appoints a special agent designated by Fogafín to manage the financial institution, and Colombian banking rules generally restrict creditors from initiating or continuing collection or enforcement actions, or creating liens over the financial institution's assets, during the possession process. If the financial institution is ultimately liquidated, certain savings instruments, including deposits, are excluded from the estate and paid prior to other liabilities, and the remaining claims are satisfied in accordance with statutory priority rules, with subordinated debt ranking junior to external liabilities and senior only to equity.

Deposit insurance—troubled financial institutions

Subject to specific limitations, Fogafin is authorized to provide equity (whether or not reducing the par value of the recipient’s shares) and/or secured credits to troubled financial institutions, and to insure deposits of commercial banks and certain other financial institutions.

To protect the customers of commercial banks and certain financial institutions, Resolution 1 of 2012 of the board of directors of Fogafin, as amended, requires mandatory deposit insurance. Banks must pay an annual premium of 0.30% of total funds received on savings accounts, checking accounts, certificates of deposit and other deposits, which is paid in four quarterly installments. If a bank is liquidated, the deposit insurance will cover the funds deposited by an individual or corporation with the bank up to a maximum of COP 50,000,000, regardless of the number of accounts held.

Risk management systems

Commercial banks must have risk administration systems to meet the SFC minimum standards for compliance and to avoid and mitigate the following risks: (i) credit; (ii) liquidity; (iii) market; (iv) operational; (v) money laundering and terrorism; (vi) counterparty; (vii) interest rate risk in the banking book; and (viii) country risk.

Through External Circular 18 of 2021, the SFC issued the regulatory framework for the Comprehensive Risk Management System (Sistema Integral de Administración de Riesgos, or SIAR), which has been in effect since June 1, 2023, except for certain provisions related to risk data aggregation and reporting, which became effective on December 31, 2023. These provisions require financial entities to have a global vision of the risks to which they are exposed, since it integrates the management of credit, market, operational, liquidity, counterparty, guarantee, insurance and country risks.

Internal control system framework

The SFC updated its Internal Control System Framework with External Circular 8 of 2023, aiming to converge on international best practices and promote the development of robust corporate governance structures, adopting the recommendations of the Internal Control—Integrated Framework of the Committee of Sponsoring Organizations of the Treadway Commission (COSO), the Three Lines Model of the Chartered Institute of Internal Auditors (IIA) and the guidelines defined by the Basel Committee on Banking Supervision (BCBS) on corporate governance. These new rules came into effect on May 16, 2024.

Cybersecurity regulation

External Circular 7 of 2018 issued by the SFC, modified by External Circular 33 of 2020, contains the cybersecurity risk framework for financial institutions. These rules were adopted to enhance cyber risk management and promote the adoption of best practices. The framework (i) provides financial entities with a set of minimum requirements for information security and cybersecurity management; (ii) defines a single taxonomy to standardize the reporting of metrics and incidents related to information security and cybersecurity; and (iii) adopts the Traffic Light Protocol (TLP). External Circular 004 of 2024 issued by the SFC includes requirements for financial institutions to review the cybersecurity conditions of critical third-party providers; and rules over the framework of open finance services, including the limitation of web-scraping.

Anti-money laundering provisions for financial institutions

The regulatory framework to prevent and control money laundering is contained in, among others, Decree 663 of 1993; External Circular 6 of 2025; and the Colombian Criminal Code, as amended.

Colombian laws adopt the latest guidelines related to anti-money laundering and other terrorist activities established by the Financial Action Task Force on Money Laundering ('FATF'). Colombia, as a member of the GAFI-SUD (a FATF-style regional body), follows the FATF’s recommendations. In 2022, the SFC introduced new requirements for financial entities and their risk management systems for Anti-Money Laundering/Combating the Financing of Terrorism (AML/CFT) – in Colombia referred to as the Sistema de Administración del Riesgo de Lavado de Activos y de la Financiación del Terrorismo ('SARLAFT'). The new SARLAFT requirements include due diligence on ultimate beneficial owners and politically exposed persons; countermeasures to circumstances that involve high-risk countries; information requirements in international and domestic transactions; supervision in correspondent activities; enhancement of technology tools, among others.

Financial institutions must cooperate with the appropriate authorities to prevent and control money laundering and terrorism financing. Finally, the Colombian Criminal Code introduced criminal rules and regulations to prevent, control, detect, eliminate and adjudicate all matters related to terrorism financing and money laundering, including the omission of reports on cash transactions, mobilization or storage of cash, and the lack of controls.

Consumer protection

Law 1328 of 2009 establishes a set of rights and responsibilities for customers of the financial system and a set of obligations for financial institutions in order to minimize disputes. This law also gives foreign banks more flexibility to operate in Colombia through 'branches.'

Pursuant to External Circular 23 of 2021 issued by the SFC, Smartsupervision technology was implemented to provide a mechanism for the detailed monitoring of petitions, complaints or claims (Peticiones, Quejas & Reclamos or 'PQR'). This mechanism, provided by the SFC, allows financial consumers to submit petitions, complaints or claims and for them to be answered in due time and in an appropriate manner.

Regulatory framework for Colombian subsidiaries that are non-participants in the financial sector

Grupo Cibest and its Colombian subsidiaries that do not provide financial services are governed by the laws and regulations embodied in the Colombian Civil Code and the Colombian Commercial Code, as well as any regulations issued by the SIC and the Superintendency of Corporations or any other type of special regulations that may be applicable to the commercial and industrial activities carried out by Grupo Cibest and these subsidiaries.

Panama

Regulatory framework for Panamanian banking institutions

The banking business in Panama is regulated by Law Decree 9 of 1998 (as amended to date, including by means of Law Decree 2 of 2008, the 'Banking Law'). Pursuant to the Banking Law, the Superintendency of Banks of Panama (the Superintendency of Banks of Panama), as banking supervisor, has the power to issue accords and resolutions to regulate the banking system.

To implement Basel III capital standards, the Superintendency of Banks of Panama issued Accord 1-2015 establishing capital adequacy standards. This accord establishes new requirements for the composition of a banking entity's capital base,

as well as for capital adequacy ratios, including the core Tier 1 capital ratio and the Tier 1 capital ratio, all in line with Basel III standards. This accord took effect in June 2016 and, as of January 1, 2019, the new rules were fully implemented.

In addition, in October 2023, the Superintendency of Banks of Panama issued Accord 5-2023, which establishes rules on the capital conservation buffer to ensure that banks accumulate reserves that can be used in the event of incurring losses. According to this new Accord, banks must establish a capital conservation buffer of 2.5% of risk-weighted assets (credit, market and operational), comprised of ordinary primary capital and in addition to all minimum regulatory capital requirements. This accord took effect on July 1, 2024, and banks have until July 2026 to comply.

In July 2025, the Superintendency of Banks issued a regulation introducing additional capital buffer requirements for domestic systemic banks, which will take effect in July 2027 with a transition period through July 2032. These additional capital buffers may require affected banks to maintain higher capital levels, which could limit capital distributions (such as dividends) or impact return on equity (ROE).

In terms of liquidity, banks with a general license are required to maintain 30% of their global deposits in liquid assets (which include short-term loans to other banks and other liquid assets) of the type prescribed by the Superintendency of Banks of Panama. Additionally, banks with a general license are required to maintain assets in Panama of not less than 60% of their local deposits or any other percentage set by the Superintendency of Banks of Panama. Under the Banking Law, central bank deposits and other similar deposits of international reserves of sovereign states enjoy immunity from seizure or attachment proceedings. In 2018, the Superintendency of Banks of Panama, moving forward with the implementation of Basel III liquidity standards, issued a Liquidity Coverage Ratio ('LCR') Accord that requires general license banks to maintain high-quality liquid assets in relation to their short-term net cash outflows. Daily compliance with the LCR (high-quality liquid assets as a percentage of net cash outflows) was implemented progressively, starting in December 2018 with a compliance rate of 25%, reaching a compliance rate of 100% in December 2022.

In 2025, the Superintendency of Banks of Panama issued a regulation that expanded the scope of High-Quality Liquid Assets (HQLA) and revised credit rating criteria applicable to certain financial instruments. In addition, another standard amended existing regulations to recognize the Panama Guarantee Fund as an eligible credit risk mitigant for capital adequacy purposes.

The Superintendency of Banks of Panama has also issued regulations consistent with Basel III standards regarding capital requirements for market risk in the trading book, regulations to improve country risk management and operational risk management, as well as governance and controls relating to investment in securities.

Regarding credit risk, in March 2016, the Superintendency of Banks of Panama issued Accord 3-2016, which establishes rules for the determination of risk-weighted assets applicable to on- and off-balance-sheet credit exposures, which are more risk-sensitive in line with Basel II and Basel III standards. This accord introduced the treatment of counterparty exposures in derivative transactions, as well as credit risk mitigation techniques, such as the treatment of financial guarantees.

In Panama, banks are prohibited from granting, directly or indirectly, to any natural or legal person, including any entity that is part of a bank's economic group, any loan or line of credit, guarantee or any other obligation (other than credit facilities fully secured by deposits in the bank) in favor of such person that exceeds at any time, individually or jointly, 25% of the bank's total regulatory capital. Related party obligations (as defined in the applicable regulations) exceeding (i) 5% of its total capital, in the case of unsecured transactions, and (ii) 10% of its total capital, in the case of secured transactions (other than loans secured by deposits with the bank) are prohibited.

The Superintendency of Banks of Panama is empowered to assume administrative and operational control of a bank, including the possession of its assets and the exercise of its administration, to defend the best interests of the bank's depositors and creditors, under any of the following situations: (i) at the request of the bank; (ii) if the bank is unable to continue its operations without endangering the interests of depositors; (iii) as a consequence of the evaluation of an advisor's report; (iv) failure to comply with measures ordered by the Superintendency of Banks of Panama; (v) if the bank conducts its operations in an illegal, negligent or fraudulent manner; (vi) if the bank has suspended payment of its obligations; and (vii) if the Superintendency of Banks of Panama determines that the capital adequacy, solvency or liquidity of the bank has deteriorated so as to require the intervention of the Superintendency of Banks of Panama. Upon expiration of the administrative control period, the Superintendent will decide whether to proceed with the reorganization of the bank, the compulsory liquidation of the bank or the return of administrative and operational control to the directors or legal representatives of the bank.

The Superintendency of Banks of Panama is also in charge of the supervision and oversight of the trust business, regulated by (i) Law 1 of 1984, which establishes aspects such as minimum requirements for trust contracts, characteristics of trusts,

rights and responsibilities of settlors, trustees and beneficiaries and (ii) Law 21 of 2017 which strengthens the supervisory and regulatory capacities of the Superintendency of Banks of Panama with respect to the trust business and imposes rules with respect to trust licensing, accounting, corporate governance and reporting.

Economic and Business Environment and Regulatory Framework

Operations primarily conducted in Panama are characterized by an economy that uses the U.S. dollar as legal tender, a service-oriented financial sector, and an open economy with a high degree of integration into international markets. The country’s economic performance may be influenced by factors such as trade growth, financial services, foreign investment, logistics activity, and global economic conditions.

Panama updated its preferential mortgage interest framework to modernize subsidies for primary residence loans and align them with housing policy. The reform introduced tiered interest subsidies for new mortgages up to a defined threshold, administered through licensed banks. Later adjustments temporarily reinstated the prior regime and subsequently extended subsidy terms and revised calculation methods, effective January 2026. These measures form part of Panama’s housing finance system and may influence mortgage origination volumes, pricing, and operational processes within the local banking sector.

Other regulations in Panama

Securities market activities in Panama are subject to the supervision, control, and oversight of the Superintendency of the Securities Market Panama (the 'Superintendency of the Securities Market of Panama'). These activities are mainly regulated by Law Decree 1 of 1999, as amended to date (the 'Securities Law'), which establishes the regulatory framework for the Panamanian securities market. Among the most important aspects of the Securities Law are: (i) the establishment of a system of coordination and cooperation among financial supervisors, which allows for a broader supervision of financial conglomerates; (ii) the creation of the Superintendency of the Securities Market of Panama as a supervisory entity replacing the former National Securities Commission; (iii) the authorization of the Superintendency of the Securities Market of Panama to carry out consolidated supervision, as the national supervisor of intermediaries with agencies abroad, and to enter into cooperation agreements with foreign supervisors to facilitate consolidated supervision; (iv) the regulation of foreign currency exchange as a securities activity; (v) the introduction of provisions regarding the clearing and settlement of securities and financial instruments; and (vi) the creation of new participants to promote over-the-counter transactions.

The main aspects of the securities business covered by the Securities Law and the accords and resolutions issued by the Superintendency of the Securities Market are (i) licensing requirements for securities brokers, investment advisors, fund managers and self-regulatory organizations; (ii) registration requirements for risk rating agencies, providers of securities prices, securities, public offerings, funds and providers of securities market administrative services; (iii) authorization to solicit proxy votes in respect of registered securities; (iv) public offering notification requirements for the acquisition of registered shares; (v) options, futures and derivatives contracts; (vi) custody, clearing and settlement of securities; (vii) penalty and sanction procedures; (viii) voluntary liquidation, reorganization and bankruptcy of broker-dealers, self-regulatory organizations, funds and fund administrators; (ix) reporting by registered issuers of securities, broker-dealers, investment advisers, funds, fund administrators, self-regulatory organizations and other registered entities; (x) on-site inspection of broker-dealers, investment advisers, self-regulatory organizations, funds, fund administrators, securities market administrative service providers, securities pricing providers and rating agencies; (xi) capital requirements, liquidity requirements, risk assessment, confidentiality, conflict of interest, suitability, compliance and asset laundering of securities brokers; and (xii) communication of material events by registered securities issuers.

In May 2024, the Superintendency of the Securities Market issued Accord 5-2024, which set requirements for obtaining a securities firm license. Securities firms must provide an operating manual that must contain: (i) a detailed, step-by-step description of the entity's processes, including orders, times, flow charts and persons responsible for all activities carried out by the securities firm under its business plan; and (ii) the rules or policies of the securities firm. In addition, the securities firm must make a brochure of fees, approved by its board of directors, available to clients on its website.

Panama has also enacted a series of laws to prevent, detect and sanction money laundering activities such as: (i) Executive Decree 947 of 2014 reorganizing the Financial Analysis Unit for the Prevention of Money Laundering, Terrorism Financing, and Financing of the Proliferation of Weapons of Mass Destruction (the 'UAF'); (ii) Law 23 of 2015 adopting measures to prevent money laundering, terrorism financing, and financing of the proliferation of weapons of mass destruction; and (iii) Executive Decree 35 of September 6, 2022, which regulates Law 23 of 2015 and establishes the measures that banks and other regulated entities must adopt for the prevention, identification and reporting to the UAF of suspicious transactions.

Law 23 of 2015 and Accord 7-2015 issued by the Superintendency of Banks of Panama define regulated financial entities for purposes of money laundering, financing of terrorism or any other illicit activity.

Following the recommendations of the Financial Action Task Force ('FATF'), Panama enacted Law 70 of 2019, which amended the Criminal Code imposing the penalty of imprisonment for persons who engage in tax fraud, and Law 254 of 2021, which includes provisions on tax transparency, prevention of money laundering, and accounting records, due diligence, and beneficial owners.

In October 2016, Panama approved an agreement with the U.S. government to improve international tax compliance and to implement FATCA; in February 2017, it approved the Convention on Mutual Administrative Assistance in Tax Matters; and in October 2020 it approved the Multilateral Convention to Implement Tax Treaty Related Measures to Prevent Base Erosion and Profit Shifting. All the above has enabled the exchange of information on tax matters between Panamanian tax authorities and a broader set of countries. In May 2017, the obligations and responsibilities of banking institutions with respect to due diligence procedures to identify reportable accounts were set forth in regulations, as well as the responsibilities with respect to the control measures and information requirements necessary to comply with international agreements. In addition, in February 2025, the Superintendency of Banks of Panama issued a regulation adopting an indicative guide on Politically Exposed Persons (PEPs), expanding PEP definitions, mandating enhanced due diligence, extended monitoring up to two years post-tenure, and requiring updated PEP categorization lists by obligated entities, in line with FATF Recommendation 12 and best international AML/CFT practices.

Cybersecurity regulation

Panama has several laws that regulate incidents related to technology systems.

The Criminal Code establishes penalties between two and eight years in prison to anyone who unduly enters or uses a database, network, or computer system, as well as to anyone who unduly seizes, copies, uses or modifies the data in transit or contained in a database or computer system, or interferes, intercepts, hinders or prevents its transmission. It also establishes the same penalties for anyone who alters, modifies, or manipulates programs, databases, networks, or computer systems to the detriment of a third party.

Law 81 of 2019 and Executive Decree No. 285 of 2021 establish the principles, rights, obligations, and procedures that regulate the protection of personal data. Law 81 of 2019 requires the persons responsible for the processing of personal data contained in databases to establish protocols, processes and procedures for management and secure transfer, protecting the rights of data owners over their data.

In 2013, Panama approved the Budapest Convention on cybercrime, by which Panama committed, among other things, to adopt legislative measures related to computer crimes and crimes against confidentiality, integrity and availability of data and computer systems. Additionally, through Resolution No. 17 of September 10, 2021, the National Council for Government Innovation approved the National Cybersecurity Strategy for the period 2021-2024.

The Superintendency of Banks of Panama, through Accord 8-2010, established provisions for the integral comprehensive management of risks to banks, including information technology risk and, through Accord 3-2012, developed the measures that banks must adopt in relation to information technology risk. These include, among others, establishing policies, strategic plans and procedures, as well as allocating necessary resources for information technology management and having an information technology committee, to oversee the management of the bank's information technology. Additionally, Accord 6-2011 established the guidelines for electronic banking and related risk management and Accord 6-2016 establishes guidelines for risk management regarding money laundering, terrorism financing and financing of the proliferation of weapons of mass destruction, which may arise with respect to new products and new technologies.

El Salvador

Regulatory framework for El Salvador banking institutions

El Salvador's Supervision and Regulation of the Financial System Law establishes the institutional framework for regulatory and supervisory bodies, mandating the Superintendency of the Financial System (SSF) to oversee all financial entities and the Central Reserve Bank (BCR) to issue necessary regulations. Its main objectives are to preserve stability, ensure efficiency, transparency, and security, and align with international best practices through consolidated supervision, risk management, and corporate governance.

The Banking Law establishes the legal framework for the authorization, operation, and supervision of banking institutions, defining requirements for capital adequacy, liquidity, liquidity reserve requirements, corporate governance, and risk

management. The law regulates key aspects such as deposit-taking, lending, foreign exchange operations, and the provision of payment services, ensuring prudential standards aligned with international best practices. It also mandates liquidity reserve requirements determined by the Superintendency of the Financial System based on deposits and liabilities, and sets rules for transparency, consumer protection, and reporting obligations. Over time, the law has been amended to strengthen stability and adapt to changes in the market , including the repeal of certain chapters in 2025 following the enactment of the Law for the Stability of the Financial System and Deposit Guarantee, which strengthened deposit insurance regime.

Reserve Requirements

According to the Temporary Technical Standards (NPBT‑16), which took effect on October 8, 2025, reserve requirements range from 1% to 16%, depending on the type of deposit or obligation. Entities must maintain a balance in the 'Cash Holdings' account equal to or greater than 68% of the amount reported as of September 30, 2022. These Temporary Standards expire on March 24, 2026.

Asset and Liquidity Risk Requirements

The Technical Standards for Liquidity Risk Management (NRP‑05) regulate minimum guidelines and methodologies for managing liquidity risk in financial entities. The Central Reserve Bank, effective January 2, 2026, introduced the following ratios: High-Quality Liquid Assets (HQLA), the Liquidity Coverage Ratio (LCR), and the Net Stable Funding Ratio (NSFR), with progressive compliance targets through 2031.

The Technical Standards for Liquid Assets (NRP‑87), effective February 8, 2025, require banks to maintain an average of 3% in high-quality liquid assets, defining eligible instruments, calculation methodology, and reporting obligations.

The standards aim to bring banks to the required level of liquid assets within 16 months, starting from February 8, 2025, and ending by May 5, 2026. Liquid assets must be composed of easily realizable foreign securities, deposits in foreign banks, or deposits at the central bank.

Monetary Integration Law

In November 2000, El Salvador's Congress enacted the Monetary Integration Law, adopting the U.S. dollar as the sole legal currency at a fixed exchange rate of 8.75 SVC per USD 1.00. Since its implementation, all financial operations – including deposits, loans, pensions, securities offerings, and accounting records – must be expressed in U.S. dollars. Transactions made in Salvadoran colones before the law’s effective date were converted at the established exchange rate.

Investment Funds Law

Enacted in October 2014, the Investment Funds Law aims to promote economic activity by granting investors access to capital markets, diversifying the market and channeling of savings into productive sectors. It establishes the regulatory framework for the supervision of investment funds, their participation shares, and the companies that manage them, as well as other related participants. It also regulates the marketing of participation shares in foreign investment funds.

The law provides for the creation of investment fund managers, responsible for all actions, contracts, and operations necessary for fund administration. Technical Standards issued by the Central Reserve Bank in October 2016 govern permitted transactions, disclosure requirements, and risk management.

Financial Inclusion

Enacted in 2015, the Financial Inclusion Law promotes access to formal financial services through electronic money and simplified accounts subject to balance and transaction limits. Technical Standards NASF‑11, in effect since 2022, allow banks and other entities to operate through physical, digital, and mobile correspondents, expanding coverage in underserved areas under defined risk and reporting requirements.

Consumer Protection Law

In force since September 2005, the law covers all commercial activities, including online sales (e‑commerce), and sets basic protection and legal security for consumers. In June 2024, reforms tightened price transparency, limited the collection/transfer of personal and credit data without authorization, created procedures to remove dangerous products/

services from the market, added compliance measures. These provisions are complemented by technical standards issued by the Central Reserve Bank.

For financial services, the law imposes special rules on banks and other providers: a cap on default interest of ≤5% per year, respect for the consumer’s choice of insurer, and enhanced digital channel/e‑commerce obligations.

Bitcoin Law

Congress enacted bitcoin as legal tender in El Salvador, effective September 7, 2021. The law required the Central Reserve Bank to register bitcoin service providers and issue technical standards (NRP‑29) and guidelines for bitcoin and dollar services, applicable to banks, cooperative banks, savings and credit entities, and electronic money issuers.

On January 29, 2025, the law was amended to remove bitcoin’s status as legal tender and eliminate the term “currency” when referring to bitcoin, while continuing to allow bitcoin to circulate.. Acceptance became voluntary for private entities and individuals, while tax payments and transactions with the State must be made in U.S. dollars. Public entities are no longer obliged to provide conversion mechanisms. The Central Reserve Bank and the Superintendency issued updated technical regulations to align with these changes, maintaining oversight of bitcoin service providers under the new framework.

Cybersecurity regulation

The Technical Standards for Information Security Management (NRP‑23), effective July 1, 2020, set minimum cybersecurity requirements based on each entity’s size, risk profile, and operations. On March 8, 2022, NRP‑32 introduced mandatory controls for digital channels, including secure data handling and authentication. In May 2022, the government adopted a National Cybersecurity Policy to strengthen the legal framework and create mechanisms for information sharing and cybercrime response.

On November 23, 2024, the Cybersecurity and Information Security Law came into force, creating the State Cybersecurity Agency (ACE) to classify critical infrastructure operators and submit them for presidential ratification. Banks may be designated as essential service providers only if confirmed by the President of the Republic. Once classified, they must comply with ACE regulations, implement robust incident‑response plans and report cybersecurity breaches.

AML/CFT Standards

On October 17, 2025, El Salvador’s Special Law for the Prevention, Control and Sanction of Money Laundering, Terrorist Financing and Financing of the Proliferation of Weapons of Mass Destruction took effect, replacing the previous AML law. The new law strengthens the national Financial Investigation Unit (FIU), creates an interagency committee, CIPLAFT, reduces the number of obligated entities while adding digital‑asset providers and political parties, and raises the cross‑border cash declaration threshold. It adopts a risk‑based approach that prohibits blanket de‑risking and requires individual customer assessments.

Key changes include: beneficial ownership rules, reporting timelines, compliance, an enhanced sanction regime with severe/very severe categories and significant fines (including personal ineligibility for directors/managers), and migration to the United Nations goAML reporting platform. The UIF must issue guidelines within six months, with institutions given twelve months to adapt; until then, existing 2022–2023 standards remain applicable. These changes form part of El Salvador’s ongoing efforts to address the findings and recommendations of GAFILAT’s fourth round mutual evaluation and to align its AML/CFT framework with international standards.

The Instructive for the Prevention, Detection and Control of Money and Asset Laundering, Terrorist Financing and Financing of the Proliferation of Weapons of Mass Destruction, issued on June 7, 2022, establishes rules for cash transaction monitoring, identity verification prior to onboarding, and reporting of international transactions. Amendments effective September 27, 2023, reinforced annual internal audits, mandatory reporting to the Board and Compliance Officer, and enhanced profiling for high-risk customers and Politically Exposed Persons (PEPs).

Technical Standards for Money and Asset Laundering Risk Management, Terrorist Financing and Financing of the Proliferation of Weapons of Mass Destruction (NRP‑36), issued by the Central Reserve Bank and effective since October 10, 2022, align supervisory obligations with the UIF instructive and set detailed guidelines for governance, risk-based controls, detection and reporting of unusual operations, and overall AML/CFT compliance.

Financial stability regulations (troubled financial institutions)

On May 3, 2022, the Central Reserve Bank’s Technical Standards for the Preparation of Financial stability recovery plans entered into force, requiring institutions to maintain plans with stress scenarios, indicators, trigger processes, and communication protocols.

In 2025, the Law for the Stability of the Financial System and Deposit Guarantee was approved, establishing a resolution regime for failing institutions, and establishing the Financial Stability Committee and the Deposit Guarantee Institute (IGD), and repealing Titles IV and VI of the Banking Law, related to regularization, intervention, liquidation and the prior IGD framework. It also includes a gradual increase in the premiums that banks contribute to the IGD, rising from 0.10% to 0.15% of average, calculated quarterly on the daily average of total deposits, with the IGD board empowered to set higher risk‑based rates.

Credit card system

The Credit Card System Law, enacted in November 2009, establishes the legal framework for El Salvador’s credit card system, regulating the authorization of card issuers, credit card contracts, statements of account, relationships with affiliated merchants, and enforcement/sanctions for violations. Reforms effective July 20, 2022 strengthened consumer protections by eliminating membership fees on cards with limits ≤ US$2,000, prohibiting unsolicited card issuance and persistent direct promotion, removing overdraft surcharges when no purchase transactions occur, and barring cancellations due to inactivity without prior notice.

Digital assets issuance

The Digital Asset Issuance Law entered into force on February 2, 2023, creating a legal framework for public offerings of digital assets and establishing an alternative market to traditional securities. It introduced rules for issuers and service providers, aiming to promote innovation while ensuring investor protection.

Personal data protection

On November 23, 2024, El Salvador’s Personal Data Protection Law entered into force, guaranteeing the right to privacy and informational self‑determination and establishing rules for the collection, processing, storage, and transfer of personal data. The law grants ARCO rights (rights of access, rectification, cancellation, and opposition) and requires prior consent or legal cause and security measures for data processing. In 2025, the ACE, as the supervisory authority, issued policies to regulate the handling and protection of personal data by public and private entities.

Investment banking

In 2025, El Salvador approved the Investment Banking Law, which establishes a regulatory framework for specialized entities authorized to provide complex financial services, including structured financing, mergers and acquisitions advisory, and digital asset management. The law introduces a combined licensing regime for financial intermediation and digital asset service provision, subject to applicable regulatory oversight.

Alternative Private Investment Funds

In 2025, El Salvador enacted the Alternative Private Investment Funds Law, which provides a framework for the formation and operation of private collective investment vehicles targeting sophisticated investors. The law permits investments in both traditional and digital assets and requires compliance with international accounting and auditing standards.

Public security

In 2025, El Salvador remained under a state of exception first declared on March 27, 2022, and extended consecutively, under which certain constitutional guarantees have been suspended nationwide. The measure is not specific to the financial sector. However, it is part of the broader operating context and should be taken into account when assessing of the legal and institutional environment. Bancoagrícola continues to conduct its operations under the applicable regulatory framework and maintains its governance and compliance standards.

Guatemala

Regulatory framework for Guatemalan banking institutions

The Guatemalan financial system operates under a regulatory framework primarily established by Decree No. 19-2002, the Banks and Financial Groups Law (Ley de Bancos y Grupos Financieros) and Decree No. 18-2002, the Financial Supervision Law (Ley de Supervisión Financiera). These laws define the structure and organization of the financial system and grant supervisory authority to the Guatemalan Superintendency of Banks, which is responsible for overseeing financial institutions and ensuring compliance with prudential and regulatory standards.

The Financial Supervision Law establishes the Guatemalan Superintendency of Banks and regulates its functions. The law establishes the scope of the Superintendency as the entity responsible for the supervision and inspection of the financial system in Guatemala, ensuring its stability and security.

Cybersecurity regulation

Resolution JM-98-2025, the Regulation for the Administration of Technology Risk (Reglamento para la Administración del Riesgo Tecnológico) establishes minimum guidelines that institutions within the financial system must observe for the administration of technology risk, including aspects related to information technology infrastructure, information systems, databases, technology services, information security, cybersecurity, disaster recovery planning, and the processing and/or storage of information. The regulation incorporates a specific chapter on cybersecurity, with management procedures focused on governance, identification, protection, detection, response, and recovery, as well as provisions for the organization of cyber incident response teams and the exchange of information among institutions.

In addition, it regulates the use of artificial intelligence systems, requiring the identification, assessment, and monitoring of associated risks, human oversight, and the application of principles of security, resilience, privacy, transparency, and fairness.

Resolution JM-91-2024, the Regulation on Security Measures in Electronic Channels (Reglamento de Medidas de Seguridad en Canales Electrónicos) establishes minimum security standards for banks, financial institutions, and offshore entities to manage risk in electronic transactions and prevent fraud. It defines electronic channels as platforms used to conduct transactions and exchange information. The regulation establishes a Fraud Risk Monitoring and Prevention Center to analyze complaints, issue alerts, and propose preventive measures to the Risk Management Committee. It also mandates the creation of a User Service Unit responsible for documenting cases, reporting fraud, and promoting education on security in electronic channels.

Other Regulations in Guatemala

Decree No. 67-2001, the Law Against the Laundering of Money or Other Assets (Ley Contra el Lavado de Dinero u Otros Activos), and Governmental Agreement No. 118-2002, Regulations to the Law against the Laundering of Money or Other Assets (Reglamento de la Ley Contra el Lavado de Dinero u Otros Activos) were enacted for the purpose of preventing, controlling, monitoring, and punishing the laundering of money or other assets derived from the commission of any crime. These regulations also established a Special Verification Intendancy (IVE) within the Superintendency of Banks, which is responsible for requesting and receiving information related to financial, commercial, or business transactions that may be linked to money laundering and for reporting such information to the competent authorities.

Resolution JM-117-2009, the Regulation for the Administration of Liquidity Risk (Reglamento para la Administración del Riesgo de Liquidez) establishes rules for banks, financial companies, and offshore entities to manage liquidity risk and their liquidity risk management strategy, based on the credit profile of the institution. These rules include prudential policies and processes to identify, quantify, monitor, and control liquidity risk, the capacity to manage liquidity on a day-to-day basis, and contingency plans to address liquidity problems.

Resolution JM-47-2022, the Regulation for the Administration of Credit Risk (Reglamento para la Administración del Riesgo de Crédito) regulates certain activities of banks, offshore entities, and financing subsidiaries, establishing rules on the minimum information required from applicants and borrowers, as well as the valuation of credit assets.

Resolution JM-67-2023, Amendments to the Regulation for the Administration of Credit Risk (Modificaciones al Reglamento para la Administración del Riesgo de Crédito) amends Resolution JM-47-2022 to facilitate the implementation of the Regulation for the Administration of Credit Risk and help maintain the stability of the supervised banking system.

Resolution JM-86-2023, the Collective Insurance Regulation (Reglamento del Seguro Colectivo) modernizes the legal framework for the management of collective insurance, focusing on optimizing performance and highlighting insurers’ obligations regarding customer service and communication with insured parties, improving transparency and protection for

policyholders. Important aspects of the regulation include changes to placement and coverage guidelines and rules regarding electronic insurance contracting, among others.

Agreement No. 6-2014, Instructions for the Disclosure of Information by Banks, Financial Companies, Microfinance Entities, General Deposit Warehouses, and Holding Companies or Companies Responsible for a Financial Group, as amended by Agreement No. 40-2023, establishes general guidelines for the disclosure of information by such entities. The purpose of the agreement is to ensure that economic agents have access to accurate, sufficient, and reliable data regarding the activities, financial position, risk exposure, and risk assessment of these institutions, promoting transparency, market discipline, and user confidence when making financial decisions.

Agreement No. 41-2023 of the Guatemalan Superintendency of Banks, amending Agreement No. 7-2014, Instructions for the Disclosure of Information by Insurance and Reinsurance Companies, aims to improve transparency and accessibility of certain financial information, including updated disclosure guidelines and requirements regarding timeliness and accuracy.

Decree No. 2-2024, the Credit Cards Law (Ley de Tarjetas de Crédito) regulates credit card operations, promotes transparency between issuers and users, and protects cardholders. The law establishes provisions regarding contracts, interest rates, fees, and sanctions. It highlights the creation of the Financial Services Protection Unit within the Consumer Assistance Directorate, which is responsible for supervising compliance with the law, handling complaints, and imposing sanctions for violations. The law also defines criminal offenses such as card cloning and fraudulent use and imposes administrative fines based on the seriousness of the violations.

Resolution JM-56-2024, Regulations to the Credit Cards Law (Reglamento de la Ley de Tarjetas de Crédito), in force since September 1, 2024, complements the Credit Cards Law. Key aspects include the assessment of applicants’ payment capacity, the prohibition of interest on interest, reasonable calculation of minimum payments, disclosure of credit card terms and conditions, and supervision by the Guatemalan Superintendency of Banks to ensure compliance.

Decree No. 23-2024, the Competition Law (Ley de Competencia) aims to promote competition, strengthen economic efficiency, and protect consumers in Guatemala. It regulates anticompetitive practices such as the abuse of economic power, collusion, price fixing, and restrictions on production. The law establishes general and supplementary scopes of application for sectors regulated by specific laws and creates the Superintendency of Competition as an autonomous entity responsible for investigating violations, imposing sanctions, and promoting competition awareness. Sanctions include fines of up to 200,000 times the daily minimum wage for serious violations. The law incorporates payment capacity assessments and the imposition of interest for noncompliance, and establishes administrative procedures based on principles of due process and procedural efficiency.

International regulations that apply to us

FATCA

FATCA, a U.S. federal tax law enacted in 2010, imposes a 30% withholding tax on 'withholdable payments' made to non-U.S. financial institutions that do not participate in the FATCA program or that fail (or, in some cases, that have affiliates in which they hold an interest of more than 50% and which are also non-U.S. financial institutions that fail) to provide certain information regarding their U.S. account holders and/or certain U.S. investors, such as U.S. account holders and U.S. investors ('U.S. account holders') to the IRS.

Among the countries where Grupo Cibest operates, Colombia and Panama have signed an IGA Model 1 (an intergovernmental agreement between the U.S. and a partner jurisdiction, through which the latter commits to reporting information to the IRS about financial accounts held by U.S. persons in Foreign Financial Institutions ('FFIs') within its territory. Under this model, FFIs report the collected information to their local tax authority, which is responsible for automatically transmitting it to the IRS. In addition, certain subsidiaries of Grupo Cibest located in other countries have transmitted directly to the IRS the information required pursuant to FATCA, since those other countries have not entered into an IGA.

CRS

The Common Reporting Standard ('CRS'), approved by the OECD Council in 2014, is applicable to signatory countries of the Multilateral Competent Authority Agreement ('MCAA') and requires signatory countries to obtain information from their financial institutions and automatically exchange that information with other jurisdictions on an annual basis. The CRS defines (i) which financial institutions are required to report; (ii) the types of accounts covered; and (iii) the due diligence procedures that financial institutions must follow to identify the reporting information.

Among the countries where Grupo Cibest operates, Colombia and Panama have entered into the MCAA. Compliance with the terms of the international conventions signed for the exchange of information under CRS, the laws or any other regulations enforced in the relevant jurisdictions may increase Grupo Cibest compliance costs.

B.9    ESG2

As ESG-related requirements and expectations continue to evolve globally, we monitor and seek to comply with current regulations, including with respect to information that must be reported to our stakeholders under applicable law. See Item 3.D. Risk Factors – We are exposed to environmental, social, governance and sustainability risks that could affect our financial condition and operating results.

In addition, we have adopted policies, including those related to environmental and social risk analysis, environmental management, controversial issues in financing and investment, responsible investment, climate change and sustainable procurement.

Subject to applicable law, we are integrating ESG measures into our business strategy, including retail banking, wealth management, corporate banking, asset management and project finance. To that end, we have set a goal of financing COP 700 trillion before 2030 through credit and other financial services.

In our risk management strategy, we develop a risk map, which is designed to allow us to consolidate relevant information and knowledge from various experts, supplementing the management of traditional financial risks with information on emerging risks such as climate change. As part of this process, social and environmental risks – including climate change – have been integrated for analysis alongside traditional financial risks. This approach allow us to strengthen our climate change responses and prepares us for opportunities in a changing business environment. As part of our climate commitment, we have set goals in financing for the transition to a low carbon economy by 2030.

We have sought to establish an enriching work environment that actively contributes to the well-being of our employees and their families and to their personal development. Our goal is to be the place where talent chooses not only to grow, but also to thrive. Our methodology and measurement tool, the Voice of the Employee, integrates several instruments and touchpoints to listen to our employees and measure their perception of organizational culture, employee wellbeing, and their work experience. We use strategic indicators such as employee engagement, experience versus expectations, intention to remain in the organization, and well-being.

These efforts led to 92% participation in our annual survey carried out in Bancolombia and its subsidiaries, Bancoagrícola, Bam, and Banistmo, which showed 94% favorability in engagement with the following subindicators: 96% would recommend the organization to people they know as an excellent place to work, 93% believe that their job gives them a sense of personal achievement, and 92% feel motivated to exceed expectations in their work.

We also create events and initiatives designed to strengthen our brand and position ourselves as one of the best companies to work for in the countries where we operate. These initiatives were focused on retaining employees with key knowledge and, in turn, attracting new professionals in strategic areas, such as technology, cybersecurity, design, analytics, and artificial intelligence.

The overall ESG strategy guidelines are established by the Board of Directors, which is responsible for defining our strategy and long-term objectives. The Board’s Audit, Corporate Governance and Risk committees have direct responsibility for overseeing ESG issues and strategy, according to the roles and responsibilities of each committee.

C.Organizational Structure

The following chart summarizes the organizational structure of Grupo Cibest and certain subsidiaries, mostly involved in financial or capital market activities

2 Additional ESG-related information is available in our corporate management report, prepared in compliance with Colombian regulations, and on our sustainability website. Information included in our corporate management report or accessible through our website or the website of any of our subsidiaries is not incorporated into this Annual Report.

This chart does not reflect any intermediate holding companies or special purpose vehicles owned by one or more of the entities included in the table.

The following is a list of subsidiaries of Grupo Cibest as of December 31, 2025:

Entity	Jurisdiction<br>of Incorporation	Business	Proportion of Ownership Interest and Voting Power Held by Grupo Cibest 2025
Valores Cibest S.A.S.(1)	Colombia	Investments	100.00	%
Inversiones Cibest S.A.S.(1)	Colombia	Investments	100.00	%
Cibest Investment Management S.A.S.(1)	Colombia	Investments	100.00	%
Cibest Inversiones Estratégicas S.A.S.(1)	Colombia	Investments	100.00	%
Bancolombia S.A.(1)	Colombia	Banking	100.00	%
Fiduciaria Bancolombia S.A. Sociedad Fiduciaria	Colombia	Trust	98.81	%
Banca de Inversión Bancolombia S.A. Corporación Financiera	Colombia	Investment banking	100.00	%
Valores Bancolombia S.A. Comisionista de Bolsa	Colombia	Securities brokerage	100.00	%
Wompi S.A.S.	Colombia	Technology services provider	100.00	%
Renting Colombia S.A.S.	Colombia	Operating leasing	100.00	%
Inversiones CFNS S.A.S.	Colombia	Investments	100.00	%
P.A Tokenización Novus(2)	Colombia	Trust for administration and payments	100.00	%
Negocios Digitales Colombia S.A.S.	Colombia	Payment solutions	100.00	%
Fondo de Capital Privado Fondo Inmobiliario Colombia	Colombia	Real estate investment fund	78.48	%
P.A. Inmuebles CEM	Colombia	Mercantile trust	78.48	%
P.A. Calle 92 FIC-11	Colombia	Mercantile trust	51.01	%
P.A. FIC Edificio Corfinsura	Colombia	Mercantile trust	78.48	%
P.A. FIC-A5	Colombia	Mercantile trust	78.48	%
P.A. FIC Inmuebles	Colombia	Mercantile trust	78.48	%
P.A. FIC Clínica de Prado	Colombia	Mercantile trust	60.47	%
P.A. FIC A6	Colombia	Mercantile trust	78.48	%
P.A. Central Point	Colombia	Mercantile trust	58.86	%
---	---	---	---	---
P.A. Fideicomiso Twins Bay	Colombia	Mercantile trust	78.48	%
Fideicomiso Lote Av San Martín	Colombia	Mercantile trust	78.48	%
P.A. Fideicomiso Lote 30	Colombia	Mercantile trust	78.48	%
Fideicomiso Fondo Inmobiliario Bancolombia	Colombia	Mercantile trust	78.48	%
P.A. Florencia Ferrara	Colombia	Mercantile trust	43.16	%
P.A. Flor Morado Plaza	Colombia	Mercantile trust	78.48	%
P.A. Linz Granz del Rio	Colombia	Mercantile trust	43.16	%
Fideicomiso Selecto Terrazu Etapa 1 Torre 1	Colombia	Mercantile trust	62.79	%
Fideicomiso Selecto Terrazu Etapa 1 Torre 2(3)	Colombia	Mercantile trust	62.79	%
Fideicomiso Lote C6 Carton de Colombia(3)	Colombia	Mercantile trust	43.16	%
Fideicomiso Mokana Recursos(3)	Colombia	Mercantile trust	39.24	%
Fideicomiso River Park(3)	Colombia	Mercantile trust	43.16	%
Valores Simesa S.A.	Colombia	Investments	57.40	%
P.A. FAI Calle 77	Colombia	Mercantile trust	98.00	%
P.A. Nomad Salitre	Colombia	Mercantile trust	98.00	%
P.A. Nomad Central-2	Colombia	Mercantile trust	98.00	%
P.A. Calle 84 (2)	Colombia	Mercantile trust	98.00	%
P.A. Calle 84 (3)	Colombia	Mercantile trust	98.00	%
P.A. Nomad Distrito Vera	Colombia	Mercantile trust	98.00	%
P.A. Nexo	Colombia	Mercantile trust	98.00	%
P.A. Mercurio	Colombia	Mercantile trust	100.00	%
P.A. CEDIS Sodimac	Colombia	Mercantile trust	100.00	%
Wenia S.A.S	Colombia	Technology services	100.00	%
P.A. Wenia	Colombia	Mercantile trust	100.00	%
Nequi S.A. Compañía de Financiamiento	Colombia	Financial services	100.00	%
P.A Títulos de Pagos por Ejecución(4)	Colombia	Mercantile trust	100.00	%
Cibest Panamá Assets, S.A(5)	Panama	Investment	100.00	%
Cibest Capital Panamá, S.A. (before Valores Banistmo S.A.)(5)	Panama	Purchase and sale of securities	100.00	%
Bancolombia Panamá S.A.	Panama	Banking	100.00	%
Sistemas de Inversiones y Negocios S.A. Sinesa	Panama	Investments	100.00	%
Banagrícola S.A.	Panama	Holding	99.17	%
Banistmo S.A.	Panama	Banking	100.00	%
Banistmo Investment Corporation S.A.	Panama	Trust	100.00	%
Leasing Banistmo S.A.	Panama	Leasing	100.00	%
Banistmo Panamá Fondos de Inversión S.A.(6)	Panama	Investment fund holder	100.00	%
Desarrollo de Oriente S.A.(6)	Panama	Real estate	100.00	%
Banistmo Capital Markets Group Inc.(6)(7)	Panama	Purchase and sale of securities	100.00	%
Anavi Investment Corporation S.A.(6)(7)	Panama	Real estate	100.00	%
Steens Enterprises S.A.(6)(7)	Panama	Portfolio holder	100.00	%
Ordway Holdings S.A.(6)(7)	Panama	Real estate broker	100.00	%
Grupo Agromercantil Holding S.A.	Panama	Holding	100.00	%
Banco Agromercantil de Guatemala S.A.	Guatemala	Banking	99.68	%
Seguros Agromercantil de Guatemala S.A.	Guatemala	Insurance agency	79.92	%
Financiera Agromercantil S.A.	Guatemala	Financial services	100.00	%
Agrovalores S.A.	Guatemala	Securities brokerage	100.00	%
Arrendadora Agromercantil S.A.	Guatemala	Financial Leasing	100.00	%
Asistencia y Ajustes S.A.	Guatemala	Roadside and medical assistance services	100.00	%
Serproba S.A.	Guatemala	Maintenance and remodeling services	100.00	%
Servicios de Formalización S.A.	Guatemala	Loans formalization	100.00	%
Conserjeria, Mantenimiento y Mensajería S.A.“En liquidación”	Guatemala	Maintenance services	100.00	%
---	---	---	---	---
Mercom Bank Ltd.(8)	Barbados	Banking	99.68	%
New Alma Enterprises Ltd.	Bahamas	Investments	99.68	%
Bancolombia Puerto Rico Internacional Inc.	Puerto Rico	Banking	100.00	%
Sinesa Cayman, Inc.(9)	Cayman Islands	Banking	100.00	%
Banco Agrícola S.A.	El Salvador	Banking	97.36	%
Arrendadora Financiera S.A. Arfinsa	El Salvador	Leasing	97.37	%
Accelera S.A. de C.V.	El Salvador	Credit card services	97.36	%
Valores Banagrícola S.A. de C.V.	El Salvador	Securities brokerage	98.89	%
Inversiones Financieras Banco Agrícola S.A. IFBA	El Salvador	Holding	98.89	%
Gestora de Fondos de Inversión Banagrícola S.A.	El Salvador	Administers investment funds	98.89	%
Bagrícola Costa Rica S.A.	Costa Rica	Business and management advising	99.17	%
Cibest Capital Holdings USA LLC (before Bancolombia Capital Holdings USA LLC)	United States	Holding	100.00	%
Cibest Capital Advisory Services LLC (before Bancolombia Capital Advisers LLC)	United States	Investment advisor	100.00	%
Cibest Capital Securities LLC (before Bancolombia Capital LLC)	United States	Securities brokerage	100.00	%
Wenia Ltd.	Bermuda	Technology services	100.00	%

(1) Incorporation of subsidiaries due to changes in the corporate structure, whereby Grupo Cibest became the holding company of all financial entities and other companies within the group, including Bancolombia. For further information, see Consolidated Financial Statement, the Explanatory Note and Note 1. Reporting Entity.

(2) Trust for administration and payments consolidated by Inversiones CFNS S.A.S as of December 2025.

(3) Trust funds consolidated through Fondo de Capital Privado Fondo Inmobiliario Colombia: Fideicomiso Selecto Terrazu Etapa 1 Torre 2 as of May 2025; Fideicomiso Lote C6 Cartón de Colombia and Fideicomiso Mokana as of September 2025; and Fideicomiso River Park as of November 2025.

(4) Company consolidated as of December 2025 through Bancolombia.

(5) Investments of Grupo Cibest resulting from the partial spin-off by Banistmo of 100% of the shares it held in Cibest Capital Panamá, S.A. (before Valores Banistmo S.A.), in favor of Cibest Panamá Assets. For further information, see Consolidated Financial Statement, Item 4.A History and Development of the Company and Note 1. Reporting Entity.

(6) On December 18, 2025, Grupo Cibest informed to the market the execution of a share purchase agreement with Inversiones Cuscatlán Centroamérica S.A. for the sale of 100% of the shares of Banistmo. For further information, see Consolidated Financial Statement, Item 4.A History and Development of the Company, Item 10. B. Material Contracts and Note 1. Reporting Entity.

(7) Investments in non-operational stage.

(8) On September 30, 2021, Mercom Bank Ltd shareholder authorized the beginning of an organized and gradual process to transfer of the assets and liabilities of Mercom Bank, Ltd., to Bam. or other companies of Cibest Corporate Group. For further information, see Consolidated Financial Statement, Note 1. Reporting Entity.

(9) On October 5, 2020, the Board of Directors of Bancolombia Panamá (the subsidiary’s parent company), approved the commencement of a gradual wind-up process of Sinesa Cayman, Inc.'s operations (formerly Bancolombia Cayman). For further information, see Consolidated Financial Statement, Note 1. Reporting entity.

D.PREMISES AND EQUIPMENT

As of December 2025, our premises and equipment include Bancolombia's main office located on Avenida Los Industriales in Medellín, as well as other owned and leased facilities primarily located in Colombia, with an approximate total area of 414,351 square meters.

In 2025, our subsidiaries carried out improvements, openings, and renovations of some properties where branches, ATMs, and administrative offices operate. These improvements involved the execution of refurbishing and maintenance activities. The financing for these works was from our funds, totaling approximately COP 183,896 million.

We carried out a comprehensive evaluation of the physical risks affecting Grupo Cibest's ans its subsidiaries facilities, including branches, ATMs, administrative buildings, warehouses, and other assets. This analysis identified that the main risks these assets are exposed to are:

•Landslides: massive movements of rocks, debris, earth, or mud on slopes, which may compromise the stability of infrastructures

•Flooding: the occupation of normally dry areas due to sudden water accumulation, either from river overflow or coastal flooding

•Wildfires: uncontrolled fire spread in forested or wild land areas, affecting surrounding vegetation, flora, and fauna

•Intense rainfall, snow, or hail that may impact infrastructure and operations

•Cyclones: low-pressure systems with intense rains and strong winds that can cause significant damage

In 2026, efforts related to branches, ATMs and facilities will be focused exclusively on ensuring the operational continuity of the properties, prioritizing maintenance, preservation and minor improvements necessary to keep the infrastructure in optimal operating condition and no projects with material scope are planned. We expect to invest approximately COP 63,552 million in the refurbishing of owned and leased properties.

Our total premises and equipment for own use had a net book value as of December 31, 2025, of COP 2,410,891 million and the book value of right of use assets related to branches and rented offices amounts to COP 1,281,175 million. Banistmo, presents premises and equipment for own use net of COP 90,536 million and the book value of right of use assets related to branches and rented offices amounts to COP 188,545 million.

The following table provides information on our main owned and leased facilities where administrative activities, banking business activities, and data processing center operations take place:

Building / Facility	Location	Area (square meters)
Dirección General (Torre Norte, Torre Sur and Torre Oriente and Ciudad del Río)	Medellín, Colombia	117,118
Torre Atrio	Bogotá, Colombia	21,084
Niquía	Bello, Colombia	4,070
Edificio 9211	Bogotá, Colombia	9,578
Torre Barranquilla	Barranquilla, Colombia	8,801
Twins Bay 1	Cartagena, Colombia	2,866
Sucursal 8111	Bogotá, Colombia	679
Banca Personas Cali	Cali, Colombia	3,379
Sucursal Centro Comercial Santa Fe	Bogotá, Colombia	425
Gerencia de Zona Bucaramanga	Bucaramanga, Colombia	1,869

During 2025, in the ordinary course of business, we entered into new lease agreements for properties used in branch operations and self-service halls, resulting in an approximate increase of COP 32,996 million in the right-of-use asset. Notable among these new agreements are properties located in Colombia, which represented an increase in the right-of-use asset by approximately COP 19,135 million.

For further information relating to our branch network, see Item 4. Information on the Company, B5. Distribution Network. Accounting recognition for premises and equipment are described in Note 2 'Significant Accounting Policies' and Note 10 'Premises and Equipment, Net' to the Consolidated Financial Statements.

E.SELECTED STATISTICAL INFORMATION

The following information should be read together with the Consolidated Financial Statements as well as Item 5. Operating and Financial Review and Prospects. This information has been prepared based on our financial records, which are prepared in accordance with IFRS as issued by the IASB and the related interpretations issued by the IFRIC. The consolidated selected statistical information refer to us, including all subsidiaries.

E.1DISTRIBUTION OF ASSETS, LIABILITIES AND STOCKHOLDERS’ EQUITY; INTEREST RATES AND INTEREST DIFFERENTIAL

Average balances for each of the years ended December 31, 2025, 2024 and 2023 have been calculated as the arithmetic average of the last 13 monthly IFRS balances. In addition, the interest rate subtotals are based on the weighted average of domestic and foreign assets and liabilities.

Average statement of financial position

The following tables show, for the years ended December 31, 2025, 2024 and 2023, respectively: (i) average balances for all of our assets and liabilities; (ii) interest earned and interest paid amounts; and (iii) average nominal interest rates/yield for our interest-earning assets and interest-bearing liabilities.

For the year 2025, the average balances of all of our assets and liabilities, as well as the amounts of interest earned and interest paid, include the effects of the classification of Banistmo S.A. as an asset held for sale since December 18, 2025.

	Average statement of financial position and income from interest-earning assets for the fiscal year ended December 31,(2)
	2025(1)				2024				2023
	Average <br>balance	Interest <br>income <br>earned	Average <br>Yield / Rate		Average <br>balance	Interest <br>income <br>earned	Average <br>Yield / Rate		Average <br>balance	Interest <br>income <br>earned	Average <br>Yield / Rate
In millions of COP, except percentages
ASSETS
Interest-earning assets
Interbank borrowings
Domestic activities	163,720	9,373	5.73	%	98,288	8,507	8.66	%	91,258	10,028	11.00	%
Foreign activities	2,049,202	91,368	4.46	%	3,197,413	199,984	6.25	%	2,981,291	187,279	6.30	%
Total	2,212,922	100,741	4.55	%	3,295,701	208,491	6.33	%	3,072,549	197,307	6.40	%
Reverse repurchase agreements and other similar secured loans
Domestic activities	3,245,865	143,663	4.43	%	4,343,154	284,814	6.56	%	2,676,670	292,971	10.90	%
Foreign activities	34,754	1,137	3.27	%	96,642	15,401	15.94	%	73,920	11,777	15.90	%
Total	3,280,619	144,800	4.41	%	4,439,796	300,215	6.76	%	2,750,590	304,748	11.10	%
Debt instruments(3)
Domestic activities	20,819,348	1,582,154	7.60	%	15,172,478	1,144,392	7.54	%	10,599,721	1,376,246	13.00	%
Foreign activities	10,101,857	512,596	5.07	%	15,663,891	1,189,523	7.59	%	16,826,459	281,213	1.70	%
Total	30,921,205	2,094,750	6.77	%	30,836,369	2,333,915	7.57	%	27,426,180	1,657,459	6.00	%
Loans and advances to customers, net
Domestic activities	192,434,712	24,263,989	12.61	%	178,959,009	25,309,441	14.14	%	172,515,187	27,947,473	16.20	%
Foreign activities	56,154,842	4,972,013	8.85	%	87,001,331	7,304,110	8.40	%	89,986,484	7,293,314	8.10	%
Total	248,589,554	29,236,002	11.76	%	265,960,340	32,613,551	12.26	%	262,501,671	35,240,787	13.40	%
Total interest-earning assets
Domestic activities	216,663,645	25,999,179	12.00	%	198,572,929	26,747,154	13.47	%	185,882,836	29,626,718	15.90	%
Foreign activities	68,340,655	5,577,114	8.16	%	105,959,277	8,709,018	8.22	%	109,868,154	7,773,583	7.10	%
Total	285,004,300	31,576,293	11.08	%	304,532,206	35,456,172	11.64	%	295,750,990	37,400,301	12.60	%
Total non-interest-earning assets
Domestic activities	24,551,716	-	-		20,705,057	-	-		23,428,476	-	-
Foreign activities(4)	62,058,763	-	-		23,959,853	-	-		24,158,685	-	-
Total	86,610,479	-	-		44,664,910	-	-		47,587,161	-	-
Total interest and non-interest earnings assets
Domestic activities	241,215,361	25,999,179	10.78	%	219,277,986	26,747,154	12.20	%	209,311,312	29,626,718	14.20	%
Foreign activities(4)	130,399,418	5,577,114	4.28	%	129,919,130	8,709,018	6.70	%	134,026,839	7,773,583	5.80	%
Total	371,614,779	31,576,293	8.50	%	349,197,116	35,456,172	10.15	%	343,338,151	37,400,301	10.90	%

(1)The accumulated value as of December 31, 2025 includes the effects of the classification of Banistmo S.A. as an asset held for sale since December 18, 2025. For more information, see Note 1. Reporting Entity, Note 2.D12. Significant Accounting Policies - Assets Held for Sale and Discontinued Operations, and Note 31. Discontinued Operation.

(2)Our average total assets and total liabilities and stockholder's equity were calculated considering the last 13 monthly IFRS balances.

(3)Tax-exempt income of tax-exempt investment securities has not been calculated on a tax equivalent basis because the effect of such calculation would not be material.

(4)The percentage of total average assets attributable to foreign activities was 35.1%, 37.2% and 39.0%, respectively, for the fiscal years ended December 31, 2025, 2024 and 2023.

	Average statement of financial position and interest paid on interest-bearing liabilities for the fiscal year ended December 31(2)
	2025(1)				2024				2023
	Average <br>balance	Interest <br>income <br>earned	Average <br>Yield / Rate		Average <br>balance	Interest <br>income <br>earned	Average <br>Yield / Rate		Average <br>balance	Interest <br>income <br>earned	Average <br>Yield / Rate
In millions of COP, except percentages
LIABILITIES AND STOCKHOLDERS’ EQUITY
Interest-bearing liabilities:
Checking accounts
Domestic activities	23,927,038	21,270	0.09	%	22,466,429	23,764	0.11	%	22,001,228	22,131	0.10	%
Foreign activities	13,531,155	93,466	0.69	%	17,357,904	81,415	0.47	%	18,432,636	68,657	0.40	%
Total	37,458,193	114,736	0.31	%	39,824,333	105,179	0.26	%	40,433,864	90,788	0.20	%
Saving accounts
Domestic activities	97,619,091	2,498,147	2.56	%	83,711,882	2,676,437	3.20	%	79,151,508	3,463,957	4.40	%
Foreign activities	23,699,277	531,486	2.24	%	27,779,679	463,925	1.67	%	29,694,615	395,108	1.30	%
Total	121,318,368	3,029,633	2.50	%	111,491,561	3,140,362	2.82	%	108,846,123	3,859,065	3.50	%
Time deposits
Domestic activities	64,039,718	5,965,943	9.32	%	60,786,003	6,880,218	11.32	%	54,810,787	7,586,429	13.80	%
Foreign activities	28,248,027	1,219,213	4.32	%	44,402,637	2,089,914	4.71	%	42,637,064	1,787,234	4.20	%
Total	92,287,745	7,185,156	7.79	%	105,188,640	8,970,132	8.53	%	97,447,851	9,373,663	9.60	%
Repurchase agreements and other similar secured borrowing
Domestic activities	1,890,926	151,329	8.00	%	1,068,567	45,253	4.23	%	968,917	160,766	16.60	%
Foreign activities	323,032	9,507	2.94	%	226,752	17,641	7.78	%	54,757	6,968	12.70	%
Total	2,213,958	160,836	7.26	%	1,295,319	62,894	4.86	%	1,023,674	167,734	16.40	%
Borrowings from other financial institutions(3)
Domestic activities	5,173,286	465,515	9.00	%	5,662,586	669,512	11.82	%	5,645,529	798,977	14.20	%
Foreign activities	4,826,075	360,946	7.48	%	8,518,466	680,401	7.99	%	11,769,294	860,019	7.30	%
Total	9,999,361	826,461	8.27	%	14,181,052	1,349,913	9.52	%	17,414,823	1,658,996	9.50	%
Interbank deposits(3)(4)
Domestic activities	73,448	16,713	22.75	%	-	2,958	-	%	71,595	11,260	15.70	%
Foreign activities	-	35	-	%	639,639	19,348	3.02	%	723,898	19,280	2.70	%
Total	73,448	16,748	22.80	%	639,639	22,306	3.49	%	795,493	30,540	3.80	%
Debt instruments in issue
Domestic activities	2,191,337	237,165	10.82	%	3,211,356	591,122	18.41	%	4,602,387	895,296	19.50	%
Foreign activities	5,808,472	445,158	7.66	%	11,248,144	610,990	5.43	%	12,856,710	531,319	4.10	%
Total	7,999,809	682,323	8.53	%	14,459,500	1,202,112	8.31	%	17,459,097	1,426,615	8.20	%
Lease liability
Domestic activities	1,147,601	98,607	8.59	%	1,105,501	95,481	8.64	%	987,982	71,808	7.30	%
Foreign activities	179,074	12,507	6.98	%	703,013	40,065	5.70	%	802,540	42,007	5.20	%
Total	1,326,675	111,114	8.38	%	1,808,514	135,546	7.49	%	1,790,522	113,815	6.40	%
Total interest-bearing liabilities
Domestic activities	196,062,445	9,454,689	4.82	%	178,012,324	10,984,745	6.17	%	168,239,933	13,010,624	7.70	%
Foreign activities	76,615,112	2,672,318	3.49	%	110,876,234	4,003,699	3.61	%	116,971,514	3,710,592	3.20	%
Total	272,677,557	12,127,007	4.45	%	288,888,558	14,988,444	5.19	%	285,211,447	16,721,216	5.90	%
Total non-interest bearing liabilities
Domestic activities	17,096,243	-	-		16,624,159	-	-		15,982,833	-	-
Foreign activities	38,711,644	-	-		2,947,687	-	-		3,298,036	-	-
Total	55,807,887	-	-		19,571,846	-	-		19,280,869	-	-
Stockholders' equity
Domestic activities	35,566,709	-	-		32,207,927	-	-		29,371,732	-	-
---	---	---	---	---	---	---	---	---	---	---	---	---
Foreign activities	7,562,626	-	-		8,528,785	-	-		9,474,103	-	-
Total	43,129,335	-	-		40,736,712	-	-		38,845,835	-	-
Total interest and non-interest bearing liabilities and stockholders’ equity(5)
Domestic activities	248,725,401	9,454,689	3.80	%	226,844,411	10,984,745	4.84	%	213,594,498	13,010,624	6.10	%
Foreign activities(5)	122,889,378	2,672,318	2.17	%	122,352,705	4,003,699	3.27	%	129,743,653	3,710,592	2.90	%
Total	371,614,779	12,127,007	3.26	%	349,197,116	14,988,444	4.29	%	343,338,151	16,721,216	4.90	%

(1)The accumulated value as of December 31, 2025 includes the effects of the classification of Banistmo as an asset held for sale since December 18, 2025. For more information, see Note 1. Reporting Entity, Note 2.D12. Significant Accounting Policies - Assets Held for Sale and Discontinued Operations, and Note 31. Discontinued Operation.

(2)Our average of total assets and total liabilities and stockholder's equity were calculated considering the last 13 monthly IFRS balances.

(3)Includes both short-term and long-term borrowings.

(4)Includes borrowings from banks located outside Colombia.

(5)The percentage of foreign activities over total average liabilities attributable was 35.1%, 36.9% and 39.5%, respectively, for the fiscal years ended December 31, 2025, 2024 and 2023.

Changes in net interest income and expenses- volume and rate analysis

The following table allocates, for domestic and foreign activities, changes in our net interest income to changes in average volume, changes in nominal rates and the net variance caused by changes in both average volume and nominal rate for the year ended December 31, 2025 compared with the year ended December 31, 2024; and the year ended December 31, 2024, compared with the year ended December 31, 2023. Volume and rate variances have been calculated based on movements in average balances over the period and changes in nominal interest rates on average interest-earning assets and average interest-bearing liabilities. Net changes attributable to changes in both volume and interest rate have been allocated to the change due to changes in volume.

	December 31, 2025(1)-December 31, 2024			December 31, 2024-December 31, 2023
	Increase (decrease) due to changes in:			Increase (decrease) due to changes in:
	Volume	Rate	Net Change	Volume	Rate	Net Change
	In millions of COP
Interest-earning assets
Interbank borrowings
Domestic activities	1,762	(896)	866	867	(2,388)	(1,521)
Foreign activities	(60,357)	(48,259)	(108,616)	13,513	(808)	12,705
Total	(58,595)	(49,155)	(107,750)	14,380	(3,196)	11,184
Reverse repurchase agreements and other similar secured loans
Domestic activities	(61,729)	(79,422)	(141,151)	(22,904)	14,747	(8,157)
Foreign activities	(6,365)	(7,899)	(14,264)	3,621	3	3,624
Total	(68,094)	(87,321)	(155,415)	(19,283)	14,750	(4,533)
Debt instruments(2)
Domestic activities	429,066	8,696	437,762	(8,116,489)	7,884,635	(231,854)
Foreign activities	(349,933)	(326,994)	(676,927)	(18,060)	926,370	908,310
Total	79,133	(318,298)	(239,165)	(8,134,549)	8,811,005	676,456
Loans and advances to customers, net
Domestic activities	2,375,393	(3,420,845)	(1,045,452)	1,099,138	(3,737,170)	(2,638,032)
Foreign activities	(2,756,961)	424,864	(2,332,097)	(134,170)	144,966	10,796
Total	(381,568)	(2,995,981)	(3,377,549)	964,968	(3,592,204)	(2,627,236)
Total interest-earning assets
Domestic activities	2,744,492	(3,492,467)	(747,975)	(7,039,388)	4,159,824	(2,879,564)
Foreign activities	(3,173,616)	41,712	(3,131,904)	(135,096)	1,070,531	935,435
Total	(429,124)	(3,450,755)	(3,879,879)	(7,174,484)	5,230,355	(1,944,129)
Interest-bearing liabilities:
Checking accounts
Domestic activities	1,713	(4,207)	(2,494)	474	1,159	1,633
Foreign activities	(10,533)	22,584	12,051	(3,702)	16,460	12,758
Total	(8,820)	18,377	9,557	(3,228)	17,619	14,391
Saving accounts
Domestic activities	885,310	(1,063,600)	(178,290)	214,206	(1,001,726)	(787,520)
Foreign activities	(50,634)	118,195	67,561	(23,282)	92,099	68,817
Total	834,676	(945,405)	(110,729)	190,924	(909,627)	(718,703)
---	---	---	---	---	---	---
Time deposits
Domestic activities	396,543	(1,310,818)	(914,275)	1,051,429	(1,757,640)	(706,211)
Foreign activities	(708,971)	(161,730)	(870,701)	76,300	226,380	302,680
Total	(312,428)	(1,472,548)	(1,784,976)	1,127,729	(1,531,260)	(403,531)
Repurchase agreements and other similar secured borrowing
Domestic activities	49,198	56,878	106,076	18,507	(134,020)	(115,513)
Foreign activities	17,524	(25,658)	(8,134)	12,180	(1,507)	10,673
Total	66,722	31,220	97,942	30,687	(135,527)	(104,840)
Borrowings from other financial institutions
Domestic activities	(54,181)	(149,816)	(203,997)	2,421	(131,886)	(129,465)
Foreign activities	(278,560)	(40,895)	(319,455)	(270,890)	91,272	(179,618)
Total	(332,741)	(190,711)	(523,452)	(268,469)	(40,614)	(309,083)
Interbank deposits
Domestic activities	13,755	—	13,755	(3,523)	(4,779)	(8,302)
Foreign activities	(9,648)	(9,665)	(19,313)	(409)	477	68
Total	4,107	(9,665)	(5,558)	(3,932)	(4,302)	(8,234)
Debt instruments in issue
Domestic-activities	(154,081)	(199,876)	(353,957)	(258,246)	(45,928)	(304,174)
Foreign-activities	(1,103,175)	937,343	(165,832)	(52,660)	132,331	79,671
Total	(1,257,256)	737,467	(519,789)	(310,906)	86,403	(224,503)
Lease liability
Domestic-activities	3,614	(488)	3,126	9,165	14,508	23,673
Foreign-activities	(39,515)	11,957	(27,558)	(6,840)	4,898	(1,942)
Total	(35,901)	11,469	(24,432)	2,325	19,406	21,731
Total interest-bearing liabilities
Domestic-activities	1,141,871	(2,671,927)	(1,530,056)	1,034,433	(3,060,312)	(2,025,879)
Foreign-activities	(2,183,512)	852,131	(1,331,381)	(269,303)	562,410	293,107
Total	(1,041,641)	(1,819,796)	(2,861,437)	765,130	(2,497,902)	(1,732,772)

(1)The accumulated value as of December 31, 2025 includes the effects of the classification of Banistmo as an asset held for sale since December 18, 2025. For more information, see Note 1. Reporting Entity, Note 2.D12. Significant Accounting Policies - Assets Held for Sale and Discontinued Operations, and Note 31. Discontinued Operation.

(2)Tax-exempt income of tax-exempt investment securities has not been calculated on a tax equivalent basis because the effect of such calculation would not be material.

Interest -earning assets-net interest margin and spread

The following table presents our levels of average interest-earning assets and net interest income and illustrates the comparative net interest margin and interest spread obtained for the fiscal years ended December 31, 2025, 2024 and 2023, respectively.

	Interest earning assets yield for the fiscal
	Year ended December 31,
	2025(1)		2024		2023
	In millions of COP, except percentages
Total average interest-earning assets
Domestic activities	216,663,645		198,572,929		185,882,836
Foreign activities	68,340,655		105,959,277		109,868,154
Total	285,004,300		304,532,206		295,750,990
Net interest income(2)
Domestic activities	16,544,490		15,762,409		16,616,094
Foreign activities	2,904,796		4,705,319		4,062,991
Total	19,449,286		20,467,728		20,679,085
Average yield on interest-earning assets
Domestic activities	12.00	%	13.47	%	15.94	%
Foreign activities	8.16	%	8.22	%	7.08	%
Total	11.08	%	11.64	%	12.65	%
Net interest margin(3)
Domestic activities	7.64	%	7.94	%	8.94	%
Foreign activities	4.25	%	4.44	%	3.70	%
Total	6.82	%	6.72	%	6.99	%
Interest spread(4)
Domestic activities	7.18	%	7.30	%	8.21	%
Foreign activities	4.67	%	4.61	%	3.90	%
Total	6.63	%	6.45	%	6.78	%

(1)The accumulated value as of December 31, 2025 includes the effects of the classification of Banistmo as an asset held for sale since December 18, 2025. For more information, see Note 1. Reporting Entity, Note 2.D12. Significant Accounting Policies - Assets Held for Sale and Discontinued Operations, and Note 31. Discontinued Operation.

(2)Net interest income is interest income on loans less interest expense and includes interest earned on investments, as presented in the previous table “Average statement of financial position”.

(3)Net interest margin is net interest income divided by total average interest-earning assets.

(4)Interest spread is the difference between the average yield on interest-earning assets and the average rate accrued on interest-bearing liabilities.

E.2INVESTMENT PORTFOLIO

DEBT INSTRUMENTS PORTFOLIO MATURITY

The following table summarizes the maturities and weighted average nominal yields of our debt instruments at amortized cost and debt instruments at fair value through other comprehensive income as of December 31, 2025:

	Maturity less		Maturity between		Maturity between		Maturity More
	than 1 year		1 and 5 Years		5 and 10 Years		Than 10 Years		Total yield
	Yield %(1)		Yield %(1)		Yield %(1)		Yield %(1)		Yield %(1)
Securities issued or secured by: Foreign currency.-denominated(2):
Colombian Government	6.10	%	5.99	%	6.63	%	-	%	6.13	%
Other financial entities	5.68	%	5.89	%	4.77	%	-	%	5.65	%
Foreign Governments	3.58	%	5.69	%	5.71	%	5.95	%	5.10	%
Corporate bonds	-	%	5.03	%	4.52	%	6.57	%	4.93	%
Subtotal yield	4.00	%	5.28	%	4.78	%	6.53	%	5.04	%
Securities issued or secured by: Peso-denominated(2)
Other financial entities	12.14	%	15.79	%	26.48	%	-	%	19.45	%
Corporate bonds	-	%	12.29	%	-	%	18.79	%	14.95	%
Colombian Government	9.52	%	-	%	-	%	-	%	9.52	%
Other Government entities	5.58	%	-	%	9.13	%	-	%	5.63	%
Subtotal yield	7.15	%	12.44	%	17.77	%	18.79	%	8.44	%
Total yield	6.93	%	6.78	%	5.49	%	14.72	%	7.10	%

(1)Yield was calculated using the internal rate of return (IRR) as of December 31, 2025, includes the effects of Banistmo's classification as asset held for sale since December 18, 2025. For more information see Consolidated Financial Statements, Note 1. Reporting Entity, Note 2.D.12 Material Accounting Policies - Assets held for sale and discontinued operations and Note 31. Discontinued Operation.

(2)Yields on tax-exempt obligations have not been calculated on a tax equivalent basis because the effect of such calculation would not be material.

E.3LOAN PORTFOLIO

Maturity of loans and advances to customers

The following table shows the maturities of our loan portfolio as of December 31, 2025:

	In one year or less	After one year through five years	After five years through 15 years	After 15 years	Total
In millions of COP
Commercial
Corporate	20,753,064	33,460,016	19,965,253	1,828,625	76,006,958
SME	4,070,363	8,539,793	1,060,389	186,436	13,856,981
Others	12,878,463	17,705,008	18,311,380	869,132	49,763,983
Total commercial	37,701,890	59,704,817	39,337,022	2,884,193	139,627,922
Consumer
Credit card	39,952	10,351,902	2,088,614	3,451	12,483,919
Vehicle	136,130	2,704,055	1,955,420	365	4,795,970
Payroll loans	2,209,043	1,812,470	2,800,720	12,514	6,834,747
Others	3,007,927	19,959,456	5,451,660	219,867	28,638,910
Total consumer	5,393,052	34,827,883	12,296,414	236,197	52,753,546
Mortgage
VIS	19,358	300,678	3,002,419	9,851,053	13,173,508
Non-VIS	801,434	683,013	7,694,010	12,064,407	21,242,864
Total mortgage	820,792	983,691	10,696,429	21,915,460	34,416,372
Financial Leases	2,283,462	8,690,954	13,328,370	4,190,343	28,493,129
Small Business Loan	53,098	987,314	20,720	1,880	1,063,012
Total gross loans and advances to customers	46,252,294	105,194,659	75,678,955	29,228,073	256,353,981

In general, the initial term of a loan will depend on the type of guarantee or collateral, the credit history of the borrower and the purpose of the loan. As of December 31, 2025, 59.08% of our loan portfolio had a maturity of five years or less.

Loans interest rate allocation

The following table shows the interest rate allocation of our loan portfolio by type due after one year and within one year or less:

	As of December 31, 2025
In millions of COP
Loans with term of 1 year or more:
Variable Rate
Domestic-denominated	101,354,974
Commercial	76,800,325
Consumer	5,632,930
Mortgage	7,241
Financial Leases	18,914,478
Small business loan	-
Foreign-denominated	10,828,935
Commercial	6,179,840
Consumer	3,437,749
Mortgage	14,243
Financial Leases	15,006
Small business loan	1,182,097
Total	112,183,909
Fixed Rate
Domestic-denominated	80,339,377
Commercial	9,965,789
Consumer	34,273,740
Mortgage	983,453
Financial Leases	7,086,676
Small business loan	28,029,719
Foreign-denominated	17,578,401
Commercial	8,980,078
Consumer	4,016,075
Mortgage	4,977
Financial Leases	193,507
Small business loan	4,383,764
Total	97,917,778
Loans with term of less than 1 year:
Domestic-denominated	33,466,415
Commercial	30,189,409
Consumer	907,889
Mortgage	46,350
Financial Leases	2,277,133
Small business loan	45,634
Foreign-denominated	12,785,879
Commercial	7,512,481
Consumer	4,485,163
Mortgage	6,748
Financial Leases	6,329
Small business loan	775,158
Total	46,252,294
Total gross loans and advances to customers	256,353,981

E.4SUMMARY OF LOAN LOSS EXPERIENCE

Allowance for credit losses to total loans

The following table shows the allowance for credit losses to total loans outstanding for the years ended December 31, 2025 and 2024:

	Year ended December 31,
	2025	2024
Allowance for credit losses to total loans.	5.17 %	5.79 %

The loss allowance for the loan portfolio and financial leasing operations decreased to 5.17% in 2025 from 5.79% in 2024. For more information see Note 6. Loans and advances to customers, net.

This decrease is attributable to:

The allowance for expected credit losses decreased compared to the prior year, primarily driven by the overall improvement in the credit performance of all portfolios compared to 2024. This improvement is evidenced by a reduction in past-due indicators, with loans past due more than 30 days decreasing from 5.20% in 2024 to 3.95% in 2025, and loans past due more than 90 days declining from 3.85% to 2.96% over the same period. Consequently, a lower proportion of exposures was classified under Stage 2 and Stage 3, reflecting a reduction in credit risk deterioration.

In addition with the reclassification of Banistmo in 2025 both the loan and the allowance balance decreased. However, if the reclassification had not been made the ratio of allowance to loans would have been even lower in 2025 because of the high percentage of collateralized loans in Banistmo.

For more information on the classification of Banistmo S.A. as an asset held for sale please refer to Note 1. Reporting Entity, Note 2.D.12 Material Accounting Policies - Assets held for sale and discontinued operations and Note 31. Discontinued Operation. For more information on the variation in the Provision for impairment of loan portfolio and financial leasing operations over the client loan portfolio from 2024 to 2023, please refer to Note 6 of the Consolidated Financial Statements, "Loans And Advances to Customers, Net," under "Loans and financial leasing operating portfolio and Allowance for loans losses" and "Impact of movements in the value of the portfolio and loss allowance by Stage" as well as the "Risk management" note in the "Credit risk" section.

Ratio of charge-offs to average outstanding loans

The ratio of charge-offs to average outstanding loans for the years ended December 31, 2025 and 2024 was as follows:

	Year ended December 31,
	2025	2024
Ratio of charge-offs to average outstanding loans	2.28 %	2.95 %
Commercial	0.88 %	0.68 %
Consumer	8.33 %	11.67 %
Mortgage	0.19 %	0.37 %
Financial Leases	0.95 %	0.83 %
Small Business Loan	3.42 %	8.60 %

The decrease in the charge‑off ratio in 2025 compared with the prior year is mainly attributable to the reduction in the nonperforming consumer loan portfolio throughout the period, supported by lower roll rates and enhanced recovery management effectiveness.

E.5DEPOSITS

Uninsured deposits

An uninsured deposit is any deposit that does not have a mechanism to protect and secure the depositor’s resources (either natural or legal person) in the event of insolvency or settlement of any financial institution.

The amount of uninsured deposits for 2025 and 2024 is COP 189,722,405 and COP 190,359,916, respectively.

The following table shows the time deposits held by us as of December 31, 2025 and 2024, unsecured:

	At December 31, 2025
	Unsecured Peso -<br><br>Denominated	Unsecured<br>Foreign Exchange-<br>Denominated	Total
	In millions of COP
Up to 3 months	21,456,254	10,775,018	32,231,272
From 3 to 6 months	9,461,473	7,056,727	16,518,200
From 6 to 12 months	4,101,153	6,886,199	10,987,352
More than 12 months	12,933,262	1,529,356	14,462,618
Total time deposits	47,952,142	26,247,300	74,199,442			At December 31, 2024
---	---	---	---
	Unsecured Peso -<br>Denominated	Unsecured<br>Foreign Exchange-<br>Denominated	Total
	In millions of COP
Up to 3 months	17,810,529	10,773,646	28,584,175
From 3 to 6 months	7,967,231	6,678,490	14,645,721
From 6 to 12 months	5,179,422	8,418,227	13,597,649
More than 12 months	15,895,727	1,545,271	17,440,998
Total time deposits	46,852,909	27,415,634	74,268,543

For further information about deposits by customers, see Consolidated Financial Statement, Note 15. Deposits by customers.

F.Unresolved Staff Comments

None.

ITEM 5      Operating and financial review and prospects

The following discussion should be read in conjunction with our Consolidated Financial Statements included in this Annual Report.

The following discussion includes information regarding future financial performance and plans, targets, aspirations, expectations, and objectives of management, which constitute forward-looking statements within the meaning of the safe harbor provisions of the U.S. Private Securities Litigation Reform Act of 1995. It is possible that our actual results may differ materially from the results discussed in the forward-looking statements because of several risks and uncertainties. Please see Cautionary Note Regarding Forward-Looking Statements.

In addition, please refer to the discussion in Item 3. Key Information – D. Risk Factors for a description of risks and uncertainties affecting our business and financial results and to Item 16.K – Cybersecurity, for a description of our cybersecurity framework.

A.Operating results

Impact of economic and monetary policies on Grupo Cibest's results

Our operating results are influenced by macroeconomic factors, primarily in Colombia but also in the other countries where we operate. The most significant variables include GDP growth, interest rates, inflation, and exchange rates, particularly the USD/COP exchange rate. Below is a summary of the trends for these variables in Colombia in 2025.

Economic Activity

Colombia's real GDP growth in 2025 was 2.6%, marking a stronger period after growing just 1.6% in 2024. The main drivers were private consumption and public spending, which offset a deterioration in the trade balance caused by higher imports. Household spending grew above GDP, supported by a resilient labor market and remittance income that was at historic high levels. Meanwhile, public spending recorded its highest increase since 2021.

The performance of key GDP components during 2025, compared to 2024 and in real terms (constant prices), was as follows: fixed investment increased by 2.9%, private consumption increased by 3.9%, total public spending increased by 7.5%, imports increased by 10.6%, and exports increased by 1.4%.To put this into context, private consumption accounted for 73% of nominal GDP in 2025, investment accounted for 16% and public spending 15%.

The sectors that exhibited the most dynamic growth during 2025 were arts, entertainment, and recreation (up 9.4%), retail (up 5.1%), and public administration, defense, health, and education, (up 4.4%).

Interest Rates

As of December 31, 2025, the Central Bank's benchmark interest rate, the repo rate, stood at 9.25%, following a reduction of 25 basis points during the year. In the eight Central Bank meetings where interest rate decisions were made, the board of directors opted to cut the repo rate only once, in April 2025, keeping it unchanged for the remainder of the year.

Inflation

Annual consumer inflation (measured by CPI) stood at 5.1% at the end of 2025, remaining very close to the 5.2% recorded at the end of 2024. The components that contributed the most to inflationary pressures in 2025 were shelter (with annual increases of 5.1% for imputed shelter and 5.3% for actual effective shelter), dining out (up 8.0%), and urban transportation (up 9.2%).

Inflationary pressures intensified toward the end of 2025, particularly in services. These pressures were compounded by increases in household electricity and natural gas prices. Moreover, the 23.7% increase in the minimum wage has become a key factor pushing inflation expectations for 2026 higher. Together, these dynamics are expected to result in a more contractionary monetary policy stance going forward.

Exchange Rate

The Colombian peso appreciated by 14.79% against the U.S. dollar in 2025, recovering to COP 3,757 per U.S. dollar by December. This contrasts sharply with the 10.9% depreciation experienced in 2024, when the exchange rate averaged December around COP 4,386 per U.S. dollar.

The recent appreciation of the Colombian peso has taken place against a broadly weakening U.S. dollar and an improvement in global risk appetite, which has increased investor demand for assets in emerging markets and particularly in Latin America. In Colombia, the peso has been further supported by attractive interest rate spread opportunities, as well as by sales of U.S. dollars in the spot market by the Ministry of Finance.

Outlook

Prospects for the Colombian economy, the financial sector in general, and for Bancolombia in particular, are expected to depend on these factors:

Favorable factors for the Colombian economy – medium-term

Unfavorable factors for the Colombian economy – medium term

Rapid economic recovery following the sustained increase in interest rates both locally and globally.<br><br><br><br>The country is expected to maintain responsible monetary policies.<br><br><br><br>Institutional strength will continue to ensure a stable political environment.<br><br><br><br>Democracy in Colombia, along with the separation of powers and checks and balances, underpins the predictability of policy measures and economic pragmatism.<br><br><br><br>The increase in remittances has substantially reduced Colombia’s external vulnerabilities, helping keep the current account deficit below 3.0% of GDP.<br><br><br><br>The Central Bank remains committed to its institutional mandate of targeting inflation and allowing the currency to float freely.<br><br><br><br>The country has a solid cushion of international reserves, which helps mitigate external vulnerabilities stemming from the, albeit declining, still relatively high current account deficit compared to peer countries.<br><br><br><br>Changes in the sociopolitical situation in Venezuela could open new opportunities for investment and bilateral trade in the long term, provided that institutional strengthening and security conditions materialize in that country.

Private investment remains low, which will constrain medium-term economic growth.<br><br>Persistently low investor confidence could impact private investment, posing risks to expectations that GDP growth will return to its potential level, slightly above 3%, in the coming years.<br><br>Low potential growth in the medium term could lead to challenges for public finances or heightened external vulnerabilities.<br><br>Colombia is exposed to the adverse effects of climate change, particularly flooding; over 80% of its population and economic activity is concentrated in approximately 20% of its territory, making it vulnerable to natural disasters.<br><br>Higher inflationary pressures and fiscal deterioration could generate upward pressure on interest rates.<br><br>Public finances could be affected in terms of revenue if international commodity prices decline.<br><br>The country faces significant volatility in international trade due to its dependence on hydrocarbons.<br><br>Low trade openness and an export base reliant on basic commodities imply high vulnerability to price shocks.<br><br>Elevated spending expectations for 2026, relative to revenues, pose risks to marking the highest fiscal deficit in Colombia’s recent history.<br><br>The risk of civil unrest will remain high throughout the 2026–2030 forecast period, reflecting deep societal divisions in Colombia and fragmentation in Congress, which will hinder swift progress in addressing issues such as poverty and low-quality education.<br><br>The recent declarations of an Economic State of Emergency introduce an additional source of political uncertainty that could affect private investment.<br><br>Threats of higher tariffs on trade with the U.S., other commercial sanctions, and reduced economic aid from key U.S. government agencies.

GENERAL DISCUSSION OF THE CHANGES IN RESULTS FOR 2025 VERSUS 2024

The following discussion does not address the changes in results for 2024 versus 2023; the discussion of these changes may be found in our Annual Report on Form 20-F for the year ended December 31, 2024, filed with the SEC.

Summary

Grupo Cibest’s net income decreased in 2025 due to a one-time goodwill impairment related to the Banistmo agreement, but delivered strong operating results on the back of resilient margins and significantly lower provisions for deteriorated loans.

By virtue of the Banistmo sale agreement executed in December 2025, the entity had to be classified as an Asset Held for Sale and recognized as a Discontinued Operation, in accordance with IFRS 5. This classification remains in effect until the transaction is completed. From the classification date onward, its assets and liabilities are presented separately on the balance sheet, and its results are shown separately from continuing operations in the income statement, requiring the restatement of prior comparative periods3.

In Colombia, 2025 was marked by a moderate economic recovery driven by domestic demand, public spending and lower unemployment rates, although high inflation, contractionary monetary policy and ongoing fiscal pressures continued to

3 See note 32 - Discontinued operation.

weigh on the macroeconomic environment. Meanwhile, El Salvador, Panama, and Guatemala experienced moderate economic growth, supported by remittances, low‑to‑moderate inflation, and generally stable macroeconomic conditions, despite their ongoing structural and fiscal challenges.

In contrast to the depreciation observed in 2024, the Colombian peso strengthened throughout 2025, ending the year at COP 3,757.08 per U.S. dollar, an appreciation of 14.79%.

Loans and advances to customers and financial institutions decreased by 8.27% in 2025. This is mainly attributable to the Banistmo agreement, as assets were reclassified as "assets associated with investments in subsidiaries held for sale." It is also worth noting the aforementioned effect of the Colombian peso’s appreciation relative to the U.S. dollar, as balances from foreign subsidiaries are restated in Colombian pesos. Excluding the exchange‑rate effect, the annual variation would have been a 4.91% decrease.

Our operations in Colombia and El Salvador led the acceleration in credit originations, expanding at a faster pace in 2025 than the previous year. Mortgage loans recorded the highest percentage growth, particularly in Colombia, where reduced‑rate programs launched in 2024 remained in place during the first part of 2025.

Consumer lending re-emerged as a key growth driver after two years of contraction, with Bancolombia adopting a progressively more assertive but still-selective appetite for risk, concentrated on lower‑risk segments such as middle‑ and higher‑income individuals. At the same time, credit origination at our digital bank, Nequi, added further momentum, targeting lower‑income segments. Commercial lending posted a modest expansion, as demand from corporates in Colombia and Panama remained subdued. In contrast, our operations in El Salvador and Guatemala continued to display stronger credit dynamics. Commercial loans grew unevenly across regions, as corporate demand remained weak in Panama and showed only modest improvement in Colombia amid the current economic environment and political uncertainty, while El Salvador and Guatemala recorded more constructive activity led by corporate clients. However, given their smaller share of the consolidated portfolio, these operations had a limited impact at the Group level. The total loan book in Colombian pesos grew 9.77% while the portfolio in U.S. dollars decreased 33.42% (a decrease of 43.27% when calculated in Colombian pesos).

Asset quality remained strong in 2025, with the cost of credit declining across all loan categories, most notably in consumer lending, which continued its steady improvement of the last two years. While provision expense in 2024 was partially supported by favorable macroeconomic effects captured in our expected‑loss models, 2025 delivered an even lower full‑year provision expense, mainly attributable to the ongoing improvement of asset quality across the portfolio.

Credit impairment charges came down 11.32% to COP 4,430 billion for 2025 from COP 4,995 billion in 2024, and 30‑day and 90‑day NPL ratios decreased across all segments, reflecting a better credit cycle, especially in Colombia.

Allowance for loan and lease losses represented 134.41% of 30-day past-due loans (excluding accrued interest) at the end of 2025 compared with 112.39% of 30-day past-due loans (excluding accrued interest) at the end of 2024. Based on our expected loss credit models, we expect that these allowances will provide adequate coverage for expected loan losses.

Deposits by customers decreased 5.25% in 2025. This outcome is mainly attributable to the Banistmo sale agreement, as its liabilities were reclassified as "liabilities related to investments in subsidiaries held for sale". The net loans‑to‑deposits ratio stood at 91.9% in 2025, down from 94.3% at the end of 2024. This decline reflects, in part, the reclassification effects of Banistmo’s assets relative to its liabilities and also, the faster annual growth of deposits when compared to the loan book on a consolidated basis.

The net interest and valuation income margin fell to 6.13% in 2025 from 6.39% in 2024.

Net income attributable to equity holders of Grupo Cibest was COP 3,821 billion (COP 4,045 per share, both Common and Preferred Shares, and USD 3.99 per ADS) in 2025, a contraction of 39.04% compared with the COP 6,268 billion of net income attributable to equity holders of Grupo Cibest for 20244.

The average return on stockholder equity was 9.09% in 2025, down from 15.77% in 2024.

As of December 31, 2025, the banks that are part of Grupo Cibest comply with the regulatory capital adequacy requirements in each of the geographies in which they operate.

For further details, see Item 5.B.1 Capital Adequacy.

4 Formerly operating as Bancolombia prior to the establishment of the holding company in May 2025.

Net interest margin and valuation income on financial instruments before impairment on loans and financial leases and off-balance-sheet credit instruments.

Interest income – the sum of interest on loans, financial leases, overnight funds and interest and valuation income from investment securities – was COP 31,488 billion in 2025, down 4.16% from COP 32,854 billion in 2024. The decrease was mainly due to reduced yields in the credit portfolio, reflecting the impact of asset repricing in the ongoing interest rate easing cycle, given that a large portion of the loan book is indexed to variable rates.

In addition, mortgage loans, the fastest‑growing portion of the portfolio remained the lowest‑yielding segment in 2025, particularly in Colombia. Meanwhile, consumer lending, historically the segment with the highest risk‑adjusted returns, resumed its growth trajectory during the year; however, its still‑modest annual expansion was not sufficient to meaningfully offset the downward pressure on lending margins from the effects described above.

As a result, the weighted average nominal interest rate on loans and financial leases was 11.76% in 2025, down from 12.26% in 2024.

Interest expense was COP 12,061 billion in 2025, down 11.88% from COP 13,688 billion in 2024. Several hedging strategies executed during the year helped optimize the liability structure and manage interest rate exposure of the deposit base in Colombia. Also, Grupo Cibest increased the share of low‑cost deposits and adjusted the tenors of term deposits to accelerate repricing in line with the interest rate cycle. These measures largely offset the impact of lower loan yields as previously discussed, supporting overall profitability. Thus, the interest rate paid on interest-bearing liabilities decreased to 4.45% in 2025 from 5.19%, in 2024.

Interest on debt instruments using the effective interest method totaled COP 715 billion in 2025, down 1.86% from COP 728 billion in 2024, whereas total valuation on financial instruments was COP 1,436 billion, a decrease of 13.77% from 2024. The investment portfolio delivered strong results in 2025, extending the positive trend from 2024, with a high liquidity position. This performance was due to the effective execution of positions in the securities portfolio, by means of the valuation of debt instruments, and by efficient liquidity management through short‑term money market instruments, while distribution and sale of derivatives to commercial clients also added to robust income generation.

As a result, net interest income and valuation for 2025 was COP 19,426 billion, a 1.35% increase from COP 19,167 billion in 2024. This represents a net interest and valuation income margin from continuing operations of 6.13%, down 26 basis points from 6.39% recorded in 2024.

Fees and Commissions

The following table lists the principal categories of revenue-generating fees and commissions for the years ended on December 31, 2025, and December 31, 2024, along with year-to-year variations. For further information about the composition of Grupo Cibest and its subsidiaries segments, see Note 3 Operating segments.

Fees and commissions income, gross

As of December 31, 2025

		Banking<br>Colombia	Banking El<br>Salvador	Banking<br>Guatemala	International<br>Banking	Leases	All Other<br>Segments	Total	Discontinued Operation Banking Panama
Revenue of contracts with customers for fees and Commissions	In millions of COP
Credit and debit card fees and commercial establishments		2,815,114	339,492	103,514	1,690	-	-	3,259,810	260,524
Payment and collections		1,136,610	-	-	-	-	-	1,136,610	7,611
Banking services		738,887	183,023	62,462	47,505	-	62,802	1,094,679	118,747
Bancassurance		1,090,888	12	-	-	-	1	1,090,901	64,711
Fiduciary Activities and Securities		-	9,266	893	50	-	634,665	644,874	7,682
Placement of securities		-	3,709	-	-	-	102,943	106,652	-
Acceptances, Guarantees and Standby Letters of Credit		69,154	4,802	1,761	600	-	-	76,317	27,701
Brokerage		-	-	-	-	-	42,214	42,214	-
Others		301,218	89,681	62,950	5,820	4	16,824	476,497	32,270
Total revenue of contracts with customers		6,151,871	629,985	231,580	55,665	4	859,449	7,928,554	519,246

As of December 31, 2024

		Banking<br>Colombia	Banking El<br>Salvador	Banking<br>Guatemala	International<br>Banking	Leases	All Other<br>Segments	Total	Discontinued Operation Banking Panama
Revenue of contracts with customers for fees and Commissions	In millions of COP
Credit and debit card fees and commercial establishments		2,657,690	257,697	85,842	1,934	-	-	3,003,163	282,610
Payment and collections		1,024,053	-	-	-	-	-	1,024,053	15,735
Banking services		694,554	166,713	65,432	43,540	-	34,580	1,004,819	131,958
Bancassurance		958,311	47	-	-	-	13	958,371	67,193
Fiduciary Activities and Securities		-	6,515	902	50	-	544,820	552,287	18,964
Acceptances, Guarantees and Standby Letters of Credit		73,302	5,789	1,881	679	-	-	81,651	27,364
Placement of securities		-	2,097	-	-	-	78,120	80,217	1,670
Brokerage		-	-	-	-	-	20,648	20,648	16,473
Others		252,445	76,876	57,721	5,698	292	8,271	401,303	359
Total revenue of contracts with customers		5,660,355	515,734	211,778	51,901	292	686,452	7,126,512	562,326

The following table presents the variation in revenues from fees and commissions of contracts with customers between 2025 and 2024:

	Growth
	2025	-	2024
	COP		%
Credit and debit card fees and commercial establishments	256,647		8.55	%
Bancassurance	132,530		13.83	%
Payment and collections	112,557		10.99	%
Fiduciary Activities and Securities	92,587		16.76	%
Banking services	89,860		8.94	%
Placement of securities	26,435		32.95	%
Brokerage	21,566		104.45	%
Acceptances, Guarantees and Standby Letters of Credit	(5,334)		(6.53)	%
Others	75,194		18.74	%
Total revenue of contracts with customers(1)	802,042		11.25	%

(1) Total commission income from continuing operations.

Fees and commissions expenses

The following table presents fees and commissions related expenses:

	Year		Growth
	2025	2024	2025-2024
	In millions of COP
Banking services	1,737,216	1,458,363	278,853	19.12	%
Sales, collections and other services	889,356	894,836	(5,480)	(0.61	%)
Correspondent banking	618,969	620,818	(1,849)	(0.30	%)
Payments and collections	77,008	46,792	30,216	64.58	%
Others	251,061	204,573	46,488	22.72	%
Total fees and commissions expenses	3,573,610	3,225,382	348,228	10.80	%
Discontinued Operation Banistmo S.A.	261,793	286,392	(24,599)	(8.59	%)

Fees and commission income, net

	Year		Growth
	2025	2024	2025-2024
	In millions of COP
Fees and commission income	7,928,554	7,126,512	802,042	11.25	%
Fees and commission expenses	(3,573,610)	(3,225,382)	(348,228)	10.80	%
Total fees and commissions income, net	4,354,944	3,901,130	453,814	11.63	%

For 2025, gross revenues from fees and commissions totaled COP 7,929 billion, up 11.25% from COP 7,127 billion in 2024. The main sources of fee income are credit and debit cards, which accounts for approximately 41% of total fee income, payments and collections, banking services, and bancassurance, which each account for approximately 14%.

Credit and debit card income is derived from interchange fees paid by merchants and monthly maintenance charges. Revenues in this segment increased 8.55% year over year, driven by higher transaction volumes and larger interbank

exchange fees associated with growth in national and international purchases made through both point‑of‑sale and electronic payment channels.

Banking services made a significant contribution to the increase in fees, posting an 8.94% growth in the period, due to, among other factors, higher revenues from digital banking in Colombia. Payment and collections fees grew 10.99% in the year, primarily due to a higher number of automatic payment transactions in Colombia.

Bancassurance recorded a 13.83% increase, a notable strengthening from 2024. The improvement reflects higher commission income from the distribution of insurance policies, as well as the start of a joint operation with a new underwriter in the second half of the year.

Fee expenses totaled COP 3,574 billion in 2025, up 10.80% from COP 3,225 billion in 2024. Banking services represented 51% of all fee expenses and increased by 20.53%. This change is mainly due to higher data‑processing costs for banking services, increased royalties paid to credit‑card franchises as transactional volumes expanded, and higher expenses associated with credit cardholder membership benefits.

Sales, collections and other services accounted for 25% of fee expenses. On an annual basis, this line declined 0.61%, reflecting lower expenses from outsourced sales and third‑party collection services.

Other Operating Income

Other operating income was COP 3,572 billion, up 20.02% from COP 2,976 billion in 2024 explained by foreign exchange effects driven by the appreciation of the local currency over the year.

Revenues from operating leases totaled COP 1,748 billion in 2024, a decrease of 4.31% from 2024. The variation reflects lower income from vehicle rentals and real‑estate lease operations under Fondo Inmobiliario Colombia (FIC).

Total dividends received and other net income from equity investments

Total dividends and other net income from equity investments was COP 693 billion in 2025, up 644.38% from COP 93 billion in 2024. The increase is primarily driven by the partial reversal of the impairment recognized in 2024 on the investment in Tuya S.A.

Operating expenses

The following table summarizes the principal components of our operating expenses for the last two fiscal years:

	For the years ended December 31,		Growth
	2025(1)	2024(1)	2025-2024
	In millions of COP
Operating expenses
Salaries and employee benefits	5,760,122	5,224,723	535,399	10.25	%
Other administrative and general expenses	5,599,360	5,035,023	564,337	11.21	%
Taxes other than income tax	1,481,323	1,402,064	79,259	5.65	%
Depreciation, amortization and impairment	1,016,301	989,336	26,965	2.73	%
Total operating expenses	13,857,106	12,651,146	1,205,960	9.53	%
Discontinued operation Banistmo S.A.	909,939	982,520	(72,581)	(7.39	%)

(1) As of December 31, 2025 and 2024, Banistmo, a subsidiary classified as an asset held for sale since December 18, 2025, For more information, see the Consolidated Financial Statements Note 1. Reporting Entity, Note 2.D12. Material Accounting Policies – Assets Held for Sale and Discontinued Operations and Note 31. Discontinued Operation.

The following table summarizes the principal components of our operating expenses for the fiscal years ended:

	For the years ended December 31,		Growth
	2024(1)	2023(1)	2024-2023
	In millions of COP
Operating expenses
Salaries and employee benefits	5,224,723	4,899,283	325,440	6.64	%
Other administrative and general expenses	5,035,023	4,614,987	420,036	9.10	%
Taxes other than income tax	1,402,064	1,393,216	8,848	0.64	%
Depreciation, amortization and impairment	989,336	1,017,144	(27,808)	(2.73	%)
Total operating expenses	12,651,146	11,924,630	726,516	6.09	%
Discontinued operation Banistmo S.A.	982,520	1,017,555	(35,035)	(3.44	%)

(1)As of December 31, 2025 and 2024, Banistmo, a subsidiary classified as an asset held for sale since December 18, 2025, For more information, see the Consolidated Financial Statements Note 1. Reporting Entity, Note 2.D12. Material Accounting Policies – Assets Held for Sale and Discontinued Operations and Note 31. Discontinued Operation.

Operating expenses totaled COP 13,857 billion in 2025, up 9.53% from COP 12,651 billion in 2024. Salaries and employee benefits (excluding bonuses) totaled COP 4,695 billion in 2025, an increase of 7.79% from 2024. The variation is mainly attributable to annual salary increases. Bonuses increased under the performance‑driven compensation model, which incentivizes employee contributions to overall profitability.

Other administrative and general expenses totaled COP 5,599 billion in 2025, up 11.21% from 2024. This was largely related to technology and professional services linked to ongoing modernization projects, greater cloud‑service use, additional data‑processing costs associated with software license renewals, and increased use of software services.

Impairments, depreciation, and amortization totaled COP 1,016 billion in 2025, up 2.73% from 2024. It was primarily driven by higher depreciation on right‑of‑use assets for real estate and on computer equipment.

As a result of the changes in expenses and revenues, the cost-to-income ratio of Grupo Cibest for 2025 was 49.41%, up from 48.40% in 2024.

Provision charges and credit quality

Total net credit impairment charges fell to COP 4,430 billion (or 1.59% of average loans) in 2025, down 11.32% from COP 4,996 billion (or 1.88% of average loans) in 2024.

Asset quality reflected a healthier credit cycle, supported by a decline in provision expenses across all loan categories, most notably in consumer lending, which has shown steady improvement over the past two years. These positive trends were largely driven by the broad recovery of the consumer portfolio across all regions and the solid performance of the mortgage portfolio. Past-due loans amounted to COP 10,130 billion on December 31, 2025, down 30.25% from COP 14,523 billion a year earlier. The past-due loan ratio (loans overdue more than 30 days divided by total loans) was 3.95% on December 31, 2025, down from 5.20% on December 31, 2024.

Credit risk management in 2025 focused on proactive adjustments to our risk appetite and timely actions across origination, monitoring, and recovery. Better underwriting models supported disciplined loan growth and contributed to improved credit profiles across commercial and retail clients. Advances in predictive analytics enhanced portfolio monitoring by improving rating accuracy. Strengthened recovery strategies, supported by improved client payment capacity, digital self‑service tools, and data‑driven collection models, boosted effectiveness, increased recoveries, and helped reduce charge‑offs across all geographies.

Net loan charge-offs totaled COP 6,341 billion in 2025, down 19.28% from COP 7,856 billion in 2024. The reduction in charge‑offs is primarily explained by a lower volume of non‑performing consumer loans from the vintages originated during the year, along with the enhanced effectiveness of recovery management efforts noted earlier. Net charge‑offs help remove unrecoverable assets from the portfolio, thereby improving the accuracy of asset quality ratios.

Income tax expenses

Income tax expense from continuing operations in 2025 was COP 2,811 billion, an increase of 18.11% compared to COP 2,380 billion in 2024, excluding prior‑period effects, total tax expense would have been COP 2,824 billion in 2025, compared with COP 2,473 billion in 2024. The annual increase is mainly explained by the declaration of an economic and social emergency, under which certain tax measures increased the corporate income tax rate by 10 percentage points.

The effective tax rate for 2025 was 28.94% (excluding prior‑period impacts).

The effective tax rate is lower than the statutory tax rate because of certain tax benefits. In Colombia, these include exempt income from social housing and benefits associated with investments in productive fixed assets, and non‑taxable dividends. For the Central American operations tax benefits result from exempt foreign‑source income, corresponding to returns on securities issued by the governments of Guatemala, El Salvador, and Panama. They also include, earnings generated by subsidiaries operating in jurisdictions with lower tax rates than Colombia.

For further details, see Note 13 of the Consolidated Financial Statements.

Results by Segment

We manage our business through seven main operating segments: Banking Colombia, Banking El Salvador, Banking Guatemala, International Banking, Leases, All Other and Banking Panama. The Leases segment corresponds to the operations of: FCP Fondo Inmobiliario Colombia, Combinado Hábitat CCLA, Combinado Hábitat – others, Valores Simesa S.A., and Renting Colombia and its subsidiaries

The segment information in this Annual Report reflects the reporting structure in place at the reporting date, in accordance with the segment information in Note 3. Operating Segments to the Consolidated Financial Statements.

Banking Colombia:

	Year ended December 31,
				Change		Change
	2025	2024	2023	2025-2024		2024-2023
	In millions of COP
Total interest and valuation on financial instruments	26,062,351	27,543,286	29,230,060	(5.38)	%	(5.77)	%
Interest income on loans and financial leases	24,478,980	25,632,102	28,366,678	(4.50)	%	(9.64)	%
Debt investments	1,491,219	1,503,298	937,090	(0.80)	%	60.42	%
Derivatives, net	51,816	155,794	(167,887)	(66.74)	%	192.80	%
Liquidity operations, net	40,336	252,092	94,179	(84.00)	%	167.67	%
Interest expenses	(9,633,252)	(11,292,917)	(13,202,338)	(14.70)	%	(14.46)	%
Net interest margin and valuation on financial instruments before impairment on loans and financial leases, off balance sheet credit instruments and other financial instruments	16,429,099	16,250,369	16,027,722	1.10	%	1.39	%
Credit impairment charges, net	(3,396,144)	(4,220,195)	(6,480,377)	(19.53)	%	(34.88)	%
Net interest margin and valuation on financial instruments after impairment on loans and financial leases, off balance sheet credit instruments and other financial instruments	13,032,955	12,030,174	9,547,345	8.34	%	26.01	%
Expenses from transactions by the operating segments	(288,452)	(181,303)	(217,445)	59.10	%	(16.62)	%
Fees and commissions income	6,151,871	5,660,355	5,252,104	8.68	%	7.77	%
Fees and commissions expenses	(3,140,014)	(2,885,255)	(2,522,916)	8.83	%	14.36	%
Total fees and commissions, net	3,011,857	2,775,100	2,729,188	8.53	%	1.68	%
Other operating income(1)	1,620,506	1,219,476	2,049,297	32.89	%	(40.49)	%
Dividends and net income on equity investments	179,656	(121,975)	17,612	247.29	%	(792.57)	%
Total operating income, net	17,556,522	15,721,472	14,125,997	11.67	%	11.29	%
Operating expenses(2)	(9,457,584)	(8,497,419)	(7,939,136)	11.30	%	7.03	%
Depreciation, amortization and impairment	(706,370)	(631,282)	(508,543)	11.89	%	24.14	%
Total operating expenses	(10,163,954)	(9,128,701)	(8,447,679)	11.34	%	8.06	%
Profit before income tax	7,392,568	6,592,771	5,678,318	12.13	%	16.10	%
Segment assets	268,613,654	266,515,464	254,244,189	0.79	%	4.83	%
Segment liabilities	241,194,742	222,388,179	216,186,886	8.46	%	2.87	%

(1)Includes derivatives, net foreign exchange, operating leases and gains on sale of assets.

(2)Includes salaries and employee benefits, other administration and general expenses and taxes other than income tax.

Analysis of 2025 versus 2024

Banking Colombia’s profit before taxes increased by 12.13% to COP 7,393 billion in 2025, up from COP 6,593 billion in 2024, driven by the factors described below.

Total interest and valuation income decreased by 5.38% to COP 26,062 billion, mainly due to a 4.50% decline in interest income from loans operations. This reduction was primarily seen in the commercial and consumer segments, the result of lower origination rates in both portfolios.

Total interest expenses decreased by 14.70% to COP 9,633 billion from COP 11,293 billion, despite higher average balances in savings accounts and time deposits. Interest expenses were primarily impacted by the lower remuneration rate on time deposits. Additionally, interest expenses on bonds fell due to a lower average balance, and borrowings from financial institutions declined as a result of both a lower average balance and lower rates. The sharper decline in interest expenses relative to interest income led to an improvement in net interest income compared to the previous year. As a result, the net interest margin and valuation of financial instruments increased by 1.10% to COP 16,429 billion.

The total net credit impairment charge decreased by 19.53% to COP 3,396 billion from COP 4,220 billion. This reduction was mainly driven by lower credit losses in the consumer portfolio due to better performance in personal loans.

Total net fees and commissions increased by 8.53% to COP 3,012 billion, mainly due to higher income from bancassurance, credit and debit cards and payments and collections, particularly through digital channels. These improvements were partially offset by higher expenses which rose 8.83% compared with the previous year, primarily related to banking services and fees for services and collections, while expenses from transactions grew 59.10%.

Other operating income increased to COP 1,621 billion, primarily due to an increase in foreign exchange differences and currency derivatives.

Dividends and net income from equity investments recorded a gain of COP 180 billion, compared with a loss of 122 billion in 2024, mainly due to the partial reversal of the impairment recognized in 2024 on the investment in Tuya S.A.

Total operating expenses increased by 11.34% to COP 10,164 billion from COP 9,129 billion, mainly due to an increase in administrative and general expenses. This increase was driven by higher maintenance costs for licenses as well as expenses associated with cloud services and computer equipment. Salaries and employee benefits increased by 11.07% to COP 4,283 billion.

Assets attributable to Banking Colombia grew 0.79% during the year, mainly driven by an expansion in the loan portfolio, with strong performance in mortgage and consumer loans. Growth in the consumer segment was driven primarily by products such as credit cards and personal loans.

Finally, liabilities attributable to Banking Colombia increased by 8.46% in 2025, supported by higher deposits, particularly in savings accounts and time deposits.

Banking El Salvador:

	Year ended December 31,
				Change		Change
	2025	2024	2023	2025-2024		2024-2023
	In millions of COP
Total interest and valuation on financial instruments	2,095,137	1,851,126	1,773,141	13.18	%	4.40	%
Interest income on loans and financial leases	1,807,267	1,623,427	1,524,765	11.32	%	6.47	%
Debt investments	287,163	226,122	236,351	26.99	%	(4.33)	%
Derivatives, net	—	775	11,187	(100.00)	%	(93.07)	%
Liquidity operations, net	707	802	838	(11.85)	%	(4.30)	%
Interest expenses	(437,193)	(437,244)	(464,851)	(0.01)	%	(5.94)	%
Net interest margin and valuation on financial instruments before impairment on loans and financial leases, off balance sheet credit instruments and other financial instruments	1,657,944	1,413,882	1,308,290	17.26	%	8.07	%
Credit impairment charges, net	(334,805)	(236,086)	(154,938)	41.81	%	52.37	%
Net interest margin and valuation on financial instruments after impairment on loans and financial leases, off balance sheet credit instruments and other financial instruments	1,323,139	1,177,796	1,153,352	12.34	%	2.12	%
Expenses from transactions by the operating segments	1,769	(19,110)	(17,732)	109.26	%	7.77	%
Fees and commissions income	629,985	515,734	479,568	22.15	%	7.54	%
Fees and commissions expenses	(291,977)	(226,445)	(188,972)	28.94	%	19.83	%
Total fees and commissions, net	338,008	289,289	290,596	16.84	%	(0.45)	%
Other operating income(1)	42,082	40,818	51,656	3.10	%	(20.98)	%
Dividends and net income on equity investments	4,590	4,338	10,982	5.81	%	(60.50)	%
Total operating income, net	1,709,588	1,493,131	1,488,854	14.50	%	0.29	%
Operating expenses(2)	(831,994)	(771,079)	(668,105)	7.90	%	15.41	%
Depreciation, amortization and impairment	(96,796)	(93,982)	(131,922)	2.99	%	(28.76)	%
Total operating expenses	(928,790)	(865,061)	(800,027)	7.37	%	8.13	%
Profit before income tax	780,798	628,070	688,827	24.32	%	(8.82)	%
Segment assets	25,916,845	26,670,513	21,608,586	(2.83)	%	23.43	%
Segment liabilities	23,452,205	23,889,120	19,220,367	(1.83)	%	24.29	%

(1)Includes derivatives, net foreign exchange, operating leases and gains on sale of assets.

(2)Includes salaries and employee benefits, other administration and general expenses and taxes other than income tax.

Analysis of 2025 versus 2024

In 2025, profit before taxes for Banking El Salvador increased by 24.32% to COP 781 billion, due to the factors described below.

The financial statements expressed in Colombian pesos were affected by the appreciation of the Colombian peso, which strengthened by 14.79% against the U.S. dollar during 2025.

The loan portfolio expressed in Colombian pesos decreased by 5.19%. Expressed in U.S. dollars, the loan portfolio increased by 11.26%, primarily driven by the commercial and consumer portfolio. Deposits grew by 17.99% in U.S. dollar terms, and 0.54% in Colombian pesos, mainly due to higher savings accounts and time deposits.

Total interest and valuation income expressed in Colombian pesos increased by 13.18% to COP 2,095 billion, mainly driven by higher interest income from the commercial and consumer loan portfolios. Interest expenses remained broadly stable during the year.

Net credit impairment charges increased by 41.81% to COP 335 billion, up from COP 236 billion in 2024, mainly as a result of growth in the consumer portfolio.

Net fees and commissions increased by 16.84% to COP 338 billion, primarily driven by higher fee income from debit cards, credit cards, and merchant services.

Total operating expenses increased by 7.37% to COP 929 billion, mainly due to higher general expenses and salaries.

Assets attributable to Banking El Salvador decreased by 2.83% during the year, mainly driven by the lower loan portfolio balance compared with the previous quarter, due to the appreciation of the Colombian peso against the U.S. dollar. Similarly, liabilities decreased by 1.83%, primarily as a result of the lower deposit balances caused by the exchange rate effect.

Banking Guatemala:

	Year ended December 31,
				Change		Change
	2025	2024	2023	2025-2024		2024-2023
	In millions of COP
Total interest and valuation on financial instruments	2,013,347	1,939,602	1,795,543	3.80	%	8.02	%
Interest income on loans and financial leases	1,848,807	1,807,334	1,726,821	2.29	%	4.66	%
Debt investments	173,103	134,101	60,534	29.08	%	121.53	%
Liquidity operations, net	(8,563)	(1,833)	8,188	367.16	%	(122.39)	%
Interest expenses	(911,786)	(804,815)	(731,886)	13.29	%	9.96	%
Net interest margin and valuation on financial instruments before impairment on loans and financial leases, off balance sheet credit instruments and other financial instruments	1,101,561	1,134,787	1,063,657	(2.93)	%	6.69	%
Credit impairment charges, net	(442,529)	(394,589)	(499,368)	12.15	%	(20.98)	%
Net interest margin and valuation on financial instruments after impairment on loans and financial leases, off balance sheet credit instruments and other financial instruments	659,032	740,198	564,289	(10.97)	%	31.17	%
Expenses from transactions by the operating segments	(79,514)	(86,604)	(75,808)	(8.19)	%	14.24	%
Fees and commissions income	231,580	211,778	223,200	9.35	%	(5.12)	%
Fees and commissions expenses	(96,751)	(85,700)	(89,405)	12.89	%	(4.14)	%
Total fees and commissions, net	134,829	126,078	133,795	6.94	%	(5.77)	%
Other operating income(1)	131,316	130,140	130,757	0.90	%	(0.47)	%
Dividends and net income on equity investments	2,115	1,555	1,827	36.01	%	(14.89)	%
Total operating income, net	847,778	911,367	754,860	(6.98)	%	20.73	%
Operating expenses(2)	(654,017)	(645,311)	(620,928)	1.35	%	3.93	%
Depreciation, amortization and impairment	(59,578)	(61,471)	(55,243)	(3.08)	%	11.27	%
Total operating expenses	(713,595)	(706,782)	(676,171)	0.96	%	4.53	%
Profit before income tax	134,183	204,585	78,689	(34.41)	%	159.99	%
Segment assets	24,413,292	27,332,834	21,377,205	(10.68)	%	27.86	%
Segment liabilities	22,331,358	25,018,466	19,469,075	(10.74)	%	28.50	%

(1)Includes derivatives, net foreign exchange, operating leases and gains on sale of assets.

(2)Includes salaries and employee benefits, other administration and general expenses and taxes other than income tax.

Analysis of 2025 versus 2024

Banking Guatemala’s profit before taxes decreased to COP 134 billion in 2025, down from COP 205 billion in 2024, driven by the factors described below.

The financial statements expressed in Colombian pesos were affected by the appreciation of the Colombian peso, which strengthened by 14.79% against the U.S. dollar during 2025.

The loan portfolio, expressed in Colombian pesos, decreased by 13.21%; while in U.S. dollars, it grew by 1.86%, mainly driven by the commercial portfolio. Deposits, expressed in colombian pesos decrease by 7.99%, in U.S. dollars, it grew 7.98% mainly driven by saving accounts.

Total interest and valuation income increased by 3.80% to COP 2,013 billion, due to stronger interest income generation from the commercial portfolio, as well as higher valuations of debt investments.

Net credit impairment charges increased by 12.15% to COP 443 billion, compared with COP 395 billion in 2024, mainly due to higher provision expenses in the consumer portfolio.

Net fees and commissions increased by 6.94% to COP 135 billion, mainly driven by higher commissions related to electronic services and ATM transactions.

Total operating expenses increased by 0.96% to COP 714 billion, primarily due to higher personnel expenses and technology services.

Assets attributable to Banking Guatemala, expressed in Colombian pesos, decreased by 10.68% during the year, mainly due to the reduction in the loan portfolio resulting from a lower exchange rate. Similarly, liabilities decreased by 10.74%, driven primarily by lower customer deposits, also associated with the exchange rate effect.

International Banking:

	Year ended December 31,
				Change		Change
	2025	2024	2023	2025-2024		2024-2023
	In millions of COP
Total interest and valuation on financial instruments	1,014,777	1,203,837	1,112,171	(15.70)	%	8.24	%
Interest income on loans and financial leases	852,849	987,377	940,091	(13.62)	%	5.03	%
Debt investments	94,069	116,662	85,091	(19.37)	%	37.10	%
Derivatives, net	(56)	(94)	(188)	(40.43)	%	(50.00)	%
Liquidity operations, net	67,915	99,892	87,177	(32.01)	%	14.59	%
Interest expenses	(660,927)	(708,671)	(596,039)	(6.74)	%	18.90	%
Net interest margin and valuation on financial instruments before impairment on loans and financial leases, off balance sheet credit instruments and other financial instruments	353,850	495,166	516,132	(28.54)	%	(4.06)	%
Credit impairment charges, net	(225,658)	(91,617)	4,164	146.31	%	(2,300.22)	%
Net interest margin and valuation on financial instruments after impairment on loans and financial leases, off balance sheet credit instruments and other financial instruments	128,192	403,549	520,296	(68.23)	%	(22.44)	%
Revenues from transactions by the operating segments	320,216	400,937	416,107	(20.13)	%	(3.65)	%
Fees and commissions income	55,665	51,901	47,228	7.25	%	9.90	%
Fees and commissions expenses	(11,627)	(10,116)	(11,042)	14.94	%	(8.39)	%
Total fees and commissions, net	44,038	41,785	36,186	5.39	%	15.48	%
Other operating income(1)	16,492	12,435	16,794	32.63	%	(25.96)	%
Dividends and net income on equity investments	24	25	37	(4.00)	%	(32.43)	%
Total operating income, net	508,962	858,731	989,420	(40.73)	%	(13.21)	%
Operating expenses(2)	(104,892)	(98,572)	(89,220)	6.41	%	10.48	%
Depreciation, amortization and impairment	(2,473)	(8,016)	(4,259)	(69.15)	%	88.21	%
Total operating expenses	(107,365)	(106,588)	(93,479)	0.73	%	14.02	%
Profit before income tax	401,597	752,143	895,941	(46.61)	%	(16.05)	%
Segment assets	23,693,417	35,272,842	30,199,897	(32.83)	%	16.80	%
Segment liabilities	21,502,643	24,248,959	20,734,521	(11.33)	%	16.95	%

(1)Includes derivatives, net foreign exchange, operating leases and gains on sale of assets.

(2)Includes salaries and employee benefits, other administration and general expenses and taxes other than income tax.

Analysis of 2025 versus 2024

Profit before taxes for the International Banking segment decreased by 46.61% to COP 402 billion in 2025, down from COP 752 billion in 2024, due to the factors described below.

The financial statements expressed in Colombian pesos were affected by the appreciation of the Colombian peso, which strengthened by 14.79% against the U.S. dollar in 2025.

Total interest and valuation income on financial instruments decreased, in Colombian‑peso terms, by 15.70% to COP 1,015 billion, compared to COP 1,204 billion in 2024. This decline was mainly driven by lower interest income from commercial loans, as well as reduced income from liquidity operations and investments in debt securities.

Net credit impairment charges rose to COP 226 billion in 2025, up from COP 92 billion in 2024, primarily due to higher provisions for specific corporate‑segment clients.

Net fees and commissions increased by 5.39% to COP 44 billion, mainly reflecting higher transaction volumes from foreign trade clients.

Total operating expenses increased by 0.73% to COP 107 billion, driven primarily by higher employee salary expenses.

Assets attributable to the International Banking segment decreased by 32.83% to COP 23,693 billion, primarily driven by a contraction in the loan portfolio and reduced investments in financial assets. Liabilities decreased by 11.33%, mainly due to lower deposits resulting from the impact of the exchange rate

Leases:

	Year ended December 31,
				Change		Change
	2025	2024	2023	2025-2024		2024-2023
	In millions of COP
Total interest and valuation on financial instruments	216,802	254,200	254,360	(14.71)	%	(0.06)	%
Interest income on loans and financial leases	224,652	257,363	253,677	(12.71)	%	1.45	%
Debt investments	1,180	41	683	2,778.05	%	(94.00)	%
Derivatives, net	(9,030)	(3,204)	—	181.84	%	100.00	%
Interest expenses	(360,799)	(443,629)	(434,664)	(18.67)	%	2.06	%
Net interest margin and valuation on financial instruments before impairment on loans and financial leases, off balance sheet credit instruments and other financial instruments	(143,997)	(189,429)	(180,304)	(23.98)	%	5.06	%
Credit impairment charges, net	(30,327)	(53,547)	(55,660)	(43.36)	%	(3.80)	%
Net interest margin and valuation on financial instruments after impairment on loans and financial leases, off balance sheet credit instruments and other financial instruments	(174,324)	(242,976)	(235,964)	(28.25)	%	2.97	%
Expenses from transactions by the operating segments	(115,936)	(136,749)	(163,049)	(15.22)	%	(16.13)	%
Fees and commissions income	4	292	—	(98.63)	%	100.00	%
Fees and commissions expenses	(3,842)	(1,639)	(11,082)	134.41	%	(85.21)	%
Total fees and commissions, net	(3,838)	(1,347)	(11,082)	184.93	%	(87.85)	%
Other operating income(1)	1,545,011	1,543,538	1,673,939	0.10	%	(7.79)	%
Dividends and net income on equity investments	329,307	287,930	239,405	14.37	%	20.27	%
Total operating income, net	1,580,220	1,450,396	1,503,249	8.95	%	(3.52)	%
Operating expenses(2)	(1,057,200)	(1,056,501)	(1,049,474)	0.07	%	0.67	%
Depreciation, amortization and impairment	(137,602)	(182,106)	(309,435)	(24.44)	%	(41.15)	%
Total operating expenses	(1,194,802)	(1,238,607)	(1,358,909)	(3.54)	%	(8.85)	%
Profit before income tax	385,418	211,789	144,340	81.98	%	46.73	%
Segment assets	11,150,070	10,182,907	9,554,490	9.50	%	6.58	%
Segment liabilities	4,849,872	4,573,121	4,812,434	6.05	%	(4.97)	%

(1)Includes derivatives, net foreign exchange, operating leases and gains on sale of assets.

(2)Includes salaries and employee benefits, other administration and general expenses and taxes other than income tax.

Analysis of 2025 versus 2024

In 2025, the profit before taxes of the Leases segment increased by 81.98% to COP 385 billion, due to the reasons described below.

Total interest and valuation income from financial instruments decreased by 14.71% to COP 217 billion, mainly the result of the reduction in interest income from financial leasing operations in the vehicle business.

Total interest expenses decreased by 18.67% to COP 361 billion, due to a lower financial cost associated with the decline in the Central Bank of Colombia’s reference rate in 2025, combined with a lower financial liability balance in Renting Colombia.

Net credit impairment charges decreased by 43.36% to COP 30 billion, driven by lower impairment of debtors compared to December 2024 in Renting Colombia.

Other operating income amounted to COP 1,545 billion, boosted by higher gains from property leasing and sales, which offset the decrease in income from the vehicle business.

Dividends and other net income from equity investments increased by 14.37% to COP 329 billion, mainly due to higher dividends and profit from investments in associates received by Fondo Inmobiliario Colombia.

Operating expenses decreased by 3.54% to COP 1,195 billion, due to lower expenses in Renting Colombia associated with right‑of‑use asset depreciation and reduced vehicle taxes resulting from a contraction in the fleet balance.

Assets attributable to the leasing segment grew 9.50% during the year to COP 11,150 billion, driven by increased investments in real estate assets. Liabilities increased by 6.05% to COP 4,850 billion, mainly due to higher liabilities of Fondo Inmobiliario Colombia.

All Other:

	Year ended December 31,
				Change		Change
	2025	2024	2023	2025-2024		2024-2023
	In millions of COP
Total interest and valuation on financial instruments	85,112	62,265	54,326	36.69	%	14.61	%
Interest income on loans and financial leases	23,447	22,836	13,521	2.68	%	68.89	%
Debt investments	48,016	37,486	36,544	28.09	%	2.58	%
Derivatives, net	(1,051)	(2,463)	(1,747)	(57.33)	%	40.98	%
Liquidity operations, net	14,700	4,406	6,008	233.64	%	(26.66)	%
Interest expenses	(57,269)	(384)	(405)	14,813.80	%	(5.19)	%
Net interest margin and valuation on financial instruments before impairment on loans and financial leases, off balance sheet credit instruments and other financial instruments	27,843	61,881	53,921	(55.01)	%	14.76	%
Credit impairment charges, net	(455)	433	(4,906)	(205.08)	%	108.83	%
Net interest margin and valuation on financial instruments after impairment on loans and financial leases, off balance sheet credit instruments and other financial instruments	27,388	62,314	49,015	(56.05)	%	27.13	%
Revenues from transactions by the operating segments	161,917	22,829	57,927	609.26	%	(60.59)	%
Fees and commissions income	859,449	686,452	545,853	25.20	%	25.76	%
Fees and commissions expenses	(29,399)	(16,227)	(14,966)	81.17	%	8.43	%
Total fees and commissions, net	830,050	670,225	530,887	23.85	%	26.25	%
Other operating income(1)	216,667	29,703	20,269	629.44	%	46.54	%
Dividends and net income on equity investments	177,319	(78,774)	(73,177)	325.10	%	7.65	%
Total operating income, net	1,413,341	706,297	584,921	100.11	%	20.75	%
Operating expenses(2)	(735,118)	(592,928)	(540,623)	23.98	%	9.67	%
Depreciation, amortization and impairment	(13,482)	(12,479)	(7,742)	8.04	%	61.19	%
Total operating expenses	(748,600)	(605,407)	(548,365)	23.65	%	10.40	%
Profit before income tax	664,741	100,890	36,556	558.88	%	175.98	%
Segment assets	46,854,190	3,378,212	3,523,498	1,286.95	%	(4.12)	%
Segment liabilities	2,455,417	404,335	386,819	507.27	%	4.53	%

(1)Includes derivatives, net foreign exchange, operating leases and gains on sale of assets.

(2)Includes salaries and employee benefits, other administration and general expenses and taxes other than income tax.

Analysis of 2025 versus 2024

In 2025, the income before taxes of all other segments increased by 558.88% to COP 665 billion for the reasons described below.

Total interest from loans and financial leasing operations grew 36.69%, mainly due to the improved performance of Valores Bancolombia’s fixed‑income portfolio.

Total net fee income rose 23.85% to COP 830 billion, driven by revenues from collective investment funds, which contributed approximately COP 63 billion. This increase was also supported by higher fees and commissions from Investment Banking financing structuring services, as well as commissions generated through the Wompi payment gateway.

Other operating income grew by 629.44% to COP 217 billion, mainly due to foreign exchange gains recognized by Grupo Cibest S.A. on investments held abroad, following the aforementioned spin‑off.

Operating expenses increased by 23.65% to COP 749 billion, largely due to the effects of the spin‑off process from Bancolombia S.A. in favor of Grupo Cibest S.A., in addition to higher labor and general expenses related to operations in development stages, including Nequi, Wompi, and Wenia.

Total assets in All Other segments increased to COP 46,854 billion as a result of the completion of the partial spin‑off of assets and liabilities from Bancolombia S.A. in favor of Grupo Cibest S.A. Likewise, total liabilities rose to COP 2,455 billion, also reflecting the effects of this partial spin‑off.

Banking Panama (Discontinued operation)

	Year ended December 31,
				Change		Change
	2025	2024	2023	2025-2024		2024-2023
	In millions of COP
Total interest and valuation on financial instruments	2,546,672	2,689,904	2,826,559	(5.32)	%	(4.83)	%
Interest income on loans and financial leases	2,103,723	2,283,111	2,415,234	(7.86)	%	(5.47)	%
Debt investments	353,019	316,205	301,167	11.64	%	4.99	%
Derivatives, net	3,197	3,322	817	(3.76)	%	306.61	%
Liquidity operations, net	86,733	87,266	109,341	(0.61)	%	(20.19)	%
Interest expenses	(1,241,640)	(1,336,250)	(1,238,112)	(7.08)	%	7.93	%
Net interest margin and valuation on financial instruments before impairment on loans and financial leases, off balance sheet credit instruments and other financial instruments	1,305,032	1,353,654	1,588,447	(3.59)	%	(14.78)	%
Credit impairment charges, net	(161,369)	(456,748)	(270,501)	(64.67)	%	68.85	%
Net interest margin and valuation on financial instruments after impairment on loans and financial leases, off balance sheet credit instruments and other financial instruments	1,143,663	896,906	1,317,946	27.51	%	(31.95)	%
Expenses from transactions by the operating segments	—	—	—	—	%	—	%
Fees and commissions income	519,246	562,330	532,930	(7.66)	%	5.52	%
Fees and commissions expenses	(261,793)	(286,392)	(258,897)	(8.59)	%	10.62	%
Total fees and commissions, net	257,453	275,938	274,033	(6.70)	%	0.70	%
Other operating income(1)	24,905	65,876	36,939	(62.19)	%	78.34	%
Dividends and net income on equity investments	8,561	11,474	13,498	(25.39)	%	(14.99)	%
Loss from discontinued operations	(5,022,822)	—	—	100.00	%	—	%
Total operating income, net	(3,588,240)	1,250,194	1,642,416	(387.01)	%	(23.88)	%
Operating expenses(2)	(812,202)	(853,981)	(909,844)	(4.89)	%	(6.14)	%
Depreciation, amortization and impairment	(97,737)	(128,544)	(107,717)	(23.97)	%	19.33	%
Total operating expenses	(909,939)	(982,525)	(1,017,561)	(7.39)	%	(3.44)	%
Profit before income tax	(4,498,179)	267,669	624,855	(1780.50)	%	(57.16)	%
Segment assets	39,538,249	45,964,767	40,740,495	(13.98)	%	12.82	%
Segment liabilities	35,059,304	41,132,907	36,315,750	(14.77)	%	13.26	%

(1)Includes derivatives, net foreign exchange, operating leases and gains on sale of assets.

(2)Includes salaries and employee benefits, other administration and general expenses and taxes other than income tax.

Analysis of 2025 versus 2024

In 2025, Banking Panama’s profit before taxes recorded a loss of COP 4,498 billion, down from a gain of COP 268 billion in 2024, driven by the factors described below.

The financial statements expressed in Colombian pesos were affected by the appreciation of the Colombian peso, which strengthened by 14.79% against the U.S. dollar in 2025.

The loan portfolio, expressed in Colombian pesos, decreased by 16.58% and by 2.10% when expressed in U.S. dollars, primarily due to decreases in the mortgage and commercial portfolios. Deposits decreased 15.51% in Colombian pesos and 0.85% in U.S. dollar terms, mainly due to lower time deposits.

Total interest and valuation income decreased by 5.32% to COP 2,547 billion, mainly due to lower interest income from commercial loans.

The total net credit impairment charge decreased by 64.67% to COP 161 billion. This change is mainly explained by the release of provisions associated with macroeconomic models and the overall improved performance of the loan portfolio.

Total net fees and commissions decreased by 6.70% to COP 257 billion, mainly due to lower income from brokerage and credit card fees.

Discontinued operations recorded a loss of COP 5,023 billion as a result of the impairment of goodwill associated with the Banistmo agreement.

Total operating expenses decreased by 7.39%, primarily due to lower general expenses related to professional fees for IT projects and other technology-related costs, which offset the increase in bonuses.

Assets attributable to Banking Panama decreased by 13.98% during the year, mainly due to a lower loan portfolio balance. Similarly, liabilities fell by 14.77%, primarily as a result of a decrease in deposits, mainly time deposits. In both assets and liabilities, the appreciation of the Colombian peso against the U.S. dollar negatively affected the growth of balances in Colombian pesos.

B.LIQUIDITY AND CAPITAL RESOURCES

B.1LIQUIDITY AND FUNDING

Liquid Assets

One of our main principles is to maintain a solid liquidity position. Our Asset-Liability Committee ('ALCO'), has established a minimum level of liquid assets to ensure that each subsidiary always has sufficient liquidity to meet its liabilities without incurring big losses or risking reputational damage.

We seek to maintain in the optimum level of liquid assets to ensure proper operations not only under normal conditions but also under market stress scenarios. We maintained a solid liquidity position in 2025, with high liquidity levels during the second half of the year.

The following table shows the composition of the liquid assets in the last two years:

Liquid Assets (1)	December 31, 2025	December 31, 2024
High quality Liquid Assets (2)
Cash	26,625,173	27,931,834
High quality liquid securities	25,531,243	24,862,860
Other Liquid Assets
Other securities (3)	10,142,076	6,823,145
Total Liquid Assets	62,298,492	59,617,839

(1)Cash and those liquid assets received by the Central Bank for its expansion and contraction monetary operations. Liquid assets are adjusted by a haircut. The following are considered as liquid assets: cash, repos held for trading and investments held for trading in listed shares in Colombia’s stock exchange, in investment funds units or in other trading debt instruments.

(2) High-quality liquid assets: cash and shares that are eligible to be reportable or repo operations, in addition to those liquid assets that the Central Bank receives for its monetary expansion and contraction operations described in paragraph 3.1.1 of the Foreign Regulatory Circular DODM-142 of the Central Bank.

(3) Other Securities: Securities issued by financial and corporate entities.

As of December 31, 2025, liquid assets showed a growth of COP 2,681 billion, mainly due to the increase in high-quality liquid securities. This change is a consequence of higher deposits and excess of liquidity, which has been managed through the treasury portfolio with purchases of liquid securities.

We measure liquid assets on a daily basis and compare them to an objective target set by the Risk Committee. Under this rule, daily liquid assets must be equal to or higher than the target. In the event the limit is not reached, there is a five-day period to increase liquidity levels.

Adequate cash levels are needed to guarantee branch and ATM operations. Our expansion across Colombia requires considerable levels of cash and we monitor cash levels on a daily basis in order to minimize opportunity costs. Additionally, cash is included in the banking reserve established by the Central Bank.

Securities that comprise liquid assets are reviewed by the ALCO when considering our liquidity objective. Even though available-for-sale and held-to-maturity debt securities cannot be sold, they can be pledged as collateral in repurchase agreements. Some of them are mandatory investments that can be posted to the Central Bank as collateral.

The SFC requires financial entities to have liquid assets greater than the contractual liquidity cumulative one-month gap. This contractual gap reflects the maturity of the current positions of assets and liabilities and does not reflect projections of future operations. The maturity of the loan portfolio for this purpose is affected by the historical default indicator and the maturity of deposits is modeled according to the regulation.

We believe that the current level of liquidity is adequate and will seek to maintain the solid deposit base and access to alternative sources of funding, such as borrowings from domestic and international development and commercial banks, repurchase agreements, bond issuances, overnight funds and Central Bank funds, considering market conditions, interest rates and the desired maturity profile of liabilities.

Funding Structure

As of December 31, 2025, our liabilities reached COP 338,757 billion, a 3.40% increase compared with December 31, 2024. Liabilities denominated in Colombian pesos increased by 10.99%, and liabilities denominated in U.S. dollars decreased by 9.30%. These changes were primarily driven by the increase in peso‑denominated savings accounts, the increase in dollar‑denominated debt securities in circulation, and the reduction in dollar‑denominated time deposits. The 9.30% decrease in dollar‑denominated liabilities reflected, on a net basis, the reduction in U.S. dollar‑denominated time deposits and the appreciation of the Colombian peso against the U.S. dollar (14.79% in 2025); however, this decrease was partially offset by the impact of the Banistmo divestiture, which mitigated the overall reduction in U.S. dollar‑denominated liabilities. Absent this divestiture, the decrease in U.S. dollar‑denominated liabilities would have been more pronounced.

	As of December 31,
	2025	2024
	In millions of COP
Total funding
Peso-denominated	227,513,866	204,977,765
Dollar-denominated.	111,242,880	122,653,342
Total Liabilities	338,756,746	327,631,107

In 2025, our deposits reached COP 264,414 billion at year-end, a decrease of COP 14,645 billion, or 5.25%, compared with 2024. Deposits denominated in Colombian pesos increased by 10.49%, due mainly to the rise in savings accounts and time deposits, while deposits denominated in U.S. dollars decreased by 34.28% as a result of the decline in savings accounts, decrease in time deposits and the effect of exchange rate variations. Additionally, it is important to note that the decrease in deposits denominated in U.S. dollars also reflects the reclassification of Banistmo’s deposits as liabilities associated with investments in subsidiaries held for sale. The ratio of deposits to total assets was 69.6%, decreasing by 5.34 percentage points compared to 2024.

	As of December 31,
	2025	2024
	In millions of COP
Total Deposits	264,413,956	279,059,401

The following table sets forth checking accounts, savings accounts and time deposits as a percentage of our total liabilities for 2025 and 2024:

	2025 (1)		2024
Saving accounts	39.3	%	38.1	%
Time deposits	27.1	%	33.5	%
Checking accounts	9.5	%	11.6	%
Other deposits	2.2	%	2.0	%
Percentage of Total Liabilities	78.1	%	85.2	%

(1)As of December 31, 2025 includes the effects of the classification of Banistmo S.A. as an asset held for sale as of December 18, 2025, For more information, see the Consolidated Financial Statements Note 1. Reporting Entity, Note 2.D12. Material Accounting Policies – Assets Held for Sale and Discontinued Operations and Note 31. Discontinued Operation.

Our principal sources of funding are deposits, which are mainly composed of checking accounts, time deposits and savings accounts. During 2025, savings accounts and time deposits played an important role in the structure of the balance sheet. In the first half of the year, the gradual reduction of the Central Bank’s monetary policy rate, supported by lower inflation, reduced the cost of interest‑sensitive funding. Despite the stabilization of the monetary policy rate in the second half of 2025, the higher share of low‑cost deposits helped maintain a favorable cost of funds throughout the year.

Deposits as a percentage of our total liabilities in 2025 were 78.1%, increasing from 85.3% of total liabilities at year-end 2024.

The ratio of net loans to deposits (including borrowings from commercial banks) was 88.80% at the end of 2025, decreasing from 89.32% at the end of 2024. Net loans and advances to customers rose to COP 243,100 billion in 2025 from COP 263,274 billion in 2024, while deposits were COP 273,770 billion in 2025, an increase of COP 20,979 billion from 2024.

	As of December 31,
	2025		2024
Net Loans to Deposits	88.80	%	89.32	%

We also fund our operations with borrowings from financial institutions. Nevertheless, the main source of financing during 2025 was savings accounts and time deposits. Additionally, our time deposits and borrowings from financial institutions are linked to different market rates/indexes like the IBR, (a short-term benchmark interest rate of Colombian money market liquidity that reflects the price at which banks are willing to lend or borrow funds in the financial market), DTF, IPC1 and SOFR.

Debt instruments in issue

In 2025, we issued USD 528 million of notes, distributed as follows: Bancolombia issued USD 18 million, Banistmo USD 429.5 million, Banagrícola USD 7 million and Bancolombia Puerto Rico USD 42.5 million.

As of December 31, 2025, the total outstanding aggregate principal amount of bonds issued was COP 10,839 billion.

The following table shows the maturity profile of our debt securities in issue:

	2026	2027	2028	2029	2030	2031 and thereafter	Total
	In millions of COP
Debt securities in issue	2,573,470	4,045,504	—	360,730	321,266	3,538,453	10,839,423

________________________________________

1The IPC refers to the Consumer Price Index certified by the Colombian statistical bureau ('DANE')

The following table sets forth the components of our liabilities for the years 2025 and 2024:

	As of December,
	2025(1)	% of total<br>funding		2024	% of total<br>funding
	In millions of COP, except percentages
Savings accounts
Peso-denominated	108,986,303	32.2	%	93,938,152	28.7	%
Dollar-denominated	24,142,419	7.1	%	30,698,842	9.4	%
Total	133,128,722	39.3	%	124,636,994	38.1	%
Time deposits
Peso-denominated	63,874,633	18.9	%	60,608,350	18.5	%
Dollar-denominated	27,798,534	8.2	%	49,152,372	15.0	%
Total	91,673,167	27.1	%	109,760,722	33.5	%
Checking accounts
Peso-denominated	20,374,259	6.0	%	20,567,300	6.3	%
Dollar-denominated	11,751,682	3.5	%	17,466,396	5.3	%
Total	32,125,941	9.5	%	38,033,696	11.6	%
Other deposits
Peso-denominated	6,719,341	2.0	%	5,863,094	1.8	%
Dollar-denominated	766,785	0.2	%	764,895	0.2	%
Total	7,486,126	2.2	%	6,627,989	2.0	%
Interbank Deposits
Peso-denominated	30,102	—	%	—	—	%
Dollar-denominated	—	—	%	716,493	0.2	%
Total	30,102	—	%	716,493	0.2	%
Derivate financial instrument-Liabilities
Peso-denominated	4,478,163	1.3	%	2,642,149	0.8	%
Dollar-denominated	36,467	0.0	%	37,494	0.0	%
Total	4,514,630	1.3	%	2,679,643	0.8	%
Borrowings from other financial institutions
Peso-denominated	5,181,708	1.5	%	5,055,039	1.5	%
Dollar-denominated	4,174,720	1.3	%	10,634,493	3.3	%
Total	9,356,428	2.8	%	15,689,532	4.8	%
Debt securities in issue
Peso-denominated	2,171,540	0.6	%	2,241,026	0.7	%
Dollar-denominated	5,238,153	1.5	%	9,034,190	2.8	%
Total	7,409,693	2.1	%	11,275,216	3.5	%
Repurchase agreements and other similar secured borrowing
Peso-denominated	283,792	0.1	%	679,878	0.2	%
Dollar-denominated	392,255	0.1	%	380,594	0.1	%
Total	676,047	0.2	%	1,060,472	0.3	%
Leases
Peso-denominated	1,153,404	0.3	%	1,141,239	0.4	%
Dollar-denominated	171,635	0.1	%	748,125	0.2	%
Total	1,325,039	0.4	%	1,889,364	0.6	%
Other liabilities
Peso-denominated	14,260,621	4.2	%	12,241,538	3.7	%
Dollar-denominated	36,770,230	10.9	%	3,019,448	0.9	%
Total	51,030,851	15.1	%	15,260,986	4.6	%
Total funding
Peso-denominated	227,513,866	67.1	%	204,977,765	62.6	%
Dollar-denominated	111,242,880	32.9	%	122,653,342	37.4	%
Total Liabilities	338,756,746	100.0	%	327,631,107	100.0	%

(1)The accumulated value as of December 31, 2025, includes the effects of the classification of Banistmo as an asset held for sale as of December 18, 2025, For more information, see Financial Statements Note 1. Reporting Entity, Note 2.D12. Material Accounting Policies – Assets Held for Sale and Discontinued Operations and Note 31. Discontinued Operation.

Consolidated statement of cash flows

The following table shows net cash provided by operating activities, net cash used in investing activities and net cash used in financing activities, for the years ended December 31, 2025, 2024 and 2023:

	2025	2024	2023
	In millions of COP
Operating activities	12,258,945	435,895	19,153,084
Investing activities	(2,216,093)	(559,196)	(159,689)
Financing activities	(8,246,850)	(9,244,376)	(5,430,672)
Increase / (decrease) in cash and cash equivalents	1,796,002	(9,367,677)	13,562,723

Operating activities

Operating activities resulted in positive net cash in 2025, due to an increase of COP 27,999 billion in deposits by customers, compared to an increase of COP 18,329 billion in 2024, and COP 31,802 billion of interest received, down from COP 33,225 billion in 2024. Loans and advances to customers and financial institutions rose by COP 27,306 billion, compared with COP 21,622 billion in 2024 and COP 10,554 in 2023. Interest paid generated a use-of-cash of COP 13,299 billion in 2025, COP 14,982 billion in 2024 and COP 15,978 billion in 2023. The value of investment securities recognized at fair value through profit and losses fell by COP 3,004 billion in 2025, compared with an increase of COP 8,401 billion in 2024.

Investing activities

In 2025, we purchased debt securities at an amortized cost of COP 1,967 billion, down from COP 2,114 billion in 2024 and COP 3,629 billion in 2023. The proceeds from maturities of debt securities at amortized cost provided cash of COP 1,115 billion in 2025, COP 1,622 in 2024 and COP 4,738 billion in 2023.

Investing activities related to debt instruments at fair value through OCI provided net cash of COP 603 billion in 2025 and COP 1,858 billion in 2024. Investing activities related to equity securities and interest in associates and joint ventures used net cash of COP 55,837 billion in 2025, down from COP 93,892 billion in 2024. Investing activities related to purchases and sales of premises and equipment and investment properties used net cash of COP 1,748 billion, compared with COP 1,628 billion in 2024 and COP 2,226 billion in 2023.

Financing activities

Proceeds from borrowings from other financial institutions provided COP 7,454 billion in 2025, COP 9,416 billion in 2024 and COP 9,855 billion in 2023. The placement of debt securities in issue provided COP 2,540 billion in 2025, COP 4,155 in 2024 and COP 1,781 in 2023. The repayment of borrowings used COP 10,808 billion in 2025, compared with COP 10,496 in 2024 and COP 9,921 in 2023. And the payments of debt securities in issue used COP 1,618 billion in 2025, COP 9,276 billion in 2024 and COP 3,928 billion in 2023. Cash was also used to pay dividends to stockholders in the amount of COP 5,196 billion, up from COP 3,398 billion in 2024 and COP 3,298 billion in 2023.

The decrease in repurchase agreements used cash of COP 431 billion, compared with cash provided of COP 550 billion in 2024 and COP 304 billion in 2023.

Capital adequacy

As of December 31, 2025, the banks that are part of Grupo Cibest comply with the regulatory capital adequacy requirements in each of the jurisdictions where they operate.

Bancolombia’s standalone capital adequacy ratio was 14.40% (with a basic solvency ratio of 12.22%), below the 18.54% (basic solvency of 15.97%) reported at the end of 2024. This change is mainly due to the start of Grupo Cibest’s operations in 2025. The minimum regulatory requirement for total capital adequacy in Colombia is 9.00%.

Bancoagrícola’s capital adequacy ratio was 13.57%, down from the 15.13% reported at the end of 2024, exceeding by 157 basis points the minimum level of 12.00% required by the regulator in El Salvador.

Bam’s capital adequacy ratio was 13.51%, below the 13.75% (basic solvency of 7.54%) reported at year‑end 2024, significantly above the minimum level of 10.00% (basic solvency of 5.00%) required by the regulator in Guatemala.

As of year‑end 2025, Grupo Cibest's standalone double leverage ratio stood at 101.45%, reflecting a reduction driven by the combined accounting effects of the agreement to sale Banistmo (a decrease in investments and shareholders’ equity coupled with the impairment of the related goodwill).

Additionally, Bancolombia’s total exposure used to calculate the leverage ratio amounted to COP 281,369,411 billion as of 2025, and the leverage ratio stood at 8.87%.

B.2FINANCIAL INSTRUMENTS AND TREASURY ACTIVITIES

The treasury division is responsible for overseeing sales and trading activities across Bancolombia, Bancoagrícola, Bancolombia Panamá, Bancolombia Puerto Rico, Banistmo and Bam. We execute transactions in both domestic and foreign currencies legally authorized in Colombia and in all the countries where we have a presence. These include derivatives transactions, fixed income and indexed securities trading, repurchase or resale transactions, short sales, temporary securities transfers, as well as FX trading.

Oversight of the treasury division activities is maintained through comprehensive policies governing liquidity, market, legal, credit and operational risk management. Such policies are monitored by our Chief Risk Officer (CRO). To control market and liquidity risks, we set limits intended to keep our exposure levels and losses within certain ranges determined by Grupo Cibest's Board of Directors. Our investment policies do not include restrictions regarding the maturity of the securities held in the portfolio, except for those related to the liquidity portfolio and over the counter (OTC) derivatives transactions held by Bancolombia, Banistmo and Bancoagrícola. However, we have defined a policy to classify investments in trading portfolios, structural portfolios and other portfolios that have a specific objective. Before taking any additional position, our treasury division also verifies, with respect to investments in domestic and in foreign currencies, the availability of funds for investment and each investment’s compatibility with our liquidity structure.

As mentioned in Item 11. Quantitative and Qualitative Disclosure about Market Risk, the market risk stated in the treasury book is measured with value at risk (VaR) metrics, and the position limits are based on the results of these methodologies. We have defined VaR limits that follow a hierarchical structure, which avoids the concentration of market risk in certain groups of assets and takes advantage of portfolio diversification. In addition to VaR limits, we use stop loss signals and limits, except for GAH, to inform senior management when accumulated losses are close to certain predefined thresholds in the trading book. Moreover, for the options portfolio in Bancolombia, we have set limits based on the sensitivity of the portfolio to the underlying volatility, underlying currency and interest rates.

As part of our operations, we hold cash and cash equivalents primarily in Colombian pesos, U.S. dollars and Guatemalan quetzals. These positions, as well as any other currency position, are determined by the treasury division in connection with our currency risk assessment and management. Specifically, our exposure to FX risk primarily arises from changes in the U.S. dollar/Colombian peso exchange rate. The exposure to currency risk is managed by our treasury division. We estimate VaR metrics to manage and limit foreign currency risk exposure across our balance sheet in Bancolombia, Valores Bancolombia, Bancoagrícola, Banistmo and Bam. These limits are supervised daily by our Market Risk Management Office. Our treasury division manages a derivative portfolio in Bancolombia and Banistmo, which includes foreign exchange forward transactions with the purpose, among others, of hedging our overall currency exposure.

Our Chief Treasury Officer (CTO) centralizes all the reports from the treasury directors in the subsidiaries in all geographies in which they are responsible for FX, investment and risk taking.

The Investment Committee is responsible for decision-making related to the management of the treasury areas and the CTO. The participants in the Investment Committee, which meets monthly, are: the CTO, the proprietary trading director, the market risk director, the treasury directors from each bank, and the head of each desk in Colombia (fixed income, FX and derivatives). This committee reviews the investment strategy portfolios, profit and loss figures, VaR levels and benchmark portfolios, based on the framework and risk appetite defined by the Board of Directors.

Performance is evaluated against benchmarks approved for each treasury, which includes a target position for each asset and established limits for every product and market in which the treasury operation may invest. There is a continuous follow-up of the portfolios by the Investment Committee.

B.3COMMITMENT FOR CAPITAL EXPENDITURES

See Item 4. Information on the Company - A. History and Development of the Company – Capital Acquisitions and Divestitures.

C.Research and development, patents and licenses, etc

Grupo Cibest invests in new business, conducts internal testing, and runs pilots and proofs of concept ('POCs') of new technologies aimed at creating new opportunities in our industry.

The innovations derived from these activities are protected by the rigorous management of trademarks and copyright, and the protection of industrial secrets. To date, there are no outstanding patents or processes to obtain new patents, and there are no licensing agreements for our solutions or digital creations.

D.Trend information

Operating conditions across our key markets are characterized by modest economic growth, broadly in line with the region’s slow but steady expansion in 2025. This environment is supported by easing inflation and increasingly accommodative monetary policies, while domestic demand has remained resilient despite external headwinds. Loan dynamics reflected a combination of resilient commercial activity, selective risk‑adjusted growth, and differentiated strategies across segments. Consolidated trends for the year were influenced by the reclassification of Banistmo as held for sale, which reduced reported loan volumes and impacted net income. However, net interest and valuation income in 2025 increased 1.35%, driven by a larger reduction in interest expenses relative to interest revenues, improvements in credit quality and more selective origination practices that contributed to lower provision charges and a healthier portfolio profile, while solid fee generation and sustained operating‑expense discipline supported results. Looking ahead, the evolution of monetary policy is expected to be favorable given our asset‑sensitive balance sheet, while our strong competitive position in deposits further supports sustained performance. The following is a brief discussion of recent trends affecting Grupo Cibest and the economy.

Loan volume performance

Gross loans and financial leases (before allowance for losses) decreased 8.27% in 2025, primarily reflecting the share purchase agreement of Banistmo, whose assets were reclassified as “assets related to investments in subsidiaries held for sale.” Following this adjustment, the consolidated loan portfolio totaled COP 256.4 billion at year‑end. The Colombian peso strengthened significantly during the period, appreciating 14.79% from COP 4,409.15 per U.S. dollar in December 2024 to COP 3,757.08 in December 2025, which materially affected the translation of foreign‑currency‑denominated portfolios and amplified the reported contraction. Excluding foreign‑exchange effects, the consolidated loan portfolio would have declined by 4.9%.

Expressed in Colombian pesos, consolidated loan balance decreased across all segments: commercial loans by 6.86%, mortgages by 17.55%, consumer loans by 5.57%, and microcredit by 21.39%. Loan balances showed growth across most of the geographies where we operate, but consolidated results were mainly driven by portfolio reclassification effects associated with Banistmo. Excluding the reclassification effect, consolidated loan growth would have reached 2.06%.

Loans in Bancolombia expanded 8.91% in 2025. Credit origination strengthened consistently throughout the year, supported by a gradual improvement in monetary conditions and a recovery in household demand. The mortgage portfolio recorded the highest percentage growth, benefiting from reduced‑rate programs implemented in the prior year and maintained through the first half of 2025. Consumer lending showed a clear shift in trend over the year, as progressive improvements in asset‑quality indicators supported the reactivation of growth, –particularly in personal loans and credit cards. Commercial loans grew at a more moderate pace in 2025, similar to the trend observed in 2024, when activity began to accelerate in line with the monetary policy change at the start of that year. Overall, these results were aligned with Colombia’s moderate economic recovery in an environment of contained inflation, which supported credit demand and sound asset quality.

Loans at Bancoagrícola grew 11.26% year‑over‑year in dollar terms. Commercial lending was the main driver of this expansion, reflecting solid activity among corporate clients, with strong dynamism in the construction sector, supported by large‑ticket disbursements, particularly concentrated in the fourth quarter of the year. Consumer loans also showed sustained growth, especially in personal loans and credit cards. This performance was underpinned by the continued expansion of our digital banking capabilities, which have enabled the Bank to reach a broader customer base and penetrate new customer segments. In 2025, the economy in El Salvador was mainly propelled by resilient private consumption supported by strong U.S. activity and remittance inflows. Fiscal dynamics remained constrained by rigid expenditures,

though short‑term consolidation efforts aligned with the government’s commitments to the IMF, global trade disruptions and a weakening textile sector weighed on external performance.

The credit portfolio in Bam was up 1.86% in dollar terms led by the performance of commercial lending, which stood out as the main driver of new disbursements. In contrast, consumer lending declined as Bam tightened origination of higher‑risk products to stabilize asset quality. Mortgage activity remained contained, reflecting the institution’s strategic focus on disciplined portfolio allocation and prioritization of segments that best support long‑term balance‑sheet objectives amid a more competitive pricing environment. In 2025, Guatemala’s economic activity was supported by private consumption and by the performance of financial services, textile production for export, tourism, and commerce. Inflation remained contained as fuel prices declined and earlier supply effects receded. Macroeconomic conditions remained stable under consistent policy management. Within this environment, portfolio growth reflected a selective, risk‑adjusted approach aimed at balancing expansion with prudent credit performance.

Banistmo’s credit portfolio was down 2.10% on an annual basis, when measured in U.S. dollars, decreasing across all loan categories except microcredit, due to a combination of stricter post‑pandemic risk controls and client‑specific adjustments. Mortgages saw the deepest contraction, driven by tighter origination policies following credit deterioration and delayed government subsidy flows. The commercial portfolio decreased as amortizations exceeded new loan originations. Consumer lending also contracted, reflecting weaker origination and risk discipline. Panama’s economic activity recovery in 2025 was gradual and continued to be weighed down by the shutdown of Cobre Panamá and trade disruptions linked to U.S. tariff announcements. These shocks weakened confidence and softened credit demand, limiting loan growth. Although Panama Canal activity and tourism gradually improved after El Niño-related interruptions, they did not fully offset the earlier decline, leaving the operating environment constrained by persistent fiscal pressures and uncertainty.

Foreign-denominated loans decreased 43.27% in 2025. This contraction was mainly explained by the reclassification of Banistmo’s dollar‑denominated loan portfolio, as well as lower credit demand and higher amortizations at Bancolombia Panamá. Looking ahead, an improving macroeconomic environment and strengthening domestic demand in El Salvador and Guatemala are expected to support a more favorable performance of the dollar‑denominated loan portfolio on a consolidated basis.

Net interest margin and valuation

The annualized net interest margin ('NIM') on a consolidated basis was 6.13% for 2025, down from 6.39% for 2024. Net interest margin comprises the loan interest margin and the margin on debt investments.

In 2024, Colombia's monetary authority initiated a gradual easing cycle, lowering the benchmark rate to 9.50% by year end. During 2025, however, the pace of monetary normalization slowed considerably. The policy rate remained unchanged at 9.50% in early 2025 and was subsequently held at 9.25% across several meetings, as the Central Bank prioritized caution in response to persistent inflationary pressures and increased macroeconomic uncertainty, While our credit portfolio continued to grow during the year, interest income declined, as our assets tend to reprice faster than our liabilities. However, supported by effective funding management, interest expense decreased at a faster pace, more than offsetting the pressure on interest income. As a result, net interest income recorded a slight expansion during the period.

Interest expenses have declined faster than interest income. Our funding strategy has focused on actively managing time deposits, allowing us to benefit from shorter maturities and a gradual repricing at lower rates ahead of central bank easing. At the same time, sight deposits gained relevance within the funding mix, driven by strong growth in saving accounts. Looking ahead, the expected interest rate environment in 2026 could gradually become more supportive, given our asset‑sensitive balance sheet, which would translate into higher loan yields as rates adjust. At the same time, our funding profile, anchored by a solid base of customer deposits and disciplined liability management strategies, should help mitigate pressure on margins. Overall, these factors are expected to contribute to stable net interest income performance going forward.

Cost of credit

For 2025, the cost of credit was 1.59% of average loans, down from 1.88% posted in 2024, due to lower behavior‑driven provisions, particularly in the consumer and SME portfolios, which exhibited stronger credit performance. The corporate segment also contributed, though to a lesser extent, through reduced provisions associated with better asset quality. Macroeconomic updates, which had a positive effect on provision expenses in 2024, had only a limited impact in 2025. Although releases were recorded in the first half of the year, these were offset by higher expenses in the fourth quarter, driven by a less favorable outlook following inflationary pressures and interest rate hikes. As the credit cycle normalizes across both retail and corporate portfolios, we anticipate a steadier cost of risk ahead. We maintain a strong balance sheet, supported by an adequate level of loan-loss reserves, reporting a coverage ratio to PDLs (overdue 30 days) of 134.41% at the end of the year. This performance was supported by improvements in credit risk management during the year, including enhanced analytical models, stronger early‑warning monitoring and more disciplined management of loan stages.

E.Critical accounting policies and estimates

The preparation of the Consolidated Financial Statements requires our management to make judgments, estimates and assumptions that affect the application of accounting policies and the reported amounts of assets, liabilities, income and expenses.

The material accounting policies, including the policies that include critical accounting estimates and judgments, are described in Note 2.E. to the Consolidated Financial Statements, Material accounting policies, Use of estimates and judgments.

The accounting policies listed below involve a high degree of uncertainty and could have a material impact on the Consolidated Financial Statements:

•Credit risk impairment: Expected credit losses are measured using both individual and collective models and methodologies. Collective models include parameters such as the 12‑month probability of default, lifetime probability of default (for loans classified in Stage 2), loss given default and exposure at default. These models apply a forward‑looking approach, which represents the most significant critical judgment in the estimation of expected credit losses. The estimation process incorporates reasonable and supportable forecasts of key macroeconomic variables that have a significant impact on impairment outcomes, including gross domestic product (GDP) growth, interest rates, inflation and the current account balance, among others. As of December 31, 2025, a total of COP 4,437,432 of credit impairment charges on loans, advances and financial leases, net, were recorded on the Consolidated Statement of Income, down from COP 4,964,893 on December 31, 2024 and COP 7,210,390 on December 31, 2023. The allowance for credit losses decreased by 18% in 2025 compared to the prior year. This decrease was primarily driven by the reduction in exposure and provisions across all stages, mainly as a result of the classification of Banistmo as a discontinued operation. In addition, the strong credit performance observed during 2025 contributed to lower provision levels, particularly in Stage 3. Although some specific clients in the commercial and consumer portfolios experienced credit deterioration, these effects were offset by the overall improvement in credit quality, together with the impact of the classification of Banistmo as a discontinued operation. For further information about the change of the allowance for credit losses from 2025 to 2024, see Note 6 to the Consolidated Financial Statements, Loans and Advances to Customers, Net, Impact of movements in the value of the portfolio and loss allowance by Stage section and Note Risk Management in the Credit Risk section.

•Impairment testing of cash generating units ('CGUs'), including goodwill: The identification of cash-generating units, the allocation of goodwill based on expectations as to which of our business segments will benefit from the business acquisition, the estimation of the future cash flows of the CGUs and the rates used to discount these cash flows are subject to a high degree of uncertainty. As of December 31, 2025, and December 31, 2024, a total of COP 1,947,325 and COP 9,017,419, respectively, of goodwill were recorded on the Consolidated Statement of Financial Position. In 2025, the Group recorded a goodwill impairment charge of COP 5,022,822 million related to the classification of Banistmo as a discontinued operation. See Note 2.E.2 to the Consolidated Financial Statements.

•Recognition of digital assets: Determining the appropriate accounting treatment for the digital asset holdings and for the custody of digital assets held by customers involves significant judgment, as there is currently no specific definitive guidance in IFRS or alternative accounting frameworks to account for these transactions. See Note 2.E.3 to the Consolidated Financial Statements.

•Deferred tax and uncertainty over income tax treatments: Due to the changing conditions of the political, social and economic environment, the constant changes in tax legislation and the constant changes in tax principles and interpretations by tax authorities, the determination of the tax bases of deferred tax items involves difficult judgments related to recoverability, which is based on expected future profitability, offsets or tax deductions. As of December 31, 2025, and December 31, 2024, COP 1,750,097 and COP 763,757, respectively, of deferred tax assets were recorded on the Consolidated Statement of Financial Position. See Note 2.E.4 and 13 to the Consolidated Financial Statements.

•Provisions and contingent liabilities: Significant judgment is required in determining whether a present obligation exists and in estimating the probability, timing and amount of any outflows, including the assumption of the discount rate where the timing of the outflow is greater than 12 months. As of December 31, 2025, and

December 31, 2024, COP 382,655 and COP 439,095, respectively, of provisions were recorded on the Consolidated Statement of Financial Position. See Note 2.E.5 to the Consolidated Financial Statements.

•Fair value of assets and liabilities: A variety of valuation techniques are used to determine the fair value of assets and liabilities, some of which involve significant unobservable inputs and are subject to significant uncertainty based on assumptions that would be used in the market to determine the price for assets or liabilities. As of December 31, 2025, and December 31, 2024, a total of COP 41,559,307 and COP 39,514,527, respectively, of assets and COP 4,514,630 and COP 2,679,643, respectively, were recorded in respect of liabilities that have been measured at fair value on a recurring basis in the Consolidated Statement of Financial Position. See Note 2.E.6 to the Consolidated Financial Statements.

•Measurement of employee benefits: The measurement of post-employment and long-term employee benefit obligations involves a number of inputs and is dependent on a number of assumptions about future events, such as discount rate, inflation rate, pension payments and deferred pensions, compensation and mortality. As of December 31, 2025, and December 31, 2024, COP 947,610 and COP 951,555, respectively, of liabilities relating to post-employment benefit and long-term benefit plans were recorded on the Consolidated Statement of Financial Position. See Note 2.E.7 to the Consolidated Financial Statements.

•Transaction price determination: We have fixed and variable prices considering the characteristics of each service, future events, discounts, returns and other variables that may influence the selling price. See Note 2.E.8 to the Consolidated Financial Statements.

•Leases: The measurement of the right-of-use asset and of the lease liabilities requires a series of judgments, among which are the determination of the term of the lease and the rate used in discounting the cash flows. As of December 31, 2025, and December 31, 2024, a total of COP 1,329,718 and COP 1,757,206, respectively, of right-of-use assets and COP 1,325,039 and COP 1,889,364, respectively, of lease liabilities were recorded on the Consolidated Statement of Financial Position. See Note 2.E.9 to the Consolidated Financial Statements.

Given the inherent uncertainties of the items above, the estimates and underlying assumptions are reviewed on an ongoing basis. Revisions to accounting estimates are recognized in the period in which the estimate is revised if the revision affects only that period, or in the period of the revision and future periods if the revision affects both current and future periods. Management bases its estimates and judgments on historical experience and various other factors that are believed to be reasonable under current circumstances. Actual results may differ from these estimates if assumptions and conditions change.

ITEM 6        Directors, Senior Management and Employees

A.Directors and senior management

The following persons acted as directors and senior managers of Grupo Cibest:

Directors

•Luis Fernando Restrepo Echavarría holds a bachelor’s degree in industrial management from the Georgia Institute of Technology and an MBA degree from the University of Chicago. He has been affiliated with The Marmon Group of Chicago and was part of the Leadership Rotational Program in Chicago at The Rego Company (Planning Production and Industrial Engineering), Hammond Organ Company (Financial and Cost Accounting) and Marmom Keystones (Sales). Mr. Restrepo currently serves as CEO of Crystal S.A.S., a company that produces and sells brands such as Gef, Punto Blanco, Baby Fresh and Galax. He is a member of the board of directors of: Etiflex S.A (Litography), Espumas Plásticas S.A.S - Comodisimos, and Proantioquia. He is also a member of the Georgia Tech Advisory Board until 2026. Mr. Restrepo has been a non-independent member of Grupo Cibest's Board since May 2025 and has served as member of Bancolombia's board of directors since 2016. He has been the Chairman of Grupo Cibest's Board since his appointment and the Chairman of Bancolombia's board of directors since April 2022. He was born in 1958.

•Ricardo Jaramillo Mejía holds a degree in civil engineering from Universidad EIA and has an MBA in finance from Boston University's Questrom School of Business. He currently serves as CEO of Grupo de Inversiones Suramericana S.A., the holding company of the Sura–Bancolombia financial conglomerate, where he previously served as Vice President of Business Development and Finance. He also served as CEO, Finance Vice President

and Project Manager in Banca de Inversión Bancolombia, among other roles in Fiduciaria Bancolombia. He is a member of the board of directors of Suramericana S.A., Sura Asset Management S.A., and Bancolombia, as well as on the board of directors of Fundación Sura, Fundación Ideas por la Paz (FIP), Consejo Privado de Competitividad, Fundación Empresarios por la Educación, Medellín Cultural Association, Medellín Philharmonic Orchestra, and the Superior Council of EIA University. Mr. Jaramillo has been a non-independent member of Grupo Cibest's Board of Directors since May 2025 and of Bancolombia's Board of Directors since June 2024. He has also been the Vice Chairman of Grupo Cibest's Board since his appointment and Vice Chairman of Bancolombia's board of directors since September 2024. He was born in 1972.

•Juan Esteban Toro Valencia holds a degree in administrative engineering from Universidad EIA and a postgraduate degree in economics from Universidad de los Andes. He also has an MBA with a concentration in Finance and Strategy from Emory University’s Goizueta Business School and completed the Strategic Financial Leadership Program at Stanford University’s Graduate School of Business. He currently serves as Vice President of Corporate Finance at Grupo Sura S.A. Previously, he served as Investment Manager at Grupo Sura, Project Manager at Banca de Inversión Bancolombia, and Investor Relations Manager at Bancolombia. He is an invited member of the governing council of Fundación PAN and serves on the boards of directors of Suramericana S.A., Sura Asset Management S.A., Enka de Colombia S.A. and Bancolombia. Mr. Toro has been a non-independent member of Grupo Cibest's Board of Directors since June 2025 and of Bancolombia's board of directors since April 2025. He was born in 1979.

•Andrés Felipe Mejía Cardona holds a degree in economics from the University of Michigan and an MBA from Universidad Eafit. He studied strategic planning at the Universitat de Barcelona, advanced management at the Universidad de los Andes and took part in the EXPRO Program in International Business at CBI Rotterdam, Netherlands. Mr. Mejía has extensive professional experience in foreign trade and international markets. He is CEO of MU Mecanicos Unidos S.A.S., a metal casting company with 86 years in the market and the owner of the brand Victoria Cast Iron Cookware. Mr. Mejía has been an independent member of Grupo Cibest's Board since May 2025. He previously served as an independent member of Bancolombia’s board of directors from 2016 to April 2025. He was born in 1962.

•Sylvia Escovar Gómez holds a degree in economics from the Universidad de los Andes. She has worked as chief economist of the World Bank´s resident mission in Colombia and was Head of the External Credit Division of the National Planning Department ('Departamento Nacional de Planeación' or 'DNP'). She served as Head of the Economic Research Service of the Central Bank in Cartagena, Head of the National Public Policy Evaluation System of the DNP and General Director of FES Leadership Foundation. She was Undersecretary of Education and Undersecretary of Finance of the municipal government of Bogota and previously served as Financial Vice President of Fiducolombia. She served as Chief Executive Officer of Organización Terpel S.A. from 2012 until 2020 and currently serves as a strategic advisor to its board of directors. She is also a member of the boards of directors of Grupo Energía de Bogota, Terpel S.A., Geo Park S.A.S. and ETB S.A. Ms. Escovar has been an independent member of Grupo Cibest's Board since May 2025. She previously served as an independent member of Bancolombia's board of directors from 2020 to April 2025. She was born in 1961.

•Silvina Vatnick holds a degree in economics from the University of Buenos Aires and a master’s degree in economics from UCEMA. She also received and MPhil in Macroeconomics and International Finance at Columbia University and completed a Management of Financial Institutions program at New York University. Her career has focused on macroeconomic policy, financial stability, bank and non-bank regulatory issues, corporate governance, access to finance, sustainability, and entrepreneurship. She has a solid technical expertise and a close understanding of the economies of Latin America, and the global economy after a distinguished career at the World Bank. Ms. Vatnick also has extensive experience in Central Banking and the management of financial institutions. She is cofounder and director of Global Outcomes LLC, a strategic advisory firm for companies, governments, and public and private institutions in Latin America and globally. She has been an Adviser to the U.S. Treasury Department’s Office of Technical Assistance on financial and regulatory stability issues. She is also a member of the Corporate Governance Task Force at the OECD. Ms. Vatnick has been an independent member of Grupo Cibest's Board since May 2025 and is the audit committee’s financial expert. She previously served as an independent member of Bancolombia’s board of directors from 2021 to April 2025 and was the audit committee’s financial expert. She was born in 1959.

•Nicolás Zapata Zuluaga, holds a degree in administrative engineering from Universidad EIA and a postgraduate degree in economics from Universidad de los Andes and Universidad EAFIT. He earned an MBA from IE University Business School and completed executive programs in Venture Capital Immersion at the Venture Capital Institute, Leveraging Fintech Innovation at Harvard Business School, and Value Investing at Columbia Business School. He currently serves as Chief Executive Officer of Astorga Kapital and Chief Operating Officer

of Aferox S.A.S. Previously, he held positions including Fund Trader at Suvalor, Dollar Securities Trader at Corfinsura, International Desk Trader at Bancolombia, Director of Special Products at Valores Bancolombia, and Chief Executive Officer at Gondwana S.A.S. He is an alternate member of the boards of Laboratorios Medick S.A.S., Base Cook S.A.S., Rutech S.A.S., Pasta Artesanale S.A.S., and Cervecería Nevada S.A.S., as well as a principal member of the board of directors of Fundación Los 8 Valores. Mr. Zapata has been an independent member of Grupo Cibest’s Board of Directors since June 2025. He was born in 1976.

For additional information regarding the Board of Directors and its functions, see Item 10 Additional Information – B. Memorandum and Articles of Association – Board of Directors.

Senior Management

•Juan Carlos Mora Uribe has been CEO of Grupo Cibest since April 30, 2025, and of Bancolombia since May 2016. Prior to his appointment as CEO, he was Vice President for Corporate Innovation and Digital Transformation, a post he held until 2015. He holds a bachelor's degree in business administration (BBA) from Universidad Eafit and an MBA degree from Babson College. Mr. Mora has wide experience in corporate finance and investment banking. Mr. Mora also previously served as Chief Risk Officer, Chief IT Officer, and Chief Operating Officer of Bancolombia. He is a member of the boards of directors of Proantioquia, Acumen Latinoamérica, Asociación Nacional de Empresarios Colombianos (ANDI), Asociación Nacional de Instituciones Financieras (ANIF), and Asobancaria and also chairs the Comité Universidad Empresa Estado – CUEE. He was born in 1965.

•Mauricio Rosillo Rojas has been the Business Vice President of Grupo Cibest since April 30, 2025, and of Bancolombia since December 2023. Mr. Rosillo holds a law degree from Pontificia Universidad Javeriana, a degree in financial legislation from Universidad de Los Andes, a master’s degree in commercial and economic law from the University of Georgia and additional training in European Community law from the Free University of Brussels. Mr. Rosillo has held several positions in the public and private sectors, including General Secretary of Federación Colombiana de Compañías de Leasing (Fedeleasing), Interim Colombian Superintendency of Cooperatives ('Superintendente de Economia Solidaria encargado), Director of Financial Regulation of the Colombian Ministry of Finance, Supervisor of the Securities Market of the Colombian Stock Exchange and President of the Colombian Self-Regulatory Organization (Autoregulador del Mercado de Valores - AMV). He was the Chief Legal Officer of Bancolombia from December 2008 until September 2019, when he was appointed as Corporate Vice President, a position that he held until his appointment as Business Vice President. As Business Vice President of Grupo Cibest and Bancolombia, he is responsible for proposing, implementing and controlling strategies aimed at generating value for Grupo Cibest’s businesses, aiming the consolidation and increase of Grupo Cibest's leadership in the market, among others. Mr. Rosillo is also a member of the board of directors of certain subsidiaries. He was born in 1969.

•Julián Mora Gómez has been the Business Development Vice President of Grupo Cibest and Bancolombia since March 1, 2026. He holds a law degree and a degree in insurance from Universidad Pontificia Bolivariana in Medellín and an MBA from the EADA Business School, and has participated in complementary executive programs at Stanford. Mr. Mora has held various roles in Bancolombia for more than 20 years, as a lawyer, commercial and regional manager of Fiduciaria Bancolombia, director of industry and trade of Banca de Inversión Bancolombia and CEO of Fiduciaria Bancolombia. He served as Chief Compliance Officer for Bancolombia from January 2022 until December 2023, when he was appointed Corporate Vice President, a position he held until his appointment as Business Development Vice President. He has also been a Professor at Pontificia Universidad Javeriana in Bogota. As Business Development Vice President of Grupo Cibest and Bancolombia, he is responsible for shaping and strengthening how the group's businesses communicate their value proposition. Mr. Mora is also a member of the board of directors of certain subsidiaries. He was born in 1976.

•Jaime Alberto Villegas Gutierrez has been the Corporate Services Vice President of Grupo Cibest since April 30, 2025, and of Bancolombia since October 2016. He holds an industrial engineering degree and a postgraduate degree in finance from Universidad de los Andes and has more than 30 years of international experience in the financial services industry. He has worked in the finance, operations and technology department of financial institutions such as Citibank and Standard Chartered Bank, the latter in Colombia, Peru, United Arab Emirates and Singapore. As Corporate Services Vice President of Grupo Cibest and Bancolombia, he is responsible for supplying corporate, administrative, technological, operational, and project support services to the business units, ensuring the normal development of our activities in Colombia and other countries. Mr. Villegas is also a member of the board of directors of certain subsidiaries. He was born in 1965.

•Rodrigo Prieto Uribe has been Corporate Risk Vice President of Grupo Cibest since April 30, 2025, and of Bancolombia since March 2011. He holds a degree in civil engineering from Universidad EIA and has a master’s degree in economics from Universidad de los Andes and a master’s degree in finance from Instituto Tecnológico y de Estudios Superiores de Monterrey. Mr. Prieto has held positions in various departments of Bancolombia, including Risk, Investment Banking, Financial Planning, Strategic Planning and Corporate Project Management. He has also been a professor at several universities, including Universidad Eafit, Universidad EIA and Universidad de los Andes. As Vice President of Corporate Risks of Grupo Cibest and Bancolombia, he is responsible for the design of Grupo Cibest's and Bancolombia's risk management strategy, and formulation of the risk appetite. Mr. Prieto is also a member of the board of directors of certain subsidiaries. He was born in 1973.

•José Mauricio Rodríguez Ríos has been the Internal Audit Vice President of Grupo Cibest since April 30, 2025, and of Bancolombia since August 2020. He has more than 25 years of experience in auditing, and has worked for Bancolombia since 1994. He previously served as Vice President of Internal Audit at Bancoagrícola. Mr. Rodríguez is a Certified Public Accountant from Universidad de Medellín and an IT Technician from Politécnico Colombiano. He also holds an Executive MBA from Centro Universitario Villanueva and a postgraduate degree in Finance from Universidad de Medellín. Mr. Rodríguez is also certified in international risk (CRMA) by IIA – The Institute of Internal Auditors- and is licensed to perform quality assessments (QA). As Vice President for Internal Audit of Grupo Cibest and Bancolombia, he is responsible for advising and coordinating the continuous evaluation of the Internal Control System of our companies as well as leading the development of the organizational control culture. He was born in 1972.

•Claudia Echavarría Uribe has been the Corporate Governance Vice President and General Counsel of Grupo Cibest and Bancolombia since March 1, 2026. She is a lawyer from Universidad Pontificia Bolivariana, has a Master of Laws degree from Columbia University Law School. She previously held the position of Legal Vice President and General Counsel of Bancolombia since December 2019, until March, 2026, and of Grupo Cibest since April, 2025 until March 2026. She was the corporate vice president and the general counsel of Almacenes Exito S.A. and held different positions in the legal department of Bancolombia and in Banca de Inversion Bancolombia between 2004 and 2015. As Corporate Governance Vice President of Grupo Cibest and Bancolombia, her mission is to build trust in the group's companies, leveraging the new business structure and strengthening relational capital to create competitive advantage. Additionally, she is in charge of the communications team. Ms. Echavarría is also a member of the board of directors of certain subsidiaries. She was born in 1979.

•Mauricio Botero Wolff has been the Strategy and Finance Vice President of Grupo Cibest since April 30, 2025, and of Bancolombia since August 2024. He holds a degree in administrative engineering from Universidad EIA, a postgraduate degree in economics from Universidad de los Andes, and an MBA from Emory University, which he completed as a Fulbright scholar. He has held different positions in Bancolombia, including as a Corporate Trader in the Treasury Department, Investor Relations Manager, Acquisitions Integration Manager and Corporate Projects Manager. He became Vice President of Administrative Services of Bancolombia in 2016, a position that he held until he became the Vice President of Customer and Employee Services in 2022. As Vice President of Strategy and Finance of Grupo Cibest and Bancolombia, he is responsible for directing and integrating the formulation and execution of the corporate strategy and the financial and treasury management, for our companies and businesses in all geographies. Mr. Botero is also a member of the board of directors of certain subsidiaries. He was born in 1978.

•Liliana Vásquez Uribe has been the Payments, Cash Flows, and Insurance Vice President of Grupo Cibest since March 1, 2026. She holds a degree in Business Administration from Universidad EAFIT, with studies in Marketing Management with an emphasis on Products and Managerial Development in Boards of Directors from Universidad de los Andes. She has international certifications in banking payment instruments from Tecnológico de Monterrey, executive training in Marketing from Kellogg–Northwestern, Strategic Innovation from Babson College, studies in digital banking from IE University, financial sustainability from Barcelona School of Management, and global strategic vision under the World of Tomorrow program of IE University. She has held different positions in the group since 1996, including Vice President of Payment Methods for Colombia, Panama, Guatemala and El Salvador; Vice President of Product and Channel Development; and Vice President of Products. Ms. Vásquez is also a member of the board of directors of certain subsidiaries. She was born in 1969.

•Alejandro Botero López has been the Corporate Vice President of Grupo Cibest and Bancolombia since March 1, 2026. He holds a degree in Business Administration from Universidad EAFIT, with a postgraduate degree in Economics from Universidad de los Andes and a Master’s Degree in Management and Marketing from the University of Barcelona. He completed a Senior Management Program at IE Business School and the Global CEO Program, jointly developed by IESE Business School and MIT, with international training in Singapore, Boston,

and Barcelona. He has held different positions in Bancolombia since 2002, including Director of Strategic Alliances, Vice President of Private Banking, President of the Sufi business line, and Vice President of Mobility Leasing, Rental and Use. As Corporate Vice President of Grupo Cibest and Bancolombia, he is the strategic leader for Human Resources Compliance, and Diversity, Equity and Inclusion (DEI), ensuring high standards of organizational culture. He is also responsible for formulating and implementing Sustainability standards and directing the Bancolombia Foundation. Mr. Botero is also a member of the board of directors of certain subsidiaries. He was born in 1976.

Cipriano López González, held the position of Vice President of Innovation and Sustainability until March 1, 2026.

There are no family relationships between the directors and senior management of Grupo Cibest listed above.

No arrangements or understandings have been made by major shareholders, customers, suppliers or others pursuant to which any of the above directors or members of senior management were selected.

The Good Governance Code of Grupo Cibest sets a mandatory retirement age of 65 years for senior management and suggests a retirement age of 75 years for members of the Board of Directors.

B.Compensation of Directors and Officers

In 2025, Grupo Cibest paid each member of the Board of Directors who resides in Colombia a fixed fee of COP 15.5 million per month for membership of the Board.

In addition, Grupo Cibest paid the following fixed monthly fees for participation in Support Committees:

•Audit and Risk Committees: COP 15.5 million.

•Good Governance Committee and Designation, Compensation and Development Committee: COP 5.2 million.

Grupo Cibest also provides differential compensation to the Chair of the Board of Directors and to the Chairs of the Support Committees, consisting of fixed monthly fees.

•Chair of the Board of Directors: COP 20.1 million

•Chairs of Audit and Risk Committees: COP 18.6 million

•Chairs of Good Governance Committee and Designation, Compensation and Development Committee: COP 6.2 million

In 2025, Grupo Cibest paid each member of the Board of Directors who does not reside in Colombia a fixed fee of USD 3,500 per month for membership of the Board. Such fees correspond to a scheme that is different from and independent of that applicable to members of the Board of Directors who reside in Colombia.

In addition, Grupo Cibest paid the following fixed monthly fees for participation in Support Committees:

•Audit and Risk Committees: USD 3,500.

•Good Governance Committee and Designation, Compensation and Development Committee: USD 1,200.

Grupo Cibest also provides differential compensation to the Chair of the Board of Directors and to the Chairs of the Support Committees, consisting of fixed monthly fees.

•Chair of the Board of Directors: USD 4,500

•Chairs of Audit and Risk Committees: USD 4,100

•Chairs of Good Governance Committee and Designation, Compensation and Development Committee: USD 1,400

Grupo Cibest also grants each member of the Board who does not reside in Colombia travel expenses for USD 278 per day of travel for their in-person attendance at the Board or Support Committees.

In accordance with our current policy, 70% of directors’ fees are paid in cash each month and the remaining 30% is paid through a contribution to a fund that invests in Grupo Cibest shares. Directors can withdraw money from the fund two years after the respective contribution is made.

The directors received no other compensation or benefits, and there is no stock option plan for them.

The Board maintains a Designation, Compensation and Development Committee, which consists of three Board members. This Committee supports the Board in matters related to the selection, appointment, hiring, and remuneration policies for senior management officers and other matters related to Grupo Cibest's remuneration model.

The Board of Directors approves any salary increases for the Chief Executive Officer of Grupo Cibest and Bancolombia and salary policies for other employees.

Consistent with Colombian law, Grupo Cibest does not publish information regarding the compensation of its individual officers. The aggregate amount of remuneration paid by Grupo Cibest to senior management during the fiscal year ended December 31, 2025, is disclosed in Note 28. Related party transactions of consolidated financial statements.

Grupo Cibest has an incentive plan that awards bonuses annually to its senior management. In determining the amount of any bonuses, Grupo Cibest takes into consideration the overall return on equity of Grupo Cibest and its senior management's achievement of established goals. Bonuses are paid in cash and through an investment fund that invests in Grupo Cibest shares. Members of the senior management can withdraw from the fund three years following the respective contributions are made.

C.Board Practices

The following table reflects the composition of the Board of Directors of Grupo Cibest as of April 8, 2026

Name	Elected to the Board	Term Expires
Luis Fernando Restrepo Echavarría	2025	2027
Andrés Felipe Mejía Cardona	2025	2027
Sylvia Escovar Gómez	2025	2027
Silvina Vatnick	2025	2027
Ricardo Jaramillo Mejía	2025	2027
Nicolás Zapata Zuluaga	2025	2027
Juan Esteban Toro Valencia	2025	2027

Andrés Felipe Mejía Cardona, Sylvia Escovar Gómez, Nicolás Zapata Zuluaga and Silvina Vatnick are independent directors in accordance with Grupo Cibest's bylaws, Colombian laws and NYSE standards. Luis Fernando Restrepo is considered a non-independent member under Colombian regulations, as he is also a member of the Board of Directors of Bancolombia, a subsidiary of Grupo Cibest. Consequently, the majority of the Board of Directors is composed of independent directors. Neither Grupo Cibest nor its subsidiaries have any type of agreement with Grupo Cibest's directors providing for benefits upon termination of their term.

The following are the current terms of office and the period served for members of senior management. There are no defined expiration terms. The members of senior management can be removed by the Board of Directors.

Name	Period Served
President
Juan Carlos Mora Uribe	Since 2025
Vice Presidents
Mauricio Rosillo Rojas	Since 2025
Julián Mora Gómez	Since 2025
Jaime Alberto Villegas Gutierrez	Since 2025
Rodrigo Prieto Uribe	Since 2025
José Mauricio Rodríguez Ríos	Since 2025
Claudia Echavarría Uribe	Since 2025
Mauricio Botero Wolff	Since 2025
Liliana Vásquez Uribe	Since 2026
Alejandro Botero López	Since 2026

For further information about Grupo Cibest’s corporate governance practices please see Item 16. Reserved – B. Corporate Governance and Code of Ethics.

Audit Committee

Grupo Cibest’s Board of Directors, in compliance with Colombian and American regulations, maintains an Audit Committee that is currently composed of three (3) Board members, all of whom must be independent directors. The current members of the Audit Committee are Andrés Felipe Mejía Cardona, Silvina Vatnick and Nicolás Zapata Zuluaga. The Board of Directors elected Silvina Vatnick and Andrés Felipe Mejía Cardona as members of the Audit Committee on May 2, 2025 and re-elected them as members of the Audit Committee on June 18, 2025. Additionally, the Board of Directors elected Nicolás Zapata Zuluaga as member of the Audit Committee on June 18, 2025. Each of them serves as an independent member of the Board of Directors.

Pursuant to the applicable U.S. regulations for foreign private issuers, Ms. Silvina Vatnick has served as the financial expert of the Audit Committee since June 2025, she previously served as the financial expert of the audit committee of Bancolombia from May 2021 until April 2025. In addition, the Committee has an independent advisor and expert in financial reporting and auditing matters, who provides advice to the Committee on such matters.

For a broader description of the experience and qualifications of Mr. Mejía, Ms.Vatnick and Mr. Zapata see Item 6. Directors, Senior Management and Employees—A. Directors and Senior Management.

This Committee has a charter approved by the Board of Directors that establishes its composition, organization, objectives, duties, responsibilities and extension of its activities. The main purpose of this Committee is to support the Board of Directors in overseeing the effectiveness of Grupo Cibest's internal control system, specifically, and of Cibest Corporate Group in general, as well as in its continuous improvement. Other specific responsibilities of the Committee include:

(i) ensuring that the preparation, presentation, and disclosure of financial and accounting information comply with applicable regulations and the financial performance targets established, verifying that the necessary controls are in place for such purpose.

(ii) submitting to the general shareholders’ meeting, through the Board of Directors, the candidates for the position of external auditor, without prejudice to the shareholders’ right to propose other candidates at the respective meeting. For this purpose, the Committee reviews the information provided by the candidates and presents to the general shareholders' meeting the results of its assessment.

(iii) conducting an annual evaluation of the internal control system, the draft year-end financial statements and their notes, the auditors’ reports, the observations issued by oversight entities, the results of the evaluations conducted by the internal audit and the external auditor, and any other relevant documents. As a result of this process, the Committee shall present to

the Board of Directors the annual management report, which will be submitted for consideration by the shareholders’ meeting.

(iv) approving the annual internal audit plan, as well as its annual budget and resource plan.

(v) overseeing the functions and activities of internal audit and/or other control bodies within Cibest Corporate Group, in order to determine their independence and objectivity with respect to the activities they audit, identify any limitations that may hinder their proper performance, and verify that the scope of their work meets the control needs established by the entity.

(vi) receiving and reviewing the reports submitted by the external auditor, internal audit, and other external auditors regarding weaknesses identified in the assessment of the effectiveness of the internal control system, as well as other internal control reports prepared by such bodies, ensuring appropriate follow-up on management’s actions.

(vii) proposing to the Board of Directors the implementation of controls to prevent, detect, and adequately respond to fraud risks. The Committee also reviews, reports, and recommends measures to be adopted in cases of fraud that may affect the quality of financial information.

(viii) overseeing the services provided by the external auditor, assessing their quality and effectiveness, and informing the Board of Directors of any situations that may jeopardize their independence or limit their access to information.

(ix) reviewing non-recurrent operations with related parties, according to the Good Governance Code.

(x) evaluating and advising the potential conflicts of interests of directors and members of senior management.

(xi) monitoring compliance with ESG commitments and the closing of identified gaps.

(xii) evaluating the programs designed to prevent cybersecurity risks, including a review of the semi‑annual cybersecurity reports submitted by management to the Board of Directors, as well as a reviewing material cybersecurity incidents of the Cibest Corporate Group.

(xiii) periodically reviewing reports regarding cybersecurity management.

Further, the Internal Auditor of Grupo Cibest and the Compliance Officer report to the Audit Committee. Likewise, Grupo Cibest has a management-level Ethics Committee that reports to the Audit Committee and is in charge of defining general policy issues and giving guidelines on ethics, conduct and integrity, as well as defining corporate positions in the face of difficult ethical dilemmas. From time to time, the Audit Committee may be informed of diagnostic studies of the ethical culture in Grupo Cibest.

Unless there are no matters to be addressed, the Audit Committee meets at least every three months, upon prior notice issued by the Secretary or the Chair of the Committee. In addition, the Committee may meet in extraordinary sessions convened by the Chair or the Secretary of the Committee, as often as deemed necessary. The Committee met a total of seven (7) times during 2025. Additionally, between January and May 2025, the Audit Committee of Bancolombia, which during that period was the parent company of the group, met five (5) times.

The shareholders establish the remuneration of the members of the Audit Committee in their general meeting.

Designation, Compensation and Development Committee

This committee is composed of three (3) Board members of which at least one (1) must be an independent director, who is elected by the Board itself. The Manager of Human Resources of Bancolombia acts as secretary of this Committee.

The Designation, Compensation and Development Committee has a charter approved by the Board of Directors that governs matters such as its composition and meeting invitees, and the roles, responsibilities and internal rules of the Committee.

The Designation, Compensation and Development Committee supports the Board of Directors in matters related to the appointment, hiring, remuneration and compensation policies for senior management officers and other matters related to Grupo Cibest's and Bancolombia's remuneration model.

The duties of the Designation, Compensation and Development Committee are:

(i) proposing to the Board of Directors the succession policy for the senior management of Grupo Cibest and Bancolombia.

(ii) evaluating and proposing to the Board of Directors candidates for the positions of CEO of Grupo Cibest and Bancolombia.

(iii) proposing to the Board of Directors the remuneration policy for the senior management of Grupo Cibest and Bancolombia. When the remuneration policy for Grupo Cibest's and Bancolombia's senior management includes a variable component linked to Grupo Cibest's shares, it shall be submitted for approval by the General Shareholders' Meeting.

(iv) periodically reviewing the remuneration programs for senior management of Grupo Cibest and Bancolombia and proposing updates as appropriate.

(v) presenting to the Board of Directors proposals for corporate human management policies within its competence, such as annual salary increases, non-traditional work schemes, inclusion policies, among others.

The members of the Designation, Compensation and Development Committee are Ricardo Jaramillo Mejía, Luis Fernando Restrepo Echavarria and Sylvia Escovar Gómez. The committee met 3 times during 2025. Additionally, between January and May 2025, the Designation, Compensation and Development Committee of Bancolombia, which during that period was the parent company of the group, met twice.

The shareholders establish the remuneration of the members of the Committee at the ordinary General Shareholders' Meeting.

Good Governance Committee

The Good Governance Committee is composed of 3 members of the Board of Directors, of which at least 1 must be an independent director. Grupo Cibest’s CEO attends this committee on a permanent basis.

The Good Governance Committee has a charter approved by the Board of Directors that governs matters such as its composition and meeting invitees, and the roles, responsibilities and internal rules of the Committee.

The purpose of this Committee is to assist the Board of Directors in overseeing compliance with corporate governance policies established by Grupo Cibest, as well as in reviewing any proposed changes to such measures. The Committee also supports the Board of Directors in matters related to determining Board succession policies and its remuneration. Likewise, the Committee approves Grupo Cibest’s ESG strategy and monitors compliance with such strategy.

This Committee also prepares the annual calendar of meetings of the Board of Directors, and makes recommendations regarding the agenda for such meetings; reviews the results of the internal self‑assessment and/or the external annual assessment of the performance of the Board of Directors, and formulates recommendations aimed at improving its effectiveness, as well as that of its supporting committees, including through the efficient use of available resources and technology; and reviews, on a prior basis, the policies, guidelines, and measures to be submitted to the Board of Directors for consideration and approval in matters relating to the corporate governance of Grupo Cibest, submitting proposals for the updating or amendment of the provisions currently in force in this regard, among others.

The members of the Good Governance Committee are Sylvia Escovar Gómez, Silvina Vatnick and Luis Fernando Restrepo Echavarría. The committee met 5 times in 2025. Additionally, between January and May 2025, the Good Governance Committee of Bancolombia, which during that period was the parent company of the group, met 3 times.

The shareholders establish the remuneration of the members of the Committee at the ordinary General Shareholders' Meeting.

Risk Committee

Grupo Cibest’s Risk Committee consists of 3 members of the Board of Directors. Its president must be an independent director.

The Risk Committee has a charter approved by the Board of Directors that establishes its composition, organization, objectives, duties, responsibilities and activities.

The main purpose of this Committee is to support the approval, follow-up and control of policies, guidelines and strategies for risk management. In addition, this Committee supports Grupo Cibest's Board of Directors in matters such as knowledge and understanding of the risks assumed by Grupo Cibest and the monitoring of its risk appetite, including its subsidiaries, and the capital required to administer such risks.

Among other responsibilities, the Risk Committee supports the Board of Directors in verifying compliance with the risk governance structure, and strategies for managing risks, capital and liquidity and their disclosure.

The Committee is aware of global trends with the aim of identifying the risks to which our companies are exposed, strengthening the maturity and management of both traditional and non-traditional risks; and monitoring and issuing recommendations in line with the dynamics of business and its associated risks.

The Committee also oversees the methodology, procedures, and tools for cybersecurity risk management, as well as the policies for its proper governance.

The members of the Risk Committee are Andrés Felipe Mejía Cardona, Silvina Vatnick and Juan Esteban Toro Valencia. The Risk Committee meets every 2 months and met 6 times in 2025. Additionally, between January and May 2025, the Risk Committee of Bancolombia, which during that period was the parent company of the group, met 4 times.

The shareholders establish the remuneration of the members of the Committee at the ordinary General Shareholders' Meeting.

D.EMPLOYEES

The following table sets forth the number of our employees for the last three fiscal years:

As of December 31,	Total number of employees<br><br>Cibest Corporate Group*
2025	33,951
2024	34,114
2023	34,756

*Total number of employees in 2023 and 2024 were reported under 'Grupo Bancolombia'.

The following table sets forth the number of our employees for 2025:

Cibest Corporate Group
Company	Number of employees
Bancolombia S.A, Valores Bancolombia, Fiduciaria Bancolombia and Banca de Inversión (Colombia)	23,447
BAM (Guatemala)	3,233
Banco Agrícola (El Salvador)	3,097
Banistmo (Panamá)	2,119
Bancolombia Panamá and Puerto Rico	190
Valores Banistmo (Panamá)	46
Subtotal	32,132
Other companies	Number of employees
---	---
Renting	941
Nequi S.A. Compañía de Financiamiento	579
Wompi S.A.S	194
Wenia	79
Grupo Cibest S.A.	12
Cibest Capital Holdings y filiales	10
Valores Simesa S.A	2
Banagrícola Costa Rica	2
Subtotal	1,819
Total Cibest Corporate Group	33,951

As of December 31, 2025, we had 33,951 employees; approximately 74.4% are located in Colombia, 9.5% in Guatemala, 9.1% in El Salvador, and 7.0% in Panama, Puerto Rico and other places. Of the total, 45.6% are operational personnel and 54.4% are professional or managerial employees.

Companies with active union membership are Bancolombia, Valores Bancolombia, Banca de Inversión Bancolombia, and Fiduciaria Bancolombia. The trade union density is 41.6% in these companies. In line with our Social Dialogue Model, our Collective Bargaining Agreement (CBA) is effective from November 2023 until October 2026 for all operating personnel, regardless of whether they are union members. The CBA coverage rate is 48% of the total employees in those companies.

Four trade unions submitted independent lists of petitions requesting the intervention of arbitral tribunals to solve pending pleas. However, the CBA reached with the more representative unions (Uneb and Sintrabancol) applies to all operating personnel of other unions.

During 2025, we employed an average of 250 persons per month in Colombia through temporary employment agencies.

E.Share Ownership

None of the directors or members of senior management directly owned Common or Preferred shares in Grupo Cibest as of December 31, 2025.

As of March 18, 2026, (i) none of the directors or members of senior management directly owned Common or Preferred Shares in Grupo Cibest, but all of the directors and members of senior management indirectly own Common Shares and Preferred Shares of Grupo Cibest, whether through the institutional fund SVA (which holds 1.87% of Grupo Cibest’s shares) or through their respective beneficial owners. The number of shares or the corresponding percentage in each case represents a beneficial ownership of less than 1% of Grupo Cibest's outstanding shares.

The following table provides the names of Grupo Cibest directors and members of senior management who indirectly held shares of Grupo Cibest as of March 18, 2026.

Directors / Members of Senior Management	Common Shares	Preferred Shares	Percentage of Outstanding Preferred Shares	Percentage of Total Share Capital
Luis Fernando Restrepo Echavarría	*	*	*	*
Andrés Felipe Mejía Cardona	*	*	*	*
Sylvia Escovar Gómez	*	*	*	*
Silvina Vatnick	*	*	*	*
Ricardo Jaramillo Mejía	*	*	*	*
Nicolás Zapata Zuluaga	*	*	*	*
Juan Esteban Toro Valencia	*	*	*	*
Juan Carlos Mora Uribe	*	*	*	*
Mauricio Rosillo Rojas	*	*	*	*
Julián Mora Gómez	*	*	*	*
Jaime Alberto Villegas Gutiérrez	*	*	*	*
Rodrigo Prieto Uribe	*	*	*	*
José Mauricio Rodríguez Ríos	*	*	*	*
Claudia Echavarría Uribe	*	*	*	*
Mauricio Botero Wolff	*	*	*	*
Liliana Patricia Vásquez Uribe	*	*	*	*
Alejandro Botero López	*	*	*	*

*None of the directors or members of senior management held or beneficially owned, individually or in the aggregate, more than 1% of Grupo Cibest’s outstanding Common Shares, Preferred Shares, or a combination of both classes of shares.

As of December 31, 2025, there are no stock options to acquire any of Grupo Cibest’s outstanding Common Shares or Preferred Shares or share-based payments to any employee.

F.Disclosure of a registrant's action to recover erroneously awarded compensation

Pursuant to Section 303A.14 of the NYSE Listed Company Manual (Erroneously Awarded Compensation), each listed issuer that does not qualify for an exemption set forth in the rule was required to adopt a recovery policy by December 1, 2023. Complying with the rule, the Board of Directors of Grupo Cibest approved the implementation of a Recovery Policy (or Clawback Policy) on May 27, 2025.

Grupo Cibest was not required to prepare an accounting restatement that required recovery of erroneously awarded compensation pursuant to its compensation recovery policy, nor was there any outstanding balance at the end of 2025 of erroneously awarded compensation to be recovered from the application of the policy to a prior restatement.

ITEM 7           Major Stockholders and Related Party Transactions

A.Major stockholders

In accordance with Grupo Cibest's bylaws, there are two classes of authorized and outstanding stock: Common Shares and Preferred Shares. Each Common share entitles its holder to one vote at meetings of our stockholders, and there are no differences in the voting rights conferred by any of the Common Shares. Under Grupo Cibest's bylaws and Colombian corporate law, holders of Preferred Shares (and consequently, holders of ADSs) have no voting rights, other than in limited

circumstances as described in Item 10. Additional Information – B. Memorandum and Articles of Association – Description of Share Rights, Preferences and Restrictions – Voting Rights – Preferred Shares.

The following table sets forth, solely for purposes of United States securities laws, certain information regarding the beneficial ownership of Grupo Cibest’s capital stock by each person known to Grupo Cibest to own beneficially more than 5% of each class of Grupo Cibest’s outstanding capital stock as of December 31, 2025. A beneficial owner includes anyone who has the power to receive the economic benefit of ownership of the securities.

Name	Common Shares	Preferred Shares	% Ownership of<br><br>Common<br><br>Shares(1)	% Ownership of<br><br>Preferred<br><br>Shares(1)	% Ownership of<br><br>Total Shares (1)
Grupo de Inversiones Suramericana S.A (2)	235,012,336	—	46.16 %	— %	24.65 %
ADR Program	—	113,309,660	— %	25.51 %	11.89 %

(1)Common Shares have one vote per share; Preferred Shares have limited voting rights under certain circumstances specified in the bylaws of Grupo Cibest filed as Exhibit 1 to this Annual Report

(2)Represents ownership of Grupo de Inversiones Suramericana S.A. directly and through its subsidiaries: Grupo de Inversiones Suramericana Panamá S.A., Inversiones y Construcciones Estrategicas S.A., CIA. Suramericana de Seguros de Vida S.A., Cia. Suramericana de Seguros S.A., Suratep.

As of December 31, 2025, a total of 509,103,132 Common Shares and 444,111,532 Preferred Shares were registered in our stockholder registry in the name of 53,007 stockholders. A total of 113,309,660 representing 25.51% of Preferred Shares were part of the ADR Program and were held by 33 record holders registered in The Bank of New York Mellon’s registered stockholder list. Given that some of the Preferred Shares and ADSs are held by nominees, the number of record holders may not be representative of the number of beneficial owners.

During the past year, Grupo de Inversiones Suramericana S.A. increased its ownership to 24.65% on December 31, 2025 from 24.43% on December 31, 2024. The ADR program decreased as a percentage of our total ownership, from 12.70% on December 31, 2024, to 11.89% by the end of December 2025. Fondo de Pensiones Obligatorias Porvenir Moderado and Fondo de Pensiones Obligatorias Protección Moderado – both Colombian private pension fund managers that held more than 5% of Grupo Cibest’s outstanding capital in previous years – reduced their ownership to below 5% as of December 31, 2025.

There were no other significant changes in the percentage of ownership held by major shareholders in the last year.

There are no arrangements known to Grupo Cibest that may at a subsequent date result in a change in control of the company. To the extent known to Grupo Cibest, and in accordance with Colombian law, Grupo Cibest is not directly or indirectly owned or controlled by any other entity or person.

B.RELATED PARTY TRANSACTIONS

Our Good Governance Code provides that in no event may any transaction regarding Grupo Cibest's shares that is carried out by any officer, director or manager be executed for speculative purposes, which would be presumed if the following three conditions were met:

(a) if suspiciously short lapses of time exist between the purchase and the sale of shares;

(b) if situations arise proving to be exceptionally favorable for Grupo Cibest;

(c) if significant profits are obtained from this transaction.

All transactions that we enter into with our directors, officers and senior management are subject to the limitations and conditions set forth by the applicable law governing the prevention, handling and resolution of conflicts of interest.

Over time, Bancolombia, Grupo Cibest's largest operating subsidiary, has granted loans and engaged in other transactions with related parties. Such loans were made in the ordinary course of business, on substantially the same terms, including interest rates and required collateral, as those prevailing at the time for comparable transactions with other persons, and did not involve more than the normal risk of collectability, and do not present any additional unfavorable terms for Grupo Cibest.

On a nonconsolidated basis, Bancolombia had a total of COP 2,145,059 million in loans outstanding to related parties as of February 28, 2026. The principal amounts outstanding as of February 28, 2026, included in this amount are:

Entity	Amount<br>outstanding	Accrued <br>Interest	Average <br>Interest rate
	In millions of COP, except percentages
Subsidiaries Grupo Sura	2,008,823	21,633	13.01	%

For additional information regarding our related party transactions, please see Note 28. Related party transactions to the Consolidated Financial Statements.

C.Interests of Experts and Counsel

Not applicable.

ITEM 8         FINANCIAL INFORMATION

A.CONSOLIDATED FINANCIAL STATEMENTS AND OTHER FINANCIAL INFORMATION

A.1CONSOLIDATED FINANCIAL STATEMENTS

Reference is made to pages F-1 through F-215.

A.2Legal Proceedings

We are involved in normal collection proceedings and restructuring proceedings with respect to certain borrowers as well as other legal proceedings. For further information regarding legal proceedings, see Note 21.2 - Provisions and Contingent Liabilities to the Consolidated Financial Statements.

A.3Dividend Policy

The declaration, amount and payment of dividends are based on Grupo Cibest’s unconsolidated earnings. Dividends must be approved at the ordinary annual shareholders’ meeting upon the recommendation of the Board of Directors. Under the Colombian Commercial Code, after payment of income taxes and appropriation of legal and other reserves, and after setting off losses from prior fiscal years, Grupo Cibest must distribute to its stockholders at least 50% of its annual net income or 70% of its annual net income if the total amount of reserves exceeds its outstanding capital. Such dividend distribution must be made to all stockholders, in cash or in issued stock of Grupo Cibest, as may be determined by the stockholders, and within a year from the date of the ordinary annual shareholders’ meeting in which the dividend was declared. According to Colombian law, the minimum dividend per share may be waived by an affirmative vote of the holders of 78% of the voting shares present at the shareholders’ meeting.

The annual net profits of Grupo Cibest must be applied as follows: (i) first, an amount equal to 10% of Grupo Cibest’s net profits to a legal reserve until such reserve is equal to at least 50% of Grupo Cibest’s paid-in capital; (ii) second, to the payment of the minimum dividend on the Preferred Shares (for more information, see Item 10. Additional Information – B. Memorandum and Articles of Association); and (iii) third, as may be determined in the ordinary annual shareholders’ meeting by the vote of the holders of a majority of the shares entitled to vote.

The following table sets forth the annual cash dividends paid on each common share and each preferred share during the periods indicated:

Dividends declared with respect to net<br>income earned in:	Cash dividends<br><br>per share(1)(2)	Cash dividends<br><br>per share(1)(3)
	(COP)	(U.S.dollars)
2025	4,512	1.198
2024(4)	4,524	1.078
2023	3,536	0.899
2022	3,536	0.735
2021	3,120	0.831

(1)Includes Common Shares and Preferred Shares.

(2)Cash dividends for 2025 will be paid in quarterly installments.

(3)Amounts have been translated from pesos at the Representative Market Rate in effect at the end of the month in which the dividends were declared in March. In 2025, the amount were converted from pesos at the representative market rate at the end of February.

(4)During 2024, the total value of cash dividends includes an ordinary dividend of COP 3,900 and an extraordinary dividend of COP 624.

B.SIGNIFICANT CHANGES

On March 31, 2026, the board of directors of the Central Bank decided to increase the policy rate by 100 basis points, from 10.25% to 11.25%, in response to the persistence of inflationary pressures and the deterioration of macroeconomic balances.

On February 11, 2026, the Colombian government issued Legislative Decree No. 150, pursuant to which it declared a State of Economic, Social, and Ecological Emergency in certain departments of Colombia. Subsequently, on February 24, 2026, the government enacted Decree No. 173, which established, as a temporary tax measure for the 2026 fiscal year, a net worth tax applicable to Colombian legal entities that are taxpayers of the corporate income tax as of March 1, 2026. The general tax rate is 0.5% applied to net equity, while a special rate of 1.6% applies to financial institutions, brokerage firms, and other entities operating in certain specific sectors.

On January 30, 2026, the board of directors of the Central Bank decided to increase the policy rate by 100 basis points, from 9.25% to 10.25%, in response to the persistence of inflationary pressures and the deterioration of macroeconomic balances.

On January 29, 2026, the Constitutional Court of Colombia ordered the provisional suspension of Legislative Decree 1474 of 2025 while it carries out its constitutionality review. This decree established temporary tax measures applicable to fiscal year 2026 within the framework of the State of Economic Emergency.

As of December 31, 2025, Decree 1474 of 2025 was fully in force and, consequently, Cibest Corporate Group recognized its effects in the determination of income tax and the measurement of deferred tax (see Note 13. Income Tax).

The subsequent suspension does not provide evidence of conditions that existed at the reporting date, and the Decree has not been fully repealed, as it remains subject to the Court’s substantive review. Therefore, this event does not result in modifications to the amounts recognized as of December 31, 2025. However, it is disclosed due to its relevance for users of the financial statements.

ITEM 9        THE OFFER AND LISTING

A.OFFER AND LISTING DETAILS

Grupo Cibest´s ADSs, each representing four Preferred Shares, began trading on the NYSE on May 19, 2025, under the symbol 'CIB,' the same symbol under which Bancolombia's ADSs were traded on the NYSE prior to the Corporate Structure Changes in accordance with its Supplemental Listing Application. The CUSIP for Grupo Cibest's ADSs is 40090E 106. The NYSE filed a Form 25 with the SEC to remove the listing of Bancolombia's ADSs on the NYSE and from registration under Section 12(b) of the Exchange Act. Grupo Cibest´s Preferred Shares are also listed on the Colombian Stock Exchange.

ADRs evidencing ADSs are issuable by The Bank of New York Mellon (the 'Depositary'), as Depositary, pursuant to the Deposit Agreement, dated May 16, 2025, entered into by Grupo Cibest, the Depositary, the owners of ADSs from time to time and the owners and beneficial owners from time to time of ADSs, pursuant to which the ADSs are issued (as amended, the 'Deposit Agreement'). Copies of the Deposit Agreement are available for inspection at the Corporate Trust Office of the Depositary, currently located at 101 Barclay Street, New York, New York 10286, and at the office of Fiduciaria Bancolombia, as agent of the Depositary, currently located at Carrera 48, No. 26 - 85, Medellin, Colombia or Carrera 11 No. 91-42, Bogota, Colombia. The Depositary’s principal executive office is located at One Wall Street, New York, New York 10286.

Grupo Cibest has not listed debt, therefore it has not presented any Form F-3 with the SEC.

B.Plan of Distribution

Not applicable.

C.MARKETS

The Colombian Stock Exchange is the principal non-U.S. trading market for the Preferred Shares and the sole market for the Common Shares. As of December 31, 2025, the market capitalization for Grupo Cibest’s Preferred shares based on the closing price in the Colombian Stock Exchange was COP 26,647 billion. Grupo Cibest’s total market capitalization, which includes the Common and Preferred shares, was COP 61,878 billion or USD 16.47 billion as of the same date.

There are no official market makers or independent specialists on the Colombian Stock Exchange to ensure market liquidity and, therefore, orders to buy or sell in excess of corresponding orders to sell or buy will not be executed. The aggregate equity market capitalization of the Colombian Stock Exchange, as of December 31, 2025, was COP 500,564 billion (USD 133.21 billion), with 75 companies listed as of that date.

On May 19, 2025, Grupo Cibest announced that it has started a liquidity program in Colombia with Credicorp Colombia for its Common and Preferred shares under the same conditions Bancolombia had previously. This program seeks to increase the number of transactions involving Grupo Cibest's shares through purchase and sale orders entered by Credicorp Capital Colombia in the stock market, enabling price formation. These mechanisms contribute to promoting liquidity and mitigating volatility in stock trading, facilitating market entry and exit mechanisms for investors.

D.Selling Stockholders

Not applicable.

E.Dilution

Not applicable.

F.Expenses of the Issue

Not applicable.

ITEM 10      ADDITIONAL INFORMATION

A.Share Capital

Not applicable.

B.Memorandum and articles of association

Grupo Cibest is a stock company (sociedad anónima) registered with the Chamber of Commerce of Medellín under registration number 40255. Set forth below is certain information concerning Grupo Cibest’s capital stock and a brief summary of certain significant provisions of Grupo Cibest’s bylaws and Colombian corporate law. This description does not purport to be complete and is qualified by reference to Grupo Cibest’s bylaws (an English translation of which is attached as Exhibit 1 to this Annual Report) and to Colombian corporate law.

Grupo Cibest’s Corporate Purpose

Pursuant to Article 3 of its bylaws, Grupo Cibest’s corporate purpose consists of investing in movable and immovable property, particularly in shares, quotas, equity interests and/or any other participation interest in Colombian and/or foreign companies or entities, as well as managing such investments.

In carrying out its corporate purpose, Grupo Cibest may take any acts and enter into contracts necessary or incidental to its corporate purpose and those necessary to exercise rights or fulfill obligations arising from its existence and activities. Among others, it may acquire, encumber, exploit, deliver in trust or dispose of movable and immovable property; enter into credit operations with related parties or third parties, either granting or receiving funds, provided that such transactions do not constitute financial intermediation, are occasional, non-speculative and solely intended to obtain resources to comply with its corporate purpose.

Grupo Cibest may also endorse, negotiate, transfer, pay or assign negotiable instruments and execute all types of civil and commercial documents, in furtherance of its corporate purpose.

Board of Directors

As of the date of filing of this Annual Report, Grupo Cibest’s Board of Directors is composed of seven Directors, elected for a two-year term, with no alternate Directors. For additional information regarding Grupo Cibest’s current Directors please see Item 6.A, Directors and Senior Management.

Director’s power to vote on a proposal, arrangement or contract in which the director is materially interested

According to Grupo Cibest's bylaws and Good Governance Code, if a director has a conflict of interest with respect to a matter subject to the Board’s deliberation and decision, he/she must immediately inform the other members of the Board. The director in conflict must also refrain from participating in the deliberation and decision on the matter that gives rise to the conflict of interest; and the Board will deliberate and decide without the participation of the conflicted director, provided that he/she is not required to constitute the necessary quorum for deliberation and decision. If the conflicted director is required to constitute the necessary quorum, the conflict must be submitted to the competent body in accordance with the applicable regulations, including the special rules governing financial conglomerates. As a result, a director may not vote on any proposal, arrangement, or contract in which they hold a material interest.

Directors’ power, in the absence of an independent quorum, to vote compensation to themselves or any members of their body

The general shareholders' meeting is the sole body authorized to determine the compensation of the Board of Directors; therefore, directors have no authority to vote on their own compensation.

Borrowing powers exercisable by the directors and how such borrowing powers can be varied

Pursuant to the bylaws of Grupo Cibest, the Board of Directors has the power to authorize the execution of any agreement, within the corporate purpose of Grupo Cibest, and to adopt the necessary measures in order for Grupo Cibest to fulfill its purpose, except for matters reserved by law to the shareholders’ meeting. Furthermore, the Board of Directors must authorize the issuance of bonds or Common Shares up to the total amount of authorized capital stock. Any modification of such powers would require an amendment to the bylaws approved by the general shareholders’ meeting.

Retirement or non-retirement of Directors under an age limit requirement

There is no mandatory retirement age for directors under the bylaws of Grupo Cibest. Grupo Cibest’s Good Governance Code establishes that efforts shall be made to ensure that members of the Boards of Directors are not older than 75 years at the time of their election. If a Board member reaches the age of 75 while holding office, his or her age shall be taken into account in the next election when preparing candidate proposals, seeking to ensure that such candidates are under 75 years of age at the time of nomination.

Number of shares, if any, required for Director’s qualification.

There are no provisions in Grupo Cibest's bylaws or Good Governance Code requiring members of the Board of Directors to hold any number of Grupo Cibest shares as a qualification for their position and there is no share ownership requirement under applicable Colombian law.

Description of share rights, preferences and restrictions

Grupo Cibest’s bylaws provide for an authorized capital stock of COP 700 billion divided into 1,400,000,000 shares of a par value of COP 500 each. The shares may be issued as (i) Common Shares, (ii) privileged shares; and (iii) with preferred dividend and without voting rights. All shares have the same nominal value.

Common Shares Voting rights

Each Common share entitles its holder to one vote at a general shareholders’ meeting. General meetings may be ordinary or extraordinary.

Ordinary general shareholder’s meetings are held at least once a year within three months following the end of the prior fiscal year, for the following purposes:

(i) to consider the approval of Grupo Cibest’s annual report, including the financial statements for the preceding fiscal year

(ii) to review the annual report prepared by the external auditor

(iii) to determine the compensation for the members of the Board of Directors, and the external auditor every two years

(iv) to elect, every two years, the members of the Board of Directors and the external auditor

(v) to determine the dividend policy and the allocation of profits, if any, of the preceding fiscal year, as well as any retained earnings from previous fiscal years.

Extraordinary general shareholders’ meetings may take place when duly called for a specific purpose. The general shareholders' meeting may validly meet without prior notice, when holders representing all outstanding shares are duly represented at the meeting.

Quorum for both ordinary and extraordinary general shareholders’ meetings to be convened at first call requires the presence of two or more shareholders representing at least half plus one of the outstanding shares entitled to vote at the relevant meeting. If a quorum is not present, a subsequent meeting is called at which the presence of one or more holders of shares entitled to vote at the relevant meeting constitutes a quorum, regardless of the number of shares represented.

Ordinary general shareholders’ meetings may be called by the CEO, by order of the Board. Extraordinary general shareholders’ meetings may be called by the Board of Directors, the CEO or the external auditor of Grupo Cibest.

In addition, according to Grupo Cibest's bylaws, two or more shareholders representing at least 10% of the outstanding shares have the right to request that a general shareholders meeting be convened.

Notice of ordinary meetings and extraordinary meetings shall be issued by means of a notice published in at least one widely circulating newspaper in Grupo Cibest's principal place of business. For meetings at which year-end balance sheets, increases in authorized capital, reductions in subscribed capital, spin-offs, mergers, or the assignment of assets, liabilities and contracts representing more than 25% of their total value are to be examined, or where members are to be elected to the Board of Directors, the call notice shall be issued at least 15 business days prior to the date set for the meeting; in all other cases, 5 calendar days’ notice will suffice. When calculating these deadlines, neither the day on which the call notice is issued nor the day of the meeting will be counted.

Except when Colombian law or Grupo Cibest’s bylaws require a special majority, action may be taken at a general shareholder’s meeting by the vote of two or more shareholders representing a majority of Common Shares present. Pursuant to Colombian law and/or Grupo Cibest’s bylaws, special majorities are required to adopt the following corporate actions:

(i) a favorable vote of at least 70% of the shares represented at a general shareholders’ meeting is required to approve the issuance of shares without preemptive rights available for shareholders;

(ii) a favorable vote of at least 78% of the holders of represented Common Shares to decide not to distribute as dividend at least 50% of the annual net profits of any given fiscal year;

(iii) a favorable vote of at least 80% of the holders of represented Common Shares and 80% of the holders of outstanding Preferred Shares to approve the payment of the dividend in shares; and

(iv) a favorable vote of at least 70% of the holders of Common Shares and of outstanding Preferred Shares to effect a decision to impair the conditions or rights established for such Preferred Shares, or a decision to convert those Preferred Shares into Common Shares.

Regarding the election of the Board of Directors, the election of independent Directors must be in a separate ballot from the ballot to elect the rest of the Directors, unless reaching the minimum number of independent Directors required by law or by the bylaws is assured, or when there is only one list that includes the minimum number of required independent Directors. 25% of the members of the Board of Directors shall be independent. Under Colombian law, an independent Director is a Director who is not:

(i) an employee or director of the issuer or any of its parent or subsidiary companies, including all those persons acting in said capacity during the year immediately preceding that in which they were appointed, except in the case of an independent member of the Board of Directors being re-elected;

(ii) shareholders, who either directly or by virtue of an agreement direct, guide or control the majority of the entity’s voting rights or who determine the majority composition of management, the Board of Directors or other corporate bodies of this same entity;

(iii) a partner or employee of any association or firm that provides advisory or consultancy services to the issuer or to companies who belong to the same economic group to which the issuer in question belongs, in the event that income obtained from such services represent for said association or firm 20% or more of its total operating income;

(iv) an employee or director of a foundation, association or institution that receives significant donations from the issuer. The term 'significant donations' is quantified as being 20% or more of the total amount of donations received by the respective institution;

(v) an officer of any entity on whose board of directors a legal representative of the issuer participates

(vi) any person who receives from the issuer any kind of remuneration different from fees as a member of the board of directors, of the audit committee or any other committee set up by the board of directors.

The Good Governance Code, aiming to strengthen the independence of the Board, establishes the following additional criteria to qualify a director as non-independent:

i.Employees or Executive Officers of companies within Cibest Corporate Group, including those persons who have had the status of employee or Executive Officer during the 2 years immediately preceding the appointment, unless it is the reelection of an independent person.

ii.Any of the following persons: (a) any of the Relevant Partners, as defined in the bylaws, of Grupo Cibest; or (b) any person that determines the majority composition of the administrative or management bodies of Grupo Cibest.

iii.Shareholders, employees or advisers to shareholders, who directly or through an agreement, direct, influence or control more than 10% of the voting rights of Grupo Cibest or determine the majority composition of the management, board of directors or control bodies of the Grupo Cibest.

iv.Partners or employees of associations or companies that receive payments from Cibest Corporate Group for services or other fees for: (i) an amount greater than the equivalent to USD 250,000 or corresponding to 2% or more of the total income of the applicable association or company (whichever is higher) for the last 3 years, or (ii) an amount representing 20% or more of the operating income of such association or company the prior year.

v.Partners or employees of legal entities or similar (e.g., trusts) that have made payments to Grupo Cibest or its affiliates, subsidiaries or controllers, for a value greater than USD 1 Million or equal to 2% of the total income of the relevant company or association (whichever is higher) in the last three years, except for interest payments or for financial services rendered by Grupo Cibest or its subsidiaries in the ordinary course of business.

vi.Employees or directors of legal entities or similar (e.g., trusts) that receive significant donations from Grupo Cibest, Bancolombia, or from individuals or corporate entities that hold, directly or indirectly, 0.5% or more of the voting rights of Grupo Cibest. A donation will be considered significant if it represents more than 20% of donations received by the relevant entity.

vii.Directors and officers of an entity on whose board of directors a legal representative of Grupo Cibest serves.

viii.Persons who receive from the Cibest Corporate Group any remuneration other than fees as members of the Board of Directors, the audit committee or any other committee created by the Board of Directors, or who have received remuneration for an amount greater than USD 120,000 during any 12 months within, in the last three years, other than payments for being a member of the Board of Directors or a Board committee.

ix.Partners or employees, or individuals who were, within the past three years, partners or employees of the external auditors.

x.Executive officers of another entity in which any of the current Directors, senior management or key executives or representatives of Grupo Cibest are members of the compensation committee.

For the election of members of the Board of Directors, the electoral quotient system shall be applied. This shall be determined by dividing the total number of votes validly cast by the number of persons to be elected. The count will begin with the slate that received the highest number of votes and in descending order. From each slate, as many names as the quotient in the number of votes cast by it will be declared elected, and if there are any places that remain to be filled, these will correspond to the highest residuals, counting them in the same descending order. Blank ballots will only be counted to determine the electoral quotient. If, at the time of the count, a person on one slate has already been elected because he or she appears on a previous slate, the person that comes next in the order of placement shall be chosen. In the event of a tie in the residuals, in elections performed as provided for in the above rule, the position

will be decided by drawing lots.

The members of the Board of Directors may not be replaced through partial elections without carrying out a new election of the entire Board, pursuant to the electoral quotient system, unless the vacancies are filled unanimously.

With respect to the appointment of directors of the other companies of Cibest Corporate Group, the Good Governance Code establishes that Grupo Cibest's CEO, with the support of the corporate vice presidents, is responsible for appointing the nominees as members of the board of directors of the companies that are part of Cibest Corporate Group.

Preferred SharesVoting Rights

The holders of Preferred Shares are not entitled to receive notice of, attend to or vote at any general shareholders’ meeting except as described below.

Each Preferred Share entitles its holder to vote on the basis of one vote per share at any shareholders’ meeting, whenever a shareholder’s vote is required on the following matters:

(i) when voting the anticipated dissolution, merger or transformation of the corporation or change of its corporate purpose;

(ii) when the preferred dividend has not been fully paid during two consecutive annual terms. In this event, holders of such shares shall retain their voting rights until the corresponding dividends have been fully paid to them;

(iii) if at the end of a fiscal period, Grupo Cibest’s profits are not enough to pay the minimum dividend and the SFC, by its own decision or upon petition of holders of at least 10% of Preferred Shares, determines that benefits were concealed or shareholders were misled with regard to benefits received from Grupo Cibest by Grupo Cibest’s directors or officers decreasing the profits to be distributed, the Superintendency of Companies may resolve that holders of Preferred Shares should participate with speaking and voting rights at the general shareholders’ meeting, in the terms established by law;

(iv) when the registration of shares at the Colombian Stock Exchange or at the National Register of Securities is suspended or canceled. In this event, voting rights shall be maintained until the irregularities that resulted in such cancellation or suspension are resolved;

(v) when voting amendments that could impair the Preferred Shares’ rights, or the conversion of the Preferred Shares to Common Shares, a favorable vote of a minimum of 70% of the subscribe capital stock, including the favorable vote of a minimum of 70% of the Preferred Shares, is required; and

(vi) when the general shareholders´ meeting orders the payment of dividends with issued shares. In this event, the decision shall be approved with a favorable vote of 80% of the Common Shares represented, and 80% of the Preferred Shares subscribed.

Dividend Rights

Common Share dividends

Holders of Common Shares are entitled to receive dividends declared by the general shareholders’ meeting out of legally available profits.

Under the Colombian Commercial Code, at least 50% of Grupo Cibest annual net profits must be distributed to shareholders, unless a higher majority 78% of the Common Shares represented at the meeting approves a lower distribution. If total reserves exceed paid-in capital, the minimum distribution increases to 70%.

Therefore, Grupo Cibest's annual net profits are applied as follows:

(i) first, 10% of net profits is allocated to build a legal reserve until that reserve is equal to at least 50% of Grupo Cibest’s paid-in capital

(ii) second, payment of the minimum dividend on the Preferred Shares

(iii) third, the remainder is allocated as determined by the shareholders upon the recommendation of the Board of Directors and the CEO. All Common Shares that are fully paid in and outstanding at the time a dividend or other distribution is declared are entitled to share equally in that dividend or other distribution. Common Shares that are only partially paid participate in a dividend or distribution in the same proportion as the shares that have been fully paid in at the time of the dividend or distribution.

The general shareholders’ meeting may allocate a portion of the profits to welfare, education or civic services, or to support economic organizations of Cibest Corporate Group’s employees.

Preferred Share dividends

Holders of Preferred Shares are entitled to receive dividends based on the net profits of Grupo Cibest from the preceding fiscal year, after deducting losses affecting the capital and allocating the legally required reserve, but prior to the creation of any other reserve. Preferred Shares are entitled to a non-cumulative minimum preferred dividend equal to 1% yearly of the subscription price per share, provided that such amount is not less than the dividend declared per Common share. If the dividend declared on Common shares exceeds the minimum preferred dividend, the dividend payable on the Preferred Shares will be increased to equal the per share dividend on the Common shares. The dividend received by holders of Common shares may not be higher than the dividend assigned to Preferred shares.

Payment of the preferred dividend shall be made at the time and in the manner established in the general shareholders’ meeting and with the priority indicated by Colombian law.

In the event that the holders of Preferred Shares have not received the minimum dividend for a period in excess of two consecutive fiscal years, they will acquire certain voting rights. See Item 10. Additional Information – B. Memorandum and Articles of Association – Description of Share Rights, Preferences and Restrictions – Voting Rights – Preferred Shares.

General considerations relating to dividends

The general shareholders’ meeting, determines the record date, the payment date, method and place for payment of dividends, including whether dividends will be paid in installments.

Dividends declared on the Common Shares and the Preferred Shares are payable to the record holders of those shares, as reflected on Grupo Cibest’s stock registry, on relevant record dates established by the general shareholders’ meeting.

Any dividend in shares payable by Grupo Cibest will be paid in Common Shares to the holders of Common Shares and in Preferred Shares to the holders of Preferred Shares, unless the general shareholders’ meeting authorizes the payment in Common Shares to all shareholders.

Payment of dividend in shares requires the approval of at least 80% of the shares present at a shareholders’ meeting, including at least 80% of the outstanding Preferred Shares. If such voting majority is not obtained, shareholders may individually elect to receive a stock dividend or a cash dividend.

According to Grupo Cibest bylaws, dividends that are not claimed in a timely manner, will remain at the disposal of the shareholders. Dividends not claimed within 10 years following the date on which they become payable will lose their enforceable nature and must be transferred to a reserve of Grupo Cibest.

Liquidation rights

Grupo Cibest will be dissolved if certain events take place, including the following:

(i) its term of existence, as stated in the bylaws, expires without being extended by the shareholders prior to its expiration date;

(ii) when, according to the financial statements, there is no realistic alternative to liquidating the entity or ceasing operations;

ii) by decision at the general shareholders’ meeting; and

(iv) in certain other events expressly provided by law and in the bylaws.

Upon dissolution, a liquidator must be appointed by the general shareholders’ meeting to wind up its affairs.

Upon liquidation, holders of fully paid Preferred Shares will be entitled to receive in Colombian pesos, out of the surplus assets available for distribution to shareholders, pari passu with any of the other shares ranking at that time pari passu with the Preferred Shares, an amount equal to the nominal value of those Preferred Shares before any distribution or payment may be made to holders of Common Shares or any other shares at that time ranking junior to the Preferred Shares with regard to participation in Grupo Cibest’s surplus assets. If, upon any liquidation, assets that are available for distribution among the holders of Preferred Shares and liquidation parity shares are insufficient to pay in full their respective liquidation preferences, then those assets will be distributed among those holders pro-rata in accordance with the respective liquidation preference amounts payable to them.

Subject to the preferential liquidation rights of holders of preferred shares, all fully paid common shares will be entitled to participate equally in any distribution upon liquidation. Partially paid Common Shares must participate in a distribution upon liquidation in the same proportion that those shares have been paid at the time of the distribution.

To the extent there are surplus assets available for distribution after full payment to the holders of Common Shares of the nominal value of the Common Shares, the surplus assets will be distributed among all holders of shares of capital stock pro-rata in accordance with their respective holdings of shares.

Preemptive rights and other anti-dilution provisions

Under Grupo Cibest’s bylaws, the holders of Common Shares determine in their meeting the amount of authorized capital stock, and the Board of Directors has the power to (a) order the issuance and regulate the terms of subscription of Common Shares up to the total amount of authorized capital stock and (b) regulate the issuance of Preferred Shares, when expressly delegated at the general shareholders’ meeting. The issuance of Preferred Shares must always be first approved at the general shareholders’ meeting, which shall determine the nature and extent of any privileges, according to the bylaws and Colombian law.

Grupo Cibest’s bylaws and Colombian law require that, whenever Grupo Cibest issues new shares of any outstanding class, it must offer the holders of each class of shares the right to purchase a number of shares of such class sufficient to maintain their existing percentage ownership of the aggregate capital stock of Grupo Cibest. These rights are called preemptive rights. See Item 3. Key Information – D. Risk Factors – Preemptive rights may not be available to holders of (ADRs evidencing ADSs).

Shareholders at a general meeting of shareholders may suspend preemptive rights with respect to a particular capital increase by a favorable vote of at least 70% of the shares represented at the meeting. Preemptive rights must be exercised within the period stated in the share placement terms of the increase, which cannot be shorter than 15 business days following the publication of the notice of the public offer of that capital increase. From the date of the notice of the share placement terms, preemptive rights may be transferred separately from the corresponding shares.

The SFC will authorize decreases in the outstanding capital stock decided by the holders of Common Shares only if: (i) Grupo Cibest has no liabilities; (ii) Grupo Cibest’s creditors consent in writing; or (iii) the outstanding capital stock remaining after the reduction represents at least twice the amount of Grupo Cibest’s liabilities.

Limits on Purchases and Sales of Capital Stock by Related Parties

Pursuant to the Colombian Commerce Code, the members of Grupo Cibest’s Board of Directors and certain of Grupo Cibest’s senior management may not, directly or indirectly, buy or sell shares of Grupo Cibest’s capital stock while they hold their positions, except when dealing with nonspeculative operations and in that case they need to obtain the prior authorization of the Board of Directors, passed with the vote of two-thirds of its members (excluding, in the case of transactions by a Director, that Director’s vote) or, when deemed relevant by the Board of Directors with the authorization of the shareholders meeting, the affirmative vote of the ordinary majority foreseen in the bylaws, excluding the vote of the petitioner.

Redemption

Under Colombian law, Grupo Cibest may repurchase shares of its capital stock, as long as any repurchases are approved at a shareholders’ meeting and the repurchases meet certain Colombian law requirements.

Sinking fund provisions

Grupo Cibest's Common Shares and Preferred Shares are not subject to any sinking fund provisions.

Liability to further capital calls

Under Grupo Cibest bylaws, shareholders are not liable for further capital calls by Grupo Cibest, and there are no provisions or clauses requiring shareholders to contribute additional capital as a result of their share ownership.

No discrimination

Grupo Cibest's bylaws do not include any provision discriminating against any existing or prospective holder of Common Shares or Preferred Shares as a result of such shareholder owning a substantial number of shares.

Limitations on the Rights to own securities

There are no limitations in Grupo Cibest’s bylaws or Colombian law on the rights of Colombian residents or foreign investors to own the shares of Grupo Cibest, or on the right to hold or exercise voting rights with respect to those shares.

Under Decree 663 of 1993, as amended, any transaction resulting in an individual or entity holding 10% or more of the outstanding shares of any Colombian financial institution, including transactions resulting in holding American depositary shares representing 10% or more of outstanding shares, is subject to the prior authorization of the SFC. This restriction will be indirectly applicable to Grupo Cibest as the parent company of Bancolombia. The SFC must evaluate any proposed transaction resulting in a change of ownership of 10% or more of the outstanding shares of a Colombian financial institution based on the criteria and guidelines specified in Decree 663 of 1993. Transactions entered into without the prior approval of the SFC are null and void and cannot be recorded in the institution’s stock ledger. These restrictions are equally applicable to Colombian and foreign investors.

Restrictions on change of control, mergers, acquisitions or corporate restructuring of the company

Under Colombian law and Grupo Cibest’s bylaws, the general shareholders’ meeting has full and exclusive authority to approve any corporate restructuring, including mergers, acquisitions or spin-offs, subject to authorization by the SFC.

Under Article 92 of Grupo Cibest's bylaws, a price-matching obligation applies as follows:

(a) Any beneficial owner of Common Shares in Grupo Cibest that holds less than 25% of such shares as of the date on which Grupo Cibest shares being to be traded on the Colombian Stock Exchange (the 'Cut-off Date'), and acquires, in one or more transactions, directly or indirectly, within a 12 month following its first acquisition after the Cut-off Date ('Matching Period One'), Common Shares that result in such beneficial owner holding more than 25% of Grupo Cibest’s Common Shares, shall be required to pay to each seller that disposed of its Common Shares during Matching Period One, an amount equal to the difference between (x) the highest price per Common Share in Grupo Cibest paid by such beneficial owner during Matching Period One and (y) the price per Common Share in Grupo Cibest paid to such seller ('Matching Value One').

(b) Any beneficial owner who acquires Common Shares in Grupo Cibest via an Initial Takeover Bid, as defined in Grupo Cibest bylaws, and subsequently acquires, in one or more transactions, directly or indirectly, within a 12 month period following the completion of the Initial Takeover Bid ('Matching Period Two'), additional Common Shares that increase its percentage of Grupo Cibest Common Shares by 5% or more, shall be required to pay each seller that disposed of its Common Shares in Grupo Cibset during Matching Period Two an amount equal to the difference between (x) the highest price per Common Share of Grupo Cibest paid by the beneficial owner during Matching Period Two and (y) the price per Common Share in Grupo Cibest paid to such seller ('Matching Value Two'). Once Matching Period Two has expired, any subsequent Takeover Bid, as defined in Grupo Cibest bylaws, for Common Shares by a beneficial owner shall be considered a new Initial Takeover Bid and the provisions of Article 92 shall apply again.

Ownership threshold requiring public disclosure

Grupo Cibest must disclose to the SFC at the end of each semester the names of the shareholders of Grupo Cibest, indicating at least the 25 shareholders with the highest number of shares.

Colombian securities regulations set forth the obligation to disclose any material event or relevant fact. Any transfer of shares equal to or greater than 5% of Grupo Cibest’s capital stock or any person acquiring a percentage of shares that would make him the beneficial owner of 5% or more of Grupo Cibest’s capital stock, is a material event, and therefore, must be disclosed to the SFC.

Changes in the capital of the company

There are no conditions in Grupo Cibest’s bylaws governing changes in Grupo Cibest’s capital stock that are more stringent than those required under Colombian law.

C.Material contracts

We have not entered into any contract, other than those entered in the ordinary course of business or that are not considered to be material, to which we or any of our subsidiaries are a party, for the two years immediately preceding the date of this Annual Report.

D.Exchange controls

The Colombian Foreign Exchange Regime allows Colombian residents to acquire in the exchange market the currencies required to carry out their operations. For such purpose, the Colombian Foreign Exchange Regime establishes certain procedures that must be followed in order to carry out foreign exchange operations, which are known as 'channeling of currencies', through the exchange market. This channeling must be carried out through an intermediary of the exchange market (such as commercial banks in Colombia), or through compensation accounts (bank accounts abroad opened by Colombian residents registered before the Central Bank). Therefore, there are no limitations regarding the import or export of capital, including the availability of cash and cash equivalents for use by us. Nevertheless, these operations must be carried out following the applicable procedures.

The Foreign Exchange Statute, Law 9 of 1991, outlines the Colombian foreign exchange regime which relates to matters such as imports and exports of goods, foreign indebtedness, and guarantees in foreign currencies, among others. Additionally, Decree 1068 of 2015 and Decree 119 of 2017, as amended, sets forth an international investments regime which provides for rules applicable to foreign residents who invest in the Colombian securities markets and undertake other types of investments, prescribes registration before the Central Bank of certain foreign exchange transactions, and specifies procedures pursuant to which certain types of foreign investments are to be authorized and administered. Both the Foreign Exchange Statute and the International Investments Regime are regulated by External Resolution No. 1 of 2018 and External Regulating Circular DCIP-83, both as amended, of the board of directors of the Central Bank.

Under Colombian law and Grupo Cibest's bylaws, foreign investors receive the same treatment as Colombian citizens with respect to ownership and the voting rights of ADSs and Preferred Shares, as well as the remittance abroad of dividends, or any other type of proceedings derived from any type of securities investments duly registered before the Central Bank. For a detailed discussion of ownership restrictions see Item 4. Information on the Company - B. Business Overview – B.8. Supervision and Regulation – Ownership and Management Restrictions.

E.Taxation

Colombian Tax Consideration

ADSs do Not Have the Same Tax Treatment as Other Equity Investments in Colombia.

Although ADSs represent Grupo Cibest's Preferred Shares, they are held through a foreign capital fund in Colombia, subject to a specific tax regulatory regime. Accordingly, the applicable law in Colombia to equity investments, particularly those relating to dividends and profits from sales, are not applicable to ADSs, including Grupo Cibest's ADSs.

Under Section 18-1 of the Colombian Tax Code, dividends are subject to a dividend tax as follows:

Foreign Portfolio investment:

To determine the income tax concerning the profits earned from the foreign portfolio investment, regardless of the method or vehicle used to invest by the investor, the following rules shall apply:

i.Dividends subject to CIT at the corporate level are taxed at 20%.

ii.Dividends that did not pay CIT at the corporate level are subject to the equalization tax at 25% upon distribution, plus a 20% dividend tax on top of that.

The tax is to be collected via withholding tax on the accrual or cash basis and is applicable to:

i.Non-residents of Colombia for foreign exchange matters.

ii.Corporations whose head office, principal place of business or effective place of management is located outside of Colombia.

iii.Companies incorporated under non-Colombian laws.

Tax Residence for Individuals

For Colombian tax purposes, individuals are considered tax residents if they meet any of the following requirements:

•He or she remains in Colombia (continuously or not) for an aggregate period of 183 calendar days or more, including entry and departure days from the country, within a period of 365 consecutive calendar days. If that requirement is met by considering the days spent in Colombia over two successive fiscal years, the individual would be viewed as a tax resident as of the second fiscal year.

•Individuals who work for the Colombian Foreign Services in other countries under the Vienna Conventions on Diplomatic and Consular Relations and whose income and capital gains are exempt from taxation in the country they serve.

•If the individual is a Colombian citizen and falls within any of the following scenarios:

a)The spouse or dependents are tax residents of Colombia.

b)50% or more of their income is Colombian-sourced income.

c)50% or more of their assets are managed in Colombia.

d)50% or more of their assets are physically located in Colombia.

e)If the Colombian Tax Office (DIAN) requests evidence of the fiscal residency status in another country and the individual does not provide it.

f)The individual has a fiscal residence in a non-cooperative jurisdiction, a place of null or minimum taxation, or a preferential tax regime jurisdiction (tax havens).

Colombian citizens are not considered tax residents for any of the scenarios above if:

a)50% or more of their annual income has been sourced where they are domiciled; or

b)50% or more of their assets are located in the jurisdiction where they are domiciled.

Entities

Corporate residence is determined by the place of incorporation of any given company. Companies incorporated in Colombia under Colombian laws qualify as National Companies and are taxed on their worldwide income. For Colombian tax purposes, a non-resident entity that is effectively managed in Colombia would be considered as a Colombian entity (effective place of management).

Preferred Shares

Preferred Shares will have the same treatment as financial liabilities for the issuer's tax purposes. The treatment will be the same as financial assets for the holder. This treatment will not apply to listed shares that do not comply with the rest of the requirements established by Section 33-3 of the Colombian Tax Code.

Industry and Commerce Tax

Industry and commerce tax ('ICT') is a territorial tax levied on industrial, commercial and services activities performed by the taxpayer within a Colombian municipality. ICT is paid in the municipality where the activity is performed over the gross revenue at rates ranging between 0.2% and 2%. Each municipality fixes the rate and how the tax should be collected and paid to the municipal tax office.

Dividends received by holders are not subject to any special rule and therefore are subject to industry and commerce tax if they are derived from a commercial activity at a rate of 0.5%.

Other Tax Considerations

As of the date of this report, there is no Double Taxation Treaty between Colombia and the United States.

United States Federal Income Taxation Considerations

This section describes the material United States federal income tax consequences generally applicable to a U.S. holder (as defined below) of owning Preferred Shares or ADSs. It applies to you only if you hold your Preferred Shares or ADSs as capital assets for United States federal income tax purposes. This discussion addresses only United States federal income taxation and does not discuss all of the tax consequences that may be relevant to you in light of your individual circumstances, including foreign, state or local tax consequences, estate and gift tax consequences, and tax consequences arising under the Medicare contribution tax on net investment income or the alternative minimum tax. This section does not apply to you if you are a member of a special class of holders subject to special rules, including:

•A dealer in securities,

•A bank,

•A trader in securities that elects to use a mark-to-market method of accounting for securities holdings,

•A tax-exempt organization,

•A life insurance company,

•A person that actually or constructively owns 10.00% or more of the combined voting power of Grupo Cibest's voting stock or of the total value of Grupo Cibest's stock,

•A person that holds Preferred Shares or ADSs as part of a straddle or a hedging or conversion transaction for United States federal income tax purposes,

•A person that purchases or sells Preferred Shares or ADSs as part of a wash sale for United States federal income tax purposes, or

•A person whose functional currency is not the U.S. dollar.

This section is based on the Internal Revenue Code of 1986, as amended, its legislative history, existing and proposed regulations, published rulings and court decisions. These laws are subject to change, possibly on a retroactive basis. There is currently no comprehensive income tax treaty between the United States and Colombia. In addition, this section is based in part upon the representations of the Depositary and the assumption that each obligation in the Deposit Agreement and any related agreement will be performed in accordance with its terms.

If an entity or arrangement that is treated as a partnership for United States federal income tax purposes holds the Preferred Shares or ADSs, the United States federal income tax treatment of a partner will generally depend on the status of the partner and the tax treatment of the partnership. A partner in a partnership holding the Preferred Shares or ADSs should consult its tax advisor with regard to the United States federal income tax treatment of an investment in the Preferred Shares or ADSs.

You are a U.S. holder if you are a beneficial owner of Preferred Shares or ADSs and you are:

•A citizen or resident of the United States

•A domestic corporation (or an entity treated as a domestic corporation)

•An estate whose income is subject to United States federal income tax regardless of its source, or

•A trust if a United States court can exercise primary supervision over the trust’s administration and one or more United States persons are authorized to control all substantial decisions of the trust.

In general, and taking into account the earlier assumptions, for United States federal income tax purposes, if you hold ADRs evidencing ADSs, you will be treated as the owner of the Preferred Shares represented by those ADRs. Exchanges of Preferred Shares for ADRs, and ADRs for Preferred Shares generally will not be subject to United States federal income tax.

The tax treatment of your Preferred Shares or ADSs will depend in part on whether or not we are classified as a passive foreign investment company, or PFIC, for United States federal income tax purposes. Except as discussed below under “PFIC Rules”, this discussion assumes that we are not classified as a PFIC for United States federal income tax purposes.

You should consult your own tax advisor regarding the U.S. federal, state and local and other tax consequences of owning and disposing of Preferred Shares or ADSs in your particular circumstances.

Taxation of Distributions

Under the United States federal income tax laws, the gross amount of any dividend we pay out of Grupo Cibest's current or accumulated earnings and profits (as determined for United States federal income tax purposes), other than certain pro-rata distribution of Grupo Cibest's Preferred Shares, including the amount of any Colombian tax withheld, will be treated as a dividend that is subject to United States federal income taxation. If you are a non-corporate U.S. holder, dividends paid to you that constitute qualified dividend income will be taxable to you at preferential rates applicable to long-term capital gains, provided that you hold the Preferred Shares or ADSs for more than 60 days during the 121-day period beginning 60 days before the ex-dividend date (or, if the dividend is attributable to a period or periods aggregating over 366 days, provided that you hold the Preferred Shares or ADSs for more than 90 days during the 181-day period beginning 90 days before the ex-dividend date) and meet other holding period requirements. Dividends we pay with respect to the ADSs generally will be qualified dividend income, provided that, in the year that you receive the dividend, the ADSs are readily tradable on an established securities market in the United States. Grupo Cibest believes that its ADSs, which are listed on the NYSE, are readily tradable on an established securities market in the United States; however, there can be no assurance that Grupo Cibest's ADSs will continue to be readily tradable on an established securities market. Because the Preferred Shares are not listed on any United States securities market, it is unclear whether dividends we pay with respect to the Preferred Shares will also be qualified dividend income. If dividends we pay with respect to Grupo Cibest's Preferred Shares are not qualified dividend income, then the U.S. dollar amount of such dividends received by a U.S. holder (including dividends received by a non-corporate U.S. holder) will be subject to taxation at ordinary income tax rates.

You must include any Colombian tax withheld from the dividend payment in this gross amount even though you do not in fact receive it. The dividend is taxable to you when you, in the case of Preferred Shares, or the Depositary, in the case of ADSs, receive the dividend, actually or constructively. The dividend will not be eligible for the dividends-received deduction generally allowed to United States corporations in respect of dividends received from other United States corporations. The amount of the dividend distribution that you must include in your income will be the U.S. dollar value of the Colombian Peso payments made, determined at the spot Colombian Peso / U.S. dollar rate on the date the dividend is distributed, regardless of whether the payment is in fact converted into U.S. dollars. Generally, any gain or loss resulting from currency exchange fluctuations during the period from the date the dividend is distributed to the date you (or the Depositary on your behalf) convert the payment into U.S. dollars will be treated as ordinary income or loss and will not be eligible for the special tax rate applicable to qualified dividend income. The gain or loss generally will be income or loss from sources within the United States for foreign tax credit limitation purposes. Distributions in excess of current and accumulated earnings and profits, as determined for United States federal income tax purposes, will be treated as a non-taxable return of capital to the extent of your basis in the Preferred Shares or ADSs and thereafter as capital gain. However, we do not expect to calculate earnings and profits in accordance with U.S. federal income tax principles. Accordingly, you should expect to generally treat distributions with respect to Preferred Shares or ADSs as dividends.

Subject to certain limitations, the Colombian tax withheld and paid over to Colombia will be creditable or deductible against your United States federal income tax liability. Special rules apply in determining the foreign tax credit limitation with respect to dividends that are subject to preferential rates. To the extent a refund of the tax withheld is available to you under Colombian law, the amount of tax withheld that is refundable will not be eligible for credit against your United States federal income tax liability. The rules governing foreign tax credits are complex, and U.S. holders should consult their tax advisors regarding the creditability of foreign taxes in their particular circumstances.

For foreign tax credit purposes, dividends will generally be income from sources outside the United States and will generally be “passive” income for purposes of computing the foreign tax credit allowable to you.

The rules governing foreign tax credits are complex. You are urged to consult your tax advisors regarding the availability of foreign tax credits under your particular circumstances.

Taxation of Capital Gains

If you sell or otherwise dispose of your Preferred Shares or ADSs, you will recognize capital gain or loss for United States federal income tax purposes equal to the difference between the U.S. dollar value of the amount that you realize and your tax basis, determined in U.S. dollars, in your Preferred Shares or ADSs. Capital gain of a non-corporate U.S. holder is generally taxed at preferential rates where the property is held for more than one year. The deductibility of capital losses is subject to certain limitations. The gain or loss will generally be income or loss from sources within the United States for foreign tax credit limitation purposes.

PFIC Rules

We believe that we are not currently classified as a PFIC for United States federal income tax purposes, and we do not expect to become a PFIC in the foreseeable future. However, this conclusion is a factual determination that is made annually and thus may be subject to change. In addition, our current position that we do not expect to be a PFIC is based on our position that we qualify for a special rule that treats income recognized by a bank in the active conduct of a banking business as active income for PFIC purposes (the “active bank exception”). It is possible, however, that we may not satisfy the requirements of the active bank exception in the current or a future taxable year, or that the U.S. Internal Revenue Service may issue guidance in the future under which we would not satisfy the requirements of the active bank exception. In such a case, our interest income would be treated as passive income for PFIC purposes and we would therefore be treated as a PFIC. Accordingly, it is possible that we could become a PFIC in the current taxable year or in a future taxable year.

In general, we will be a PFIC in a taxable year if:

•at least 75% of our gross income for the taxable year is passive income or

•at least 50% of the value, determined on the basis of a quarterly average, of our assets in such taxable year is attributable to assets that produce or are held for the production of passive income.

'Passive income' generally includes dividends, interest, gains from the sale or exchange of investment property, rents and royalties (other than certain rents and royalties derived in the active conduct of a trade or business) and certain other specified categories of income. If a foreign corporation owns at least 25% by value of the stock of another corporation, the foreign corporation is treated for purposes of the PFIC tests as owning its proportionate share of the assets of the other corporation, and as receiving directly its proportionate share of the other corporation's income.

If we are treated as a PFIC, you will generally be subject to special rules with respect to:

•any gain you realize on the sale or other disposition of your Preferred Shares or ADSs and

•any excess distribution that we make to you (generally, any distributions to you during a single taxable year, other than the taxable year in which your holding period in the Preferred Shares or ADSs begins, that are greater than 125% of the average annual distributions received by you in respect of the Preferred Shares or ADSs during the three preceding taxable years or, if shorter, your holding period for the Preferred Shares or ADSs that preceded the taxable year in which you receive the distribution).

Under these rules:

•the gain or excess distribution will be allocated ratably over your holding period for the Preferred Shares or ADSs,

•the amount allocated to the taxable year in which you realized the gain or excess distribution or to prior years before the first year in which we were a PFIC with respect to you will be taxed as ordinary income,

•the amount allocated to each other prior year will be taxed at the highest tax rate in effect for that year, and

•the interest charge generally applicable to underpayments of tax will be imposed in respect of the tax attributable to each such year.

Special rules apply for calculating the amount of the foreign tax credit with respect to excess distributions by a PFIC.

Unless you make certain elections, your Preferred Shares or ADSs will generally be treated as stock in a PFIC if we were a PFIC at any time during your holding period in your Preferred Shares or ADSs, even if we are not currently a PFIC.

In addition, notwithstanding any election you make with regard to the Preferred Shares or ADSs, dividends that you receive from us will not constitute qualified dividend income to you if we are a PFIC (or are treated as a PFIC with respect to you) either in the taxable year of the distribution or the preceding taxable year. Dividends that you receive that do not constitute qualified dividend income are not eligible for taxation at the preferential rates applicable to qualified dividend income. Instead, you must include the gross amount of any such dividend paid by us out of our accumulated earnings and profits (as determined for United States federal income tax purposes) in your gross income, and it will be subject to tax at rates applicable to ordinary income.

If you own Preferred Shares or ADSs during any year that we are a PFIC with respect to you, you may be required to file IRS Form 8621.

Information with Respect to Foreign Financial Assets

Owners of 'specified foreign financial assets' with an aggregate value in excess of USD 50,000 (and in some circumstances, a higher threshold) may be required to file an information report with respect to such assets with their tax returns. 'Specified foreign financial assets' may include financial accounts maintained by foreign financial institutions, as well as any of the following, but only if they are held for investment and not held in accounts maintained by financial institutions: (i) stocks and securities issued by non-United States persons (including the Preferred Shares and ADSs), (ii) financial instruments and contracts that have non-United States issuers or counterparties, and (iii) interests in foreign entities. You are urged to consult your tax advisors regarding the application of this reporting requirement to your ownership of the Preferred Shares or ADSs.

FATCA Withholding

Under FATCA, a 30% withholding tax will be imposed on certain payments to certain non-U.S. financial institutions that fail to comply with information reporting requirements or certification requirements in respect of their direct and indirect United States shareholders and/or United States account holders. To avoid becoming subject to the 30% withholding tax on payments to them, we and other non-U.S. financial institutions may be required to report information to the IRS regarding the holders of Preferred Shares or ADSs and to withhold on a portion of payments under the Preferred Shares or ADSs to certain holders that fail to comply with the relevant information reporting requirements (or hold Preferred Shares or ADSs directly or indirectly through certain non-compliant intermediaries). However, under proposed Treasury regulations, such withholding will not apply to payments made before the date that is two years after the date on which final regulations defining the term “foreign passthru payment” are enacted. The rules for the implementation of this legislation have not yet been fully finalized, so it is impossible to determine at this time what impact, if any, this legislation will have on holders of the Preferred Shares and ADSs.

FATCA is particularly complex and its application is uncertain at this time. The above description is based in part on regulations, the intergovernmental agreement between the United States and Colombia and official guidance, which are subject to change, and the provisions described above may be implemented in a materially different form. Holders of Preferred Shares or ADSs should consult their own tax advisors regarding how these rules may apply to their investment in the Preferred Shares or ADSs.

F.Dividends and Paying Agents

Not applicable.

G.Statement by Experts

Not applicable.

H.Documents on Display

Grupo Cibest files reports and other information with the SEC pursuant to the rules and regulations of the SEC that apply to foreign private issuers. You may view Grupo Cibest's SEC filings on the SEC’s website at http://www.sec.gov.

I.Subsidiary Information

Not applicable.

J.      Annual report to security holders

Not applicable.

ITEM 11        QUANTITATIVE AND QUALITATIVE DISCLOSURES ABOUT MARKET RISK

Introduction

This section describes the market risks that we are exposed to, along with the tools and methodologies used to measure these risks as of December 31, 2025. We face market risk as an inherent aspect of our lending, trading and investment

operations. Market risk represents the potential loss due to adverse changes in market prices of financial instruments driven by fluctuations in interest rates, foreign exchange rates, equity prices and other risk factors, such as sovereign risk.

Our risk management strategy, called the 'Integrated Risk Management Strategy', is based on principles set by international bodies and by Colombian regulations, and is guided by our corporate strategy. The primary objective of the Integrated Risk Management Strategy is to identify, measure, coordinate, monitor, report and propose policies for market and liquidity risks, thereby facilitating the efficient management of our assets and liabilities. To formalize the approach to market risk management, the Board of Directors and senior management have established policies, procedures, strategies and rules for market risk administration in the 'Market Risk Manual'. This manual defines the roles and responsibilities of each subdivision and their interaction to ensure effective market risk administration.

Our Market Risks Management Department is responsible for: (a) identifying, measuring, monitoring, analyzing and controlling the market risk inherent in our businesses, (b) analyzing our exposure under stress scenarios and confirming compliance with our risk management policies, (c) analyzing the methodologies designed by the official price vendor for valuation of the market value securities and financial instruments, (d) reporting to senior management and the Board of Directors any violation of our risk management policies, (e) reporting to the senior management on a daily basis the levels of market risk associated with the trading instruments recorded in its treasury book (the 'Treasury Book'), and (f) proposing policies to the Board of Directors and to senior management that ensure the maintenance of predetermined risk levels. We have also implemented an approval process for new products across each of our subdivisions. This process ensures that each subdivision is prepared to incorporate the new product into its procedures, that all risks are considered prior to incorporation, and that approval from the Board of Directors is obtained before the new product is offered.

Our assets include both trading and non-trading instruments. Trading instruments are recorded in the Treasury Book and include fixed income securities, foreign exchange (FX) and bond futures, as well as over-the-counter plain vanilla and exotic derivatives. Derivative trading includes forward contracts on foreign currency operations, forward contracts on fixed income securities, plain vanilla options on foreign currency, Asian options on U.S. dollar/COP, cross currency swaps and interest rate swaps. Non-trading instruments are recorded in our banking book (the 'Banking Book'), which primarily includes loans, time deposits, checking accounts and savings accounts.We use a Value-at-Risk ('VaR') calculation to manage our exposure to market risk in the Treasury Book, applying two different VaR methodologies: (1) the standard methodology required by the SFC, used to report market risk exposure to the regulator (this is the methodology applied in the analysis below); and (2) an internal historical simulation methodology, used to monitor the VaR limit structure trading activities.

The Board of Directors is responsible for establishing the maximum VaR based on the assessment of the appropriate level of risk for Cibest Corporate Group. The Corporate Market, Liquidity and Interest Rate Risk Committee is responsible for establishing the maximum VaR by type of investment. These limits are supervised daily by our Market Risk Management Office.

We are exposed to foreign currency exchange rate risk due to mismatches between assets and liabilities and off-balance sheet items denominated in different currencies.These mismatches may arise from trading activities or during the normal course of business operations. Our principal foreign currency exposure is to the U.S. dollar, which is actively managed by the Treasury Division and monitored through positions, VaR, and daily results.To manage interest rate risk associated with banking activities, we conduct a thorough analysis of mismatches between interest earning assets and interest-bearing liabilities. This analysis evaluates the potential impact of interest rate shocks on both the economic value of equity (EVE) and net interest income (NII). In addition, the foreign currency exchange rate exposures arising from the Banking Book are provided to the Treasury Division, where these positions are consolidated and effectively managed.

Trading Instruments Market Risk Measurement

We also measure the Treasury Book’s exposure to market risk (including over-the-counter derivatives positions) as well as the currency risk exposure of the Banking Book, which is provided to the Treasury Division, using a VaR methodology established in accordance with Chapter XXXI of the Basic Accounting Circular issued by the SFC.

This methodology is based on the model recommended by the Amendment to the Capital Accord to Incorporate Market Risks by the Basel Committee of 2005, which focuses on the Treasury Book and excludes investments measured under amortized cost that are not pledged as collateral, as well as any other investment that comprises the Banking Book, such as non-trading positions except for the currency risk position stemming from investment in affiliated but not consolidated entities denominated in foreign currencies. In addition, the methodology aggregates all risks using correlations, through an allocation system based on defined zones and bands, adjusted by specific sensitivity factors.

Our total market risk is calculated through the arithmetical aggregation of the VaR calculated for each subsidiary.

For purposes of VaR calculations, a risk exposure category is any market variable capable of causing potential changes in the portfolio value. Considering a given risk exposure, the VaR model assesses the maximum loss that does not exceed a

specified confidence level over a given period of time. The fluctuations in the portfolio’s VaR depend on volatility, modified duration and positions changes relating to the different instruments that are subject to market risk.

The relevant risk exposure categories for which VaR is computed by Cibest Corporate Group according to Chapter XXXI, appendix VI of the Basic Accounting Circular are: (i) interest rate risks relating to local currency, foreign currency and UVR; (ii) currency risk; (iii) stock price risk; (iv) fund risk and (v) credit default swaps.

Interest Rate Risk (Treasury Book)

The interest rate risk is the probability of decline in the market value of a position due to fluctuations in market interest rates. We calculate the interest rate risk for positions in local currency, foreign currency and UVR separately, in accordance with Chapter XXXI of the Basic Accounting Circular issued by the SFC. The calculation of the interest rate risk begins with determining the net position in each instrument and estimating its sensitivity, calculated by multiplying its net present value (NPV) by its “modified duration” and by the interest rate’s estimated fluctuation (as defined by the Superintendency of Finance). The interest rate’s fluctuations are established by the SFC according to historical market performance, as shown in the following table:

Figure 1. Interest Risk – Sensitivity by Bands and Zones

		Modified Duration		Interest rate fluctuations (basis points)
Zone	Band	Low	High	Pesos	UVR	USD
Zone 1	1	0	0.08	274	274	100
	2	0.08	0.25	268	274	100
	3	0.25	0.5	259	274	100
	4	0.5	1	233	274	100
Zone 2	5	1	1.9	222	250	90
	6	1.9	2.8	222	250	80
	7	2.8	3.6	211	220	75
Zone 3	8	3.6	4.3	211	220	75
	9	4.3	5.7	172	200	70
	10	5.7	7.3	162	170	65
	11	7.3	9.3	162	170	60
	12	9.3	10.6	162	170	60
	13	10.6	12	162	170	60
	14	12	20	162	170	60
	15	20	-	162	170	60

After calculating the sensitivity factor for each position, modified duration is applied to classify positions into their respective bands. A net sensitivity is then calculated for each band, by determining the difference between the sum of all long-positions and the sum of all short-positions. Subsequently, a net position is calculated for each zone, comprising a series of bands defined by the SFC. The final step involves adjusting within each band, across bands and within each zone, culminating in the computation of the interest rate risk VaR by currency. All adjustments are executed in accordance with the guidelines issued by the Superintendency of Finance.

Our exposure to interest rate risk primarily arises from investments in Colombian government’s treasury bonds (TES) and other securities issued by the Colombian government.

Currency (Treasury and Banking Book), Equity (Treasury Book) and Fund Risk (Treasury Book)

The VaR model uses a sensitivity factor to estimate the probability of loss due to fluctuations in the prices of stocks, funds and currencies in which we hold positions. As previously indicated, the methodology used in this Annual Report to quantify such risk consists of computing VaR, calculated by multiplying the position by the maximum probable variation in the price of such positions (Δp). The Δp is determined by the SFC, as shown in the following table:

Figure 2. Sensitivity Factor for Currency Risks, Equity Risks and Fund Risks

Currency	Sensitivity Factor
USD	12.49	%
Euro	11.00	%
Other currencies	13.02	%
Equity and Fund Risk	14.70	%

Interest rate fluctuations and the sensitivity of exchange rate risk, share prices, and collective portfolios used in the model are established by the SFC in accordance with historical market behavior.

Total Market Risk VaR

This VaR is calculated as the algebraic sum of the interest rate risk, currency risk, stock price risk, fund risk and credit default swaps risk. These components are calculated by aggregating our and our subsidiaries’ exposures to each respective risk. At present, we do not have exposure to credit default swaps risk.

Our exposure to market risk decreased by 28.5%, from COP 1,697,565 in December 2024 to COP 1,213,155 in December 2025. There was a notable decrease in the exchange rate factor due to lower exposure to the U.S. dollar, driven by lower exposure to foreign currency securities. Meanwhile, the share price factor increased due to greater exposure to equity instruments, as did the collective portfolio factor, which also increased due to the valuation of the Colombia Real Estate Fund.

Assumptions and Limitations of VaR Models:

While VaR models are widely recognized as a valuable tool for risk management, they have inherent limitations, including their reliance on historical data, which may not be indicative of future market conditions or trading patterns. Consequently, VaR models should not be viewed as predictive indicators of future results. We may incur losses that could be materially in excess of the amounts estimated by the models for a particular trading day or over a specific period, and there have been instances when results have fallen outside the values generated by our VaR models. A VaR model does not estimate the greatest possible loss. The outcomes derived from these models, as well as the subsequent analysis, are subject to prudent judgment of our risk management personnel.

The chart below provides information about our VaR for trading instruments at the end of December 2024 and December 2025.

December 2025
In millions of COP
Factor	December 31	Average	Maximum	Minimum
Interest Rate Risk VaR	534,919	552,803	499,712	524,034
Foreign Exchange Rate Risk VaR	182,077	282,154	751,796	79,062
Equity Risk VaR	407,177	380,326	367,615	375,015
Fund Risk VaR	88,982	51,683	35,781	36,608
Total Value at Risk	1,213,155	1,266,967

As of December 31, 2024, the proprietary portfolio of Wenia amounted to USD -74.3 thousand, with a Value at Risk (VaR) of USD 3.8 thousand. The VaR was calculated using an internal methodology based on a Dynamic Conditional Correlation (DCC) GARCH model, with a one-day time horizon and a 99% of confidence level.

Non-Trading Instruments Market Risk Measurement

The relevant risk exposure in the Banking Book is interest rate risk, defined as the probability of unexpected changes in net interest income due to changes in market interest rates. Changes in interest rates affect our earnings as a result of timing differences on the repricing of the assets and liabilities. We manage interest rate risk arising from banking activities in non-trading instruments by analyzing the interest rate mismatches between its interest earning assets and its interest-bearing liabilities. The foreign currency exchange rate exposures associated with the Banking Book are provided to the Treasury Division where these positions are aggregated and managed.

Interest Risk Exposure (Banking Book)

We performed a sensitivity analysis of market risk sensitive instruments, estimating the impact on the net interest income for each position in the Banking Book, using a repricing model and assuming positive parallel shifts of 100 basis points (bps).

Table 1 provides information about our interest rate sensitivity for the items on the statement of financial position that comprises the Banking Book:

Table 1. Sensitivity to Interest Rate Risk of the Banking Book

The chart below provides information about our interest rate risk sensitivity in local currency (COP) at December 31, 2025 and December 31, 2024:

Interest Rate Risk
	As of December 31,
	December 31, 2025	December 31, 2024
	In millions of COP
Assets sensitivity 100 bps	1,314,604	1,262,776
Liabilities sensitivity 100 bps	870,619	915,528
Net interest income sensitivity 100 bps	443,985	347,248

The chart below provides information about our interest rate risk sensitivity in foreign currency (USD) at December 31, 2025 and December 31, 2024:

Interest Rate Risk
	As of December 31,
	December 31, 2025
	In thousands of
Assets sensitivity 100 bps	95,344
Liabilities sensitivity 100 bps	110,682
Net interest income sensitivity 100 bps	(15,337)

All values are in US Dollars.

A positive net sensitivity denotes a higher sensitivity of assets than of liabilities and implies that a rise in interest rates will positively affect our net interest income. A negative sensitivity denotes a higher sensitivity of liabilities than of assets and implies that a rise in interest rates will negatively affect our net interest income. In the event of a decrease in interest rates, the impacts on net interest income would be opposite to those described above.

Total Exposure

As of December 31, 2025, the net sensitivity of the banking book in legal currency to positive and parallel variations in interest rates of 100 basis points was COP 443,985. The variation in interest rate risk sensitivity between 2025 and 2024 is due to the increase in the portfolio balance and accounting hedges.

On the other hand, the sensitivity of the net interest margin in foreign currency, assuming a parallel shift of 100 basis points, amounted to USD 15,337. This represents an increase compared to December 31, 2024, primarily driven by higher balances in rate‑sensitive deposit accounts and certificates of deposit.

Assumptions and Limitations

Net interest income sensitivity analysis is based on the repricing model and incorporates the following key assumptions: (a) the effect of new transactions, defaults, etc. is not considered (b) the sensitivity of the fixed-rate balance sheet considers amounts maturing in less than one year, assuming that these will be placed again at market rates; and (c) changes in interest rates are presented immediately and in parallel in the yield curves for assets and liabilities.

Structural Equity Risk Exposure (Banking Book)

Grupo Cibest's Investment Banking unit, in its capacity as a financial corporation, holds structural capital investments directly and through its affiliated companies. These investments are mainly concentrated in the industrial and financial

sectors. The market value of these positions grew 25.5%, going from COP 36,226 million at the end of 2024 to COP 45,460 million at the end of 2025, mainly as a result of the appreciation of ENKA's shares.

The structural equity positions are exposed to market risk. Sensitivity calculations are made for those positions:

	As of December 31,
	2025		2024
	In millions of COP
Market Value	45,460		36,226
Delta	14.70	%	14.70	%
Sensitivity	6,683		5,325

A negative impact of 14.70% on the value of structural shares as of December 2025 would result in a COP 6,683 million drop in their market value.

ITEM 12          Description of Securities Other than Equity Securities

D.AMERICAN DEPOSITARY SHARES

D.3FEES AND CHARGES APPLICABLE TO HOLDERS OF AMERICAN DEPOSITARY RECEIPTS

The Depositary collects its fees for delivery and surrender of ADSs directly from investors depositing shares or surrendering ADSs for the purpose of withdrawal or from intermediaries acting for them. The Depositary may generally refuse to provide fee-attracting services until its fees for those services are paid.

The following are the fees charged by the Depositary:

Persons depositing or withdrawing shares must pay:	For:
USD 5.00 per 100 ADSs (or portion of 100 ADSs)	•Issuance of ADSs, including issuances resulting from a distribution of shares or rights or other property.<br><br>•Cancellation of ADSs for the purpose of withdrawal, including if the deposit agreement terminates.
Registration or transfer fees	•Transfer and registration of shares on Grupo Cibest’s share register to or from the name of the depositary or its agent when you deposit or withdraw shares.
Expenses of the depositary	•Cable, telex and facsimile transmissions (when expressly provided in the deposit agreement).<br><br>•Converting foreign currency to U.S. dollars.
Taxes and other Governmental charges the depositary or the custodian has to pay on any ADSs or share underlying a ADSs, for example, stock transfer taxes, stamp duty or withholding taxes.	•As necessary.
Any charges incurred by the depositary or its agents for servicing the deposited securities.	•As necessary.

D.4.i.FEES INCURRED IN PAST ANNUAL PERIOD

For the period between January 1, 2025, and December 31, 2025, the Depositary reimbursed Grupo Cibest USD 187,965.60 for expenses related to the administration and maintenance of the ADR facility, investor relations activities, annual listing fees and any other ADR program-related expenses incurred by Grupo Cibest directly associated with Bancolombia’s preferred share ADR Program, corresponding to the period of May 2024 to May 2025. In addition, Fiduciaria Bancolombia received COP 336 million from The Bank of New York Mellon for the period between January 1, 2025, and December 31, 2025 in connection with its role as local custodian of the depositary bank.

D.4.ii.FEES TO BE PAID IN THE FUTURE

The Bank of New York Mellon, as Depositary, has agreed to reimburse Grupo Cibest for expenses incurred that are related to establishment and maintenance expenses of the ADR Program. The Depositary has agreed to reimburse Grupo Cibest for its continuing annual stock exchange listing fees. The Depositary has also agreed to pay the standard out-of-pocket maintenance costs for the ADSs, which consist of the expenses of postage and envelopes for mailing annual and interim financial reports, printing and distributing dividend checks, electronic filing of U.S. federal tax information, mailing required tax forms, stationery, postage, facsimile, and telephone calls. It has also agreed to reimburse Grupo Cibest annually for certain investor relationship programs or special investor relations promotional activities. In certain instances, the depositary has agreed to provide additional payments to Grupo Cibest based on any applicable performance indicators relating to the ADR facility. There are limits on the amount of expenses for which the Depository will reimburse the Company, but the amount of reimbursement available to Grupo Cibest is not necessarily tied to the amount of fees the depositary collects from investors.

The Depositary collects its fees for delivery and surrender of ADSs directly from investors depositing shares or surrendering ADSs for the purpose of withdrawal or from intermediaries acting for them. The Depositary collects fees for making distributions to investors by deducting those fees from the amounts distributed or by selling a portion of distributable property to pay the fees. The Depositary may collect its annual fee for depositary services by deduction from cash distributions or by directly billing investors or by charging the book-entry system accounts of participants acting for them. The Depositary may generally refuse to provide fee-attracting services until its fees for those services are paid.

PART II

ITEM 13       DEFAULTS, DIVIDEND ARREARAGES AND DELINQUENCIES

There has not been any default, arrearage or delinquency neither in the payment of principal, interest, a sinking or purchase fund installment, nor in any payment relating to indebtedness or dividends by us.

ITEM 14       Material Modifications to the Rights of Security Holders and Use of Proceeds

There were no material modifications to the rights of shareholders.

ITEM 15       Controls and Procedures

We carried out an evaluation under the supervision and with the participation of our management, including Grupo Cibest's Chief Executive Officer and Chief Financial Officer, of the effectiveness of our disclosure controls and procedures. As a result, the Chief Executive Officer and Chief Financial Officer have concluded that, as of the end of the period covered by this report, the disclosure controls and procedures effectively provide reasonable assurance that information required to be disclosed in the reports we file and submit under the Exchange Act is recorded, processed, summarized and reported within the time periods specified in the rules and regulations of the SEC and provide reasonable assurance that such information is collected and communicated to management, including the Chief Executive Officer and Chief Financial Officer, to allow timely decisions regarding disclosure.

There are inherent limitations to the effectiveness of any system of disclosure controls and procedures, including the possibility of human error and the circumvention or overriding of the controls and procedures. Accordingly, even effective disclosure controls and procedures can only provide reasonable assurance of achieving their control objectives.

Management’s Report on Internal Control Over Financial Reporting

Management is responsible for establishing and maintaining adequate internal control over financial reporting. Our internal control over financial reporting is a process designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of consolidated financial statements for external purposes in accordance with IFRS.

Our internal control over financial reporting includes those policies and procedures that:

•Pertain to the maintenance of records that in reasonable detail accurately and fairly reflect the transactions and dispositions of our assets;

•Provide reasonable assurance that transactions are recorded as necessary to permit preparation of consolidated financial statements in accordance with generally accepted accounting principles, and that our receipts and expenditures are being made only in accordance with authorizations of our management and directors; and

•Provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use or disposition of our assets that could have a material effect on the financial statements.

Because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements. Projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate because of changes in conditions, or that the degree of compliance with the policies or procedures may deteriorate.

Management assessed the effectiveness of internal control over financial reporting as of December 31, 2025, based on criteria established in the Internal Control-Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission (2013 Framework version). On this assessment, management concluded that our internal control over financial reporting was effective as of December 31, 2025.

The effectiveness of our internal control over financial reporting as of December 31, 2025, has been audited by PwC Contadores y Auditores S.A.S. located in Colombia with PCAOB ID 6466, an independent registered public accounting firm, which report is included on page F-5 of this Annual Report.

In addition, there were no changes in our internal control over financial reporting occurred during the period covered by this Annual Report that has materially affected or is reasonable likely to materially affect our internal control over financial reporting.

ITEM 16       RESERVED

A.Audit Committee Financial Expert

The Board of Directors of Grupo Cibest appointed Silvina Vatnick as the Audit Committee financial expert in accordance with SEC rules and regulations.

Grupo Cibest's Audit Committee financial expert, along with the other members of Grupo Cibest's Audit Committee, is considered to be independent according to applicable NYSE criteria.

Ms. Vatnick has served as Grupo Cibest's Audit Committee financial expert since May 2025 she previously served as Bancolombia's Audit Committee financial expert until April, 2025. There is no business relationship between her and Grupo Cibest, except for standard personal banking services. Further, there is no fee arrangement between Ms. Vatnick and Grupo Cibest, except in connection with her capacity as a member of Grupo Cibest's Board of Directors and as a member of the Audit, Good Governance and Risk Committee. Ms. Vatnick is considered an independent director under Colombian law and Grupo Cibest's Good Governance Code, as well as under NYSE’s director independence standards and SEC's independence criteria. The Audit Committee and the financial expert also have an independent advisor, who provides advice on financial reporting and auditing matters.

For more information regarding Grupo Cibest's Audit Committee, see Item 6. 'Directors, Senior Management and Employees— C. Board Practices—Audit Committee'. For more information regarding Ms. Vatnick relevant experience, see Item 6. 'Directors, Senior Management and Employees—A. Directors and Senior Management'.

B.    Corporate Governance and Code of Ethics

Grupo Cibest has adopted a Code of Ethics and a Good Governance Code, both of which apply to all employees, including Grupo Cibest's Chief Executive Officer, Chief Financial Officer and Chief Accounting Officer, as well as to Grupo Cibest's Board of Directors.

We also have an anonymous Ethics Line (línea ética) for reporting improper conduct.

English translations of the Code of Ethics and the Good Governance Code are available on our website at https://www.grupocibest.com/es The Spanish versions take precedence for all legal purposes.

The Code of Ethics was updated in January 2026, with the approval of the Board of Directors. The main changes are:

•We updated our guidelines on Material Nonpublic Information and on Employees with Inside and/or Material Nonpublic Information (Insiders) to align with applicable SEC standards.

•We also revised the section addressing conflicts of interest in the performance of duties within the Group.

•In addition, we adjusted the policies and procedures governing the approval or rejection of gifts and invitations received by external members of the Board of Directors.

As a foreign private issuer, Grupo Cibest must disclose how its corporate governance practices may differ from those that U.S. companies listed on the NYSE must follow. We address these differences in Item 16. G Corporate Governance, which includes subsections on Independence of Directors, Non-Executive Director Meetings, Committees of the Board of Directors and Stockholders’ Approval of Dividends.

A copy of our Code of Ethics is filed as Exhibit 11.1 to this Annual Report on Form 20-F.

C.    PRINCIPAL ACCOUNTANT FEES AND SERVICES

Audit Fees

The aggregate fees billed under the caption audit fees for professional services rendered to us for the audit of our financial statements and for services that are normally provided to us, in connection with statutory or regulatory filings or engagements totaled COP 19,011 million and COP 23,401 million in audits carried out by PwC Contadores y Auditores S.A.S. and by the member firms of the PwC network located in Panama, El Salvador, Guatemala and Puerto Rico, which are the auditors of Cibest Corporate Group for the years 2025 and 2024, respectively.

Additionally, the amount of fees not billed as of December 31, 2025 and 2024 for the audit by PwC Contadores y Auditores S.A.S. is approximately COP 7,594 million and COP 6,059 million, respectively.

Tax Fees

For the years ended December 31, 2025 and 2024, we did not contract professional services related to tax compliance, tax advice or tax planning rendered by PwC Contadores y Auditores S.A.S.

All Other Fees

In 2025 and 2024, we did not pay other fees to PwC Contadores y Auditores S.A.S.

Pre-Approval Policy and Procedure

The audit committee of each company within the Cibest Corporate Group approves the fees and assignments of external auditors, and the overall fee proposal for Grupo Cibest and its subsidiaries is made known to the Audit Committee of Grupo Cibest. The fees are then submitted for approval by the General Shareholders' Meeting of each company. In cases where additional services related to the role of the external auditor and SOX are required, these must be submitted for prior approval by the audit committee of each company within the Cibest Corporate Group, in accordance with the delegation made by the General Shareholders' Meeting. Additionally, during 2025, a report was presented on a quarterly basis to Grupo Cibest's Audit Committee, providing a summary of the fees approved by the audit committees of the subsidiaries for additional services related to the role of the external auditor and SOX. Beginning 2026, these reports are presented to the Audit Committee on a semiannual basis.

During 2025, there were no services approved by the Audit Committee pursuant to paragraph (c) (7) (i) (C) of Rule 2-01 of Regulation S-X.

D.    Exemptions from the Listing Standards for Audit Committees

Not applicable.

E.    Purchases of Equity Securities by the Issuer and Affiliated Purchasers

On June 9, 2025, in an extraordinary shareholders’ meeting, the shareholders of Grupo Cibest authorized a share repurchase program covering Grupo Cibest’s Common Shares, Preferred Shares, and ADSs, for an amount of up to one trillion three hundred fifty billion Colombian pesos (COP 1,350,000,000,000), for a period of up to one (1) year, starting from the approval of the share repurchase program regulations by the Board of Directors on June 24, 2025. The execution of the program commenced on July 17, 2025.

The following table sets forth information regarding purchases of ADSs during the period covered by this report.

Period	Total number of ADSs purchased(*)	Average price paid per ADS in USD1	Total number of ADSs purchased as part of publicly announced plan or programs(**)	Approximate COP value of ADSs that may yet be purchased under the plans or programs(**)2
January 1 to January 31, 2025	-	-	-	-
February 1 to February 28, 2025	-	-	-	-
March 1 to March 31, 2025	-	-	-	-
April 1 to April 30, 2025	-	-	-	-
May 1 to May 31, 2025	-	-	-	-
June 1 to June 30, 2025	-	0	-	-
July 1 to July 31, 2025	244,469	44.86	244,469	1,281,117,291,815
August 1 to August 31, 2025	273,784	47.75	273,784	1,137,176,659,916
September 1 to September 30, 2025	236,575	51.69	236,575	989,396,083,091
October 1 to October 31, 2025	98,855	51.77	98,855	919,458,092,804
November 1 to November 30, 2025	-	-	-	919,458,092,804
December 1 to December 31, 2025	-	-	-	919,458,092,804
Total	853,683		853,683

(*) All ADSs purchased through publicly announced program.

(**) The share repurchase program was announced on June 9, 2025, covering Grupo Cibest’s Common Shares, Preferred Shares, and ADSs for an amount of up to one trillion three hundred fifty billion Colombian pesos (COP 1,350,000,000,000), for a period of up to one (1) year, from June 24, 2025 to expire on June 24, 2026.

1.     While Grupo Cibest’s primary financial statements use COP, the price is presented in USD since that is the currency in which CIB ADSs are denominated.
   

2.     The approximate value that may yet be purchased covers repurchases to be made of Common Shares, Preferred Shares, and ADSs.
   

The following table sets forth information regarding purchases of Preferred Shares during the period covered by this report.

Period	Total number of shares purchased(*)	Average price paid per share in COP	Total number of shares purchased as part of publicly announced plan or programs(**)	Approximate COP value of shares that may yet be purchased under the plans or programs(**)1
January 1 to January 31, 2025	-	-	-	-
February 1 to February 28, 2025	-	-	-	-
March 1 to March 31, 2025	-	-	-	-
April 1 to April 30, 2025	-	-	-	-
May 1 to May 31, 2025	-	-	-	-
June 1 to June 30, 2025	-		-	-
July 1 to July 31, 2025	387,983	46,388	387,983	1,281,117,291,815
August 1 to August 31, 2025	1,556,686	49,410	1,556,686	1,137,176,659,916
September 1 to September 30, 2025	1,709,476	50,829	1,709,476	989,396,083,091
October 1 to October 31, 2025	942,007	51,914	942,007	919,458,092,804
November 1 to November 30, 2025	-	-	-	919,458,092,804
December 1 to December 31, 2025	-	-	-	919,458,092,804
Total	4,596,152		4,596,152

(*) All shares purchased through publicly announced program.

(**) The share repurchase program was announced on June 9, 2025, covering Grupo Cibest’s Common Shares, Preferred Shares, and ADSs for an amount of up to one trillion three hundred fifty billion Colombian pesos (COP 1,350,000,000,000), for a period of up to one (1) year, from June 24, 2025 to expire on June 24, 2026.

1.     The approximate value that may yet be purchased cover repurchases to be made of Common Shares, Preferred Shares, and ADSs.
   

F.        Change in Registrant's Certifying Accountant

Not applicable.

G.        Corporate Governance

Grupo Cibest, as a listed company that qualifies as a foreign private issuer under the NYSE listing standards in accordance with the NYSE corporate governance rules, is permitted to follow home-country practice in some circumstances instead of the provisions of the corporate governance rules contained in Section 303A of the NYSE Listed Company Manual that are applicable to U.S. companies. Grupo Cibest follows corporate governance practices applicable to Colombian companies and those described in Grupo Cibest's Good Governance Code, which in turn follows Colombian corporate governance rules. An English translation of the Good Governance Code is available at Grupo Cibest’s website at www.grupocibest.com. The Spanish version prevails for all legal purposes.

In Colombia, a series of laws and regulations set forth corporate governance requirements. External Circular 006 of 2025, which superseded External Circular 029 of 2014, issued by the SFC, contains the corporate governance standards to be followed by companies issuing securities.

Additionally, Law 964 of 2005 established mandatory corporate governance requirements for all issuers whose securities are publicly traded in the Colombian market, and Decree 2555 of 2010, the External Circulars 031 of 2021 and 012 of 2022 —both incorporated into External Circular 006 of 2025—regulate the information disclosure requirements, including relevant and periodical information for the Colombian securities issuers. Grupo Cibest’s corporate governance standards comply with these legal requirements and Grupo Cibest has implemented additional corporate governance measures pursuant to regional recommendations including the OECD White Paper on Corporate Governance for Latin America and the Andean Development Corporation’s (CAF) Good Governance Code.

The following is a summary of the significant differences between the corporate governance practices followed by Grupo Cibest and those applicable to domestic issuers under the NYSE listing standards.

•Independence of Directors. Under NYSE corporate governance rules, a majority of a U.S. company’s board of directors must be composed of independent directors. Regarding Colombian legislation, Law 964 of 2005 requires that at least 25% of the members of Grupo Cibest's Board of Directors be independent directors, and Decree 3923 of 2006 regulates their election. Additionally, Colombian law requires that all directors exercise independent judgment under all circumstances. Grupo Cibest’s Good Governance Code includes a provision stating that directors shall exercise independent judgment and requires that at least two of the seven directors must be independent.

The Good Governance Code also includes additional independence standards that must be met by two of the seven directors. As of December 31, 2025, Grupo Cibest’s Board of Directors included a majority of independent members (four members of seven). For the independence test applicable to directors of Grupo Cibest, see Item 10. 'Additional Information. – B. Memorandum and Articles of Association – Board of Directors'.

•Non-Executive Director Meetings. Pursuant to the NYSE listing standards, non-executive directors of U.S. listed companies must meet on a regular basis without management present. There is no prohibition under Colombian regulations for officers to be members of the board of directors; however, it is customary for Colombian companies to maintain separation between the directors and management. Grupo Cibest’s Board of Directors does not include any management members; however, the CEO attends the monthly meetings of Grupo Cibest’s Board of Directors, and members of senior management may attend the meetings of the Board of Directors and committees to guarantee an adequate flow of information between employees, management and directors; in both cases, the CEO and members of senior management are not allowed to vote. In accordance with Law 964 of 2005, no executive officer can be elected as chairman of a board of directors, and according to Grupo Cibest’s bylaws, under no circumstances can a legal representative of Grupo Cibest can be elected chairman of the Board of Directors.

•Committees of the Board of Directors. Under NYSE listing standards, all U.S. companies listed on the NYSE must have an audit committee, a compensation committee, and a nominating/corporate governance committee and all members of such committees must be independent. In each case, the independence of directors must be established pursuant to highly detailed rules enacted by the NYSE and, in the case of the audit committee, the NYSE and the SEC. Grupo Cibest’s Board of Directors has a Designation, Compensation and Development Committee, a Good Governance Committee, a Risk Committee, and an Audit Committee, each of which is composed exclusively of directors (Audit Committee is composed exclusively of independent directors, whereas the other committees have both independent and non-independent directors). For a description of the Designation, Compensation and Development Committee, Corporate Governance Committee,Risk Committee, and Audit Committee see Item 6. 'Directors, Senior Management and Employees – C. Board Practices'.

•Stockholders’ Approval of Dividends. While NYSE corporate governance standards do not require listed companies to have stockholders approve or declare dividends, in accordance with the Colombian Code of Commerce, all dividends must be approved by Grupo Cibest’s stockholders.

H.     Mine Safety Disclosures

Not applicable.

I.    Disclosure Regarding Foreign Jurisdictions that Prevent Inspections

Not applicable.

J.    Insider Trading Policies

We have adopted comprehensive insider trading policies and procedures designed to govern transactions involving Grupo Cibest securities by members of our Board of Directors, executive officers (including senior management) and employees, particularly those who have access to inside information and/or material nonpublic information. These policies are intended to promote compliance with applicable insider trading laws and regulations, as well as the listing standards of the NYSE.

Our insider trading policies and procedures are set forth in our Code of Ethics, last updated in January 27, 2026, and in our Code of Good Governance, updated on February 17, 2026.

In addition, we maintain analytical guidelines, internal controls, and monitoring mechanisms designed to prevent and mitigate the risk of improper sharing of inside information and/or material nonpublic information among business units or individuals who are not authorized to access such information.

A copy of our Code of Ethics and of our Code of Good Governance is filed as an exhibit to this Annual Report on Form 20-F.

K.        Cybersecurity

Cybersecurity has become a strategic pillar for safeguarding and ensuring our resilience in an increasingly digital and complex global environment. We face constantly evolving threats, driven by the rise of sophisticated attacks and the adoption of emerging technologies such as artificial intelligence and post-quantum cryptography. In response, we have reinforced our defense capabilities through initiatives that span process automation, the consolidation of protection platforms, advanced identity and access management, and ongoing enhancements in service observability and availability.

Processes for assessing, identifying, and managing material risks from cybersecurity threats

We seek to enhance our Information Security Management System (ISMS) to proactively prevent, identify, and address cybersecurity risks. The ISMS includes a robust framework of policies, standards, controls, baselines, manuals, methodologies, and governance models, aligned with ISO 27001, NIST CSF 2.0, and COBIT. Furthermore, we leverage other specialized technical frameworks, including the Center for Internet Security (CIS) for infrastructure security and the Open Web Application Security Project (OWASP) for secure development, Application Programming Interface (API) security, and related areas.

We have established policies, procedures, and controls to protect our operations against cybersecurity threats. Roles and responsibilities have been defined for both employees and third-party providers, and we have implemented processes designed to detect, prevent, and mitigate any potential exposure of our information, people, processes, technology, or physical infrastructure to cyberattacks. These policies address risks from both internal and external sources, with the goal of ensuring the security of our data and other critical components of our operations. We further mitigate external risks by ensuring that our third-party vendors comply with our established security protocols and by maintaining oversight through regular assessments of their cybersecurity posture

We also have a process to identify, evaluate and manage the material risks of cybersecurity threats, which we consider to be part of our overall risk management cycle. When a cybersecurity incident is detected, it is quickly escalated so that we can make the necessary tactical and strategic decisions.

We periodically evaluate our cybersecurity procedures, controls, and overall maturity. For 2025, we worked with the same provider that performed the 2024 assessment to review progress on addressing previously reported findings, verify the

effective closure of completed items, and assess the relevance of action plans that remain in progress. The 2025 analysis demonstrated an improvement in the maturity level of the entities within the Cibest Corporate Group.

During 2025, we improved the cyber resilience strategy for Bancolombia and our Foreign Banks. This strategy strengthens prevention and response mechanisms while enhancing our ability to adapt to emerging cyber threats.

As part of the cyber resilience plan, we established an interdisciplinary team to ensure a comprehensive approach and reduce dependencies, leveraging cybersecurity initiatives that safeguard the continuity of our operations. We modeled several critical scenarios that could compromise essential organizational processes. Additionally, we developed a training program to strengthen employee preparedness.

We have adopted a new methodology for asset identification and classification. This change enables more accurate valuation and tailored protection strategies for each asset, ensuring that information security management remains aligned with our objectives.

Driven by our commitment to organizational efficiency and automation (key enablers for achieving the coverage and agility required in today’s cybersecurity landscape), we are advancing initiatives to automate processes and activities within the cybersecurity environment. These initiatives include deploying artificial intelligence and data analytics capabilities to guide internal users (via chatbots), enhance control verification and vulnerability detection, and refine the criticality assessment model.

The integration of artificial intelligence capabilities has enabled us to automate cybersecurity investigations, reduce false positives, accelerate diagnostics, and proactively identify emerging threats. As a result, our teams can dedicate more time to threat hunting and in-depth analysis. These advances are supported by enhanced AI governance and assurance measures, including alerts and controls designed to ensure the responsible and effective use of these tools.

The identity and access automation initiative has streamlined the access lifecycle for applications across some of our companies. We believe this transformation has significantly reduced residual risk, accelerated permission assignment times and strengthened our internal control environment. These achievements were made possible through integration with the identity governance and administration solution.

In 2025, we implemented a comprehensive series of awareness and training initiatives for all employees and a significant number of external service providers. These initiatives included diverse cybersecurity exercises covering topics such as phishing, ransomware, and enterprise email vulnerabilities, achieving 100% employee participation. Additionally, 99.98% of Bancolombia employees completed mandatory annual online cybersecurity and information security courses, with similar results across other Cibest Group companies. The virtual training platform, Cybersecurity Campus, remains accessible on the intranet, providing continuous learning and certification opportunities for all employees. We held the second edition of our Cybersecurity Marathon, a 32-hour interactive event featuring demonstrations and lectures, with approximately 6,850 employees participating.

To enhance processing capabilities, strengthen network security, and improve the detection and containment of emerging threats across both on‑premises and cloud environments, we implemented adjustments, integrations, and technological upgrades to our perimeter security controls.

In 2026, we will continue to prioritize process automation by seeking to further leverage artificial intelligence and data analytics capabilities, including the evaluation of third parties throughout their lifecycle within the organization.

We will continue to enhance our comprehensive Governance, Risk, and Compliance (GRC) system, designed to strengthen security governance across the technological ecosystem. Built on recognized frameworks and regulations, this system should enable us to more effectively manage security risks, standardize governance across the entire Cibest Corporate Group, ensure compliance with security guidelines for technological and information assets, and accelerate the assessment of cybersecurity maturity levels.

As part of our initiative to protect banking applications on mobile devices, maintaining a balance between security and user experience, we continue to implement different strategies to strengthen threat detection and blocking, as well as prevent unauthorized access. The solution’s configuration and features will continue to be updated as part of an improvement process.

To date, we have not experienced any material cybersecurity incidents. Nevertheless, we recognize the dynamic and constantly evolving nature of the global cyber risk landscape affecting industries and businesses. Depending on their origin and severity, future cybersecurity incidents could potentially have a material impact on our business strategy, operational performance, or financial condition.

For a description of how cybersecurity threats may affect our business strategy or results, see item 3.D. Risk Factors.

Board of Directors’ oversight of risks of cybersecurity threats

The Board of Directors, directly or through its committees, establishes and oversees our cybersecurity risk management strategy. On an annual basis, the Board receives reports on cybersecurity management across the Cibest Corporate Group. In this context, the Board evaluates global cybersecurity risk trends and is informed of the most significant cybersecurity incidents.

The Board has an external technology expert, that attends Board and relevant committee meetings when invited, offering independent advice and recommendations. In addition, one member of the Board of Directors is an expert in cybersecurity matters.

The Board has two committees that are involved in overseeing cybersecurity risk:

–The Audit Committee evaluates the programs aimed at preventing cybersecurity risks, for which purpose it shall review in advance the material cybersecurity incidents of Grupo Cibest. In addition, on a semiannual basis, the CISO presents to the Audit Committee an update on the group’s cybersecurity management, including key performance and risk indicators. These reports cover evaluations of information confidentiality, integrity, and availability; identification of cybersecurity threats; assessments of program effectiveness; progress on the maturity model; third-party cybersecurity practices; awareness initiatives; proposed improvements; and a summary of incidents that have affected the Cibest Corporate Group.

–The Risk Committee oversees the methodology, procedures, and tools for cybersecurity risk management, as well as the policies for its proper management. Additionally, it reports to the Board of Directors on the effectiveness of cybersecurity risk management, and reviews cybersecurity breaches and the mitigation measures adopted. Likewise, it periodically analyzes the reports submitted by senior management regarding exposure to cybersecurity risk, as well as material changes in such exposure, compliance with the risk‑tolerance level, and the mitigation and management measures adopted.

In addition, Bancolombia has a standing Technology and Cybersecurity Committee of three (3) members of the Board of Directors, including two (2) independent Directors, among them the Director who is an expert in technology and cybersecurity matters. The Committee’s primary role is to assist Bancolombia´s board in the strategic oversight of technology and cybersecurity matters. It evaluates technological trends that may impact Bancolombia's strategic objectives and approves related adoption and management strategies. Key areas of focus include software development, technological architecture, service availability, IT continuity, and investment performance. The Committee also monitors significant cybersecurity and technology events, providing recommendations to the Bancolombia´s board on measures to prevent and address channel unavailability. Additionally, it reports to the Bancolombia´s board on the effectiveness of cybersecurity risk management, incidents of cybersecurity breaches, and the mitigation measures implemented.

Bancolombia's Technology and Cybersecurity Committee meeting reports are also shared with Grupo Cibest's Board of Directors.

Management’s role and expertise in assessing and managing cybersecurity risks

Our management is responsible for identifying, evaluating, and addressing cybersecurity risks. This includes establishing processes to monitor potential exposures, implementing effective mitigation measures, and maintaining robust cybersecurity programs.The CISO, who reports to the Vice President of Customer and Employee Services, and dedicated personnel on his team are certified and experienced information systems security professionals and information security managers.Grupo Cibest’s CEO and senior management receive monthly reports on cybersecurity achievements, including metrics on monthly expected loss compliance, fraud management and the availability of components, as well as new initiatives, controls, integration and alerts.

We have two management committees involved in managing cybersecurity risks: The Corporate Cybersecurity Committee is responsible for approving and promoting cybersecurity and information security policies, strategies, and projects. It oversees compliance with the strategic plan, prioritizes initiatives and budget allocation, monitors significant changes in cybersecurity risks, and fosters a culture of information security within Cibest Corporate Group. The committee meets quarterly and includes Grupo Cibest's Risk Vicepresident, Bancolombia's Vice Presidents of Customer and Employee Services and Human Resources, as well as the Vice Presidents of Services for Bancolombia, Banistmo, Bancoagrícola,

Bam and Nequi. Meetings are led by the CISO, who participates as a permanent invitee. While the committee’s responsibilities align with those of the Cybersecurity and Information Security Committee, its decisions have a regional scope, impacting other companies within Cibest Corporate Group and tailoring specific initiatives to each bank.The Cybersecurity and Information Security Committee approves and promotes policies, standards, strategies and crucial projects, in addition to making decisions on associated controls. It periodically evaluates strategic and tactical compliance plans, reviewing, approving and prioritizing initiatives or decisions. The Committee meets monthly, and its members are Grupo Cibest's CRO, Bancolombia’s Vice President of Corporate Services, Vice President of Customer and Employee Services, and the Vice Presidents of Human Resources, Technology Services and Product Environment. The CISO, who has over 27 years of experience in Technology and Cybersecurity, is a permanent invitee of the Committee.

PART III

ITEM 17       FINANCIAL STATEMENTS

See Item 18.

ITEM 18       FINANCIAL STATEMENTS

Reference is made to pages F-1 through F-215.

ITEM 19       EXHIBITS

The following exhibits are filed as part of this Annual Report.

1.1	English translation of the corporate bylaws of the registrant, as amended onMay 12, 2025.
2.1	Deposit Agreement entered into betweenGrupo Cibestand The Bank of New YorkMellononMay16, 2025.(1)
2.2	Instruments defining the rights of the holders of long-term debt issued by Grupo Cibest S.A. and its subsidiaries.
	Grupo Cibest agrees to furnish to the SEC upon request, copies of the instruments, including indentures, defining the rights of the holders of Grupo Cibest’s long-term debt and of Grupo Cibest’s subsidiaries’ long-term debt.
2.4	Description of securities registered under section 12 of the u.s. securities exchange act of 1934
8.1	List of Subsidiaries.
11.1	Code of Ethics
11.2	Good Governance code
12.1	CEO Certification pursuant to Section 302 of the Sarbanes-Oxley Act of 2002, dated April 8, 2026.
12.2	CFO Certification pursuant to Section 302 of the Sarbanes-Oxley Act of 2002, dated April 8, 2026.
13.1	CEO Certification pursuant to Section 906 of the Sarbanes-Oxley Act of 2002, dated April 8, 2026.
13.2	CFO Certification pursuant to Section 906 of the Sarbanes-Oxley Act of 2002, dated April 8, 2026.
97.1	Clawback Policy
101.INS	Inline XBRL Instance Document
101.SCH	Inline XBRL Taxonomy Extension Schema Document
101.CAL	Inline XBRL Taxonomy Extension Calculation Linkbase Document
101.DEF	Inline XBRL Taxonomy Extension Definition Linkbase Document
101.LAB	Inline XBRL Taxonomy Extension Label Linkbase Document
101.PRE	Inline XBRL Taxonomy Extension Presentation Linkbase Document
104	Inline XBRL Cover Page Interactive Data File

(1)Incorporated by reference to the Registration Statement on Form F-6, filed by Grupo Cibest S.A. on May 6, 2025.

SIGNATURE

The registrant hereby certifies that it meets all of the requirements for filing on Form 20-F and that it has duly caused and authorized the undersigned to sign this Annual Report on its behalf.

GRUPO CIBEST S.A.
/s/ MAURICIO BOTERO WOLFF
Name: Mauricio Botero Wolff
Title: Chief Financial Officer
Date: April 8, 2026

CONSOLIDATED FINANCIAL STATEMENTS

2025, 2024 and 2023

F-1

Table of Contents

Report of Independent Registered Public Accounting Firm

To the Board of Directors and Shareholders of Grupo Cibest S. A.

Opinions on the Financial Statements and Internal Control over Financial Reporting

We have audited the accompanying consolidated statements of financial position of Grupo Cibest S. A. and its subsidiaries (“the Company”) as of December 31, 2025 and 2024, and the related consolidated statements of income, comprehensive income, changes in equity and cash flows for each of the three years in the period ended December 31, 2025, including the related notes (collectively referred to as the “consolidated financial statements”). We also have audited the Company’s internal control over financial reporting as of December 31, 2025, based on criteria established in Internal Control - Integrated Framework (2013) issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).

In our opinion, the consolidated financial statements referred to above present fairly, in all material respects, the financial position of the Company as of December 31, 2025 and 2024, and the results of its operations and its cash flows for each of the three years in the period ended December 31, 2025 in conformity with IFRS Accounting Standards as issued by the International Accounting Standards Board. Also in our opinion, the Company maintained, in all material respects, effective internal control over financial reporting as of December 31, 2025, based on criteria established in Internal Control - Integrated Framework (2013) issued by the COSO.

Basis for Opinions

The Company's management is responsible for these consolidated financial statements, for maintaining effective internal control over financial reporting, and for its assessment of the effectiveness of internal control over financial reporting, included in Management’s Report on Internal Control over Financial Reporting appearing under Item 15. Our responsibility is to express opinions on the Company’s consolidated financial statements and on the Company's internal control over financial reporting based on our audits. We are a public accounting firm registered with the Public Company Accounting Oversight Board (United States) (PCAOB) and are required to be independent with respect to the Company in accordance with the U.S. federal securities laws and the applicable rules and regulations of the Securities and Exchange Commission and the PCAOB.

F-2

Table of Contents

We conducted our audits in accordance with the standards of the PCAOB. Those standards require that we plan and perform the audits to obtain reasonable assurance about whether the consolidated financial statements are free of material misstatement, whether due to error or fraud, and whether effective internal control over financial reporting was maintained in all material respects.

Our audits of the consolidated financial statements included performing procedures to assess the risks of material misstatement of the consolidated financial statements, whether due to error or fraud, and performing procedures that respond to those risks. Such procedures included examining, on a test basis, evidence regarding the amounts and disclosures in the consolidated financial statements. Our audits also included evaluating the accounting principles used and significant estimates made by management, as well as evaluating the overall presentation of the consolidated financial statements. Our audit of internal control over financial reporting included obtaining an understanding of internal control over financial reporting, assessing the risk that a material weakness exists, and testing and evaluating the design and operating effectiveness of internal control based on the assessed risk. Our audits also included performing such other procedures as we considered necessary in the circumstances. We believe that our audits provide a reasonable basis for our opinions.

Definition and Limitations of Internal Control over Financial Reporting

A company’s internal control over financial reporting is a process designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles. A company’s internal control over financial reporting includes those policies and procedures that (i) pertain to the maintenance of records that, in reasonable detail, accurately and fairly reflect the transactions and dispositions of the assets of the company; (ii) provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles, and that receipts and expenditures of the company are being made only in accordance with authorizations of management and directors of the company; and (iii) provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use, or disposition of the company’s assets that could have a material effect on the financial statements.

F-3

Table of Contents

Because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements. Also, projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate because of changes in conditions, or that the degree of compliance with the policies or procedures may deteriorate.

Critical Audit Matters

The critical audit matter communicated below is a matter arising from the current period audit of the consolidated financial statements that was communicated or required to be communicated to the audit committee and that (i) relates to accounts or disclosures that are material to the consolidated financial statements and (ii) involved our especially challenging, subjective, or complex judgments. The communication of critical audit matters does not alter in any way our opinion on the consolidated financial statements, taken as a whole, and we are not, by communicating the critical audit matter below, providing a separate opinion on the critical audit matter or on the accounts or disclosures to which it relates.

The allowance for credit losses - collectively evaluated

As described in Notes 2 and 6 to the consolidated financial statements, expected credit losses are calculated using both individual and collective models and methodologies. These are based on significant assumptions and judgments that consider historical credit data, the current situation of the borrower and reasonable and supportable forecasts of future economic conditions. As of December 31, 2025, the allowance for loans, advances and lease losses was COP 13,2 trillion of which COP 10,3 trillion relates to collectively evaluated loans on a gross portfolio value of COP 256,3 trillion. As disclosed by management, the collectively evaluated models include parameters such as the twelve ‑month probability of default (“PD”), lifetime probability of default (when the exposure is classified in stage 2), loss given default (“LGD”), and exposure at default (“EAD”), incorporating forward‑looking information that reflects macroeconomic assumptions under plausible scenarios. One of the Company’s most significant judgments in estimating the allowance for expected credit losses on the collectively evaluated portfolio relates to the macroeconomic projections used over a reasonable and supportable forecast period. To incorporate forward-looking information into the components used to estimate expected credit losses, the Company has developed projections under three macroeconomic scenarios (base, pessimistic and optimistic), each assigned a probability of occurrence, to determine the best estimate of expected losses under potential future economic conditions.

F-4

Table of Contents

The principal considerations for our determination that performing procedures relating to the allowance for credit losses for the collectively evaluated portfolios is a critical audit matter are: (i) the significant judgment and estimation by management in estimating the projections of key macroeconomic variables impacting the forward-looking parameter, which led to a high degree of auditor judgment, subjectivity, and effort in performing procedures and evaluating audit evidence regarding management’s determination of those projections; and (ii) the audit effort involved the use of professionals with specialized skills and knowledge to assist in performing procedures and evaluating the audit evidence obtained.

Addressing the matter involved performing procedures and evaluating audit evidence in connection with forming our overall opinion on the consolidated financial statements. These procedures included testing the effectiveness of controls relating to management’s process for estimating the allowance for credit losses for the collectively evaluated portfolios, including controls over the assessment and selection of variables used in the macroeconomic scenario. These procedures also included, among others (i) evaluation of the adequacy of management’s methodology and models used to develop macroeconomic projections; (ii) testing the completeness and accuracy of the data used in the estimate; (iii) the involvement of professionals with specialized skill and knowledge to assist in evaluating (a) the reasonableness of the forecasting model and methodology used by management; (b) the reasonableness of management’s determination of the impact of macroeconomic variable projections within the scenarios considered.

/s/ PwC Contadores y Auditores S. A. S.

Medellín, Colombia

April 8, 2026

We have served as the Company’s auditor since 2020.

F-5

Table of Contents

CONSOLIDATED STATEMENT OF FINANCIAL POSITION

GRUPO CIBEST S.A. AND ITS SUBSIDIARIES

As of December 31, 2025, and 2024

(Stated in millions of Colombian pesos)

	Note	December 31, 2025(1)	December 31, 2024
ASSETS
Cash and cash equivalents	4	29,916,400	32,844,099
Financial assets investments	5.1	34,317,259	37,570,270
Derivative financial instruments	5.2	4,417,863	2,938,142
Financial assets investments and derivative financial instruments		38,735,122	40,508,412
Loans and advances to customers		256,353,981	279,453,908
Allowance for loans, advances, and lease losses		(13,253,946)	(16,179,738)
Loans and advances to customers, net	6	243,100,035	263,274,170
Assets held for sale and inventories, net	7	666,361	1,106,399
Investment in associates and joint ventures	8	3,311,506	2,928,984
Investment properties	9	6,595,407	5,580,109
Premises and equipment, net	10	5,406,874	5,906,064
Right-of-use assets, lease	11.2	1,329,718	1,757,206
Goodwill and intangible assets, net	12	2,537,180	9,767,903
Deferred tax, net	13.5	1,750,097	763,757
Assets related to investments in subsidiaries held for sale	31	40,309,257	-
Other assets, net	14	6,094,423	7,778,279
TOTAL ASSETS		379,752,380	372,215,382
LIABILITIES AND EQUITY
LIABILITIES
Deposits by customers	15	264,413,956	279,059,401
Interbank deposits and repurchase agreements and other similar secured borrowing	16	706,149	1,776,965
Derivative financial instruments	5.2	4,514,630	2,679,643
Borrowings from other financial institutions	17	9,356,428	15,689,532
Debt instruments in issue	18	7,409,693	11,275,216
Lease liabilities	11.2	1,325,039	1,889,364
Preferred shares		583,477	584,204
Current tax		701,452	156,162
Deferred tax, net	13.5	2,903,375	2,578,504
Employee benefit plans	19	947,610	951,555
Liabilities related to investments in subsidiaries held for sale	31	34,416,684	-
Other liabilities	20	11,478,253	10,990,561
TOTAL LIABILITIES		338,756,746	327,631,107
EQUITY
Share capital	22	480,914	480,914
Additional paid-in-capital		4,857,491	4,857,454
Appropriated reserves	23	23,436,138	22,575,837
Retained earnings		3,376,023	2,715,313
Net income attributable to equity holders of the Parent Company		3,820,634	6,267,744
Accumulated other comprehensive income, net of tax		3,783,433	6,645,206
SHAREHOLDERS’ EQUITY ATTRIBUTABLE TO THE OWNERS OF THE PARENT COMPANY		39,754,633	43,542,468
Non-controlling interest		1,241,001	1,041,807
TOTAL EQUITY		40,995,634	44,584,275
TOTAL LIABILITIES AND EQUITY		379,752,380	372,215,382

(1)The accumulated value as of December 31, 2025, includes the effects of the classification of Banistmo S.A. as an asset held for sale since December 18, 2025. For more information, see Note 1. Reporting Entity, Note 2.D12. Significant Accounting Policies - Assets Held for Sale and Discontinued Operations, and Note 31. Discontinued Operation.

The accompanying notes form an integral part of these Consolidated Financial Statements.

F-6

Table of Contents

CONSOLIDATED STATEMENT OF INCOME

GRUPO CIBEST S.A. AND ITS SUBSIDIARIES

For the years ended December 31, 2025, 2024, and 2023

(Stated in millions of Colombian pesos, except EPS stated in units of pesos)

	Note	2025	2024	2023
Interest on loans and financial leases
Commercial		14,746,859	15,606,023	16,389,264
Consumer		7,535,551	7,907,240	9,234,891
Mortgage		3,547,386	3,171,740	3,211,406
Financial leases		3,199,293	3,524,414	3,841,841
Small business loans		206,913	121,022	148,151
Total interest income on loans and financial leases		29,236,002	30,330,439	32,825,553
Interest on debt instruments using the effective interest method	25.1	714,677	728,238	741,684
Total Interest on financial instruments using the effective interest method		29,950,679	31,058,677	33,567,237
Interest income on overnight and market funds		100,741	130,126	103,145
Interest and valuation on financial instruments	25.1	1,436,106	1,665,513	549,219
Total interest and valuation on financial instruments		31,487,526	32,854,316	34,219,601
Interest expenses	25.2	(12,061,226)	(13,687,660)	(15,430,183)
Net interest margin and valuation on financial instruments before impairment on loans and financial leases, off balance sheet credit instruments and other financial instruments		19,426,300	19,166,656	18,789,418
Credit impairment charges on loans, advances and financial leases, net	6	(4,437,432)	(4,964,893)	(7,210,390)
Recovery (impairment) for other financial instruments	5.1 - 21.1	7,514	(30,708)	19,305
Total credit impairment charges, net		(4,429,918)	(4,995,601)	(7,191,085)
Net interest margin and valuation on financial instruments after impairment on loans and financial leases and off balance sheet credit instruments and other financial instruments		14,996,382	14,171,055	11,598,333
Fees and commissions income	25.3	7,928,554	7,126,512	6,547,953
Fees and commissions expenses	25.3	(3,573,610)	(3,225,382)	(2,838,383)
Total fees and commissions, net		4,354,944	3,901,130	3,709,570
Other operating income	25.4	3,572,074	2,976,110	3,942,712
Dividends and net income on equity investments	25.5	693,011	93,099	196,686
Total operating income, net		23,616,411	21,141,394	19,447,301
Operating expenses
Salaries and employee benefits	26.1	(5,760,122)	(5,224,723)	(4,899,283)
Other administrative and general expenses	26.2	(5,599,360)	(5,035,023)	(4,614,987)
Taxes other than income tax	26.2	(1,481,323)	(1,402,064)	(1,393,216)
Depreciation, amortization, and impairment	26.3	(1,016,301)	(989,336)	(1,017,144)
Total operating expenses		(13,857,106)	(12,651,146)	(11,924,630)
Profit continued operations before tax		9,759,305	8,490,248	7,522,671
Income tax continued operations	13	(2,810,966)	(2,379,852)	(1,820,293)
Net income continued operations		6,948,339	6,110,396	5,702,378
(Loss) / gain from discontinued operation, net(1)	31	(3,006,640)	255,185	512,593
Net income		3,941,699	6,365,581	6,214,971
Net income attributable to equity holders of the Parent Company		3,820,634	6,267,744	6,116,936
Non-controlling interest		121,065	97,837	98,035
Basic and diluted earnings per share to common shareholders, stated in units of pesos	27	4,045	6,576	6,420
From continued operations	27	7,182	6,311	5,887
From discontinued operation	27	(3,137)	265	533

(1)The accumulated value as of December 31, 2025, and 2024, includes the effects of the classification of Banistmo S.A. as an asset held for sale since December 18, 2025. For more information, see Note 1. Reporting Entity, Note 2.D12. Significant accounting policies - Assets held for sale and discontinued operations, Note 13. Income Tax and Note 31. Discontinued Operation.

The accompanying notes form an integral part of these Consolidated Financial Statements.

F-7

Table of Contents

CONSOLIDATED STATEMENT OF COMPREHENSIVE INCOME

GRUPO CIBEST S.A. AND ITS SUBSIDIARIES

For the years ended December 31, 2025, 2024 and 2023

(Stated in millions of Colombian pesos)

	Note	2025	2024	2023
Net income		3,941,699	6,365,581	6,214,971
Other comprehensive income/(loss) that will not be reclassified to net income
Remeasurement income related to defined benefit liability		4,073	6,041	(44,594)
Income tax	13.4	(5,531)	(4,747)	13,234
Net of tax amount		(1,458)	1,294	(31,360)
Investments in equity instruments measured at fair value through other comprehensive income (FVTOCI)
Unrealized gain		22,378	22,109	11,144
Income tax	13.4	(2,358)	6,463	(246)
Net of tax amount		20,020	28,572	10,898
Gains on asset revaluation
Income tax	13.4	(356)	-	-
Net of tax amount		(356)	-	-
Total other comprehensive income that will not be reclassified to net income, net of tax		18,206	29,866	(20,462)
Other comprehensive income/(loss) that may be reclassified to net income
Investments in debt instruments measured at fair value through other comprehensive income (FVTOCI)
Loss on investments recycled to profit or loss upon disposal		-	(5,996)	(8,679)
Unrealized gain		16,475	20,272	119,225
Changes in loss allowance for credit losses		(604)	538	3,741
Income tax		19,029	8,422	(21,023)
Net of tax amount		34,900	23,236	93,264
Foreign currency translation adjustments:
Exchange differences arising on translating the foreign operations		(3,118,395)	2,978,351	(4,963,913)
Gain/(Loss) on net investment hedge in foreign operations		364,414	(742,930)	1,948,833
Income tax	13.4	(140,820)	307,656	(772,755)
Net of tax amount(1)		(2,894,801)	2,543,077	(3,787,835)
Cash flow hedges
Net gains from cash flow hedges		(5,947)	351	-
Reclassification to the Statement of Income		144	(135)	-
Income tax	13.4	87	(87)	-
Net of tax amount		(5,716)	129	-
Unrealized loss on investments in associates and joint ventures using equity method		(70)	(7,690)	(2,225)
Income tax	13.4	(617)	1,348	2,223
Net of tax amount		(687)	(6,342)	(2)
Total other comprehensive income that may be reclassified to net income, net of tax		(2,866,304)	2,560,100	(3,694,573)
Other comprehensive income, attributable to the owners of the Parent Company, net of tax		(2,848,098)	2,589,966	(3,715,035)
Other comprehensive income, attributable to the Non-controlling interest		(3,488)	3,278	(5,222)
Total comprehensive income attributable to:		1,090,113	8,958,825	2,494,714
Equity holders of the Parent Company		972,536	8,857,710	2,401,901
Non-controlling interest		117,577	101,115	92,813

(1)In 2025, there was a 14.79% revaluation of the Colombian peso against the U.S. dollar, in 2024 there was a 15.36% devaluation and in 2023 there was 20.54% revaluation .

The accompanying notes form an integral part of these Consolidated Financial Statements.

F-8

Table of Contents

CONSOLIDATED STATEMENT OF CHANGES IN EQUITY

GRUPO CIBEST S.A. AND ITS SUBSIDIARIES

For the years ended December 31, 2025, 2024, and 2023

(Stated in millions of Colombian pesos, except per share amounts stated in units of pesos)

	Attributable to owners of Parent Company
					Accumulated other comprehensive income
	Share<br>Capital<br>(Note 22)	Additional<br>Paid in <br>capital	Appropriated<br><br>Reserves<br><br>(Note 23)(1)	For share repurchase (Note 23)(2)	Translation<br><br>adjustment(3)	Cash flow hedging	Equity<br>Securities<br>through OCI	Debt<br>instruments<br>at fair value<br>through OCI	Revaluation<br>of assets	Associates	Employee<br>Benefits	Retained<br>earnings	Net<br>Income	Attributable<br>to owners<br>of Parent<br>Company	Non-<br>Controlling<br>interest	Total<br>equity
Balance as of January 1, 2025	480,914	4,857,454	22,575,837	-	6,517,456	129	203,557	(44,070)	2,137	5,178	(39,181)	2,715,313	6,267,744	43,542,468	1,041,807	44,584,275
Transfer to profit from previous years	-	-	-	-	-	-	-	-	-	-	-	6,267,744	(6,267,744)	-	-	-
Dividend payment corresponding to 509,704,584 common shares and 452,122,416 preferred shares without voting rights, subscribed and paid as of December 31, 2024, at a rate of COP 3,900 per share, as approved by the shareholders' meeting on March 14, 2025. Additionally, on April 23, 2025, the shareholders' meeting approved an extraordinary dividend at a rate of COP 624 per share.	-	-	(600,180)	-	-	-	-	-	-	-	-	(3,693,424)	-	(4,293,604)	-	(4,293,604)
Other reserves	-	-	541,899	1,350,000	-	-	-	-	-	-	-	(1,923,803)	-	(31,904)	-	(31,904)
Share repurchase	-	-	-	(431,418)	-	-	-	-	-	-	-	-	-	(431,418)	-	(431,418)
Realization of retained earnings(4)	-	-	-	-	-	-	(13,675)	-	-	-	-	13,675	-	-	-	-
Others(5)	-	37	-	-	-	-	-	-	-	-	-	(3,482)	-	(3,445)	-	(3,445)
Non-controlling interest	-	-	-	-	-	-	-	-	-	-	-	-	-	-	81,617	81,617
Net Income	-	-	-	-	-	-	-	-	-	-	-	-	3,820,634	3,820,634	121,065	3,941,699
Other comprehensive income	-	-	-	-	(2,894,801)	(5,716)	20,020	34,900	(356)	(687)	(1,458)	-		(2,848,098)	(3,488)	(2,851,586)
Balance as of December 31, 2025	480,914	4,857,491	22,517,556	918,582	3,622,655	(5,587)	209,902	(9,170)	1,781	4,491	(40,639)	3,376,023	3,820,634	39,754,633	1,241,001	40,995,634

(1) The transaction for COP (600,180) corresponds to the payment of extraordinary dividend approved by the shareholders' meeting held on April 23, 2025.

(2) At the extraordinary shareholders’ meeting of Cibest, held on June 9, 2025, a share buyback program was approved for Common Shares, Preferred Shares and ADSs of Grupo Cibest S.A., up to an amount of one trillion three hundred fifty billion Colombian pesos COP 1,350 trillion. As of July, 2025, the Grupo Cibest S.A. has bought back 8,612,336 shares worth COP 431,418. For further information, see Note 1. Reporting entity and Note23. Appropiated reserves.

(3) As of December 31, 2025, the Colombian peso showed an appreciation of 14.79% against the U.S. dollar (USD), from COP 4,409.15 in 2024 to COP 3,757.08 in 2025.

(4) Realization of retained earnings from equity securities through OCI, corresponds to the sale of the investment in Bladex for COP 10,025 and partial payments of asset-backed securities investments for COP 3,650.

(5) The transaction for COP 37 in additional paid in capital corresponds to Grupo Cibest, recorded upon its capitalization.

The accompanying notes form an integral part of these Consolidated Financial Statements.

F-9

Table of Contents

CONSOLIDATED STATEMENT OF CHANGES IN EQUITY

GRUPO CIBEST S.A. AND ITS SUBSIDIARIES

For the years ended December 31, 2025, 2024, and 2023

(Stated in millions of Colombian pesos, except per share amounts stated in units of pesos)

	Attributable to owners of Parent Company
				Accumulated other comprehensive income
	Share<br>Capital<br>(Note 22)	Additional<br>Paid in <br>capital	Appropriated<br>Reserves<br>(Note 23)	Translation<br>adjustment	Cash flow hedging	Equity<br>Securities<br>through OCI	Debt<br>instruments<br>at fair value<br>through OCI	Revaluation<br>of assets	Associates	Employee<br>Benefits	Retained<br>earnings	Net<br>Income	Attributable<br>to owners<br>of Parent<br>Company	Non-<br>Controlling<br>interest	Total<br>equity
Balance as of January 1, 2024	480,914	4,857,454	20,044,769	3,974,379	-	193,906	(67,306)	2,137	11,520	(40,475)	2,515,278	6,116,936	38,089,512	960,217	39,049,729
Transfer to profit from previous years	-	-	-	-	-	-	-	-	-	-	6,116,936	(6,116,936)	-	-	-
Dividend payment corresponding to 509,704,584 common shares and 452,122,416 preferred shares without voting rights, subscribed and paid as of December 31, 2023, at a rate of COP 3,536 per share.	-	-	-	-	-	-	-	-	-	-	(3,343,319)	-	(3,343,319)	-	(3,343,319)
Other reserves	-	-	2,531,068	-	-	-	-	-	-	-	(2,566,144)	-	(35,076)	-	(35,076)
Realization of retained earnings(1)	-	-	-	-	-	(18,921)	-	-	-	-	18,921	-	-	-	-
Others	-	-	-	-	-	-	-	-	-	-	(26,359)	-	(26,359)	-	(26,359)
Non-controlling interest	-	-	-	-	-	-	-	-	-	-	-	-	-	(19,525)	(19,525)
Net Income	-	-	-	-	-	-	-	-	-	-	-	6,267,744	6,267,744	97,837	6,365,581
Other comprehensive income	-	-	-	2,543,077	129	28,572	23,236	-	(6,342)	1,294	-	-	2,589,966	3,278	2,593,244
Balance as of December 31, 2024	480,914	4,857,454	22,575,837	6,517,456	129	203,557	(44,070)	2,137	5,178	(39,181)	2,715,313	6,267,744	43,542,468	1,041,807	44,584,275

(1) Mainly corresponds to partial payments of asset-backed securities investments.

The accompanying notes form an integral part of these Consolidated Financial Statements.

F-10

Table of Contents

CONSOLIDATED STATEMENT OF CHANGES IN EQUITY

GRUPO CIBEST S.A. AND ITS SUBSIDIARIES

For the years ended December 31, 2025, 2024, and 2023

(Stated in millions of Colombian pesos, except per share amounts stated in units of pesos)

	Attributable to owners of Parent Company
				Accumulated other comprehensive income
	Share<br>Capital<br>(Note 22)	Additional<br>Paid in <br>capital	Appropriated<br>Reserves<br>(Note 23)	Translation<br>adjustment	Equity<br>Securities<br>through OCI	Debt<br>instruments<br>at fair value<br>through OCI	Revaluation<br>of assets	Associates	Employee<br>Benefits	Retained<br>earnings	Net<br>Income	Attributable<br>to owners<br>of Parent<br>Company	Non-<br>Controlling<br>interest	Total<br>equity
Balance as of January 1, 2023	480,914	4,857,454	15,930,665	7,762,214	152,028	(160,570)	2,137	11,522	(9,115)	3,278,164	6,783,490	39,088,903	908,648	39,997,551
Transfer to profit from previous years	-	-	-	-	-	-	-	-	-	6,783,490	(6,783,490)	-	-	-
Dividend payment corresponding to 509,704,584 common shares and 452,122,416 preferred shares without voting rights, subscribed and paid as of December 31, 2022, at a rate of COP 3,536 per share.	-	-	-	-	-	-	-	-	-	(3,343,319)	-	(3,343,319)	-	(3,343,319)
Other reserves	-	-	4,114,104	-	-	-	-	-	-	(4,149,684)	-	(35,580)	-	(35,580)
Realization of retained earnings(1)	-	-	-	-	30,980	-	-	-	-	(30,980)	-	-	-	-
Others	-	-	-	-	-	-	-	-	-	(22,393)	-	(22,393)	-	(22,393)
Non-controlling interest	-	-	-	-	-	-	-	-	-	-	-	-	(41,244)	(41,244)
Net Income	-	-	-	-	-	-	-	-	-	-	6,116,936	6,116,936	98,035	6,214,971
Other comprehensive income	-	-	-	(3,787,835)	10,898	93,264	-	(2)	(31,360)	-	-	(3,715,035)	(5,222)	(3,720,257)
Balance as of December 31, 2023	480,914	4,857,454	20,044,769	3,974,379	193,906	(67,306)	2,137	11,520	(40,475)	2,515,278	6,116,936	38,089,512	960,217	39,049,729

(1)Corresponds mainly to the exchange of shares from Bolsa de Valores de Colombia for shares of the Holding Bursátil Regional in Chile. The Holding Bursátil Regional was constituted as of the integration of the Colombia, Peru and Chile Stock Exchanges in November 2023.

The accompanying notes form an integral part of these Consolidated Financial Statements.

F-11

Table of Contents

CONSOLIDATED STATEMENT OF CASH FLOW

GRUPO CIBEST S.A. AND ITS SUBSIDIARIES

For the years ended December 31, 2025, 2024 and 2023

(Stated in millions of Colombian pesos)

	Note	2025(1)	2024(1)	2023(1)
Net income		3,941,699	6,365,581	6,214,971
Adjustments to reconcile net income to net cash provided by operating activities:
Depreciation and amortization	26.3	1,055,991	1,011,455	1,082,838
Other assets impairment	26.3	58,047	106,426	42,021
(Recovery) / impairment of investments in subsidiaries, associates and joint ventures	8 - 25.5 - 31	(117,867)	314,347	108,175
Impairment of goodwill	31	3,455,597	-	-
Equity method	8 - 25.5	(348,962)	(222,572)	(113,115)
Credit impairment charges on loans and advances and financial leases	6	4,620,893	5,413,652	7,461,479
(Recovery) / impairment of credit charges on off balance sheet credit and other financial instruments(2)		(29,607)	38,697	107
Gain on sales of assets	25.4	(238,305)	(103,481)	(170,910)
Valuation gain on investment securities	25.1 - 25.5	(2,516,636)	(2,376,109)	(1,680,403)
Gain upon disposal of investment in subsidiaries, associates, and joint ventures	25.5	(11,508)	-	-
Valuation on derivative financial instruments		62,468	(323,784)	(180,246)
Income tax	13.2	2,886,653	2,392,336	1,932,555
Bonuses and short-term benefits		1,049,591	811,648	734,916
Dividends	25.5	(154,368)	(140,634)	(127,427)
Investment property valuation	25.4	(109,781)	(200,256)	(197,526)
Effect of exchange rate changes		(1,133,542)	307,689	(245,915)
Other non-cash items		(41,400)	(10,276)	74,905
Net interest		(18,036,859)	(17,589,640)	(18,572,492)
Change in operating assets and liabilities:
Decrease / (increase) in derivative financial instruments		290,109	(394,624)	859,961
Decrease / (increase) in accounts receivable		1,244,206	(713,069)	(525,550)
Increase in loans and advances to customers		(27,306,897)	(21,622,099)	(10,554,946)
(Increase) / decrease in other assets		(1,167,123)	895,908	(1,151,822)
Increase / (decrease) in accounts payable		742,030	(859,352)	945,923
Increase / (decrease) in other liabilities		409,431	(1,393,618)	245,593
Increase in deposits by customers		27,999,206	18,329,816	17,025,357
Increase / (decrease) in estimated liabilities and provisions		8,498	(18,204)	(40,602)
Net changes in investment securities recognized at fair value through profit or loss		(3,004,255)	(8,401,726)	(1,988,166)
Proceeds from sales of assets held for sale and inventories		1,463,627	1,380,264	1,060,642
Recovery of charged-off loans	6	865,865	926,268	770,934
Income tax paid		(2,417,279)	(1,954,871)	(2,737,511)
Dividend received		237,314	223,313	155,676
Interest received		31,802,060	33,225,177	34,702,410
Interest paid		(13,299,951)	(14,982,367)	(15,978,748)
Net cash provided by operating activities		12,258,945	435,895	19,153,084
Cash flows from investment activities:
Purchases of debt instruments at amortized cost		(1,967,254)	(2,114,414)	(3,629,543)
Proceeds from maturities of debt instruments at amortized cost		1,115,138	1,622,184	4,738,686
Purchases of debt instruments at fair value through OCI		(436,275)	(448,930)	(7,837,997)
Proceeds from debt instruments at fair value through OCI		1,039,663	2,307,032	9,253,538
Purchases of equity instruments at fair value through OCI and interests in associates and joint ventures		(21,493)	(134,381)	(122,910)
Proceeds from equity instruments at fair value through OCI and interests in associates and joint ventures		77,330	40,489	16,804
Purchases of premises and equipment and investment properties		(2,244,222)	(2,042,094)	(2,412,123)
Proceeds from sales of premises and equipment and investment properties		496,117	414,030	185,324
Purchase of other long-term assets		(275,097)	(203,112)	(351,468)
Net cash used in investing activities		(2,216,093)	(559,196)	(159,689)
Cash flows from financing activities:
Increase in repurchase agreements and other similar secured borrowing		34,012	550,584	304,846

F-12

Table of Contents

	Note	2025(1)	2024(1)	2023(1)
Proceeds from borrowings from other financial institutions		7,454,602	9,416,739	9,855,033
Repayment of borrowings from other financial institutions		(10,808,762)	(10,496,891)	(9,921,582)
Payment of lease liability		(203,415)	(174,818)	(182,596)
Placement of debt instruments in issue(3)		2,540,893	4,155,253	1,781,728
Payment of debt instruments in issue(3)		(1,618,031)	(9,276,962)	(3,928,673)
Dividends paid		(5,196,645)	(3,398,756)	(3,298,183)
Buyback of shares	22 - 23	(431,418)	-	-
Transactions with non-controlling interests		(18,086)	(19,525)	(41,245)
Net cash (used) provided in financing activities(4)		(8,246,850)	(9,244,376)	(5,430,672)
Effect of exchange rate changes on cash and cash equivalents		(1,205,941)	2,412,167	(5,408,405)
Increase / (decrease) in cash and cash equivalents		1,796,002	(9,367,677)	13,562,723
Cash and cash equivalents at beginning of year	4	32,844,099	39,799,609	31,645,291
Cash and cash equivalents at end of year	4	33,434,160	32,844,099	39,799,609

(1)As of December 31, 2025, 2024 and 2023, the cash flow include the operations of Banistmo S.A. For more information, see Note 1. Reporting Entity; Note 2.D12. Significant Accounting Policies – Assets Held for Sale and Discontinued Operations; and Note 31. Discontinued Operation.

(2)Mainly credit card limits and overdrafts.

(3)For further information, see Note 18 Debt instruments in issues.

(4)For further information about the reconciliation of the balances of liabilities from financing activities, see Note 29 Liabilities from financing activities.

The statement of cash flows includes the following non-cash transactions, which were not reflected in the Consolidated Statement of Cash Flows:

•During the years ended December 31, 2025, 2024 and 2023, restructured loans and returned assets that were transferred to assets held for sale, inventories, and other assets for COP 1,251,021, COP 1,408,331 and COP 1,361,465, respectively,

•In 2025, the Cibest Corporate Group received an investment property as a contribution in kind valued at COP 203,832.

•In 2024, asset received as payment in kind for a loan portfolio, which was recognized as an equity instrument representing an 11% stake in the units of the FCP Pactia Inmobiliario for COP 230,674.

•In 2024, cancellation of active credit operations as a source of payment for the acquisition of P.A.(Trust Fund) Cedis Sodimac.

The accompanying notes form an integral part of these Consolidated Financial Statements.

F-13

Table of Contents

NOTES TO THE CONSOLIDATED FINANCIAL STATEMENTS

GRUPO CIBEST S.A.

NOTE 1. REPORTING ENTITY

Grupo Cibest S.A., hereinafter 'Grupo Cibest', 'Cibest Corporate Group' is a listed issuer on the Colombian Stock Exchange (BVC) as well as on the New York Stock Exchange (NYSE), since 2025. Grupo Cibest's main location is in Medellín (Colombia), main address Carrera 48 # 26-85, Avenida Los Industriales, and was incorporated under the name Grupo Cibest S.A., according to public deed number 10,594, dated September 25, 2024, from the Fifteenth Notary's Office of Medellin.

The duration contemplated in the bylaws is until December 8, 2144, but it may be dissolved or renewed before the end of that period.

The corporate purpose of Grupo Cibest is to invest in movable and immovable property, and especially, invest in shares, quotas or interest shares, or any other participation title in Colombian and/or foreign companies or entities, and the administration of said investments.

Grupo Cibest’s bylaws are formalized in the public deed number 386 dated May 12, 2025, from the Thirtieth Notary's Office of Medellin.

On May 12, 2025, according to public deed number 386 from the Thirtieth Notary's Office of Medellin, a partial spin-off agreement was formalized, whereby Bancolombia S.A. ('Bancolombia'), as the spinning-off entity, transferred part of its assets without dissolution to Grupo Cibest, as the beneficiary entity.

This transaction was first announced to the market on October 29, 2024, approved at the extraordinary shareholders’ meeting of Grupo Cibest, held on February 20, 2025, and at the extraordinary shareholders’ meeting of Bancolombia, held on April 23, 2025. It was authorized by the Financial Superintendence of Colombia through Resolutions number 0356 dated February 28, 2025, and number 0901 dated May 7, 2025.

On May 16, 2025, the market was informed of the completion of corporate transactions aimed at the evolution of the corporate structure of the Cibest Corporate Group. Upon completion of these transactions, Grupo Cibest became the parent or holding company of all financial entities and other subsidiaries, including Bancolombia (collectively referred to as Cibest Corporate Group).

As a result of these transactions, Bancolombia's shareholders (excluding Grupo Cibest) became shareholders of Grupo Cibest, which issued in their name the same number and class of shares (Common Shares and Preferred Shares), maintaining the same terms, conditions, and ownership percentages. The shares previously held in Bancolombia (excluding those held by Grupo Cibest) were cancelled. Holders of Bancolombia American Depositary Shares (ADSs) received equivalent ADSs of Grupo Cibest, and their Bancolombia ADSs were cancelled.

The Common Shares and Preferred Shares issued by Grupo Cibest are listed on the Colombian Stock Exchange (BVC) under the symbols CIBEST and PFCIBEST, respectively. The ADSs representing Preferred Shares are listed on the NYSE under the symbol CIB, the same symbol under which Bancolombia’s ADSs were previously traded.

The Common Shares, Preferred Shares, and ADSs issued by Grupo Cibest became tradable as of Monday, May 19, 2025.

At the extraordinary shareholders’ meeting of Grupo Cibest, held on June 9, 2025, a share buyback program was approved for Common Shares, Preferred Shares, and ADSs of Grupo Cibest, up to an amount of one trillion three hundred fifty billion Colombian pesos (COP 1,350,000), for a term of up to one year from the approval of the Share Buyback Program Regulation by the Board of Directors. For this program, the shareholders also approved a change in the allocation of a portion of the legal reserve and the creation of a reserve for share buyback.

On June 24, 2025, the Board of Directors of Grupo Cibest enacted the share repurchase program, the execution of which commenced on Thursday, July 17, 2025. In Colombia, the program is being carried out through the trading systems of the Colombian Stock Exchange via Valores Bancolombia S.A. Comisionista de Bolsa, and in the United States through an Enhanced Open Market Repurchase executed by Morgan Stanley & Co. LLC. For more information, see Note 23. Appropriated Reserves and Consolidated Statement of Changes in Equity.

F-14

Table of Contents

Cibest Corporate Group has national and international presence in Colombia, the United States, Puerto Rico, Panama, Guatemala, and El Salvador, and operates in the following segments: Banking Colombia, Banking Panama, Banking El Salvador, Banking Guatemala, Leases and Others (these include Fiduciaria Bancolombia, Banca de Inversión Bancolombia and Valores Bancolombia). These activities are described in Note 3. Operating Segments.

Regarding the subsidiaries, the assets and liabilities of operations in Barbados through Mercom Bank Ltd. were transferred to other entities, resulting in zero balances for both loan and deposit portfolios. The liquidation of this company has been approved by the public registry and is currently undergoing approval by the Central Bank of Barbados.

Operations in the Cayman Islands through Sinesa Cayman, Inc. (formerly Bancolombia Cayman) have been cancelled or transferred. On November 22, 2023, the Cayman Islands Monetary Authority approved the surrender of the banking license pursuant to Section 20(1)(a) of the Banks and Trust Companies Act (2021 Revision) (“BTCA”), thereby cancelling the license as of that date. No longer a banking entity, the company changed its corporate name to Sinesa Cayman, Inc. on June 20, 2024, and is currently undergoing dissolution and liquidation before the Cayman Islands Companies Registry.

The General Shareholders’ Meeting of Transportempo S.A.S. approved the liquidation of the company, including the corresponding asset allocations and final account approvals, as recorded in Minute number 98 dated July 3, 2024.

On August 27, 2025, the Extraordinary Shareholders’ Meeting of Bancolombia approved the voluntary delisting of Bancolombia's Common Shares and Preferred Shares from the National Registry of Securities and Issuers (RNVE) and the Colombian Stock Exchange (BVC). In line with this decision, the BVC formally notified the Bank of the delisting of the securities from its trading systems, effective as of September 19, 2025.

Additionally, on November 6, 2025, it was announced that the Financial Superintendence of Colombia (SFC), through Resolution No. 2002 dated October 31, 2025, as amended by Resolution No. 2021 dated November 4, 2025 (becoming final on November 6 of the same year), authorized Nequi S.A. to operate and carry out throughout the national territory the activities corresponding to the corporate purpose of a 'compañía de financiamiento'. Nequi S.A. will commence operations once the corresponding formalities have been completed and will continue to be part of Grupo Cibest. For customers, this evolution will not entail any changes in the way they access or use the products and services.

On October 21, 2025, the market was informed of the completion of the corporate reorganization of the Panamanian subsidiary Banistmo S.A., as well as other Cibest subsidiaries in Panama, which had been previously announced on September 29, 2025. It was indicated that, once the authorizations of the Superintendency of Banks of Panama and the respective Shareholders’ Meetings were obtained, the merger of the Beneficiary Company VB Panamá S.A. with Banistmo S.A. was completed (noting that the Beneficiary Company VB had previously received certain asset portfolios that were partially spun off from Valores Banistmo S.A. and Banistmo Capital Markets Group Inc.), as well as the partial spin-off by Banistmo of 100% of the shares it held in Valores Banistmo S.A., in favor of Cibest Panamá Assets S.A., a Panamanian company wholly owned by Cibest.

Moreover, on December 18, 2025, it was announced to the market the execution of a share purchase agreement with Inversiones Cuscatlán Centroamérica S.A. for the sale of 100% of the shares of Banistmo S.A. The agreed purchase price was USD 1,418,000 (subject to customary adjustments at the closing of the transaction) and will be paid in full on the closing date, once the required regulatory authorizations in Panama have been obtained and the conditions set forth in the share purchase agreement have been fulfilled. For more information, see Note 2.D12. Material Accounting Polices - Assets held for sale and discontinued operations and Note 31. Discontinued Operation.

As of December 31, 2025, Cibest Corporate Group has 33,951 employees, 35,519 banking correspondents, 6,145 ATMs and operates through 835 offices. Regarding the above, Banistmo (a subsidiary classified as a discontinued operation) had 2,119 employees, 395 banking correspondents, 338 ATMs, and operated through 37 offices.

For more information on Grupo Cibest and its subsidiaries, see Note 2.C.1. Subsidiaries.

NOTE 2. MATERIAL ACCOUNTING POLICIES

A.   Basis for preparation of the Consolidated Financial Statements

The Consolidated Financial Statements of Cibest Corporate Group are prepared in accordance with the International Financial Reporting Standards (hereinafter, “IFRS”) issued by the International Accounting Standards Board (hereinafter,

F-15

Table of Contents

“IASB”), as well as, the interpretations issued by the International Financial Reporting Interpretations Committee (hereinafter, “IFRS-IC”).

The preparation of Consolidated Financial Statements in conformity with IFRS requires the use of accounting estimates that, by definition, will seldom equal the actual results. Therefore, the estimates and assumptions are constantly reviewed. Any revision is recognized in the same period if it affects the reviewed period; or in the reviewed period and future periods if it affects all the current and future periods.

Preparation of the Consolidated Financial Statements under going concern basis

Management has assessed Cibest Corporate Group's ability to continue as a going concern and confirms that Cibest Corporate Group has adequate liquidity and solvency to continue operating the business for the foreseeable future, which is at least, but is not limited to, 12 months from the end of the reporting period. Based on Cibest Corporate Group's liquidity position at the date of authorization of the Consolidated Financial Statements, Management maintains a reasonable expectation that it has adequate liquidity and solvency to continue in operation for at least the next 12 months and that the going concern basis of accounting remains appropriate.

The Consolidated Financial Statements were prepared on a going concern basis and do not include any adjustments to the reported carrying amounts and classification of assets, liabilities and expenses that might otherwise be required if the going concern basis were not correct.

Assets and liabilities are measured at cost or amortized cost, except for some financial assets and liabilities and investment properties that are measured at fair value. Financial assets and liabilities measured at fair value comprise those classified as assets and liabilities at fair value through profit or loss, debt instruments and equity securities measured at fair value through other comprehensive income (“OCI”) and derivative instruments. Likewise, the carrying value of assets and liabilities recognized as a fair value hedge are adjusted for changes in fair value attributable to the hedged risk. Almost all investments in associates and joint ventures are measured using the equity method.

The Consolidated Financial Statements are stated in Colombian pesos (“COP”) and figures are stated in millions or billions (when indicated), except earnings per share, diluted earnings per share and the exchange rate, which are stated in units of Colombian pesos, while other currencies (dollars, euro, pounds, etc.) are stated in thousands.

The Parent Company’s financial statements, which have been prepared in accordance with “Normas de Contabilidad e Información Financiera” (“NCIF”) applicable to separate financial statements, are those that serve as the basis for the distribution of dividends and other appropriations by the shareholders.

B.   Presentation of the consolidated financial statements

Cibest Corporate Group presents the Consolidated Statement of Financial Position ordered by liquidity and the Consolidated Statement of Income is prepared based on the nature of expenses. Revenues and expenses are not offset unless such treatment is permitted or required by an accounting standard or interpretation and described in Cibest Corporate Group's policies.

The Consolidated Statement of Comprehensive Income presents net income and items of OCI classified by nature and grouped into those that will not be reclassified subsequently to profit or loss and those that will be reclassified when specific conditions are met. Cibest Corporate Group discloses the amount of income tax relating to each item of OCI.

The Consolidated Statement of Cash Flows was prepared using the indirect method, whereby net income is adjusted for the effects of transactions of a non-cash nature, changes during the period in operating assets and liabilities, and items of income or expense associated with investing or financing cash flows.

C.   Consolidation

1.   Subsidiaries

On May 16, 2025, the market was informed of the completion of corporate transactions aimed at the evolution of the corporate structure of Cibest Corporate Group. Upon completion of these transactions, Grupo Cibest S.A. became the parent or holding company of all financial entities and other subsidiaries, including Bancolombia (collectively referred to as Cibest Corporate Group). For more information, see Note 1. Reporting entity.

F-16

Table of Contents

The consolidated financial statements include the financial statements of parent company and its subsidiaries as of December 31, 2025 and 2024. The Parent Company consolidates the financial results of the entities over which it exerts control.

The following details the entities over which control is held and form part of the consolidation of the Cibest Corporate Group:

ENTITY	JURISDICTION<br>OF<br>INCORPORATION	BUSINESS	PROPORTION OF<br>OWNERSHIP<br>INTEREST AND<br>VOTING POWER<br>HELD BY CIBEST CORPORATE GROUP 2025		PROPORTION OF<br>OWNERSHIP<br>INTEREST AND<br>VOTING POWER<br>HELD BY CIBEST CORPORATE GROUP 2024		PROPORTION OF<br>OWNERSHIP<br>INTEREST AND<br>VOTING POWER<br>HELD BY CIBEST CORPORATE GROUP 2023
Valores Cibest S.A.S.(1)	Colombia	Investments	100.00	%	-	%	-	%
Inversiones Cibest S.A.S.(1)	Colombia	Investments	100.00	%	-	%	-	%
Cibest Investment Management S.A.S.(1)	Colombia	Investments	100.00	%	-	%	-	%
Cibest Inversiones Estratégicas S.A.S.(1)	Colombia	Investments	100.00	%	-	%	-	%
Bancolombia S.A.(1)	Colombia	Banking	100.00	%	100.00	%	100.00	%
Fiduciaria Bancolombia S.A. Sociedad Fiduciaria	Colombia	Trust	98.81	%	98.81	%	98.81	%
Banca de Inversión Bancolombia S.A. Corporación Financiera	Colombia	Investment banking	100.00	%	100.00	%	100.00	%
Valores Bancolombia S.A. Comisionista de Bolsa	Colombia	Securities brokerage	100.00	%	100.00	%	100.00	%
WOMPI S.A.S.	Colombia	Technology services provider	100.00	%	100.00	%	100.00	%
Renting Colombia S.A.S.	Colombia	Operating leasing	100.00	%	100.00	%	100.00	%
Transportempo S.A.S. "En liquidación"(2)	Colombia	Transportation	-	%	-	%	100.00	%
Inversiones CFNS S.A.S.	Colombia	Investments	100.00	%	100.00	%	99.94	%
P.A Tokenización Novus(3)	Colombia	Trust for administration and payments	100.00	%	-	%	-	%
Negocios Digitales Colombia S.A.S.	Colombia	Payment solutions	100.00	%	100.00	%	100.00	%
Fondo de Capital Privado Fondo Inmobiliario Colombia(4)	Colombia	Real estate investment fund	78.48	%	80.47	%	80.47	%
P.A. Inmuebles CEM(4)	Colombia	Mercantile trust	78.48	%	80.47	%	80.47	%
P.A. Calle 92 FIC-11(4)	Colombia	Mercantile trust	51.01	%	52.31	%	52.31	%
P.A. FIC Edificio Corfinsura(4)	Colombia	Mercantile trust	78.48	%	80.47	%	80.47	%
P.A. FIC-A5(4)	Colombia	Mercantile trust	78.48	%	80.47	%	80.47	%
P.A. FIC Inmuebles(4)	Colombia	Mercantile trust	78.48	%	80.47	%	80.47	%
P.A. FIC Clínica de Prado(4)	Colombia	Mercantile trust	60.47	%	62.00	%	62.00	%
P.A. FIC A6(4)	Colombia	Mercantile trust	78.48	%	80.47	%	80.47	%
P.A. Central Point(4)	Colombia	Mercantile trust	58.86	%	60.35	%	60.35	%
Fideicomiso Irrevocable de Garantía, Fuente de Pago y Administración Inmobiliaria Polaris(5)	Colombia	Mercantile trust	-	%	-	%	80.47	%
P.A. Fideicomiso Twins Bay(4)	Colombia	Mercantile trust	78.48	%	80.47	%	80.47	%
Fideicomiso Lote Av San Martín(4)	Colombia	Mercantile trust	78.48	%	80.47	%	80.47	%
P.A. Fideicomiso Lote 30(4)	Colombia	Mercantile trust	78.48	%	80.47	%	80.47	%
Fideicomiso Fondo Inmobiliario Bancolombia(4)	Colombia	Mercantile trust	78.48	%	80.47	%	80.47	%
P.A. Florencia Ferrara(4)	Colombia	Mercantile trust	43.16	%	44.26	%	44.26	%
P.A. Flor Morado Plaza(4)	Colombia	Mercantile trust	78.48	%	80.47	%	80.47	%
P.A. Galería la 33(6)	Colombia	Mercantile trust	-	%	80.47	%	80.47	%
P.A Linz Granz del Rio(4)	Colombia	Mercantile trust	43.16	%	44.26	%	-	%
Fideicomiso Selecto Terrazu Etapa 1 Torre 1(4)	Colombia	Mercantile trust	62.79	%	64.38	%	-	%
Fideicomiso Selecto Terrazu Etapa 1 Torre 2(7)	Colombia	Mercantile trust	62.79	%	-	%	-	%
Fideicomiso Lote C6 Carton de Colombia(7)	Colombia	Mercantile trust	43.16	%	-	%	-	%
Fideicomiso Mokana Recursos(7)	Colombia	Mercantile trust	39.24	%	-	%	-	%
Fideicomiso River Park(7)	Colombia	Mercantile trust	43.16	%	-	%	-	%
Valores Simesa S.A.(8)	Colombia	Investments	57.40	%	62.75	%	64.93	%
Fideicomiso Lote Distrito Vera B1B2(9)	Colombia	Mercantile trust	-	%	62.44	%	64.61	%
Fideicomiso Lote Distrito Vera B3B4(10)	Colombia	Mercantile trust	-	%	-	%	64.61	%
P.A. FAI Calle 77	Colombia	Mercantile trust	98.00	%	98.00	%	98.00	%
P.A. Nomad Salitre	Colombia	Mercantile trust	98.00	%	98.00	%	98.00	%
P.A. Nomad Central-2	Colombia	Mercantile trust	98.00	%	98.00	%	98.00	%
P.A. Calle 84 (2)	Colombia	Mercantile trust	98.00	%	98.00	%	98.00	%
P.A. Calle 84 (3)	Colombia	Mercantile trust	98.00	%	98.00	%	98.00	%
P.A. Nomad Distrito Vera(11)	Colombia	Mercantile trust	98.00	%	98.00	%	-	%
P.A Nexo(11)	Colombia	Mercantile trust	98.00	%	98.00	%	-	%
P.A. Mercurio	Colombia	Mercantile trust	100.00	%	100.00	%	100.00	%

F-17

Table of Contents

ENTITY	JURISDICTION<br>OF<br>INCORPORATION	BUSINESS	PROPORTION OF<br>OWNERSHIP<br>INTEREST AND<br>VOTING POWER<br>HELD BY CIBEST CORPORATE GROUP 2025		PROPORTION OF<br>OWNERSHIP<br>INTEREST AND<br>VOTING POWER<br>HELD BY CIBEST CORPORATE GROUP 2024		PROPORTION OF<br>OWNERSHIP<br>INTEREST AND<br>VOTING POWER<br>HELD BY CIBEST CORPORATE GROUP 2023
P.A CEDIS Sodimac(11)	Colombia	Mercantile trust	100.00	%	100.00	%	-	%
Wenia S.A.S.	Colombia	Technology services	100.00	%	100.00	%	100.00	%
P.A. Wenia	Colombia	Mercantile trust	100.00	%	100.00	%	100.00	%
Nequi S.A. Compañía de Financiamiento	Colombia	Financial services	100.00	%	100.00	%	100.00	%
Sociedad Beneficiaria BC Panamá S.A.S(12)	Colombia	Holding	-	%	100.00	%	-	%
P.A Títulos de Pagos por Ejecución(13)	Colombia	Mercantile trust	100.00	%	-	%	-	%
Cibest Panamá Assets, S.A(14)	Panama	Investment	100.00	%	-	%	-	%
Cibest Capital Panamá, S.A. (before Valores Banistmo S.A.(14))	Panama	Purchase and sale of securities	100.00	%	100.00	%	100.00	%
Bancolombia Panamá S.A.	Panama	Banking	100.00	%	100.00	%	100.00	%
Sistemas de Inversiones y Negocios S.A. Sinesa	Panama	Investments	100.00	%	100.00	%	100.00	%
Banagrícola S.A.	Panama	Holding	99.17	%	99.17	%	99.17	%
Banistmo S.A.(15)	Panama	Banking	100.00	%	100.00	%	100.00	%
Banistmo Investment Corporation S.A.(15)	Panama	Trust	100.00	%	100.00	%	100.00	%
Leasing Banistmo S.A.(15)	Panama	Leasing	100.00	%	100.00	%	100.00	%
Banistmo Panamá Fondos de Inversión S.A.(15)	Panama	Investment fund holder	100.00	%	100.00	%	100.00	%
Desarrollo de Oriente S.A.(15)	Panama	Real estate	100.00	%	100.00	%	100.00	%
Banistmo Capital Markets Group Inc.(15)(16)	Panama	Purchase and sale of securities	100.00	%	100.00	%	100.00	%
Anavi Investment Corporation S.A.(15)(16)	Panama	Real estate	100.00	%	100.00	%	100.00	%
Steens Enterprises S.A.(15)(16)	Panama	Portfolio holder	100.00	%	100.00	%	100.00	%
Ordway Holdings S.A.(15)(16)	Panama	Real estate broker	100.00	%	100.00	%	100.00	%
Grupo Agromercantil Holding S.A.	Panama	Holding	100.00	%	100.00	%	100.00	%
Banco Agromercantil de Guatemala S.A.	Guatemala	Banking	99.68	%	99.68	%	99.68	%
Seguros Agromercantil de Guatemala S.A.	Guatemala	Insurance agency	79.92	%	79.92	%	79.92	%
Financiera Agromercantil S.A.	Guatemala	Financial services	100.00	%	100.00	%	100.00	%
Agrovalores S.A.	Guatemala	Securities brokerage	100.00	%	100.00	%	100.00	%
Arrendadora Agromercantil S.A.	Guatemala	Financial Leasing	100.00	%	100.00	%	100.00	%
Asistencia y Ajustes S.A.	Guatemala	Roadside and medical assistance services	100.00	%	100.00	%	100.00	%
Serproba S.A.	Guatemala	Maintenance and remodeling services	100.00	%	100.00	%	100.00	%
Servicios de Formalización S.A.	Guatemala	Loans formalization	100.00	%	100.00	%	100.00	%
Conserjeria, Mantenimiento y Mensajería S.A. "En liquidación"	Guatemala	Maintenance services	100.00	%	100.00	%	100.00	%
Mercom Bank Ltd.(17)	Barbados	Banking	99.68	%	99.68	%	99.68	%
New Alma Enterprises Ltd.	Bahamas	Investments	99.68	%	99.68	%	99.68	%
Bancolombia Puerto Rico Internacional Inc.	Puerto Rico	Banking	100.00	%	100.00	%	100.00	%
SINESA Cayman, Inc.(18)	Cayman Islands	Banking	100.00	%	100.00	%	100.00	%
Banco Agrícola S.A.	El Salvador	Banking	97.36	%	97.36	%	97.36	%
Arrendadora Financiera S.A. Arfinsa	El Salvador	Leasing	97.37	%	97.37	%	97.37	%
ACCELERA S.A. de C.V.	El Salvador	Credit card services	97.36	%	97.36	%	97.36	%
Valores Banagrícola S.A. de C.V.	El Salvador	Securities brokerage	98.89	%	98.89	%	98.89	%
Inversiones Financieras Banco Agrícola S.A. IFBA	El Salvador	Holding	98.89	%	98.89	%	98.89	%
Gestora de Fondos de Inversión Banagrícola S.A.	El Salvador	Administers investment funds	98.89	%	98.89	%	98.89	%
Bagrícola Costa Rica S.A.	Costa Rica	Business and management advising	99.17	%	99.17	%	99.17	%
Cibest Capital Holdings USA LLC (before Bancolombia Capital Holdings USA LLC)	United States	Holding	100.00	%	100.00	%	100.00	%
Cibest Capital Advisory Services LLC (before Bancolombia Capital Advisers LLC)	United States	Investment advisor	100.00	%	100.00	%	100.00	%
Cibest Capital Securities LLC (before Bancolombia Capital LLC)	United States	Securities brokerage	100.00	%	100.00	%	100.00	%
Wenia Ltd.	Bermuda	Technology services	100.00	%	100.00	%	100.00	%

(1) Incorporation of subsidiaries due to changes in the corporate structure, whereby Grupo Cibest S.A. became the holding company of all financial entities and other companies within Cibest Corporate Group, including Bancolombia. For further information, see Note 1. Reporting entity.

(2) Company liquidated in July 2024. For more information, see Note 1. Reporting entity.

(3) Trust for administration and payments consolidated by Inversiones CFNS S.A.S since December 2025.

(4) The decrease in the shareholding is due to the entry of a new investor in September 2025, which diluted the percentage of participation.

(5) On February 29, 2024, the trust rights were transferred as a result of the sale by Fondo de Capital Privado Fondo Inmobiliario Colombia

(6) On August 21, 2025, the trust rights were transferred as a result of the sale by Fondo de Capital Privado Fondo Inmobiliario Colombia.

(7) Companies consolidated by Fondo de Capital Privado Fondo Inmobiliario Colombia, Fideicomiso Terrazu Etapa 1 Torre 2 since May 2025, Fideicomiso Lote C6 Cartón de Colombia y Fideicomiso Mokana since September 2025 y el Fideicomiso River Park since November 2025.

(8) The decrease in the shareholding is due to the repurchase of outstanding stock carried out by Valores Simesa subsidiary during 2025 and 2024.

(9) During 2025, the trust rights were transferred as a result of the sale by Valores Simesa S.A. (Parent of the fund).

(10) During 2024, the trust rights were transferred as a result of the sale by Valores Simesa S.A.

(11) During May, June and November 2024, the parent company was established as trustor of P.A. CEDIS Sodimac, P.A. Nomad Distrito Vera and P.A. Nexo, respectively through a management mercantile trust agreement, for real estate activity purposes.

F-18

Table of Contents

(12) On September 27, 2024, Sociedad Beneficiaria BC Panamá was established, a company whose corporate purpose is to be the beneficiary of the division of a company domiciled in Panama, by virtue of which it partially transfers its assets, as a consequence of the above, to be the owner of the assets and liabilities received on the occasion of said operation, and merge with a company domiciled in Colombia. For more information, see Note 1. Reporting entity. In 2025, once the transaction was completed, the company Beneficiaria BC Panamá was liquidated.

(13) Company consolidated by Bancolombia S.A. since December 2025.

(14) Investments of Cibest Corporate Group resulting from the the partial spin-off by Banistmo of 100% of the shares it held in Cibest Capital Panamá, S.A. (before Valores Banistmo S.A.), in favor of Cibest Panamá Assets S.A., a Panamanian company wholly owned by Cibest. For further information, see Note 1. Reporting entity.

(15) on December 18, 2025, Cibest informed to the market the execution of a share purchase agreement with Inversiones Cuscatlán Centroamérica S.A. for the sale of 100% of the shares of Banistmo S.A. For further information, see Note 1. Reporting entity.

(16) Investments in non-operational stage.

(17) On September 30, 2021, Mercom Bank Ltd shareholder authorized the beginning of an organized and gradual process to transfer of the assets and liabilities of Mercom Bank, Ltd., to Banco Agromercantil de Guatemala, S. A. or other companies of Cibest Corporate Group. For further information, see Note 1. Reporting Entity.

(18) On October 5, 2020, the Board of Directors of Bancolombia Panamá (parent company of Sinesa Cayman), authorized the decision to wind-down the business and operations of its subsidiary in Cayman. For further information, see Note 1. Reporting entity.

When necessary, adjustments are made to the accounting principles in the financial statements of subsidiaries to bring their accounting policies into line with Cibest Corporate Group's accounting policies, in order to prepare the Consolidated Financial Statements using uniform accounting policies.

All intragroup assets and liabilities, equity, income, expenses and cash flows relating to transactions between members of Cibest Corporate Group are eliminated in full on consolidation.

Non-controlling interests in controlled entities are presented in profit or loss and equity separately from the Parent Company's shareholders' equity and profit or loss. When Cibest Corporate Group loses control over a subsidiary, any residual interest remaining on Cibest Corporate Group's balances is measured at fair value; gains or losses arising from this measurement are recognized in net income.

The loan and financial leases originated by Banistmo and Bancolombia Panama are subject to prudential regulation in Panama by the Superintendencia de Bancos de Panamá (“SBP”) requiring the maintenance of minimum reserves as a countercyclical capital buffer. For the years ended as of December 31, 2025 and 2024, the reserves recognized amounted to COP 987,250 and COP 972,818. The establishment of these reserves restrict the ability of the aforementioned subsidiaries to pay dividends to Grupo Cibest S.A., the ultimate parent, except in the event of liquidation.

As of December 31, 2025, Banistmo was considered as assets held for sale. For further information see Note 1. Reporting entity, Note 2.D.12 material accounting policies and Note 31. Discontinued Operations.

2.    Business reorganization and transactions between entities under common control

The business reorganization process under common control refers to transactions in which entities under Cibest Corporate Group's control are restructured, both before and after the reorganization, and such control is not temporary.

For transactions under common control, Cibest Corporate Group has chosen as its accounting policy to apply the predecessor value method for recognizing intercompany transactions. This means that the assets and liabilities carved out from the entity or business being spun off are recognized in the Separate Financial Statements of the receiving company at their carrying amounts, as recorded prior to the transaction date.

Cibest Corporate Group presents the net assets received as if they had always been part of its Financial Statements from the date of transfer.

The Financial Statements for the second quarter of 2025 and year-end 2024 are presented on a consolidated basis, reflecting Cibest Corporate Group’s structure in effect during that period, since, under the adopted policy, historical Financial Statements are used as if the new corporate structure had always existed. Consequently, the comparative balances of the holding company are equivalent with those of the former parent company. During the second quarter of 2025, Cibest Corporate Group assumed the position of parent within the economic group. Therefore, from that date onward, the financial statements presented include all subsidiaries previously consolidated by Bancolombia. For more information, see Note 1 – Reporting Entity.

3.    Fund’s administration

Cibest Corporate Group manages assets held in mutual funds and other forms of investment. Assets managed by Cibest Corporate Group and owned by third parties are not included in the Consolidated Financial Statements unless control exists as structured entities.

F-19

Table of Contents

Cibest Corporate Group consolidates the following funds:

Name		Country		% of ownership<br>interest held by<br>Cibest Corporate Group, 2025	% of ownership<br>interest held by<br>Cibest Corporate Group, 2024	% of ownership<br>interest held by<br>Cibest Corporate Group, 2023	Assets managed
	December 31,<br>2025		December 31,<br>2024
Fondo de Capital Privado Fondo Inmobiliario Colombia(1)		Colombia		78.48%	80.47%	80.47%	6,840,135	6,039,891
Fideicomiso Lote Distrito Vera B1B2(2)		Colombia		—%	62.44%	64.61%	—	26,367
Fideicomiso Lote Distrito Vera B3B4(3)		Colombia		-	—%	64.61%	-	—
Banistmo Panamá Fondos de Inversión S.A.(4)		Panama		100.00%	100.00%	100.00%	69,395	126,092

(1)It includes the amounts of certain equity instruments that are controlled through the subsidiary Fondo de Capital Privado Fondo Inmobiliario Colombia, they meet the definition of control in accordance with IFRS 10. For further information, see Note 2.C. Consolidation. The decrease in the percentage of participation is due to the entry of a new investor in September 2025, which diluted the percentage of participation.

(2) During 2025, the trust rights were transferred by Valores Simesa S.A. (the fund’s parent company).

(3)During 2024, the trust rights were transferred by Valores Simesa S.A. (the fund’s parent company).

(4) Investment in non-operational stage. The variation in assets managed is mainly due to the effect of converting US dollars to Colombian pesos in the consolidation process, the closing exchange rate was to 4,409.15 in December 2024 and 3,757.08 in December 2025, also withdrew its participation in Fondo Renta Fija Valor to free up resources. For more information, see Note 2.C. Consolidation Principles.

For all the aforementioned funds, Cibest Corporate Group participated in the design of the structured entity, makes operating and financial decisions on behalf of the funds and is exposed to variable returns such as dividends or returns paid in quarterly installments.

Commissions earned by the management of funds that are not consolidated are included in the Consolidated Statement of Income as “Fees and commissions income”.

4.    Non-controlling interest

Non-controlling interests in the net assets of consolidated subsidiaries are presented separately within Cibest Corporate Group's equity. Similarly, net income and other comprehensive income are also attributed to non-controlling interest and equity holders of the Parent Company. In a business combination, the amount of non-controlling interest may be initially measured either at fair value or at the non-controlling interest’s proportionate share of the acquirer’s identifiable net assets. The option for recognition is made on an investment-by-investment basis.

Any purchase or sale of shares in subsidiaries that does not imply a loss or gain of control is directly recognized in equity.

D.    Material Accounting Policies

The material accounting policies used by Cibest Corporate Group in the preparation of its Consolidated Financial Statements are detailed below:

1.    Functional currency, transactions and balances in foreign currency

The functional and presentation currency of Cibest Corporate Group's Consolidated Financial Statements is the Colombian peso. Therefore, all balances and transactions denominated in currencies other than the Colombian peso are considered as foreign currency, which are translated into the functional currency using the exchange rates at the dates of the transactions.

Foreign exchange gains and losses resulting from the settlement of the transactions and from the translation of monetary assets and liabilities denominated in foreign currencies at period end are generally recognized in net income. They are deferred in equity (other comprehensive income) if they relate to qualifying cash flow hedges and qualifying net investment hedges or are attributable to part of the net investment in a foreign operation.

Non-monetary items that are measured at cost are held at the exchange rate at the transaction date, while those which are measured at fair value in a foreign currency are translated using the exchange rates at the date when the fair value was determined. When a gain or loss on a non-monetary item is recognized in the Consolidated Statement of Comprehensive Income, any exchange component of that gain or loss is recognized in other comprehensive income. Conversely, when a gain or loss on a non-monetary item is recognized in net income, any exchange component of that gain or loss shall be recognized in net income.

F-20

Table of Contents

Cibest Corporate Group translated the results and financial position of foreign subsidiaries into the functional currency as follows:

•Assets and liabilities for each Statement of Financial Position presented are translated at the closing rate at the date of that Consolidated Statement of Financial Position;

•Income and expenses for each Statement of Income and Statement of Comprehensive Income is translated at average exchange rates for the period; and

•All resulting of such translations are recognized in other comprehensive income in the caption “Translation adjustment”.

When a foreign operation is sold, the associated exchange differences are reclassified to net income, as part of the gain or loss on sale.

Goodwill and fair value adjustments arising on the acquisition of a foreign operation are treated as assets and liabilities of the foreign operation and translated at the closing exchange rate.

The table below sets forth the exchange rate used by Cibest Corporate Group and its subsidiaries to convert Consolidated Statement of Financial Position accounts and transactions in U.S. dollar into Colombian pesos:

	December 31, 2025	December 31, 2024	December 31, 2023
Year-end exchange rate	3,757.08	4,409.15	3,822.05
Average rate for the period ended at	4,052.89	4,073.75	4,330.14

2.    Cash and cash equivalents

Cibest Corporate Group considers cash and cash equivalents to include cash and balances at banks and the Central Bank, interbank assets and reverse repurchase agreements and other similar secured lending that have original maturities up to 90 days, as shown in Note 4. Cash and cash equivalents.

3.    Business combinations and goodwill

Business combinations are those transactions where an acquirer obtains control of a business (e.g., an acquisition or merger).

Business combinations are accounted for using the acquisition method as follows: a) identifiable acquired assets, liabilities and contingent liabilities assumed in the acquisition are recognized at fair value at the date of acquisition; b) acquisition costs are recognized in the Consolidated Statement of Income as expenses in the periods in which the costs are incurred and the services are received; and c) goodwill is recognized as an asset in the Consolidated Statement of Financial Position or a gain from a bargain purchase.

The consideration transferred for the acquisition of a subsidiary is the fair value of the assets transferred, the liabilities incurred to the former owners of the acquiree, and the equity interests issued by Cibest Corporate Group (if any).

Goodwill is measured as the excess of the sum of the consideration transferred, the value of any non-controlled interest and, when applicable, the fair value of any previous equity interest in the acquired entity, over the net fair value of the acquired assets, liabilities or contingent liabilities assumed at the date of acquisition.

For each business combination, at the date of acquisition, Cibest Corporate Group measures the non-controlling interest by the proportional share of the identifiable assets acquired, as well as liabilities and contingent liabilities assumed by the acquired company, or by their fair value.

Any contingent consideration in a business combination is classified as a liability or as equity and is recognized at fair value at the date of acquisition, the liability is remeasured at subsequent reporting dates in accordance with IAS 37 Provisions, contingent liabilities and contingent assets, and the consideration classified as equity is not remeasured at subsequent reporting dates and its subsequent settlement is accounted for within equity.

The goodwill acquired in a business combination is allocated, at the date of acquisition, to Cibest Corporate Group's cash-generating units (or group of cash generating units) which are expected to benefit from the combination, regardless of whether other assets or liabilities of the acquiree are assigned to those units or group of units.

F-21

Table of Contents

For business combinations achieved in stages, any previous equity interest held by Cibest Corporate Group in the acquiree is remeasured at its fair value at the date of acquisition and any resulting gain (or loss) is reported in the Consolidated Statement of Income or Other Comprehensive Income, as appropriate. Amounts related to such investments previously recognized in other comprehensive income that must be recycled through net income are reclassified to the Consolidated Statement of Income, as if such investment had been sold. When the associate had other comprehensive income, which was not reclassified to profit or loss, the amounts were reclassified within equity to “Retained earnings” once the investment was sold.

4.    Financial instruments

A financial instrument is a contract that gives rise to a financial asset of one entity and a financial liability or equity instrument of another entity.

4.1. Financial assets

Financial assets are recognized in the Consolidated Statement of Financial Position when Cibest Corporate Group becomes party to the contractual provisions of the instrument. This includes regular way purchases and sales, which are those purchases and sales of financial assets that require the delivery of assets within the time frame established by regulation or convention in the marketplace. Cibest Corporate Group uses settlement date accounting for regular way contracts when recording financial asset transactions.

At initial recognition, Cibest Corporate Group measures financial assets at fair value plus, in the case of a financial asset that is not measured at fair value through profit or loss, the transaction costs directly attributable to the acquisition of the financial assets. Transaction costs of financial assets subsequently measured at fair value with changes in profit or loss are recognized as expenses in the income statement. After initial recognition, for financial assets measured at amortized cost and investments in debt securities subsequently measured at fair value with changes in other comprehensive income, an allowance for expected credit losses (“ECL”) is recognized.

4.1.1.  Classification and measurement of financial assets

Cibest Corporate Group classifies its financial assets considering the business model and the characteristics of contractual cash flows (cash flows that consist solely of payments of principal and interest on the principal amount outstanding at specified dates – “SPPI”) in accordance with the following categories of subsequent measurement:

•Amortized cost: measured at cost using the effective interest rate method, excluding future credit losses, and considering transaction costs and premiums granted, less commissions and discounts received that are included in the calculation of the effective interest rate.

•Fair value through other comprehensive income (FVOCI): measured using fair value, variations in the fair value of the investment are recognized in other comprehensive income, except for impairment losses or recoveries, interest income, and gains or losses on foreign exchange, which are recognized in the income statement.

•Fair value through profit or loss (FVTPL): measured using fair value, variations in the fair value are recognized in the income statement.

The classification based on the business model reflects how Cibest Corporate Group manages financial assets and how it determines whether cash flows from the asset will come from obtaining contractual cash flows, selling the instrument, or both. If the objective is to obtain contractual cash flows, the assets are subsequently measured at amortized cost; if the objective is to obtain contractual cash flows and selling financial assets, the assets are subsequently measured at FVOCI. A financial asset shall be measured at FVTPL unless it is measured at amortized cost or at FVOCI.

Cibest Corporate Group measures equity instruments at FVTPL. Likewise, Cibest Corporate Group has made an irrevocable choice to present subsequent changes in the fair value of some equity instrument investments that are not held for trading in other comprehensive income; dividends from such investments are recognized in the income statement when the right to receive payment is established.

Accumulated gains or losses in other comprehensive income at the time of derecognition of a financial asset are reclassified from equity to the income statement, except for investments in equity instruments for which Cibest Corporate Group has made the irrevocable choice to present subsequent changes in fair value in other comprehensive income; for these, reclassification is made to the "retained earnings" line.

F-22

Table of Contents

4.1.2.  Impairment of financial assets at amortized cost or at fair value through other comprehensive income “FVOCI”

4.1.2.1.   Impairment of loan portfolio and financial leasing transactions

Expected credit losses are calculated using both individual and collective models and methodologies. These are based on significant assumptions and judgments that consider historical credit data, the current situation of the borrower and reasonable and supportable forecasts of future economic conditions. The collectively evaluated models include parameters such as the twelve-month probability of default (“PD”), lifetime probability of default (when the exposure is classified in stage 2), loss given default (“LGD”), and exposure at default (“EAD”), incorporating forward‑looking information that reflects macroeconomic assumptions under plausible scenarios.

One of the Group’s most significant judgments in estimating the allowance for expected credit losses on the collectively evaluated portfolio relates to the macroeconomic projections used over a reasonable and supportable forecast period. In addition, for loans individually assessed in stage 3, Cibest Corporate Group evaluates significant exposures in default by analyzing each borrower’s debt profile, the fair value of the collateral pledged, credit performance information, and the customer’s expected future cash flows.

At the end of each reporting period, Cibest Corporate Group assesses the expected credit loss impairment model for a financial asset or group of assets measured at amortized cost, where impairment is recognized from “day 1” following initial recognition. The model is structured into three stages in which a financial asset may be classified from its initial recognition, based on its credit risk level and the circumstances that indicate a significant increase in credit risk, as described below:

•Stage 1: financial instruments that have not experienced a significant increase in credit risk since initial recognition, or that have low credit risk at the reporting date.

•Stage 2: financial instruments that have experienced a significant increase in credit risk since initial recognition (unless they have low credit risk at the reporting date), but do not present objective evidence of impairment.

•Stage 3: financial instruments that have objective evidence of impairment (“OEI”) at the reporting date.

For each stage, an expected credit loss (“ECL”) is calculated. This calculation incorporates both current and forward‑looking conditions, portfolio behavior, and various associated macroeconomic factors.

•For stage 1, a 12-month ECL is calculated. This represents the expected credit losses that may result from default events that are possible within the 12 months following the reporting date.

•For stage 2 and 3, a Lifetime ECL is calculated. This reflects the expected credit losses that may arise from all possible default events over the expected life of the financial instrument.

Significant increase in risk

To determine whether an asset has experienced a significant increase in risk since its initial recognition, and is therefore should be classified in Stage 2, Cibest Corporate Group assesses both quantitative and qualitative factors. For each portfolio, Cibest Corporate Group reviews the rebuttable presumption of more than 30 days overdue in payment. Cibest Corporate Group determines whether the credit risk of financial instruments has increased significantly since their initial recognition as follows:

Quantitative criteria

•Clients with loans that are over 30 days past due.

•Lifetime PD assessment: Cibest Corporate Group has determined that the most suitable quantitative way to establish the significant increase in credit risk is by comparing the residual lifetime PD at the initial recognition and the current lifetime PD. To measure this difference, two thresholds are defined:

◦Absolute threshold: this is the absolute difference between the current lifetime PD and the residual lifetime PD at initial recognition. A positive absolute variation beyond this threshold indicates an increase in the instrument’s risk.

◦Relative threshold: this is the percentage variation between the value of the current lifetime PD and the residual lifetime PD at initial recognition. A positive percentage variation beyond this threshold indicates an increase in the instrument’s risk.

F-23

Table of Contents

If the PD comparison surpasses one threshold but not the other, it is not considered a significant increase in the instrument’s risk.

If the instrument does not exceed the threshold, additional qualitative criteria are assessed. These can identify a significant increase in credit risk even when the obligation is nearing expiration. These criteria include:

Qualitative criteria

•Loans restructured due to credit risk, where the client is experiencing financial difficulties, are classified in stage 2, until the instrument is canceled, cured (after a period of demonstrated good performance) or transferred to stage 3 upon meeting the definition of default.

•Loans that cease to be in default (stage 3) remain in stage 2 for a 12‑month period.

•Customers on the watchlist with a medium‑risk profile, according to the policies defined by the Special Customer Management Committee (“AEC” by its initials in Spanish).

•Cibest Corporate Group also reviews, on a semiannual basis, whether there are collective criteria for migrating a group of customers to stage 2. Examples include significant changes since origination in a particular product or geographic region, industry‑specific or regulatory events, market conditions, or any other significant event considered relevant to the customer’s future cash‑flow generation capacity.

Rebuttable presumption of more than 30 Days Past Due

Cibest Corporate Group has performed a review for each portfolio regarding the presumption of a significant increase in credit risk upon exceeding 30 days past due. Historical evidence supports the correlation between this presumption and default events.

Definition of default

To determine whether an asset is in default, and thus classified as stage 3, the evaluates quantitative and qualitative factors. It also reviews the rebuttable presumption of more than 90 days past due for each portfolio.

Cibest Corporate Group applies the following criteria to determine whether default has occurred:

Quantitative criteria

•Clients with active credit exposure who have at least one charged-off instrument within the modality.

•Clients with obligations that are 90 days or more past due.

Qualitative criteria

•Clients subject to special legal restructuring or reorganization agreements, or insolvency processes.

•Customers on the watchlist with a high‑risk profile, according to the policies defined by the Special Customer Management Committee (“AEC” by its initials in Spanish).

•Cibest Corporate Group also aligns all products within the same modality to stage 3 when any of the client’s obligations is considered in default.

Rebuttable presumption of more than 90 Days Past Due

Cibest Corporate Group has reviewed the 90 day past due default presumption for each portfolio. Historical evidence supports a high likelihood of loss at 90 days past due. However, this presumption has been rebutted for Banistmo’s mortgage portfolio. Historical evidence demonstrates that default generally occurs at approximately 120 days past due.

Measurement of expected credit losses (ECL) under the collective methodology

The collective quantification of expected credit losses is conducted based on the stage classification, the homogeneous groups defined within each portfolio type and the client’s risk level.

Homogeneous groups are segmented by client type; for individuals, they are grouped by product, and for companies, they are grouped by industry segments defined based on the company’s revenue level.

F-24

Table of Contents

In addition, credit risk management is supported by robust rating and scoring systems. The primary objective of these systems is to determine each client's risk profile, which is assigned through a credit rating or scoring. For retail portfolios, credit scoring are based on both origination and behavioral scoring models. These models incorporate personal and financial information, historical behavior, transaction activity, the total number of credit products held, and external credit bureau data.

Corporate portfolios are rated using a comprehensive model that integrates quantitative variables and objective criteria to assess the level of risk associated with each client's financial commitments. This rating model is applied from the initial origination of the credit and is updated periodically to ensure a timely and dynamic assessment of the client's credit profile throughout the entire debt cycle. The model considers key determinants of credit risk, including the client’s financial performance and repayment capacity, payment behavior with both Group entities and the broader financial system, and transaction data available within Cibest Corporate Group. Additionally, sector information and complementary variables are included to enhance the assessment. This approach provides a comprehensive and up-to-date view of risk, strengthening decision-making and proactive portfolio management.

In Colombia, for SME and corporate portfolio, the risk level is estimated using models that assign an internal rating considering the client’s economic sector and multiple variables, including financial, transactional, sector specific, qualitative, and behavioral information. These models aim to achieve greater accuracy in classifying customer risk levels, improve discrimination and precision, incorporate non-traditional information, and enhance interpretability, ultimately enabling a deeper understanding of the client. These methodologies play a fundamental role in assessing and monitoring credit risk.

To estimate expected credit losses (“ECL”) under the collective methodology, the following formula is used:

Expected Credit Loss (ECL) = Exposure at Default (EAD)* Probability of Default (PD) * Loss Given Default (LGD)

The components are estimated using statistical models developed from the entity’s internal historical information and subsequently adjusted with forward looking information as described below:

•Probability of Default (“PD”): estimated probability of occurrence that a financial instrument will default. IFRS 9 requires parameter specification and differentiated application across stages 1, 2 and 3.

◦12 months PD: the estimated probability of occurrence of default within the next 12 months from the assessment date. Cibest Corporate Group applies it to exposures with no significant increase in credit risk and no evidence of impairment (stage 1). The 12-month PD is estimated using traditional techniques such as logistic regression, modelling portfolio behavior by risk level for each segment.

◦Lifetime PD: the estimated probability of default occurring over the remaining life of the instrument, depending on product characteristics and risk level. Cibest Corporate Group applies it to exposures with a significant increase in credit risk (stage 2). It is estimated using survival models that quantify portfolio survival rates over defined horizons and incorporate prepayment models.

◦Stage 3 PD: exposures evaluated under the collective methodology and classified in stage 3 are assigned a probability of default of 100%.

•Loss Given Default (“LGD”): the severity of Loss Given Default is the percentage of exposure that the entity ultimately expects to be lost in the event of default. The general formulation is: LGD = 1 – recovery rate. The recovery rate corresponds to the sum of cash flows received from the operation, discounted at the customer’s rate at the assessment date, over the exposure at default. It includes asset sales and other recovery strategies.

For secured products, recoveries are primarily classified by collateral type and incorporate discounted projected

sale value minus acquisition, maintenance, and disposal costs, as well as appraisals to determine value and recovery timing.

•Exposure at Default (“EAD”): for amortizing products, exposure includes principal, interest and receivables, net of expected contractual repayments over a 12-month or lifetime horizon.

For revolving products with available undrawn limits, EAD incorporates the Credit Conversion Factor (CCF) to estimate the utilized and unused portions expected to convert into outstanding balance. For loan commitments, the ECL includes the probability of becoming on-balance-sheet-exposure.

F-25

Table of Contents

To estimate lifetime expected credit losses, the exposure is projected annually, considering discounted contractual cash flows for each year. Discounting is performed using the effective interest rate or an appropriate approximation.

Incorporation of forward-looking information into the expected credit loss (ECL) models

To incorporate forward looking information into the components used to estimate expected credit losses (ECL), Cibest Corporate Group applies methodologies that correlate the historical performance of the portfolio with specific economic variables. Cibest Corporate Group has developed projections under three macroeconomic scenarios (base, pessimistic and optimistic), each assigned a probability of occurrence, to determine the best estimate of expected losses under potential future economic conditions.

To prepare these projections, the Economic Research team relies on a dual perspective forecasting process: thematic and analytical.

•Thematic Perspective: this perspective identifies external variables whose values are determined globally and are not influenced by country-specific dynamics. As they fall outside the scope of the Corporate Economic Research team, these variables are based on estimates developed by external analysts.

•Analytical Perspective: this perspective involves collecting historical information for the most relevant economic and financial variables of each country. Data sources include official authorities such as banking supervisors, national statistical agencies, and central banks. Forecasts are generated using time series econometric models widely applied in macroeconomic analysis.

As a result, monthly projections are obtained for the economic variables of interest over a horizon covering the current year and four additional years. After this period, due to uncertainty and technical limitations, the projected value at the end of the horizon is used for the remaining life of the instrument.

Cibest Corporate Group considers a five-year projection horizon appropriate, as it remains a reasonable practice for ECL estimation. It also deems it appropriate to use the fifth-year projection as a reference value for later periods, as this provides the most consistent approximation based on available information. This approach is based on the natural tendency of economic time series to revert to long term trends, equilibrium levels, or the mean. Once macroeconomic projections reach such a steady state, stability is expected unless an unforeseen shock occurs.

It is considered reasonable to assume that over a five-year horizon, macroeconomic projections will converge toward their equilibrium level, since historically the maximum periods of consecutive deviation above or below the long-term trend (approximately ±0.25 standard deviations of the variable), based on annual GDP growth data from 1972–2025, have lasted precisely five years.

Weighting of macroeconomic scenarios

To incorporate the inherent uncertainty of macroeconomic forecasting, Cibest Corporate Group uses three macroeconomic scenarios: base, optimistic, and pessimistic.

These scenarios reflect reasonable, non-extreme expectations. The current weighting applied to the macroeconomic forecasts at year-end is as follows:

	Optimistic		Base		Pessimistic
Country	2025	2024	2025	2024	2025	2024
Colombia	15.00 %	15.00 %	60.00 %	60.00 %	25.00 %	25.00 %
Panama	20.00 %	20.00 %	55.00 %	55.00 %	25.00 %	25.00 %
El Salvador	20.00 %	20.00 %	55.00 %	55.00 %	25.00 %	25.00 %
Guatemala	20.00 %	20.00 %	55.00 %	55.00 %	25.00 %	25.00 %

F-26

Table of Contents

The following presents a comparison of the key projected macroeconomic variable in each country, “GDP Growth,” used to estimate ECL as of December 31, 2025 and 2024:

As of December 31, 2025
	Colombia				Panama
Cutoff	Optimistic	Base	Pessimistic		Optimistic	Base	Pessimistic
2025	3.07 %	2.86 %	2.65 %		4.85 %	4.14 %	3.43 %
2026	4.57 %	3.23 %	1.89	%	6.19 %	3.97 %	1.75 %
2027	4.68 %	2.88 %	1.08 %		6.81 %	4.04 %	1.26 %		As of December 31, 2025
---	---	---	---	---	---	---
	Guatemala			El Salvador
Cutoff	Optimistic	Base	Pessimistic	Optimistic	Base	Pessimistic
2025	4.15 %	3.79 %	3.44 %	3.30 %	2.80 %	2.29 %
2026	4.49 %	3.48 %	2.47 %	3.90 %	2.49 %	1.08 %
2027	4.58 %	3.38 %	2.18 %	4.07 %	2.39 %	0.72 %		As of December 31, 2024
---	---	---	---	---	---	---	---
	Colombia				Panama
Cutoff	Optimistic	Base	Pessimistic		Optimistic	Base	Pessimistic
2024	1.98 %	1.80 %	1.59 %		3.51 %	2.46 %	1.41 %
2025	3.89 %	2.57 %	1.23	%	6.04 %	3.48 %	0.92 %
2026	4.76 %	2.96 %	1.16 %		6.68 %	3.76 %	0.85 %		As of December 31, 2024
---	---	---	---	---	---	---	---
	Guatemala			El Salvador
Cutoff	Optimistic	Base	Pessimistic	Optimistic	Base	Pessimistic
2024	3.83 %	3.48 %	3.12 %	3.10 %	2.59 %	2.09 %
2025	4.46 %	3.46 %	2.45 %	3.77 %	2.36 %	0.95	%
2026	4.55 %	3.35 %	2.14 %	3.93 %	2.25 %	0.58	%

Special methodologies applied in stage 3

Collateral based methodology

For defaulted loans (classified in stage 3) where the primary source of repayment is determined to be real estate collateral or an asset under a leasing arrangement, the loss estimate is calculated as the outstanding balance minus the probability weighted net present value of the collateral’s market value. The valuation is based on appraisals not older than one year, net of acquisition, maintenance and disposal costs, and adjusted for multiple macroeconomic scenarios weighted by their respective probabilities of occurrence.

Individual NPV assessment methodology

Cibest Corporate Group individually assesses defaulted (stage 3) exposures exceeding COP 20,000 or USD 5 million in foreign subsidiaries, analyzing each debtor’s debt profile, collateral provided, financial information, and both client specific and sector specific credit behaviour. Significant financial assets are considered to be in default when, based on current or past events and available information, it is unlikely that the entity will recover all amounts due under the original contractual terms, including interest and fees. When a significant financial asset has been identified as defaulted, the loss amount is measured as the outstanding balance minus the probability weighted net present value of expected future cash flows, assessed under at least two macroeconomic scenarios with assigned probabilities of occurrence.

Clients assessed under an individual net present value (“NPV”) approach are evaluated at least twice per year and, additionally, whenever a relevant event occurs that materially affects their risk profile and requires updating the previously analyzed scenarios. Relevant events may include:

•Significant changes in collateral value,

F-27

Table of Contents

•Adverse or emerging changes in the client’s business,

•Regulatory changes with potential impact on the borrower,

•Changes affecting the borrower’s commercial or operational dynamics, and

•Significant payments made by the client.

To determine expected future cash flows for the client, two approaches may be applied: a cash flow generation approach or an asset recovery approach involving enforcement or liquidation of collateral. that is, “Going Concern” or “Gone Concern” approach.

Cash-flow-based approach: This refers to an analysis under the “Going-Concern” assumption; that is, repayment of the obligation is expected to occur through the client’s ongoing cash flows. The calculation of the expected NPV under the cash-flow-based approach includes:

•Client financial projections.

•Debt simulation.

•Expected NPV calculation.

Collateral-recovery approach: This refers to collateral liquidation or "Gone concern” that is, repayment of the obligation is expected to occur through the realization of collateral, liquidation of assets, enforcement of personal guarantees, or adjudication through judicial processes. The NPV calculation under the collateral approach must include:

•Collateral analysis.

•Projected future collateral value.

•NPV calculation.

•Recovery time estimates.

Future cash flows are estimated under two scenarios (base and alternative), which may be affected by the variables described above.

4.1.2.2. Impairment of investments measured at amortized cost or at fair value through other comprehensive income (FVOCI)

At the end of each period, Cibest Corporate Group evaluates the impairment model based on the expected loss of a financial asset or a group of assets that are measured at amortized cost or at fair value with changes in other comprehensive income, where the impairment loss is measured from "day 1" after initial recognition.

Investments are classified into stages according to the risk level (rating), as follows:

Stage 1:

•Investments rated at investment grade.

•Investments rated at speculative grade, if:

◦The current external rating is maintained or improved compared with the rating at the acquisition date.

◦If there is a rating deterioration, the deterioration is lower than the number of notches that signify a significant increase in risk.

Stage 2:

•Investments migrating from investment grade to speculative grade.

•When the rating is downgraded beyond the thresholds notches that signify a significant increase in risk.

Stage 3:

•Investments classified as being in default.

Significant increase in risk

Investments classified in stage 2 include those instruments meeting Cibest Corporate Group’s definition of a significant increase in risk.

F-28

Table of Contents

To determine whether a security has experienced a significant increase in risk since initial recognition, the deterioration of its current rating relative to its purchase date rating is evaluated. Depending on the initial rating, a significant increase may correspond to a downgrade of 1, 2, or 3 notches, as shown below:

EXTERNAL RATING ORIGIN	SIGNIFICANT INCREASE<br>IN RISK
Ba1/BB+	3 Notches
Ba2/BB	3 Notches
Ba3/BB-	3 Notches
B1/B+	2 Notches
B2/B	2 Notches
B3/B-	1 Notch
Caa/CCC	1 Notch

Measurement of expected losses:

Impairment: [Amortized Cost or Market Position (Exposure)] * PD (Probability of default) * LGD (Loss given default)

•Instruments classified in stage 1 are assigned a 12-month probability of default.

•Instruments classified in stage 2 are assigned a lifetime probability of default.

•Instruments classified in stage 3 are assigned a probability of default of 100.00%.

To estimate the impairment of the instruments if the issue has an external rating, the PD (Probability of default) from the international rating agency is applied; if no external rating exists, the internal rating model and portfolio PD are used.

In all cases, the LGD (Loss Given Default) is based on the parameter published by the external rating agency for the investment portfolio, which corresponds to 51.60% as of December 2025.

4.1.3.      Derecognition of financial assets

4.1.3.1.   Derecognition of financial assets not resulting from modifications

Financial assets are derecognized when the rights to receive cash flows from the financial assets have expired or have been transferred, and Cibest Corporate Group has transferred substantially all the risks and rewards of ownership, or when Cibest Corporate Group neither transfers nor retains substantially all of the risks and rewards of ownership but it does not retain control of the financial asset.

When Cibest Corporate Group retains the contractual rights to receive cash flows from the financial asset, but assumes a contractual obligation to pay those cash flows to other entities, it shall treat the transaction as a transfer that results in derecognition if:

•It has no obligation to pay any amounts to the other entities unless it collects equivalent amounts from the assets;

•It is prohibited from selling or pledging the assets; and

•It has an obligation to remit without material delay any cash flows it receives from the assets.

4.1.3.2.   Modifications

In modifications for commercial or market reasons, an assessment is made as to whether the modification is substantial; that is, whether the changes in the terms of the contract differ substantially from the original contract, based on the analysis of qualitative variables (inclusion of returns based on profit sharing, guarantees, other collateral, or credit enhancements that significantly affect the credit risk profile associated with the loan, changes in currency and/or obligor) and, in some cases, a quantitative assessment. When the modifications result in derecognition, the renegotiated contract is a new loan, subject to the classification and measurement requirements established by IFRS 9.

Similarly, the costs and commissions associated with the financial asset are derecognized. Modifications that do not result in derecognition are understood as non-substantial modifications, the carrying amount will be recalculated as the present

F-29

Table of Contents

value of the modified contractual cash flows discounted at the original interest rate, recognizing the effect of the modification in the margin net interest in the Statement Consolidated of Income. Likewise, costs and commissions are adjusted and amortized over the remaining life of the modified asset.

Contractual modifications of financial assets may be carried out due to restructurings and/or renegotiations for credit risk due to the borrower's financial difficulties are evaluated as a non-substantial modification and therefore does not lead to derecognition. When a financial asset is restructured, the difference between the original contractual cash flow and the new cash flow of the restructured asset discounted at the original effective interest rate is recognized as a gain or loss in the Statement Consolidated of Income as “Interest income on loan and financial leases”, the costs and fees are deferred and will be amortized by the remaining life of the modified asset.

4.1.3.3.        Written-Off loan portfolio

Loans are written off when Cibest Corporate Group concludes there is no realistic expectation of recovery of the loans and receivables balances from a client or third party, i.e., there is no possibility of recovery due to the debtor's lack of ability or willingness to pay or in the absence of open guarantees granted by the debtor. In general, this characteristic will be fulfilled when the following delinquency conditions are present:

		Length of delinquency (days)
Type	Collateral	Grupo Agromercantil Holding S.A.	Banistmo S.A.	Banco Agrícola S.A.	Bancolombia S.A.
	Without collateral			180
Commercial	With collateral	N/A(1)	360	360	360
	Without collateral	180	180	180	180
Consumer	With collateral	540 for vehicles collateral	1080 for mortgage collateral	720 for mortgage collateral
	Without collateral		180
Small Business Loan	With collateral	N/A(1)	1080 for mortgage collateral	180	180
Mortgage	With collateral	1440	1080	720	N/A(1)

(1)Not dependent on the length of delinquency but on the reasons underlying a loan's non-recoverability.

Among the reasons underlying a loan's non-recoverability are the estimated recovery time of the obligation, the probable recovery percentage given the existence or lack of collateral and the inability to locate the client. When default conditions are present, it is initially necessary to evaluate whether the collateral that supports the loan generates a reasonable expectation of recovery; if so, the necessary steps are taken to realize on the collateral prior to writing-off the loan. In cases where the collateral net fair value indicates that there are no reasonable expectations of recovery, loans are written-off in the Consolidated Financial Statements.

4.2.        Financial liabilities

At initial recognition, Cibest Corporate Group measures its financial liabilities at fair value. The transaction costs that are directly attributable to the financial liability are deducted from its fair value if the instruments are subsequently recognized at amortized cost or will be recognized in the Consolidated Statement of Income if the liabilities are measured at fair value.

4.2.1.     Classification and Measurement of Financial Liabilities

Financial liabilities are classified and subsequently measured as follows:

•Amortized cost, measured at cost using the effective interest rate method.

•Fair value through profit or loss (“FVTPL”), measured using fair value, with variations in value recognized in the income statement.

•Irrevocably designated at fair value through profit or loss, measured using fair value, with variations in value recognized in the income statement. The effect of changes in own credit risk is presented in other comprehensive income.

F-30

Table of Contents

4.2.2.     Derecognition of Financial Liabilities

Cibest Corporate Group derecognizes a financial liability from the Consolidated Statement of Financial Position when it is extinguished; that is, when the contractual obligation has been paid or settled or has expired.

Debt Exchange

Cibest Corporate Group assesses whether instruments subject to debt exchange are substantially different from each other, considering qualitative aspects such as currencies, maturities, interest rates, subordination terms, regulatory framework, among others, and quantitative aspects, in which the present value of discounted cash flows under the conditions of the new instruments (including any net commission paid minus any commission received) using the original effective interest rate to calculate the discount differs by at least 10 percent from the present value of discounted cash flows remaining from the original financial liability.

When it is concluded that the instruments subject to debt exchange are not substantially different (based on the analysis of qualitative variables such as currency or issuance market changes, and in some cases a quantitative evaluation), the transaction is recognized as a modification of debt, and in this case, the amortized cost of the modified liability is adjusted to the present value of estimated contractual cash flows discounted at the original effective interest rate of the financial instrument, and the gain or loss is recognized immediately in the income statement. Incremental costs and commissions adjust the carrying amount of the liability and are amortized over the remaining life of the modified liability, following its subsequent measurement at amortized cost. In debt exchanges that are considered substantially different, derecognition is recognized in the income statement, and a new financial liability is recognized.

4.3.   Day one profit adjustment

In situations where the fair value of a financial asset acquired or financial liability assumed at initial recognition differs from the transaction price, Cibest Corporate Group shall recognize a gain or loss directly in the Consolidated Statement of Income if the fair value is supported by Level 1 inputs or is based on a valuation technique that uses only observable market data. In all other circumstances, Cibest Corporate Group defers the Day one gain or loss and recognizes it in the Consolidated Statement of Income over the course of the transaction period.

4.4.   Compound instruments

Cibest Corporate Group recognizes compound financial instruments that contain both liability and equity components separately. Therefore, for initial measurement, the liability component is the fair value of a similar liability which doesn´t have an equity component (determined by discounting future cash flows using the market rate at the date of the issuance). The difference between the fair value of the liability component and the fair value of the compound financial instrument, considered as a whole, is the residual value assigned to the equity component. After initial recognition, the liability component of a compound financial instrument is measured at amortized cost using the effective interest method. The equity component of a compound financial instrument is not re-measured subsequent to initial recognition. The liability component corresponds to the preferred dividend related to 1% of the subscription price, which is the payment of the minimum dividend on the Preferred Shares for each period. For further information, see Note 22. Share capital.

4.5.   Financial guarantee contracts and loan commitments

Cibest Corporate Group issues financial guarantees and loan commitments. Loan commitments are those agreements under which Cibest Corporate Group has an irrevocable obligation to grant the loan. The financial guarantee contracts issued by Cibest Corporate Group are contracts that require the issuer to make specified payments to reimburse the holder for a loss it incurs because a specified debtor fails to make payment when due to accordance with the original or modified terms of a debt instrument.

Both financial guarantee contracts and loan commitments are initially recognized as liabilities at fair value, which is normally the fee received, adjusted for the directly attributable transaction costs incurred. Subsequently, liabilities are measured at the higher of the provision amount measured according to IFRS 9, and the amount initially recognized, less the accumulated amortization recognized according to IFRS 15 Revenue from contracts with customers.

Income derived from guarantees is recognized as “commission income” in the Consolidated Statement of Income over the term of the contract, in accordance with the method and frequency of commission’s payments.

F-31

Table of Contents

4.6.   Derivatives financial instruments

A financial derivative is an instrument whose value changes in response to changes in a variable or index, such as an interest rate, exchange rate, the price of a financial instrument, a credit rating or a credit index. This instrument requires no initial payment or is lower in comparison to other financial instruments with a similar response to changes in market conditions and is generally settled at a future date.

Cibest Corporate Group recognizes its derivative financial instruments at fair value, based on the prices and valuation methodologies provided by the official pricing service provider (Precia); this includes counterparty credit-risk adjustments applied to derivatives when Cibest Corporate Group's position is a derivative asset, and Cibest Corporate Group's credit risk when the position is a liability on a derivative. For further information, see Note 30. Fair value of assets and liabilities, section d. Credit valuation adjustment.

Derivatives are recognized and measured at fair value through profit or loss unless such derivatives are designated as cash flow hedges or hedges of a net investment in a foreign operation. In those cases, the effective portion of changes in the fair value of the derivatives are recognized in other comprehensive income. All derivatives are carried as assets when fair value is positive and as liabilities when fair value is negative. Gains and losses arising from changes in the fair value of derivatives, which are not in hedging relationships, are recognized in the Consolidated Statement of Income under the "valuation on financial instruments" item, and gains and losses from the valuation of foreign exchange derivatives are included in the "Other Operating Income" item.

4.7.   Hedge accounting

Cibest Corporate Group designates and documents hedge accounting at inception in accordance with the requirements of IFRS 9 Financial Instruments. When the hedging relationship is considered to be highly effective, the changes in value of the hedging derivative are accounted for according to their classification, as fair value hedges, cash flow hedges and hedges of net investment in foreign operations, as set out in the paragraph below.

Cibest Corporate Group assesses at the inception of the hedge and on an ongoing basis during the life of the instrument, whether the hedge used in the transaction is expected to be aligned with the hedge effectiveness requirement (prospective effectiveness):

•Economic relationship between the hedging instrument and the hedged item.

•The effect of credit risk does not predominate over the value of the economic relationship.

•Designated hedge ratio is consistent with risk management strategy.

Cibest Corporate Group discontinues the hedge accounting when the hedging relationship no longer meets the criteria provided for hedge effectiveness or when the hedging instrument expires or is sold, terminated or exercised. Consequently, the item no longer complies with the hedge accounting conditions or the hedging relationship no longer complies with the risk management objective.

Before the establishment of hedge accounting, Cibest Corporate Group documents the relationship between hedged items and hedging instruments, as well as its risk management objectives and hedging strategies, which are approved by the Asset and Liability Management Committee.

Hedge relationships are classified and accounted for in the following ways:

Fair value hedges

Fair value hedges are designated to protect against the exposure to changes in the fair value of recognized assets or liabilities or unrecognized firm commitments.

Changes in the fair value of derivatives that are designated and qualify as hedging instruments in fair value hedges are recorded in the same line item of the Consolidated Statement of Income as hedged item. The change in fair value of the hedged item that is attributable to the hedged risk is recorded as part of the carrying value of the hedged item, and it is also recognized in the same line item of the Consolidated Statement of Income as the hedge item.

For fair value hedges of items carried at amortized cost, adjustments to the carrying value are amortized to the Consolidated Statement of Income over the remaining life of the hedge item until maturity. Amortization is based on a recalculated effective interest rate at the beginning of the amortization period, which begins when the hedged item ceases

F-32

Table of Contents

to be adjusted for changes in its fair value attributable to the risk being hedged. The adjustment shall be amortized fully by maturity of the financial instrument or, in the case of a portfolio hedge of interest rate risk, by expiry of the relevant repricing period.

If the hedged item is derecognized, the non-amortized fair value is recognized immediately in the Consolidated Statement of Income.

When an unrecognized firm commitment is designated as a hedged item, the subsequent cumulative change in the fair value of the firm commitment attributable to the hedged risk is recognized as an asset or liability with corresponding gain or loss recognized in net income.

Cash flow hedges

Cash flows hedges are used mainly to manage the exposure to variability related to the cash flow attributable to a specific risk associated with an asset or liability recognized on the Consolidated Statement of Financial Position or to a highly probable forecast transaction.

The portion of the gain or loss on the hedging instrument that is determined to be an effective hedge is recognized in other comprehensive income. The ineffective portion of the gain or loss on the hedging instrument is recognized in the Consolidated Statement of Income as interest and valuation on financial instruments.

If the hedging instrument expires or is sold, terminated or exercised, without replacement or rollover into another hedging instrument, or if the hedging designation no longer meets the criteria provided for the hedge effectiveness requirements after any subsequent rebalancing adjustment, any accumulated gain or loss previously recognized in OCI remains in OCI, until the planned operation or the firm commitment affects the result.

When a forecasted transaction is no longer expected to occur, the gain or loss accumulated in equity is recognized immediately in net income.

Hedges of a net investment in a foreign operation

In accordance with the application of IFRS 9 and IFRIC 16 – Hedges of a Net Investment in a Foreign Operation, Cibest Corporate Group has elected to hedge the foreign exchange risk arising from the translation of activities conducted in a country or currency other than that of the reporting entity.

The accounting for these hedges requires that the effective portion of foreign exchange gains or losses arising from instruments designated as hedging instruments be recognized in the same line item of the statement of profit or loss or other comprehensive income (OCI). This accounting treatment is consistent with the requirements of IAS 21 – The Effects of Changes in Foreign Exchange Rates, and aligns with the disclosure provided in Section 1. Functional currency, translation of balances and foreign currency transactions.

Upon the disposal of a foreign operation, or upon the settlement of an instrument that forms part of the net investment, the foreign exchange differences previously accumulated in OCI are reclassified to profit or loss for the period as part of the gain or loss on such disposal. For additional information related to the accounting for hedges of net investments in foreign operations, refer to Note 5.3 – Hedge accounting.

5.      Investments in associates and joint arrangements

5.1.   Investments in associates and joint ventures

An associate is an entity over which Cibest Corporate Group has significant influence. Significant influence is the power to participate in the financial and operating policy decisions of the investee but does not have control or joint control to make those policies decisions.

A joint venture is an entity that Cibest Corporate Group controls jointly with other participants, where the parties maintain a contractual agreement that establishes joint control over the relevant activities of the entity (which only exists when decisions about those activities require unanimous consent of the parties sharing control) and the parties have rights to the net assets of the joint arrangement.

F-33

Table of Contents

Cibest Corporate Group's investments in associates and joint ventures are initially recorded at cost and their results, assets and liabilities are subsequently included in the Consolidated Financial Statements using the equity method, except when the investment, or a portion thereof, is classified as held for sale, in which case it is accounted for in accordance with IFRS 5 Non-current assets held for sale and discontinued operations.

When an investment in an associate or joint venture is held by, or is held indirectly through, an entity that is a venture capital organization, or a mutual fund, unit trust or similar entities, and such investment is measured at fair value through profit or loss in that entity, Cibest Corporate Group may elect to measure investments in those associates and joint ventures at fair value through profit or loss in the Consolidated Financial Statements. This election is applied on an investment-by-investment basis.

At the acquisition date, the excess of the acquisition cost of the associate or joint venture shares exceeding Cibest Corporate Group's share of the net fair value of identifiable assets and liabilities of the investee is recognized as goodwill and is included in the carrying amount of the investment and it is not amortized. Any excess of Cibest Corporate Group's share of the net fair value of the investee’s identifiable assets and liabilities over the cost of the investment is included as income in the determination of Cibest Corporate Group's share of the associate or joint venture’s profit or loss in the period in which the investment is acquired. When necessary, the entire carrying amount of the investment (including goodwill) is tested for impairment in accordance with IAS 36 Impairment of assets. Impairment losses are recognized in accordance with the policy for impairment of assets, cash-generating units and goodwill (see section 12. Impairment of assets, cash-generating units and goodwill, of this note).

If Cibest Corporate Group's share of losses of an associate or joint venture exceeds Cibest Corporate Group's interest in that associate or joint venture (which includes any long-term interests that, in substance, form part of Cibest Corporate Group's net investment in the associate or joint venture), Cibest Corporate Group discontinues recognition its share of further losses. Additional, losses are recognized only to the extent that Cibest Corporate Group has incurred legal or constructive obligations or made payments on behalf of the associate or joint venture.

When the equity method is applicable, adjustments are considered in order to adopt uniform accounting policies of the associate or joint venture with Cibest Corporate Group. The portion that corresponds to Cibest Corporate Group for changes in the investee´s other comprehensive income items is recognized in the Consolidated Statement of Comprehensive Income as “Unrealized gain/loss on investments in associates and joint ventures using equity method” and gains or losses of the associate or joint venture are recognized in the Consolidated Statement of Income as “Dividends and net income on equity investments”, in accordance with Cibest Corporate Group's participation. Gains and losses resulting from transactions between Cibest Corporate Group and its associate or joint venture are recognized in Cibest Corporate Group's Consolidated Financial Statements only to the extent of the unrelated investor´s interest in the associate or joint venture. The equity method is applied from the acquisition date until the significant influence or joint control over the entity is lost. When the significant influence on the associate or the joint venture is lost, Cibest Corporate Group measures and recognizes any residual investment that remains at its fair value. The difference between the associate or joint venture carrying value (taking into account the relevant items of other comprehensive income), the fair value of the retained residual investment and any proceeds from disposing of a partial interest in the associate or joint venture, is recognized in the Consolidated Statement of Income. The currency translation adjustments recognized in equity are reclassified to net income at the moment of disposal.

The unrealized gain or loss of an associate or joint venture is presented in the Consolidated Statement of Comprehensive Income, net of tax. Changes in the investment´s participation that arise from changes in other comprehensive income of an associate or joint venture are recognized directly in the investor’s Statement of Comprehensive Income.

The dividends received from the associate or joint venture reduce the investment carrying value.

For further information, please see Note 8. Investments in associates and joint ventures.

5.2.  Joint operations

A joint operation is a joint arrangement whereby the parties that have joint control of the arrangement have rights to the assets, and obligations for the liabilities, relating to the arrangement.

Cibest Corporate Group recognizes and measures assets, liabilities, revenues, and expenses in relation to its interest in joint operations in accordance with the applicable IFRS for the particular assets, liabilities, revenues and expenses.

F-34

Table of Contents

When Cibest Corporate Group acquires an interest in a joint operation in which the activity constitutes a business, as defined in IFRS 3, or when an existing business is contributed to the joint operation on its formation by one of the parties that participate in the joint operation, Cibest Corporate Group will apply all of the principles of IFRS 3. In this case, Cibest Corporate Group recognizes goodwill in the event that consideration transferred exceeds the net of the acquisition date amounts of the identifiable assets acquired and the liabilities assumed.

When Cibest Corporate Group transacts with a joint operation in which the Parent Company or its subsidiaries is a joint operator (such as a sale or contribution of assets), Cibest Corporate Group is considered to be conducting the transaction with the other parties to the joint operation, and gains and losses resulting from the transactions are recognized in Cibest Corporate Group's Consolidated Financial Statements only to the extent of other parties’ interests in the joint operation.

6.     Leases

6.1.  Cibest Corporate Group as lessee

Cibest Corporate Group assesses whether a contract is or contains a lease at the inception of the contract and recognizes a right-of-use asset representing its right to use the leased asset and a lease liability representing its obligation to make lease payments. Cibest Corporate Group elected to apply the recognition exemptions for short-term leases (leases of 12 months or less and without a purchase option) and leases where the underlying asset is of low value. Lease payments related to these exemptions will be recognized as an expense in profit or loss on a straight-line basis over the term of the lease.

Both the right-of-use asset and the lease liability are measured at the present value of the lease payments that have not been paid at that date. Lease payments are discounted using the lessee’s incremental borrowing rate. In addition, the right-of-use asset includes: 1) the amount of the initial measurement of the lease liability, 2) lease payments or costs incurred by the lessee made before or after the commencement date, less lease incentives received, and 3) an estimate of the costs to be incurred to dismantle the underlying asset, restore the site on which it is located or restore the underlying asset to the condition required by the lease.

Subsequently, Cibest Corporate Group measures the right-of-use asset at cost less any accumulated depreciation and any accumulated impairment losses and adjusted for any remeasurement of the lease liability. Cibest Corporate Group measures the lease liability by increasing the carrying amount to reflect interest on the lease liability, reducing the carrying amount to reflect the lease payments made, and remeasuring the carrying amount to reflect any new expectation or lease modifications. Each lease payment has been allocated between the liability and interest expenses. The accrued interest on the lease liability for each period over the lease term will be the amount that produces a constant periodic rate of interest (incremental borrowing rate) on the remaining balance of the liability.

6.2.  Cibest Corporate Group as lessor

The lease agreements entered into by Cibest Corporate Group are classified at the initial recognition as financial or operating leases.

A lease is classified as a finance lease when substantially all the risks and rewards incidental to ownership of the asset are transferred to the lessee and are recognized at a value equal to the net investment in the lease, corresponding to the sum of the minimum lease payments receivable and any unguaranteed residual value, discounted at the interest rate implicit in the lease. Otherwise, it is classified as an operating lease, recognizing and measuring the assets under the principles of property and equipment or investment property, in which case income and depreciation of property and equipment are recognized on a straight-line basis over the life of the asset. Contingent lease payments are recognized as revenue in the period in which they are received.

If during the lease term, the lessor and the lessee decide to modify the initial conditions, and the agreed changes result in a different classification, then the modified agreement will be considered a new lease with new clauses that will lead to the classification of a financial or operating lease, as appropriate.

Cibest Corporate Group uses the following indicia of transfer of risk and rewards incidental to ownership to the asset; if one of them is met, lease is classified as a finance lease:

•The agreement indicates that the lessee has the option to purchase the asset at a price that is expected to be equal to or less than 10% of the fair value of the asset, upon termination of the lease.

F-35

Table of Contents

•The term of the lease covers most of the economic life of the asset, even when the lease does not transfer the ownership of the underlying asset to the lessee at the end of the lease term, i.e., when the minimum lease term represents 75% or more of the economic life of the leased asset.

•At the inception of the lease, the present value of the minimum lease payments amounts to at least 90% of the fair value of the leased asset.

•The leased assets are of such a specialized nature that only the lessee has the possibility of using them without making significant modifications.

7.     Premises and equipment and depreciation

Premises and equipment include tangible items that are held for use, for rental to others, or for administrative purposes and are expected to be used for more than one period.

Items of premises and equipment are expressed at cost less accumulated depreciation and impairment losses. Depreciation is calculated using the straight-line method, in order to derecognize the depreciable amount of premises and equipment over the estimated useful lives of the assets. The depreciable amount is the cost of an asset less its residual value.

The estimated useful lives for each asset group are:

Asset group	Useful life range
Buildings	10 to 75 years
Furniture and fixtures	3 to 20 years
Computer equipment	3 to 20 years
Equipment and machinery	2 to 40 years
Vehicles	3 to 10 years

The asset’s residual values and useful lives are reviewed, and adjusted if appropriate, at the end of each reporting period. When there is a significant change, the depreciation and the charge to the Consolidated Statement of Income are adjusted based on the new estimation.

Cibest Corporate Group assesses at the end of each year whether there is any indication of external or internal reduction in the asset’s recoverable value. If there is any indication of impairment, Cibest Corporate Group estimates the recoverable amount of the assets and then recognizes the impairment loss in the Consolidated Statement of Income. For further information, see section 12. Impairment of nonfinancial assets, cash-generating units and goodwill in this note.

Maintenance expenses of the premises and equipment are recognized as an expense in the period in which they are incurred and are registered in the Consolidated Statement of Income as “Other administrative and general expenses”.

Gains and losses in sales of premises and equipment are registered in the Consolidated Statement of Income as “Other operating income”.

8.     Investment properties

The investment properties are measured initially at cost, including the transaction costs. The carrying value includes the cost of replacement or substitution of a part of an investment property at the time the cost is incurred, if the cost meets the recognition criteria; and it excludes the daily maintenance costs of the investment property which are included in the Consolidated Statement of Income as “Other administrative and general expenses”.

After the initial recognition, the investment properties are measured at fair value which reflects the market conditions at the Consolidated Statement of Financial Position date and are valued by Management with the support of external experts using valuation techniques based on comparable prices, direct capitalization, discounted cash flows and replacement cost. The gains and losses that arise from changes in the fair values of investment properties are included in the Consolidated Statement of Income as “Other operating income”.

Transfers of an asset to or from the investment properties are only made when there is a change in its use. For a transfer from an investment property to premises and equipment, the cost taken into account for its subsequent accounting is the fair value at the time of the change in use. If a premise and equipment becomes an investment property, it will be accounted for at its fair value.

F-36

Table of Contents

9.     Intangible assets

Intangible assets are identifiable, non-monetary assets without physical appearance, separately acquired or internally generated by Cibest Corporate Group that are measured initially at cost and subsequently at cost less any accumulated amortization and any accumulated impairment loss. Intangible assets acquired in business combinations are recognized at fair value at the date of acquisition.

Intangible assets with finite useful lives (ranging from 1 to 10 years) are amortized using the straight-line method over their estimated useful lives and assessed at the end of the period for impairment. The amortization period and the amortization method for intangible assets with a finite useful life are reviewed at least annually. The expected changes in the useful life or in the pattern of consumption of the future economic benefits of the asset are recognized when the amortization period or method has changed, as appropriate, and they are treated as changes in the accounting estimates. The amortization expense of intangible assets with finite useful lives is recognized in the Consolidated Statement of Income.

Cibest Corporate Group's intangible assets comprise mainly intangibles of finite useful life, such as licenses, software and computer applications, customer relationships and trademarks (See Note 12. Goodwill and intangible assets, net). Intangibles of indefinite useful life include Goodwill.

When intangible assets with finite useful life are written-off, the expected future economic benefits period is reduced to increase the amount of amortization, resulting in the derecognition of the intangible asset in a shorter period than initially estimated.

Intangible assets with indefinite useful lives are not subject to amortization but are periodically tested to identify any impairment, either individually or at the cash-generating unit level. The assessment of the indefinite life is reviewed annually to determine if it continues being supportable. In the event that the assessment was not valid, the change from indefinite useful life to finite useful life is recognized prospectively. Intangible assets with an indefinite useful life correspond to goodwill.

9.1. Internally generated intangible assets

The costs of internally generated intangible assets are recognized as intangible assets if they have been incurred in the development stage and meet the recognition criteria; if so, such assets are presented in the Consolidated Statement of Financial Position at cost less accumulated amortization and accumulated impairment losses (see section 12. Impairment of nonfinancial assets, cash-generating units and goodwill in this note). Other expenditures are recorded as expenses in the Consolidated Statement of Income.

Amortization of the asset begins when development is complete and the asset is available for use. Intangible assets are amortized using the straight-line method over their estimated useful lives and assessed at the end of the period for impairment.

10.  Inventories

Cibest Corporate Group recognizes as inventory the assets or returned property from finance or operating lease and real estate acquired or held in construction for sale in the ordinary course of business.

Assets or returned property from finance or operating lease

Inventories of assets or returned property are those assets arising from an early termination of a finance or operating lease or those on which the lease has been terminated, and they are expected to be sold in the normal course of business, which are controlled by Cibest Corporate Group and are expected to obtain future economic benefit.

The inventory of returned property is recognized as an asset from the date on which Cibest Corporate Group assumes the risks and benefits thereof. Assets arising from operating leases are initially measured at cost, which is the carrying amount less accumulated depreciation and impairment, if any. Assets returned property financial leasing operations are recognized at the lower of their book value plus sanitation costs and its net realizable value. When the book value is greater than the net realizable value, an adjustment is recognized under the caption "Provision for impairment of loan portfolio and financial leasing operations, net" in the Consolidated Income Statement.

Real estate acquired or in construction for sale

F-37

Table of Contents

Real estate acquired or in construction for sale in the ordinary course of Cibest Corporate Group’s business mainly include:

•Real estate units in construction: refers to investments made in real estate construction projects (residential, commercial, etc.) that are in the development phase.

•Real estate units in inventory: corresponds to real estate units available for sale.

The cost of real estate acquired or in construction for sale includes all expenses incurred in their acquisition and transformation, as well as other expenses necessary to complete them. Once the construction phase is completed, any subsequent costs will be recognized as an expense in the income statement for the period.

Inventories are measured at the lower of cost and net realizable value. Net realizable value ("NRV") is the estimated selling price in the normal course of business, less the estimated costs necessary to make the sale. The cost of inventories is assigned by using specific identification of their individual costs.

Cibest Corporate Group revises the NRV of its inventories at least annually, or when market conditions so require; the adjustment of the decrease in value is recognized directly in income. Adjustments to the NRV are recognized under the caption "Amortization, depreciation and impairment" in the Consolidated Statement of Income, up to the value initially recognized.

11.  Assets held for sale and discontinued operations

Cibest Corporate Group classifies non-current assets or disposal groups held for sale if their carrying value will be recovered through a sale transaction, rather than through continuing use. These assets are measured at the lower of their carrying value and their fair value less costs to sell and they are not depreciated nor amortized from the date of their classification. Additionally, if any indications of impairment exist, impairment losses are recognized for the difference between the carrying and the fair value less costs to sell as “depreciation, amortization and impairment” in the Consolidated Statement of Income. Gains and losses in the sale of assets held for sale are recognized in the Consolidated Statement of Income as “Other operating income” or “Other administrative and general expenses”.

The held for sale condition is met if the assets or groups of assets are available, in their current condition, for immediate sale or the sale transaction is highly probable and is expected to be completed within the year following the date of classification. In Cibest Corporate Group, the assets held under this classification correspond to foreclosed assets and the subsidiary Banistmo. If the sale of the asset does not take place within the planned period, the assets are reclassified to "Other assets, net" in the Consolidated Statement of Financial Position.

A discontinued operation is a component of an entity that has been disposed of, or is classified as held for sale, and represents a separate major line of business or a geographical area of operations, is part of a single coordinated and individual plan to dispose of a separate major line of business or geographical area of operations, or is a subsidiary acquired exclusively with a view to resale. The results of a discontinued operation are presented separately from those of continuing operations in the Consolidated Statement of Income on a comparative basis.

The comparative information in the statement of profit or loss is restated to reflect the classification of discontinued operations for all periods presented, whereas the Statement of Financial Position is not restated for prior periods; instead, the related assets and liabilities are presented separately from the date they are classified as held for sale.

12.  Impairment of nonfinancial assets and cash-generating units and goodwill

Cibest Corporate Group evaluates at the end of each period whether there is any indication that on a stand-alone basis nonfinancial assets and cash-generating units are impaired. If some indication of impairment does exist, Cibest Corporate Group estimates the recoverable amount of the assets and the loss by impairment, the impairment loss is recognized for the amount by which the carrying amount of the cash generating unit exceeds its recoverable amount. Regardless of whether impairment indicators exist, impairment of goodwill is assessed annually, or more frequently if events or changes in circumstances indicate that it may be impaired.

The recoverable amount of nonfinancial assets or cash-generating units is defined as the higher of fair value less costs of disposal and value in use. Fair value is determined by Management with reference to market value (if available), through pricing models, or with the assistance of a valuation specialist. Meanwhile, value in use requires Management to develop significant assumptions and estimates to forecast cash flow for periods that extend beyond the normal requirements of management reports, assessing the appropriate discount rate and growth rate.

F-38

Table of Contents

If an asset does not generate cash flows that are independent from the rest of the assets or group of assets, the recoverable amount is determined by the cash-generating unit to which the asset belongs.

The amount of impairment losses recognized in net income during the period is included in the Consolidated Statement of Income as “depreciation, amortization and impairment”. Except for impairment loss recognized for goodwill, impairment losses are subject to reversal, the increased carrying amount of an asset other than goodwill attributable to a reversal of an impairment loss shall not exceed the carrying amount that would have been determined (net of amortization or depreciation) had no impairment loss been recognized for the asset in prior years.

13.  Other assets

Cibest Corporate Group presents as other assets, among other things, (a) the expenses paid in advance incurred in the development of its business, in order to receive future services, which are amortized during the period in which services are received or the costs or expenses are recorded and (b) foreclosed assets that do not comply with the requirements to be recognized as assets held for sale and where there are no plans to use them in the supply of services or for administrative purposes.

Foreclosed assets are initially recognized at the lower of net amount of the charged-off financial assets to which the foreclosed assets relate and net realizable value of the foreclosed asset (the net realizable value will be the estimated selling price of the asset or its awarding value, less the estimated costs necessary to carry out its sale), pending obtaining a plan for its commercialization. If net amount of the charged-off financial assets is greater than net realizable value of the foreclosed asset, an adjustment for impairment of credit risk of the financial asset is recorded in the results for the period.

There is evidence of impairment when these group of assets remain in the Consolidated Statement of Financial Position for a period of time exceeding one year from the reception date, without buyer having been found, despite Cibest Corporate Group's ongoing efforts to sell them (even adjusting the selling price).

Foreclosed assets are subsequently assessed to determine whether an impairment lost must be recognized. In the case of events that arise that are beyond the control of Cibest Corporate Group and that make remote the realization of these assets, they are identified as "non-tradable”, and a complete impairment is carried out.

14.  Derecognition of nonfinancial assets

Cibest Corporate Group nonfinancial assets are derecognized either on disposal or when they are permanently withdrawn from use and no future economic benefits are expected. The difference between the value obtained on disposal and the carrying amount is recognized in the Consolidated Statement of Income.

15.   Employee benefits

15.1. Short term benefits

Cibest Corporate Group grants to its employees short-term benefits such as bonuses based on added value to clients and Cibest Corporate Group's results, salaries, accrued performance costs and social security that are expected to be wholly settled within 12 months. Expenses related to these benefits are recognized over the period in which the employees provide the services to which the payments relate. For further information, see Note 19. Employee benefit plans.

15.2. Other long-term employee benefits

Cibest Corporate Group grants to its employees seniority bonuses as long-term employee benefits whose payment is not expected within the 12 months following the end of the annual period in which the employees have rendered their services. The cost of long-term employee benefits is allocated across the period from the time the employee was hired by Cibest Corporate Group and the expected date of obtaining the benefit. These benefits are projected up to the date of payment and are discounted through the projected unit credit method.

15.3. Pensions and other post-employment benefits

–Defined contribution plans

Cibest Corporate Group makes monthly contributions to pension funds, due to legal requirements and it has no legal obligation to pay further contributions.

F-39

Table of Contents

Cibest Corporate Group recognizes contributions in the Consolidated Statement of Income once the contribution is accrued. Any contributions unpaid at the Consolidated Statement of Financial Position date are included as a liability.

–Defined benefit plans

These are post-employment benefit plans in which Cibest Corporate Group has the legal or constructive obligation to take responsibility for the payments of benefits that have been agreed, for example, severance pay, pension recognition bonuses, and pensions for retirees who fall under Cibest Corporate Group’s responsibility, as well as any other defined benefit plans agreed upon with former employees. Cibest Corporate Group makes an actuarial valuation based on the projected unit credit method and a risk-free rate which reflects current market assessments of the time value of money in each country (interest rate of treasury bonds [“TES”], representative of the nation's public debt), related to the characteristics and the benefit flows weighted average, to discount such obligation.

16.  Provisions, contingent liabilities and contingent assets

Provisions

Provisions are recognized when Cibest Corporate Group has a present obligation (legal or constructive) as a result of a past event, where it is probable that an outflow of resources embodying economic benefits will be required to settle the obligation, and a reliable estimate of the obligation's value can be made.

The corresponding expense for any provision is presented in the Consolidated Statement of Income, net of all expected reimbursement. The increase in the provision due to the time value of money is recognized as a financial expense.

The amounts recognized in the Consolidated Statement of Financial Position, correspond mainly to:

I.            Judicial proceedings

Judicial provisions refer to pending legal proceedings on employment matters, ordinary lawsuits, class actions suit, civil actions within criminal prosecutions and executive proceedings against Cibest Corporate Group.

II.            Onerous contracts

For Cibest Corporate Group, an onerous contract is a contract in which the unavoidable costs of meeting the obligations under the contract exceeds the economic benefits expected to be received under it.

III.            Loan commitments

In order to meet the needs of its customers, Cibest Corporate Group issues loan commitments, letters of credit and bank guarantees. Loan commitments are those approved irrevocable loans, in which, despite having acquired a commitment to grant them, due to the contract or agreement or for any other reason they are still pending disbursement.

IV.            Financial guarantees

Cibest Corporate Group issues bank guarantees on behalf of its customers. A bank guarantee represents an irrevocable commitment pursuant to which Cibest Corporate Group will cover, up to the maximum amount guaranteed, a breach of the client's contractual obligations to third parties for a certain period of time. These are commitments issued by Cibest Corporate Group to guarantee the performance of a customer to a third party and are mainly issued to guarantee agreements established between parties from the energy sector, hydrocarbons sector, private sector and public procurement contracts. Cibest Corporate Group expects most of those guarantees provided to expire before they are used.

The events or circumstances that would require Cibest Corporate Group to perform under a guarantee are determined by the type of guarantee, as outlined below:

Guarantees for the energy sector

Cibest Corporate Group is responsible before the guarantee’s beneficiary in the following situations:

•Lack of energy supply due to low availability from the generating company (the guaranteed entity).

F-40

Table of Contents

•Noncompliance with the contract signed by the guaranteed entity.

•Noncompliance with the payment for energy supply.

•Noncompliance with the construction and operating of power plants.

•Noncompliance with the construction and operating of transmission lines.

Guarantees for the hydrocarbons sector

Cibest Corporate Group is responsible before the guarantee’s beneficiary in the following situations:

•Noncompliance with the contractual obligations in the Minimum Exploration Program.

•Noncompliance with the contractual obligations in the Additional Exploratory Program.

•Noncompliance with the contractual obligations in the Post Exploratory Program.

•Noncompliance with the Technical Evaluation obligations.

Guarantees for public procurement

Cibest Corporate Group must pay a state entity up to the amount guaranteed for the breach by the contractor of the contractual or legal obligations agreed.

Commitment issued by Cibest Corporate Group to guarantee the performance of a customer from the private sector

Cibest Corporate Group must pay the third party if there is any breach of what has been agreed upon or due to the economic insolvency of the client.

Contingent liabilities

Possible obligations that arise from past events and whose existence will be confirmed only by the occurrence or non-occurrence of one or more uncertain future events, not wholly within the control of Cibest Corporate Group, or present obligations that arise from past events but are not recognized because it is not probable that an outflow of resources embodying economic benefits will be required to settle the obligations or the amount of the obligations cannot be measured with sufficient reliability, are not recognized in the Consolidated Statement of Financial Position, but instead are disclosed as contingent liabilities, unless the possibility of an outflow of resources embodying economic benefits is remote, in which case no disclosure is required.

Contingent assets

Possible assets that arise from past events whose existence will be confirmed only by the occurrence or non-occurrence of one or more uncertain future events, not wholly within the control of Cibest Corporate Group, are not recognized in the Consolidated Statement of Financial Position; instead, these are disclosed as contingent assets where an inflow of economic benefits is probable. When the realization of income is virtually certain, then the related asset is not a contingent asset and its recognition is appropriate.

17.  Revenue recognition

Cibest Corporate Group recognizes revenue from ordinary activities, which represent the transfer of goods or services committed with customers in exchange for an amount that reflects the consideration to which the entity expects to be entitled. For performance obligations where none of the conditions for revenue recognition over time are met, Cibest Corporate Group satisfies the performance obligation at a point in time, at which the customer obtains control of the promised services.

Revenue is measured based on the consideration specified in the contract with the customer, and excludes amounts received on behalf of third parties when Cibest Corporate Group is an agent. Cibest Corporate Group recognizes revenue when it transfers control over a good or service to a customer. Revenue is presented net of reimbursements and discounts and after eliminating inter-group sales. Cibest Corporate Group evaluates its revenue categories based on specific criteria to determine whether it acts as principal or agent. Revenue is recognized to the extent that it is probable that economic benefits will flow to Cibest Corporate Group and it is possible to reliably measure the related revenues and costs.

When Cibest Corporate Group fulfills a performance obligation through the delivery of promised goods or services to customer, it creates a contractual asset for the consideration amount obtained with the performance. Cibest Corporate

F-41

Table of Contents

Group recognizes the contractual assets as current assets, as they are expected to be realized within the normal operating cycle.

The costs of contracts eligible for capitalization as incremental costs when obtaining a contract are recognized as a contractual asset. Contractual costs are capitalized when incurred if Cibest Corporate Group expects to recover those costs. Contractual costs constitute non-current assets to the extent that Cibest Corporate Group expects to receive the economic benefits of those assets in a period greater than twelve months. The contractual costs are amortized systematically and consistently with the transfer of the services to the customer once the corresponding revenue has been recognized. The capitalized contractual costs are impaired if the customer withdraws or if the carrying amount of the asset exceeds the projection of the discounted cash flows that are related to the contract.

Interest income comprises income of financial assets at amortized cost or at fair value through other comprehensive income. Interest income is recognized using the effective interest rate method, the computation takes into account all the contractual conditions of the financial instrument (for example, prepayment options) and includes incremental fees and commissions (for example, certain loan commitment fees) or expenses that are directly attributed to the instrument and are an integral part of the effective interest rate, without taking account future credit losses.

Valuation income relates to debt securities at fair value, where gains and losses arising from changes in fair value are included in the Consolidated Statement of Income as “Interest and valuation on financial instruments”.

Fees and services commissions are recognized as the right to consideration is obtained through the exchange of goods or services that the entity has transferred to a customer. Therefore, Cibest Corporate Group recognizes some fees as revenue over time, such as income from commissions and asset management, custody and other administration and advisory commissions. While other fees are recognized as revenue at a point in time of completion of the underlying transaction, like commissions arising from the negotiation or participation in the negotiation of a transaction for a third party, such as the acquisition of shares or other securities or the purchase or sale of businesses. In addition, Cibest Corporate Group maintains a credit card loyalty program to provide incentives to its customers. The program allows customers to purchase goods and services, based on the exchange of awards points, which are awarded based on purchases using Cibest Corporate Group's credit cards and the fulfillment of certain conditions established in such program. The redemption of points for prizes is carried out by a third party. Therefore, the expenses of Cibest Corporate Group's commitments with its clients arising from this program are recognized as a lower value of the fees and commission income, considering the total number of points that can be redeemed over the accumulated prizes and the probability of redemptions.

Dividend revenue of investments that are not associates or joint ventures are recognized when the right to payment of Cibest Corporate Group is established, which is generally when the shareholders declare the dividend. These are included in the Consolidated Statement of Income as “Dividends and net income on equity investments”.

18.   Income tax

Income tax includes current tax and deferred tax. The current tax is the income tax payable with respect to the profit for the fiscal year, which arises in profit or other comprehensive income. A provision is made for current tax considering the tax bases and tax rates enacted in each of the jurisdictions where Cibest Corporate Group is located, at the date of preparation of the Consolidated Financial Statements.

Cibest Corporate Group recognizes, when appropriate, deferred tax assets and liabilities by estimating the future tax effects attributable to differences between book values of assets, liabilities and their tax bases. Deferred tax assets and liabilities are measured based on the tax rate that, in accordance with the valid tax laws in each country where Cibest Corporate Group has operations, must be applied in the year in which the deferred tax assets and liabilities are expected to be realized or settled. The future effects of changes in tax laws or tax rates are recognized in the deferred taxes as from the date of publication of the law providing for such changes.

Tax bases for deferred tax must be calculated by factoring in the definition of IAS 12 Income tax and the value of the assets and liabilities that will be realized or settled in the future according to the valid tax laws of each of the countries where Cibest Corporate Group has operations.

Deferred tax liabilities due to deductible temporary differences associated with investments in subsidiary and associated entities or shares in joint ventures, are recognized, except when Cibest Corporate Group is able to control the period in which the deductible temporary difference is reverted, and it is likely that the temporary difference will not be reverted in the foreseeable future.

F-42

Table of Contents

Deferred tax assets, identified with temporary differences, are only recognized if it is considered likely that Cibest Corporate Group will have sufficient taxable income in the future that allows it to be recovered based on the stand-alone entity expected cash flow forecast for the next three years.

Tax credit from fiscal losses and surplus amounts from the presumptive income on the net income are recognized as a deferred asset, provided that it is likely that Cibest Corporate Group will generate future net income to allow their offset.

The deferred tax is recorded as debit or credit according to the result of each of the companies that form Cibest Corporate Group, and for the purpose of disclosure on the Consolidated Statement of Financial Position it is disclosed as net.

The deferred income tax expense is recognized in the Consolidated Statement of Income under the heading “Income tax”, except when referring to amounts directly recognized in OCI (Other Comprehensive Income).

Regulatory changes in tax laws and in tax rates are recognized in the Consolidated Statement of Income under the heading “Income Tax” in the period when such rule becomes enforceable. Interest and fines are recognized in the Consolidated Statement of Income under the other administrative and general expenses or in the caption "Income tax" of the Consolidated Income Statement, when applicable.

Cibest Corporate Group periodically assesses the tax positions adopted in tax returns, and, according to the results of the tax audits conducted by the tax authorities, determines possible tax outcomes provided it has a present obligation and it is more likely than not that Cibest Corporate Group will have to dispose of the economic resources to cancel the obligation, and Cibest Corporate Group can make an accurate estimate of the amount of the obligation.

For more information on the income tax impacts arising from the tax measures in Colombia under Decree 1474 of 2025, “By which tax measures are adopted to cover the expenses of the General Budget of the Nation necessary to address the State of Emergency declared by Decree 1390 of 2025”, see Note 13. Income Tax.

Transfer pricing policy

Cibest Corporate Group has as a general policy that each of its companies be responsible for their income, costs and expenses independently. The policy takes into account the regulation for the Parent Company provided for in the Organic Statute of the Financial System (article 119, numeral 4) which in relation to the autonomy of the subsidiaries states that: the activity of the subsidiaries of entities subject to the control and supervision of the SFC must be carried out in conditions of independence and administrative autonomy, so that they have sufficient decision-making capacity to carry out the operations that constitute their object.

Cibest Corporate Group recognizes arm’s length operations with foreign economic links. These operations are documented and reported to the tax Administration according to the last evaluation date corresponding to the previous year.

E.   Use of estimates and judgments

The preparation of Consolidated Financial Statements requires Cibest Corporate Group's Management to make judgments, estimates and assumptions that affect the application of accounting policies and the reported amounts of assets, liabilities, income and expenses.

The estimates and underlying assumptions are reviewed on an ongoing basis. Revisions to accounting estimates are recognized in the period in which the estimate is revised if the revision affects only that period, or in the period of the revision and future periods if the revision affects both current and future periods.

Judgments or changes in assumptions are disclosed in the notes to the Consolidated Financial Statements. Management bases its estimates and judgments on historical experience and on various other factors that are believed to be reasonable under current circumstances. Actual results may differ from these estimates if assumptions and conditions change.

The significant accounting estimates that Cibest Corporate Group uses in preparing its Consolidated Financial Statements are detailed below:

1.     Credit risk impairment

As described in section D. Material Accounting Policies, paragraph 4.1.2. Impairment of financial assets at amortized cost or at fair value through other comprehensive income ‘FVOCI’, expected credit losses are calculated using individual and

F-43

Table of Contents

collective models and based on assumptions and judgments that incorporate historical credit data, the borrower’s current situation, and reasonable and supportable forecasts of future economic conditions.

Collective models incorporate parameters such as 12-month probability of default, lifetime probability of default, loss given default and exposure at default:

•Exposure at default: defined as the outstanding balance of principal, interest, and receivables. For revolving products with undrawn limits that can be fully utilized, this parameter includes an estimate of potential utilization after the borrower’s default, in accordance with the loan agreements.

•Probability of default (“PD”): the likelihood that the debtor will fail to meet principal and/or interest obligations over a 12 month horizon or over the life of the credit. PD is linked to the rating or score assigned to each borrower or exposure.

•Loss given default (“LGD”): defined as the economic loss the entity would incur in the event of default. It depends primarily on the borrower’s characteristics and the valuation of collateral associated with the exposure.

The main risk factors incorporated into collective expected credit loss methodologies include the definition of significant increase in credit risk, the definition of default, the fair value of collateral, and a forward looking approach through the inclusion of projections of key macroeconomic variables (such as unemployment rates, GDP growth, interest rate levels, inflation, among others). Additionally, other variables that may influence customers' payment expectations are considered.

The forward-looking approach incorporates assumptions about future macroeconomic conditions under plausible scenarios. This is one of the most significant judgments involved in estimating Cibest Corporate Group’s expected credit loss allowance and relates to the macroeconomic projections applied over a reasonable and supportable forecast period.

Cibest Corporate Group analyzes significant exposures in Stage 3 through an individual assessment, which incorporates assumptions regarding the client’s financial condition and expected future cash flows. These may be affected by factors such as potential regulatory changes impacting the client’s business, variations in commercial and operational dynamics, the client’s ability to successfully negotiate during financial distress and generate sufficient cash flows to meet debt obligations, fluctuations in collateral value, scenario weightings, and any other internal or external factor that may influence financial condition. For further information, see Note 6. Loans and advances to customers, net, and Risk management.

The Risk Management Division has three committees responsible for overseeing Management’s decisions regarding expected credit losses (ECL), including the operation of mathematical, econometric, and financial models that require relevant assumptions based on historical data and subsequently validated by the following expert panels:

•ECL Technical Committee: evaluates and periodically approves the performance of the models and methodologies used to estimate expected credit losses, as well as the underlying assumptions, through rigorous validation procedures designed to ensure reasonable coverage of realised losses. This process helps identify when assumptions or models must be adjusted to improve accuracy. It also evaluates and approves the use of post model adjustments (PMAs) in their formation, monitoring and release stages.

•Economic Forecasting Committee: discusses, evaluates, and periodically approves macroeconomic projections for Colombia and subsidiaries, covering variables such as GDP, inflation, monetary policy rate, exchange rate, exports, imports, current account balance, and fiscal balance. It also approves the weighting of base and alternative scenarios, considering factors that may affect the macroeconomic outlook. Members include the Director of Economic Research, the Macroeconomic Manager, the Analytics Manager, macroeconomic research analysts, and subsidiary economists. Accordingly, the projection of economic conditions and the assignment of probability weightings to those scenarios have a significant impact on lifetime probability‑of‑default models. These scenarios are defined and supported by the Economic Research Division.

•NPV Committee: responsible for approving, validating, and challenging assumptions and methodologies used to estimate allowances under recovery models (Going Concern, Gone Concern, Mixed, and 100% Provision) for significant Stage 3 clients whose provision must be estimated using individual NPV analysis. The Committee meets periodically and consists of a team with extensive expertise in risk, finance, law, and corporate management.

Furthermore, internal controls and governance mechanisms have been implemented over data quality, modelling, and approval processes to strengthen the reliability and accuracy of the estimates.

F-44

Table of Contents

Post‑Model Adjustments due to economic uncertainty:

Adjustments for macroeconomic uncertainty are recorded in two ways. First, through the ECL models to capture additional deterioration within macroeconomic expectations not fully reflected in the models, mainly related to inflation and interest rate impacts. Second, through a post‑model adjustment applied to significant Stage 3 exposures based on sector‑specific risk identification.

Segment	Total impairment allowance	Economic uncertainty adjustments – ECL models	Economic uncertainty adjustments – significant clients	Economic uncertainty adjustments – Total	Proportion of adjustments to total impairment allowance
Commercial	6,872,442	119,109	35,987	155,095	2.30%
Consumer and Small Business Loan	5,414,308	150,775	-	150,775	2.80%
Mortgage	967,196	9,850	-	9,850	1.00%
Total	13,253,946	279,734	35,987	315,720	2.40%

2.     Impairment testing of cash generating units (“CGU”), including goodwill

Cibest Corporate Group tests goodwill recognized upon business combinations for impairment at least annually. The impairment test for goodwill involves estimates and significant judgments, including the identification of cash generating units and the allocation of goodwill based on the expectations of which operating segments of Cibest Corporate Group will benefit from the acquisition. The fair value of the acquired companies is sensitive to changes in the valuation models’ assumptions. Adverse changes in any of the factors underlying these assumptions could lead Cibest Corporate Group to record a goodwill impairment charge. Management believes that the assumptions and estimates used are reasonable and supportable in the existing market environment and commensurate with the risk profile of the assets valued. See Note 12. Goodwill and intangible assets, net, for further information related to carrying amount, valuation methodologies, key assumptions, sensitivities and the allocation of goodwill.

3.     Recognition of digital assets

Currently, there is no specific definitive guidance in IFRS or alternative accounting frameworks to account for the recognition of digital assets held by Cibest Corporate Group, as well as the custody of digital assets held for customers, so management has exercised significant judgment in determining the appropriate accounting treatment.

Cibest Corporate Group has considered that it acts in the quality of a commodity trader, as defined in IAS 2, Inventories, by characterizing certain of its holdings as inventories, or more specifically, digital assets. The business model for digital assets will be to sell them in the near future and generate a profit from fluctuations in price or dealer margin. So, inventories held by commodity broker-dealers are measured at fair value less costs to sale. When such inventories are measured on that basis, changes in value are recognized in profit or loss in the period.

In the event that the IASB issues final guidance, Cibest Corporate Group may be required to modify its accounting policies, which could have a significant effect on Cibest Corporate Group's Consolidated Financial Statements.

4.      Deferred tax

Deferred tax assets and liabilities are recorded on deductible or levied temporary differences originating between tax and accounting bases, taking into account the tax rules applicable in each country where Cibest Corporate Group has operations. Due to the changing conditions of the political, social and economic environment, the constant amendments to tax legislation and the permanent changes in the tax principles and changes in interpretations by tax authorities determining the tax bases for the deferred tax items involves difficult judgments including estimates of future gains, offsets or tax deductions. Accordingly, the determination of the deferred tax is considered a critical accounting policy.

For more information relating to the nature of deferred tax assets and liabilities recognized by Cibest Corporate Group, please see Note 13. Income tax.

F-45

Table of Contents

5.     Provisions and contingent liabilities

Cibest Corporate Group is subject to contingent liabilities, including those arising from judicial, regulatory and arbitration proceedings, tax and other claims arising from the conduct of Cibest Corporate Group's business activities. These contingencies are evaluated based on Management’s best estimates and provisions are established for legal and other claims by assessing the likelihood of the loss actually occurring as probable, possible or remote. Contingences are provisioned and recorded when all the information available indicates that it is probable that an outflow of resources embodying economic benefits will be required to settle the obligation before the Consolidated Statement of Financial Position date and the amounts may be reasonably estimated. Cibest Corporate Group engages internal and external experts in assessing probability and in estimating timing, nature and amount of outflows that may result from past events.

Provisions are determined by Management’s best estimate of the expenditure required to settle the present obligation at the end of the reporting period, which estimate is discounted using a risk-free rate which reflects current market assessments of the time value of money in each country, which for Colombia is the interest rate on treasury bonds “TES”.

Throughout the life of a contingency, Cibest Corporate Group may learn of additional information that can affect assessments regarding probability or the estimates of amounts involved; changes in these assessments can lead to changes in recorded provisions.

Cibest Corporate Group considers the estimates used to determine the provisions for contingent liabilities critical estimates because the probability of their occurrence and the amounts that Cibest Corporate Group may be required to pay are based on Cibest Corporate Group judgment and those of its internal and external experts, which will not necessarily coincide with the future outcome of the proceedings. For further information regarding legal proceedings and contingencies and their carrying amounts, see Note 21. Provisions and contingent liabilities.

6.      Fair value of assets and liabilities

The fair value of Cibest Corporate Group's assets and liabilities is determined at the date of the Consolidated Statement of Financial Position. Cibest Corporate Group's fair value measurement process considers the characteristics of the asset or liability in the same way that market participants would take them into account when pricing the asset or liability at the measurement date; the estimate takes into account inputs from valuation techniques used to measure fair value.

To increase consistency and comparability in fair value measurements and related disclosures, Cibest Corporate Group specifies different levels of inputs that may be used to measure the fair value of financial instruments, as follows:

Level 1: assets and liabilities are classified as Level 1 if there are observable inputs that reflect quoted prices (unadjusted) for identical assets or liabilities in active markets. An active market is one in which transactions occur with sufficient volume and frequency to provide pricing information on an ongoing basis. Instruments are valued by reference to unadjusted quoted prices for identical assets or liabilities in active markets where the quoted price is readily available, and the price represents actual and regularly occurring market transactions.

Level 2: assets and liabilities are classified as Level 2 if in the absence of a market price for a specific financial instrument, its fair value is estimated using models whose input data are observable for recent transactions of identical or similar instruments.

Level 3: assets and liabilities are classified as level 3 if unobservable input data were used in the measurement of fair value that are supported by little or no market activity and that are significant to the fair value of these assets or liabilities. The fair value of Level 3 financial assets and liabilities is determined using pricing models, discounted cash flow methodologies or similar techniques.

Transfers into or out of Level 3 are made if the significant inputs used in the financial models measuring the fair values of the assets and liabilities became unobservable or observable, respectively, in the current marketplace. All transfers between the aforementioned levels are assumed to occur at the end of the reporting period.

The measurement of the fair value of financial instruments generally involves a higher degree of complexity and requires the application of judgments especially when the models use unobservable inputs (level 3) based on the assumptions that would be used in the market to determine the price for assets or liabilities. Determination of these assumptions includes consideration of market conditions and liquidity levels. Changes in the market conditions, such as reduced liquidity in the capital markets or changes in secondary market activities, may reduce the availability and reliability of quoted prices or observable data used to determine fair value.

F-46

Table of Contents

When developing fair value measurements, Cibest Corporate Group maximizes the use of observable inputs and minimizes the use of unobservable inputs in measuring fair value. Additionally, Cibest Corporate Group uses third-party pricing services to obtain fair values, which are used to either record the price of an instrument or to corroborate internally developed prices. Third-party price validation procedures are performed over the reasonableness of the fair value measurements. For further details regarding carrying amount and sensitivity disclosures, please see Note 30. Fair value of assets and liabilities.

7.     Measurement of employee benefits

The measurement of post-employment benefit obligations and long-term employee benefits takes into account a range of inputs and it is dependent upon a series of assumptions of future events. The projected unit credit method is used to determine the present value of the obligation for the defined benefits and its associated cost. Future measurements of obligations may differ to those presented in the Consolidated Financial Statements, among others, due to changes in economic and demographic assumptions and significant events. The actuarial valuation methodology of the post-employment and long-term benefit plans include typified discount rates by each benefit plan, with the objective of presenting more relevant information on the value of these plans in the Consolidated Financial Statements. For further information, see Note 19. Employee benefit plans.

8.     Transaction price determination

With respect to contracts with Cibest Corporate Group's customers, for the determination of the transaction price, Cibest Corporate Group allocates to each one of the performance obligations under the contract the price which represents the value expected to be received in respect of each such performance obligation based on its relative stand-alone selling price. Such price is determined based on the cost of each service, related tax and associated risks to the operation and inherent to the transaction, plus the margin expected to be received for the services, considering in each case the market price for the service, the conditions agreed with the customer and the customer’s segment. Cibest Corporate Group has fixed and variable prices considering the characteristics of each service, future events, discounts, returns and other variables that may influence the selling price. No significant financing components are factored in the determination of the selling price. For further information, see Note 25. Operating income.

9.      Leases

The measurement of the right-of-use asset and of the lease liabilities requires a series of judgments, among which are the determination of the term of the lease and the rate used in discounting the cash flows. The term of the lease is defined according to the historical information of the contracts and the period over which an asset is expected to be economically usable, which involves a high degree of uncertainty due to the use of relevant information about past events. In Cibest Corporate Group's case, the weighted average lessee’s incremental borrowing rate was used to discount the cash flows associated with the leasing contracts. Cibest Corporate Group performs analysis taking into account the currency, lease term, economic environment and class of underlying assets, as to determine the weighted average lessee’s incremental borrowing rate. For further information, see Note 11. Leases.

10.   Uncertainty over income tax treatments

In the process of determining the current and deferred tax for periods subject to review by the tax authority, the applicable rules have been applied and interpretations have been made to take positions, on which different interpretations could arise from those made by the entity. Due to the complexity of the tax system, the continuous modifications of the fiscal rules, the accounting changes with implications in the tax bases and in general the legal instability of the country, at any time the tax authority could have different criteria from Cibest Corporate Group. Therefore, a dispute or inspection by the tax authority on a specific tax treatment may affect the deferred or current tax asset or liability Cibest Corporate Group's accounting, in accordance with the requirements of IAS 12.

Management and its advisors believe that their decisions concerning the estimates and judgments made in each fiscal period are in accordance with those required by the current tax regulations, and therefore have not considered it necessary to recognize any additional provisions to those indicated in Note 13. Income tax.

F-47

Table of Contents

F.     Recently issued accounting pronouncements

a)    Accounting Pronouncements Applicable in 2025

Amendments to illustrative examples–Disclosures about uncertainties in the Financial Statements: on November 28, 2025, the Board issued amendments to the guidance accompanying IFRS 7, IAS 8, IAS 36, and IAS 37, including IFRS 18 Presentation and Disclosure in Financial Statements and IAS 1 Presentation of Financial Statements. These amendments add examples illustrating how to disclose the impacts of uncertainties within climate‑related scenarios; however, the principles and requirements are also applicable to the disclosure of other uncertainties.

Materials accompanying IFRS Accounting Standards, including illustrative examples, are not an integral part of those standards and, therefore, do not have an effective date or transition requirements.

This amendment has been evaluated by Cibest Corporate Group without identifying any impact on the financial statements or disclosures, as the new requirements align with those already applied and reported by Cibest Corporate Group.

b) Recently issued accounting pronouncements applicable in future periods

NIIF 18 Presentation and Disclosure in Financial Statements: In April 2024, the Board issued IFRS 18 to replace IAS 1 Presentation of Financial Statements. IFRS 18 introduces three sets of new requirements to improve the way companies report their financial performance and give investors a better basis for analyzing and comparing companies:

–Improved comparability in the statement of income: IFRS 18 introduces three defined categories for income and expenses (operating, investing and financing) to improve the structure of the statement of income, and requires all companies to provide new defined subtotals, including operating profit.

–Enhanced transparency of management-defined performance measures: the new standard requires companies to disclose explanations of those company-specific measures that are related to the statement of income, referred to as management-defined performance measures.

–More useful grouping of information in the financial statements: IFRS 18 sets out enhanced guidance on how to organize information and whether to provide it in the primary financial statements or in the notes. In addition, the new standard requires companies to provide more transparency about operating expenses, helping investors to find and understand the information they need.

The IASB proposes that this new standard become effective for annual periods beginning on or after January 1, 2027, with early application permitted. As of today, this standard has not yet been incorporated into the accounting technical framework accepted in Colombia.

Management is assessing the impact that these amendments will have on Cibest Corporate Group's Consolidated Financial Statements and disclosures.

NOTE 3. OPERATING SEGMENTS

Operating segments are defined as components of an entity about which separate financial information is available and that is evaluated regularly by the chief operating decision maker (CODM) in deciding how to allocate resources and assessing performance; the CODM comprises the Cibest Corporate Group’s President (CEO) and Financial Vice President (CFO). Segment information has been prepared following the Cibest Corporate Group’s accounting policies and is presented consistently with the internal reports provided to the CODM.

The chief operating decision maker (CODM) uses a variety of information and key financial data on a segment basis to assess the performance and make decisions regarding the investment and allocation of resources, such as:

•Net interest margin (Net margin on financial instruments divided by average interest-earning assets).

•Return on average total assets (Net income divided by average total assets).

•Return on average stockholders’ equity.

•Efficiency ratio (Operating expenses as a percentage of interest, fees, services, and other operating income).

•Asset quality and loan coverage ratios.

F-48

Table of Contents

The Cibest Corporate Group reports the following operating segments: Banking Colombia, Banking Panama (discontinued operation), Banking El Salvador, Banking Guatemala, International Banking, Leases, and All Other segments. Segments are identified primarily by the nature of products and services and geographical footprint, consistent with the internal reporting to the CODM.

During the current period, Cibest Corporate Group conducted a comprehensive review of the information structure used by the Chief Operating Decision Maker (CODM) for strategic decision-making and performance assessment. As a result of this analysis, adjustments were made to the presentation of the disclosed operating segments, with the purpose of ensuring that the reported information more accurately reflects the manner in which CODM manages and oversees operational activities.

To maintain the comparability of information, prior periods have been restated in accordance with the new operating segment structure, without generating impacts on the consolidated results of Cibest Corporate Group.

The Cibest Corporate Group’s operating segments are comprised as follows:

•Banking Colombia

This segment provides individual and corporate banking products and services to individuals, businesses, and national and local governments in Colombia. The Parent Company's business strategy seeks to meet customers' financial needs and is based on personalized service, a friendly and approachable attitude, and the generation of added value, ensuring quality of service and fostering business growth and national development.

The commercial strategy is based on a segmented service model by customer type Personal, Plus and Empresarial for individuals and SMEs, and Corporate and Government for larger customers. In particular, the corporate sales force specializes in companies with more than COP 100,000, covering twelve economic sectors: agriculture, commerce, supplies and materials manufacturing, consumer goods, financial services, health, education, construction, government, infrastructure, real estate and natural resources.

The segment centrally manages the loan portfolio, funding and liquidity, and the distribution of treasury products and services in the Colombian market, in line with the Cibest Corporate Group’s risk, profitability and sustainability policies.

•Banking Panama (discontinued operation)

This segment comprises the financial services provided in Panama through Banistmo S.A., its subsidiaries Banistmo Investment Corporation S.A. and Leasing Banistmo S.A., as well as the non‑operating entities Banistmo Capital Markets Group Inc., Anavi Investment Corporation S.A., Desarrollo de Oriente S.A., Steens Enterprises S.A., and Ordway Holdings S.A.

This segment also manages the own‑book loan portfolio, liquidity, and the distribution of treasury products for customers in Panama.

In 2025, the corporate reorganization of Banistmo S.A. was completed, under which 100% of its ownership interest in Valores Banistmo S.A. was spun off in favor of Cibest Panamá Assets S.A., a company 100% owned by Cibest Corporate Group.

On December 18, 2025, the Cibest Corporate Group executed a share purchase agreement for the sale of 100% of the shares of Banistmo S.A. As a result, this operation is classified as a discontinued operation under IFRS 5, and its assets, liabilities, and results are presented within the specific discontinued‑operation line items in the consolidated financial statements. As of December 31, 2025, Banistmo S.A. was considered an asset held for sale. For further information, see Note 1. Reporting Entity, Note 2.D12. Significant accounting policies – Assets held for sale and discontinued operations and Note 31. Discontinued Operation.

•Banking El Salvador

This segment provides comprehensive financial services in El Salvador through Banco Agrícola S.A., Banagrícola S.A., Inversiones Financieras Banco Agrícola S.A. (IFBA), Arrendadora Financiera S.A. Arfinsa, ACCELERA S.A. de C.V., Valores Banagrícola S.A. de C.V., Bagrícola Costa Rica S.A. and Gestora de Fondos de Inversión Banagrícola S.A. These entities offer banking, fiduciary, financial leasing, fund management, brokerage and credit products.

F-49

Table of Contents

The segment also manages own‑book lending, liquidity and the distribution of treasury products and services to customers in El Salvador.

•Banking Guatemala

This segment serves the Guatemalan market through Banco Agromercantil de Guatemala S.A., Grupo Agromercantil Holding S.A., Seguros Agromercantil de Guatemala S.A., Arrendadora Agromercantil S.A., Financiera Agromercantil S.A., Agrovalores S.A., Asistencia y Ajustes S.A., Serproba S.A., Servicios de Formalización S.A., Conserjería, Mantenimiento y Mensajería S.A. (in voluntary liquidation), New Alma Enterprises Ltd., and Mercom Bank Ltd. The assets and liabilities of the operations in Barbados through Mercom Bank Ltd. were transferred to other entities, leaving loan and deposit balances at zero as of January 31, 2023. As of December 31, 2025, the public registry approved the liquidation of this company, which is pending approval by the Central Bank of Barbados. See Note 1. Reporting Entity.

This segment is also responsible for managing own‑book lending, liquidity, and the distribution of treasury products and services to customers in Guatemala.

•International Banking

This segment comprises the Cibest Corporate Group’s international operations through Bancolombia Panamá S.A., Bancolombia Puerto Rico Internacional Inc., and SINESA Cayman, Inc. (formerly Bancolombia Cayman S.A., currently being wound down). These platforms provide international banking services, foreign‑currency products, cash‑management structures, offshore funding, and financing for regional and non‑resident customers.

Operations in the Cayman Islands through SINESA Cayman, Inc. (formerly Bancolombia Cayman S.A.) have been cancelled or transferred. As of December 31, 2025, the company is in dissolution and liquidation.

•Leases

The Leases segment consolidates the operating leasing, finance leasing and real‑estate asset management activities of the Cibest Corporate Group, primarily through Renting Colombia S.A.S., Valores Simesa S.A., FCP Fondo Inmobiliario Colombia, and a broad structure of autonomous trusts and real estate trusts (patrimonios autónomos y fideicomisos), including: P.A. FAI Calle 77, P.A. Nomad Salitre, P.A. Nomad Central‑2, P.A. Calle 84 (2), P.A. Calle 84 (3), P.A. Nomad Distrito Vera, P.A. Nexo, P.A. Mercurio, P.A. CEDIS Sodimac, P.A. Inmuebles CEM, P.A. Calle 92 FIC‑11, P.A. FIC Edificio Corfinsura, P.A. FIC A5, P.A. FIC Inmuebles, P.A. FIC Clínica del Prado, P.A. FIC A6, P.A. Central Point, P.A. Fideicomiso Twins Bay, Fideicomiso Lote Av. San Martín, P.A. Fideicomiso Lote 30, Fideicomiso Fondo Inmobiliario Bancolombia, P.A. Florencia Ferrara, P.A. Flor Morado Plaza, P.A. Linz Graz del Río, Fideicomiso Selecto Terrazu (Towers 1 and 2), Fideicomiso Lote C6 Cartón de Colombia, Fideicomiso Mokana Recursos and Fideicomiso River Park.

The segment manages the leasing portfolio, income‑producing real‑estate assets, project structuring and the associated treasury management.

•All other segments

This segment includes holding, investment, fiduciary operations, technology, innovation, capital markets and special‑purpose vehicles that do not meet the quantitative thresholds of IFRS 8 to be reported separately. It comprises: Grupo Cibest S.A., Inversiones Cibest S.A.S., Cibest Investment Management S.A.S., Valores Cibest S.A.S., Cibest Inversiones Estratégicas S.A.S., Sistemas de Inversiones y Negocios S.A. – SINESA, Banca de Inversión Bancolombia S.A. Corporación Financiera, Negocios Digitales Colombia S.A.S., Inversiones CFNS S.A.S., WOMPI S.A.S., Nequi S.A. Compañía de Financiamiento, Wenia S.A.S., Wenia Ltd., Cibest Panamá Assets S.A., P.A. Wenia, P.A. Títulos de Pagos por Ejecución, P.A. Tokenización Novus, Valores Banistmo S.A., Banistmo Panamá Fondos de Inversión S.A. (non‑operating), Valores Bancolombia S.A. Comisionista de Bolsa, Cibest Capital Holdings USA LLC, Cibest Capital Advisory Services LLC and Cibest Capital Securities LLC.

Entities in this segment carry out capital‑markets activities, brokerage services, investment advisory, technology solutions, fiduciary administration, digital innovation, investment vehicles and holding functions. They also provide strategic, operational and financial support to the Cibest Corporate Group through corporate functions, technology platforms, and the distribution of specialized products and services.

F-50

Table of Contents

In accordance with IFRS 8, the figures reported under “All other segments” aggregate information for operating segments that individually did not meet the quantitative thresholds defined by that standard; that is, the absolute amount of their reported results represents, in absolute terms, less than 10% of the combined results of all segments, and their assets represent less than 10% of the combined assets of all operating segments of Cibest Corporate Group.

Financial performance by operating segment:

The CODM reviews the performance of the Cibest Corporate Group using the following financial information by operating segment:

	For the year ended December 31, 2025
	Banking<br>Colombia	Banking El<br>Salvador	Banking<br>Guatemala	International<br>Banking	Leases(4)	All other<br>segments	Total <br>segments	Banking Panama (Discontinued operation)(5)
In millions of COP
Total interest and valuation on financial instruments	26,062,351	2,095,137	2,013,347	1,014,777	216,802	85,112	31,487,526	2,546,672
Interest income on loans and financial leases	24,478,980	1,807,267	1,848,807	852,849	224,652	23,447	29,236,002	2,103,723
Debt investments	1,491,219	287,163	173,103	94,069	1,180	48,016	2,094,750	353,019
Derivatives, net	51,816	-	-	(56)	(9,030)	(1,051)	41,679	3,197
Liquidity operations, net	40,336	707	(8,563)	67,915	-	14,700	115,095	86,733
Interest expenses	(9,633,252)	(437,193)	(911,786)	(660,927)	(360,799)	(57,269)	(12,061,226)	(1,241,640)
Net interest margin and valuation on financial instruments before impairment on loans and financial leases, off balance sheet credit instruments and other financial instruments	16,429,099	1,657,944	1,101,561	353,850	(143,997)	27,843	19,426,300	1,305,032
Credit impairment charges, net	(3,396,144)	(334,805)	(442,529)	(225,658)	(30,327)	(455)	(4,429,918)	(161,369)
Net interest margin and valuation on financial instruments after impairment on loans and financial leases, off balance sheet credit instruments and other financial instruments	13,032,955	1,323,139	659,032	128,192	(174,324)	27,388	14,996,382	1,143,663
(Expenses) Revenues from transactions by the operating segments of Cibest Corporate Group	(288,452)	1,769	(79,514)	320,216	(115,936)	161,917	-	-
Fees and commissions income(1)	6,151,871	629,985	231,580	55,665	4	859,449	7,928,554	519,246
Fees and commissions expenses	(3,140,014)	(291,977)	(96,751)	(11,627)	(3,842)	(29,399)	(3,573,610)	(261,793)
Total fees and commissions, net	3,011,857	338,008	134,829	44,038	(3,838)	830,050	4,354,944	257,453
Other operating income	1,620,506	42,082	131,316	16,492	1,545,011	216,667	3,572,074	24,905
Dividends and net income on equity investments(2)	179,656	4,590	2,115	24	329,307	177,319	693,011	8,561
Goodwill impairment	-	-	-	-	-	-	-	(5,022,822)
Total operating income / (Expenses), net	17,556,522	1,709,588	847,778	508,962	1,580,220	1,413,341	23,616,411	(3,588,240)
Operating expenses(3)	(9,457,584)	(831,994)	(654,017)	(104,892)	(1,057,200)	(735,118)	(12,840,805)	(812,202)
Depreciation, amortization and impairment	(706,370)	(96,796)	(59,578)	(2,473)	(137,602)	(13,482)	(1,016,301)	(97,737)
Total operating expenses	(10,163,954)	(928,790)	(713,595)	(107,365)	(1,194,802)	(748,600)	(13,857,106)	(909,939)
Profit / (loss) before income tax	7,392,568	780,798	134,183	401,597	385,418	664,741	9,759,305	(4,498,179)

(1)For further information about income from contracts with customers, see Note 25.3. Commissions.

(2)For further information see Note 25.5. Dividends and net income on equity investments.

(3)Includes salaries and employee benefits, other administration and general expenses and taxes other than income tax.

(4)In 2025, the Leases segment is presented separately as its own reportable segment. For comparative purposes, the 2024 information has been restated, as these operations were included within “All other segments” during that period.

(5)As of December 31, 2025, Banistmo S.A. was considered an asset held for sale. The profit before income tax of Banking Panama segment (discontinued operation) differs from the net income from discontinued operations because it does not include the income tax related to that segment. For more information, see Note 1. Reporting Entity, Note 2.D.12 Material Accounting Policies - Assets held for sale and discontinued operations and Note 31. Discontinued Operation.

F-51

Table of Contents

	For the year ended December 31, 2024
	Banking<br>Colombia	Banking El<br>Salvador	Banking<br>Guatemala	International<br>Banking	Leases(4)	All other<br>segments	Total <br>segments	Banking Panama (Discontinued operation)(5)
In millions of COP
Total interest and valuation on financial instruments	27,543,286	1,851,126	1,939,602	1,203,837	254,200	62,265	32,854,316	2,689,904
Interest income on loans and financial leases	25,632,102	1,623,427	1,807,334	987,377	257,363	22,836	30,330,439	2,283,111
Debt investments	1,503,298	226,122	134,101	116,662	41	37,486	2,017,710	316,205
Derivatives, net	155,794	775	-	(94)	(3,204)	(2,463)	150,808	3,322
Liquidity operations, net	252,092	802	(1,833)	99,892	-	4,406	355,359	87,266
Interest expenses	(11,292,917)	(437,244)	(804,815)	(708,671)	(443,629)	(384)	(13,687,660)	(1,336,250)
Net interest margin and valuation on financial instruments before impairment on loans and financial leases, off balance sheet credit instruments and other financial instruments	16,250,369	1,413,882	1,134,787	495,166	(189,429)	61,881	19,166,656	1,353,654
Credit impairment charges, net	(4,220,195)	(236,086)	(394,589)	(91,617)	(53,547)	433	(4,995,601)	(456,748)
Net interest margin and valuation on financial instruments after impairment on loans and financial leases, off balance sheet credit instruments and other financial instruments	12,030,174	1,177,796	740,198	403,549	(242,976)	62,314	14,171,055	896,906
(Expenses) Revenues from transactions by the operating segments of Cibest Corporate Group	(181,303)	(19,110)	(86,604)	400,937	(136,749)	22,829	-	-
Fees and commissions income(1)	5,660,355	515,734	211,778	51,901	292	686,452	7,126,512	562,330
Fees and commissions expenses	(2,885,255)	(226,445)	(85,700)	(10,116)	(1,639)	(16,227)	(3,225,382)	(286,392)
Total fees and commissions, net	2,775,100	289,289	126,078	41,785	(1,347)	670,225	3,901,130	275,938
Other operating income	1,219,476	40,818	130,140	12,435	1,543,538	29,703	2,976,110	65,876
Dividends and net income on equity investments(2)	(121,975)	4,338	1,555	25	287,930	(78,774)	93,099	11,474
Total operating income, net	15,721,472	1,493,131	911,367	858,731	1,450,396	706,297	21,141,394	1,250,194
Operating expenses(3)	(8,497,419)	(771,079)	(645,311)	(98,572)	(1,056,501)	(592,928)	(11,661,810)	(853,981)
Depreciation, amortization and impairment	(631,282)	(93,982)	(61,471)	(8,016)	(182,106)	(12,479)	(989,336)	(128,544)
Total operating expenses	(9,128,701)	(865,061)	(706,782)	(106,588)	(1,238,607)	(605,407)	(12,651,146)	(982,525)
Profit before income tax	6,592,771	628,070	204,585	752,143	211,789	100,890	8,490,248	267,669

(1)For further information about income from contracts with customers, see Note 25.3. Commissions.

(2)For further information see Note 25.5. Dividends and net income on equity investments.

(3)Includes salaries and employee benefits, other administration and general expenses and taxes other than income tax.

(4)In 2025, the Leases segment is presented separately as its own reportable segment. For comparative purposes, the 2024 information has been restated, as these operations were included within “All other segments” during that period.

(5)As of December 31, 2025, Banistmo S.A. was considered an asset held for sale. The profit before income tax of Banking Panama segment (discontinued operation) differs from the net income from discontinued operations because it does not include the income tax related to that segment. For more information, see Note 1. Reporting Entity, Note 2.D.12 Material Accounting Policies - Assets held for sale and discontinued operations and Note 31. Discontinued Operation.

F-52

Table of Contents

	For the year ended December 31, 2023
	Banking<br><br>Colombia	Banking El<br>Salvador	Banking<br>Guatemala	International<br>Banking	Leases(4)	All other<br>segments	Total <br>segments	Banking Panama (Discontinued operation)(5)
In millions of COP
Total interest and valuation on financial instruments	29,230,060	1,773,141	1,795,543	1,112,171	254,360	54,326	34,219,601	2,826,559
Interest income on loans and financial leases	28,366,678	1,524,765	1,726,821	940,091	253,677	13,521	32,825,553	2,415,234
Debt investments	937,090	236,351	60,534	85,091	683	36,544	1,356,293	301,167
Derivatives, net	(167,887)	11,187	-	(188)	-	(1,747)	(158,635)	817
Liquidity operations, net	94,179	838	8,188	87,177	-	6,008	196,390	109,341
Interest expenses	(13,202,338)	(464,851)	(731,886)	(596,039)	(434,664)	(405)	(15,430,183)	(1,238,112)
Net interest margin and valuation on financial instruments before impairment on loans and financial leases, off balance sheet credit instruments and other financial instruments	16,027,722	1,308,290	1,063,657	516,132	(180,304)	53,921	18,789,418	1,588,447
Credit impairment charges, net	(6,480,377)	(154,938)	(499,368)	4,164	(55,660)	(4,906)	(7,191,085)	(270,501)
Net interest margin and valuation on financial instruments after impairment on loans and financial leases, off balance sheet credit instruments and other financial instruments	9,547,345	1,153,352	564,289	520,296	(235,964)	49,015	11,598,333	1,317,946
(Expenses) Revenues from transactions by the operating segments of Cibest Corporate Group	(217,445)	(17,732)	(75,808)	416,107	(163,049)	57,927	-	-
Fees and commissions income(1)	5,252,104	479,568	223,200	47,228	-	545,853	6,547,953	532,930
Fees and commissions expenses	(2,522,916)	(188,972)	(89,405)	(11,042)	(11,082)	(14,966)	(2,838,383)	(258,897)
Total fees and commissions, net	2,729,188	290,596	133,795	36,186	(11,082)	530,887	3,709,570	274,033
Other operating income	2,049,297	51,656	130,757	16,794	1,673,939	20,269	3,942,712	36,939
Dividends and net income on equity investments(2)	17,612	10,982	1,827	37	239,405	(73,177)	196,686	13,498
Total operating income, net	14,125,997	1,488,854	754,860	989,420	1,503,249	584,921	19,447,301	1,642,416
Operating expenses(3)	(7,939,136)	(668,105)	(620,928)	(89,220)	(1,049,474)	(540,623)	(10,907,486)	(909,844)
Depreciation, amortization and impairment	(508,543)	(131,922)	(55,243)	(4,259)	(309,435)	(7,742)	(1,017,144)	(107,717)
Total operating expenses	(8,447,679)	(800,027)	(676,171)	(93,479)	(1,358,909)	(548,365)	(11,924,630)	(1,017,561)
Profit before income tax	5,678,318	688,827	78,689	895,941	144,340	36,556	7,522,671	624,855

(1)For further information about income from contracts with customers, see Note 25.3. Commissions.

(2)For further information see Note 25.5. Dividends and net income on equity investments.

(3)Includes salaries and employee benefits, other administration and general expenses and taxes other than income tax.

(4)In 2025, the Leases segment is presented separately as its own reportable segment. For comparative purposes, the 2023 information has been restated, as these operations were included within “All other segments” during that period.

(5)As of December 31, 2025, Banistmo S.A. was considered an asset held for sale. The profit before income tax of Banking Panama segment (discontinued operation) differs from the net income from discontinued operations because it does not include the income tax related to that segment. For more information, see Note 1. Reporting Entity, Note 2.D.12 Material Accounting Policies - Assets held for sale and discontinued operations and Note 31. Discontinued Operation.

The following table presents financial information of the total assets and liabilities by operating segment:

As of December 31, 2025
In millions of COP
	Banking<br>Colombia	Banking Panama (Discontinued operation)(1)	Banking El<br>Salvador	Banking<br>Guatemala	International<br>Banking	Leases	All other<br>segments	Total before<br>eliminations	Adjustments<br>for<br>consolidation	Total after<br>eliminations
Total assets	268,613,654	39,538,249	25,916,845	24,413,292	23,693,417	11,150,070	46,854,190	440,179,717	(60,427,337)	379,752,380
Total liabilities	241,194,742	35,059,304	23,452,205	22,331,358	21,502,643	4,849,872	2,455,417	350,845,541	(12,088,795)	338,756,746

(1) As of December 31, 2025, Banistmo S.A. was considered an asset held for sale. The profit before income tax of the Panama Banking segment (discontinued operation) differs from the net income from discontinued operations because it does not include the income tax related to that segment. For more information, see Note 1. Reporting Entity, Note 2.D.12 Material Accounting Policies - Assets held for sale and discontinued operations and Note 31. Discontinued Operation.

As of December 31, 2024
In millions of COP
	Banking<br>Colombia	Banking<br>Panama	Banking El<br>Salvador	Banking<br>Guatemala	International<br>Banking	Leases	All other<br>segments	Total before<br>eliminations	Adjustments<br>for<br>consolidation	Total after<br>eliminations
Total assets	266,515,464	45,964,767	26,670,513	27,332,834	35,272,842	10,182,907	3,378,212	415,317,539	(43,102,157)	372,215,382
Total liabilities	222,388,179	41,132,907	23,889,120	25,018,466	24,248,959	4,573,121	404,335	341,655,087	(14,023,980)	327,631,107

F-53

Table of Contents

The following table presents financial information on the investments in associates and joint ventures by operating segment:

As of December 31, 2025(1)
	Banking<br>Colombia	Banking El<br>Salvador	Leases	All other<br>segments	Total
In millions of COP
Investments in associates and joint ventures	268,110	25,555	2,041,402	976,439	3,311,506
Equity method	46,364	4,549	175,699	122,350	348,962

(1)As of December 31, 2025, Banking Panama, Banking Guatemala and International Banking did not have investments in associates and joint ventures.

As of December 31, 2024(1)
	Banking<br>Colombia	Banking El<br>Salvador	Leases	All other<br>segments	Total
In millions of COP
Investments in associates and joint ventures	205,311	27,621	1,830,884	865,168	2,928,984
Equity method	(28,130)	4,320	155,418	90,964	222,572

(1)As of December 31, 2024, Banking Panama, Banking Guatemala and International Banking did not have investments in associates and joint ventures.

For additional information related to investment in associates and joint ventures, see Note 8. Investments in associates and joint ventures.

Information about products and services

The Cibest Corporate Group does not report revenues from external customers for each product and service or each group of similar products and services, because the information is not available and the cost to develop it is excessive.

Geographic information

The following summarizes the Cibest Corporate Group’s total interest and valuation and long-lived assets attributable to Colombia and other foreign countries based on the country where the Interest and valuation was originated:

	2025		2024		2023
Geographic information	Interest and<br><br>valuation(1)	Long-lived<br><br>assets(2)	Interest and<br><br>valuation(1)	Long-lived<br><br>assets(2)	Interest and<br><br>valuation(1)	Long-lived<br><br>assets(2)
In millions of COP
Colombia	26,688,212	14,087,381	28,127,681	13,614,718	29,812,448	13,466,457
Panama	3,798,982	657,701	1,466,508	995,045	1,407,984	877,407
El Salvador	2,096,904	513,106	1,852,097	607,601	1,774,165	547,357
Guatemala	2,013,523	350,517	1,939,808	436,804	1,795,597	361,840
Bermuda	449	6,759	177	4,416	184	3,434
United States of America	77	2,678	63	4,176	55	4,805
Puerto Rico	158,629	1,553	187,913	1,552	149,541	1,297
Total	34,756,776	15,619,695	33,574,247	15,664,312	34,939,974	15,262,597
Eliminations and adjustments	(3,269,250)	860,580	(719,931)	8,453,369	(720,373)	7,000,343
Total, net	31,487,526	16,480,275	32,854,316	24,117,681	34,219,601	22,262,940

(1)Includes interest and valuation on financial instruments.

(2)Includes assets held for sale, premises and equipment, net, investment property, right-of-use assets, goodwill and intangible assets, net.

F-54

Table of Contents

NOTE 4. CASH AND CASH EQUIVALENTS

For purposes of the Consolidated Statement of Cash Flow and the Consolidated Statement of Financial Position, the following assets are considered as cash and cash equivalents:

	December 31, 2025(1)	December 31, 2024
In millions of COP
Cash and balances at central bank
Cash	7,981,486	9,439,363
Due from central banks(2)	8,762,476	7,504,135
Due from other private financial entities	5,985,138	7,778,937
Checks on hold	55,091	132,929
Remittances of domestic negotiated checks in transit	21,444	26,172
Total cash and due from banks	22,805,635	24,881,536
Money market transactions
Interbank borrowings	2,437,175	2,239,615
Reverse repurchase agreements and other similar secured loans(3)	4,673,590	5,722,948
Total money market transactions	7,110,765	7,962,563
Total cash and cash equivalents	29,916,400	32,844,099

(1)As of December 31, 2025, Banistmo S.A. was considered an asset held for sale and had cash and cash equivalents of COP 3,517,759, which were reclassified to Assets related to investments in subsidiaries held for sale. For more information, see Note 1. Reporting Entity, Note 2.D12. Significant Accounting Policies - Assets Held for Sale and Discontinued Operations, and Note 31. Discontinued Operation.

(2)According to External Resolution No. 3 of 2024 of Banco de la República de Colombia, which amends External Resolution No. 5 of 2008, Bancolombia S.A. must maintain, the equivalent of 7%, of the deposits mentioned in Article 1, paragraph (a), and the equivalent of 2.5% of its customer’s deposits with a maturity of less than 18 months (paragraph b). According to Resolution Number 177 of 2002 issued by the Guatemala Monetary Board, Grupo Agromercantil Holding through its subsidiary Banco Agromercantil de Guatemala must maintain the equivalent of 14.60% of its customer’s deposits daily balances as a legal banking reserve, represented in unrestricted deposits at the Bank of Guatemala. Additionally, circular SBP-DR-CIRCULAR-2024-0036 dated July 02, 2024, communicates the decision of the Superintendency of Banks of Panama to maintain the percentage established in the General Resolution of the Board of Directors SBP-GJD-0003-2014 dated January 28, 2014, which sets at 30.00% the minimum legal liquidity rate that Panamanian banks must maintain. Finally, in accordance with temporary rule NPBT-15, effective from July 30, 2025, to January 13, 2026, Banco Agrícola must maintain an equivalent average daily amount of its deposits and debt instruments in issue as a liquidity reserve between 1.00% and 16.00% represented in unrestricted deposits or debt instruments in issue by the Central Bank of el Salvador. Once the established term has ended, the bank continues to comply with the Technical Norm (NRP-28), issued by the Central Bank, under which it must maintain an equivalent amount between 1.00% and 18.00%, which has been in effect since June 23, 2021.

(3)The variation is mainly generated by the decrease in Reverse repurchase agreements and other similar secured loans in simultaneous operations with the Cámara de Riesgo Central de Contraparte in Colombia.

As of December 31, 2025 and 2024, there is restricted cash amounting to COP 520,105 and COP 530,924, respectively, included in other assets on the Consolidated Statement of Financial Position, which represents margin deposits pledged as collateral for derivative contracts traded through Colombian clearing houses. See Note 14. Other assets, net.

F-55

Table of Contents

NOTE 5. FINANCIAL ASSETS INVESTMENTS AND DERIVATIVES

5.1   Financial assets investments

Cibest Corporate Group has securities portfolios at fair value through profit or loss, other comprehensive income and at amortized cost are listed below, as of December 31, 2025 and 2024:

As of December 31, 2025

Financial assets investments		Measurement methodology					Total carrying<br><br>value, net(1)
	Fair value through<br>profit or loss		Fair value through other<br>comprehensive income, net		Amortized<br> cost, net
In millions of COP
Securities issued by the Colombian Government(2)		12,615,680		2,625,566		137,017	15,378,263
Securities issued by foreign governments		9,776,321		-		344,985	10,121,306
Securities issued by government entities		152,574		-		4,125,782	4,278,356
Corporate bonds		89,471		862,158		934,475	1,886,104
Securities issued by other financial institutions(3)		825,334		63,624		270,365	1,159,323
Total debt instruments(4)		23,459,380		3,551,348		5,812,624	32,823,352
Total equity securities		1,136,645		326,977		-	1,463,622
Total other financial instruments(5)		30,285		-		-	30,285
Total financial assets investments		24,626,310		3,878,325		5,812,624	34,317,259

(1)The accumulated value as of December 31, 2025, includes the effects of Banistmo S.A.'s classification as asset held for sale since December 18, 2025, which had Financial Assets Investment amounting to COP 6,346,573 that were reclassified to Assets related to investments in subsidiaries held for sale. For more information see Note 1. Reporting Entity, Note 2.D.12 Material Accounting Policies - Assets held for sale and discontinued operations and Note 31. Discontinued Operation.

(2)The increase in investments in financial assets measured at fair value through profit or loss is mostly due to the acquisition of Colombian treasury instruments (TES) by Bancolombia S.A.

(3)Includes mortgage-backed securities (TIPS) measured at fair value through profit or loss amounting to COP 93,092. For further information on TIPS’ fair value measurement see Note 30. Fair value of assets and liabilities.

(4)At December 31, 2025, Cibest Corporate Group has recognized in the Consolidated Statement of Comprehensive Income COP 34,900 related to debt instruments at fair value through OCI.

(5)Corresponds to convertible notes or agreements for the future purchase of shares, Simple Agreement for Future Equity “SAFE”, by Cibest Panamá Assets, S.A, Banagrícola S.A., Inversiones CFNS S.A.S. and Bancolombia S.A.

As of December 31, 2024

Financial assets investments		Measurement methodology					Total carrying<br>value, net
	Fair value through<br>profit or loss		Fair value through other<br>comprehensive income, net		Amortized<br> cost, net
In millions of COP
Securities issued by the Colombian Government		11,644,181		2,683,925		159,323	14,487,429
Securities issued by foreign governments		10,283,450		1,484,546		651,494	12,419,490
Corporate bonds		257,326		639,108		3,612,049	4,508,483
Securities issued by government entities		118,760		-		3,380,491	3,499,251
Securities issued by other financial institutions(1)		731,564		276,837		601,521	1,609,922
Total debt instruments(2)		23,035,281		5,084,416		8,404,878	36,524,575
Total equity securities		537,213		474,097		-	1,011,310
Total other financial instruments(3)		34,385		-		-	34,385
Total financial assets investments		23,606,879		5,558,513		8,404,878	37,570,270

(1)Includes mortgage-backed securities (TIPS) measured at fair value through profit or loss amounting to COP 142,945. For further information on TIPS’ fair value measurement see Note 30. Fair value of assets and liabilities.

F-56

Table of Contents

(2)As of December 31, 2024, Cibest Corporate Group has recognized COP 23,236 in the Consolidated Statement of Comprehensive Income related to debt instruments at fair value through OCI.

(3)Corresponds to convertible notes or agreements for the future purchase of shares, Simple Agreement for Future Equity “SAFE” , by Sistema de Inversiones y Negocios, S.A., Banagrícola S.A., Inversiones CFNS S.A.S. and Bancolombia S.A.

The following tables set forth the debt instruments portfolio by maturity:

As of December 31, 2025

	Less than 1<br>year	Between 1 and 3 years	Between 3 and 5 years	Greater than 5 years	Total
In millions of COP
Securities at fair value through profit or loss
Securities issued by the Colombian Government	2,231,675	6,294,281	2,816,527	1,273,197	12,615,680
Securities issued by foreign governments	8,104,847	984,195	268,725	418,554	9,776,321
Securities issued by other financial institutions	406,122	238,371	96,441	84,400	825,334
Securities issued by government entities	113,317	23,713	457	15,087	152,574
Corporate bonds	1,515	17,735	40,239	29,982	89,471
Subtotal	10,857,476	7,558,295	3,222,389	1,821,220	23,459,380
Fair value through other comprehensive income
Securities issued by the Colombian Government	2,625,566	-	-	-	2,625,566
Corporate bonds	-	40,566	349,647	471,945	862,158
Securities issued by other financial institutions	32,436	31,188	-	-	63,624
Subtotal	2,658,002	71,754	349,647	471,945	3,551,348
Securities at amortized cost
Securities issued by government entities	4,075,492	-	-	50,290	4,125,782
Corporate bonds	-	492,450	338,593	103,432	934,475
Securities issued by foreign governments	135,316	85,834	62,193	61,642	344,985
Securities issued by other financial institutions	64,203	82,772	38,975	84,415	270,365
Securities issued by the Colombian Government	-	44,335	60,492	32,190	137,017
Subtotal	4,275,011	705,391	500,253	331,969	5,812,624
Total debt instruments	17,790,489	8,335,440	4,072,289	2,625,134	32,823,352

F-57

Table of Contents

As of December 31, 2024

	Less than 1<br>year	Between 1 and 3 years	Between 3 and 5 years	Greater than 5 years	Total
In millions of COP
Securities at fair value through profit or loss
Securities issued by the Colombian Government	1,019,028	6,767,240	1,157,703	2,700,210	11,644,181
Securities issued by foreign governments	7,088,685	1,835,751	651,529	707,485	10,283,450
Securities issued by other financial institutions	192,039	235,209	200,251	104,065	731,564
Corporate bonds	42,395	28,019	41,022	145,890	257,326
Securities issued by government entities	33,854	82,536	2,370	-	118,760
Subtotal	8,376,001	8,948,755	2,052,875	3,657,650	23,035,281
Fair value through other comprehensive income
Securities issued by the Colombian Government	2,648,354	35,571	-	-	2,683,925
Securities issued by foreign governments	169,992	648,246	497,967	168,341	1,484,546
Corporate bonds	-	73,409	60,922	504,777	639,108
Securities issued by other financial institutions	119,479	51,275	49,744	56,339	276,837
Subtotal	2,937,825	808,501	608,633	729,457	5,084,416
Securities at amortized cost
Corporate bonds	56,847	1,086,392	847,742	1,621,068	3,612,049
Securities issued by government entities	3,330,223	-	-	50,268	3,380,491
Securities issued by foreign governments	143,911	162,996	85,772	258,815	651,494
Securities issued by other financial institutions	201,944	44,699	271,793	83,085	601,521
Securities issued by the Colombian Government	-	51,260	46,598	61,465	159,323
Subtotal	3,732,925	1,345,347	1,251,905	2,074,701	8,404,878
Total debt instruments	15,046,751	11,102,603	3,913,413	6,461,808	36,524,575

For further information related to disclosures of the fair value of securities, please see Note 30. Fair value of assets and liabilities.

Equity securities that are measured at fair value through OCI are considered strategic for Cibest Corporate Group and, thus, there is no intention to sell them in the foreseeable future and that is the main reason for using this presentation alternative.

The following table details the equity instruments designated at fair value through OCI analyzed by listing status:

Equity securities		Carrying amount
	December 31, 2025(1)		December 31, 2024
In millions of COP
Securities at fair value through OCI:
Equity securities listed in Colombia		2		2
Equity securities listed in foreign countries		73,149		76,795
Equity securities unlisted:
Asociación Gremial de Instituciones Financieras Credibanco S.A.		125,732		109,011
Transacciones y Transferencias, S. A.		35,116		55,401
Compañía de Procesamiento de Medios de Pago Guatemala (Bahamas), S. A.		34,035		18,913
Cámara de Riesgo Central de Contraparte de Colombia S.A.		20,406		17,385
Pexton Holdings Limited		8,917		-
Suncolombia SAS		5,636		-
Derecho Fiduciario Inmobiliaria Cadenalco		4,260		4,212
Telered S.A.(1)		-		160,761
Others(1)		19,724		31,617
Total equity securities at fair value through OCI		326,977		474,097

(1)The accumulated value as of December 31, 2025, includes the effects of Banistmo S.A.'s classification as asset held for sale since December 18, 2025. For more information see Note 1. Reporting Entity, Note 2.D.12 Material Accounting Policies - Assets held for sale and discontinued operations and Note 31. Discontinued Operation.

F-58

Table of Contents

Cibest Corporate Group has recognized in the Consolidated Statement of Comprehensive Income COP 20,020 in 2025, COP 28,572 in 2024 and COP 10,898 in 2023 related to equity securities and trust funds at fair value through OCI. See Consolidated Statement of Comprehensive Income.

During 2025, impairment loss was recognized on equity securities for COP 537. Dividends received from equity investments at fair value through OCI held as of December 31, 2025, 2024 and 2023 amounted to COP 8,397, COP 6,872 and COP 6,565, respectively. See Note 25.5 Dividends and net income on equity investments.

Equity investments do not have a specific maturity date; therefore, they are not included in the maturity detail.

The detail of the securities pledged as collateral as of December 31, 2025, and 2024 is as follows:

As of December 31, 2025

Pledged financial assets	Term	Security pledged	Carrying amount
In millions of COP
Investments pledged as collateral in money market
Securities issued by foreign governments	Up to 3 months	Time deposits	233,712
Securities issued by foreign governments	Between 3 and 6 months	Time deposits	48,367
Securities issued by foreign governments	Between 6 and 12 months	Time deposits	151,841
Securities issued by foreign governments	Between 6 and 12 months	Foreign issuers	1,900
Securities issued by the Colombian Government	Greater than 12 months	TES - Treasury instruments	90,558
Subtotal investments pledged as collateral in money market			526,378
Investments pledged as collateral in derivative operations
Securities issued by the Colombian Government	Between 6 and 12 months	TES - Treasury instruments	315,314
Securities issued by the Colombian Government	Greater than 12 months	TES - Treasury instruments	1,687,494
Subtotal investments pledged as collateral in derivative operations			2,002,808
Total securities pledged as collateral			2,529,186

As of December 31, 2024

Pledged financial assets	Term	Security pledged	Carrying amount
In millions of COP
Investments pledged as collateral in money market
Securities issued by foreign governments	Up to 3 months	Time deposits	43,424
Securities issued by foreign governments	Between 6 and 12 months	Bonds	26,314
Securities issued by foreign governments	Between 6 and 12 months	Time deposits	109,792
Securities issued by foreign governments	Greater than 12 months	Bonds	48,841
Securities issued by foreign governments	Greater than 12 months	Time deposits	166,849
Securities issued by the Colombian Government	Greater than 12 months	TES - Treasury instruments	491,472
Securities issued by other financial institutions	Between 3 and 6 months	Time deposits	5,037
Securities issued by other financial institutions	Between 6 and 12 months	Time deposits	4,019
Securities issued by other financial institutions	Greater than 12 months	Bonds	1,876
Securities issued by other financial institutions	Greater than 12 months	Time deposits	29,058
Subtotal investments pledged as collateral in money market			926,682
Investments pledged as collateral in derivative operations
Securities issued by the Colombian Government	Up to 3 months	TES - Treasury instruments	68,903
Securities issued by the Colombian Government	Between 3 and 6 months	TES - Treasury instruments	414,296
Securities issued by the Colombian Government	Greater than 12 months	TES - Treasury instruments	200,561
Securities issued by foreign governments	Between 6 and 12 months	Foreign issuers	2,229
Subtotal investments pledged as collateral in derivative operations			685,989
Total securities pledged as collateral			1,612,671

F-59

Table of Contents

The following table shows the breakdown of the changes in the gross carrying amount of the debt securities at fair value through other comprehensive income and amortized cost, in order to explain their significance to the changes in the loss allowance for the same portfolio as discussed above:

As of December 31, 2025

Debt instruments portfolio measure at fair value through OCI and amortized cost	Stage 1	Stage 2	Stage 3	Total(1)
In millions of COP
Gross carrying amount as at 1 January 2025	12,998,652	454,065	36,577	13,489,294
Reclassification to assets held for sale(1)	(4,188,943)	(100,495)	(36,577)	(4,326,015)
Transfer from stage 1 to stage 2(2)	(137,017)	137,017	-	-
Transfer from stage 2 to stage 1(3)	13,435	(13,435)	-	-
Sales and maturities	(6,740,567)	-	-	(6,740,567)
Purchases and renewals	4,570,660	2,490,647	-	7,061,307
Valuation and payments	(50,949)	135,439	-	84,490
Foreign Exchange	(152,209)	(52,328)	-	(204,537)
Gross carrying amount as at 31 December 2025	6,313,062	3,050,910	-	9,363,972

(1)The accumulated value as of December 31, 2025, includes the effects of Banistmo S.A.'s classification as asset held for sale since December 18, 2025. For more information see Note 1. Reporting Entity, Note 2.D.12 Material Accounting Policies - Assets held for sale and discontinued operations and Note 31. Discontinued Operation.

(2)Stage transfer in Colombian treasury instruments (TES) by Bancolombia Panamá S.A. and Bancolombia Puerto Rico Internacional Inc.

(3)Stage transfer in foreign issuers by Bancolombia Panamá S.A. and Bancolombia Puerto Rico Internacional Inc.

As of December 31, 2024

Debt instruments portfolio measure at fair value through OCI and amortized cost	Stage 1	Stage 2	Stage 3	Total
In millions of COP
Gross carrying amount as at 1 January 2024	12,760,342	205,133	30,784	12,996,259
Transfer from stage 1 to stage 2(1)	(294,440)	294,440	-	-
Transfer from stage 2 to stage 1(2)	12,678	(12,678)	-	-
Sales and maturities	(7,928,390)	(171,505)	-	(8,099,895)
Purchases and renewals	7,975,932	129,455	-	8,105,387
Valuation and payments	(125,564)	3,806	984	(120,774)
Foreign Exchange	598,094	5,414	4,809	608,317
Gross carrying amount as at 31 December 2024	12,998,652	454,065	36,577	13,489,294

(1)Stage transfer in corporate bonds by Banistmo S.A., Bancolombia Puerto Rico Internacional Inc and Bancolombia Panamá S.A.

(2)Stage transfer in corporate bonds by Banagrícola S.A.

The following table shows the impairment detail for the debt instruments portfolio using the expected credit losses model:

As of December 31, 2025

Concept	Stage 1	Stage 2	Total(1)
In millions of COP
Securities at amortized cost, net	5,387,280	425,344	5,812,624
Carrying amount	5,399,656	429,664	5,829,320
Loss allowance	(12,376)	(4,320)	(16,696)
Securities at fair value through other comprehensive income(2)	925,782	2,625,566	3,551,348
Total debt instruments portfolio measure at fair value through OCI and amortized cost	6,313,062	3,050,910	9,363,972

F-60

Table of Contents

(1)The accumulated value as of December 31, 2025, includes the effects of Banistmo S.A.'s classification as asset held for sale since December 18, 2025. For more information see Note 1. Reporting Entity, Note 2.D.12 Material Accounting Policies - Assets held for sale and discontinued operations and Note 31. Discontinued Operation.

(2)Loss allowance of investments at fair value through OCI corresponds to COP 4,174 classified in stage 1 to COP 1,757 and in stage 2 to COP 2,417; the loss allowance decrease in relation to 2024 from COP (2,338) is due to the acquisition of instruments from COP 2,874, and the decrease from COP (3,116) is due because Banistmo S.A. was considered as assets held for sale, and from COP (1,397) in sales and maturities and COP (699) in net provisions recognized during the period.

As of December 31, 2024

Concept	Stage 1	Stage 2	Stage 3	Total
In millions of COP
Securities at amortized cost, net	7,975,158	393,143	36,577	8,404,878
Carrying amount	8,008,567	401,263	53,985	8,463,815
Loss allowance	(33,409)	(8,120)	(17,408)	(58,937)
Securities at fair value through other comprehensive income(1)	5,023,494	60,922	-	5,084,416
Total debt instruments portfolio measure at fair value through OCI and amortized cost	12,998,652	454,065	36,577	13,489,294

(1)Loss allowance of investments at fair value through OCI corresponds to COP 6,513 classified in stage 1 to COP 5,734.

The following table sets forth the changes in the allowance for debt instruments measured at amortized cost:

As of December 31, 2025

Concept	Stage 1	Stage 2	Stage 3	Total(1)
In millions of COP
Loss allowance of January 1, 2025	33,409	8,120	17,408	58,937
Reclassification to assets held for sale(1)	(21,583)	(2,413)	(17,408)	(41,404)
Transfer from stage 1 to stage 2(2)	(1,568)	1,568	-	-
Transfer from stage 2 to stage 1(3)	14	(14)	-	-
Sales and maturities	(7,690)	-	-	(7,690)
New debt instruments purchased	10,252	-	-	10,252
Net provisions recognized during the period	15	(2,262)	-	(2,247)
Foreign Exchange(4)	(473)	(679)	-	(1,152)
Loss allowance of December 31, 2025	12,376	4,320	-	16,696

(1)The accumulated value as of December 31, 2025, includes the effects of Banistmo S.A.'s classification as asset held for sale since December 18, 2025. For more information see Note 1. Reporting Entity, Note 2.D.12 Material Accounting Policies - Assets held for sale and discontinued operations and Note 31. Discontinued Operation.

(2)Stage transfer in Colombian treasury instruments (TES) by Bancolombia Panamá S.A. and Bancolombia Puerto Rico Internacional Inc.

(3)Stage transfer in foreign issuers by Bancolombia Panamá S.A. and Bancolombia Puerto Rico Internacional Inc.

(4)The decrease is due to the variation in the market representative rate during the year 2025.

F-61

Table of Contents

As of December 31, 2024

Concept	Stage 1	Stage 2	Stage 3	Total
In millions of COP
Loss allowance of January 1, 2024	29,939	11,913	13,951	55,803
Transfer from stage 1 to stage 2(1)	(3,213)	3,213	-	-
Transfer from stage 2 to stage 1(2)	298	(298)	-	-
Sales and maturities	(11,187)	(5,895)	-	(17,082)
New debt instruments purchased(3)	13,296	3,114	-	16,410
Net provisions recognized during the period	1,465	(4,482)	1,214	(1,803)
Foreign Exchange(4)	2,811	555	2,243	5,609
Loss allowance of December 31, 2024	33,409	8,120	17,408	58,937

(1)Stage transfer in corporate bonds by Banistmo S.A., Bancolombia Puerto Rico Internacional Inc and Bancolombia Panamá S.A.

(2)Stage transfer in corporate bonds by Banagrícola S.A.

(3)Impairment is mainly in securities issued by corporate bonds in Banistmo S.A., Bancolombia Panamá S.A. and Bancolombia S.A. and government entities by Bancolombia S.A.

(4)The increase is due to the variation in the market representative rate during the year 2024.

As of December 31, 2023

Concept	Stage 1	Stage 2	Stage 3	Total
In millions of COP
Loss allowance of January 1, 2023	29,881	35,020	-	64,901
Transfer from stage 1 to stage 3(1)	(13,951)	-	13,951	-
Transfer from stage 2 to stage 1(1)	129	(129)	-	-
Sales and maturities	(9,459)	-	-	(9,459)
New debt instruments purchased	10,497	-	-	10,497
Net provisions recognized during the period	19,030	(17,882)	-	1,148
Foreign Exchange	(6,188)	(5,096)	-	(11,284)
Loss allowance of December 31, 2023	29,939	11,913	13,951	55,803

(1) Stage transfer in corporate bonds by Banistmo S.A.

5.2   Derivative financial instruments

Cibest Corporate Group's derivative activities do not give rise to significant open positions in portfolios of derivatives. Cibest Corporate Group enters into derivative transactions to facilitate customer business, for hedging purposes and arbitrage activities, such as forwards, options or swaps where the underlying are exchange rates, interest rates and securities.

A swap agreement is a contract between two parties to exchange cash flows based on specified underlying notional amounts, assets and/or indices. Financial futures and forward settlement contracts are agreements to buy or sell a quantity of a financial instrument (including another derivative financial instrument), index, currency or commodity at a predetermined rate or price during a period or at a date in the future. Futures and option contracts are standardized agreements for future delivery, traded on exchanges that typically act as a platform.

For further information related to the objectives, policies and processes for managing the Cibest Corporate Group’s risk, please see Risk Management.

F-62

Table of Contents

The following table sets forth the carrying values of Cibest Corporate Group’s derivatives by type of risk as of December 31, 2025 and 2024:

Derivatives	December 31, 2025(1)	December 31, 2024
In millions of COP
Forwards
Assets
Foreign exchange contracts	2,895,452	1,084,830
Equity contracts	59,140	51,645
Subtotal assets	2,954,592	1,136,475
Liabilities
Foreign exchange contracts	2,719,599	972,295
Equity contracts	8,163	1,367
Subtotal liabilities	2,727,762	973,662
Total forwards(2)	226,830	162,813
Swaps
Assets
Foreign exchange contracts	1,068,740	1,463,256
Interest rate contracts	278,454	236,033
Subtotal assets	1,347,194	1,699,289
Liabilities
Foreign exchange contracts	1,268,754	1,332,431
Interest rate contracts	371,179	291,068
Subtotal liabilities	1,639,933	1,623,499
Total swaps(3)	(292,739)	75,790
Options
Assets
Foreign exchange contracts	116,077	102,378
Subtotal assets	116,077	102,378
Liabilities
Foreign exchange contracts	146,935	82,482
Subtotal liabilities	146,935	82,482
Total options	(30,858)	19,896
Derivative assets	4,417,863	2,938,142
Derivative liabilities	4,514,630	2,679,643

(1)The accumulated amount as of December 31, 2025 includes the effects of the classification of Banistmo S.A. as an asset held for sale since December 18, 2025, which recorded derivatives totaling COP 17,932 and derivative liabilities of

F-63

Table of Contents

COP 19,379. For more information, see Note 1. Reporting Entity; Note 2.D12. Significant Accounting Policies – Assets Held for Sale and Discontinued Operations; and Note 31. Discontinued Operation.

(2)At December 31, 2025, mainly at Bancolombia, there is a increase in both the active and passive forwards contracts compared to those in effect as December 31, 2024, due to volatility in the exchange rate, pricing nodes, and curves for 2025

(3)At December 31, 2025, mainly at Bancolombia, there is a variation in active and passive swap exposures due to volatility in the exchange rate, pricing nodes, and market expectations for 2026

The following table sets forth the remaining contractual life of the derivatives portfolio:

As of December 31, 2025

	Forwards	Swaps	Options	Total
In millions of COP
Assets	2,954,592	1,347,194	116,077	4,417,863
Less than 1 year	2,875,220	317,806	106,506	3,299,532
Between 1 and 3 years	79,361	477,666	9,571	566,598
Greater than 3 years	11	551,722		551,733
Liabilities	2,727,762	1,639,933	146,935	4,514,630
Less than 1 year	2,672,446	373,109	133,948	3,179,503
Between 1 and 3 years	55,311	717,476	12,987	785,774
Greater than 3 years	5	549,348		549,353

As of December 31, 2024

	Forwards	Swaps	Options	Total
In millions of COP
Assets	1,136,475	1,699,289	102,378	2,938,142
Less than 1 year	1,105,226	440,817	96,891	1,642,934
Between 1 and 3 years	31,249	651,770	5,487	688,506
Greater than 3 years		606,702		606,702
Liabilities	973,662	1,623,499	82,482	2,679,643
Less than 1 year	943,804	376,346	76,537	1,396,687
Between 1 and 3 years	29,858	604,473	5,945	640,276
Greater than 3 years		642,680		642,680

Collateral for derivatives

The table below presents the collateral amounts posted under derivatives contracts as of December 31, 2025 and 2024:

	December 31, 2025	December 31, 2024
In millions of COP
Collateral granted	2,502,088	1,157,880
Collateral received	764,034	378,767

F-64

Table of Contents

Day one gains or (losses)

If an asset has been acquired or a liability has been assumed in a market transaction, it could be assumed that the transaction price is the fair value of the asset or liability. However, the fair value of the financial asset or liability at the time of initial recognition may be different from the transaction price, because the fair value includes variables in its valuation technique that include market information, such as interest rate yield curves, currencies rates, indicators, default factors among others. When the values are not equal, the asset or liability must be measured at fair value and the difference between the transaction price and the fair value must be recognized as follows:

•If fair value is evidenced by Level 1 inputs or is based on a valuation technique that uses only observable market data, Cibest Corporate Group must recognize the difference as a gain or loss on initial recognition directly in the income statement.

•In all other circumstances, the entire day 1 gain or loss is deferred and is recognized in the income statement over the life of the transaction.

The table below presents the unrecognized gains or (losses) for derivatives trading at the initial moment, due to use of valuation techniques for which not all inputs were observable market data:

As of December 31, 2025

	Forward	Swaps	Options	Total
In millions of COP
Balance at January 1, 2025	42,974	(23,207)	36,437	56,204
New trades	551,506	94,684	127,482	773,672
Amortization	(528,355)	(35,451)	(136,604)	(700,410)
Early cancellations and level transfers	(6,877)	(34,993)	(6,381)	(48,251)
Balance at December 31, 2025	59,248	1,033	20,934	81,215

As of December 31, 2024

	Forward	Swaps	Options	Total
In millions of COP
Balance at January 1, 2024	36,289	(13,630)	63,068	85,727
New trades	702,001	(978)	117,125	818,148
Amortization	(687,024)	(8,767)	(130,767)	(826,558)
Early cancellations and level transfers	(8,292)	168	(12,989)	(21,113)
Balance at December 31, 2024	42,974	(23,207)	36,437	56,204

Offsetting of derivatives

Cibest Corporate Group enters into International Swaps and Derivatives Association (ISDA) master netting agreements or similar agreements with substantially all of the Cibest Corporate Group’s derivative counterparties. Where legally enforceable, and depending on the Bank’s intention, these master netting agreements give the Cibest Corporate Group’s, in the event of default by the counterparty, the right to liquidate securities and cash equivalents held as collateral and to offset receivables and payables with the same counterparty.

The table below presents derivative instruments subject to enforceable master netting agreements and other similar agreements but not offset in the Consolidated Statement of Financial Position as of December 31, 2025 and 2024 by derivative and by risk:

F-65

Table of Contents

As of December 31, 2025

	Derivatives Assets	Derivatives Liabilities
In millions of COP
Over-the-counter
Foreign exchange contracts
Forwards	2,895,452	2,719,599
Swaps	1,068,740	1,268,754
Options	116,077	146,935
Interest rate contracts
Swaps	278,454	371,179
Equity contracts
Forwards	59,140	8,163
Gross derivative assets/liabilities	4,417,863	4,514,630
Offsetting of derivatives
Derivative financial instruments in the Consolidated Statement of Financial Position	4,417,863	4,514,630
Master netting agreements	(4,417,863)	(4,046,024)
Collateral received/paid		(468,606)
Total derivative financial instruments assets/ liabilities before collateral and Master netting agreements

As of December 31, 2024

	Derivatives Assets	Derivatives Liabilities
In millions of COP
Over-the-counter
Foreign exchange contracts
Forwards	1,084,830	972,295
Swaps	1,463,256	1,332,431
Options	102,378	82,482
Interest rate contracts
Swaps	236,033	291,068
Equity contracts
Forwards	51,645	1,367
Gross derivative assets/liabilities	2,938,142	2,679,643
Offsetting of derivatives	-	-
Derivative financial instruments in the Consolidated Statement of Financial Position	2,938,142	2,679,643
Master netting agreements	(2,540,752)	(2,679,643)
Collateral received/paid	(378,767)
Total derivative financial instruments assets/ liabilities before collateral and Master netting agreements	18,623

For further information about offsetting of other financial assets and liabilities see Note 16. Interbank deposits and repurchase agreements and other similar secured borrowing.

F-66

Table of Contents

5.3 Hedge Accounting

Cibest Corporate Group is exposed to certain risks relating to its ongoing business operations. The main risks managed through derivative instruments are exchange rate risk and interest rate risk. Details of the covered risks are as follows:

Exchange rate risk

Exchange rate risk is the risk that the fair value or future cash flows of an exposure fluctuate due to changes in exchange rates. Cibest Corporate Group exposure to the risk of exchange rate fluctuations primarily relates to its operational activities (when revenues or expenses are denominated in a foreign currency) and Cibest Corporate Group net investments in foreign subsidiaries. The hedging strategy of this exposure may occur naturally through the interaction of balance sheet accounts, that is, with strategic decisions oriented toward asset and liability accounts in the foreign currency banking book, and through the trading of foreign exchange financial derivatives.

When a derivative is contracted for the purpose of hedging exchange rate risk, Cibest Corporate Group negotiates the terms of the derivative seeking to mitigate the adverse financial effects of the covered exposure according to market conditions. For forecasted transaction hedges, the derivative covers the exposure period from the moment cash flows from transactions are forecasted until the settlement of the resulting receivable or payable denominated in foreign currency.

Among the financial derivatives most commonly used to manage exchange rate risk are foreign exchange forwards and Cross Currency Swaps (CCS). When these are designated as hedging instruments, they can be classified as cash flow hedges or fair value hedges under the IFRS 9 accounting guidelines.

Cibest Corporate Group determines the existence of an economic relationship between the hedging instrument and the hedged item based on the currency, amount, and timing of their respective cash flows. The effectiveness of the hedge is assessed at the start of the hedging relationship and through periodic prospective effectiveness assessments to ensure that there is an economic relationship between the hedged item and the hedging instrument. Cibest Corporate Group evaluates whether the designated derivative in each hedging relationship is expected to be, and has been, effective in offsetting changes in the cash flows of the hedged item using the hypothetical derivative method.

For each hedging relationship, the objective is to maintain a 1:1 ratio, seeking to offset exchange rate variation in cash flows.

The hedge ratio will be determined by comparing the notional value, in accordance with the definition of risk and the conditions established for the structuring. However, uncertainty about the final amount until the time of the transaction may lead to deviations, which will be recognized in the result as hedge ineffectiveness, as appropriate.

In these hedge relationships, the main sources of ineffectiveness are:

•The effect of the credit risk of counterparties and Cibest Corporate Group itself on the fair value of foreign exchange swap and forward contracts, which are not reflected in the change in the fair value of the cash flows hedged attributable to changes in exchange rates; and

•Changes in the timing of recognition in the financial statements of the anticipated transactions regarding the nominal value and the exchange rate of their settlement.

Interest rate risk

Interest rate risk is the risk that the fair value or future cash flows of a financial instrument fluctuate due to changes in market interest rates. Cibest Corporate Group exposure to changes in market interest rates primarily relates to treasury operations and the banking book, where a mismatch between assets and liabilities in duration, indexing, repricing, and maturity creates an asymmetry that could have repercussions on financial results.

Coverage of this exposure may occur naturally through the interaction of balance sheet accounts, that is, with strategic decisions oriented toward asset and liability accounts in the banking book, and through the trading of interest rate financial derivatives, among which we primarily have Swaps (IRS: Interest Rate Swap), where flows between fixed and variable rates (market index) are agreed upon.

Cibest Corporate Group determines the existence of an economic relationship between the hedging instrument and the hedged item based on reference interest rates, terms, pricing review dates, maturities, and the notional amounts.

F-67

Table of Contents

When a derivative is contracted for the purpose of hedging interest rate risk, Cibest Corporate Group negotiates the terms of the derivative seeking to mitigate the adverse financial effects of the covered exposure according to market conditions. To test the effectiveness of the hedge, Cibest Corporate Group uses the hypothetical derivative method and compares the changes in the fair value of the hedging instrument against the changes in the fair value of the hedged item attributable to the covered risk.

For each hedging relationship, the objective is to maintain a ratio close to 1:1, so that changes in the fair value of the hedged item are offset by changes in interest rates.

The hedge ratio will be determined by comparing the notional value or sensitivity, depending on the definition of the risk and the conditions established for the structuring. However, factors such as market depth, the trading conditions of the hedging instruments, and natural variations in the hedged item may lead to differences in sensitivities and nominal values. These effects will be recognized in the result as appropriate.

Hedge ineffectiveness may arise from:

•The difference between the variable rate index present in the hedged item and the index used in the derivative instruments, according to market convention (Basis Risk).

•Differences in the settlement dates of the cash flows of the hedged item and the hedging instrument, and

•The credit risk of counterparties impacts the movements of the fair value of the hedging instrument and the hedged item differently.

Cibest Corporate Group risk management strategy and details of its application are further elaborated in the Risk Management - Market Risk section.

As of November 2025, cash flow and fair value hedging operations are carried out in Cibest Corporate Group, the details of derivatives designated as hedging instruments according to the type of hedge and covered risk are provided below:

1.Cash flow hedges

As of December 31, 2025, on the Consolidated Statement of Financial Position, Cibest Corporate Group held the following instruments to hedge exposures to changes in foreign currency and interest rates which have a maturity of less than one year:

As of December 31, 2025

	Maturity	Total
In millions of COP (Except average rate)
Foreign currency risk
Forward exchange contracts
Notional amount of hedging instruments	169,069	169,069
Average rate of hedging instruments (COP/)	4,047

All values are in US Dollars.

As of December 31, 2024

F-68

Table of Contents

	Maturity		Total
In millions of COP (Except average rate)
Foreign currency risk
Forward exchange contracts
Notional amount of hedging instruments	6,614		6,614
Average rate of hedging instruments (COP/)	4,496
Interest rate risk
Interest rate swaps
Notional amount of hedging instruments	188,000		188,000
Average fixed interest rate	8.63	%

All values are in US Dollars.

The impacts of the hedging instrument on the Consolidated Statement of Financial Position as of December 31, 2025, are as follows:

As of December 31, 2025

		Notional amount		Carrying amount		Line item in the Consolidated Statement of Financial Position	Change in fair value used for measuring ineffectiveness for the period
	Assets		Liabilities
In millions of COP
Foreign currency risk
Forward exchange contracts(1)		169,069		-	-	Derivative financial instruments	(5,587)
Interest rate risk
Interest rate swaps(1)		-		-	-	Derivative financial instruments	-

As of December 31, 2024

		Notional amount		Carrying amount		Line item in the Consolidated Statement of Financial Position	Change in fair value used for measuring ineffectiveness for the period
	Assets		Liabilities
In millions of COP
Foreign currency risk
Forward exchange contracts(1)		6,614		-	-	Derivative financial instruments	(65)
Interest rate risk
Interest rate swaps(1)		188,000		-	-	Derivative financial instruments	281

(1) The net balance between the rights and obligations of derivatives negotiated through risk chambers (or novated therein) is zero, given their daily clearing and settlement.

The impacts of hedged items on the Consolidated Statement of Financial Position as of December 31, 2025, are as follows:

F-69

Table of Contents

As of December 31, 2025

	Change in fair value used for measuring ineffectiveness	Cash flow hedge reserve (OCI)	Balances remaining in the cash flow hedge reserve from hedging relationships for which hedge accounting is no longer applied
In millions of COP
Foreign currency risk
Forecast transactions	5,587	5,587	-
Interest rate risk
Deposits	-	-	-

As of December 31, 2024

	Change in fair value used for measuring ineffectiveness	Cash flow hedge reserve (OCI)	Balances remaining in the cash flow hedge reserve from hedging relationships for which hedge accounting is no longer applied
In millions of COP
Foreign currency risk
Forecast transactions	65	(65)	-
Interest rate risk
Deposits	(298)	281	-

The effects of the cash flow hedge in the Consolidated Statement of Income and Consolidated Statement of Comprehensive Income as of December 31, 2025, are as follows:

As of December 31, 2025

	Total hedging gain/(loss) recognized in OCI	Ineffectiveness recognized in profit or loss	Line item in the Consolidated Statement of Income that includes the recognized hedge ineffectiveness	Amount reclassified from OCI to profit or loss	Line item in the Consolidated Statement of Income that includes the reclassification adjustment
In millions of COP
Foreign currency risk
Forecast transactions	(6,082)	47	Other operating income	513	Other administrative and general expenses
Interest rate risk
Deposits	135	-	Other operating income	(416)	Interest expense

F-70

Table of Contents

As of December 31, 2024

	Total hedging gain/(loss) recognized in OCI	Ineffectiveness recogniszed in profit or loss	Line item in the Consolidated Statement of Income that includes the recognized hedge ineffectiveness	Amount reclassified from OCI to profit or loss	Line item in the Consolidated Statement of Income that includes the reclassification adjustment
In millions of COP
Foreign currency risk
Forecast transactions	(65)	-	Other operating income	-	Other administrative and general expenses
Interest rate risk
Deposits	416	-	Other operating income	(135)	Interest expense

Set out below is the reconciliation of each component of equity and the analysis of Other Comprehensive Income as of December 31, 2025:

As of December 31, 2025

	Foreign currency risk	Interest rate risk	Total
In millions of COP
As of January 1, 2025			-
Total hedging (loss)/gain recognized in OCI	(6,082)	135	(5,947)
Amount reclassified to profit or loss	560	(416)	144
Amount included in the cost of nonfinancial items	-	-	-
Total cash flow hedging	(5,522)	(281)	(5,803)
Income tax	(26)	113	87
As of December 31, 2025	(5,548)	(168)	(5,716)

As of December 31, 2024

	Foreign currency risk	Interest rate risk	Total
In millions of COP
As of January 1, 2025			-
Total hedging (loss)/gain recognized in OCI	(65)	416	351
Amount reclassified to profit or loss	-	(135)	(135)
Amount included in the cost of nonfinancial items	-	-	-
Total cash flow hedging	(65)	281	216
Income tax	26	(113)	(87)
As of December 31, 2025	(39)	168	129

2. Fair Value Hedges

As of December 31, 2025 and 2024, Cibest Corporate Group maintained the following instruments to hedge exposures to foreign currency changes and interest rates:

F-71

Table of Contents

As of December 31, 2025

		Maturity
	Less than 1 year		1 to 3 years			3 to 5 years			More than 5 years			Total
In millions of COP
Interest rate risk
Interest rate swaps
Notional amount		12,363,000			-			1,813,500			-			14,176,500
Average fixed interest rate		8.76		%	-		%	8.6		%	-		%

As of December 31, 2024

		Maturity
	Less than 1 year		1 to 3 years			3 to 5 years			More than 5 years			Total
In millions of COP
Interest rate risk
Interest rate swaps
Notional amount		-			134,000			-			-			134,000
Average fixed interest rate		-		%	8.22		%	-		%	-		%

The impacts of the hedging instrument on the Consolidated Statement of Financial Position as of December 31, 2025, is as follows:

As of December 31, 2025

		Notional amount		Carrying amount		Line item in the Consolidated Statement of Financial Position	Change in fair value used for measuring ineffectiveness for the period
	Assets		Liabilities
In millions of COP
Interest rate risk
Interest rate swaps(1)		14,176,500		-	-	Derivative financial instruments	160,036

As of December 31, 2024

		Notional amount		Carrying amount		Line item in the Consolidated Statement of Financial Position	Change in fair value used for measuring ineffectiveness for the period
	Assets		Liabilities
In millions of COP
Interest rate risk
Interest rate swaps(1)		134,000		-	-	Derivative financial instruments	(1,044)

(1) The net balance between the rights and obligations of derivatives negotiated through risk chambers (or novated therein) is zero, given their daily clearing and settlement. The instrument has a maturity of 1 to 3 years at an average fixed interest rate of —%, for further details on maturity, see Note 15 Deposits by customers.

The impacts of hedged items on the Consolidated Statement of Financial Position as of December 31, 2025, is as follows:

F-72

Table of Contents

As of December 31, 2025

	Carrying amount	Accumulated fair value adjustments	Line item in the Consolidated Statement of Financial Position	Change in fair value used for measuring ineffectiveness for the period	Accumulated amount of fair value hedge adjustments remaining in the Statement of Financial Position for any hedged items that have ceased to be adjusted for hedging gains and losses
In millions of COP
Interest rate risk
Deposits	15,670,372	(160,765)	Deposits by customers	160,765	-

As of December 31, 2024

	Carrying amount	Accumulated fair value adjustments	Line item in the Consolidated Statement of Financial Position	Change in fair value used for measuring ineffectiveness for the period	Accumulated amount of fair value hedge adjustments remaining in the Statement of Financial Position for any hedged items that have ceased to be adjusted for hedging gains and losses
In millions of COP
Interest rate risk
Deposits	128,454	(963)	Deposits by customers	963	-

The effects of the cash flow hedge in the Consolidated Statement of Income and Consolidated Statement of Comprehensive Income as of December 31, 2025, is as follows:

As of December 31, 2025

	Ineffectiveness recognized in profit or loss	Line item in the Consolidated Statement of Income that includes the recognized hedge ineffectiveness
In millions of COP
Interest rate risk
Deposits	729	Other operating income

As of December 31, 2024

	Ineffectiveness recognized in profit or loss	Line item in the Consolidated Statement of Income that includes the recognized hedge ineffectiveness
In millions of COP
Interest rate risk
Deposits	(81)	Other operating income

F-73

Table of Contents

3. Hedges of a net asset in a foreign operation

Grupo Cibest S.A. uses hedge accounting for net assets in foreign operations with non-derivative instruments and has designated USD528,000 in debt securities issued as hedging instruments. The purpose of this transaction is to protect Grupo Cibest S.A from exchange rate risk (USD/COP) for an amount equivalent to the net assets of the subsidiaries Bancolombia Panama S.A., Bancolombia Puerto Rico Internacional Inc. and Succursal Panama, whose financial information is expressed in dollars.

The book value and covered portion of the investment are listed below:

			December 31, 2024
	Net assets in foreign operations not hedged	Net assets in foreign operations	Net assets in foreign operations covered	Net assets in foreign operations not hedged	Net assets in foreign operations
In thousands of
Banistmo S.A. (1)	-	-	884,544	1,723,889	2,608,433
Bancolombia Panamá S.A. (2)	97,470	384,470	-	-	-
Bancolombia Puerto Rico Internacional Inc. (2)	45,481	186,481	-	-	-
Sucursal Panamá (2)	12,124	112,124	-	-	-
Total	155,075	683,075	884,544	1,723,889	2,608,433

All values are in US Dollars.

(1) In May 2025, the partial spin-off of assets and liabilities from Bancolombia S.A. to Grupo Cibest S.A. was completed. In this transaction, Banistmo S.A. was spun off to Grupo Cibest S.A. As a result, the hedge accounting of the net assets of a foreign operation on Banistmo was completely discontinued.

(2)As of May 2025, subordinated bonds maturing in 2027 and 2034 were designated as hedging instruments for the net assets of a foreign operation in Bancolombia Panama, Bancolombia Puerto Rico, and the Panama Branch, with the aim of mitigating the impact of exchange rate differences on the financial statements of the Cibest Consolidated Group.

The following is a breakdown of the hedging instruments for net foreign investment:

As of December 31, 2025

Debt securities issued designated as a hedging instrument
In thousands of
Opening date	Rate	Principal balance	Designated capital as a hedged instrument
18/10/2017	7.03%	461,707	428,000
24/06/2024	8.82%	800,000	100,000
Total debt securities issued		1,261,707	528,000

All values are in US Dollars.

As of December 31, 2024

Debt securities issued designated as a hedging instrument
In thousands of
Opening date	Rate	Principal balance	Designated capital as a hedged instrument
18/10/2017	7.03%	461,707	355,339
18/12/2019	4.68%	800,000	529,205
Total debt securities issued		1,261,707	884,544

All values are in US Dollars.

During 2024, Group Cibest made advance payments on bonds maturing in 2025, 2027, and 2029 for a total of USD1,320,327; of this amount, USD1,036,695 was part of the coverage ratio for net assets abroad, deciding to discontinue

F-74

Table of Contents

in the same proportion. On the other hand, the Bank issued bonds in June, maturing in 2034, for a value of USD800,000; of this issue, a total of USD529,205 was designated as coverage in December. See Note 18. Debt securities issued.

Measurement of effectiveness and ineffectiveness

A hedge is considered effective if, at the beginning of the period and in subsequent periods, changes in fair value or cash flows attributable to the hedged risk during the period for which the hedge has been designated are offset.

The Cibest Consolidated Group has documented the effectiveness tests for the hedge. The hedge is considered fully effective, since the critical terms and risks of the obligations serving as the hedging instrument are identical to those of the primary position being hedged. The effectiveness of the hedge is measured before taxes.

Gains or losses on the translation of Banistmo's financial statements are recognized in the Consolidated Statement of Comprehensive Income. Consequently, the exchange difference related to the translation of debt securities issued and designated as hedges is recognized directly in the Consolidated Statement of Comprehensive Income. As a result of the revaluation of the Colombian peso against the US dollar, the foreign currency translation adjustment corresponding to hedging instruments as of December 31, 2025 was COP 364,414, and as of December 31, 2024 was COP (742,930)

For further information, see Consolidated Statement of Comprehensive Income and Note 18. Debt securities issued.

F-75

Table of Contents

NOTE 6. LOANS AND ADVANCES TO CUSTOMERS, NET

Loans and financial leasing operating portfolio

The following is the composition of the loans and financial leasing operations portfolio, net as of December 31, 2025 and 2024:

Composition	December 31, 2025(1)	December 31, 2024
In millions of COP
Commercial	139,627,922	153,252,811
Consumer	52,753,546	55,815,683
Mortgage	34,416,372	41,741,601
Financial Leases(2)	28,493,129	27,291,604
Small Business Loans	1,063,012	1,352,209
Total gross loans and advances to customers(3)	256,353,981	279,453,908
Total allowance	(13,253,946)	(16,179,738)
Total Net loans and advances to customers	243,100,035	263,274,170

(1)The accumulated value as of December 31, 2025, includes the effects of Banistmo S.A.'s classification as asset held for sale since December 18, 2025, which had a loan portfolio of COP 28,853,418 and a provision for loan portfolio impairment of COP 1,420,269 that were reclassified to Assets related to investments in subsidiaries held for sale. For more information see Note 1. Reporting Entity, Note 2.D.12 Material Accounting Policies - Assets held for sale and discontinued operations and Note 31. Discontinued Operation.

(2)See note 11.1 Lessor.

(3)The decrease is mainly due to the effects of Banistmo S.A.'s classification as asset held for sale, offset by growth in Bancolombia S.A., due to higher disbursements made during 2025, as a result of quotas offered with rate benefits and improved dynamics following the reactivation of national government subsidies. Additionally, as of December 31, 2025, the Colombian peso devalued -14.79% against the US dollar, compared to December 31, 2024, which impacts the balances of the foreign subsidiaries.

Allowance for loan losses

The following table sets forth the changes in the allowance for loans and advances and lease losses as of December 31, 2025, 2024 and 2023:

As of December 31, 2025

Concept	Commercial	Consumer	Mortgage	Financial<br>Leases	Small<br>business<br>loans	Total(1)
In millions of COP
Balance at beginning of period January 1, 2025	7,259,230	6,497,777	1,235,177	1,088,272	99,282	16,179,738
Reclassification to assets held for sale(1)	(970,777)	(602,849)	(286,628)	(27,989)	(20,782)	(1,909,025)
Loan sales(2)	(336,124)	-	-	-	-	(336,124)
Recovery of charged - off loans	151,997	480,508	28,136	94,838	933	756,412
Credit impairment charges on loans, advances and financial leases, net(3)	1,045,454	3,149,937	41,122	111,744	89,175	4,437,432
Adjusted stage 3(4)	264,306	426,468	47,037	65,415	5,744	808,970
Charge-offs(5)	(1,334,284)	(4,613,577)	(77,397)	(262,636)	(52,853)	(6,340,747)
Translation adjustment(6)	(122,338)	(207,501)	(9,756)	(2,852)	(263)	(342,710)
Balance at December 31, 2025	5,957,464	5,130,763	977,691	1,066,792	121,236	13,253,946

(1)The accumulated value as of December 31, 2025, includes the effects of Banistmo S.A.'s classification as asset held for sale since December 18, 2025. The net effect of COP (1,909,025) corresponds to the opening balance as of January 1, 2025. The movements recorded in the period correspond to: impairment recognized in results in COP (183,462), charges-offs of COP (498,977), recovery of charged-off loans of COP (109,942), translation adjustment and others of

F-76

Table of Contents

COP (283,166), for a total loan portfolio provision of COP (1,420,269). For more information see Note 1. Reporting Entity, Note 2.D.12 Material Accounting Policies - Assets held for sale and discontinued operations and Note 31. Discontinued Operation.

(2)Corresponds to the release of loan allowances related to portfolio sales.

(3)The loss allowance for 2025 decreases by 18% compared to the previous year; this reduction is due to the strong performance across all portfolios.

(4)Recognized as a reduction to Interest Income on loans and financial leases in Consolidated Statement of Income, in accordance with IFRS 9.

(5)This amount is still subject to enforcement activity.

(6)The variation is due to the decrease in the market representative rate from COP 4,409.15 in December 2024 to COP 3,757.08 in December 2025.

As of December 31, 2024

Concept	Commercial	Consumer	Mortgage	Financial<br>Leases	Small<br>business<br>loans	Total
In millions of COP
Balance at beginning of period January 1, 2024	6,290,266	7,717,038	1,023,206	1,024,575	168,018	16,223,103
Loan sales(1)	(178,128)	-	-	-	-	(178,128)
Recovery of charged - off loans	85,858	637,131	48,029	150,466	4,784	926,268
Credit impairment charges on loans, advances and financial leases, net(2)(3)	1,462,622	3,660,321	215,240	62,708	12,761	5,413,652
Adjusted stage 3(4)	331,332	579,861	41,563	72,432	9,010	1,034,198
Charge-offs(5)	(977,743)	(6,406,521)	(143,885)	(228,639)	(99,124)	(7,855,912)
Translation adjustment(6)	245,023	309,947	51,024	6,730	3,833	616,557
Balance at December 31, 2024	7,259,230	6,497,777	1,235,177	1,088,272	99,282	16,179,738

(1)Corresponds to the release of loan allowances related to portfolio sales.

(2)The credit impairment charges decreased by 27.45% compared to the previous year. This decrease is primarily due an improvement in the consumer portfolio resulting from lending and collection actions that Cibest Corporate Group initiated in 2023, which had positive effects in 2024. Additionally, there has been a positive effect of the macroeconomic variables in the expected credit losses models.

(3)The net provision for impairment of the loan portfolio and finance lease operations differs from the COP 4,964,893 reported in the consolidated income statement due to Banistmo S.A.'s net loan portfolio provision expense of COP 448,759, classified as a discontinued operation in 2025. For more information, see Note 31. Discontinued operation.

(4)Recognized as a reduction to Interest Income on loans and financial leases in Consolidated Statement of Income, in accordance with IFRS 9.

(5)This amount is still subject to enforcement activity.

(6)The variation is due to the increase in the market representative rate from COP 3,822.05 in December 2023 to COP 4,409.15 in December 2024.

F-77

Table of Contents

As of December 31, 2023

Concept	Commercial	Consumer	Mortgage	Financial<br>Leases	Small<br>business<br>loans	Total
In millions of COP
Balance at beginning of period January 1, 2023	7,270,305	6,047,135	1,024,091	1,013,074	125,035	15,479,640
Loan sales(1)	(829,547)	-	-	-	-	(829,547)
Recovery of charged - off loans	93,251	548,655	64,573	61,749	2,706	770,934
Credit impairment charges on loans, advances and financial leases, net(2)	756,174	6,313,453	104,417	167,904	119,531	7,461,479
Adjusted stage 3(3)	427,283	509,668	33,465	67,288	11,201	1,048,905
Charge-offs(4)	(970,685)	(5,261,966)	(128,532)	(277,904)	(81,276)	(6,720,363)
Translation adjustment(5)	(456,515)	(439,907)	(74,808)	(7,536)	(9,179)	(987,945)
Balance at December 31, 2023	6,290,266	7,717,038	1,023,206	1,024,575	168,018	16,223,103

(1)Corresponds to the release of loan allowances related to portfolio sales.

(2)The net provision for impairment of the loan portfolio and finance lease operations differs from the COP 7,210,390 reported in the consolidated income statement due to Banistmo S.A.'s net loan portfolio provision expense of COP 251,089, classified as a discontinued operation in 2025. For more information, see Note 31. Discontinued operation.

(3)Recognized as a reduction to Interest Income on loans and financial leases in Consolidated Statement of Income, in accordance with IFRS 9.

(4)This amount is still subject to enforcement activity.

(5)The variation is due to the decrease in the market representative rate from COP 4,810.20 in December 2022 to COP 3,822.05 in December 2023.

The following table presents information about the nature and effects of changes in the contractual cash flows of the loan portfolio that did not result in derecognition and the effect of these changes on the measurement of expected credit losses.

Changes in the contractual cash flows of the loan portfolio that did not result in derecognition
In millions of COP
	December 31, 2025	December 31, 2024
Loan portfolio modified during the period
Amortized cost before modification	6,383,018	7,563,621
Net gain or loss on changes	(194,997)	(560,552)
Loan portfolio modified since initial recognition
Gross carrying value of the previously modified loan portfolio for which the allowance for losses has been changed from the asset's life to the expected credit losses for 12 months.	355,652	325,028

F-78

Table of Contents

Loans and advances according to their type of evaluation

Expected credit losses are calculated using both individual and collective models and methodologies, impairment loan portfolio analyzed by individual evaluation at COP 4.3 trillion, which represented 1.7% of the total portfolio of Cibest Corporate Group.

The table below shows loans and advances according to their type of evaluation for the periods ending December 31, 2025 and 2024:

December 31, 2025
In millions of COP
Evaluation	Stage 1		Stage 2		Stage 3		Total
	Gross	Allowance	Gross	Allowance	Gross	Allowance	Gross	Allowance
Collectively evaluated	230,529,201	2,009,090	13,291,069	2,277,512	8,194,278	6,027,390	252,014,548	10,313,992
Individually evaluated	-	-	-	-	4,339,433	2,939,954	4,339,433	2,939,954
Total	230,529,201	2,009,090	13,291,069	2,277,512	12,533,711	8,967,344	256,353,981	13,253,946		December 31, 2024
---	---	---	---	---	---	---	---	---
In millions of COP
Evaluation	Stage 1		Stage 2		Stage 3		Total
	Gross	Allowance	Gross	Allowance	Gross	Allowance	Gross	Allowance
Collectively evaluated	245,272,297	2,174,979	16,670,291	2,673,761	10,984,759	7,597,019	272,927,347	12,445,759
Individually evaluated	-	-	-	-	6,526,561	3,733,979	6,526,561	3,733,979
Total	245,272,297	2,174,979	16,670,291	2,673,761	17,511,320	11,330,998	279,453,908	16,179,738

Impact of movements in the value of the portfolio and loss allowance by Stage

The following explains the significant changes in the loans and the allowance for loan losses by category during the periods ended on December 31, 2025 and 2024 as a result of applying the expected credit loss model according to IFRS 9:

Variation December 2025 vs December 2024

Stage 1 (12-month expected credit losses)

The exposure in Stage 1 decreased by COP (14,743,096) and the loss allowance decreased by COP (165,889). The decrease in exposure and provision is mainly Banistmo S.A.'s classification as asset held for sale since December 18, 2025, as during 2025 the portfolio showed strong disbursement dynamics.

Stage 2 (Lifetime expected credit losses)

The exposure in Stage 2 decreased by COP (3,379,222) and the loss allowance registered a negative variation of COP (396,249). The decrease in exposure and provisions in this stage is primarily due to the Banistmo S.A.'s classification as asset held for sale since December 18, 2025, partially offset by an increase in impairment of specific clients in the commercial portfolio in Colombia and the consumer portfolio in Guatemala.

Stage 3 (Lifetime expected credit losses)

The exposure in Stage 3 decreased by COP (4,977,609) and the loss allowance decreased by COP (2,363,654). The reduction in exposure and provisions in this stage is mainly Banistmo S.A.'s classification as asset held for sale since December 18, 2025 and the strong performance observed in the portfolio during 2025.

For more information about Banistmo S.A.'s classification as asset held for sale see Note 1. Reporting Entity, Note 2.D.12 Material Accounting Policies - Assets held for sale and discontinued operations and Note 31. Discontinued Operation.

As of December 31, 2025

Commercial

F-79

Table of Contents

	Stage1		Stage2		Stage3		Total
	Gross<br>carrying	Allowance	Gross<br>carrying	Allowance	Gross<br>carrying	Allowance	Gross<br>carrying	Allowance
In millions of COP
Balance at January 1, 2025	137,761,467	(502,037)	5,545,788	(459,510)	9,945,556	(6,297,683)	153,252,811	(7,259,230)
Reclassification to assets held for sale(1)	(12,125,138)	45,922	(1,608,363)	33,845	(2,265,986)	891,010	(15,999,487)	970,777
Transfers of financial instruments:	(1,599,937)	79,247	412,309	30,925	1,187,628	(110,172)	-	-
Transfers from stage 1 to stage 2	(1,579,903)	17,471	1,579,903	(17,471)	-	-	-	-
Transfers from stage 1 to stage 3	(551,698)	129,948	-	-	551,698	(129,948)	-	-
Transfers from stage 2 to stage 1	521,590	(36,027)	(521,590)	36,027	-	-	-	-
Transfers from stage 2 to stage 3	-	-	(798,490)	109,139	798,490	(109,139)	-	-
Transfers from stage 3 to stage 1	10,074	(32,145)	-	-	(10,074)	32,145	-	-
Transfers from stage 3 to stage 2	-	-	152,486	(96,770)	(152,486)	96,770	-	-
Remeasurement arising from transfer of stage	(576,552)	(54,986)	(212,241)	(55,034)	141,315	(1,115,161)	(647,478)	(1,225,181)
Remeasurement from remaining in the stage	(7,895,159)	30,960	(144,129)	(32,521)	(337,299)	(159,442)	(8,376,587)	(161,003)
Remeasurement due to changes in economics factors	-	(108,077)	-	817	-	2,038	-	(105,222)
Remeasurement due to changes in model inputs	-	63,096	-	59,654	-	(45,466)	-	77,284
New financial assets originated(2)	75,155,440	(183,471)	1,199,076	(153,031)	1,099,244	(697,146)	77,453,760	(1,033,648)
Financial assets that have been derecognized	(56,859,784)	154,753	(1,209,177)	91,006	(1,426,985)	1,076,378	(59,495,946)	1,322,137
Charges-off	(7,394)	480	(43,895)	21,388	(1,282,995)	1,312,416	(1,334,284)	1,334,284
Foreign Exchange and other movements	(4,952,926)	8,956	(150,346)	8,349	(121,595)	105,033	(5,224,867)	122,338
Balance at December 31, 2025	128,900,017	(465,157)	3,789,022	(454,112)	6,938,883	(5,038,195)	139,627,922	(5,957,464)

(1) The accumulated value as of December 31, 2025, includes the effects of Banistmo S.A.'s classification as asset held for sale since December 18, 2025. For more information see Note 1. Reporting Entity, Note 2.D.12 Material Accounting Policies - Assets held for sale and discontinued operations and Note 31. Discontinued Operation.

(2) Includes financial assets originated and restructured.

F-80

Table of Contents

Consumer

	Stage1		Stage2		Stage3		Total
	Gross<br>carrying	Allowance	Gross<br>carrying	Allowance	Gross<br>carrying	Allowance	Gross<br>carrying	Allowance
In millions of COP
Balance at January 1, 2025	46,697,013	(1,370,712)	5,118,607	(1,644,274)	4,000,063	(3,482,791)	55,815,683	(6,497,777)
Reclassification to assets held for sale(1)	(4,807,840)	129,943	(776,756)	244,003	(276,624)	228,903	(5,861,220)	602,849
Transfers of financial instruments:	(1,615,302)	(93,716)	532,447	38,985	1,082,855	54,731	-	-
Transfers from stage 1 to stage 2	(1,518,885)	102,096	1,518,885	(102,096)	-	-	-	-
Transfers from stage 1 to stage 3	(927,968)	64,375	-	-	927,968	(64,375)	-	-
Transfers from stage 2 to stage 1	748,932	(184,573)	(748,932)	184,573	-	-	-	-
Transfers from stage 2 to stage 3	-	-	(468,223)	154,938	468,223	(154,938)	-	-
Transfers from stage 3 to stage 1	82,619	(75,614)	-	-	(82,619)	75,614	-	-
Transfers from stage 3 to stage 2	-	-	230,717	(198,430)	(230,717)	198,430	-	-
Remeasurement arising from transfer of stage	(361,401)	261,035	(368,351)	(102,279)	1,039,113	(3,304,618)	309,361	(3,145,862)
Remeasurement from remaining in the stage	(3,747,909)	153,169	(182,635)	151,134	(4,227)	1,762	(3,934,771)	306,065
Remeasurement due to changes in economics factors	-	(207,564)	-	(1,466)	-	3,526	-	(205,504)
Remeasurement due to changes in model inputs	-	13,396	-	(137,978)	-	10,475	-	(114,107)
New financial assets originated(2)	22,087,030	(548,952)	1,937,447	(651,351)	772,622	(636,814)	24,797,099	(1,837,117)
Financial assets that have been derecognized	(10,676,274)	291,106	(770,167)	275,579	(435,700)	372,927	(11,882,141)	939,612
Charges-off	(546,673)	49,407	(760,127)	357,949	(3,306,777)	4,206,221	(4,613,577)	4,613,577
Foreign Exchange and other movements	(1,659,764)	45,487	(133,041)	35,024	(84,083)	126,990	(1,876,888)	207,501
Balance at December 31, 2025	45,368,880	(1,277,401)	4,597,424	(1,434,674)	2,787,242	(2,418,688)	52,753,546	(5,130,763)

(1) The accumulated value as of December 31, 2025, includes the effects of Banistmo S.A.'s classification as asset held for sale since December 18, 2025. For more information see Note 1. Reporting Entity, Note 2.D.12 Material Accounting Policies - Assets held for sale and discontinued operations and Note 31. Discontinued Operation.

(2) Includes financial assets originated and restructured.

F-81

Table of Contents

Financial Leases

	Stage1		Stage2		Stage3		Total
	Gross<br>carrying	Allowance	Gross<br>carrying	Allowance	Gross<br>carrying	Allowance	Gross<br>carrying	Allowance
In millions of COP
Balance at January 1, 2025	22,561,434	(118,828)	3,212,710	(234,230)	1,517,460	(735,214)	27,291,604	(1,088,272)
Reclassification to assets held for sale(1)	(514,783)	4,049	(20,980)	2,247	(31,870)	21,693	(567,633)	27,989
Transfers of financial instruments:	(583,172)	(19,345)	324,853	29,925	258,319	(10,580)	-	-
Transfers from stage 1 to stage 2	(895,754)	11,458	895,754	(11,458)	-	-	-	-
Transfers from stage 1 to stage 3	(110,470)	2,658	-	-	110,470	(2,658)	-	-
Transfers from stage 2 to stage 1	422,790	(33,269)	(422,790)	33,269	-	-	-	-
Transfers from stage 2 to stage 3	-	-	(316,924)	53,288	316,924	(53,288)	-	-
Transfers from stage 3 to stage 1	262	(192)	-	-	(262)	192	-	-
Transfers from stage 3 to stage 2	-	-	168,813	(45,174)	(168,813)	45,174	-	-
Remeasurement arising from transfer of stage	(48,812)	30,400	(80,891)	(48,481)	49,833	(257,550)	(79,870)	(275,631)
Remeasurement from remaining in the stage	(1,991,928)	17,943	(70,056)	14,965	(70,210)	(4,279)	(2,132,194)	28,629
Remeasurement due to changes in economics factors	-	(39,665)	-	(1,077)	-	(525)	-	(41,267)
Remeasurement due to changes in model inputs	-	9,117	-	5,909	-	(62,139)	-	(47,113)
New financial assets originated(2)	6,649,904	(18,572)	206,109	(9,975)	22,459	(11,093)	6,878,472	(39,640)
Financial assets that have been derecognized	(2,072,585)	9,456	(260,935)	16,462	(216,667)	77,107	(2,550,187)	103,025
Charges-off	(105)	4	(72,142)	71,196	(190,389)	191,436	(262,636)	262,636
Foreign Exchange and other movements	(76,563)	236	(6,351)	207	(1,513)	2,409	(84,427)	2,852
Balance at December 31, 2025	23,923,390	(125,205)	3,232,317	(152,852)	1,337,422	(788,735)	28,493,129	(1,066,792)

(1) The accumulated value as of December 31, 2025, includes the effects of Banistmo S.A.'s classification as asset held for sale since December 18, 2025. For more information see Note 1. Reporting Entity, Note 2.D.12 Material Accounting Policies - Assets held for sale and discontinued operations and Note 31. Discontinued Operation.

(2) Includes financial assets originated and restructured.

F-82

Table of Contents

Mortgage

	Stage1		Stage2		Stage3		Total
	Gross<br>carrying	Allowance	Gross<br>carrying	Allowance	Gross<br>carrying	Allowance	Gross<br>carrying	Allowance
In millions of COP
Balance at January 1, 2025	37,076,580	(158,420)	2,701,930	(315,726)	1,963,091	(761,031)	41,741,601	(1,235,177)
Reclassification to assets held for sale(1)	(9,452,639)	34,415	(1,357,043)	90,049	(684,397)	162,164	(11,494,079)	286,628
Transfers of financial instruments:	(477,672)	(33,513)	248,173	(1,080)	229,499	34,593	-	-
Transfers from stage 1 to stage 2	(571,346)	12,468	571,346	(12,468)	-	-	-	-
Transfers from stage 1 to stage 3	(205,738)	4,973	-	-	205,738	(4,973)	-	-
Transfers from stage 2 to stage 1	298,159	(50,598)	(298,159)	50,598	-	-	-	-
Transfers from stage 2 to stage 3	-	-	(289,490)	53,061	289,490	(53,061)	-	-
Transfers from stage 3 to stage 1	1,253	(356)	-	-	(1,253)	356	-	-
Transfers from stage 3 to stage 2	-	-	264,476	(92,271)	(264,476)	92,271	-	-
Remeasurement arising from transfer of stage	(20,554)	44,968	(18,660)	(12,478)	52,712	(149,859)	13,498	(117,369)
Remeasurement from remaining in the stage	(1,338,191)	6,160	(20,607)	30,495	35,581	(91,633)	(1,323,217)	(54,978)
Remeasurement due to changes in economics factors	-	(13,278)	-	(1,704)	-	-	-	(14,982)
Remeasurement due to changes in model inputs	-	25,376	-	15,953	-	479	-	41,808
New financial assets originated(2)	8,773,202	(21,501)	111,527	(15,307)	44,135	(17,817)	8,928,864	(54,625)
Financial assets that have been derecognized	(2,362,816)	8,668	(94,631)	14,923	(127,539)	60,260	(2,584,986)	83,851
Charges-off	(1,526)	1	(423)	3	(75,448)	77,393	(77,397)	77,397
Foreign Exchange and other movements	(745,144)	769	(18,290)	576	(24,478)	8,411	(787,912)	9,756
Balance at December 31, 2025	31,451,240	(106,355)	1,551,976	(194,296)	1,413,156	(677,040)	34,416,372	(977,691)

(1) The accumulated value as of December 31, 2025, includes the effects of Banistmo S.A.'s classification as asset held for sale since December 18, 2025. For more information see Note 1. Reporting Entity, Note 2.D.12 Material Accounting Policies - Assets held for sale and discontinued operations and Note 31. Discontinued Operation.

(2) Includes financial assets originated and restructured.

F-83

Table of Contents

Small business loans

	Stage1		Stage2		Stage3		Total
	Gross<br>carrying	Allowance	Gross<br>carrying	Allowance	Gross<br>carrying	Allowance	Gross<br>carrying	Allowance
In millions of COP
Balance at January 1, 2025	1,175,803	(24,982)	91,256	(20,021)	85,150	(54,279)	1,352,209	(99,282)
Reclassification to assets held for sale(1)	(580,125)	4,720	(48,619)	3,771	(38,067)	12,291	(666,811)	20,782
Transfers of financial instruments:	(54,800)	1,009	28,536	1,683	26,264	(2,692)	-	-
Transfers from stage 1 to stage 2	(40,405)	1,811	40,405	(1,811)	-	-	-	-
Transfers from stage 1 to stage 3	(21,187)	1,084	-	-	21,187	(1,084)	-	-
Transfers from stage 2 to stage 1	6,737	(1,845)	(6,737)	1,845	-	-	-	-
Transfers from stage 2 to stage 3	-	-	(6,062)	2,348	6,062	(2,348)	-	-
Transfers from stage 3 to stage 1	55	(41)	-	-	(55)	41	-	-
Transfers from stage 3 to stage 2	-	-	930	(699)	(930)	699	-	-
Remeasurement arising from transfer of stage	(3,107)	1,580	(8,565)	(7,429)	(8,615)	(30,397)	(20,287)	(36,246)
Remeasurement from remaining in the stage	(132,363)	3,246	(2,418)	987	(909)	309	(135,690)	4,542
Remeasurement due to changes in economics factors	-	(1,354)	-	74	-	79	-	(1,201)
Remeasurement due to changes in model inputs	-	349	-	(1,985)	-	404	-	(1,232)
New financial assets originated(2)	637,291	(25,040)	80,827	(27,711)	28,036	(19,907)	746,154	(72,658)
Financial assets that have been derecognized	(143,836)	4,721	(8,734)	3,040	(3,657)	3,182	(156,227)	10,943
Charges-off	(10,034)	729	(11,807)	5,976	(31,012)	46,148	(52,853)	52,853
Foreign Exchange and other movements	(3,155)	50	(146)	37	(182)	176	(3,483)	263
Balance at December 31, 2025	885,674	(34,972)	120,330	(41,578)	57,008	(44,686)	1,063,012	(121,236)

(1) The accumulated value as of December 31, 2025, includes the effects of Banistmo S.A.'s classification as asset held for sale since December 18, 2025. For more information see Note 1. Reporting Entity, Note 2.D.12 Material Accounting Policies - Assets held for sale and discontinued operations and Note 31. Discontinued Operation.

(2) Includes financial assets originated and restructured.

Variation December 2024 vs December 2023

Stage 1 (12-month expected credit losses)

The exposure in Stage 1 increased by COP 22,899,408 and the loss allowance increased by COP (1,520,924). The increase in the portfolio in this Stage is mainly due to the dynamics of disbursements in the corporate portfolio and the restatement of dollar loans into Colombian Pesos due to the increase in the exchange rate. The decrease in the loss allowance is due to a higher portfolio participation in lower-risk categories and the macroeconomic impact on the PD (probability of default) models, which have a more favorable economic outlook, where a downward trend in interest rates in Colombia is observed, which positively affects the portfolios of individuals.

Stage 2 (Lifetime expected credit losses)

The exposure in Stage 2 increased by COP 627,630 and the loss allowance increased by COP 137,359. The increase in exposure is mainly due to clients in the corporate portfolio classified as medium risk, through monitoring by the Special Client Management Committee, and a higher number of restructurings compared to the previous year. The increase in the provision is consistent with the arrival of these clients.

Stage 3 (Lifetime expected credit losses)

The exposure in Stage 3 increased by COP 1,975,223 and the loss allowance increased by COP 1,340,200. This variation in exposure and provisions is primarily due to the deterioration of clients in the legal entity portfolio, which includes both corporate clients and SMEs. Significant defaults were particularly observed in the pharmaceutical, commerce, manufacturing, and construction sectors.

F-84

Table of Contents

As of December 31, 2024

Commercial

	Stage1		Stage2		Stage3		Total
	Gross<br>carrying	Allowance	Gross<br>carrying	Allowance	Gross<br>carrying	Allowance	Gross<br>carrying	Allowance
In millions of COP
Balance at January 1, 2024	120,773,927	(638,095)	5,453,537	(425,470)	8,459,932	(5,226,701)	134,687,396	(6,290,266)
Transfers of financial instruments:	(1,548,717)	(13,835)	(200,399)	101,921	1,749,116	(88,086)	-	-
Transfers from stage 1 to stage 2	(1,625,193)	22,890	1,625,193	(22,890)	-	-	-	-
Transfers from stage 1 to stage 3	(1,207,431)	36,155	-	-	1,207,431	(36,155)	-	-
Transfers from stage 2 to stage 1	1,278,864	(70,018)	(1,278,864)	70,018	-	-	-	-
Transfers from stage 2 to stage 3	-	-	(633,645)	86,370	633,645	(86,370)	-	-
Transfers from stage 3 to stage 1	5,043	(2,862)	-	-	(5,043)	2,862	-	-
Transfers from stage 3 to stage 2	-	-	86,917	(31,577)	(86,917)	31,577	-	-
Remeasurement arising from transfer of stage	(537,295)	42,814	(254,631)	(33,104)	(236,667)	(1,205,996)	(1,028,593)	(1,196,286)
Remeasurement from remaining in the stage	(7,993,068)	112,459	(269,421)	38,168	29,358	(329,489)	(8,233,131)	(178,862)
Remeasurement due to changes in economics factors	-	3,800	-	(1,359)	-	109	-	2,550
Remeasurement due to changes in model inputs	-	12,929	-	(60,157)	-	28,775	-	(18,453)
New financial assets originated(1)	83,411,122	(234,532)	2,012,893	(166,762)	1,595,995	(954,919)	87,020,010	(1,356,213)
Financial assets that have been derecognized	(61,617,701)	229,467	(1,631,559)	81,976	(1,177,975)	734,137	(64,427,235)	1,045,580
Charges-off	(18,847)	872	(71,910)	24,045	(886,986)	952,826	(977,743)	977,743
Foreign Exchange and other movements	5,292,046	(17,916)	507,278	(18,768)	412,783	(208,339)	6,212,107	(245,023)
Balance at December 31, 2024	137,761,467	(502,037)	5,545,788	(459,510)	9,945,556	(6,297,683)	153,252,811	(7,259,230)

(1)Includes financial assets originated and restructured.

F-85

Table of Contents

Consumer

	Stage1		Stage2		Stage3		Total
	Gross<br>carrying	Allowance	Gross<br>carrying	Allowance	Gross<br>carrying	Allowance	Gross<br>carrying	Allowance
In millions of COP
Balance at January 1, 2024	46,060,615	(2,672,234)	4,407,067	(1,584,505)	4,124,087	(3,460,299)	54,591,769	(7,717,038)
Transfers of financial instruments:	(3,287,690)	167,853	1,334,175	(32,948)	1,953,515	(134,905)	-	-
Transfers from stage 1 to stage 2	(2,355,931)	236,700	2,355,931	(236,700)	-	-	-	-
Transfers from stage 1 to stage 3	(1,694,306)	185,537	-	-	1,694,306	(185,537)	-	-
Transfers from stage 2 to stage 1	705,570	(207,512)	(705,570)	207,512	-	-	-	-
Transfers from stage 2 to stage 3	-	-	(572,936)	195,424	572,936	(195,424)	-	-
Transfers from stage 3 to stage 1	56,977	(46,872)	-	-	(56,977)	46,872	-	-
Transfers from stage 3 to stage 2	-	-	256,750	(199,184)	(256,750)	199,184	-	-
Remeasurement arising from transfer of stage	(322,470)	214,334	(389,162)	(153,151)	1,432,594	(4,673,940)	720,962	(4,612,757)
Remeasurement from remaining in the stage	(3,891,488)	246,406	(137,592)	(27,302)	27,126	(96,141)	(4,001,954)	122,963
Remeasurement due to changes in economics factors	-	13,782	-	8,102	-	(4,463)	-	17,421
Remeasurement due to changes in model inputs	-	370,905	-	(37,890)	-	(28,501)	-	304,514
New financial assets originated(1)	18,171,352	(503,056)	1,702,506	(592,301)	1,099,137	(970,118)	20,972,995	(2,065,475)
Financial assets that have been derecognized	(11,013,532)	597,248	(895,311)	336,485	(525,071)	422,288	(12,433,914)	1,356,021
Charges-off	(1,093,049)	266,898	(1,092,436)	502,944	(4,221,036)	5,636,679	(6,406,521)	6,406,521
Foreign Exchange and other movements	2,073,275	(72,848)	189,360	(63,708)	109,711	(173,391)	2,372,346	(309,947)
Balance at December 31, 2024	46,697,013	(1,370,712)	5,118,607	(1,644,274)	4,000,063	(3,482,791)	55,815,683	(6,497,777)

(1)Includes financial assets originated and restructured.

Financial leases

	Stage1		Stage2		Stage3		Total
	Gross<br>carrying	Allowance	Gross<br>carrying	Allowance	Gross<br>carrying	Allowance	Gross<br>carrying	Allowance
In millions of COP
Balance at January 1, 2024	22,553,128	(145,429)	3,293,100	(206,641)	1,430,829	(672,505)	27,277,057	(1,024,575)
Transfers of financial instruments:	(626,993)	(32,495)	164,252	42,979	462,741	(10,484)	-	-
Transfers from stage 1 to stage 2	(807,360)	11,270	807,360	(11,270)	-	-	-	-
Transfers from stage 1 to stage 3	(301,609)	5,217	-	-	301,609	(5,217)	-	-
Transfers from stage 2 to stage 1	476,482	(48,011)	(476,482)	48,011	-	-	-	-
Transfers from stage 2 to stage 3	-	-	(261,903)	28,911	261,903	(28,911)	-	-
Transfers from stage 3 to stage 1	5,494	(971)	-	-	(5,494)	971	-	-
Transfers from stage 3 to stage 2	-	-	95,277	(22,673)	(95,277)	22,673	-	-
Remeasurement arising from transfer of stage	(29,224)	26,927	(111,911)	(24,264)	82,688	(332,058)	(58,447)	(329,395)
Remeasurement from remaining in the stage	(2,030,801)	1,024	(36,408)	6,618	(48,471)	19,994	(2,115,680)	27,636
Remeasurement due to changes in economics factors	-	388	-	(1,315)	-	3,278	-	2,351
Remeasurement due to changes in model inputs	-	33,405	-	(39,054)	-	(19,599)	-	(25,248)
New financial assets originated(1)	4,685,664	(16,709)	265,140	(61,525)	43,177	(26,867)	4,993,981	(105,101)
Financial assets that have been derecognized	(2,161,635)	14,818	(369,040)	13,130	(232,037)	116,203	(2,762,712)	144,151
Charges-off	(2,309)	116	(626)	38,690	(225,704)	189,833	(228,639)	228,639
Foreign Exchange and other movements	173,604	(873)	8,203	(2,848)	4,237	(3,009)	186,044	(6,730)
Balance at December 31, 2024	22,561,434	(118,828)	3,212,710	(234,230)	1,517,460	(735,214)	27,291,604	(1,088,272)

F-86

Table of Contents

(1)Includes financial assets originated and restructured.

Mortgage

	Stage1		Stage2		Stage3		Total
	Gross<br>carrying	Allowance	Gross<br>carrying	Allowance	Gross<br>carrying	Allowance	Gross<br>carrying	Allowance
In millions of COP
Balance at January 1, 2024	32,210,648	(184,915)	2,628,654	(284,921)	1,411,106	(553,370)	36,250,408	(1,023,206)
Transfers of financial instruments:	(530,580)	(63,741)	(110,527)	65,658	641,107	(1,917)	-	-
Transfers from stage 1 to stage 2	(1,054,660)	17,932	1,054,660	(17,932)	-	-	-	-
Transfers from stage 1 to stage 3	(388,239)	7,709	-	-	388,239	(7,709)	-	-
Transfers from stage 2 to stage 1	911,038	(89,109)	(911,038)	89,109	-	-	-	-
Transfers from stage 2 to stage 3	-	-	(575,585)	77,114	575,585	(77,114)	-	-
Transfers from stage 3 to stage 1	1,281	(273)	-	-	(1,281)	273	-	-
Transfers from stage 3 to stage 2	-	-	321,436	(82,633)	(321,436)	82,633	-	-
Remeasurement arising from transfer of stage	(46,383)	71,166	(34,361)	(69,232)	58,849	(197,427)	(21,895)	(195,493)
Remeasurement from remaining in the stage	(1,500,100)	146	(28,254)	(50,026)	(14,983)	(92,113)	(1,543,337)	(141,993)
Remeasurement due to changes in economics factors	-	(655)	-	232	-	-	-	(423)
Remeasurement due to changes in model inputs	-	35,570	-	38,196	-	(59,346)	-	14,420
New financial assets originated(1)	7,250,404	(24,146)	89,441	(15,434)	38,103	(15,032)	7,377,948	(54,612)
Financial assets that have been derecognized	(2,219,679)	13,232	(88,540)	12,205	(114,124)	47,832	(2,422,343)	73,269
Charges-off	(3,221)	263	(2,019)	1,789	(138,645)	141,833	(143,885)	143,885
Foreign Exchange and other movements	1,915,491	(5,340)	247,536	(14,193)	81,678	(31,491)	2,244,705	(51,024)
Balance at December 31, 2024	37,076,580	(158,420)	2,701,930	(315,726)	1,963,091	(761,031)	41,741,601	(1,235,177)

(1)Includes financial assets originated and restructured.

F-87

Table of Contents

Small business loans

	Stage1		Stage2		Stage3		Total
	Gross<br>carrying	Allowance	Gross<br>carrying	Allowance	Gross<br>carrying	Allowance	Gross<br>carrying	Allowance
In millions of COP
Balance at January 1, 2024	774,571	(55,230)	260,303	(34,865)	110,143	(77,923)	1,145,017	(168,018)
Transfers of financial instruments:	48,693	4,363	(90,096)	465	41,403	(4,828)	-	-
Transfers from stage 1 to stage 2	(32,175)	5,260	32,175	(5,260)	-	-	-	-
Transfers from stage 1 to stage 3	(26,237)	3,577	-	-	26,237	(3,577)	-	-
Transfers from stage 2 to stage 1	106,886	(4,362)	(106,886)	4,362	-	-	-	-
Transfers from stage 2 to stage 3	-	-	(22,854)	3,333	22,854	(3,333)	-	-
Transfers from stage 3 to stage 1	219	(112)	-	-	(219)	112	-	-
Transfers from stage 3 to stage 2	-	-	7,469	(1,970)	(7,469)	1,970	-	-
Remeasurement arising from transfer of stage	(8,293)	2,046	(11,218)	(35)	2,245	(59,190)	(17,266)	(57,179)
Remeasurement from remaining in the stage	(119,140)	13,134	(1,716)	9,558	(4,671)	(1,179)	(125,527)	21,513
Remeasurement due to changes in economics factors	-	549	-	103	-	(52)	-	600
Remeasurement due to changes in model inputs	-	9,603	-	(169)	-	(740)	-	8,694
New financial assets originated(1)	774,418	(15,290)	42,211	(6,973)	18,044	(12,363)	834,673	(34,626)
Financial assets that have been derecognized	(323,208)	12,414	(120,903)	5,663	(27,026)	16,366	(471,137)	34,443
Charges-off	(19,210)	3,952	(19,407)	7,670	(60,507)	87,502	(99,124)	99,124
Foreign Exchange and other movements	47,972	(523)	32,082	(1,438)	5,519	(1,872)	85,573	(3,833)
Balance at December 31, 2024	1,175,803	(24,982)	91,256	(20,021)	85,150	(54,279)	1,352,209	(99,282)

(1)Includes financial assets originated and restructured.

For more information, see RISK MANAGEMENT in the credit risk section.

F-88

Table of Contents

NOTE 7. ASSETS HELD FOR SALE AND INVENTORIES, NET

The breakdown of inventories and assets held for sale, net of the Cibest Corporate Group is as follows:

Assets held for sale and inventories	December 31, 2025 (1)	December 31, 2024
In millions of COP
Inventories, net	656,019	932,657
Assets held for sale, net	10,342	173,742
Total assets held for sale and inventories, net	666,361	1,106,399

(1) The accumulated value as of December 31, 2025, includes the effects of the classification of Banistmo S.A. as an asset held for sale as of December 18, 2025, which recorded inventories of COP 129,046, impairment of COP 4,385, and assets held for sale of COP 124,660, which were reclassified to Assets related to investments in subsidiaries held for sale. For more information, see Note 1. Reporting Entity, Note 2.D12. Material accounting policies – Assets held for sale and discontinued operations, and Note 31. Discontinued Operation.

7.1. Inventories

Due to the nature of the financial services provided by some subsidiaries of the Cibest Corporate Group, assets provided through operating or financial leases to third parties that do not exercise the purchase option or that do not have a purchase option, are recorded as inventories once the agreement expires, considering that in the course of the ordinary activities performed by such subsidiaries, those assets are routinely sold.

In addition, the Cibest Corporate Group companies have a business unit that develops real estate, which are sold in the ordinary course of business and are classified as inventories.

The Cibest Corporate Group inventories at December 31, 2025, and 2024, are summarized as follows:

Inventories	December 31, 2025 (1)	December 31, 2024
In millions of COP
Lands and buildings(2)	457,482	576,556
Vehicles(3)	182,745	365,173
Machinery and others(4)	41,335	32,166
Total inventory cost	681,562	973,895
Impairment	(25,543)	(41,238)
Total inventories, net	656,019	932,657

(1)The accumulated value as of December 31, 2025, includes the effects of the classification of Banistmo S.A. as an asset held for sale since December 18, 2025. For further information, see Note 1, Reporting Entity; Note 2.D12, Significant Accounting Policies – Assets Held for Sale and Discontinued Operations; and Note 31, Discontinued Operation.

(2)The decrease corresponds mainly to Fondo Inmobiliario Colombia, which is associated with autonomous trusts that develop projects to sell real estate units.

(3) The variation corresponds mainly to Bancolombia due to higher vehicle sales during 2025.

(4) The increase corresponds mainly to income from machinery and equipment received in processes with customers.

As of December 31, 2025, Banistmo S.A. (subsidiary classified as an asset held for sale) had a inventory cost of COP 129,046 and impairment of COP 4,385. For more information, see Note 31. Discontinued operations.

Impairment is recognized based on market price fluctuation due to the fact that the fair value is determined by the offering price less cost to sell.

There are one hundred twenty-nine thousand forty-six inventories pledged as collateral for liabilities as of December 31, 2025, and 2024.

7.2. Assets held for sale

The assets recognized by the Cibest Corporate Group as assets held for sale correspond to machinery, equipment, motor vehicles, and technology, among others that have been received as assets received in lieu of payment.

F-89

Table of Contents

These assets are subject to a current plan for their sale, which contains the details of the selling price allocation and the advertising and marketing plan. Furthermore, the plan specifies the conditions to proceed with the selling process.

The total balance of assets held for sale, by operating segment, are detailed below:

As of December 31, 2025

Assets held for sale	Banking<br>Colombia	Banking<br>El Salvador	Banking<br>Guatemala	Total (1)
In millions of COP
Machinery and equipment	5,622	-	-	5,622
Cost	5,658	-	-	5,658
Impairment	(36)	-	-	(36)
Real estate for residential purposes	1,909	1,168	1,507	4,584
Cost	1,909	1,168	1,507	4,584
Impairment	-	-	-	-
Real estate different from residential properties	136	-	-	136
Cost	136	-	-	136
Impairment	-	-	-	-
Total assets held for sale - cost	7,703	1,168	1,507	10,378
Total assets held for sale - impairment	(36)	-	-	(36)
Total assets held for sale	7,667	1,168	1,507	10,342

(1) The accumulated value as of December 31, 2025 includes the effects of the classification of Banistmo S.A. as an asset held for sale since December 18, 2025. For further information, see Note 1, Reporting Entity; Note 2.D12, Significant Accounting Policies – Assets Held for Sale and Discontinued Operations; and Note 31, Discontinued Operation.

For 2025 there are four thousand three hundred eighty-five assets related to investments held for sale.

As of December 31, 2024

Assets held for sale	Banking<br>Colombia	Banking<br>Panama	Banking<br>El Salvador	Banking<br>Guatemala	Total
In millions of COP
Machinery and equipment	5,563	4,522	-	-	10,085
Cost	5,660	4,532	-	-	10,192
Impairment	(97)	(10)	-	-	(107)
Real estate for residential purposes	2,887	111,983	6,349	12,644	133,863
Cost	2,887	116,214	6,374	12,673	138,148
Impairment	-	(4,231)	(25)	(29)	(4,285)
Real estate different from residential properties	182	29,612	-	-	29,794
Cost	182	29,787	-	-	29,969
Impairment	-	(175)	-	-	(175)
Total assets held for sale - cost	8,729	150,533	6,374	12,673	178,309
Total assets held for sale - impairment	(97)	(4,416)	(25)	(29)	(4,567)
Total assets held for sale(1)	8,632	146,117	6,349	12,644	173,742

(1)For 2024 there are no assets related to investments held for sale.

Impairment losses are recognized for the difference between the carrying and recoverable amount of the asset.

F-90

Table of Contents

NOTE 8. INVESTMENTS IN ASSOCIATES AND JOINT VENTURES

The following table presents information regarding Cibest Corporate Group investments in associates and joint ventures:

Composition	December 31, 2025	December 31, 2024
In millions of COP
Investments in associates(1)	3,013,466	2,768,611
Investments in joint ventures(2)	298,040	160,373
Total investments in associates and joint ventures	3,311,506	2,928,984

(1)As of December 31, 2025, and 2024, the amount includes investments in associates at fair value for COP 2,041,402 and COP 1,830,884, respectively, see Note 30. Fair value of assets and liabilities. Additionally, the amount includes investments in associates at equity method value for COP 972,064 and COP 937,727, respectively.

(2)All investments in joint ventures are accounted for using the equity method.

The following are the investments in associates that Cibest Corporate Group holds as of December 31, 2025, and 2024:

Company name		Main activity		Country	December 31, 2025				December 31, 2024
	% of Ownership<br>interest		Carrying<br>amount				% of Ownership<br>interest	Carrying<br>amount
In millions of COP
P.A Viva Malls(1)		Development and operation of commercial spaces		Colombia	49.00	%	1,990,554		49.00	%	1,817,503
Protección S.A.(1)		Administration of pension and severance funds		Colombia	20.58	%	661,833		20.58	%	625,370
P.A El Bosque		Real estate ecosystems		Colombia	14.11	%	82,547	*	14.11	%	85,863	*
Titularizadora Colombiana S.A. Hitos.		Mortgage portfolio securities		Colombia	26.98	%	44,726	*	26.98	%	42,050	*
Redeban Multicolor S.A.		Network data transmission services		Colombia	20.36	%	43,701	*	20.36	%	42,190	*
P.A El Otoño		Real estate ecosystems		Colombia	16.30	%	38,867	*	16.30	%	36,676	*
P.A Lote Palermo(2)		Real estate ecosystems		Colombia	37.50	%	37,294		-	%	-
ACH Colombia S.A.		Electronic transfer services		Colombia	19.94	%	28,613	*	19.94	%	23,706	*
Patria Asset Management S.A.		Investment management services		Colombia	49.31	%	24,742	*	49.31	%	20,428
P.A Distrito Vera		Real estate ecosystems		Colombia	33.33	%	13,408		33.33	%	13,325
Servicios Financieros, S.A. de C.V.		Processing of financial transactions and electronic payment methods		El Salvador	49.78	%	12,567	*	49.78	%	12,695	*
Servicio Salvadoreño de Protección, S. A. de C.V.		Custodial services and transfer of monetary types		El Salvador	25.00	%	12,145	*	25.00	%	13,382	*
P.A La Felicidad		Real estate ecosystems		Colombia	20.00	%	7,689	*	20.00	%	4,067	*
P.A Boreal		Real estate ecosystems		Colombia	20.00	%	5,622	*	20.00	%	8,658	*
P.A Madrid II		Real estate ecosystems		Colombia	20.00	%	4,129	*	20.00	%	3,103	*
Reintegra S.A.S.		Collections and recovery of portfolio		Colombia	46.00	%	2,696	*	46.00	%	3,520
Agricapital S.A.S.		Financial services		Colombia	10.79	%	1,064	*	10.79	%	991	*
ACH de El Salvador, S. A. de C.V.		Electronic transfer services		El Salvador	25.00	%	842	*	25.00	%	1,544	*
P.A Mirador de la Ciénaga.		Real estate ecosystems		Colombia	13.00	%	281	*	13.00	%	4,326	*
Fideicomiso Locales Distrito Vera		Real estate ecosystems		Colombia	33.33	%	146		33.33	%	56
Internacional Ejecutiva de Aviación S.A.S.(3)		Aircraft and aircraft travel service		Colombia	-	%	-		37.50	%	9,158
Servicios de Identidad Digital S.A.S.(4)		Digital services		Colombia	-	%	-		33.33	%	-
Total investments in associates							3,013,466				2,768,611

(1)For further information, see table the changes in the carrying amount of associates of Cibest Corporate Group as of December 31, 2025 and 2024.

(2)Investment reclassified from equity instrument to associate by FCP Fondo Colombia Inmobiliario S.A. in November 2025.

(3)It is reclassified as a joint venture due to the increase in the percentage of ownership with the purchase of 562,500 shares from Grupo Argos S.A. for COP 453 in September 2025.

(4)On July 2, 2025, the liquidation certificate was filed with the Chamber of Commerce and the company's registration was canceled. As of December 31, 2024, the carrying amount of this investment was COP 0, due to the recognition of the entity's losses during the year through the application of the equity method.

F-91

Table of Contents

(*)For the purposes of applying the equity method of accounting, financial statements as of November 30, 2025, and 2024 have been used. However, Cibest Corporate Group does not consider that any adjustments have to be made since no significant transactions took place between that date and December 31, 2025, and 2024.

The following table sets forth the changes in the carrying amount of associates of Cibest Corporate Group as of December 31, 2025, and 2024:

	December 31, 2025				December 31, 2024
	In millions of COP
	P.A Viva Malls	Protección S.A.	Others	Total	P.A Viva Malls	Protección S.A.	Others	Total
Balance as of January 1,	1,817,503	625,370	325,738	2,768,611	1,661,679	594,105	270,289	2,526,073
Equity method(1)	173,051	77,538	65,648	316,237	155,824	94,180	61,189	311,193
OCI (Equity method)	-	88	(140)	(52)	-	(8,464)	1,642	(6,822)
OCI (Translation adjustment)	-	-	(4,244)	(4,244)	-	-	3,395	3,395
Purchase / capitalizations	-	-	4,934	4,934	-	-	38,285	38,285
Sales or refund of contributions	-	-	(23,044)	(23,044)	-	-	(21,041)	(21,041)
Impairment loss(2)	-	-	-	-	-	-	(26)	(26)
Dividends	-	(41,163)	(37,067)	(78,230)	-	(55,558)	(27,432)	(82,990)
Transfers(3)	-	-	28,137	28,137	-	-	-	-
Others	-	-	1,117	1,117	-	1,107	(563)	544
Balance as of December 31,	1,990,554	661,833	361,079	3,013,466	1,817,503	625,370	325,738	2,768,611

(1)For further information see Note 25.5. Dividends and net income on equity investments.

(2)For 2024, Cibest Corporate Group management performed a valuation, to establish the recoverable amounts based in value in use of Reintegra S.A.S., which amounted to COP 3,737, with a discount rate of 20.39%. As a result of the valuation, the recoverable amounts of the investment were lower than the carrying amount of each year, for this, Cibest Corporate Group recorded an impairment in the Consolidated Statement of Income for COP 26. For further information see Note 25.5. Dividends and net income on equity investments.

(3)Net effect between the transfer of P.A. Lote Palermo from other equity instruments and the reclassification of Internacional Ejecutiva de Aviación S.A.S. to joint ventures.

The following is additional information regarding Cibest Corporate Group’s most significant associates as of December 31, 2025, and 2024:

As of December 31, 2025

Company name	Assets<br>(unaudited)	Liabilities<br>(unaudited)	OCI<br>(unaudited)	Income from<br>ordinary activities<br>(unaudited)	Profits<br>(unaudited)
In millions of COP
P.A Viva Malls	4,112,818	50,463	-	885,803	469,813
Protección S.A.	3,422,617	804,200	39,060	1,959,129	376,826

As of December 31, 2024

Company name	Assets<br>(unaudited)	Liabilities<br>(unaudited)	OCI<br>(unaudited)	Income from<br>ordinary activities<br>(unaudited)	Profits<br>(unaudited)
In millions of COP
P.A Viva Malls	3,823,893	114,703	-	761,198	487,123
Protección S.A.	3,194,045	752,834	38,953	1,884,277	446,532

The dividends received from the associate at fair value P.A Viva Malls for the year ended December 31, 2025, and 2024 are COP 135,246 and COP 121,977, respectively. These are included in the line Dividends and net income on equity

F-92

Table of Contents

investments in the Consolidated Statement of Income. Dividends are received in Protección S.A. for the year ended December 31, 2025 and 2024 are COP 41,163, and COP 55,558, respectively, effect of the recognition of the equity method, recognized as a reduction in the value of the investment.

The following are the joint ventures that Cibest Corporate Group holds as of December 31, 2025, and 2024:

Company name		Main activity		Country	December 31, 2025				December 31, 2024
	% of Ownership<br>interest		Carrying<br>amount				% of Ownership<br>interest	Carrying<br>amount
In millions of COP
Compañía de Financiamiento TUYA S.A.(1)		Financing Services		Colombia	50.00	%	235,908		50.00	%	95,106
Puntos Colombia S.A.S.		Administration of the customers loyalty		Colombia	50.00	%	28,862		50.00	%	17,691
Internacional Ejecutiva de Aviación S.A.S.(2)		Aircraft and aircraft travel service		Colombia	50.00	%	12,962		-	%	-
Fondo de Capital Privado Ruta del Sol compartimento A		Investment in infrastructure projects		Colombia	26.30	%	10,606		26.30	%	10,597	*
Ecosistemas Digitales de Negocio S.A.S.		Digital electronic billing services		Colombia	50.00	%	4,502		50.00	%	3,182
P.A Blup		Inventory finance and comprehensive logistics operation		Colombia	50.00	%	4,327		50.00	%	3,888
P.A Coba		Technological platform development		Colombia	51.78	%	602		51.78	%	1,720
P.A Acelera TI		IT talent development		Colombia	50.00	%	195		50.00	%	279
P.A Avicapital		Purchase and sale of loans and receivables		Colombia	50.00	%	76		50.00	%	75	*
P.A Laurel(3)		Renewable energies		Colombia	-	%	-		50.00	%	27,835
P.A Reintegra(4)		Collections and recovery of portfolio		Colombia	46.00	%	-		46.00	%	-	*
P.A Muverang(5)		Sustainable mobility services		Colombia	33.33	%	-		33.33	%	-	*
Total investments in joint venture							298,040				160,373

(1)For further information, see table the changes in the carrying amount of joint ventures of Cibest Corporate Group as of December 31, 2025, and 2024.

(2)It is reclassified from associate to joint venture due to the increase in the percentage of ownership with the purchase of 562,500 shares from Grupo Argos S.A. for COP 453 in September 2025.

(3)Investment sold by Inversiones CFNS S.A.S in September 2025. For further information see Note 25.5. Dividends and net income on equity investments.

(4)In 2025 and 2024, the carrying amount at the end of the year is COP 0, because the amount of downstream transactions between Bancolombia S.A. and P.A Reintegra made during these years.

(5)In 2025 and 2024, the value of the investment in the company is COP 0, due to the recognition of the equity method and impairment of the company.

(*)For the purposes of applying the equity method of accounting, financial statements as of November 30, 2025, and 2024 have been used. However, Cibest Corporate Group does not consider that any adjustments have to be made since no significant transactions took place between these dates and December 31, 2025, and 2024.

The following table sets forth the changes in the carrying amount of joint ventures of Cibest Corporate Group as of December 31, 2025, and 2024:

	December 31, 2025			December 31, 2024
	In millions of COP
	Compañía de<br>financiamiento<br> Tuya S.A.	Others	Total	Compañía de<br>financiamiento<br> Tuya S.A.	Others	Total
Balance as of January 1,	95,106	65,267	160,373	410,324	61,206	471,530
Equity method(1)	22,935	9,790	32,725	(79,681)	(8,940)	(88,621)
OCI (Equity method)	-	(18)	(18)	-	-	-
Purchase / capitalizations	-	9,764	9,764	76,751	15,437	92,188
Sales or refund of contributions	-	(27,114)	(27,114)	-	(403)	(403)
Recovery / (Impairment loss)(2)	117,867	-	117,867	(312,288)	(2,033)	(314,321)
Transfers(3)		9,158	9,158
Dividends	-	(4,715)	(4,715)	-	-	-
Balance as of December 31,	235,908	62,132	298,040	95,106	65,267	160,373

(1)For further information, see Note 25.5. Dividends and net income on equity investments.

F-93

Table of Contents

(2)During 2025 and 2024, Cibest Corporate Group’s management requested a valuation of the joint venture Tuya S.A. to determine the recoverable amount, which amounted to COP 235,907 and COP 85,993 respectively, based on value in use; the valuation used discount rates of 13.70% - 14.20% and 12.90% - 16.10% respectively. As a result of the valuation, the recoverable amount of the investment was higher than the carrying amount for 2025 and lower for 2024; therefore, Cibest Corporate Group recognized a recovery of COP 117,867 and an impairment of COP 312,288, respectively, in the Consolidated Statement of Income. Additionally, in 2024, Cibest Corporate Group's management determined that, due to its divestment decision in P.A. Muverang, the recoverable amount is COP 0. ince the recoverable amount was lower than the carrying amount, an impairment of COP 2,033. was recognized in the Consolidated Statement of Income for the period. For further information, see Note 25.5. Dividends and net income on equity investments.

(3)Reclassification of Internacional Ejecutiva de Aviación S.A.S. from associates to joint ventures.

The following is additional information regarding the Cibest Corporate Group’s most significant joint ventures as of December 31, 2025 and 2024:

As of December 31, 2025

Company name	Assets<br><br>(unaudited)(1)	Liabilities<br>(unaudited)	Income from<br>ordinary activities<br>(unaudited)	Profit<br><br>(unaudited)(2)
In millions of COP
Compañía de financiamiento Tuya S.A.	2,346,559	1,792,658	1,186,933	45,872

(1)Includes cash and cash equivalents for COP 175,888.

(2)Includes interest and valuation income for COP 444,415, credit impairment charges, net for COP 129,630, interest expenses for COP 174,042, depreciation and amortization for COP 28,302 and income tax revenue for COP 46,491.

As of December 31, 2024

Company name	Assets<br><br>(unaudited)(1)	Liabilities<br>(unaudited)	Income from<br>ordinary activities<br>(unaudited)	Loss<br><br>(unaudited)(2)
In millions of COP
Compañía de financiamiento Tuya S.A.	2,830,280	2,322,251	1,505,074	155,514

(1)Includes cash and cash equivalents for COP 317,389.

(2)Includes interest and valuation income for COP 704,535, credit impairment charges, net for COP 510,496, interest expenses for COP 305,343, depreciation and amortization for COP 29,329 and income tax revenue for COP 53,566.

The accumulated other comprehensive income before tax of investments in associates and joint ventures as of December 31, 2025 and 2024, corresponds to COP (10,432) and COP (6,118), respectively.

As of December 31, 2025 and 2024, there are no restrictions on the ability of the associates and joint ventures to transfer funds to Cibest Corporate Group in the form of cash dividends. In the same way, there are no contingent liabilities incurred by Cibest Corporate Group regarding its interests in the aforementioned joint ventures and associates.

In the companies P.A El Bosque, P.A El Otoño, ACH Colombia S.A., P.A Mirador de la Ciénaga and Agricapital S.A.S. the participation of Cibest Corporate Group is less than 20%, however, it has participation in the Board of Directors and for this reason it is considered that it has significant influence over the decisions that may be taken in the company.

F-94

Table of Contents

NOTE 9. INVESTMENT PROPERTIES

The table below sets forth the conciliation between the initial and ending balances of the market value of investment properties of Consolidated Statement of Financial Position at the end of the period:

	December 31, 2025	December 31, 2024
In millions of COP
Balance at the beginning of the year	5,580,109	4,709,911
Acquisitions	871,551	682,334
Subsequent expenditure recognized as an asset	181,782	222,167
Sales/Write-offs	(112,375)	(156,697)
Amount reclassified (to) from other assets(1)	(35,441)	(77,862)
Gains on valuation(2)	109,781	200,256
Balance at the end of the period(3)	6,595,407	5,580,109

(1)The reclassification in 2025 and 2024 corresponds to properties of the Fondo Inmobiliario Colombia that were reclassified to the inventory category for COP 33,264 and COP 77,862, respectively. Additionally, in 2025, Bancolombia reclassified COP 2,177 to premises and equipment, considering the change in use of the asset.

(2)See Note 25.4. Other operating income.

(3)Between December 31, 2025, and 2024, there were no transfers in and out of Level 3 fair value hierarchy related with investment properties. See Note 30. Fair value of assets and liabilities.

The valuation adjustments recorded by the Cibest Corporate Group related to its investment properties are detailed below:

As of December 31, 2025

Type of asset	Balance at the<br>beginning of the<br>year	Appraisals	Net increase	Amount reclassified to other asset(1)	Adjusted fair<br>value at the end<br>of the year
In millions of COP
Buildings	5,080,276	106,838	880,549	(35,441)	6,032,222
Lands	499,833	2,943	60,409	-	563,185
Total	5,580,109	109,781	940,958	(35,441)	6,595,407

(1) Corresponds due to the fact that in 2025 and 2024, certain properties belonging to the Colombia Real Estate Fund were reclassified as inventory.

As of December 31, 2024

Type of asset	Balance at the<br>beginning of the<br>year	Appraisals	Net increase(1)	Amount reclassified to other asset(2)	Amount reclassified from construction to finished(3)	Adjusted fair<br>value at the end<br>of the year
In millions of COP
Buildings	4,369,629	191,051	578,639	(77,862)	18,819	5,080,276
Lands	340,282	9,205	169,165	-	(18,819)	499,833
Total	4,709,911	200,256	747,804	(77,862)	-	5,580,109

(1) The net increase in buildings corresponds mainly the purchase of PA Cedis Sodimac for COP 461,815, and Constellation property for COP 161,427.

(2) In 2024 corresponds to property of Fondo Inmobiliario Colombia that were reclassified to the inventories category because they are assets intended to be sold in the ordinary course of business.

(3) In 2024 the movement corresponds to the reclassification of properties that were under construction and have already been completed.

F-95

Table of Contents

Amounts recognized in the Consolidated Statement of Income for the period.

The table sets forth the main income recorded by the Cibest Corporate Group related to its investment properties:

	December 31, 2025	December 31, 2024	December 31, 2023
	In millions of COP
Income from rentals	360,610	325,286	228,325
Operating expenses due to:	61,658	60,334	39,191
Investment properties that generated income through rentals	26,225	37,394	28,813
Investment properties that did not generate income through rentals	35,433	22,940	10,378

Currently, there are no restrictions on the use or income derived from the buildings or lands that Cibest Corporate Group has as investment property.

The fair value of the Cibest Corporate Group investment properties for the year ending at December 31, 2025 and 2024, has been recorded according to the assessment made by independent external consulting companies that have the appropriate capacity and experience in performing those assessments. The appraisers are either approved by the Property Market Auctions of Colombia or foreign appraisers, who are required to provide a second signature by a Colombia appraiser accredited by the Property Market Auctions.

Fair value appraisals are carried out in accordance with IFRS 13. The reports made by the external consulting company contain the description of the valuation methodologies used, and key assumptions, such as, discount rates, calculation of applied expenses and income approach, among others. The fair value of the investment properties is based on the comparative market approach, which reflects the prices of recent transactions with similar characteristics. Upon determining the fair value of these investment properties, the greater and best use of these investment properties is their present use. For further information about measurement techniques and inputs used by consulting companies, see Note 30 Fair value of assets and liabilities.

As of December 31, 2025 and 2024, the Cibest Corporate Group does not have investment properties held under financial leases.

NOTE 10. PREMISES AND EQUIPMENT, NET

As of December 31, 2025 and 2024, the premises and equipment, net consisted of the following:

Composition	December 31, 2025(1)	December 31, 2024
In millions of COP
Premises and equipment for own use, net	2,410,891	2,650,602
Premises and equipment in operating leases, net	2,995,983	3,255,462
Total premises and equipment, net	5,406,874	5,906,064

(1) The accumulated value as of December 31, 2025, includes the effects of the classification of Banistmo S.A. as an asset held for sale as of December 18, 2025, which recorded property and equipment, net, amounting to COP 90,536, which were reclassified to Assets related to investments in subsidiaries held for sale. For more information, see Note 1.

F-96

Table of Contents

Reporting Entity, Note 2.D12. Material Accounting Policies – Assets Held for Sale and Discontinued Operations and Note 31. Discontinued Operation.

As of December 31, 2025

Premises and equipment for own use

Premises and equipment for own use		Balance as of<br>January 1,<br>2025		Roll - forward										Balance as of<br><br>December 31,<br><br>2025(1)
	Reclassification to assets held for sale(1)		Additions(2)		Expenses<br><br>depreciation and<br><br>impairment(3)		Disposals		Transfers(4)		Effect of<br>changes in<br>foreign<br>exchange<br>rate
In millions of COP
Land
Cost		538,633		(8,646)		-		-		(4,007)		(3,406)	(28,942)	493,632
Construction in progress
Cost		46,689		-		21,124		-		-		(54,157)	(2,781)	10,875
Buildings
Cost		1,876,034		(212,870)		1,624		-		(10,874)		44,340	(77,951)	1,620,303
Accumulated depreciation		(574,669)		166,192		-		(28,289)		6,543		6,261	32,171	(391,791)
Furniture and fixtures
Cost		780,165		(87,437)		59,475		-		(16,527)		(1,405)	(26,733)	707,538
Accumulated depreciation		(464,712)		72,041		-		(45,846)		13,918		(157)	15,065	(409,691)
Accumulated impairment		-		-		-		(44)		44		-	-	-
Computer equipment
Cost		1,072,944		(127,379)		109,669		-		(58,991)		(1,189)	(34,209)	960,845
Accumulated depreciation		(646,428)		80,050		-		(108,511)		47,440		158	24,113	(603,178)
Accumulated impairment		-		-		-		(499)		499		-	-	-
Vehicles
Cost		36,434		(4,622)		6,298		-		(2,713)		1,507	(1,932)	34,972
Accumulated depreciation		(19,810)		2,668		-		(5,634)		2,000		-	1,148	(19,628)
Leasehold improvements
Cost		5,907		-		33,103		-		(177)		(31,048)	(251)	7,534
Accumulated depreciation		(585)		-		-		(28)		1		-	92	(520)
Total premises and equipment for own use - cost		4,356,806		(440,954)		231,293		-		(93,289)		(45,358)	(172,799)	3,835,699
Total premises and equipment - accumulated depreciation		(1,706,204)		320,951		-		(188,308)		69,902		6,262	72,589	(1,424,808)
Total premises and equipment - accumulated impairment		-		-		-		(543)		543		-	-	-
Total premises and equipment for own use, net		2,650,602		(120,003)		231,293		(188,851)		(22,844)		(39,096)	(100,210)	2,410,891

(1) The accumulated value as of December 31, 2025, includes the effects of the classification of Banistmo S.A. as an asset held for sale as of December 18, 2025, which reports Premises and equipment for own use, net, of COP 90,536. The associated reclassification amounted to COP 120,003; the difference of COP 29,467 corresponds to the movements recognized between the classification date and the end of the period—mainly expenses depreciation and impairment, additions, disposals, transfers, and the effect of changes in foreign exchange rate—which affect Land; Construction in progress; Buildings; Furniture and fixtures; Computer equipment; Vehicles; and Leasehold improvements. For more information, see Note 1. Reporting Entity, Note 2.D12. Material Accounting Policies – Assets Held for Sale and Discontinued Operations and Note 31. Discontinued Operation.

(2) Corresponds mainly to Bancolombia S.A., due to the acquisition of computer equipment — including laptops, ATMs, central processing units (CPU), and digital recorders — as well as furniture and fixtures such as handling units, power plants, modular systems, and executive chairs. It also includes investments made in leasehold improvements across several branches and offices nationwide. Finally, it incorporates construction in progress projects related to educational infrastructure, operational branches, and corporate developments in different locations.

(3) The impairment mainly relates to Bancolombia S.A., and corresponds to the procedure applied to assets affected by obsolescence, accidents, and other events, resulting in their write‑off. See Note 26.3. Depreciation, amortization and impairment.

(4) Corresponds mainly to Bancolombia S.A. and includes movements in leasehold improvements transferred to right‑of‑use assets and to buildings, arising from adaptations at various branches. It also includes construction in progress

F-97

Table of Contents

transferred to buildings, the settlement of advances, transfers to idle assets, and reclassifications from investment properties. Movements in land correspond to transfers to idle assets and reclassifications from investment properties.

Premises and equipment in operating leases

Premises and equipment in operating leases		Balance as of<br>January 1,<br>2025		Roll - forward						Balance as of<br>December 31,<br>2025
	Additions(2)		Expenses<br><br>depreciation and<br><br>impairment(1)		Disposals(3)		Transfers
In millions of COP
Furniture and fixtures
Cost		2,091		-		-		-	-		2,091
Accumulated depreciation		(868)		-		(254)		-	-		(1,122)
Computer equipment
Cost		265,230		77,896		-		(11,966)	(37,468)		293,692
Accumulated depreciation		(124,865)		-		(68,811)		9,786	33,038		(150,852)
Vehicles
Cost		4,066,966		907,677		-		(247,948)	(919,118)		3,807,577
Accumulated depreciation		(953,092)		-		(355,480)		66,120	287,049		(955,403)
Total premises and equipment in operating leases - cost		4,334,287		985,573		-		(259,914)	(956,586)		4,103,360
Total premises and equipment - accumulated depreciation		(1,078,825)		-		(424,545)		75,906	320,087		(1,107,377)
Total premises and equipment in operating leases, net		3,255,462		985,573		(424,545)		(184,008)	(636,499)		2,995,983

(1)See Note 26.3. Depreciation, amortization and impairment.

(2)Additions correspond mainly to Bancolombia S.A., explained by the purchase of vehicles to be placed into operating lease contracts, through Renting Colombia S.A.S.

(3)Corresponds mainly to Bancolombia S.A. and includes movements in vehicles arising from the transfer of assets whose operating lease contracts ended and were reclassified as inventory, as well as transfers to loan portfolio associated with financial lease repositioning.

Premises and equipment total

Premises and equipment total		Balance as of<br>January 1,<br>2025		Roll - forward										Balance as of<br><br>December 31,<br><br>2025(1)
	Reclassification to assets held for sale(1)		Additions		Expenses<br><br>depreciation and<br><br>impairment(2)		Disposals		Transfers(3)		Effect of<br>changes in<br>foreign<br>exchange<br>rate
In millions of COP
Total premises and equipment - cost		8,691,093		(440,954)		1,216,866		-		(353,203)		(1,001,944)	(172,799)	7,939,059
Total premises and equipment - accumulated depreciation		(2,785,029)		320,951		-		(612,853)		145,808		326,349	72,589	(2,532,185)
Total premises and equipment - accumulated impairment		-		-		-		(543)		543		-	-	-
Total premises and equipment, net		5,906,064		(120,003)		1,216,866		(613,396)		(206,852)		(675,595)	(100,210)	5,406,874

(1)The accumulated value as of December 31, 2025, includes the effects of the classification of Banistmo S.A. as an asset held for sale as of December 18, 2025. For more information, see Note 1. Reporting Entity, Note 2.D12. Material Accounting Policies – Assets Held for Sale and Discontinued Operations and Note 31. Discontinued Operation.

(2)See Note 26.3. Depreciation, amortization and impairment.

(3)Total transfers of premises and equipment, net, to assets held for sale, net amount to COP (633,021).

F-98

Table of Contents

As of December 31, 2024

Premises and equipment for own use

Premises and equipment for own use		Balance as of<br>January 1,<br>2024		Roll - forward								Balance as of<br>December 31,<br>2024
	Additions(1)		Expenses<br><br>depreciation and<br><br>impairment(2)		Disposals(3)		Transfers(4)		Effect of<br>changes in<br>foreign<br>exchange<br>rate
In millions of COP
Land
Cost		517,405		-		-		(8,729)		1,437	28,520	538,633
Construction in progress
Cost		83,633		27,273		-		(19,945)		(51,842)	7,570	46,689
Buildings
Cost		1,740,005		14,187		-		(17,843)		42,645	97,040	1,876,034
Accumulated depreciation		(493,196)		-		(36,311)		5,581		865	(51,608)	(574,669)
Furniture and fixtures
Cost		678,138		88,033		-		(20,444)		98	34,340	780,165
Accumulated depreciation		(415,517)		-		(42,332)		15,163		(6)	(22,020)	(464,712)
Accumulated impairment		-		-		(441)		441		-	-	-
Computer equipment
Cost		974,433		163,304		-		(111,079)		(1,857)	48,143	1,072,944
Accumulated depreciation		(592,436)		-		(116,102)		93,511		6	(31,407)	(646,428)
Accumulated impairment		-		-		(401)		401		-	-	-
Vehicles
Cost		33,980		4,809		-		(5,174)		445	2,374	36,434
Accumulated depreciation		(17,306)		-		(6,007)		4,762		17	(1,276)	(19,810)
Leasehold improvements
Cost		16,637		33,848		-		-		(44,781)	203	5,907
Accumulated depreciation		(522)		-		(23)		-		-	(40)	(585)
Total premises and equipment for own use - cost		4,044,231		331,454		-		(183,214)		(53,855)	218,190	4,356,806
Total premises and equipment - accumulated depreciation		(1,518,977)		-		(200,775)		119,017		882	(106,351)	(1,706,204)
Total premises and equipment - accumulated impairment		-		-		(842)		842		-	-	-
Total premises and equipment for own use, net		2,525,254		331,454		(201,617)		(63,355)		(52,973)	111,839	2,650,602

(1) Corresponds mainly to Bancolombia S.A due to:

Computer equipment, mainly: ATMs, laptops, central processing unit (CPU), and security cameras.

Furniture and fixtures, mainly: Condensing unit, modular system, handling unit and Chiller (complementary air conditioning equipment), power plant, and cashier stand.

Leasehold improvements, mainly: Cosmocentro building, Carrera Primera Branch and Calle 76 Branch.

(2) See Note 26.3. Depreciation, amortization and impairment.

The impairment, mainly in Bancolombia S.A, corresponds to the procedure defined in the assets for obsolescence, accidents and others, which results in the write-off of the asset.

(3) Corresponds mainly to Bancolombia S.A in computer equipment due to obsolescence of ATMs and laptops.

(4) Corresponds mainly to Bancolombia S.A. for transfer to right-of-use assets due to completion of improvements and activation of contracts, the most significant improvements being in branches and activation due to completion of improvements of other assets.

F-99

Table of Contents

Premises and equipment in operating leases

Premises and equipment in operating leases		Balance as of<br>January 1,<br>2024		Roll - forward						Balance as of<br>December 31,<br>2024
	Additions		Expenses<br><br>depreciation and<br><br>impairment(1)		Disposals		Transfers
In millions of COP
Furniture and fixtures
Cost		2,091		-		-		-	-		2,091
Accumulated depreciation		(614)		-		(254)		-	-		(868)
Computer equipment
Cost		228,161		73,678		-		(15,015)	(21,594)		265,230
Accumulated depreciation		(95,638)		-		(63,251)		12,730	21,294		(124,865)
Vehicles(2)
Cost		4,787,645		673,997		-		(148,572)	(1,246,104)		4,066,966
Accumulated depreciation		(924,365)		-		(369,475)		30,259	310,489		(953,092)
Total premises and equipment in operating leases - cost		5,017,897		747,675		-		(163,587)	(1,267,698)		4,334,287
Total premises and equipment - accumulated depreciation		(1,020,617)		-		(432,980)		42,989	331,783		(1,078,825)
Total premises and equipment in operating leases, net		3,997,280		747,675		(432,980)		(120,598)	(935,915)		3,255,462

(1)See Note 26.3. Depreciation, amortization and impairment.

(2)The decrease is mainly in Bancolombia S.A., due to cancellations and transfers to inventories of vehicles leased..

Premises and equipment total

Premises and equipment total		Balance as of<br>January 1,<br>2024		Roll - forward								Balance as of<br>December 31,<br>2024
	Additions		Expenses<br><br>depreciation and<br><br>impairment(1)		Disposals		Transfers		Effect of<br>changes in<br>foreign<br>exchange<br>rate
In millions of COP
Total premises and equipment - cost		9,062,128		1,079,129		-		(346,801)		(1,321,553)	218,190	8,691,093
Total premises and equipment - accumulated depreciation		(2,539,594)		-		(633,755)		162,006		332,665	(106,351)	(2,785,029)
Total premises and equipment - accumulated impairment		-		-		(842)		842		-	-	-
Total premises and equipment, net		6,522,534		1,079,129		(634,597)		(183,953)		(988,888)	111,839	5,906,064

(1)See Note 26.3. Depreciation, amortization and impairment.

As of December 31, 2025 and 2024, there were contractual commitments for the purchase of premises and equipment of COP 2,702 and COP 2,664, respectively. As of December 31, 2025, these commitments relate mainly to the purchase of assets for the Niquía Datacenter (data processing center).

As of December 31, 2025 and 2024, Cibest Corporate Group had no premises and equipment pledged as collateral or subject to ownership restrictions. In addition, based on the assessment performed by Cibest Corporate Group, there is no evidence of impairment of its premises and equipment.

As of December 31, 2025 and 2024, the amount of fully depreciated premises and equipment that is still in use is COP 632,615 and COP 735,090, respectively, mainly comprised of computer equipment, furniture and fixtures, buildings, vehicles, and machinery. The temporarily idle premises and equipment amounted to COP 131,105 in 2025 and COP 97,055 in 2024.

F-100

Table of Contents

NOTE 11. LEASES

11.1. Lessor

Finance leases

Cibest Corporate Group has entered into lease agreements as the lessor. These lease arrangements involve buildings, machinery and equipment, vehicles, and other assets; and their terms range between one and twenty years, as follows:

As of December 31, 2025

Period(1)	Gross investment in finance<br><br>lease receivable	Present value of minimum<br><br>payments
In millions of COP
Less than 1 year	1,158,027	1,016,714
Between 1 and 5 years	10,841,602	8,536,355
Greater than 5 years	32,724,445	18,940,060
Total gross investment in finance lease receivable/ present value of minimum payments	44,724,074	28,493,129
Less: Future financial income(2)	(16,230,945)	-
Present value of payments receivable(3)	28,493,129	28,493,129
Minimum non-collectable payments impairment(3)	(1,066,792)	(1,066,792)
Total	27,426,337	27,426,337

(1)The accumulated value as of December 31, 2025, includes the effects of the classification of Banistmo S.A. as an asset held for sale as of December 18, 2025,which reported a total gross investment of COP 554,504, a total present value of minimum lease payments of COP 493,277, and an allowance for leasing portfolio of COP 23,545, which were reclassified to Assets related to investments in subsidiaries held for sale. For more information, see Note 1. Reporting Entity, Note 2.D12. Significant Accounting Policies – Assets Held for Sale and Discontinued Operations, and Note 31. Discontinued Operation.

(2)Future financial income: Total Gross Investment - Total Present Value of minimum payments.

(3)See Note 6. Loans and advances to customers, net.

As of December 31, 2024

Period	Gross investment in finance<br><br>lease receivable	Present value of minimum<br><br>payments
In millions of COP
Less than 1 year	1,443,191	1,253,099
Between 1 and 5 years	10,610,800	8,446,425
Greater than 5 years	31,988,317	17,592,080
Total gross investment in finance lease receivable/ present value of minimum payments	44,042,308	27,291,604
Less: Future financial income(1)	(16,750,704)	-
Present value of payments receivable(2)	27,291,604	27,291,604
Minimum non-collectable payments impairment(2)	(1,088,272)	(1,088,272)
Total	26,203,332	26,203,332

(1)Future financial income: Total Gross Investment - Total Present Value of minimum payments.

(2)See Note 6. Loans and advances to customers, net.

F-101

Table of Contents

Unsecured residual value(*)

At the end of the reporting period, the unsecured residual values of the assets under financial leasing are:

Type of asset	December 31, 2025	December 31, 2024
In millions of COP
Technological equipment	60,426	58,357
Buildings(1)	48,352	-
Machinery and equipment	12,269	20,650
Vehicles	8,825	15,966
Furniture and fixtures	11	14
Other assets	-	1,862
Total	129,883	96,849

(1) The variation in buildings compared to the previous year corresponds to the activation of three new contracts in Bancolombia.

(*)The unsecured residual value is the part of the residual value of the leased asset, whose realization is not secured or is secured by a third party related to the lessor.

Amounts recognized as income for extensions

At the end of the reporting period, the following entries are recognized as income corresponding to contract extensions or automatic time extension of financial leasing contracts:

Type of asset	December 31, 2025(1)	December 31, 2024
In millions of COP
Technological equipment	14,927	15,572
Buildings	6,244	9,254
Machinery and equipment	314	236
Vehicles	161	200
Total	21,646	25,262

(1) The accumulated value as of December 31, 2025 includes the effects of the classification of Banistmo S.A. as an asset held for sale as of December 18, 2025, which recorded interest income from finance leases amounting to COP 34,630. For more information, see Note 1. Reporting Entity, Note 2.D12. Material Accounting Policies – Assets Held for Sale and Discontinued Operations and Note 31. Discontinued Operation.

As of December 31, 2025, 2024 and 2023, Cibest Corporate Group has recognized in its financial statements COP 3,199,293, COP 3,524,414, and COP 3,841,841, corresponding to financial leases income, respectively.

Gross Investment Growth: Increase in Finance Leases During the Period

F-102

Table of Contents

The following information corresponds to the growth in gross investment in finance leases during the current period:

	December 31, 2025	December 31, 2024
In millions of COP
Gross investment in finance leases	9,709,356	7,267,877
Unearned income	(3,998,816)	(2,866,058)
Leases cancelled	(1,468,518)	(1,840,877)
Total	4,242,022	2,560,942

Operating leases

Some of Cibest Corporate Group’s subsidiaries lease assets to third parties under the lease modality. Assets provided through operating leases are recorded as premises and equipment. The terms established for these agreements range from one year to ten years.

The following table presents the information of minimum payments by lease to be received:

	December 31, 2025	December 31, 2024
In millions of COP
Less than 1 year	232,527	246,875
Between 1 and 5 years	139,869	186,465
Greater than 5 years	71,054	56,999
Total	443,450	490,339

As of December 31, 2025, 2024 and 2023, Cibest Corporate Group have recognized in its financial statements COP 724,656, COP 795,179 and COP 833,244 corresponding to operating leases income, respectively. Additionally, Cibest Corporate Group recognized other services related to the lease for COP 629,473, COP 671,251 and COP 660,442 respectively.

Risk management associated with leases

Cibest Corporate Group, in those companies offering leasing services, acting as lessor, has a comprehensive asset management model for those assets classified as premises and equipment. For the risk of non-payment of rent by the lessee, the model includes policies and guidelines in the origination of leasing contracts, where the lessee's payment capacity is assessed through financial analysis, historical payment behavior evaluation, and risk level.

The model includes an impairment test performed annually for this type of asset, in which both external (economic and legal) and internal (insurance, maintenance, sales) indicators that affect the assets and their environment are assessed. Likewise, the residual value calculations were updated to reflect the effect of new macroeconomic conditions. The lessor performs a detailed review process at the time the asset is returned by the lessees to ensure its operating condition and determine any necessary adjustments.

The process also involves independent experts, separate from the commercial area, who continuously monitor used‑asset market conditions, conduct backtesting to validate the consistency of the variables used in estimating residual value (commercial value less commercialization costs), and periodically review the model results with key executives. These efforts are complemented by agreements with suppliers that facilitate information exchange, technical insights, and, in some cases, the development of mechanisms to mitigate residual risk.

To manage the risks associated with these assets, support is provided by a specialized insurance area, an international broker, and various insurance companies. These parties assist in designing and defining the strategies and coverages that safeguard the lessor, the assets, and the customers.

Additionally, in Renting Colombia S.A.S. vehicle rental business, assets are managed with the goal of preserving their commercial value through the execution of the necessary maintenance to prevent deterioration beyond that caused by normal use. To achieve this, service indicators are periodically reviewed with suppliers to ensure quality and compliance with expected standards.

F-103

Table of Contents

As an integral part of the safe mobility strategy and the Strategic Road Safety Plan, telemetry technologies and automated data collection systems are incorporated to enable real-time monitoring of the assets. This information is systematically analyzed to identify risk patterns, prevent physical damage, and reduce the likelihood of losses due to external fraud affecting the assets.

The analysis derived from these data facilitates timely decision-making, the implementation of customized action plans, and the strengthening of preventive controls, in compliance with current regulations and with the objective of preserving the asset’s useful life, user safety, and business sustainability.

11.2. Lessee

Cibest Corporate Group have entered into lease agreements as a lessee. These arrangements involve offices, branches and administrative offices, vehicles, as well as certain computer equipment and furniture and fixtures. As of December 31, 2025, and 2024, the Roll-forward of right-of-use assets was as follows:

As of December 31, 2025

Right-of-use assets		Balance as of<br><br>January 1, 2025		Roll-forward												Balance as of<br><br>December 31, 2025(1)
	Reclassification to assets held for sale(1)		Acquisitions(2)		Additions(3)		Expenses<br><br>depreciation(4)		Disposals(5)		Revaluation(6)		Effect of changes<br><br>in foreign<br><br>exchange rate
In millions of COP
Buildings
Cost		2,644,519		(797,348)		129,082		33,938		-		(99,936)		102,512	(48,283)	1,964,484
Accumulated depreciation		(925,898)		339,138		-		-		(157,704)		35,994		166	24,995	(683,309)
Computer equipment
Cost		67,701		(12,586)		37,568		-		-		(10,236)		(5,071)	(8,261)	69,115
Accumulated depreciation		(48,916)		7,893		-		-		(10,779)		9,373		-	5,082	(37,347)
Furniture and fixtures
Cost		7,986		-		8,075		-		-		-		(7,692)	(971)	7,398
Accumulated depreciation		(3,071)		-		-		-		(1,098)		-		-	396	(3,773)
Vehicles
Cost		19,289		-		147,008		-		-		(146,024)		218	(144)	20,347
Accumulated depreciation		(4,404)		-		-		-		(2,880)		8		-	79	(7,197)
Total right-of-use assets – cost		2,739,495		(809,934)		321,733		33,938		-		(256,196)		89,967	(57,659)	2,061,344
Total right-of-use assets - accumulated depreciation		(982,289)		347,031		-		-		(172,461)		45,375		166	30,552	(731,626)
Total right-of-use assets, net		1,757,206		(462,903)		321,733		33,938		(172,461)		(210,821)		90,133	(27,107)	1,329,718

(1)The accumulated value as of December 31, 2025, includes the effects of Banistmo S.A.'s classification as asset held for sale since December 18, 2025. The net effect of the reclassification to assets held for sale for COP (462,903), corresponds to the decrease in the right-of-use assets for COP (192,114), additions made for COP 5,919, revaluations and disposals of contracts for COP (189,350), and expenses depreciation recognized in Consolidated Statement of Income for COP (34,830), and effect of changes in foreign exchange rate for COP (52,528). For more information see Note 1. Reporting Entity, Note 2.D.12 Material Accounting Policies - Assets held for sale and discontinued operations and Note 31. Discontinued Operation.

(2)The main acquisitions were vehicles for fleet renewal, and, for buildings, by new branch leases were signed.

(3)The additions for buildings mainly correspond to adjustments in the branches.

(4)See Note 26.3 Depreciation, amortization and impairment.

(5)The main disposals due to contract termination were mainly in vehicles at Renting S.A. and for buildings represented in the branches.

(6)The variation corresponds mainly to changes in the estimated term of buildings lease liabilities, mainly in branches.

F-104

Table of Contents

As of December 31, 2024

Right-of-use assets		Balance as of<br><br>January 1, 2024		Roll-forward										Balance as of<br><br>December 31, 2024
	Acquisitions		Additions		Expenses<br><br>depreciation(1)		Disposals		Revaluation(2)		Effect of changes<br><br>in foreign<br><br>exchange rate
In millions of COP
Buildings
Cost		2,302,922		105,666		61,879		-		(62,106)		91,414	144,744	2,644,519
Accumulated depreciation		(706,786)		-		-		(191,472)		34,561		-	(62,201)	(925,898)
Computer equipment
Cost		58,069		4,552		195		-		(3,538)		803	7,620	67,701
Accumulated depreciation		(34,936)		-		-		(12,352)		3,398		-	(5,026)	(48,916)
Furniture and fixtures
Cost		2,762		5,083		-		-		(509)		33	617	7,986
Accumulated depreciation		(2,607)		-		-		(656)		509		-	(317)	(3,071)
Vehicles
Cost		19,755		89,733		-		-		(90,464)		21	244	19,289
Accumulated depreciation		(5,134)		-		-		(3,080)		4,005		-	(195)	(4,404)
Total right-of-use assets – cost		2,383,508		205,034		62,074		-		(156,617)		92,271	153,225	2,739,495
Total right-of-use assets - accumulated depreciation		(749,463)		-		-		(207,560)		42,473		-	(67,739)	(982,289)
Total right-of-use assets, net		1,634,045		205,034		62,074		(207,560)		(114,144)		92,271	85,486	1,757,206

(1)Expenses depreciation differs from the COP (160,768) presented in the Consolidated Statement of Income due to the depreciation expense of Banistmo S.A. for COP (46,792), classified as a discontinued operation in 2025. For more information, see Note 31. Discontinued operation and Note 26.3 Depreciation, amortization and impairment.

(2)The variation corresponds mainly to changes in the estimated term of buildings lease liabilities.

The following table sets forth the changes in lease liabilities as of December 31, 2025, and 2024:

As of December 31, 2025

Concept	Total
In millions of COP
Balance as of January 1, 2025	1,889,364
(-) Reclassification to assets held for sale(1)	(580,371)
(+) New contracts	173,687
(+/-) Reassessment of the lease liability and disposals(2)	24,697
(-) Payments	(271,929)
(+) Accrued Interest(3)	116,556
(+/-) Effect of changes in foreign exchange rate(4)	(26,965)
Balance as of December 31, 2025	1,325,039

(1)The accumulated value as of December 31, 2025, includes the effects of Banistmo S.A.'s classification as asset held for sale since December 18, 2025. The net effect of the asset held for sale for COP (580,371), corresponds to the decrease in lease liabilities for COP (275,492), new contracts for COP 2,088, reassessment and disposals of contracts for COP (194,773), payments for COP (48,181), accrued interest recognized in Consolidated Statement of Income for COP 4,572, and effect of changes in foreign exchange rate for COP (68,585). For more information

F-105

Table of Contents

see Note 1. Reporting Entity, Note 2.D.12 Material Accounting Policies - Assets held for sale and discontinued operations and Note 31. Discontinued Operation.

(2)The variation corresponds mainly to changes in the estimated term of buildings lease liabilities for COP 83,394 and disposals for COP (58,697).

(3)The COP 5,442 difference from the interest expense on lease liabilities recognized in the Consolidated Statement of Income corresponds to the expense accrued for the difference between the book value of the right-of-use asset and the lease liability at the time of early termination of contracts.

(4)Corresponds to the decrease in the market representative rate from COP 4,409.15 Colombian pesos in December 2024 to COP 3,757.08 Colombian pesos in December 2025.

As of December 31, 2024

Concept	Total
In millions of COP
Balance as of January 1, 2024	1,773,610
(+) New contracts	114,425
(+/-) Reassessment of the lease liability and disposals(1)	74,457
(-) Payments	(311,082)
(+) Accrued Interest(2)	136,924
(+/-) Effect of changes in foreign exchange rate(3)	101,030
Balance as of December 31, 2024	1,889,364

(1)The variation corresponds mainly to changes in the estimated term of buildings lease liabilities for COP 95,712 and disposals for COP (21,255).

(2)The COP 29,516 difference from the interest expense on lease liabilities recognized in the Consolidated Statement of Income corresponds to the discontinuation of operations at Banistmo S.A. for COP 28,138 and the expense accrued for the difference between the book value of the right-of-use asset and the lease liability at the time of early termination of contracts for COP 1,378.

(3)Corresponds to the increase in the market representative rate from COP 3,822.05 Colombian pesos in December 2023 to COP 4,409.15 Colombian pesos in December 2024.

The following table presents the maturity analysis of lease liabilities as of December 31, 2025, and 2024:

As of December 31, 2025

Type of assets	Maturity less than 1 year	Maturity between 1 and 3 years	Maturity between 3 and 5 years	Maturity more than 5 years	Total lease liabilities
In millions of COP
Buildings	22,737	155,819	97,788	1,014,563	1,290,907
Computer equipment	3,523	1,881	24,775	-	30,179
Furniture and fixtures	-	366	3,332	-	3,698
Vehicles	-	255	-	-	255
Total lease liabilities(1)	26,260	158,321	125,895	1,014,563	1,325,039

(1)The accumulated value as of December 31, 2025, includes the effects of Banistmo S.A.'s classification as asset held for sale since December 18, 2025, which had lease liabilities amounting to COP 275,492. For more information see Note 1. Reporting Entity, Note 2.D.12 Material Accounting Policies - Assets held for sale and discontinued operations and Note 31. Discontinued Operation.

F-106

Table of Contents

As of December 31, 2024

Type of assets	Maturity less than 1 year	Maturity between 1 and 3 years	Maturity between 3 and 5 years	Maturity more than 5 years	Total lease liabilities
In millions of COP
Buildings	20,467	71,155	220,050	1,551,740	1,863,412
Computer equipment	1,332	9,683	8,693	1,224	20,932
Furniture and fixtures	-	890	3,954	-	4,844
Vehicles	-	176	-	-	176
Total lease liabilities	21,799	81,904	232,697	1,552,964	1,889,364

The following table shows the weighted average rates and average useful life of right-of-use assets as of December 31, 2025, and 2024:

As of December 31, 2025

Right-of-use assets	Weighted average life	Weighted average<br><br>remaining lease terms	Weighted average discount rates
Buildings	267 months	149 months	9.07	%
Computer equipment	55 months	45 months	8.76	%
Furniture and fixtures	54 months	51 months	7.35	%
Vehicles	41 months	32 months	6.26	%

As of December 31, 2024

Right-of-use assets	Weighted average life	Weighted average<br><br>remaining lease terms	Weighted average discount rates
Buildings	222 months	109 months	7.11 %
Computer equipment	82 months	32 months	7.52 %
Furniture and fixtures	53 months	53 months	8.71	%
Vehicles	49 months	17 months	10.44 %

The following table shows the detail of leases in the Consolidated Statement of Income as of December 31, 2025, and 2024:

As of December 31, 2025

Right-of-use assets	Financial interest(1)	Expenses depreciation(2)	Short-term leases	Leases for which the underlying asset is of low value	Variable payments
In millions of COP
Buildings	109,074	157,704	1,390	971	4,854
Computer equipment	1,800	10,779	1,113	10,270	8,975
Furniture and fixtures	230	1,098	235	3	-
Vehicles	10	2,880	-	-	-
Total	111,114	172,461	2,738	11,244	13,829
Discontinued operations Banistmo S.A.(3)	4,572	34,830	-	891	-

F-107

Table of Contents

(1)Includes the expense generated by the difference between the carrying amount of the asset for the right to use and the liability for leasing at the time of the early termination of lease contracts by COP 5,442, see Note 25.2 Interest expenses.

(2)See Note 26.3 Depreciation, amortization and impairment.

(3)The accumulated value as of December 31, 2025, includes the effects of Banistmo S.A.'s classification as asset held for sale since December 18, 2025. For more information see Note 1. Reporting Entity, Note 2.D.12 Material Accounting Policies - Assets held for sale and discontinued operations and Note 31. Discontinued Operation.

As of December 31, 2024

Right-of-use assets	Financial interest(1)	Expenses<br><br>depreciation(2)	Short-term leases	Leases for which the underlying asset is of low value	Variable payments
In millions of COP
Buildings	105,317	145,827	1,350	18	5,300
Computer equipment	1,891	11,230	169	9,098	-
Furniture and fixtures	93	656	410	9	-
Vehicles	107	3,055	5	-	-
Total	107,408	160,768	1,934	9,125	5,300
Discontinued operations Banistmo S.A.(3)	28,138	46,792	-	974	-

(1)Includes the expense generated by the difference between the carrying amount of the asset for the right to use and the liability for leasing at the time of the early termination of lease contracts by COP 1,378, see Note 25.2 Interest expenses.

(2)See Note 26.3 Depreciation, amortization and impairment.

(3)The accumulated value as of December 31, 2025, includes the effects of Banistmo S.A.'s classification as asset held for sale since December 18, 2025. For more information see Note 1. Reporting Entity, Note 2.D.12 Material Accounting Policies - Assets held for sale and discontinued operations and Note 31. Discontinued Operation.

The following table presents the minimum payments lease liabilities as of December 31, 2025, and 2024:

As of December 31, 2025

Type of assets	Maturity less than 1 year	Maturity between 1 and 3 years	Maturity between 3 and 5 years	Maturity more than 5 years	Total minimum payments lease liabilities
In millions of COP
Buildings	27,499	177,815	142,075	2,012,795	2,360,184
Computer equipment	4,193	1,955	28,569	-	34,717
Furniture and fixtures	-	323	3,788	-	4,111
Vehicles	71	200	-	-	271
Total minimum payments lease liabilities(1)	31,763	180,293	174,432	2,012,795	2,399,283

(1)The accumulated value as of December 31, 2025, includes the effects of Banistmo S.A.'s classification as asset held for sale since December 18, 2025, which had minimum payments lease liabilities of COP 361,257. For more

F-108

Table of Contents

information see Note 1. Reporting Entity, Note 2.D.12 Material Accounting Policies - Assets held for sale and discontinued operations and Note 31. Discontinued Operation.

As of December 31, 2024

Type of assets	Maturity less than 1 year	Maturity between 1 and 3 years	Maturity between 3 and 5 years	Maturity more than 5 years	Total minimum payments lease liabilities
In millions of COP
Buildings	24,464	87,714	318,197	2,530,561	2,960,936
Computer equipment	1,523	10,641	9,755	1,267	23,186
Furniture and fixtures	-	986	4,625	-	5,611
Vehicles	72	120	-	-	192
Total minimum payments lease liabilities	26,059	99,461	332,577	2,531,828	2,989,925

F-109

Table of Contents

NOTE 12. GOODWILL AND INTANGIBLE ASSETS, NET

Goodwill and intangible assets, net, are as follows:

	December 31, 2025(1)	December 31, 2024
In millions of COP
Goodwill(1)	1,947,325	9,017,419
Intangible assets, net	589,855	750,484
Total intangible assets and goodwill, net	2,537,180	9,767,903

(1) The accumulated amount as of December 31, 2025 includes the effects of the classification of Banistmo S.A. as an asset held for sale since December 18, 2025. For more information, see Note 1. Reporting Entity; Note 2.D12. Significant Accounting Policies – Assets Held for Sale and Discontinued Operations; and Note 31. Discontinued Operation.

12.1 Goodwill

The following table presents the goodwill:

	December 31, 2025	December 31, 2024
In millions of COP
Balance at beginning of the year, net	9,017,419	7,818,125
Impairment of goodwill(1)	(5,022,822)	-
Reclassification to assets held for sale(2)	(852,746)	-
Effect of change in foreign exchange rate(3)	(1,194,526)	1,199,294
Balance at end of the year, net	1,947,325	9,017,419

(1)As of December 31, 2025, Cibest Corporate Group recognized an impairment loss of COP 5,022,822 corresponding to the cash-generating unit (CGU) “Banistmo,” recorded in the Consolidated Statement of Profit or Loss, within the framework of the promise to sell 100% of Banistmo S.A., signed on December 18, 2025, for USD 1,418,000. The transaction price constituted observable evidence of a “fair value less costs of disposal” (FVLCOD) that was lower than the CGU’s carrying amount, which resulted in the impairment loss. The measurement of the recoverable amount was based on the FVLCOD determined from the sale contract price (market approach), classified within level 3 of the fair value hierarchy in accordance with IFRS 13. The “Banistmo” CGU is part of the Panama Banking operating segment. For more information, see Note 1. Reporting Entity, Note 2.D12. Material Accounting Policies – Assets Held for Sale and Discontinued Operations, Note 2.D13. Material Accounting Policies – Impairment of Assets, Cash-Generating Units, Note 31. Discontinued Operation, and Note 30. Fair Value of Assets and Liabilities.

(2)As of December 31, 2025, it includes the effects of the classification of Banistmo S.A. as an asset held for sale since December 18, 2025, corresponding to the value of the goodwill that was not impaired, included in the sale price. For more information, see Note 1. Reporting Entity, Note 2.D12. Material Accounting Policies – Assets Held for Sale and Discontinued Operations, and Note 31. Discontinued Operation.

(3)The market representative rate at the end of December 31, 2025, 2024 and 2023 is COP 3,757.08, COP 4,409.15 and COP 3,822.05, respectively. See Note 2.D.1. Functional currency, transactions and balances in foreign currency.

Cibest Corporate Group tests goodwill recognized in business combinations for impairment at least annually, through a process that begins with estimating the recoverable amount of a group of cash‑generating units (CGUs) that correspond to the operating segment. The recoverable amount may be determined by management with reference to market value, when available, through pricing models, or with the assistance of a valuation specialist.

F-110

Table of Contents

Determining the recoverable amount requires management to make assumptions and use estimates to project cash flows for periods beyond normal management reporting requirements, in order to determine value in use as a component of the recoverable amount. This includes extending projections into perpetuity based on long‑term future cash flows consistent with the CGU’s ongoing operations, evaluating the appropriate discount rate, estimating the recoverable amount of each CGU, and valuing the separable assets of each business whose goodwill is being tested.

The key assumptions used by management in determining the recoverable amount as of December 31, 2025 and 2024 are:

As of December 31, 2025

Operating segment	Valuation methodology	Key assumptions	Discount rate (real)(1)		Growth rate (real)(2)		Goodwill 2025
In millions of COP
Banking El Salvador	Discounted Cash flow	5 years plan	16.20	%	3.80	%	1,059,779
Banking Guatemala	Discounted Cash flow	5 years plan	11.20	%	5.00	%	876,886
Other segments	Comparable multiples	Multiples EV/ Revenue and EV/EBITDA	Does not apply		Does not apply		10,660
Total							1,947,325

(1)The discount rate is the return that would be expected for an investment that generates cash flows similar to those that are expected to be obtained from the use of the CGU. CAPM (Capital Asset Pricing Model) methodology was used as a basis to determine this rate.

(2)This rate is equivalent to the nominal or real growth of the economy in Guatemala and El Salvador, which is considered an important concept for the growth of the banking industry.

As of December 31, 2024

Operating segment	Valuation methodology	Key assumptions	Discount rate (real)(1)		Growth rate (real)(2)		Goodwill 2024
In millions of COP
Banking Panama	Discounted Cash flow	5 years plan	10.50	%	4.40	%	6,733,971
Banking El Salvador(3)	Discounted Cash flow	5 years plan	14.90% and 14.30%		3.90	%	1,243,711
Banking Guatemala	Discounted Cash flow	5 years plan	11.70	%	5.10	%	1,029,077
Other segments	Comparable multiples	Multiples EV/ Revenue and EV/EBITDA	Does not apply		Does not apply		10,660
Total							9,017,419

(1)The discount rate is the return that would be expected for an investment that generates cash flows similar to those that are expected to be obtained from the use of the CGU. CAPM (Capital Asset Pricing Model) methodology was used as a basis to determine this rate.

(2)This rate is equivalent to the nominal or real growth of the economy in Guatemala, Panama and El Salvador, which is considered an important concept for the growth of the banking industry.

(3)Corresponds to the discount rate used for the short and long term, respectively.

In 2025 and 2024, Cibest Corporate Group tested the aforementioned goodwill for impairment purposes at the following operating segment levels: Panama Banking (Discontinued Operation), El Salvador Banking, and Guatemala Banking. Each segment represents a cash‑generating unit (CGU). The evaluation at the operating‑segment level is aligned with the approach used by the CODM (Chief Operating Decision Maker) to monitor performance and allocate resources within Cibest Corporate Group. Following the assessment, it was determined that no impairment was identified for the El Salvador Banking and Guatemala Banking CGUs during 2025 and 2024.

F-111

Table of Contents

Sensitivity analysis:

In order to assess the impact of changes in certain significant inputs such as the discount rate and the growth rate in the operating segments’ recoverable amount, Cibest Corporate Group undertook a sensitivity analysis of these inputs through alternative scenarios.

The following tables present the recoverable amount of each operating segment obtained as a result of sensitivity analysis for the discount rate and growth rate in basis points (bips):

As of December 31, 2025

Banking El Salvador

	-50 bips	Discount rate	+50 bips
Growth rate	16.70%	16.20%	15.70%
3.80%	4,360,933	4,544,177	4,742,953
	-50 bips	Growth rate	+50 bips
Discount rate	3.30%	3.80%	4.30%
16.20%	4,482,929	4,544,177	4,610,576

Banking Guatemala

	+50 bips		Discount rate		-50 bips
Growth rate	11.70	%	11.20	%	10.70	%
5.00%	3,160,193		3,447,726		3,786,746
	-50 bips		Growth rate		+50 bips
Discount rate	4.50	%	5.00	%	5.50	%
11.20%	3,343,204		3,447,726		3,570,586

As of December 31, 2024

Banking Panama

	+50 bips		Discount rate		-50 bips
Growth rate	11.00	%	10.50	%	10.00	%
4.40%	12,069,096		13,061,970		14,232,692
	-50 bips		Growth rate		+50bips
Discount rate	3.90	%	4.40	%	4.90	%
10.50%	12,512,669		13,061,970		13,709,357

Banking El Salvador

	+100 bips	Discount rate	-100 bips
	15.90%	14.90%	13.90%
Growth rate	15.30%	14.30%	13.30%
3.90%	4,821,361	5,290,874	5,861,625
	-50 bips	Growth rate	+50 bips
Discount rate	3.40%	3.90%	4.40%
14.90% and 14.30%	5,201,761	5,290,874	5,388,987

F-112

Table of Contents

Banking Guatemala

	+50 bips		Discount rate		-50 bips
Growth rate	12.20	%	11.70	%	11.20	%
5.10%	4,433,281		4,819,854		5,271,139
	-50 bips		Growth rate		+50 bips
Discount rate	4.60	%	5.10	%	5.60	%
11.70%	4,665,498		4,819,854		4,999,513

Cibest Corporate Group considers goodwill as an asset with indefinite useful life.

12.2. Intangible assets

The following table sets forth the Cibest Corporate Group’s intangible assets as of December 31, 2025 and 2024, including the reconciliation of initial and final balances of the cost and accrued amortization:

As of December 31, 2025

Cost	Trademarks	Licenses, software<br>and computer<br>applications	Client<br>relationships	Total
In millions of COP
Balance at January 1, 2025	26,067	1,655,449	508,322	2,189,838
Reclassification to assets held for sale(1)	-	(493,570)	-	(493,570)
Acquisitions	-	238,633	667	239,300
Write off	-	(151,802)	-	(151,802)
Foreign currency translation adjustment	(3,855)	(58,979)	(75,225)	(138,059)
Balance at December 31, 2025	22,212	1,189,731	433,764	1,645,707		Amortization	Trademarks	Licenses, software<br>and computer<br>applications	Client<br>relationships	Total
---	---	---	---	---
In millions of COP
Balance at January 1, 2025	26,067	907,389	505,898	1,439,354
Reclassification to assets held for sale(1)	-	(309,151)	-	(309,151)
Write off	-	(151,802)	-	(151,802)
Amortization expense(2)	-	191,193	1,114	192,307
Foreign currency translation adjustment	(3,855)	(36,102)	(74,899)	(114,856)
Balance at December 31, 2025	22,212	601,527	432,113	1,055,852
Intangible assets at December 31, 2025, net	-	588,204	1,651	589,855

(1)The accumulated amount as of December 31, 2025 includes the effects of the classification of Banistmo S.A. as an asset held for sale since December 18, 2025. The net effect of the reclassification to assets held for sale amounted to COP (184,419), comprising a decrease in intangible assets of COP (175,251), additions of COP 36,303, amortization expense of COP (16,543), and foreign exchange differences and other movements of COP (28,928). For more information, see Note 1. Reporting Entity; Note 2.D12. Significant Accounting Policies – Assets Held for Sale and Discontinued Operations; and Note 31. Discontinued Operation.

(2)See Note 26.3. Depreciation, amortization and impairment.

F-113

Table of Contents

As of December 31, 2024

Cost	Trademarks	Licenses, software<br>and computer<br>applications	Client<br>relationships	Total
In millions of COP
Balance at January 1, 2024	22,596	1,409,836	440,636	1,873,068
Acquisitions	-	211,456	-	211,456
Write off	-	(85,717)	-	(85,717)
Foreign currency translation adjustment	3,471	119,874	67,686	191,031
Balance at December 31, 2024	26,067	1,655,449	508,322	2,189,838		Amortization	Trademarks	Licenses, software<br>and computer<br>applications	Client<br>relationships	Total
---	---	---	---	---
In millions of COP
Balance at January 1, 2024	22,596	741,765	437,135	1,201,496
Write off	-	(76,876)	-	(76,876)
Amortization expense(1)	-	168,647	1,493	170,140
Foreign currency translation adjustment	3,471	73,853	67,270	144,594
Balance at December 31, 2024	26,067	907,389	505,898	1,439,354
Intangible assets at December 31, 2024, net	-	748,060	2,424	750,484

(1)The amortization expense for intangible assets differs from the COP 144,517 disclosed in Note 26.3. Depreciation, amortization and impairment, due to the amortization expense related to Banistmo S.A. amounting to COP 25,623, an investment classified as discontinued in 2025. For further information, refer to Note 31 – Discontinued Operation.

As of December 31, 2025 and 2024, the assessment made by Cibest Corporate Group indicates there is no evidence of impairment of intangible assets.

As of December 31, 2025 and 2024, Cibest Corporate Group does not have intangible assets with restricted ownership, intangible assets pledged as collateral or contractual agreements for the acquisition of this class of assets.

Research and development costs

During the period ended at December 31, 2025, 2024 and 2023, Cibest Corporate Group incurred in research and development expenditures on non-capitalized intangible assets for COP 18,265, COP 65,010 and COP 64,363, respectively, recognized in the Consolidated Statement of Income. These costs were the result of the analysis design and implementation of the transformation projects, the most representative of which were: Core Nequi Renewal (Colombia). The expenses were recorded mainly as fees in the line ‘Other administrative and general expenses’ of the Consolidated Statement of Income.

Fully Amortized Intangible Assets

Cibest Corporate Group has intangible assets that have already reached the end of their useful life and, despite being fully amortized, continue to be in use. These assets correspond mainly to perpetual licenses and fees required to carry out the bank’s core activities. For the period ended December 31, 2025, the cost of these assets amounts to COP 113,015, the most significant being Oracle with COP 42,805 and trademarks COP 22,212. As of December 31, 2024,the cost of these assets amounted to COP 60,889, with the most significant being First Data SW Merchant Portal with COP 14,104 and Credit Risk with COP 11,102 and trademarks COP 26,067.

F-114

Table of Contents

Intangibles which did not meet the criteria to be recognized as assets

During the period ended December 31, 2025, 2024 and 2023, Cibest Corporate Group recognized in the Consolidated Statement of Income the amount of COP 1,058, COP 3,552 and COP 1,026, respectively, related to expenditures which were not recognized as intangible assets. These expenses were not recorded as assets due to the lack of characteristics to be reliably identifiable, and those assets do not support critical processes to be recognized as intangible assets.

NOTE 13. INCOME TAX

The income tax is recognized in each of the countries where the Cibest Corporate Group has operations, in accordance with the tax regulations in force in each of the jurisdictions.

13.1 Components recognized in the Consolidated Statement of Income

	December 31,<br>2025	December 31,<br>2024	December 31,<br>2023
In millions of COP
Current tax(1)
Fiscal term	(2,672,274)	(1,772,530)	(1,721,483)
Prior fiscal terms(2)	68,516	159,737	46,462
Total current tax	(2,603,758)	(1,612,793)	(1,675,021)
Deferred tax
Fiscal term	(97,261)	(688,248)	(203,510)
Prior fiscal terms	(55,554)	(67,083)	(23,966)
Adjustments for consolidation purposes	(54,393)	(11,728)	82,204
Total deferred tax	(207,208)	(767,059)	(145,272)
Income tax continued operations(3) (4)	(2,810,966)	(2,379,852)	(1,820,293)

(1) The nominal income tax rate used in Colombia for the years 2025 and 2024 is 35%, and for the year 2023 it was 31%. The Colombian financial institutions of Cibest Corporate Group liquidated some additional points in the income tax of 5% for the years 2025 and 2024, and 3% for the year 2023.

2) Mainly due to the effects of Sentence CE 26739 of January 25, 2024, in both Bancolombia S.A. and Renting Colombia S.A.S.; as well as for invoices received after the end of the year and industry and commerce tax paid prior to the filing of the income tax return.

(3) It includes impacts from Decree 1474 of December 29, 2025. See notes 13.2, 13.3 and 13.5..

(4) See the effects of discontinued operations in Note 31.

13.2 Legal regulatory changes

The Political Constitution of Colombia establishes that, when events arise that seriously disrupt the country’s economic, social, and ecological order, the President of the Republic, with the signature of all ministers, is empowered to declare a State of Emergency, which allows the issuance of decrees with the force of law aimed exclusively at mitigating the crisis. These powers also allow, on a temporary basis, the creation of new taxes or the modification of existing ones; such regulations cease to be in effect at the end of the following fiscal year.

On December 22, 2025, Decree 1390 was issued, declaring an Economic and Social State of Emergency throughout the national territory due to the fiscal deficit of the Colombian State. Subsequently, on December 29, 2025, Decree 1474 was issued, establishing temporary tax measures for the 2026 fiscal year. It should be noted that the decrees issued under the state of exception are subject to review by the Constitutional Court, whose ruling is pending and may result in changes to these tax measures in 2026.

Although the general income tax rate remains at 35%, the tax impact generated by the Economic and Social State of Emergency for financial institutions and securities brokerage firms for the 2026 taxable year consists of an increase in the additional points to the income tax rate from 5% to 15%, resulting in a total income tax rate of 50%. This gave rise to the recalculation of deferred tax as of the end of 2025 at the new rate for items to be realized in 2026 (see Note 13.5).

F-115

Table of Contents

The fifteen (15) additional points are subject to a one hundred percent (100%) advance payment, which must be calculated based on the 2025 taxable year income tax return and paid in two equal installments in April and June 2026.

In El Salvador, on March 14, 2024, Decree 969 was published in the Official Gazette with an amendment to article 4 of the

Income Tax Law, which includes income obtained abroad among the income excluded from said tax.

13.3   Reconciliation of the effective tax rate

The reconciliation between total income tax expenses calculated at the current nominal tax rate and the tax expense recognized in the income statement for the periods ended December 31, 2025, 2024 and 2023 is detailed below:

Reconciliation of the tax rate(3)	December 31,<br>2025	December 31,<br>2024	December 31,<br>2023
In millions of COP
Profit continued operations before tax	9,759,305	8,490,248	7,522,671
Applicable tax with nominal rate(1)	(3,903,722)	(3,396,099)	(3,009,068)
Non-deductible expenses to determine taxable profit (loss)	(223,840)	(238,669)	(246,852)
Accounting and non-tax income to determine taxable profit	705,654	637,567	722,280
Differences in accounting bases(2)	(53,396)	559,860	(106,074)
Fiscal and non-accounting income to determine taxable profit	(573,089)	(982,937)	(652,607)
Ordinary activities income exempt from taxation	1,137,614	1,394,248	1,239,876
Ordinary activities income not constituting income or occasional tax gain	110,681	79,525	67,132
Tax deductions	277,715	209,076	156,543
Goodwill Depreciation	461	461	2,478
Tax depreciation surplus	220,013	212,694	223,901
Untaxed recoveries	(138,906)	(103,017)	(64,516)
Tax rate effect in other countries	(168,488)	(327,808)	(211,206)
Prior fiscal terms	12,962	92,654	22,496
Tax discounts	8,500	8,250	-
Other effects of the tax rate by reconciliation between accounting profit and tax expense (income)	(69,918)	(525,657)	35,324
Impact of the Economic and Social State of Emergency(3)	(153,207)	-	-
Income tax continued operations (4)	(2,810,966)	(2,379,852)	(1,820,293)

(1) The nominal income tax rate used in Colombia for the years 2025 and 2024 is 35%, and for the year 2023 it was 31%. The Colombian financial institutions of Cibest Corporate Group liquidated some additional points in the income tax of 5% for the years 2025 and 2024, and 3% for the year 2023.

(2) Difference between the technical accounting frameworks in force and the full International Financial Reporting Standards (IFRS).

(3) Corresponds to the impacts of Decree 1390 of December 22, 2025, issued under the Economic and Social State of Emergency. See Note 13.2. Legal regulatory changes.

(4) See the effects of discontinued operations in Note 31.

13.4 Components recognized in Other Comprehensive Income (OCI)

See Consolidated Statement of Comprehensive Income

F-116

Table of Contents

December 31, 2025
In millions of COP
	Amounts before taxes	Deferred tax	Net taxes
Remeasurement income related to defined benefit liability	4,073	(5,531)	(1,458)
Unrealized gain Investments in equity instruments measured at fair value through other comprehensive income (FVTOCI)	22,378	(2,358)	20,020
Loss on asset revaluation	-	(356)	(356)
Unrealized gain Investments in debt instruments measured at fair value through other comprehensive income (FVTOCI)	15,871	19,029	34,900
Unrealized gain on net investment hedge in foreign operations	364,414	(140,820)	223,594
Exchange differences arising on translating foreign operations.	(3,118,395)	-	(3,118,395)
Unrealized loss Cash flow hedge	(5,803)	87	(5,716)
Unrealized loss on investments in associates and joint ventures using equity method	(70)	(617)	(687)
Net	(2,717,532)	(130,566)	(2,848,098)		December 31, 2024
---	---	---	---
In millions of COP
	Amounts before taxes	Deferred tax	Net taxes
Remeasurement income related to defined benefit liability	6,041	(4,747)	1,294
Unrealized gain Investments in equity instruments measured at fair value through other comprehensive income (FVTOCI)	22,109	6,463	28,572
Unrealized gain Investments in debt instruments measured at fair value through other comprehensive income (FVTOCI)	14,814	8,422	23,236
Loss on net investment hedge in foreign operations	(742,930)	307,656	(435,274)
Exchange differences arising on translating foreign operations.	2,978,351	-	2,978,351
Unrealized gain Cash flow hedge	216	(87)	129
Unrealized loss on investments in associates and joint ventures using equity method	(7,690)	1,348	(6,342)
Net	2,270,911	319,055	2,589,966		December 31, 2023
---	---	---	---
In millions of COP
	Amounts before taxes	Deferred tax	Net taxes
Remeasurement income related to defined benefit liability	(44,594)	13,234	(31,360)
Unrealized gain Investments in equity instruments measured at fair value through other comprehensive income (FVTOCI)	11,144	(246)	10,898
Unrealized gain Investments in debt instruments measured at fair value through other comprehensive income (FVTOCI)	114,287	(21,023)	93,264
Loss on net investment hedge in foreign operations	1,948,833	(772,755)	1,176,078
Exchange differences arising on translating foreign operations.	(4,963,913)	-	(4,963,913)
Unrealized loss on investments in associates and joint ventures using equity method	(2,225)	2,223	(2)
Net	(2,936,468)	(778,567)	(3,715,035)

13.5       Deferred tax

In accordance with the financial projections prepared by Cibest Corporate Group, it is expected that sufficient taxable income will be generated in future periods to allow for the recovery of the deferred tax assets recognized. Consequently, Management concludes that there is a reasonable probability that these assets will be realized, in compliance with the criteria established in IAS 12.

F-117

Table of Contents

The estimates used to support this recognition are based on financial projections prepared considering information from economic studies and research conducted by Cibest Corporate Group, as well as an analysis of the expected macroeconomic environment for the next five years. The main assumptions used in the financial models include, among others, growth in Gross Domestic Product (GDP), loan portfolio growth, and interest rate behavior. In addition, these projections incorporate the long‑term strategy defined by Cibest Corporate Group.

The deferred tax asset and liability for each of the items that generated taxable or deductible temporary differences for the period ending December 31, 2025 are detailed below:

	December 31,<br>2024	Effect on<br><br>Income<br><br>Statement (3) (4)	Effect on<br><br>OCI (4)	Effect on<br><br>Equity	Foreign<br>Exchange	Adjustments for<br><br>consolidation<br><br>purposes	December 31,<br>2025
In millions of COP
Asset Deferred Tax:
Property and equipment	2,668	(2,796)	-	-	(349)	1,580	1,103
Employee Benefits	282,601	23,106	(5,531)	-	(6,997)	-	293,179
Deterioration assessment	612,213	(41,476)	-	-	(399,931)	20,203	191,009
Investments evaluation	5,278	(266)	-	-	(50)	-	4,962
Derivatives Valuation	6,063	40,683	87	-	2	(6,065)	40,770
Tax credits settlement	4,978	(4,978)	-	-	-	-	-
Financial Obligations	197,660	(197,660)	38,370	-	-	(38,370)	-
Insurance operations	34,906	(22,908)	-	-	(5,162)	-	6,836
Bonds (2)	362,786	(163,735)	(140,820)	-	2	-	58,233
Other deductions	290,284	289,224	-	-	(26,870)	-	552,638
implementation adjustment	401,830	108,885	-	-	(158,561)	-	352,154
Total Asset Deferred Tax (1)	2,201,267	28,079	(107,894)	—	(597,916)	(22,652)	1,500,884
Liability Deferred Tax:
Property and equipment	(114,638)	54,679	(356)	-	3,076	(141,280)	(198,519)
Deterioration assessment	(973,820)	87,353	-	-	—	110,234	(776,233)
Investments evaluation	(377,994)	(134,585)	16,671	-	10,559	(2,490)	(487,839)
Derivatives evaluation	(82,375)	80,493	-	-	87	1,795	-
Lease restatement	(321,813)	(161,375)	-	-	-	-	(483,188)
Investments in associates. Adjustment for equity method	(24,805)	21,355	(617)	40	(2,381)	-	(6,408)
Financial Obligations	(556)	(101,839)	(38,370)	-	83	-	(140,682)
Goodwill (3)	(1,574,360)	1,568,800	-	-	1,055	-	(4,505)
Insurance operations	(37,379)	22,534	-	-	5,529	-	(9,316)
Properties received in payment	(104,990)	(20,957)	-	-	1,922	-	(124,025)
Other deductions	(403,259)	19,764	-	-	9,963	-	(373,532)
implementation adjustment	(25)	(49,890)	-	-	-	-	(49,915)
Total Liability Deferred Tax (1)	(4,016,014)	1,386,332	(22,672)	40	29,893	(31,741)	(2,654,162)
Net Deferred Tax	(1,814,747)	1,414,411	(130,566)	40	(568,023)	(54,393)	(1,153,278)

(1) The values revealed in the Unaudited Consolidated Statement of Financial Position correspond to the sum of the net deferred tax per company.

(2) The movement in OCI is due to the hedging of investments. See Note 5.3, Net Investment Hedge of a Foreign Operation..

(3) Includes effects of discontinued operations for COP 1,567,226. See Note 31. Discontinued operation.

(4) Includes the effects of the Economic Emergency Decree (see Note 13.2 – Legal Regulatory Changes). In accordance with the requirements of IAS 12 – Income Taxes, Cibest Corporate Group classified as financial institutions in Colombia recognized a deferred tax liability of COP 153,207 recorded in profit or loss for the period, and COP 1,802 recorded in Other Comprehensive Income (OCI).

F-118

Table of Contents

13.6    Amount of temporary differences in subsidiaries, branches, associates over which deferred tax was not recognized

In accordance with IAS 12, no deferred tax credit was recorded, because management can control the future moment in which such differences are reversed and this is not expected to occur in the foreseeable future.

	December 31, 2025	December 31, 2024
In millions of COP
Temporary differences
Local Subsidiaries	(5,993,349)	(373,971)
Foreign Subsidiaries(1)	(9,308,322)	(20,176,494)

(1) See the effects of discontinued operations in Note 31.

13.7       Dividends

13.7.1   Dividend Payment

If the parent company or any of its subsidiaries were to distribute dividends, they would be subject to the tax regulations of each of the countries in which they are decreed and distributed. In the case of Colombian companies, dividends will be subject to the application of Articles 48 and 49 of the Tax Statute and consequently will be subject to withholding at source at the established rates, in accordance with the tax characteristics of each shareholder.

13.7.2   Dividends received from Subsidiary Companies

Considering the historical tax status of the dividends received by Cibest Corporate Group from its affiliates and national subsidiaries, it is expected that in the future dividends will be received on the basis of non-income tax. They will not be subject to withholding tax, taking into account that Cibest Corporate Group, its affiliates, and national subsidiaries belong to the same business group.

13.8      Tax contingent liabilities and assets

In the determination of the effective current and deferred taxes subject to review by the tax authority, the relevant regulations have been applied in accordance with the interpretations made by the Cibest Corporate Group.

In Colombia due to the complexity of the tax system, ongoing amendments to the tax regulations, accounting changes with implications on tax bases and in general the legal instability of the country, the tax authority may at any time have different criteria than that of the Bank. Consequently, a dispute or inspection by the tax authority on a tax treatment may affect the Cibest Corporate Group accounting of assets or liabilities for deferred or current taxes, in accordance with the requirements of IAS 12. However, based on the criteria established in the interpretation of IFRIC 23, the Cibest Corporate Group did not recognize uncertain tax positions in its financial statements.

F-119

Table of Contents

NOTE 14. OTHER ASSETS, NET

As of December 31, 2025 and 2024 Cibest Corporate Group’s other assets, net consist of:

Other Assets, net	December 31, 2025(1)	December 31, 2024
In millions of COP
Other receivables(2)	1,538,474	1,110,974
Prepaid expenses	845,182	907,620
Tax advances(3)	600,059	2,014,638
Marketable and non-marketable for sale assets	591,827	1,049,169
Assets pledged as collateral (cash)	520,105	530,924
Receivables related to abandoned accounts(4)	459,978	453,956
Receivable Sales of goods and service	245,329	251,904
Accounts receivable from contracts with customers(5)	261,425	257,262
Balance in credit card clearing house	181,448	298,677
Operating leases	165,068	176,585
Debtors	136,594	84,453
Commission for letters of credit	-	95,008
Others	564,337	556,044
Total other assets	6,109,826	7,787,214
Other allowance	(15,403)	(8,935)
Total other assets, net	6,094,423	7,778,279

(1) The accumulated value as of December 31, 2025, includes the effects of Banistmo S.A.'s classification as asset held for sale since December 18, 2025, which had other assets, net, of COP 2,007,290 that were reclassified to Assets related to investments in subsidiaries held for sale. For more information see Note 1. Reporting Entity, Note 2.D.12 Material Accounting Policies - Assets held for sale and discontinued operations and Note 31. Discontinued Operation.

(2) Other accounts receivable are mainly associated with outstanding items with payment system networks, derivatives, and cash transactions, among others.

(3) The decrease is mainly attributable to Bancolombia S.A. due to the recognition of the credit balance on the 2024 income tax return and the carryover of the outstanding balance to be refunded by the DIAN from the 2023 return, which were refunded by the DIAN in 2025.

(4) In Bancolombia, corresponds to the application of Law 1777 of February 1, 2016, where established that entities holding balances in savings or checking accounts that are considered abandoned, must transfer these resources to the special fund created and administered by ICETEX for the granting of study credits and credits to promote the quality of Higher Education Institutions.

(5) See Note 25.3. Commissions.

NOTE 15. DEPOSITS BY CUSTOMERS

The following is the detail of deposits of the Cibest Consolidated Group as of December 31, 2025 and 2024:

Deposits	December 31, 2025(1)	December 31, 2024
In millions of COP
Savings accounts(2)	133,128,722	124,636,994
Time deposits	91,673,167	109,760,722
Checking accounts	32,125,941	38,033,696
Other deposits(2)	7,486,126	6,627,989
Total deposits by customers	264,413,956	279,059,401

(1) The accumulated amount as of December 31, 2025 includes the effects of the classification of Banistmo S.A. as an asset held for sale since December 18, 2025. As of that date, it recorded deposits totaling COP 27,293,518, which were reclassified to Liabilities related to investments in subsidiaries held for sale. For more information, see Note 1.

F-120

Table of Contents

Reporting Entity; Note 2.D12. Significant Accounting Policies – Assets Held for Sale and Discontinued Operations; and Note 31. Discontinued Operation.

(2) As of December 31, 2025 and 2024 includes Nequi deposits by COP 7,017,948 and COP 4,449,420, respectively, the variation is mainly due to an increase in the number of customers and transactions.

The following table details the time deposits issued by Cibest Consolidated Group:

As of December 31, 2025

Time deposits	Effective interest rate		December 31, 2025
Modality	Minimum	Maximum	Carrying Value	Fair value(1)
In millions of COP
Less than 6 months	0.10%	9.15%	26,467,776	26,390,554
Between 6 months and 12 months	0.50%	10.00%	26,702,769	26,894,925
Between 12 months and 18 months	1.35%	10.23%	10,457,649	10,627,318
Greater than 18 months	0.01%	17.00%	28,044,973	28,300,324
Total time deposits			91,673,167	92,213,121

(1)See Note 30. Fair value of assets and liabilities.

As of December 31, 2024

Time deposits	Effective interest rate		December 31, 2024
Modality	Minimum	Maximum	Carrying Value	Fair value(1)
In millions of COP
Less than 6 months	0.01%	10.60%	27,429,721	27,305,410
Between 6 months and 12 months	0.01%	12.00%	21,295,319	21,140,127
Between 12 months and 18 months	1.35%	14.55%	17,826,919	17,878,843
Greater than 18 months	0.01%	17.65%	43,208,763	43,839,953
Total time deposits			109,760,722	110,164,333

(1)See Note 30. Fair value of assets and liabilities.

The detail of time deposits issued by Cibest Corporate Group by maturity is as follows:

As of December 31, 2025

December 31, 2025
Period	Carrying value	Fair value(1)
In millions of COP
Less than 1 year	76,940,859	77,295,352
Between 1 and 3 years	4,024,284	4,260,741
Between 3 and 5 years	3,246,351	3,214,785
Greater than 5 years	7,461,673	7,442,243
Total	91,673,167	92,213,121

(1)See Note 30. Fair value of assets and liabilities.

F-121

Table of Contents

As of December 31, 2024

December 31, 2024
Period	Carrying value	Fair value(1)
In millions of COP
Less than 1 year	86,592,320	86,553,690
Between 1 and 3 years	10,868,175	10,919,972
Between 3 and 5 years	2,490,326	2,462,312
Greater than 5 years	9,809,901	10,228,359
Total	109,760,722	110,164,333

(1)See Note 30. Fair value of assets and liabilities.

NOTE 16. INTERBANK DEPOSITS AND REPURCHASE AGREEMENTS AND OTHER SIMILAR SECURED BORROWING

The following table sets forth information regarding the money market operations recognized as liabilities in Consolidated Statement of Financial Position:

Interbank and repurchase agreements and other similar secured borrowing	December 31, 2025(1)	December 31, 2024
In millions of COP
Interbank Deposits
Interbank liabilities	30,102	716,493
Total interbank	30,102	716,493
Repurchase agreements and other similar secured borrowing
Repurchase agreements	392,255	372,004
Short selling operations	191,842	155,973
Temporary transfer of securities(2)	91,950	532,495
Total Repurchase agreements and other similar secured borrowing(3)	676,047	1,060,472
Total money market transactions	706,149	1,776,965

(1) The accumulated value as of December 31, 2025, includes the effects of the classification of Banistmo S.A. as an asset held for sale since December 18, 2025, which recorded interbank and repo liabilities of COP 910,189 that were reclassified to Liabilities related to investments in subsidiaries held for sale. For more information, see Note 1. Reporting Entity, Note 2.D12. Significant Accounting Policies - Assets Held for Sale and Discontinued Operations, and Note 31. Discontinued Operation.

(2)As of December 2025, decrease in the number of active simultaneous transactions, closing the period with a total of 6 passive simultaneous transactions. Of these, 5 were carried out with the Cámara de Riesgo Central de Contraparte and 1 with Fiduciaria Davivienda S.A. As of December 2024, 14 simultaneous transactions remained active, all carried out with the Cámara de Riesgo Central de Contraparte.

(3) Total repo liabilities have maturities of less than 30 days.

Offsetting of Repurchase and Resale Agreements

For Cibest Corporate Group, substantially all repurchase and resale activities are transacted under legally enforceable repurchase agreements that give Cibest Corporate Group, in the event of default by the counterparty, the right to liquidate securities held with the same counterparty.

Cibest Corporate Group does not offset repurchase and resale transactions with the same counterparty in the Consolidated Statement of Financial Position.

The table below presents repurchases and resale transactions included in the Consolidated Statement of Financial Position at December 31, 2025 and 2024:

F-122

Table of Contents

As of December 31, 2025

	Assets /<br>liabilities gross	Amounts offset in<br>the statement of<br>financial position	Net balance<br><br>presented in the<br><br>statement of financial<br><br>position	Financial<br>instruments as<br>collaterals	Assets /<br>liabilities<br>net
In millions of COP
Securities purchased under resale agreements(1)	4,674,479	-	4,674,479	(4,674,479)	-
Securities sold under repurchase agreements	(676,047)	-	(676,047)	676,047	-
Total repurchase and resale agreements	3,998,432	-	3,998,432	(3,998,432)	-

(1)The amount includes those presented as cash and cash equivalents for COP 4,673,590 and those presented as other assets for COP 889.

As of December 31, 2024

	Assets /<br>liabilities gross	Amounts offset in<br>the statement of<br>financial position	Net balance<br>presented in the<br>statement of financial<br>position	Financial<br>instruments as<br>collaterals	Assets /<br>liabilities<br>net
In millions of COP
Securities purchased under resale agreements(1)	5,725,166	-	5,725,166	(5,725,166)	-
Securities sold under repurchase agreements	(1,060,472)	-	(1,060,472)	1,060,472	-
Total repurchase and resale agreements	4,664,694	-	4,664,694	(4,664,694)	-

(1)The amount includes those presented as cash and cash equivalents for COP 5,722,948 and those presented as other assets for COP 2,218.

For further information about offsetting of other financial assets and liabilities see Note 5. Financial assets investments and derivatives.

NOTE 17. BORROWINGS FROM OTHER FINANCIAL INSTITUTIONS

As of December 31, 2025 and 2024, the composition of the borrowings from other financial institutions measured at amortized cost is the following:

Borrowings from other financial institutions	December 31, 2025(1)	December 31, 2024
In millions of COP
Obligations granted by foreign banks	4,163,897	10,619,033
Obligations granted by domestic banks	5,192,531	5,070,499
Total borrowings from other financial institutions	9,356,428	15,689,532

(1)The accumulated amount as of December 31, 2025 includes the effects of the classification of Banistmo S.A. as an asset held for sale since December 18, 2025. As of that date, it recorded foreign financial obligations totaling COP1,755,502 which were reclassified to Liabilities related to investments in subsidiaries held for sale. For more information, see Note 1. Reporting Entity; Note 2.D12. Significant Accounting Policies – Assets Held for Sale and Discontinued Operations; and Note 31. Discontinued Operation.

F-123

Table of Contents

Obligations granted by foreign banks

As of December 31, 2025

Financial entity	Rate Minimum		Rate Maximum		December 31, 2025
In millions of COP
Financing with Correspondent Banks and Multilateral Entities(1)	4.48	%	7.50	%	2,901,835
Banco Interamericano de Desarrollo (BID)	6.47	%	8.98	%	1,083,902
Banco Latinoamericano de Comercio Exterior (Bladex)	5.20	%	5.42	%	178,160
Total					4,163,897

(1)The decrease is mainly due to the reclassification of Banistmo S.A. as an asset held for sale and to the early cancellations of obligations by Bancolombia Panamá S.A.

As of December 31, 2024

Financial entity	Rate Minimum	Rate Maximum	December 31, 2024
In millions of COP
Financing with Correspondent Banks and Multilateral Entities	1.50 %	8.99 %	9,959,214
Banco Interamericano de Desarrollo (BID)	8.47 %	9.62 %	614,946
Banco Latinoamericano de Comercio Exterior (Bladex)	5.80 %	5.80 %	44,873
Total			10,619,033

The maturities of the financial obligations with foreign entities as of December 31, 2025 and 2024 are the following:

Foreign	December 31, 2025(1)	December 31, 2024
In millions of COP
Amount expected to be settled:
No more than twelve months after the reporting period	2,028,754	7,428,943
More than twelve months after the reporting period	2,135,143	3,190,090
Total	4,163,897	10,619,033

(1)The decrease is mainly due to the reclassification of Banistmo S.A. as an asset held for sale, as well as a decrease in Bancolombia Panamá resulting from early cancellations made on various obligations with third parties.

Obligations granted by domestic banks

As of December 31, 2025

Financial entity	Rate<br>Minimum	Rate<br>Maximum	December 31, 2025
In millions of COP
Financiera de desarrollo territorial (Findeter)	3.78%	17.22%	2,387,805
Fondo para el financiamiento del sector agropecuario (Finagro)	5.14%	12.70%	1,362,009
Banco de comercio exterior de Colombia (Bancoldex)	2.17%	16.66%	370,631
Other private financial entities	5.22%	10.13%	1,072,086
Total			5,192,531

F-124

Table of Contents

As of December 31, 2024

Financial entity	Rate<br>Minimum	Rate<br>Maximum	December 31, 2024
In millions of COP
Financiera de desarrollo territorial (Findeter)	4.15%	17.21%	2,239,644
Fondo para el financiamiento del sector agropecuario (Finagro)	5.09%	13.59%	1,363,891
Banco de comercio exterior de Colombia (Bancoldex)	2.17%	17.50%	399,266
Other private financial entities	5.11%	13.01%	1,067,698
Total			5,070,499

The maturities of financial obligations with domestic banks as of December 31, 2025 and 2024, are as follows:

Domestic	December 31, 2025	December 31, 2024
In millions of COP
Amount expected to be settled:
No more than twelve months after the reporting period	371,929	679,069
More than twelve months after the reporting period	4,820,602	4,391,430
Total	5,192,531	5,070,499

As of December 31, 2025 and 2024, there were some financial covenants, mainly regarding capital adequacy ratios, past due loans and allowances, linked to some of the aforementioned outstanding credit facilities. None of these covenants had been breached nor were the related obligations past due.

NOTE 18. DEBT INSTRUMENTS IN ISSUE

Duly authorized by the authority in each country bonds have been issued as follows:

As of December 31, 2025

Issuer	Currency		Face value(1)(2)	Balance COP(1)	Rate Range
Bancolombia S.A.(3)(4)	Local	COP	2,161,877	2,172,288	7.90%-12.25%
Bancolombia S.A.(5)(6)(7)	Foreign	USD	1,279,507	4,790,394	4.40%-8.82%
Bancolombia Puerto Rico Internacional Inc.	Foreign	USD	44,100	170,272	5.00%-5.20%
Banco Agrícola S.A.(8)	Foreign	USD	42,000	158,051	6.26%-7.56%
Bancolombia Panamá S.A.	Foreign	USD	30,084	116,925	4.20%-5.40%
Grupo Agromercantil Holding S.A.	Foreign	USD	469	1,763	0.25%-5.50%
Total debt instruments in issue				7,409,693

(1)The accumulated amount as of December 31, 2025, includes the effects of the classification of Banistmo S.A. as an asset held for sale since December 18, 2025. As of that date, it recorded debt securities totaling COP 3,429,730, which were reclassified to Liabilities related to investments in subsidiaries held for sale. For more information, see Note 1. Reporting Entity; Note 2.D12. Significant Accounting Policies – Assets Held for Sale and Discontinued Operations; and Note 31. Discontinued Operation.

(2) Face value is in thousands of U.S. dollars for foreign currency bonds.

(3) The decrease is due to the maturity of bonds in local currency.

(4) The increase in bond interest rates is due to the relationship with the IPC (Consumer Price Index) indicator.

(5) See Note 18.1. Issue of Bancolombia S.A. subordinary bonds.

(6) See Note 18.2. Repurchase Bonds maturing in 2025 and 2027 Bancolombia S.A.

F-125

Table of Contents

(7) As of December 31, 2025, USD528,000 were designated as net investment coverage abroad. See Note 5.3. Hedge Accounting.

(8) See Note 18.4. Issue of Banco Agrícola S.A. ordinary bonds

As of December 31, 2024

Issuer	Currency		Face value(1)	Balance COP	Rate Range
Bancolombia S.A.	Local	COP	2,253,761	2,244,212	7.80%-12.49%
Bancolombia S.A.(2)(3)(4)	Foreign	USD	1,247,766	5,553,607	5.20%-8.82%
Banistmo S.A.(5)	Foreign	USD	585,051	2,617,132	4.25%-6.35%
Banco Agrícola S.A.(6)	Foreign	USD	117,182	517,068	5.60%-7.70%
Bancolombia Puerto Rico Internacional Inc.	Foreign	USD	51,734	246,083	5.15%-5.50%
Bancolombia Panamá S.A.	Foreign	USD	20,338	95,070	5.00%-6.00%
Grupo Agromercantil Holding S.A.	Foreign	USD	464	2,044	0.25%-7.25%
Total debt instruments in issue				11,275,216

(1)Face value is in thousands of U.S. dollars for foreign currency bonds.

(2)See Note 18.1. Issue of Bancolombia S.A. subordinary bonds.

(3)See Note 18.2. Repurchase Bonds maturing in 2025 and 2027 Bancolombia S.A.

(4)As of December 31, 2024, USD884,544 was designated as hedge of net asset in a foreign operation. See Note 5.3. Hedge Accounting.

(5)See Note 18.3. Issue of Banistmo S.A. discontinued operation ordinary bonds

(6)See Note 18.4. Issue of Banco Agrícola S.A. ordinary bonds

The following table shows the detail of the bonds classified by currency, term and type of issue:

As of December 31, 2025

Issuer	Less than<br>1 year	Between<br>1 and 3 years	Between<br>3 and 5 years	Greater than 5 years	Total amortized cost
In millions of COP
Local currency
Subordinated bonds(1)	-	-	-	615,726	615,726
Ordinary bonds	-	-	-	1,556,564	1,556,564
Foreign currency
Subordinated bonds(1)	-	-	-	4,721,908	4,721,908
Ordinary bonds(2)	283,170	93,768	6,859	131,698	515,495
Total	283,170	93,768	6,859	7,025,896	7,409,693

(1)In the event of default of the Bank, the subordinated bonds will be subordinated to the claims of depositors and all other creditors of the issuer, other than creditors whose claims rank equally with, or are junior to, the claims of the holders of the subordinated liabilities.

F-126

Table of Contents

As of December 31, 2024

Issuer	Less than<br>1 year	Between<br>1 to 3 years	Between<br>3 to 5 years	Greater than 5 years	Total amortized cost
In millions of COP
Local currency
Subordinated bonds(1)	-	-	-	615,699	615,699
Ordinary bonds	-	-	-	1,628,513	1,628,513
Foreign currency
Subordinated bonds(1)	-	-	-	5,516,940	5,516,940
Ordinary bonds	243,861	1,097,493	7,684	2,165,026	3,514,064
Total	243,861	1,097,493	7,684	9,926,178	11,275,216

(1)In the event of default of the Bank, the subordinated bonds will be subordinated to the claims of depositors and all other creditors of the issuer, other than creditors whose claims rank equally with, or are junior to, the claims of the holders of the subordinated liabilities.

18.1. Issue of Bancolombia S.A. subordinated bonds.

On June 24, 2024, the Bank issued subordinated bonds for USD800,000, maturing in 2034, which have an early redemption option that may be exercised after five years from the date of issue and a nominal coupon of 8.625% payable semi-annually on December 24 and June 24 of each year, beginning on December 24 of that year.

18.2. Repurchase Bonds maturing in 2025 and 2027 Bancolombia S.A.

On June 24, 2024, the Bank carried out a debt management operation by offering to the market a repurchase of the senior bonds due in 2025 and subordinated bonds due in 2027 for USD267,421 and USD283,632 respectively.

On July 2, 2024, the second repurchase cut of the debt management operation that began in June was met, for USD2,013 of the senior bonds due in 2025 and USD4,661 USD of the subordinated bonds due in 2027.

On November 12, 2024, the full redemption of the senior bonds due in 2025 was carried out for USD212,600.

On December 18, 2024, the Bank exercised the call option on the subordinated bonds due in 2029, which were fully redeemed for USD550,000.

The total nominal amount repurchased from the above transactions is USD1,320,327, of which USD1,036,695 was part of the net foreign investment hedging relationship, which is being discontinued in the same proportion. See Note 5.3 Hedge Accounting.

18.3. Issuance of Ordinary Bonds – Banistmo S.A. (Discontinued Operation)

Banistmo S.A., an operation classified as a discontinued operation, issued in 2025 bonds under its Revolving Bond Program totaling USD104,395, with interest rates ranging from 1.65% to 5.50% and maturities from 1 year to 5 years.

Banistmo S.A., issued bonds under the Revolving Bond Program in 2024, for USD106,868 with rates ranging from 5.70% to 6.35% and terms from 1 year to 2 years. In 2023 it issued bonds under the Revolving Bond Program, for USD58,062 each with a term of 1 year and rates ranging from 6.00% to 6.25%.

18.4. Issue of Banco Agrícola S.A. ordinary bonds.

Banco Agrícola, a subsidiary of Cibest Corporate Group, issued ordinary bonds in 2025 for USD7,000, at an interest rate of 6.30% and a maturity of 1 year.

Banco Agrícola a subsidiary of the Bank issued ordinary bonds in 2024 for USD21,382 with rates ranging from 7.00% to 7.05% and terms from 1 year to 1.5 years of which some were redeemed early.

F-127

Table of Contents

For information related to the disclosures of fair value of the debt securities in issue, see Note 30. Fair value of assets and liabilities.

The following is a schedule of the debt instruments in issue by maturity:

Issuer	December 31, 2025	December 31, 2024
In millions of COP
Amount expected to be settled:
No more than twelve months after the reporting period	1,048,169	1,297,811
More than twelve months after the reporting period	6,361,524	9,977,405
Total	7,409,693	11,275,216

As of December 31, 2025 and 2024, there were no financial covenants linked to the aforementioned securities in issue, except for some financial covenants related to the Banistmo S.A. social gender private placement bond. None of these covenants had been breached nor were the related obligations past due.

NOTE 19. EMPLOYEE BENEFIT PLANS

The following table shows liabilities relating to post-employment benefit and long-term benefit plans:

Employee benefit plans	December 31,<br>2025	December 31,<br>2024
In millions of COP
19.1 Defined benefit pension plan	130,577	140,996
19.2 Severance obligation	7,202	9,351
19.3 Retirement Pension Premium Plan and Executive Pension Plan Premium	208,892	222,786
19.4 Other long-term benefits	600,939	581,168
Total Post-employment and long-term benefit plans	947,610	954,301
Fair value Plan assets	-	2,746
Total Unfunded Post-employment and long-term benefit plans(1)	947,610	951,555

(1) The accumulated amount as of December 31, 2025, includes the effects of the classification of Banistmo S.A. as an asset held for sale since December 18, 2025. As of that date, it recorded employee benefits totaling COP 2,891, which were reclassified to Liabilities related to investments in subsidiaries held for sale. For more information, see Note 1. Reporting Entity; Note 2.D12. Significant Accounting Policies – Assets Held for Sale and Discontinued Operations; and Note 31. Discontinued Operation.

These benefits include all types of payments that Cibest Corporate Group provides to its employees. The recognition of liabilities related to post-employment and long-term employee benefit plans is based on actuarial computations which involve judgments and assumptions made by management (with the assistance of external actuaries) related to the future macroeconomic and employee demographic factors, among others, which will not necessarily coincide with the future outcome of such factors.

Post-employment benefits

19.1 Defined benefit pension plan

Colombia

Under Colombian law, employee pension obligations have been managed as a defined contribution plan since 1990. Bancolombia S.A.'s a Colombian bank legal retirement benefit obligation as of December 31, 2025 and 2024 relates to retired employees who rendered services to Bancolombia S.A. before the current regulations took effect. Under this

F-128

Table of Contents

unfunded plan, benefits are based on length of service and level of compensation. As of December 2025, 450 participants were covered by this plan, and as of December 2024, 478 participants.

For purposes of the projected assessment of the pension plan obligation, in the absence of an extensive market for high-quality corporate debt, the sovereign bond curve of the Colombian government is used, with maturity similar to the residual life of the obligation of the projected benefit. The net cost of pensions is accounted for in the Consolidated Statement of Income as “salaries and employee benefits” and includes the interest costs and cost of current service.

Defined benefit pension plan and other benefits	2025	2024
In millions of COP
Present value of the obligation as of January 1	103,247	101,778
Interest cost	10,756	10,459
Benefits paid	(12,943)	(13,003)
Net actuarial (gain) / loss due to changes in assumptions	(5,241)	2,229
Net actuarial (gain) due to plan experience	(936)	(366)
Others	-	2,150
Defined obligation, unfunded as of December 31	94,883	103,247

Panamá

The Chase Manhattan Bank Corporation, N.A. (formerly “HSBC Bank Panamá”, later merged with Banistmo S.A. in 2000) offered a defined benefit pension plan based on the average salaries paid during the 120 most recent months prior to the employee's retirement date and the years of employment service. The right to this plan was obtained after 10 years of service with the organization. This individual plan covered a certain group of employees who were hired by Chase Manhattan Bank Corporation, N.A. and it was not extended to employees of HSBC Bank Panama, now Banistmo S.A.

As of December 31 of 2025, there were 33 participants (6 participants with deferred benefits and 27 participants receiving benefits).

Defined benefit pension plan	2025(1)	2024
In millions of COP
Present value of the obligation as of January 1	3,265	3,051
Interest cost	198	234
Benefits paid from plan assets	(399)	(524)
Net actuarial loss due to changes in assumptions	323	117
Net actuarial gain due to plan experience	(5)	(63)
Foreign currency translation effect	(491)	450
Reclassification to liabilities related to assets held for sale(1)	(2,891)	-
Defined obligation, funded as of December 31	-	3,265

(1) The accumulated amount as of December 31, 2025, includes the effects of the classification of Banistmo S.A. as an asset held for sale since December 18, 2025. For more information, see Note 1. Reporting Entity; Note 2.D12. Significant Accounting Policies – Assets Held for Sale and Discontinued Operations; and Note 31. Discontinued Operation.

Banistmo S.A. (Discontinued operation), has established a plan with assets to secure benefits promised by Banistmo to the employees entitled to participate in the Pension Plan for former Chase employees under the terms described above and to comply with Panama labor code, which specifies the terms of securing the payments to be made in the event of an employee’s termination (voluntary or involuntary) or upon retirement (termination indemnity plan).

Banistmo’s pension and post-retirement plan assets consider investments in fixed-term deposits and cash and due from banks, in order to reduce the investment risk. The plan assets are managed by a trustee (third party). Likewise, the assets allocation is periodically reviewed by Banistmo and, when necessary, adjusted according to the investment strategy. The plan's investment assets are measured at fair value using significant, unobservable market data and, therefore, are classified as Level 3.

F-129

Table of Contents

The expected return on assets assumption represents the long term rate of return based on analysis of historical returns, historical asset class volatilities and the fund’s past experience.

The following table details the change in plan assets:

Banistmo’s Plan assets	2025(1)	2024
In millions of COP
Fair value of assets as of January 1	2,746	2,765
Interest income on plan assets	112	129
Benefits paid	(412)	(540)
Foreign currency translation effect	(385)	392
Reclassification to liabilities related to assets held for sale(1)	(2,061)	-
Fair value assets as of December 31	-	2,746

(1) The accumulated amount as of December 31, 2025, includes the effects of the classification of Banistmo S.A. as an asset held for sale since December 18, 2025. For more information, see Note 1. Reporting Entity; Note 2.D12. Significant Accounting Policies – Assets Held for Sale and Discontinued Operations; and Note 31. Discontinued Operation.

Guatemala

Banco Agromercantil Guatemala S.A. has established a retirement pension plan for its employees. Under this plan, the employees are entitled to receive a lifetime payment of 50% of their monthly nominal wage, if they are 70 years old and have 30 years of service, or if they are 65 years old and have 40 years of service. On the other hand, employees are entitled to receive a lifetime payment of 70% of their monthly nominal wage, if they are 70 years old and have 40 years of service, or they are 65 years old and have 45 years of service.

Defined benefit pension plan	2025	2024
In millions of COP
Present value of the obligation as of January 1	34,484	28,025
Current cost of service	1,233	1,136
Interest cost	2,819	2,657
Benefits paid	(1,680)	(1,668)
Net actuarial loss / (gain) due to changes in assumptions(1)	5,139	(556)
Net actuarial (gain) due to plan experience	(886)	(61)
Foreign currency translation effect	(5,415)	4,951
Defined obligation, unfunded as of December 31	35,694	34,484

(1)The loss for the year 2025 was mainly due to the decrease in the discount rate from 9.10% in 2024 to 8.30% in 2025.

19.2 Severance obligation

Colombia

Under Colombian labor regulations, employees hired before 1990 are entitled to receive severance in an amount equal to one month’s salary for each year of service. This benefit accumulates and is paid to the employees upon their termination or retirement from Bancolombia S.A., subsidiary of Grupo Cibest S.A. calculated based on the employees’ last salary base; however, employees may request advances against this benefit at any time. In 1990, the Colombian government revised its labor regulations for new employees to permit companies, subject to the approval of the employees, to transfer this severance obligation annually to private pension funds (this scheme of employee benefits is known as the current severance obligation).

As of December 2025 and 2024, 63 and 82 participants, respectively, were covered by this plan.

F-130

Table of Contents

The balances recognized in the Consolidated Statement of Financial Position are listed below:

Severance obligation	2025	2024
In millions of COP
Present value of the obligation as of January 1	9,351	14,360
Current cost of service	179	267
Interest cost	724	1,116
Benefits paid	(4,219)	(5,369)
Net actuarial (gain) / loss due to changes in assumptions	(187)	13
Net actuarial loss / (gain) due to plan experience	1,354	(1,036)
Defined obligation, unfunded as of December 31	7,202	9,351

19.3 Retirement Pension Premium Plan and Executive Pension Plan Premium

Colombia

Under Colombian labor regulations, employers and employees are entitled to negotiate private agreements. Grupo Cibest S.A.'s subsidiaries Bancolombia S.A., Valores Bancolombia S.A. Comisionista de Bolsa, Banca de Inversión Bancolombia S.A. Corporación Financiera and Fiduciaria Bancolombia S.A. Sociedad Fiduciaria employees participate in a defined benefit plan according to which they are entitled to receive, on the date of their retirement, a single payment.

El Salvador

By means of Decree 592 of 2013, under Salvadorian labor regulations, employees are entitled to receive 15 days of salary for each year of service. This benefit is payable upon retirement, resignation, unjustified dismissal, death and disability. As of December 31, 2025, and 2024, there were 3,089 and 3,023 participants respectively, covered by the plan.

Guatemala

Banco Agromercantil Guatemala S.A. has established a defined benefit plan for its employees. Under this plan, the employees are entitled to receive a one-off payment based on the number of years of service to the organization in the event of waiver before retirement. As of December 31, 2025, and 2024, there were 3,336 and 3,627 participants respectively, covered by the plan.

The annual change of the present value of the obligations of defined benefit plans is as follows:

Retirement Pension Premium Plan	2025	2024
In millions of COP
Present value of the obligation as of January 1	222,786	195,295
Current service cost	22,552	20,632
Interest cost	17,591	18,157
Benefits paid	(30,253)	(22,004)
Net actuarial (gain) / loss due to changes in assumptions	(8,714)	1,046
Net actuarial loss / (gain) due to plan experience	1,630	(6,103)
Foreign currency translation effect(1)	(16,700)	15,763
Defined obligation, unfunded as of December 31	208,892	222,786

(1)The actuarial gain in 2025 is mainly explained for Bancolombia S.A. by the departure of employees covered by the plan.

F-131

Table of Contents

19.4 Other long-term benefits

In addition to legal benefits and the aforementioned post-employment benefits, Cibest Corporate Group grants its employees other benefits based on the employees’ seniority. For the periods ended December 31, 2025 and December 31, 2024, the reconciliation of the other long-term benefits is set below:

Other long term benefits	2025	2024
In millions of COP
Present value of the obligation as of January 1	581,168	543,210
Current service cost	62,262	57,653
Interest cost	60,434	56,157
Loss from changes in demographic assumptions	622	-
Benefits paid	(64,933)	(62,762)
Net actuarial (gain) due to changes in assumptions(1)	(28,094)	(8,083)
Net actuarial (gain) due to plan experience	(3,136)	(11,655)
Foreign currency translation effect	(7,384)	6,648
Defined obligation, unfunded as of December 31	600,939	581,168

(1)In the case of Bancolombia S.A., in 2025 the discount rate increased from 11.00% to 12.25% and the nominal inflation rate from 5.40% to 5.50%, generating an actuarial gain of COP 24,426.

Defined contribution plans

The expense recognized in the line “Salaries and employee benefits” of the Consolidated Statement of Income for defined contribution plans, for current severance regimen and pension benefits, is as follows:

Defined contribution plans	2025	2024
In millions of COP
Pension	344,033	318,988
Current severance regimen	105,738	92,729
Total	449,771	411,717

The economic assumptions used in the determination of the present value of the defined benefit plans, in nominal terms, are as follows:

Colombia

Main projected assumptions	December 31, 2025	December 31, 2024
Discount rate	12.25 %	11.00	%
Rate of wage increase	8.00 %	7.90 %
Projected inflation	5.50 %	5.40 %
Rate of pension increase	5.50 %	5.40	%

F-132

Table of Contents

Bancolombia Panamá

Main projected assumptions	December 31, 2025	December 31, 2024
Discount rate	6.50 %	7.00	%
Rate of wage increase	2.00 %	2.00 %
Projected inflation	2.00 %	2.00	%

El Salvador

Main projected assumptions	December 31, 2025		December 31, 2024
Discount rate	5.00	%	5.20	%
Rate of wage increase	2.50	%	2.50	%
Projected inflation	1.50	%	1.50	%

Guatemala

Main projected assumptions	December 31, 2025	December 31, 2024
Discount rate	8.30 %	9.10	%
Rate of wage increase	5.00 %	5.00	%
Projected inflation	4.00 %	4.00	%

In 2025, assumptions regarding future longevity have been based on mortality tables, which reflect average ages of mortality from 30-60 years. The rate used to discount the obligation of the defined benefit plan to reflect the duration of the labor liabilities as of December 2025 corresponds to the yield of sovereign bonds of each country where the plan is established, either Colombia, Panama, Guatemala and El Salvador, as applicable, since the market transactions of these countries involving corporate bonds of high quality have no high levels of activity. The assumption of the rate of inflation is based on the long-term projection of the Central Bank of Colombia, Panama, Guatemala and El Salvador.

The nature of the risks related to the aforementioned obligations are summarized below:

Investment risk	The present value of the obligation for the defined benefits plan is calculated using a discount rate determined with reference to high quality sovereign yields of each country. Currently, the plan includes investment in financial instruments that are not vulnerable to market risks
Interest rate risks	A reduction in the bond’s interest rate will increase the plan obligation; however, this will be partially offset by an increase in the return on the plan’s deposit investments.
Longevity risk	The present value of the obligation of the defined benefit plan is calculated with reference to the highest estimate of the mortality of participants during their time of employment. An increase in the life expectancy of the participants will increase the plan obligation
Salary risk	The present value of the obligation of the benefit plan is calculated with reference to the future salaries of the participants. As such, an increase in the participants’ wages will increase the obligation of the plan

F-133

Table of Contents

Estimated payment of future benefits

The payments of benefits, which reflect future service rendered, are considered to be paid as follows:

Years	Pension Benefits	Other benefits
In millions of COP
2026	15,425	107,959
2027	15,356	93,809
2028	15,302	107,480
2029	14,996	101,081
2030	14,588	101,310
2031 to 2035	64,604	541,849

Sensitivity analysis

In presenting the sensitivity analysis, the present value of the defined benefit obligation has been calculated using the projected unit credit method at the end of the reporting period, which is the same method used to calculate the defined benefit obligation (DBO) recognized in the Statement of Financial Position. Obligations and expenses will change in the future as a result of future changes in the methods of projection and assumption, participant information, plan provisions, and regulations, or as resulting from future gains and losses.

There were no changes in the methods and assumptions used in preparing the sensitivity analyses from prior years.

Colombia

Defined benefit pension plan

Assumption	Value		(Increase/Decrease)	Effect on DBO
In millions of COP
Discount rate	12.50	%	0.50% increase	(2,416)
Discount rate	11.50	%	0.50% decrease	2,550
Pension increases	6.00	%	0.50% increase	2,905
Pension decreases	5.00	%	0.50% decrease	(2,769)
Mortality Table			One year increase in life expectancy	3,842

Retirement Pension Premium Plan

Assumption	Value		(Increase/Decrease)	Effect on DBO
In millions of COP
Discount rate	12.75	%	0.50% increase	(5,112)
Discount rate	11.75	%	0.50% decrease	5,534
Salary increases	8.50	%	0.50% increase	5,765
Salary decreases	7.50	%	0.50% decrease	(5,359)

F-134

Table of Contents

Severance obligation

Assumption	Value		(Increase/Decrease)	Effect on DBO
In millions of COP
Discount rate	11.25	%	0.50% increase	(71)
Discount rate	10.25	%	0.50% decrease	73
Salary increases	8.50	%	0.50% increase	197
Salary decreases	7.50	%	0.50% decrease	(194)

Guatemala

Defined Benefit Pension Plan

Assumption	Value		(Increase/Decrease)	Effect on DBO
In millions of COP
Discount rate	8.80	%	0.50% increase	(3,097)
Discount rate	7.80	%	0.50% decrease	3,558
Salary increases	5.50	%	0.50% increase	2,369
Salary decreases	4.50	%	0.50% decrease	(2,126)

Retirement Pension Premium Plan

Assumption	Value	(Increase/Decrease)	Effect on DBO
In millions of COP
Discount rate	7.50 %	0.50% increase	(1,674)
Discount rate	6.50 %	0.50% decrease	1,766
Salary increases	5.50 %	0.50% increase	1,792
Salary decreases	4.50 %	0.50% decrease	(1,713)

El Salvador

Retirement Pension Premium Plan

Assumption	Value		(Increase/Decrease)	Effect on DBO
In millions of COP
Discount rate	5.50	%	0.50% increase	975
Discount rate	4.50	%	0.50% decrease	(1,054)
Salary increases	3.00	%	0.50% increase	(208)
Salary decreases	2.00	%	0.50% decrease	249

F-135

Table of Contents

Colombia

Other long-term benefits

Assumption	Value		(Increase/Decrease)	Effect on DBO
In millions of COP
Discount rate	12.50	%	0.50% increase	(15,170)
Discount rate	11.50	%	0.50% decrease	16,067
Salary increases	8.50	%	0.50% increase	16,576
Salary decreases	7.50	%	0.50% decrease	(15,771)

Guatemala

Assumption	Value	(Increase/Decrease)	Effect on DBO
In millions of COP
Discount rate	7.50 %	0.50% increase	(1,208)
Discount rate	6.50 %	0.50% decrease	1,294
Salary increases	5.50 %	0.50% increase	1,316
Salary decreases	4.50 %	0.50% decrease	(1,238)

El Salvador

Assumption	Value	(Increase/Decrease)	Effect on DBO
In millions of COP
Discount rate	5.50 %	0.50% increase	151
Discount rate	4.50 %	0.50% decrease	(161)

Bonuses and short-term benefits

Short-term employment benefit plans recognized in the Consolidated Statement of Financial Position in the line “other liabilities” consist of the following:

Other employment benefit plans	December 31,<br>2025	December 31,<br>2024
In millions of COP
Current severance obligation	122,690	107,938
Bonuses and short-term benefits(1)	817,366	676,967
Other employment benefit plans	940,056	784,905

(1)The increase between December 31, 2025, and 2024, corresponds to the bonuses related to employees’ variable compensation. See Note 20 Other Liabilities.

F-136

Table of Contents

NOTE 20. OTHER LIABILITIES

Other liabilities consist of the following:

Other liabilities	December 31, 2025 (1)	December 31, 2024
In millions of COP
Payables	4,000,570	3,547,341
Suppliers	1,943,318	1,840,622
Advances to obligations	1,686,868	1,373,401
Bonuses and short-term benefits	817,366	676,967
Deposits delivered as security(2)	764,034	378,767
Security contributions	611,103	559,038
Collection services	475,233	480,202
Salaries and other labor obligations	445,258	428,077
Provisions(3)	382,655	439,095
Advances in leasing operations and loans	194,886	173,168
Liabilities from contracts with customers(4)	48,658	68,040
Dividends(5)	24,775	873,598
Deferred interests	23,616	106,058
Other financial liabilities	59,913	46,187
Total	11,478,253	10,990,561

(1)The accumulated value as of December 31, 2025, includes the effects of the classification of Banistmo S.A. as an asset held for sale since December 18, 2025, which recorded other liabilities amounting to COP 729,354 that were reclassified to Liabilities related to investments in subsidiaries held for sale. For further information, see Note 1, Reporting Entity; Note 2.D12, Significant Accounting Policies – Assets Held for Sale and Discontinued Operations; and Note 31, Discontinued Operation.

(2)The increase is mainly due to international counterparties for derivative transactions.

(3) See Note 21. Provisions and contingent liabilities.

(4)See Note 25.3 Commissions, in the detail of accounts receivable balances and contract liabilities.

(5)Dividends payable corresponds to the distribution of profits. As of December 2024, these corresponded to the last aliquot of the dividends declared on the 2023 profits, which were paid in January 2025. The dividends declared in March 2025 were paid on April 1, for COP3,751,125. Likewise, an extraordinary dividend payment was made on April 29, 2025, for COP600,180. See Consolidated Statement of Changes in Equity, distribution of dividends.

NOTE 21. PROVISIONS AND CONTINGENT LIABILITIES

21.1. Provisions

The following tables show the detail of the provisions at December 31, 2025, and 2024:

F-137

Table of Contents

As of December 31, 2025

	Judicial proceedings	Administrative proceedings(2)	Financial guarantees	Loan<br>commitments	Onerous contracts(3)	Total(4)
In millions of COP
Balance as of January 1, 2025	45,485	83,468	4,493	296,929	8,720	439,095
Reclassification to liabilities related to investments in subsidiaries held for sale(1)	(4,232)	-	(383)	(34,836)	-	(39,451)
Additions recognized in the period	24,484	15,139	7,854	125,193	5,357	178,027
Provisions used during the period	(6,968)	(8,890)	-	-	(3,896)	(19,754)
Provisions reversed during the period	(8,813)	(834)	(2,222)	(145,967)	(2,781)	(160,617)
Translation adjustment	(1,086)	-	(71)	(13,488)	-	(14,645)
Final balance as of December 31, 2025	48,870	88,883	9,671	227,831	7,400	382,655

(1)The accumulated value as of December 31, 2025, includes the effects of the classification of Banistmo S.A. as an asset held for sale since December 18, 2025. For further information, see Note 1, Reporting Entity; Note 2.D12, Significant Accounting Policies – Assets Held for Sale and Discontinued Operations; and Note 31, Discontinued Operation..

(2)The balance mainly includes new provisions of COP 15,355 and an increase in existing provisions of COP 4,915.

(3)Onerous contracts corresponds to Renting Colombia S.A.S., whose maturity exceeds three years.

(4)The decrease mainly relates to Banistmo S.A. (a subsidiary classified as an asset held for sale), see Note 31 Discontinued operations.

As of December 31, 2024

	Judicial<br><br>proceedings(1)	Administrative<br><br>proceedings(2)	Financial<br><br>guarantees(3)	Loan<br>commitments	Onerous<br><br>contracts(4)	Total
In millions of COP
Balance as of January 1, 2024	50,812	92,380	2,238	252,381	3,300	401,111
Additions recognized in the period	36,347	1,038	2,599	169,878	5,420	215,282
Provisions used during the period	(33,333)	(9,976)	-	-	-	(43,309)
Provisions reversed during the period	(11,362)	-	(407)	(138,052)	-	(149,821)
Translation adjustment	1,581	26	63	12,722	-	14,392
Effect of discounted cash flows	1,440	-	-	-	-	1,440
Final balance as of December 31, 2024	45,485	83,468	4,493	296,929	8,720	439,095

(1)The balance includes provisions mainly with Tuvacol S.A. and payments mostly with the processes of the municipality of Purificación Tolima and fiscal responsibility of the departmental comptroller's office of Cundinamarca.

(2)The balance mainly includes environmental remediation of the Santa Elena property (see Note 21.2. Contingent Liabilities) current Judicial Proceedings, and a contentious administrative proceedings arising from a difference in interpretation of the applicable income tax law for COP 15,655.

(3)The balance corresponds mainly to financial guarantees in Bancolombia S.A. and its increase is due to the new operations.

(4)Onerous contracts correspond to Renting Colombia S.A.S.

Litigation

As of December 31, 2025

Duration of the litigation provision	Judicial proceedings	Administrative proceedings	Onerous contracts
In millions of COP
Litigation under 1 month	31,092	-	-
Litigation greater than 1 year and up to 3 years	9,422	57,863	-
Litigation greater than 3 years	8,356	31,020	7,400
Total	48,870	88,883	7,400

F-138

Table of Contents

As of December 31, 2024

Duration of the litigation provision	Judicial proceedings	Administrative proceedings	Onerous contracts
In millions of COP
Litigation under 1 month	25,746	373	-
Litigation greater than 1 year and up to 3 years	6,572	66,630	-
Litigation greater than 3 years	13,167	16,465	8,720
Total	45,485	83,468	8,720

The following table shows the changes in the provision for financial guarantees and loan commitments during period at December 31, 2025, and 2024 with the expected credit loss model:

	Stage 1	Stage 2	Stage 3	Total
Balance as of January 1, 2025	156,056	78,380	66,986	301,422
Transfers	20,656	(9,867)	(10,789)	-
Transfer to stage 1	29,755	(20,164)	(9,591)	-
Transfer to stage 2	(5,634)	14,210	(8,576)	-
Transfer to stage 3	(3,465)	(3,913)	7,378	-
Reclassification to liabilities related to investments in subsidiaries held for sale(1)	(13,784)	(21,048)	(387)	(35,219)
Provisions recognized during the period	63,517	26,002	43,528	133,047
Provisions reversed during the period	(100,991)	(23,973)	(23,225)	(148,189)
Translation adjustment	(8,297)	(5,194)	(68)	(13,559)
Balance as of December 31, 2025	117,157	44,300	76,045	237,502

(1) The accumulated value as of December 31, 2025, includes the effects of the classification of Banistmo S.A. as an asset held for sale since December 18, 2025. For further information, see Note 1, Reporting Entity; Note 2.D12, Significant Accounting Policies – Assets Held for Sale and Discontinued Operations; and Note 31, Discontinued Operation.

	Stage 1	Stage 2	Stage 3	Total
Balance as of January 1, 2024	158,337	45,058	51,224	254,619
Transfers	5,186	4,587	(9,773)	-
Transfer to stage 1	12,161	(6,950)	(5,211)	-
Transfer to stage 2	(4,383)	14,688	(10,305)	-
Transfer to stage 3	(2,592)	(3,151)	5,743	-
Provisions recognized during the period	74,787	51,131	44,387	170,305
Provisions reversed during the period	(91,105)	(26,271)	(18,911)	(136,287)
Translation adjustment	8,851	3,875	59	12,785
Balance as of December 31, 2024	156,056	78,380	66,986	301,422

Judicial proceedings

Judicial provisions refer to pending legal proceedings on employment matters, ordinary lawsuits, class actions suits, civil actions within criminal prosecutions and executive proceedings against Cibest Corporate Group. In the opinion of management, after receiving pertinent legal advice, the payments estimated to be made in connection with these proceedings will not generate significant losses in addition to the provisions recognized as of December 31, 2025 and 2024. In addition, Cibest Corporate Group does not expect to obtain any reimbursement from judicial proceedings raised against it and, therefore, has not recognized any assets for that purpose, see Note 21.2 Contingent liabilities.

F-139

Table of Contents

Onerous contracts

For Cibest Corporate Group, an onerous contract is a contract in which the unavoidable costs of meeting the obligations under the contract exceed the economic benefits expected to be received under it.

Financial guarantees

The table below shows the maximum exposure to credit risk and provision based on the bank´s internal credit rating system, 12 months Basel PD range and year-end stage classification:

As of December 31, 2025

Standard		PD range		Stage 1				Stage 2				Stage 3				Total(1)
	Exposure		Provision		Exposure		Provision		Exposure		Provision		Exposure		Provision
Normal risk		0% - 3.11%		5,775,002		9		4,750		-		-		-		5,779,752	9
Acceptable risk		> 3.11% - 11.15%		103,636		1		772		-		-		-		104,408	1
Appreciable risk		> 11.15% - 72.75%		507,049		1		11,067		1		-		-		518,116	2
Significant risk		> 72.75% - 89.89%		-		-		-		-		-		-		-	-
Bad risk		> 89.89% - 100%		-		-		-		-		152,549		9,659		152,549	9,659
Total				6,385,687		11		16,589		1		152,549		9,659		6,554,825	9,671

As of December 31, 2024

Standard		PD range		Stage 1				Stage 2				Stage 3				Total
	Exposure		Provision		Exposure		Provision		Exposure		Provision		Exposure		Provision
Normal risk		0% - 3.11%		9,738,866		12		267		-		-		-		9,739,133	12
Acceptable risk		> 3.11% - 11.15%		173,730		14		10,563		1		8,000		2		192,293	17
Appreciable risk		> 11.15% - 72.75%		14,123		1		6,970		3		48,221		-		69,314	4
Significant risk		> 72.75% - 89.89%		-		-		-		-		-		-		-	-
Bad risk		> 89.89% - 100%		-		-		-		-		143,561		4,460		143,561	4,460
Total				9,926,719		27		17,800		4		199,782		4,462		10,144,301	4,493

The following table shows the maturity schedule for financial guarantees as of December 31, 2025, and 2024:

As of December 31, 2025

Maturity	Financial guarantees(1)
In millions of COP
Guarantees under 1 month	759,832
Guarantees greater than 1 month and up to 3 months(1)	1,018,158
Guarantees greater than 3 months and up to 1 year (1)	2,842,203
Guarantees greater than 1 year and up to 3 years(2)	1,249,931
Guarantees greater than 3 years and up to 5 years	632,287
Guarantees greater than 5 years	52,414
Total	6,554,825

(1) The accumulated value as of December 31, 2025, includes the effects of the classification of Banistmo S.A. as an asset held for sale since December 18, 2025. For further information, see Note 1, Reporting Entity; Note 2.D12, Significant Accounting Policies – Assets Held for Sale and Discontinued Operations; and Note 31, Discontinued Operation.

F-140

Table of Contents

As of December 31, 2024

Maturity	Financial guarantees
In millions of COP
Guarantees under 1 month	744,077
Guarantees greater than 1 month and up to 3 months(1)	1,498,132
Guarantees greater than 3 months and up to 1 year(1)	5,036,939
Guarantees greater than 1 year and up to 3 years(2)	2,135,249
Guarantees greater than 3 years and up to 5 years	60,876
Guarantees greater than 5 years	669,028
Total	10,144,301

The total amount outstanding is the maximum potential payments which represent a “worse-case scenario” and does not reflect expected results.

Loan commitments

The following table shows the maturity schedule for loan commitments as of December 31, 2025, and 2024:

As of December 31, 2025

Maturity	Loan commitments
In millions of COP
Commitments under 1 month	409,239
Commitments greater than 1 month and up to 3 months	175,825
Commitments greater than 3 months and up to 1 year	7,894,165
Commitments greater than 1 year and up to 3 years	1,158,023
Commitments greater than 3 years and up to 5 years	3,274,107
Commitments greater than 5 years	151,615
Total(1)	13,062,974

(1) The variation corresponds mainly to Bancolombia S.A. and Bancolombia Panama S.A.

As of December 31, 2024

Maturity	Loan commitments
In millions of COP
Commitments under 1 month	606,027
Commitments greater than 1 month and up to 3 months	20,060
Commitments greater than 3 months and up to 1 year	5,962,608
Commitments greater than 1 year and up to 3 years	2,100,683
Commitments greater than 3 years and up to 5 years	2,959,532
Commitments greater than 5 years	395,847
Total	12,044,757

21.2. Contingent liabilities

As of December 31, 2025, Cibest Corporate Group does not have any liability resulting from administrative or judicial proceedings.

F-141

Table of Contents

Please find below a list of liabilities arising from judicial or administrative proceedings involving entities whose financial statements are consolidated as of December 31, 2025, representing liabilities in excess of USD28,149

Some judicial proceedings involving claims for lower amounts, which were disclosed in the consolidated financial statements of Bancolombia S.A. in prior periods, are included herein to provide updated information to the reader.

BANCOLOMBIA S.A.

Neos Group S.A.S. (in reorganization) and Inversiones Davanic S.A.S.

On November 3, 2022, Bancolombia S.A. was served of a lawsuit in which Neos Group S.A.S. and Inversiones Davanic S.A.S. alleges that a loan agreement was entered between them, rather than a lease agreement. Neos Group S.A.S. and Inversiones Davanic S.A.S. also requested the rescission of the purchase and sale agreement on the ground that the price of the property was lower than its fair price.

The Neos Group S.A.S. and Inversiones Davanic S.A.S.'s claims amount is COP 65,000. The contingency is qualified as remote because the parties always intended to celebrate a lease agreement and not a different type of contract. On December 7, 2022, Bancolombia S.A. filed a brief with its defenses. As of December 31, 2025, the Court has not summoned the initial hearing. There is no provision for this proceeding.

Public Interest Class Action - Carlos Julio Aguilar and other

In this proceeding, a public interest class action was filed, in which the plaintiffs allege that due to the restructuring of Departamento del Valle's financial obligations and its performance plan, the Departamento del Valle's collective rights of the public administration and the public funds of the were breached. Bancolombia S.A. filed its defenses arguing that the agreement was made in accordance with the law.

On November 15, 2024, the First Instance Court issued a judgment in favor of Bancolombia S.A. The plaintiffs filed an appeal against the first instance judgment. As of December 31, 2025, the Second Instance Court has not issued a final decision. The contingency is qualified as eventual and there is no provision for this proceeding.

Remediation Plan for Santa Elena´s property

In 1987, Banco de Colombia (today Bancolombia S.A.) received a property located in Municipio de Cartagena, Colombia from the Federación Nacional de Algodoneros. After the transfer of the property to Bancolombia S.A., soil contamination from pesticides and herbicides was found on the property. Bancolombia S.A. commenced a civil responsibility judicial proceeding against the Federación Nacional de Algodoneros alleging environmental contamination.

On November 13, 2015, the Court issued the final judgment. In the judgment, the Court stated that the Federación Nacional de Algodoneros was liable for environmental damages and consequently, Bancolombia S.A. was not.

Despite not being liable for environmental damages, Bancolombia S.A. has assumed binding commitments to contract and pay for the property’s decontamination. As a result of these commitments, Bancolombia S.A. has conducted different decontamination processes over the years. Currently, Bancolombia S.A. has the approval of the Autoridad Nacional de Licencias Ambientales de Colombia (ANLA) for the execution of a remediation plan (plan de remediación) divided into three stages: Stage I, Stage II, and Stage III.

As of December 31, 2025, the ANLA's decision regarding the complementary studies of Stage I is still pending. Stage II concluded with the submission to ANLA of the report on the findings from the soil study. Likewise, pre-feasibility activities for Stage III are underway, and the implementation continues for the social management plan with the communities in the area of influence of the remediation plan, the emergency and contingency plan, the hazardous waste management plan, and the biotic environment protection plan.

The estimated time for the execution of the remediation plan is 36 months from July 2023, with the possibility of adjustment according to the results of the pre-feasibility and feasibility stage of Stage III and the supervening requirements of the competent authorities. As of December 31, 2025, there is a provision of COP 55,910 to attend the execution of the pending activities of the plan.

Constructora Primar S.A.S. (COMPLETED)

On June 7, 2022, Bancolombia S.A. was notified of a lawsuit filed by Incopav S.A.S., Constructora Primar S.A.S., Inversiones M & Galindo y Cía. S en C and Inversiones M & Baquero y Cía. S en C. The plaintiffs request the payment of the damages caused by Bancolombia S.A. for his decision not to fully finance of the Altos de San Jorge project.

F-142

Table of Contents

The plaintiffs' claims amount is COP 107,344. The contingency is qualified as remote because the plaintiffs are not part of the mutual agreement entered into for the financing of the Altos de San Jorge project. On July 9, 2024, the First Instance Court ruled in favor of Bancolombia S.A. On February 19, 2025, the plaintiffs' appeal was deemed unsupported. The first instance judgment became final and binding.

As of December 31, 2025, the proceeding is terminated.

Tuvacol S.A.

On July 18, 2024, Bancolombia S.A. was served of the lawsuit filed by Tuvacol S.A. Tuvacol S.A. is requesting the payment of the damages caused by the alleged irregular payment of checks charged to its checking account. Bancolombia S.A. argues that the payments of the checks were correct. The plaintiff’s claims are COP 56,769.

The initial hearing has not been held. On August 15, 2025, a favorable ruling was issued for Bancolombia. Tuvacol filed an appeal against the decision. As of December 31, 2025, the case is pending a decision by the second-instance judge. The contingency is qualified as eventual and has a provision for COP 5,676.

FIDUCIARIA BANCOLOMBIA

Quinta Sur S.A.S.

In March 2022, Fiduciaria Bancolombia was notified of a lawsuit filed by Quinta Sur S.A.S. in liquidation proceeding. According to the lawsuit, Quinta Sur seeks indemnification for damages due to the non-transfer of the resources to beginning of a housing construction project, under the terms agreed in the trust agreement.

Fiduciaria Bancolombia alleges that it has complied with the law and the contract, arguing that the property on which the housing project was to be constructed did not fulfill the contractual requirements. The plaintiff’s claims amount is COP 128,599.

On August 24, 2023, the First Instance Court issued a favorable judgment to Fiduciaria Bancolombia. As of December 31, 2025, the Second Instance Court has not issued a final decision. The contingency is qualified as eventual and there is no provision for this proceeding.

BANCO AGRÍCOLA

Dirección General de Impuestos Internos of El Salvador

The authority on taxes of El Salvador (DGII), in accordance with the resolution of October 2018, determined that Banco Agrícola failed to declare and pay income taxes related to 2014’s fiscal year for a total of USD11,116 and related penalties.

In 2021, the appeal presented by Banco Agrícola was decided. The Tribunal de Apelaciones de los Impuestos Internos y Aduanas (TAII) modified the Resolution issued by DGII, adjusted the rental tax to USD6,341 and revoked the sanction.

Banco Agrícola filed a lawsuit before the Contentious Administrative Tribunal seeking to overrule DGII´s and TAII´s previous decisions in relation to the tax’s payment. As of December 31, 2025, the decision of the Contentious Administrative Tribunal is still pending.

The contingency is qualified as remote and there is no provision for this proceeding.

ARRENDADORA FINANCIERA S.A.

Cordal

Cordal filed a lawsuit against Arrendadora Financiera, seeking compensation for USD6,454. According to the lawsuit, Cordal was the owner of a current account in Arrendadora Financiera (formerly Banco Capital S.A.), and it alleged that it´s funds were irregularly transferred to third parties. Arrendadora Financiera alleges Cordal´s account was liquidated before the acquisition of Banco Capital S.A. and, therefore, no funds were transferred.

As of December 31, 2025, the proceeding is at the evidentiary stage. The contingency is qualified as remote and there is no provision for this proceeding. A former employee of the plaintiff was convicted of aggravated theft in connection with the facts of this lawsuit.

F-143

Table of Contents

BANCO AGROMERCANTIL

Bapa Holdings Corp.

On September 20, 2022, a lawsuit against Banco Agromercantil was filed by Bapa Holdings Corp. The plaintiff alleges that it invested USD7,000 through a participation agreement with North Shore Development Company (NDSC) for the development of a housing project that was going to be built in a property, which was security for a loan given by Banco Agromercantil to NDSC, located in Roatan Island, Honduras. Bapa alleges that BAM caused damages due to its failure to provide information about NDSC´s financial situation and going through with the sale of the credit.

On October 24, 2022, BAM responded to the claim and filed exceptions alleging that it has no commercial relationship with Bapa, and the statute of limitations deadline expired. As of December 31, 2025, the Court has not ruled the exceptions to the lawsuit. The contingency is qualified as remote and there is no provision for this proceeding.

Superintendencia de Administración Tributaria (SAT)

The Superintendencia de Administración Tributaria (SAT) of Guatemala ordered a tax adjustment in the fiscal year 2014 of Banco Agromercantil´s rental tax declaration, duly paid by BAM, for a value of USD13,583 (including tax and sanction). BAM initiated legal proceedings against the decision adopted by the SAT, arguing the inadmissibility of the adjustment by applying the legal rule in an analogous way, the admissibility of the expense’s deductions of the revenue tax for being necessary to generate lien revenue and the non-withhold of the revenue tax in the interests paid to exempt people, arguing that they were appropriate according to the law.

As of December 31, 2025, the proceeding is pending the final decision from the Court. The contingency is qualified as remote and there is no provision for this proceeding.

BANISTMO (Discontinued operation)

Constructora Tymsa S.A.

In October 2021, Banistmo and Banistmo Investment were notified of a lawsuit in which the plaintiff alleged fraudulent acts involving the sale of the plaintiff´s property. Constructora Tymsa request the nullity of the public instrument of purchase through which property was transferred to Limipa S.A. Limipa S.A. requested a loan to Banistmo and guaranteed its obligation with an an administration and guarantee trust over the property. The trust was administered by Banistmo Investment. Constructora Tymsa alleges that the signatures and fingerprints in the public instrument of purchase, sale and in the mortgage in favor of Banistmo are false.

The plaintiff’s claims amount is USD10,000, in addition to interests, costs and expenses. Banistmo and Banistmo Investment allege they are not liable for any intentional or negligent conduct regarding to the alleged fraudulent sale of the property. As of December 31, 2025, the Court is pending of the resolution of three motions, including the motion for lack of jurisdiction alleged by the Bank, and to rule on the evidence presented in the proceeding. The Bank’s legal advisors have qualified the proceeding as eventual and there is no provision.

Deniss Rafael Pérez Perozo, Carlos Pérez Leal and others

Promotora Terramar (client of Banistmo, formerly HSBC Panamá) received USD299, through Visa Gift Cards issued by a foreign bank. These payments were received as a partial payment of 2 apartments located in Panamá City.

The Credit Card Securities and Fraud Prevention department of the HSBC bank detected an irregular activity by Promotora Terramar, when a monitoring alert was activated due to the high number of cards with the same BIN and bank. Therefore, pursuant to the Business Establishments Affiliate Agreement, HSBC reversed funds from Promotora Terramar´s accounts for COP 287. Nevertheless, after further investigations the money was refunded.

On October 2013, the plaintiffs filed a claim for compensation of the material and moral damages caused, which according to their valuation, amounts to USD5,252,000. Banistmo alleges it has complied with the contractual terms outlined in the Affiliate Agreement, that Mr. and Mrs Perez Leal are not customers of the Bank and thar the statute of limitations deadline has lapsed.

As of December 31, 2025, the lawsuit has not been notified to the parties. The contingency is qualified as remote and there is no provision for this proceeding.

F-144

Table of Contents

DD&C, Carlos Pérez Leal and Others

In October 2022, Banistmo received a communication announcing the filing of a legal action in the Tribunal of First Instance of Kaloum in the Republic of Guinea. This action was commenced by Inversiones DD&C, Carlos Perez Leal and other natural persons against the Central Bank of the Republic of Guinea (“BCRG”) and five international banks, including Banistmo. The action seeks compensatory damages derived from alleged fraud involving six international transfers for a total USD1,900 that Inversiones DD&C, who was a client of Banistmo at the time, ordered to be made to a bank account at the BCRG.

The parties who commenced the action are seeking USD28,100 in “dommages matériels” (which are damages for alleged economic loss), as well as additional amounts in “dommages moraux” (which are damages for alleged non-economic loss, including alleged psychological suffering and moral anguish).

On May 22, 2023, a favorable First Instance judgment was issued for Banistmo. The plaintiff filed an appeal against the decision. On October 23, 2024, the Second Instance Court issued a favorable judgment to Banistmo. As of December 31, 2025, there is still pending to decide the appeal filed by the plaintiff before the Supreme Court of Guinea.

The contingency is qualified as remote and there is not provision for this proceeding.

Interfast Panamá & Pacific Point 96624

In February 2024, Banistmo and Banistmo Investment were served of a lawsuit filed against them and against 2020 Debt Investors Corp and José Talgham Cohen. The plaintiffs seek compensation for damages originated from the assignment of credit agreement made by Banistmo as the assignor in benefit of the assignee 2020 Debt Investors Corp., of a credit operation managed by Inverfast Panamá for a value of USD 2,000. The loan was secured with a trust of administration and guarantee of real state set up on Banistmo Investment.

The plaintiffs alleges that the credit assignment agreement presented irregularities and deviations from Banistmo and breach of fiduciary duties from Banistmo Investment. The plaintiff’s claims amount is USD 15,000.

As of December 31, 2025, the proceeding is pending rule a clarification motion of the plaintiff´s complaint.

The contingency is qualified as remote and there is no provision for this matter.

NOTE 22. SHARE CAPITAL

The subscribed and paid-in capital is the following:

Share capital	December 31, 2025	December 31, 2024
Authorized shares	1,400,000,000	1,400,000,000
Subscribed and paid-in shares:
Common shares with a nominal value of COP 500 pesos	509,704,584	509,704,584
Preferred shares with dividend without voting rights with nominal value of COP 500 pesos	452,122,416	452,122,416
Total subscribed and paid-in shares	961,827,000	961,827,000
Subscribed and paid capital (nominal value, in millions of COP)	480,914	480,914

Dividends declared

The declaration, amount, and payment of dividends are based on the unconsolidated net income of Cibest S.A. Dividends must be approved by the Ordinary General Shareholders’ Meeting, following the recommendation of the Board of Directors and Management. Under the Colombian Commercial Code, after payment of income taxes and appropriation of legal and other reserves, and after setting off losses from prior fiscal years, Grupo Cibest S.A. must distribute to its stockholders at least 50% of its annual net income or 70% of its annual net income if the total amount of reserves exceeds its outstanding capital, unless such minimum percentages are waived by an affirmative vote of the holders of at least 78% of the shares present at the stockholders’ meeting. Such dividend distribution must be made to all stockholders, in cash or

F-145

Table of Contents

in issued stock of Grupo Cibest S.A., as may be determined by the stockholders, and within a year from the date of the annual general ordinary stockholders' meeting in which the dividend was declared.

Dividend payments must be made in cash on the dates defined by the Shareholders’ Meeting at its annual meeting and for all shareholders. If the payment is made in the Grupo Cibest S.A.’s own equity securities instead of cash, that must be approved by 80% of the outstanding common shareholders and 80% of the outstanding Preferred Shares and subscribed without voting rights.

The annual net profits of Grupo Cibest S.A. must be applied as follows: (i) first, an amount equal to 10% of net profits to a legal reserve until such reserve is equal to at least 50% of the paid-in capital; (ii) second, to the payment of the minimum dividend on the Preferred Shares and without voting rights; and (iii) third, as may be determined in the ordinary annual general ordinary stockholders' meeting, by the required majority in accordance with the law and the bylaws.

Dividends declared with respect to<br>net income earned in:	Cash dividends per share<br>(Stated in COP)
2025	–
2024(1)	4,524
2023	3,536
2022	3,536
2021	3,120

(1) During 2025, it includes an ordinary dividend of COP 3,900 and an extraordinary dividend of COP 624; see the Consolidated Statement of Changes in Equity.

Common Shares

The holders of Common Shares are entitled to vote on any matter subject to approval at an annual general ordinary stockholders' meeting. Within 15 calendar days prior to such meeting, such holders are entitled to inspect the books and records of the Company.

Also, the holders of Common Shares will receive a proportion of the profits subject to the provisions of law, statutes and established at general shareholders’ meeting. The dividend received by holders of Common Shares may not be higher than the dividend assigned to Preferred Shares and without voting rights.

Preferred Shares and without voting rights

Holders of Preferred Shares are entitled to receive dividends based on the net profits of the preceding fiscal year, after deducting losses affecting the capital and once the amount that shall be legally set apart for the legal reserve has been deducted, but before creating or accruing for any other reserve, of a non-cumulative minimum preferred dividend equal to one percent (1%) yearly of the subscription price of the Preferred Share, provided this dividend is higher than the dividend assigned to Common Shares. If this is not the case, the dividend shall be increased to an amount that is equal to the per share dividend on the Common Shares.

Payment of the preferred dividend shall be made at the time and in the manner established in the general shareholders’ meeting and with the priority indicated by Colombian law.

Any dividend in shares requires the approval of 80% or more of the shares present at a shareholders’ meeting, including at least 80% of the outstanding Preferred Shares. In the absence of such Preferred Shares holders, a stock dividend may be payable only to the holders of Common Shares that approve this payment.

Reserved Shares

Stocks that are available between maximum authorized shares and paid-in shares. Grupo Cibest S.A. has 438,173,000 shares held in reserve.

F-146

Table of Contents

Repurchased Own Shares

On June 9, 2025, the General Shareholders’ Meeting approved a repurchase program for shares and ADRs. For more information, see Note 1 – Reporting Entity. During the period, the entity repurchased its own shares (common and preferred), which are presented as a deduction from equity in the Consolidated Statement of Financial Position, in accordance with IAS 32. These shares do not confer political or economic rights while held by the entity. For more information, see Note 23 – Appropriated Reserves and Consolidated Statement of Changes in Equity.

Concept	December 31, 2025	December 31, 2024
Subscribed and paid common shares	509,704,584	509,704,584
Repurchased common shares(1)	(601,452)	–
Total common shares outstanding	509,103,132	509,704,584
Subscribed and paid preferred shares	452,122,416	452,122,416
Repurchased preferred shares(2)	(8,010,884)	–
Total preferred shares outstanding	444,111,532	452,122,416
Total shares outstanding	953,214,664	961,827,000

(1) The total cost of the repurchased Common Shares is COP 34,706.

(2) The total cost of the repurchased Preferred Shares is COP 396,712.

NOTE 23. APPROPRIATED RESERVES

As of December 31, 2025, and 2024, the appropriated retained earnings consist of the following:

Item	December 31, 2025	December 31, 2024
In millions of COP
Appropriation of net income(1)(2)	11,491,577	12,700,961
Other(3)	11,025,979	9,874,876
For share repurchase(4)	918,582	—
Total appropriated reserves	23,436,138	22,575,837

(1)The legal reserve fulfills two objectives: to increase and maintain the company's capital and to absorb economic losses. Based on the aforementioned, this amount shall not be distributed in dividends to the stockholders.

(2)As of December 31, 2025, and 2024, includes reclassification of unclaimed dividends under Article 85 Bylaws for COP 2,096 and COP 506, respectively.

(3)Corresponds to occasional reserve for equity strengthening and future growth continues which was approved at the General Shareholders Meeting.

(4)The movement of the reserve for share repurchase is as follows:

Concept	December 31, 2025
In millions of COP
Establishment of reserve for share repurchase(1)	1,350,000
Repurchase of common shares(2)	34,706
Repurchase of preferred shares(3)	396,712
Balance of reserves for share repurchase	918,582

(1) On June 9, 2025, the General Shareholders’ Meeting approved a repurchase program for shares and ADRs and approved a change in the legal reserve for the creation of a reserve designated for the repurchase of shares. For more information, see Note 1. Reporting Entity and Consolidated Statement of Changes in Equity.

(2) As of December 31, 2025, 601,452 Common Shares have been repurchased.

(3) As of December 31, 2025, 8,010,884 Preferred Shares have been repurchased.

F-147

Table of Contents

NOTE 24. UNCONSOLIDATED STRUCTURED ENTITIES

Nature and risks associated with Cibest Corporate Group’s interests in unconsolidated structured entities

The term "unconsolidated structured entities" refers to all structured entities that are not controlled by Cibest Corporate Group. Cibest Corporate Group manage transactions with unconsolidated structured entities to facilitate customer transactions and for specific investment opportunities.

The table below shows the total assets of unconsolidated structured entities in which Cibest Corporate Group had an interest at the reporting date and its maximum exposure to loss in relation to those interests.

As of December 31, 2025

	Securitizations	Managed funds(1)(2)	Total
In millions of COP
Total assets of the entities	599,521	187,365,295	187,964,816
Interest in assets
Investments at fair value through profit or loss	62,813	-	62,813
Investments at fair value through other comprehensive income	8,359	-	8,359
Loans and advances to customers	-	10,301,573	10,301,573
Total assets in relation to interests in the unconsolidated structured entities	71,172	10,301,573	10,372,745
Maximum exposure	71,172	10,301,573	10,372,745
Fee income(1)	2,493	616,547	619,040

(1) The accumulated amount as of December 31, 2025 includes the effects of the classification of Banistmo S.A. as an asset held for sale as of December 18, 2025, which reported a total managed assets of COP 9,220,308 and fee income of COP 7,682. For more information see Note 1. Reporting Entity, Note 2.D12. Significant Accounting Policies - Assets Held for Sale and Discontinued Operations and Note 31. Discontinued Operation.

(2) During 2025, Grupo Cibest S.A. was established as the parent company. For more information, see Note 1. Reporting Entity.

As of December 31, 2024

	Securitizations	Managed funds	Total
In millions of COP
Total assets of the entities	792,368	176,591,828	177,384,196
Interest in assets
Investments at fair value through profit or loss	68,710	-	68,710
Investments at fair value through other comprehensive income	8,649	-	8,649
Loans and advances to customers	-	8,435,301	8,435,301
Total assets in relation to interests in the unconsolidated structured entities	77,359	8,435,301	8,512,660
Maximum exposure	77,359	8,435,301	8,512,660
Fee income	3,065	558,877	561,942

F-148

Table of Contents

Securitizations

Cibest Corporate Group invest in asset-backed securities issued by securitization entities whose underlying assets are mortgages originated by financial institutions. Cibest Corporate Group does not have a significant exposure to sub-prime securities. The asset-backed securities are denominated in TIPS in the local market and accounted for as investment at fair value through profit or loss and residual rights accounted for as investment at fair value through other comprehensive income. These asset-backed securities have different maturities and are generally classified by credit ratings. Cibest Corporate Group does not expect significant changes in those ratings. Cibest Corporate Group also retain beneficial interests in the form of servicing fees on securitized mortgages.

Cibest Corporate Group’s managed funds

Cibest Corporate Group managed trust funds comprise the following business lines: real estate, mutual funds sold to individuals, escrow accounts, private equity funds, and the social security system. Generally, the related income correspond to the fees received from the management of resources that are invested in financial instruments and management of assets and resources related to real estate projects in progress or assets for which legal title may or may not be transferred, to be managed in accordance with the terms agreed with the trustor. Likewise, Cibest Corporate Group receive fees for management assets pledged as collateral for customers’ commitments and obligations, and fees from management of resources of government agencies and entities.

On the other hand, there is no additional exposure to loss, such as funding commitments with regards to Cibest Corporate Group’s involvement with those entities.

NOTE 25. OPERATING INCOME

25.1. Interest and valuation on financial instruments

The following table sets forth the detail of interest and valuation on financial asset instruments for the years ended December 31, 2025, 2024 and 2023:

	2025	2024	2023
In millions of COP
Interest on debt instruments using the effective interest method	714,677	728,238	741,684
Interest and valuation on financial instruments
Debt investments	1,380,073	1,289,472	614,609
Derivatives(1)	41,679	150,808	(158,635)
Spot transactions	30,390	(10,817)	(43,528)
Repos(2)	(16,036)	236,050	136,773
Total valuation on financial instruments	1,436,106	1,665,513	549,219
Total Interest and valuation on financial instruments	2,150,783	2,393,751	1,290,903		Discontinued operations Banistmo S.A.(3)	353,881	328,428	317,162
---	---	---	---

(1) The decrease is mainly attributable to valuation of swaps and forwards in Bancolombia.

(2) The decrease is mainly attributable to lower returns from repurchase agreement transactions in Bancolombia.

(3) The accumulated amount as of December 31, 2025, and 2024 corresponds to Banistmo S.A., a subsidiary classified as an asset held for sale since December 18, 2025. For more information, see Note 1. Reporting Entity; Note 2.D12. Significant Accounting Policies – Assets Held for Sale and Discontinued Operations; and Note 31. Discontinued Operation.

F-149

Table of Contents

25.2.       Interest expenses

The following table sets forth the detail of interest on financial liability instruments for the years ended December 31, 2025, 2024 and 2023:

	2025	2024	2023
In millions of COP
Deposits(1)	10,329,525	11,287,066	12,514,706
Borrowing costs(1)(2)	826,461	1,117,354	1,398,923
Debt instruments in issue(3)	682,323	1,074,281	1,307,383
Lease liabilities	111,114	107,408	83,916
Preferred shares	56,974	57,701	57,701
Overnight funds	16,748	3,190	10,443
Other interest (expense)	38,081	40,660	57,111
Total interest expenses	12,061,226	13,687,660	15,430,183		Discontinued operations Banistmo S.A.(4)	1,241,640	1,336,251	1,238,112
---	---	---	---

(1)The intervention rate issued by the Banco de la República de Colombia for the period of 2025 started at 9.50% and closed at 9.25%, for 2024 it started at 13.00% and closed at 9.50% and for 2023 it started at 12.00% and closed at 13.00%. This has an impact on the rates of deposits and financial obligations.

(2) The decrease is mainly in Bancolombia S.A due to the effect of the decline in the balance of foreign obligations loans.

(3) In 2025, the decrease is mainly explained by the lower amortization of deferred charges associated with bond repurchases carried out in 2024, as well as by the reduction in interest expense resulting from the maturities of debt securities denominated in local currency.

(4) The accumulated amount as of December 31, 2025, and 2024 corresponds to Banistmo S.A., a subsidiary classified as an asset held for sale since December 18, 2025. For more information, see Note 1. Reporting Entity; Note 2.D12. Significant Accounting Policies – Assets Held for Sale and Discontinued Operations; and Note 31. Discontinued Operation.

Net interest income is defined as interest on loan portfolio and financial leasing operations, interest on debt instruments measured by the effective interest method and interest expense amounts to COP 17,889,453 COP 17,371,017 and COP 18,137,054 for the years ended on December 31, 2025, 2024 and 2023, respectively.

25.3.       Fees and commissions

Cibest Corporate Group has elected to present the income from contracts with customers as an element in a line named “Fees and commissions income” in the Consolidated Statement of Income separated from the other income sources.

The information contained in this section about the fees and commission’s income presents information on the nature, amount, timing and uncertainty of the income from ordinary activities which arise from a contract with a customer under the regulatory framework of IFRS 15 Revenue from Contracts with Customers.

In the following table, the description of the main activities through which Cibest Corporate Group generates revenue from contracts with customers is presented:

Fees and Commissions

Description

Banking services

Banking Services are related to commissions from the use of digital physical channels or once the customer makes a transaction. The performance obligation is fulfilled once the payment is delivered to its beneficiary and the proof of receipt of the payment is sent, in that moment, the collection of the commission charged to the customer is generated, which is a fixed amount. The commitment is satisfied during the entire validity of the contract with the customer. Grupo Cibest S.A. and its subsidiaries acts as principal.

F-150

Table of Contents

Credit and debit card fees	In debit card product contracts, it is identified that the price assigned to the services promised by the Bank to the customers is fixed. Given that no financing component exists, it is established on the basis of the national and international interbank rate. Additionally, the product charges to the customers commissions for handling fees, at a determined time and with a fixed rate.<br><br>For Credit Cards, the commissions are the handling fees and depend on the card franchise. The commitment is satisfied in so far that the customer has capacity available on the card.<br><br>Other revenue generated by the credit card product (issuer) includes cash advance commissions. This commission income is charged each time a customer makes a cash advance, whether domestically or internationally, at ATMs owned or not owned by the issuer, or through a physical branch. The interchange fee is revenue for the credit card issuer for services provided to the merchant for transactions processed at the point of sale. This fee is accrued and collected immediately from the merchant and has a fixed amount.<br><br>In the credit cards product there is a customer loyalty program, in which points are awarded for each transaction made by the customer in a retail establishment. The program is administrated by a third party who assumes the inventory and claims risks, for which it acts as agent. The Bank recognized it as a lower value of the revenue from the exchange bank fee.<br><br>The rights and obligations of each party in respect of the goods and services for transfer are clearly identified, the payment terms are explicit, and it is probable, that is, it takes into consideration the capacity of the customer and the intention of having to pay the consideration at termination to those entitled to change the transferred goods or services. The revenue is recognized at a point in time: the Bank satisfies the performance obligation when the “control” of the goods or services was transferred to the customers.
Deposits	Deposits are related to the services generated from the offices network once a customer makes a transaction. Cibest Corporate Group generally commits to maintain active channels for the products that the customer has, with the purpose of making payments and transfers, sending statements, and making transactions in general. The commissions are deducted from the deposit account, and they are incurred at a point in time. Cibest Corporate Group acts as principal.
Electronic services and ATMs	Revenue received from electronic services and ATMs arises through the provision of services so that the customers may make required transactions, which are enabled by Cibest Corporate Group. These include online and real-time payments by the customers of Cibest Corporate Group holding a checking or savings accounts, with a debit or credit card for the products and services that the customer offers. Each transaction has a single price, for a single service. The provision of collection services or other different services provided by Cibest Corporate Group, through electronic equipment, generates consideration chargeable to the customer established contractually as a fee. Cibest Corporate Group acts as principal and the revenue is recognized at a point in time.
Brokerage	Brokerage is a group of services for the negotiation and administration of operations for purchasing fixed revenue securities, equities, and operations with derivatives in its own name, but on behalf of others. The performance obligations are fulfilled at a point in time when the commission agent in making its best effort can execute the business entrusted by the customer in the best conditions. The performance obligations are considered satisfied once the service stipulated in the contract is fulfilled, as consideration fixed, or variable payments are agreed, depending on the service. Cibest Corporate Group acts generally as principle and in some special cases as agent.
Remittance	Revenue for remittance is received as consideration for the commitment established to pay remittances sent by the remitting companies to the beneficiaries of the same. The commitment is satisfied at a point in time to the extent that the remittance is paid to the beneficiary.<br><br>The price is fixed, but may vary in accordance to the transferred amount, due to the operation being dependent on the volume of operations generated and the transaction type. There is no component of financing, nor the right to receive consideration dependent on the occurrence or not of a future event.
Acceptances, Guarantees and Standby Letters of Credit	Banking Service from acceptances, guarantees and standby letters of credit which are not part of the portfolio of Cibest Corporate Group. There exist different performance obligations; the satisfaction of performance obligations occurs when the service is given to the customer. The consideration in these types of contracts may include fixed amounts, variable amounts, or both, and Cibest Corporate Group acts as principal. The revenue is recognized at a point in time.

F-151

Table of Contents

Trust	Revenue related to Trust are received from the administration of the customer resources in the business of investment trusts, property trusts, management trusts, guarantee trusts, for the resources of the general social security system, Collective portfolios, and Private Equity Funds (PEF). The commitments are established in contracts independently and in an explicit manner, and the services provided Cibest Corporate Group are not inter-related between the contracts. The performance obligation corresponds to performing the best management in terms of the services to be provided in relation to trust characteristics, thus fixed and variable prices are established depending on the complexity of the business, similarly, revenues are recognized throughout or at a determined time. In all the established businesses it acts as principal.
Placement of Securities	Cibest Corporate Group makes available its commercial strength for the deposit, reinvestment of resources through financial instruments to the issuing company. It receives payment for deposits made. The commitment of the contract is satisfied to the extent that the resources requested by the issuer are obtained through the distribution desks of Cibest Corporate Group. The collection is made monthly. It is established that Cibest Corporate Group may undertake collection of these commissions at the end of the month through a collection account charged to the issuer, acting as principal.
Bancassurance	Cibest Corporate Group receives a commission for collecting insurance premiums at a given time and for allowing the use of its network to sell insurance from different insurance companies over time. Cibest Corporate Group in these bancassurance contracts acts as agent (intermediary between the customer and the insurance company), since it is the insurance company which assumes the risks, and which handles the complaints and claims of the customers inherent in each insurance. Therefore, the insurance company acts as principal before the customer. The prices agreed in bancassurance are defined as a percentage on the value of the policy premiums. The payment shall be tied to the premiums collected, sold or taken for the case of employees’ insurance. The aforementioned then means that the price is variable, since, the revenue will depend on the quantity of policies or calculations made by the insurance companies.
Collections	Cibest Corporate Group acting as principal, commits to collect outstanding invoices receivable by the collecting customers through the different channels offered by Cibest Corporate Group, send the information of the collections made and credit the money to the savings or checking account defined by the collecting customer. The commitment is satisfied at a point in time to the extent that the money is collected by the different channels, the information of the said collections is delivered appropriately, and the resources are credited in real time to the account agreed with the customer. For the service, Cibest Corporate Group receives a fixed payment, which is received for each transaction once the contract is in effect.
Services	These are the maintenance services performed on the fleet owned by the customers of Renting Colombia S.A.S., these services are performed on demand, and the value of the service cost is invoiced plus an intermediation margin. The collection is made by the amount of expense invoiced by the provider plus an intermediation percentage, which ranges between 5% and 10% depending on the customer.<br><br>The contract is written, is based on a framework contract which is held between the customers which contains the general terms of negotiation and the payment terms are generally 30 days after generating the invoice. The revenue is recognized when the service is provided. There is no financing nor sanctions for early cancellations. To view the details of the balance, refer to line ‘Logistics services’ in Note 25.4 Other operational Income.
Gains on sale of assets	These are the revenue from the sale of assets, where the sale value is higher than the book value recorded in the accounts, the difference representing the gains. The recognition of the revenue is at a point in time once the sale is realized. Cibest Corporate Group acts as principal in this type of transaction and the transaction price is determined by the market value of the asset being sold.<br><br>To view the details of the balance, refer to line ‘Gain on sale of assets’ in Note 25.4 Other operational Income.

Cibest Corporate Group presents the information on revenue from contracts with customers in accordance with its operating segments defined earlier in Note 3. Operating Segments for each of the principal services offered.

The following table shows the balances categorized by nature and by segment of revenue from ordinary activities from contracts with customers, for further information about composition of Cibest Corporate Group segments see Note 3. Operating segments:

F-152

Table of Contents

As of December 31, 2025

	Banking<br>Colombia	Banking El<br>Salvador	Banking<br>Guatemala	International Banking	Leases(1)	All Other<br><br>Segments	Total	Discontinued operation Banking Panama(2)
Revenue from contracts with customers	In millions of COP
Fees and Commissions income
Credit and debit card fees and commercial establishments	2,815,114	339,492	103,514	1,690	-	-	3,259,810	260,524
Banking services	738,887	183,023	62,462	47,505	-	62,802	1,094,679	118,747
Payment and collections	1,136,610	-	-	-	-	-	1,136,610	7,611
Bancassurance	1,090,888	12	-	-	-	1	1,090,901	64,711
Fiduciary Activities and Securities	-	9,266	893	50	-	634,665	644,874	7,682
Acceptances, Guarantees and Standby Letters of Credit	69,154	4,802	1,761	600	-	-	76,317	27,701
Placement of securities	-	3,709	-	-	-	102,943	106,652	-
Brokerage	-	-	-	-	-	42,214	42,214	-
Others	301,218	89,681	62,950	5,820	4	16,824	476,497	32,270
Total revenue of contracts with customers	6,151,871	629,985	231,580	55,665	4	859,449	7,928,554	519,246

(1)In 2025, the leasing segment is presented separately. For comparative purposes, the 2024 information has been restated, as in that period these operations were included within ‘All other segments’.

(2) The accumulated amount as of December 31, 2025, corresponds to Banistmo S.A., a subsidiary classified as an asset held for sale since December 18, 2025. For more information, see Note 1. Reporting Entity; Note 2.D12. Significant Accounting Policies – Assets Held for Sale and Discontinued Operations; and Note 31. Discontinued Operation.

As of December 31, 2024

	Banking<br>Colombia	Banking El<br>Salvador	Banking<br>Guatemala	International<br>Banking	Leases(1)	All Other<br>Segments	Total	Discontinued operation Banking Panama(2)
Revenue from contracts with customers	In millions of COP
Fees and Commissions income
Credit and debit card fees and commercial establishments	2,657,690	257,697	85,842	1,934	-	-	3,003,163	282,610
Banking services	694,554	166,713	65,432	43,540	-	34,580	1,004,819	131,958
Payment and collections	1,024,053	-	-	-	-	-	1,024,053	15,735
Bancassurance	958,311	47	-	-	-	13	958,371	67,193
Fiduciary Activities and Securities	-	6,515	902	50	-	544,820	552,287	18,964
Acceptances, Guarantees and Standby Letters of Credit	73,302	5,789	1,881	679	-	-	81,651	27,364
Placement of securities	-	2,097	-	-	-	78,120	80,217	1,670
Brokerage	-	-	-	-	-	20,648	20,648	16,473
Others	252,445	76,876	57,721	5,698	292	8,271	401,303	359
Total revenue of contracts with customers	5,660,355	515,734	211,778	51,901	292	686,452	7,126,512	562,326

(1)In 2025, the leasing segment is presented separately. For comparative purposes, the 2024 information has been restated, as in that period these operations were included within ‘All other segments’.

(2) The accumulated amount as of December 31, 2024 corresponds to Banistmo S.A., a subsidiary classified as an asset held for sale since December 18, 2025. For more information, see Note 1. Reporting Entity; Note 2.D12. Significant Accounting Policies – Assets Held for Sale and Discontinued Operations; and Note 31. Discontinued Operation.

F-153

Table of Contents

As of December 31, 2023

	Banking<br>Colombia	Banking El<br>Salvador	Banking<br>Guatemala	International<br>Banking	Leases	All Other<br>Segments	Total	Discontinued operation Banking Panama
Revenue from contracts with customers	In millions of COP
Fees and Commissions income
Credit and debit card fees and commercial establishments	2,467,174	233,049	95,833	1,992	-	-	2,798,048	272,380
Banking services	593,729	157,386	68,857	37,746	-	23,574	881,292	110,271
Payment and collections	950,167	-	-	-	-	-	950,167	15,236
Bancassurance	924,280	77	-	-	-	259	924,616	72,705
Fiduciary Activities and Securities	-	6,399	851	54	-	436,009	443,313	20,233
Acceptances, Guarantees and Standby Letters of Credit	72,335	5,211	3,173	1,803	-	-	82,522	25,159
Placement of securities	-	1,225	-	-	-	66,616	67,841	980
Brokerage	-	-	-	-	-	11,140	11,140	15,568
Others	244,414	76,221	54,486	5,633	-	8,255	389,009	398
Total revenue of contracts with customers	5,252,099	479,568	223,200	47,228	-	545,853	6,547,948	532,930

For the determination of the transaction price, Cibest Corporate Group assigns to each one of the services the amount which represents the value expected to be received as consideration for each independent commitment, which is based on the relative price of independent sale. The price that Cibest Corporate Group determines for each performance obligation is done by defining the cost of each service, related tax and associated risks to the operation and inherent to the transaction plus the margin expected to be received in each one of the services, taking as references the market prices and conditions, as well as the segmentation of the customer.

No changes in the transaction price were identified in the transactions evaluated within the contracts.

Contract assets with customers

Cibest Corporate Group receives payments from customers based on the provision of the service, in accordance to that established in the contracts. When Cibest Corporate Group incurs costs for providing the service prior to the invoicing, and if these are directly related with a contract, they improve the resources of the entity and are expected to recuperate, these costs correspond to a contract asset. Currently, Cibest Corporate Group does not have assets related to contracts with customers.

As a practical expedient, Cibest Corporate Group recognizes the incremental costs of obtaining a contract as an expense when the amortization period of the asset is one year or less.

Contract liabilities with customers

The contract liabilities constitute the obligation of Cibest Corporate Group to transfer the services to a customer, for which Cibest Corporate Group has received a payment on the part of the final customer or if the amount is due before the execution of the contract. They also include deferred income related to services that shall be delivered or provided in the future, which will be invoiced to the customer in advance, but which are still not due.

The following table shows the detail of accounts receivable, and contract liabilities balances as at December 31, 2025, 2024 and 2023:

	2025	2024	2023
In millions of COP
Accounts receivable from contracts with customers(1)	261,425	257,262	259,516
Liabilities from contracts with customers(2)(3)(4)	48,658	68,040	60,128

(1) Allowances for receivables from customers are COP 21,633, COP 23,639 and COP 21,591 for the year 2025, 2024 and 2023, respectively. (2) Contract liabilities are mainly related to commissions received from customers when financial guarantees are issued. They are recognized as income during the term of the contract, according to the form and frequency of payment of the commissions. The weighted-average expected period for income recognition as of December 31, 2025, and as of December 31, 2024,was 1.6 and as of December 31, 2023 was 1.4. (3) During the years 2025, 2024 and 2023, income was recognized for COP 38,614, COP 45,848 and 47,898 respectively

F-154

Table of Contents

from the liability of contracts with clients at the beginning of the period. (4) See Note 20. Other liabilities.

The contract liabilities increased COP 19,382 in 2025 and COP 7,912 in 2024. The changes in contract liabilities are mainly due to the impact of the reclassification of Banistmo S.A. as an asset held for sale.

Fees and Commissions Expenses

The following table sets forth the detail of commissions expenses for the year ended December 31, 2025, 2024, and 2023:

Fees and Commissions Expenses	2025	2024	2023
In millions of COP
Banking services	1,737,216	1,458,363	1,264,377
Sales, collections, and other services	889,356	894,836	855,480
Correspondent banking	618,969	620,818	507,586
Payments and collections	77,008	46,792	41,820
Others	251,061	204,573	169,120
Total expenses for commissions	3,573,610	3,225,382	2,838,383
Discontinued operation Banistmo S.A.(1)	261,793	286,392	258,897

(1) The accumulated amount as of December 31, 2025 and 2024 corresponds to Banistmo S.A., a subsidiary classified as an asset held for sale since December 18, 2025. For more information, see Note 1. Reporting Entity; Note 2.D12. Significant Accounting Policies – Assets Held for Sale and Discontinued Operations; and Note 31. Discontinued Operation.

25.4.       Other operating income

The following table sets forth the detail of other operating income, net for the years ended December 31, 2025, 2024 and 2023:

Other operating income	2025	2024	2023
In millions of COP
Leases and related services(1)	1,748,321	1,827,163	1,771,016
Net foreign exchange and Derivatives Foreign exchange contracts(2)	989,902	421,904	1,208,515
Gains on sale of assets(3)	236,962	101,898	172,389
Investment property valuation(4)	109,781	200,256	197,526
Insurance(5)	85,687	85,993	86,330
Logistics services	62,041	47,880	136,118
Other reversals	31,942	72,574	66,958
Penalties for failure to contracts	4,194	7,952	13,855
Others	303,244	210,490	290,005
Total Other operating income	3,572,074	2,976,110	3,942,712		Discontinued operations Banistmo S.A.(6)	24,905	65,875	36,938
---	---	---	---

(1) Corresponds to operating leases for COP 724,656, COP 795,179 and COP 833,244, other related leasing services for COP 629,473, COP 671,251 and COP 660,442 (see Note 11.1 lessor), property leases for COP 360,610, COP 325,286 and COP 228,325 (see Note 9. Investment properties) and other assets leases for COP 33,582, COP 35,447, COP 49,005 for the years ended December 31, 2025, 2024, and 2023 respectively.

(2) Corresponds to the management of assets and liabilities in foreign currencies and the volatility of the U.S. dollar.

(3) Corresponds mainly to higher gains on assets held for sale, mostly vehicles.

(4) The variation occurs due to the indexation of properties to the UVR and due to updating the appraisals of investment properties.

(5)Corresponds to income from insurance operations of Seguros Agromercantil S.A., subsidiary domiciled in Guatemala.

F-155

Table of Contents

(6)The accumulated amount as of December 31, 2025, and 2024 corresponds to Banistmo S.A., a subsidiary classified as an asset held for sale since December 18, 2025. For more information, see Note 1. Reporting Entity; Note 2.D12. Significant Accounting Policies – Assets Held for Sale and Discontinued Operations; and Note 31. Discontinued Operation.

25.5. Dividends and net income on equity investments

The following table sets forth the dividends and net income on equity investments for the years ended December 31, 2025, 2024 and 2023:

Dividends and net income on equity investments	2025	2024	2023
	In millions of COP
Equity method(1)	348,962	222,572	113,115
Dividends(2)	145,807	130,312	115,528
Equity investments and other financial instruments(3)	68,867	41,042	21,344
Gains on sale of investments in joint ventures(4)	11,508	-	-
Recovery (impairment) of investments in joint ventures(5)	117,867	(314,347)	(108,175)
Others(6)	-	13,520	54,874
Total dividends received, and share of profits of equity method investees	693,011	93,099	196,686
Discontinued operations Banistmo S.A.(7)	8,561	11,474	13,499
---	---	---	---

(1)As of December 31, 2025, 2024 and 2023, it corresponds to income from equity method of investments in associates for COP 316,237, COP 311,193 and COP 230,704 (includes valuation of investments in associates at fair value), respectively, and joint ventures for COP 32,725, COP (88,621) and (117,589), respectively. For further information, see Note 8. Investments in associates and joint ventures.

(2)As of December 31, 2025, 2024 and 2023, includes dividends received from equity investments at fair value through profit or loss for COP 1,593, COP 1,461 and COP 768 and investments written off for COP 34, COP 2 and COP 341, respectively; dividends from equity investments at fair value through OCI for COP 8,397, COP 6,872 and COP 6,565, respectively and investments written off for COP 537 in 2025 and COP 3,231 in 2023. Dividends received of the associate at fair value P.A. Viva Malls are COP 135,246, COP 121,977 and COP 104,623, respectively. For further information, see Note 8. Investments in associates and joint ventures.

(3)For 2025, the variation is explained mainly in Inversiones CFNS S.A.S for COP 21,831 due to the devaluation of investments in Home Capital Colombia S.A.S. and Enka the previous year. For 2024, the variation is in Bancolombia S.A. for COP 34,438 mainly in FCP Pactia Inmobiliario, Inversiones CFNS S.A.S. for COP (9,237) and Banagrícola S.A. for COP (8,227).

(4)In 2025, corresponds to gain on sale of the P.A. Laurel joint venture by Inversiones CFNS S.A.S. For further information, see Note 8. Investments in associates and joint ventures.

(5)As of December 31, 2025, an impairment recovery was recognized in joint venture investments in Bancolombia for COP 90,849 recognized in the Banking Colombia segment and in Banca de Inversión and Negocios Digitales for COP 26,997 and COP 21, respectively, recognized in other segments. In 2024, impairment of investments in associates and joint ventures recognized in the Banca de Inversión and other companies for COP 156,205 and COP 2,091, respectively, recognized in other segments and in Bancolombia for COP 156,051, recognized in Banking Colombia segment and in and 2023, in Banca de Inversión and Inversiones CFNS for COP 106,574 and COP 1,601, respectively, recognized in other segments. For further information, see Note 8. Investments in associates and joint ventures.

(6)Corresponds to gains recognized from a bargain purchase, In 2024, P.A. Sodimac for COP 13,520 and 2023 of P.A. Calle 84 (2) and P.A. Calle 84 (3) for COP 31,117 and P.A. Nomad Central for COP 23,757.

(7)As of December 31, 2025, 2024 and 2023, the accumulated amount corresponds to Banistmo S.A., a subsidiary classified as an asset held for sale as of December 18, 2025. For further information, see Note 1. Reporting Entity;

F-156

Table of Contents

Note 2.D.12. Significant accounting policies: assets held for sale and discontinued operations; and Note 31. Discontinued Operations.

NOTE 26. OPERATING EXPENSES

26.1.       Salaries and employee benefit

The details for salaries and employee benefits for the years ended December 31, 2025, 2024 and 2023, are as follows:

Salaries and employee benefit	2025	2024	2023
In millions of COP
Salaries(1)	2,400,872	2,169,634	2,002,456
Bonuses(2)	1,064,656	868,694	880,203
Private premium	655,485	616,613	639,311
Social security contributions	629,873	599,171	546,434
Defined Benefit severance obligation and interest	193,750	177,421	159,066
Indemnity payment	173,201	217,765	172,893
Vacation expenses	148,156	139,511	125,360
Other benefits(3)	494,129	435,914	373,560
Total salaries and employee benefit	5,760,122	5,224,723	4,899,283
Discontinuous operation Banistmo S.A.(4)	436,718	403,339	450,951

(1)This is mainly explained by salary increases.

(2)Corresponds mainly to bonuses for employees in accordance with the variable compensation model of Cibest Corporate Group.

(3)Includes pension and employee benefits (policy benefits, training, and recreation).

(4) The accumulated value as of December 31, 2025, and 2024 corresponds to Banistmo S.A., a subsidiary classified as an asset held for sale since December 18, 2025. For more information, see Note 1. Reporting Entity, Note 2.D12. Significant Accounting Policies - Assets Held for Sale and Discontinued Operations, and Note 31. Discontinued Operation.

F-157

Table of Contents

26.2.       Other administrative and general expenses

The detail for administrative and general expenses for the years ended December 31, 2025, 2024 and 2023 is as follows:

Other administrative and general expenses	2025	2024	2023
In millions of COP
Maintenance and repairs(1)	1,101,564	956,315	842,105
Fees	839,015	791,710	782,834
Insurance	766,192	725,238	729,325
Data processing(2)	643,036	482,218	400,201
Frauds and claims	446,857	412,002	340,454
Transport	264,097	246,280	220,735
Advertising	180,449	162,057	157,681
Contributions and affiliations	132,249	115,939	109,038
Public services	120,612	119,989	109,050
Cleaning and security services	119,301	112,880	105,012
Useful and stationery	85,247	88,714	48,216
Communications	83,319	76,268	74,685
Properties improvements and installation	75,891	66,543	64,619
Real estate management(3)	55,554	38,396	33,637
Travel expenses	36,567	29,794	30,237
Disputes, fines, and sanctions	35,504	41,687	42,707
Short-term and low-value leases	27,811	16,359	10,926
Publications and subscriptions	26,740	23,105	22,279
Storage services	18,430	17,845	16,321
Legal expenses(4)	12,270	8,736	9,209
Others	528,655	502,948	465,716
Total other administrative and general expenses	5,599,360	5,035,023	4,614,987
Discontinued operation Banistmo S.A.(5)	345,439	410,189	418,957
Taxes other than income tax	1,481,323	1,402,064	1,393,216
Discontinued operation Banistmo S.A.(5)	30,045	40,447	39,932

(1)The increase is due to maintenance work on buildings owned by the FCP Fondo Inmobiliario Colombia.

(2)The increase is mainly in Bancolombia, due to higher spending on technology services.

(3)The variation occurs mainly in Bancolombia.

(4)The increase at Cibest Corporate Group is due to payments to the Camara de Comercio de Medellín for spin-off procedures, registration tax, and stamp duty..

(5)The accumulated value as of December 31, 2025, and 2024 corresponds to Banistmo S.A., a subsidiary classified as an asset held for sale since December 18, 2025. For more information, see Note 1. Reporting Entity, Note 2.D12. Significant Accounting Policies - Assets Held for Sale and Discontinued Operations, and Note 31. Discontinued Operation.

F-158

Table of Contents

26.3.       Depreciation, amortization and impairment

The detail for Depreciation, amortization and impairment for the years ended December 31, 2025, 2024 and 2023 is as follows:

Depreciation, amortization and impairment	2025	2024	2023
In millions of COP
Depreciation of premises and equipment(2)	612,853	606,100	609,897
Amortization of intangible assets(3)	192,307	144,517	186,562
Depreciation of right-of-use assets(4)	172,461	160,768	179,474
Impairment of other assets, net(5)(6)	38,680	77,951	41,211
Total depreciation, amortization and impairment	1,016,301	989,336	1,017,144
Discontinued operation Banistmo S.A.(1)	97,737	128,545	107,715

(1)As of December 31, 2025, and 2024, Banistmo S.A., a subsidiary classified as an asset held for sale since December 18, 2025, recorded the following expenses:

•Depreciation of premises and equipment for COP 26,997, 2024 COP 27,655 and 2023 for COP 26,479

•Amortization of intangible assets for COP 16,543, 2024 COP 25,623 and 2023 for COP 25,755

•Depreciation of right-of-use assets for COP 34,830, 2024 COP 46,792 and 2023 for COP 50,191

•Impairment of other assets, net for COP 19,367, 2024 COP 28,475 and 2023 for COP 5,290. For further information See Note 1. Reporting Entity, Note 2.D12. Significant Accounting Policies - Assets Held for Sale and Discontinued Operations, and Note 31. Discontinued Operation.

(2)See Note 10 Premises and equipment, net.

(3)See Note 12 Goodwill and intangibles assets, net

(4)See Note 11.2 Lessee.

(5)Includes value for impairment of property and equipment for COP 543 in 2025, COP 842 in 2024 and COP 4,480 in 2023.

(6)The detail of the impairment of other assets net by operating segments for the years ended December 31, 2025, 2024 and 2023 is presented in the table below:

Impairment (recovery) of other assets, net	2025	2024	2023
In millions of COP
Banking Colombia(1)	28,540	51,626	45,122
Banking Guatemala(1)	6,326	13,703	8,929
Leases	4,069	5,822	4,709
International Banking(2)	274	5,999	1,730
Banking El Salvador(3)	(527)	732	(19,283)
All other segments	(2)	69	4
Total	38,680	77,951	41,211
Banking Panama (discontinued operation)(4)	19,367	28,475	5,290

(1)The variations in 2025 with respect to 2024, and 2023 is mainly for the impairment of assets received in lieu of payment by restatement to Net realizable value (NRV).

(2) The variation corresponds mainly to the net realizable value (NRV) and higher sales generated in 2024.

(3) The recovery is due to the retroactive adjustment of non-traded assets worth USD 1,533,000 and a lower impairment of the (BRP).

(4)The accumulated value as of December 31, 2025, and 2024 corresponds to Banistmo S.A., a subsidiary classified as an asset held for sale since December 18, 2025. For more information, see Note 1. Reporting Entity, Note 2.D12. Significant Accounting Policies - Assets Held for Sale and Discontinued Operations, and Note 31. Discontinued Operation.

During 2025, 2024 and 2023, no significant cybersecurity breaches materialized, according to the data security policies established by Management that would warrant disclosure in the Consolidated Financial Statements.

F-159

Table of Contents

NOTE 27. EARNING PER SHARE (‘EPS’)

Basic earnings per share are calculated by reducing income from continuing operations by the amount of dividends declared in the current period for each class of shares, as well as by the contractual amount of dividends required to be paid. The remaining income is allocated based on each type of share’s participation, as if all the period’s income had been distributed. Basic earnings per share are determined by dividing the profit for the period attributable to shareholders by the weighted average number of ordinary shares outstanding during the period. The weighted average number of ordinary shares outstanding during the period corresponds to the number of ordinary shares outstanding at the beginning of the period, adjusted for the number of ordinary shares repurchased or issued during the period, weighted by a factor that reflects the time such shares were outstanding or retired.

Diluted earnings per share assume the issuance of ordinary shares for all potentially dilutive ordinary shares outstanding during the reporting period. Cibest Corporate Group has no potentially dilutive ordinary shares as of December 31, 2025, 2024, and 2023.

The following presents the calculation of basic earnings per share for the years ended December 31, 2025, 2024, and 2023 (amounts in millions of Colombian pesos, except for the weighted average number of ordinary shares outstanding and earnings per share):

	2025	2024	2023
Income from continuing operations before attribution of non-controlling interests	6,948,339	6,110,396	5,702,378
Less: Non-controlling interests from continuing operations	121,065	97,837	98,035
Net income from continuing operations	6,827,274	6,012,559	5,604,343
Income from discontinuing operations before attribution of non-controlling interests	(3,006,640)	255,185	512,593
Less: Non-controlling interests from continuing operations	-	-	-
Net income from discontinued operations	(3,006,640)	255,185	512,593
Net income from controlling interest	3,820,634	6,267,744	6,116,936
Less: Preferred dividends declared	1,974,822	1,541,003	1,541,003
Less: Allocation of undistributed earnings to preferred stockholders	(215,059)	1,374,673	1,303,784
Net income allocated to common shareholders for basic and diluted EPS	2,060,871	3,352,068	3,272,149
Weighted average number of common shares outstanding used in basic EPS calculation(1)	509,467,274	509,704,584	509,704,584
Basic and diluted earnings per share from continuing operations	7,182	6,311	5,887
Basic and diluted earnings per share from discontinuing operations(2)	(3,137)	265	533
Basic and diluted earnings per share to common shareholders	4,045	6,576	6,420

(1)In 2025, Grupo Cibest repurchased 8,612,336 shares for a total amount of COP 431,418. For additional information regarding the share repurchase, see Note 22. Share Capital and Note 23. Appropriated Reserves.

(2)This corresponds to Banistmo S.A., a subsidiary classified as an asset held for sale since December 18, 2025. For more information, see Note 1. Reporting Entity, Note 2.D12. Significant Accounting Policies - Assets Held for Sale and Discontinued Operations, and Note 31. Discontinued Operation.

NOTE 28. RELATED PARTY TRANSACTIONS

IAS 24 Related Party Disclosures requires that an entity discloses:

(a)Transactions with its related parties; and

(b)Relationships between a parent and its subsidiaries irrespective of whether there have been transactions between them.

Under IAS 24, an entity must disclose information about related party relationships, transactions, and outstanding balances, including commitments, recognized in the consolidated and separate financial statements of a parent or investors with joint control or significant influence over, an investee presented in accordance with IFRS 10 Consolidated Financial Statements.

F-160

Table of Contents

Under this standard parties are considered to be related if one party has the ability to control the other party or exercise significant influence over the other party in making financial or operational decisions, or one other party controls both. This definition applies to Cibest Corporate Group the cases below:

•Stockholders with ownership interest equal or higher than 20% of the Cibest Corporate Group’s capital:

–Grupo de Inversiones Suramericana S.A.

–Fondo Bancolombia ADR Program.

•Members of Board of Directors and Senior Management, understood as the President and corporate Vice-presidents, as well as their close relatives (spouse and children) and the companies in which they have a participation of 50% or more of the Cibest Corporate Group's capital.

•Associates and joint ventures for which Cibest Corporate Group or any of the subsidiaries of Cibest Corporate Group provide commercial banking services and deposits. For these purposes, all companies in which Cibest Corporate Group has joint control or significant influence have been included. For more information see note 8. Investments in associates and joint control.

Cibest Corporate Group or some of the subsidiaries provide banking and financial services to its related parties in order to satisfy their liquidity needs, and except for the intercompany merger agreement described below, these transactions are conducted on similar terms to third-party transactions and are not individually material. In the case of treasury operations, Cibest Corporate Group operates between its own position and its related parties through transactional channels or systems established for this purpose and under the conditions established by current regulations.

Between the Parent Company and its related parties, during the periods ending at December 31, 2025, 2024 and 2023, there were no:

–Loans that for its contractual terms do not represent a lending transaction.

–Loans with interest rates different from those that are ordinarily paid or charged to third parties under similar conditions of term, risk, etc.

–Operations whose characteristics differ from those carried out with third parties.

–Guarantees, pledges or commitments given or received in respect of the aforementioned transactions.

F-161

Table of Contents

As of December 31, 2025

	Stockholders with an<br><br>interest equal or<br><br>higher than 20% of<br><br>Grupo Cibest's capital(1)	Directors and<br>senior<br>management	Associates and<br>joint ventures
In millions of COP
Assets
Financial assets investments	3,087	-	49,903
Derivative financial instruments	-	-	7,033
Loans and advances to customers	2,289,836	11,379	211,304
Allowance for loans, advances, and lease losses	(3,494)	(16)	(6,797)
Investment in associates and joint ventures	-	-	3,311,506
Other assets	14,786	20	433,749
Total assets	2,304,215	11,383	4,006,698
Liabilities
Deposits by customers	1,197,768	7,684	148,273
Derivative financial instruments	260	-	54
Other liabilities	2,246	74	77,160
Total liabilities	1,200,274	7,758	225,487
Income
Interest on loans and financial leases	281,048	701	36,819
Valuation on financial instruments	20,761	-	8,571
Fees and commissions income	819,685	55	35,020
Dividends and net income on equity investments	4,057	-	613,583
Derivatives Foreign exchange contracts	89,165	-	18,857
Other operating income	51,596	10	31,098
Net income	1,266,312	766	743,948
Expenses
Interest expenses	86,479	365	5,478
Credit impairment (recovery) charges, net	1,030	5	4,212
Fees and commissions expenses	22,223	-	220,237
Employee benefits(2)	118,554	80	1
Other administrative and general expenses	69,864	2,161	94,386
Total expenses	298,150	2,611	324,314

(1)Includes Grupo Sura conglomerate.

(2)In case of stockholders with an interest equal or higher than 20% of the Cibest Corporate Group capital, this includes the benefits provided to employees for insurance policies; for directors and senior management it corresponds to the benefit of special credit rates for employees.

F-162

Table of Contents

As of December 31, 2024

	Stockholders with an<br><br>interest equal or<br><br>higher than 20% of<br><br>Grupo Cibest's capital(1)	Directors and<br>senior<br>management	Associates and<br>joint ventures
In millions of COP
Assets
Financial assets investments	1,232	-	49,643
Derivative financial instruments	1,283	729	53
Loans and advances to customers	2,562,324	23,973	294,674
Allowance for loans, advances, and lease losses	(2,759)	(19)	(2,453)
Investment in associates and joint ventures	-	-	2,928,984
Other assets	17,685	16	332,811
Total assets	2,579,765	24,699	3,603,712
Liabilities
Deposits by customers	1,522,278	16,807	242,996
Derivative financial instruments	53,051	183	10,116
Other liabilities	20,044	91	73,838
Total liabilities	1,595,373	17,081	326,950
Income
Interest on loans and financial leases	268,820	1,834	27,177
Valuation on financial instruments	145	-	9,504
Fees and commissions income	750,416	159	18,004
Dividends and net income on equity investments	75	-	30,202
Derivatives Foreign exchange contracts	(68,910)	1,442	(6,797)
Other operating income	43,476	70	47,629
Net income	994,022	3,505	125,719
Expenses
Interest expenses	136,562	876	9,066
Credit impairment (recovery) charges, net	1,566	(29)	2,742
Fees and commissions expenses	477	-	186,384
Employee benefits(2)	105,604	131	-
Other administrative and general expenses	130,571	2,711	77,086
Total expenses	374,780	3,689	275,278

(1)Includes Grupo Sura conglomerate.

(2)In case of stockholders with an interest equal or higher than 20% of the Cibest Corporate Group capital, this includes the benefits provided to employees for insurance policies; for directors and senior management it corresponds to the benefit of special credit rates granted to employees.

F-163

Table of Contents

As of December 31, 2023

	Stockholders with an<br><br>interest equal or<br><br>higher than 20% of<br><br>Grupo Cibest’s capital(1)	Directors and<br>senior<br>management	Associates and<br>joint ventures
In millions of COP
Assets
Financial assets investments	6,050	-	54,001
Derivative financial instruments	48,747	—	7,297
Loans and advances to customers	1,850,407	22,437	271,676
Allowance for loans, advances and lease losses	(1,455)	(50)	(760)
Investment in associates and joint ventures	-	-	2,997,603
Other assets(2)	17,951	18	271,263
Total assets	1,921,700	22,405	3,601,080
Liabilities
Deposits by customers	1,434,117	16,312	141,853
Derivative financial instruments	14	209	1,068
Other liabilities	23,070	59	70,387
Total liabilities	1,457,201	16,580	213,308
Income
Interest on loans and financial leases	157,451	1,783	27,925
Valuation on financial instruments	97	-	11,998
Fees and commissions income	744,000	98	14,647
Dividends and net income on equity investments(2)	213	-	109,563
Derivatives Foreign exchange contracts	63,060	(218)	27,174
Other operating income	48,531	9	9,806
Net income	1,013,352	1,672	201,113
Expenses
Interest expenses	181,085	1,038	8,261
Credit impairment (recovery) charges, net	(8,307)	4	(1,193)
Fees and commissions expenses	590	-	152,563
Employee benefits(3)	89,199	93	-
Other administrative and general expenses	159,184	2,492	23,644
Total expenses	421,751	3,627	183,275

(1)Includes Grupo Sura conglomerate.

(2)Includes impairment of associates and joint ventures mainly in Tuya S.A.

(3)In case of stockholders with an interest equal or higher than 20% of Cibest Corporate Group’s capital, includes the benefit provided to employees for insurance policies and for directors and senior management corresponds to the benefit of special credit rates granted to employees.

During the years ending December 31, 2025, 2024 and 2023, Cibest Corporate Group paid fees to the directors of COP 1,945, COP 2,474 and COP 2,306, respectively, as compensation for attending meetings of the Board and its Committees.

The payments to senior management in the same periods were COP 25,822, COP 20,327 and COP 18,387 for short-term retributions and COP 283, COP 643 and COP 312 for long-term retributions. In addition, there were payments for post-employment benefits of COP 1,176 in 2025, COP 980 in 2024 and 827 in 2023.

F-164

Table of Contents

The Parent Company, which is also the ultimate parent company, is Grupo Cibest S.A. Transactions between companies included in consolidation, described in the significant accounting policies, see Note 2.C.1 Subsidiaries, meet the definition of related party transactions and were eliminated from the consolidated financial statements.

NOTE 29. LIABILITIES FROM FINANCING ACTIVITIES

The following table presents the reconciliation of the balances of liabilities from financing activities as of December 31, 2025 and 2024:

	Balance as of<br>January 1, 2025		Cash flows		Non-cash changes				Balance as of<br><br>December 31, 2025(1)
		Foreign<br>currency<br>translation<br>adjustment		Interests<br>accrued		Other<br>movements
	In millions of COP
Liabilities from financing activities
Repurchase agreements and other similar secured borrowing	1,060,472		34,012		(87,678)		-	-	1,006,806
Borrowings from other financial institutions(2)	15,689,532		(4,204,081)		(1,337,193)		963,405	267	11,111,930
Debt instruments in issue(2)	11,275,216		140,620		(1,402,998)		826,585	-	10,839,423
Preferred shares(3)	584,204		(57,701)		-		56,974	-	583,477
Total liabilities from financing activities	28,609,424		(4,087,150)		(2,827,869)		1,846,964	267	23,541,636

(1)As of December 31, 2025, include the operations of Banistmo S.A. For more information, see Note 1. Reporting Entity; Note 2.D12. Significant Accounting Policies – Assets Held for Sale and Discontinued Operations; and Note 31. Discontinued Operation.

(2)The cash flows disclosed in this table related with Borrowings from other financial institutions and Debt securities in issue include the interests paid during the year amounting to COP 849,921 and COP 782,242, respectively, which are classified as cash flows from operating activities in the Consolidated Statement of Cash Flow.

(3)The cash flow amounting to COP 57,701 corresponds to the fixed minimum dividend paid to the Preferred Shares' holders and is included in the line "dividends paid" of the Consolidated Statement of Cash Flow, which includes the dividends paid during the year to both Preferred and Common shareholders.

	Balance as of<br>January 1, 2024		Cash flows		Non-cash changes				Balance as of<br>December 31, 2024
		Foreign<br>currency<br>translation<br>adjustment		Interests<br>accrued		Other<br>movements
	In millions of COP
Liabilities from financing activities
Repurchase agreements and other similar secured borrowing	470,295		550,584		39,593		-	-	1,060,472
Borrowings from other financial institutions(1)	15,648,606		(2,506,604)		1,196,756		1,349,913	861	15,689,532
Debt instruments in issue(1)	14,663,576		(6,226,196)		1,635,724		1,202,112	-	11,275,216
Preferred shares(2)	584,204		(57,701)		-		57,701	-	584,204
Total liabilities from financing activities	31,366,681		(8,239,917)		2,872,073		2,609,726	861	28,609,424

(1)The cash flows disclosed in this table related with Borrowings from other financial institutions and Debt securities in issue include the interests paid during the year amounting to COP 1,426,452 and COP 1,104,487, respectively, which are classified as cash flows from operating activities in the Consolidated Statement of Cash Flow.

(2)The cash flow amounting to COP 57,701 corresponds to the fixed minimum dividend paid to the Preferred shareholders and is included in the line "dividends paid" of the Consolidated Statement of Cash Flow, which includes the dividends paid during the year to both Preferred and Common shareholders.

F-165

Table of Contents

NOTE 30. FAIR VALUE OF ASSETS AND LIABILITIES

The following table presents the carrying amount and the fair value of the assets and liabilities as of December 31, 2025, and 2024:

	Note		December 31, 2025(1)				December 31, 2024
		Carrying<br>amount		Fair<br>Value		Carrying<br>amount		Fair<br>Value
In millions of COP
Assets
Debt instruments at fair value through profit or loss	5.1		23,459,380		23,459,380		23,035,281		23,035,281
Debt instruments at fair value through OCI	5.1		3,551,348		3,551,348		5,084,416		5,084,416
Debt instruments at amortized cost	5.1		5,812,624		5,836,484		8,404,878		8,403,740
Derivative financial instruments	5.2		4,417,863		4,417,863		2,938,142		2,938,142
Equity securities at fair value	5.1		1,463,622		1,463,622		1,011,310		1,011,310
Other financial instruments	5.1		30,285		30,285		34,385		34,385
Loans and advances to customers at amortized cost, net	6		243,100,035		275,626,425		263,274,170		269,345,583
Investment properties	9		6,595,407		6,595,407		5,580,109		5,580,109
Investments in associates(2)	8		2,041,402		2,041,402		1,830,884		1,830,884
Total			290,471,966		323,022,216		311,193,575		317,263,850
Liabilities
Deposits by customers	15		264,413,956		264,953,910		279,059,401		279,463,012
Interbank deposits	16		30,102		30,102		716,493		716,493
Repurchase agreements and other similar secured borrowing	16		676,047		676,047		1,060,472		1,060,472
Derivative financial instruments	5.2		4,514,630		4,514,630		2,679,643		2,679,643
Borrowings from other financial institutions	17		9,356,428		9,356,428		15,689,532		15,689,532
Preferred shares			583,477		324,260		584,204		407,174
Debt instruments in issue	18		7,409,693		7,627,543		11,275,216		11,389,498
Total			286,984,333		287,482,920		311,064,961		311,405,824

(1)The accumulated value as of December 31, 2025, includes the effects of the classification of Banistmo S.A. as an asset held for sale since December 18, 2025. For more information, see Note 1. Reporting Entity, Note 2.D12. Significant Accounting Policies - Assets Held for Sale and Discontinued Operations, and Note 31. Discontinued Operation.

(2)It corresponds to investments in associates P.A. Viva Malls, P.A. Distrito Vera, P.A. Lote Palermo, and Fideicomiso Locales Distrito Vera. For further information see Note 8. Investments in associates and joint ventures.

Fair value hierarchy

IFRS 13 establishes a fair value hierarchy of valuation techniques based on whether the inputs to those valuation techniques are observable or unobservable, that reflects the significance of inputs adopted in the measurement process. In accordance with IFRS, the financial instruments are classified as follows:

Level 1: Observable inputs that reflect quoted prices (unadjusted) in active markets for identical assets or liabilities. An active market is a market in which transactions for the asset or liability being measured take place with sufficient frequency and volume to provide pricing information on an ongoing basis.

Level 2: Inputs other than quoted prices included in Level 1 that are observable for the asset or liability either directly or indirectly. Level 2 generally includes: (i) quoted prices for similar assets or liabilities in active markets; (ii) quoted prices for identical or similar assets or liabilities in markets that are not active, that is, markets in which there are few transactions for the asset or liability.

Level 3: Unobservable inputs that are supported by little or no market activity and that are significant to the fair value of the assets or liabilities. Level 3 assets and liabilities include financial instruments whose value is determined using pricing

F-166

Table of Contents

models, discounted cash flow methodologies, or similar techniques, as well as instruments for which the determination of fair value requires significant management judgment or estimation. This category generally includes certain retained residual interests in securitizations, asset-backed securities (ABS) and highly structured or long-term derivative contracts where independent pricing information was not able to be obtained for a significant portion of the underlying assets.

Valuation process for fair value measurements

The valuation to fair value prices is performed using prices, methodologies and inputs provided by the official pricing services provider (Precia - Proveedor de Precios para Valoración S.A.) to Cibest Corporate Group.

All methodologies and procedures developed by the pricing services provider are supervised by the SFC, which has not objected to them.

Daily, the back-office Service Valuation Officer (SVO) verifies the valuation of investments, and the Credit and Financial Risk Manager area reports the results of the portfolio’s valuation.

Fair value measurement

Assets and liabilities

a. Debt instruments

Cibest Corporate Group assigns prices to those debt investments, using the prices provided by the official pricing services provider (Precia) and assigns the appropriate level according to the procedure described above. For securities not traded or over the counter, such as certain bonds issued by other financial institutions, Cibest Corporate Group generally determines fair value using internal valuation and standard techniques. These techniques include determination of expected future cash flows which are discounted using curves of the applicable currencies and the Colombian consumer price index (interest rate in this case), modified by the credit risk and liquidity risk. The interest rate is generally computed using observable market data and reference yield curves derived from quoted interest in appropriate time bandings, which match the timings of the cash flows and maturities of the instruments.

b. Equity securities and other financial instruments

Cibest Corporate Group perform the market price valuation of its investments in variable income using the prices provided by the official pricing services provider (Precia) and classifies those investments according to the procedure described above (Hierarchy of fair value section). Likewise, the fair value of unlisted equity securities and other financial instruments is based on an assessment of each individual investment using methodologies that include publicly-traded comparable derived by multiplying a key performance metric (e.g., earnings before interest, taxes, depreciation and amortization) of the portfolio company by the relevant valuation multiple observed for comparable companies, acquisition comparable, and if necessary considered, are subject to appropriate discounts for lack of liquidity or marketability. Interests in investment funds, trusts and collective portfolios are valued using the investment unit value determined by the fund management company. For investment funds where the underlying assets are investment properties, the investment unit value depends on the investment properties value, determined as described below in “i. Investment property”.

c. Derivative financial instruments

Cibest Corporate Group holds positions in standardized derivatives, such as futures over local stocks, and over the market representative rate. These instruments are evaluated according to the information provided by Precia, which perfectly matches the information provided by the Central Counterparty Clearing House – CCP.

Additionally, Cibest Corporate Group holds positions in Over-The-Counter (OTC) derivatives, which in the absence of prices, are valued using the inputs and methodologies provided by the pricing services provider, which have the no objection to the SFC.

The key inputs depend upon the type of derivative and the nature of the underlying instrument and include interest rate yield curves, foreign exchange rates, the spot price of the underlying volatility, credit curves, and correlation of such inputs.

d. Credit valuation adjustment

F-167

Table of Contents

Cibest Corporate Group measures the effects of the credit risk of its counterparties and its own creditworthiness in determining fair value of the swap, option, and forward derivatives.

Counterparty credit-risk adjustments are applied to derivatives when the Cibest Corporate Group’s position is a derivative asset and the Cibest Corporate Group’s credit risk is incorporated when the position is a derivative liability. Cibest Corporate Group attempts to mitigate credit risk to third parties which are international banks by entering into master netting agreements. The agreements allow the offsetting or netting of amounts that are liabilities derived from transactions carried out under the different agreements. Master netting agreements take different forms and may allow payments to be made under a variety of other master agreements or other negotiated agreements between the same parties; some may operate on a monthly basis, while others apply only upon termination of the agreements.

When assessing the impact of credit exposure, only the net counterparty exposure is considered at risk, due to the offsetting of certain same-counterparty positions and the application of cash and other collateral.

Cibest Corporate Group generally calculates the asset’s credit risk adjustment for derivatives transacted with international financial institutions by incorporating indicative credit related pricing that is generally observable in the market (Credit Default Swaps, “CDS”). The credit-risk adjustment for derivatives transacted with nonpublic counterparties is calculated by incorporating unobservable credit data derived from internal credit qualifications to the financial institutions and corporate companies located in each geography. Cibest Corporate Group also considers its own creditworthiness when determining the fair value of an instrument, including OTC derivative instruments if Cibest Corporate Group believes market participants would take that into account when transacting the respective instrument. The approach to measuring the impact of the Cibest Corporate Group’s credit risk on an instrument transacted with international financial institutions is done using the asset swap curve calculated for subordinated bonds issued by Cibest Corporate Group in foreign currency. For derivatives transacted with local financial institutions, Cibest Corporate Group calculates the credit risk adjustment by incorporating credit risk data provided by rating agencies and available in the financial markets.

e. Impaired loans measured at fair value

Cibest Corporate Group measured certain impaired loans based on the fair value of the associated collateral less costs to sell. The fair values were determined as follows using external and internal valuation techniques or third-party experts, depending on the type of underlying asset.

For vehicles under leasing arrangements, Cibest Corporate Group uses an internal valuation model based on price curves for each type of vehicle. Such curves show the expected price of the vehicle at different points in time based on the initial price and projection of economic variables such as inflation, devaluation, and customs. The prices modelled in the curves are compared every six months with market information for the same or similar vehicles and in the case of significant deviation; the curve is adjusted to reflect the market conditions.

Other vehicles are measured using matrix pricing from a third party. This matrix is used by most of the market participants and is updated monthly. The matrix is developed from values provided by several price providers for identical or similar vehicles and considers brand, characteristics of the vehicles, and manufacturing date among other variables to determine the prices.

For real estate assets, a third-party qualified appraiser is used. The methodologies vary depending on the date of the last appraisal available for the property (the appraisal is estimated based on either of three approaches: cost, sales comparison, and income approach, and is required every three years). When the property has been valued in the last 12 months and the market conditions have not shown significant changes, the most recent valuation is considered the fair value of the property.

For all other cases (for example, appraisals older than 12 months) the value of the property is updated by adjusting the value in the last appraisal for weighted factors such as location, type and characteristics of the property, size, structural conditions and the expected sales prices, among others. The factors are determined based on current market information gathered from several external real estate specialists. For all other cases (for example, appraisals older than 12 months) the value of the property is updated by adjusting the value in the last appraisal for weighted factors such as location, type and characteristics of the property, size, structural conditions, and the expected sales prices, among others. The factors are determined based on current market information gathered from several external real estate specialists.

f. Assets held for sale measured at fair value less cost of sale

F-168

Table of Contents

Cibest Corporate Group measures certain impaired foreclosed assets and premises and equipment held for sale based on fair value less costs to sell. The fair values were determined using external and internal valuation techniques, depending on the type of underlying asset. Those assets are comprised mainly of real estate properties for which the appraisal is conducted by experts considering factors such as the location, type and characteristics of the property, size, physical conditions and expected selling costs, among others. Likewise, in some cases fair value is estimated considering comparable prices or promises of sale and offering prices from auctions process.

Additionally, Cibest Corporate Group measured the discontinued operation Banistmo SA classified as held for sale based on fair value less costs to sell. See Note 1. Reporting Entity, Note 2.D12. Significant Accounting Policies - Assets Held for Sale and Discontinued Operations, and Note 31. Discontinued Operation.

g. Mortgage-backed securities (“TIPS”) and Asset-Backed securities

Cibest Corporate Group invests in asset-backed securities for which underlying assets are mortgages and earnings under contracts issued by financial institutions and corporations, respectively. Cibest Corporate Group does not have a significant exposure to sub-prime securities. The asset-backed securities are denominated in local market TIPS and are classified as fair value through profit or loss. These asset-backed securities have different maturities and are generally classified by credit ratings.

TIPS are part of Cibest Corporate Group portfolio and its fair value is measured using published price from the official pricing services provider. These securities are leveled by margin and are assigned to level 2 or 3 based on information provided by Precia.

Residual TIPS have their fair value measured using the discounted flow method, taking into account the amortization tables of the Titularizadora Colombiana, the betas in COP and UVR of Precia (used to construct the curves) and the margins; when they are residual TIPS of subordinated issues, a liquidity premium is applied. These securities are assigned to level 3.

h. Investments in associates measured at fair value

Cibest Corporate Group recognizes its investments in P.A Viva Malls, P.A Distrito Vera and Fideicomiso Locales Distrito Vera as associates at fair value. The estimated amount is provided by the fund manager as the variation of the units according to the units owned by the FCP Fondo Inmobiliario Colombia. The associate’s assets are comprised of investment properties which are measured using the following techniques: comparable prices, discounted cash flows, replacement cost and direct capitalization. For further information about techniques methodologies and inputs used by the external party see “Quantitative Information about Level 3 Fair Value Measurements”.

i. Investment property

Cibest Corporate Group’s investment property is valued by external experts, who use valuation techniques based on comparable prices, direct capitalization, discounted cash flows and replacement costs.

Assets and liabilities measured at fair value on a recurring basis

F-169

Table of Contents

The following table presents for each level of the fair value hierarchy levels the Cibest Corporate Group’s assets and liabilities measured at fair value on a recurring basis as of December 31, 2025, and 2024:

Financial Assets
Type of instrument		December 31, 2025(1)										December 31, 2024
	Fair value hierarchy						Total fair<br>value			Fair value hierarchy						Total fair<br>value
	Level 1		Level 2		Level 3			Level 1			Level 2		Level 3
In millions of COP
Investment securities
Debt instruments at fair value through profit or loss
Securities issued by the Colombian Government		10,176,528		2,436,729		2,423			12,615,680			10,625,153		1,019,028	-		11,644,181
Securities issued or secured by government entities		-		152,574		-			152,574			-		118,760	-		118,760
Securities issued by other financial institutions		206,151		550,010		69,173			825,334			140,703		513,040	77,821		731,564
Securities issued by foreign governments		6,350,052		3,426,269		-			9,776,321			6,191,395		4,092,055	-		10,283,450
Corporate bonds		4,247		55,511		29,713			89,471			124,812		98,255	34,259		257,326
Total debt instruments at fair value through profit or loss		16,736,978		6,621,093		101,309			23,459,380			17,082,063		5,841,138	112,080		23,035,281
Debt instruments at fair value through OCI
Securities issued by the Colombian Government		-		-		2,625,566			2,625,566			35,570		-	2,648,355		2,683,925
Securities issued by other financial institutions		-		63,624		-			63,624			119,479		107,614	49,744		276,837
Securities issued by foreign governments		-		-		-			-			368,736		1,115,810	-		1,484,546
Corporate bonds		-		349,647		512,511			862,158			60,922		747	577,439		639,108
Total debt instruments at fair value through OCI		-		413,271		3,138,077			3,551,348			584,707		1,224,171	3,275,538		5,084,416
Total debt instruments		16,736,978		7,034,364		3,239,386			27,010,728			17,666,770		7,065,309	3,387,618		28,119,697
Equity securities
Equity securities		50,909		624,781		787,932			1,463,622			31,086		262,351	717,873		1,011,310
Total equity securities		50,909		624,781		787,932			1,463,622			31,086		262,351	717,873		1,011,310
Other financial assets
Other financial assets		-		-		30,285			30,285			-		-	34,385		34,385
Total other financial assets		-		-		30,285			30,285			-		-	34,385		34,385
Derivative financial instruments
Forwards
Foreign exchange contracts		-		2,131,966		763,486			2,895,452			-		617,961	466,869		1,084,830
Equity contracts		-		34,367		24,773			59,140			-		298	51,347		51,645
Total forwards		-		2,166,333		788,259			2,954,592			-		618,259	518,216		1,136,475
Swaps
Foreign exchange contracts		-		905,862		162,878			1,068,740			-		1,200,777	262,479		1,463,256
Interest rate contracts		136,560		129,082		12,812			278,454			105,560		114,980	15,493		236,033
Total swaps		136,560		1,034,944		175,690			1,347,194			105,560		1,315,757	277,972		1,699,289
Options
Foreign exchange contracts		-		51,739		64,338			116,077			161		36,207	66,010		102,378
Total options		-		51,739		64,338			116,077			161		36,207	66,010		102,378
Total derivative financial instruments		136,560		3,253,016		1,028,287			4,417,863			105,721		1,970,223	862,198		2,938,142
Investment properties
Lands		-		-		563,185			563,185			-		-	499,833		499,833
Buildings		-		-		6,032,222			6,032,222			-		-	5,080,276		5,080,276
Total investment properties		-		-		6,595,407			6,595,407			-		-	5,580,109		5,580,109
Investment in associates at fair value
Investment in associates at fair value		-		-		2,041,402			2,041,402			-		-	1,830,884		1,830,884
Total investment in associates at fair value		-		-		2,041,402			2,041,402			-		-	1,830,884		1,830,884
Total		16,924,447		10,912,161		13,722,699			41,559,307			17,803,577		9,297,883	12,413,067		39,514,527

(1)The accumulated value as of December 31, 2025 includes the effects of the classification of Banistmo S.A. as an asset held for sale since December 18, 2025. For more information, see Note 1. Reporting Entity, Note 2.D12. Significant Accounting Policies - Assets Held for Sale and Discontinued Operations, and Note 31. Discontinued Operation.

F-170

Table of Contents

Financial liabilities
Type of instrument		December 31, 2025(1)										December 31, 2024
	Fair value hierarchy						Total fair<br>value			Fair value hierarchy						Total fair<br>value
	Level 1		Level 2		Level 3			Level 1			Level 2		Level 3
In millions of COP
Derivative financial instruments
Forwards
Foreign exchange contracts		-		1,514,575		1,205,024			2,719,599			-		885,520	86,775		972,295
Equity contracts		-		547		7,616			8,163			-		89	1,278		1,367
Total forwards		-		1,515,122		1,212,640			2,727,762			-		885,609	88,053		973,662
Swaps
Foreign exchange contracts		-		1,133,648		135,106			1,268,754			-		1,264,593	67,838		1,332,431
Interest rate contracts		135,242		161,742		74,195			371,179			102,701		160,721	27,646		291,068
Total swaps		135,242		1,295,390		209,301			1,639,933			102,701		1,425,314	95,484		1,623,499
Options
Foreign exchange contracts		224		36,466		110,245			146,935			421		82,061	-		82,482
Total options		224		36,466		110,245			146,935			421		82,061	-		82,482
Total derivative financial instruments		135,466		2,846,978		1,532,186			4,514,630			103,122		2,392,984	183,537		2,679,643
Total		135,466		2,846,978		1,532,186			4,514,630			103,122		2,392,984	183,537		2,679,643

(1)The accumulated value as of December 31, 2025 includes the effects of the classification of Banistmo S.A. as an asset held for sale since December 18, 2025. For more information, see Note 1. Reporting Entity, Note 2.D12. Significant Accounting Policies - Assets Held for Sale and Discontinued Operations, and Note 31. Discontinued Operation.

Fair value of assets and liabilities that are not measured at fair value in the Consolidated Statement of Financial Position

The following table presents for each of the fair-value hierarchy levels the Cibest Corporate Group’s assets and liabilities that are not measured at fair value in the Consolidated Statement of Financial Position, but for which the fair value is disclosed at December 31, 2025, and December 31, 2024:

Assets
Type of instrument		December 31, 2025(1)										December 31, 2024
	Fair value hierarchy						Total fair<br>value			Fair value hierarchy						Total fair<br>value
	Level 1		Level 2		Level 3			Level 1			Level 2		Level 3
In millions of COP
Debt instruments
Securities issued by the Colombian Government		141,524		-		-			141,524			156,209		-	-		156,209
Securities issued or secured by government entities		-		43,771		4,094,247			4,138,018			-		46,272	3,326,959		3,373,231
Securities issued by other financial institutions		129,128		93,521		52,231			274,880			284,281		57,091	250,508		591,880
Securities issued by foreign governments		189,057		150,587		-			339,644			412,579		227,076	-		639,655
Corporate bonds		642,074		9,623		290,721			942,418			1,050,588		14,017	2,578,160		3,642,765
Total – Debt instruments		1,101,783		297,502		4,437,199			5,836,484			1,903,657		344,456	6,155,627		8,403,740
Loans and advances to customers, net		-		-		275,626,425			275,626,425			-		-	269,345,583		269,345,583
Total		1,101,783		297,502		280,063,624			281,462,909			1,903,657		344,456	275,501,210		277,749,323

(1)The accumulated value as of December 31, 2025 includes the effects of the classification of Banistmo S.A. as an asset held for sale since December 18, 2025. For more information, see Note 1. Reporting Entity, Note 2.D12. Significant Accounting Policies - Assets Held for Sale and Discontinued Operations, and Note 31. Discontinued Operation.

F-171

Table of Contents

Liabilities
Type of instruments		December 31, 2025(1)										December 31, 2024
	Fair value hierarchy						Total fair<br>value			Fair value hierarchy						Total fair<br>value
	Level 1		Level 2		Level 3			Level 1			Level 2		Level 3
In millions of COP
Deposits by customers		-		64,471,127		200,482,783			264,953,910			-		60,894,992	218,568,020		279,463,012
Interbank deposits		-		-		30,102			30,102			-		-	716,493		716,493
Repurchase agreements and other similar secured borrowing		-		-		676,047			676,047			-		-	1,060,472		1,060,472
Borrowings from other financial institutions		-		-		9,356,428			9,356,428			-		-	15,689,532		15,689,532
Debt instruments in issue		5,030,129		1,372,155		1,225,259			7,627,543			5,811,412		2,669,991	2,908,095		11,389,498
Preferred shares		-		-		324,260			324,260			-		-	407,174		407,174
Total		5,030,129		65,843,282		212,094,879			282,968,290			5,811,412		63,564,983	239,349,786		308,726,181

(1)The accumulated value as of December 31, 2025 includes the effects of the classification of Banistmo S.A. as an asset held for sale since December 18, 2025. For more information, see Note 1. Reporting Entity, Note 2.D12. Significant Accounting Policies - Assets Held for Sale and Discontinued Operations, and Note 31. Discontinued Operation.

IFRS requires entities to disclose the fair value of financial instruments, both assets and liabilities recognized and not recognized in the Consolidated Statement of Financial Position, for which it is practicable to estimate fair value. Certain categories of assets and liabilities, however, are not eligible for fair value accounting. The financial instruments below are not measured at fair value on a recurring and nonrecurring basis:

Short-term financial instruments

Short-term financial instruments are valued at their carrying amounts included in the Consolidated Statement of Financial Position, which are reasonable estimates of fair value due to the relatively short period to maturity of the instruments. This approach was used for cash and cash equivalents, accrued interest receivable, customers’ acceptances, accounts receivable, accounts payable, accrued interest payable and Cibest Corporate Group acceptances outstanding.

Deposits from customers

The fair value of time deposits was estimated based on the discounted value of cash flows using the appropriate discount rate for the applicable maturity. The fair value of deposits with no contractual maturities represents the amount payable on demand as of the date of the Statement of Financial Position.

Interbank deposits and repurchase agreements and other similar secured borrowings

Short-term interbank borrowings and repurchase agreements have been valued at their carrying amounts because of their relatively short-term nature. Long-term and domestic development bank borrowings have also been valued at their carrying amount because they bear interest at variable rates.

Borrowings from other financial institutions

The fair value of borrowings from other financial institutions were determined by using discounted cash flow models. The cash flows projection of capital and interest was made according to the contractual terms, considering capital amortization and interest bearing. Subsequently, the cash flows were discounted using reference curves formed by the weighted average of the Cibest Corporate Group’s deposit rates.

Debt instruments in issue

The fair value of debt instruments in issue, comprised of bonds issued by Cibest Corporate Group, was estimated substantially based on quoted market prices. The fair value of certain bonds which do not have a public trading market, were determined based on the discounted value of cash flows using the rates currently offered for bonds of similar remaining maturities and Cibest Corporate Group’s creditworthiness.

F-172

Table of Contents

Preferred Shares

In the valuation of the liability component of Preferred Shares related to the minimum dividend of 1% of the subscription price, Cibest Corporate Group uses the Gordon Model to price the obligation, taking into account its own credit risk, which is measured using the market spread based on observable inputs such as quoted prices of sovereign debt. The Gordon Model is commonly used to determine the intrinsic value of a stock based on a future series of dividends that are estimated by Cibest Corporate Group and growth at a constant rate considering Cibest Corporate Group’s own perspectives of the payout ratio.

Loans and advances to customers

Estimating the fair value of loans and advances to customers is considered an area of considerable uncertainty as there is no observable market. The loan portfolio is stratified into tranches and loans segments such as commercial, consumer, small business loans, mortgage, and leasing. The fair value of loans and advances to customers and financial institutions is determined using a discounted cash flow methodology, considering each credit’s principal and interest projected cash flows to the prepayment date. The projected cash flows are discounted using reference curves according to the type of loan and its maturity date.

Items measured at fair value on a non-recurring basis

Cibest Corporate Group measured certain foreclosed assets held for sale, including the discontinued operation of Banistmo S.A., based on fair value less costs to sell. Fair values were determined using internal and external valuation techniques and third-party judgments, depending on the type of underlying asset. The following breakdown sets out the fair value hierarchy of assets classified by type:

	December 31, 2025					December 31, 2024
Type of instruments	Fair-value hierarchy			Total fair<br>value		Fair-value hierarchy					Total fair<br>value
	Level 1	Level 2	Level 3		Level 1		Level 2		Level 3
In millions of COP
Machinery and equipment	-	-	5,622	5,622		-		-		10,085	10,085
Real estate for residential purposes	-	-	4,584	4,584		-		-		133,863	133,863
Real estate different from residential properties	-	-	136	136		-		-		29,794	29,794
Discontinued operation	-	-	5,947,838	5,947,838		-		-		-	-
Total	-	-	5,958,180	5,958,180		-		-		173,742	173,742

(1)The accumulated value as of December 31, 2025 includes the effects of the classification of Banistmo S.A. as an asset held for sale since December 18, 2025. For more information, see Note 1. Reporting Entity, Note 2.D12. Significant Accounting Policies - Assets Held for Sale and Discontinued Operations, and Note 31. Discontinued Operation.

Changes in level 3 fair-value category

The table below presents reconciliation for all assets and liabilities measured at fair value on a recurring basis using significant unobservable inputs at December 31, 2025, and 2024:

F-173

Table of Contents

As of December 31, 2025

Type of instruments	Balance,<br><br>January 1,<br><br>2025	Included<br>in<br>earnings	OCI	Purchases	Settlement	Reclassifications(2)	Prepaids	Transfers<br>in to<br>level 3	Transfers<br>out of<br>level 3	Reclassification to assets held for sale(1)	Balance,<br><br>December 31,<br><br>2025(1)
In millions of COP
Assets
Debt instruments at fair value though profit or loss										-
Securities issued by the Colombian Government	-	149	-	2,274	-	-	-	-	-	-	2,423
Securities issued or secured by other financial entities	77,821	4,103	-	100	(8,499)	-	(4,800)	11,570	(11,122)	-	69,173
Corporate bonds	34,259	(25)	-	4,327	(18,591)	-	-	9,743	-	-	29,713
Total	112,080	4,227	-	6,701	(27,090)	-	(4,800)	21,313	(11,122)	-	101,309
Debt instruments at fair value through OCI
Securities issued by the Colombian Government	2,648,355	-	134,918	2,490,647	(2,648,354)	-	-	-	-	-	2,625,566
Securities issued or secured by other financial entities	49,744	-	-	-	-	-	-	-	(49,744)	-	-
Corporate bonds	577,439	-	(32,888)	-	-	-	-	-	(32,040)	-	512,511
Total	3,275,538	-	102,030	2,490,647	(2,648,354)	-	-	-	(81,784)	-	3,138,077
Derivative financial instruments
Foreign exchange contracts	795,358	113,321	-	855,487	(586,326)	(197,124)	-	13,035	-	(3,049)	990,702
Interest rate contracts	15,493	(3,322)	-	5,683	(2,432)	(626)	-	-	(1,984)	-	12,812
Equity contracts	51,347	-	-	24,773	(51,347)	-	-	-	-	-	24,773
Total	862,198	109,999	-	885,943	(640,105)	(197,750)	-	13,035	(1,984)	(3,049)	1,028,287
Equity securities
Equity securities	717,873	39,067	12,299	173,261	(65,923)	-	-	73,903	-	(162,548)	787,932
Total	717,873	39,067	12,299	173,261	(65,923)	-	-	73,903	-	(162,548)	787,932
Other financial instruments
Other financial instruments	34,385	(6,265)		15,145	(12,980)						30,285
Total	34,385	(6,265)	-	15,145	(12,980)	-	-	-	-	-	30,285
Investment in associates
P.A. Viva malls	1,817,503	173,053	-	-	-	-	-	-	-	-	1,990,556
P.A. Lote Palermo	-	310	-	36,992	(7)	-	-	-	-	-	37,295
P.A. Distrito Vera	13,325	2,341	-	-	(2,261)	-	-	-	-	-	13,405
Fideicomiso Locales Distrito Vera	56	(3)	-	93	-	-	-	-	-	-	146
Total	1,830,884	175,701	-	37,085	(2,268)	-	-	-	-	-	2,041,402
Total Assets	6,832,958	322,729	114,329	3,608,782	(3,396,720)	(197,750)	(4,800)	108,251	(94,890)	(165,597)	7,127,292
Liabilities
Derivative financial instruments
Foreign exchange contracts	154,613	214,520	-	1,322,057	(86,562)	(197,124)	-	42,898	-	(27)	1,450,375
Interest rate contracts	27,646	4,330	-	26,345	(3,863)	(626)	-	20,363	-	-	74,195
Equity contracts	1,278	-	-	7,616	(1,278)	-	-	-	-	-	7,616
Total	183,537	218,850	-	1,356,018	(91,703)	(197,750)	-	63,261	-	(27)	1,532,186
Total liabilities	183,537	218,850	-	1,356,018	(91,703)	(197,750)	-	63,261	-	(27)	1,532,186

(1)The accumulated value as of December 31, 2025, includes the effects of the classification of Banistmo S.A. as an asset held for sale since December 18, 2025. For more information, see Note 1. Reporting Entity, Note 2.D12. Significant Accounting Policies - Assets Held for Sale and Discontinued Operations, and Note 31. Discontinued Operation.

(2)From derivative assets to derivative liabilities classified in level 3 and vice versa..

F-174

Table of Contents

As of December 31, 2024

Type of instruments	Balance,<br><br>January 1,<br><br>2024	Included<br>in<br>earnings	OCI	Purchases	Settlement	Reclassifications(1)	Prepaids	Transfers<br>in to<br>level 3	Transfers<br>out of<br>level 3	Balance,<br>December 31,<br>2024
In millions of COP
Assets
Debt instruments at fair value though profit or loss
Securities issued or secured by other financial entities	78,729	2,042	-	14,696	(12,157)	-	(3,117)	3,195	(5,567)	77,821
Corporate bonds	14,284	538	-	2,994	-	-	-	16,443	-	34,259
Total	93,013	2,580	-	17,690	(12,157)	-	(3,117)	19,638	(5,567)	112,080
Debt instruments at fair value through OCI
Securities issued by the Colombian Government	2,664,295	-	157,708	2,490,647	(2,664,295)	-	-	-	-	2,648,355
Securities issued or secured by other financial entities	-	-	(272)	50,016	-	-	-	-	-	49,744
Corporate bonds	-	-	1,892	71,517	-	-	-	504,030	-	577,439
Total	2,664,295	-	159,328	2,612,180	(2,664,295)	-	-	504,030	-	3,275,538
Derivative financial instruments
Foreign exchange contracts	1,384,673	(45,870)	-	592,047	(1,193,801)	(11,487)	-	155,582	(85,786)	795,358
Interest rate contracts	15,621	(2,591)	-	6,910	(3,606)	(138)	-	3,909	(4,612)	15,493
Equity contracts	2,863	-	-	51,347	(2,863)	-	-	-	-	51,347
Total	1,403,157	(48,461)	-	650,304	(1,200,270)	(11,625)	-	159,491	(90,398)	862,198
Equity securities
Equity securities	384,682	48,562	50,303	261,301	(26,973)	-	-	-	(2)	717,873
Total	384,682	48,562	50,303	261,301	(26,973)	-	-	-	(2)	717,873
Other financial instruments
Other financial instruments	38,319	(5,646)	-	1,712	-	-	-	-	-	34,385
Total	38,319	(5,646)	-	1,712	-	-	-	-	-	34,385
Investment in associates
P.A. Viva Malls	1,661,679	155,824	-	-	-	-	-	-	-	1,817,503
P.A. Distrito Vera	9,103	(401)	-	5,186	(563)	-	-	-	-	13,325
Fideicomiso Locales Distrito Vera	-	(5)	-	61	-	-	-	-	-	56
Total	1,670,782	155,418	-	5,247	(563)	-	-	-	-	1,830,884
Total Assets	6,254,248	152,453	209,631	3,548,434	(3,904,258)	(11,625)	(3,117)	683,159	(95,967)	6,832,958
Liabilities
Derivative financial instruments
Foreign exchange contracts	170,798	48,127	-	114,156	(95,051)	(11,487)	-	3,194	(75,124)	154,613
Interest rate contracts	11,078	(50)	-	206	(4,595)	(138)	-	27,432	(6,287)	27,646
Equity contracts	1,852	-	-	1,278	(1,852)	-	-	-	-	1,278
Total	183,728	48,077	-	115,640	(101,498)	(11,625)	-	30,626	(81,411)	183,537
Total liabilities	183,728	48,077	-	115,640	(101,498)	(11,625)	-	30,626	(81,411)	183,537

(1)From derivative assets to derivative liabilities classified in level 3 and vice versa.

Level 3 fair value rollforward

The following were the significant level 3 transfers at December 31, 2025, and 2024:

As of December 31, 2025, and 2024, net transfers in Cibest Corporate Group for COP 1,984 and COP 8,987, respectively, from level 3 to level 2 of derivatives foreign exchange contracts and interest rate contracts, it was presented due to the

F-175

Table of Contents

transfer of the credit risk of the counterparty to the own credit risk. As of December 31, 2025, and 2024, net transfers for COP (50,226) and COP 128,865, respectively, from level 2 to level 3 of the derivative foreign exchange contracts and interest rate contracts, it was presented due to the transfer of the credit risk from Cibest Corporate Group to the credit risk of the counterparty.

As of December 31, 2025, and 2024, there are corporate bonds of debt instruments at fair value through OCI for COP 512,511 and 577,439, respectively.

As of December 31, 2025, and 2024, unrealized gains and losses on debt instruments were COP 4,227 and COP 2,580; equity securities COP 39,067 and COP 48,562, respectively.

Transfers between level 1 and level 2 of the fair value hierarchy

The table below presents the transfers for all assets and liabilities measured at fair value on a recurring basis between level 1 and level 2 as of December 31, 2025, and 2024:

	December 31, 2025		December 31, 2024
Type of instruments	Transfers level 1<br>to level 2	Transfers level<br>2 to level 1	Transfers level<br>1 to level 2	Transfers level<br>2 to level 1
In millions of COP
Debt instruments at fair value though profit or loss
Securities issued by the Colombian Government	36,039	-	202,779	-
Securities issued or secured by foreign government	-	-	26,866	929
Total	36,039	-	229,645	929
Debt instruments at fair value through OCI
Securities issued or secured by foreign government	-	-	467,133	137,884
Total	-	-	467,133	137,884
Equity securities
Equity securities	2	10,018	63,827	-
Total	2	10,018	63,827	-

As of December 31, 2025, Cibest Corporate Group transferred securities from level 1 to level 2, because such securities had lower liquidity and lower trading in an active market.

All transfers are assumed to occur at the end of the reporting period.

Quantitative information about level 3 fair value measurements

The fair value of financial instruments is, in certain circumstances, measured using valuation techniques that incorporate assumptions that are not evidenced by prices from observable market transactions in the same instrument and are not based on observable market data. Changing one or more of the inputs to the valuation models to reasonably possible alternative assumptions would change the fair values and therefore a valuation adjustment would be recognized in profit or loss. Favorable and unfavorable changes are determined on the basis of changes in the value of the instrument as a result of varying the levels of the unobservable input as described in the table below.

The following table sets forth information about significant unobservable inputs related to Cibest Corporate Group’s material categories of level 3 financial assets and liabilities and the sensitivity of these fair values to reasonably possible alternative assumptions.

F-176

Table of Contents

As of December 31, 2025

Type of instruments		Fair Value	Valuation<br>technique		Significant<br>unobservable input		Range of<br>inputs		Weighted<br>average			Sensitivity<br>100<br>basis point<br>increase	Sensitivity<br>100<br>basis point<br>decrease
In millions of COP
Debt instruments
Securities issued by other financial institutions
TIPS		64,125	Discounted cash flow		Yield		0.14% to 10.31%		3.06		%	62,752	65,538
	Prepayment Speed			n/a		n/a		67,024		n/a
	Prepayment Speed			n/a		n/a		63,704		n/a
Other bonds		5,048	Discounted cash flow		Interest rate		0.32% to 1.10%		0.71		%	5,002	5,094
Total securities issued by other financial institutions		69,173
Securities issued by the Colombian Government
Bonds by government entities		2,627,989	Discounted cash flow		Interest rate		0.50% to 0.50%		0.50		%	2,619,101	2,640,019
Corporate bonds
Corporate bonds		542,224	Discounted cash flow		Yield		-0.16% to 5.02%		2.43		%	497,386	559,495
Total debt instruments		3,239,386
Equity securities
Equity securities		787,932	Price-based		Price		n/a		n/a			n/a	n/a
Other financial instruments
Other financial instruments		30,285	Internal valuation methodology		Internal valuation methodology		n/a		n/a			n/a	n/a
Derivative financial instruments
Forward		(424,381)	Discounted cash flow		Credit spread / Yield		0.00% to 17.10%		(0.24		%)	(417,068)	(424,265)
Swaps		(33,611)	Discounted cash flow		Credit spread		0.00% to 7.47%		0.61		%	(50,216)	(28,748)
Options		(45,907)	Discounted cash flow		Credit spread		0.01% to 2.13%		0.34		%	(45,481)	(46,050)
Total derivative financial instruments		(503,899)
Investment in associates
P.A. Viva Malls		1,990,556	Price-based		Price		n/a		n/a			n/a	n/a
P.A. Lote Palermo		37,295	Price-based		Price		n/a		n/a			n/a	n/a
P.A. Distrito Vera		13,405	Price-based		Price		n/a		n/a			n/a	n/a
Fideicomiso Locales Distrito Vera		146	Price-based		Price		n/a		n/a			n/a	n/a
Total investment in associates		2,041,402

F-177

Table of Contents

As of December 31, 2024

Type of instruments	Fair Value	Valuation<br>technique	Significant<br>unobservable input	Range of<br>inputs	Weighted<br>average		Sensitivity<br>100<br>basis point<br>increase	Sensitivity<br>100<br>basis point<br>decrease
In millions of COP
Debt instruments
Securities issued by other financial institutions
			Yield	0.14% to 10.66%	3.61	%	61,474	65,164
TIPS	63,280	Discounted cash flow	Prepayment Speed	n/a	n/a		65,081	n/a
			Prepayment Speed	n/a	n/a		60,732	n/a
Other bonds	62,558	Discounted cash flow	Interest rate	0.10% to 1.12%	0.94	%	61,003	64,177
Time deposits	1,727	Discounted cash flow	Yield / Interest rate	0.91% to 6.40%	3.36	%	1,441	1,772
Total securities issued by other financial institutions	127,565
Securities issued by the Colombian Government
Bonds by government entities	2,648,355	Discounted cash flow	Yield	1.18% to 1.18%	1.18	%	2,639,349	2,660,301
Corporate bonds
Corporate bonds	611,698	Discounted cash flow	Yield	0.00% to 5.25%	0.98	%	573,929	647,264
Total debt instruments	3,387,618
Equity securities
Equity securities	717,873	Price-based	Price	n/a	n/a		n/a	n/a
Other financial instruments
Other financial instruments	34,385	Internal valuation methodology	Internal valuation methodology	n/a	n/a		n/a	n/a
Derivative financial instruments
Forward	430,163	Discounted cash flow	Credit spread / Interest rate	0.00% to 20.80%	7.05	%	429,581	430,753
Swaps	182,488	Discounted cash flow	Credit spread	0.00% to 56.14%	4.03	%	166,650	204,677
Options	66,010	Discounted cash flow	Credit spread	0.12% to 34.75%	0.50	%	65,512	66,242
Total derivative financial instruments	678,661
Investment in associates
P.A. Viva Malls	1,817,503	Price-based	Price	n/a	n/a		n/a	n/a
P.A. Distrito Vera	13,325	Price-based	Price	n/a	n/a		n/a	n/a
Fideicomiso Locales Distrito Vera	56	Price-based	Price	n/a	n/a		n/a	n/a
Total investment in associates	1,830,884

F-178

Table of Contents

The following table sets forth information about valuation techniques used in the measurement of the fair value investment properties of Cibest Corporate Group, the significant unobservable inputs, and the respective sensitivity:

Methodology	Valuation technique	Significant unobservable input	Description of sensitivity
Sales Comparison Approach - SCA<br><br>The fair value assessment is based on the examination of prices at which similar properties in the same area recently sold. Since no two properties are identical the measurement valuation must take into account adjustments for the differences between the sold properties and those held by Cibest Corporate Group to earn rentals or for capital appreciation.	Comparable prices	The weighted average rates used in the capitalization methodology for revenues in the last quarter for 2025 are:<br><br>•Direct capitalization: initial rate 8.03%.<br><br>•Discounted cash flow: discount rate: 12.12%, terminal rate: 8.17%.<br><br>The same weighted rates for the last quarter of 2024 were:<br><br>•Direct capitalization: initial rate 8.13%<br><br>•Discounted cash flow: discount rate: 12.27%, terminal rate: 8.29%.<br><br>The ratio between monthly gross income and real estate value directly administered by the FIC (rental rate) considering the differences in placements and individual factors between properties and in a weighted way in the last quarter of 2025 are 0.80%, and for December 31, 2024 was 0.88%.	An increase (light, normal, considerable, significant) in the capitalization rate used would generate a decrease (significant, considerable, normal, light) in the fair value of the asset, and vice versa.<br><br>An increase (light, normal, considerable, significant) in the leases used in the valuation would generate a (significant, light, considerable) increase in the fair value of the asset, and vice versa.
Income Approach<br><br>Used to estimate the fair value of the property by taking future net cash flows and discounting them at the capitalization rate.	Direct capitalization<br><br>Discounted cash flows
Cost approach<br><br>Used to estimate the fair value of the property by considering the cost to replace or construct a property under the same or similar conditions as the asset being measured, deducting accumulated depreciation and adding the land amount.	Replacement cost

There has been no change to the valuation technique during the year 2025 for each asset.

F-179

Table of Contents

NOTE 31. DISCONTINUED OPERATION

Banistmo S.A. is a private financial entity that began operations in 1973 and is one of Cibest Corporate Group financial entities located in the Republic of Panama, after being acquired in October 2013. Banistmo has positioned itself as one of the leading banks in Panama, offering a wide variety of financial services under the supervision of the Superintendency of Banks of Panama.

On December 18, 2025, Cibest disclosed to the market the execution of a promise-to-purchase agreement for shares with Inversiones Cuscatlán Centroamérica S.A. to sell 100% of the shares of Banistmo S.A. The agreed sale price was USD 1,418,000 (subject to customary adjustments at the closing date).

Banistmo S.A. has been part of the ' Banking Panama' operating segment, contributing significantly to the Panamanian market as a provider of financial solutions for both individuals and companies, including digital banking services, savings and checking accounts, personal and corporate loans, mortgages, credit cards, insurance and payment services.

This divestment is part of a long-term corporate strategy aimed at optimizing Cibest Corporate Group’s portfolio, focusing its growth on strategic markets, and maximizing value creation for its shareholders.

Assets classified as held for sale in accordance with IFRS 5, see Note 2.D12. Significant accounting policies – Assets held for sale and discontinued operations.

As of December 31, 2025, Banistmo S.A. consisted of the assets and liabilities presented below:

STATEMENT OF FINANCIAL POSITION

As of December 31, 2025

(Stated in millions of Colombian pesos)

	December 31, 2025
ASSETS
Cash and cash equivalents	3,517,759
Financial assets investments and derivative financial instruments	6,364,505
Loans and advances to customers	28,853,418
Allowance for loans, advances and lease losses	(1,420,269)
Loans and advances to customers, net	27,433,149
Assets held for sale and inventories, net	124,660
Premises and equipment, net	90,536
Right-of-use assets, lease	192,114
Goodwill and intangible assets, net	230,516
Deferred tax, net	403,993
Other assets, net	1,952,025
TOTAL ASSETS	40,309,257
LIABILITIES
Deposits by customers	27,293,518
Interbank deposits and repurchase agreements and other similar secured borrowing	910,189
Derivative financial instruments	19,379
Borrowings from other financial institutions	1,755,502
Debt instruments in issue	3,429,730
Other liabilities	1,008,366
TOTAL LIABILITIES	34,416,684
TOTAL NET ASSETS	5,892,573

F-180

Table of Contents

Analysis of profit for the year from discontinued operation

The results of the discontinued operation included in profit for the year are presented below. Comparative profits and cash flows of the discontinued operation have been restated to include those operations classified as discontinued in the current year.

A) Profit for the year from discontinued operation

STATEMENT OF INCOME

For the years ended December 31, 2025, 2024 and 2023

(Stated in millions of Colombian pesos)

	2025	2024	2023
Total interest and valuation on financial instruments
Interest on loans	2,103,723	2,283,112	2,415,234
Interest income on overnight and market funds	89,068	78,365	94,162
Interest and valuation on financial instruments	353,881	328,428	317,162
Total interest and valuation on financial instruments	2,546,672	2,689,905	2,826,558
Interest expenses	(1,241,640)	(1,336,251)	(1,238,112)
Net interest margin and valuation on financial instruments before impairment on loans , off balance sheet credit instruments and other financial instruments	1,305,032	1,353,654	1,588,446
Credit impairment charges on loans and advances , net	(161,369)	(456,748)	(270,501)
Net interest margin and valuation on financial instruments after impairment on loans and off balance sheet credit instruments and other financial instruments	1,143,663	896,906	1,317,945
Total fees and commissions, net	257,453	275,934	274,028
Other operating income	24,905	65,875	36,938
Dividends and net income on equity investments	8,561	11,474	13,499
Goodwill impairment(1)	(5,022,822)	-	-
Operating expenses	(909,939)	(982,520)	(1,017,555)
(Loss) / Profit before tax	(4,498,179)	267,669	624,855
Income tax(2)	1,491,539	(12,484)	(112,262)
Net (Loss) / income	(3,006,640)	255,185	512,593

(1) The impairment recognized in goodwill corresponds to the loss in value determined in the period in connection with the sale of Banistmo S.A., the cash-generating unit (CGU) to which such goodwill had been allocated. In accordance with the applicable standard, goodwill was classified as an intangible asset with an indefinite useful life and was therefore not amortized and was subject to impairment testing semiannually or when there were additional indications of impairment. In prior annual analyses, the calculated value in use exceeded the carrying amount, and therefore there was no impairment to recognize. However, the agreed sale price in the transaction constitutes new observable evidence establishing a fair value lower than the CGU’s carrying amount, generating an impairment loss for the period in accordance with IFRS requirements. See Note 2.D12. Significant accounting policies – Assets held for sale and discontinued operations; Note 2.D13. Significant accounting policies – Impairment of assets, cash-generating units and Note 12. Intangibles and goodwill, net.

(2) Includes Deferred tax of discontinued operations for COP 1,567,226. See Note 13. Income Tax.

B) Cash flows of the discontinued operation

STATEMENT OF CASH FLOW

For the years ended December 31, 2025, 2024 and 2023

(Stated in millions of Colombian pesos)

	2025	2024	2023
Net cash (used in)/provided by operating activities	(1,575)	149,484	(161,011)
Net cash (used in)/provided by investing activities	(181,508)	1,057,511	459,293
Net cash provided by/(used in) financing activities	401,060	(1,596,844)	(720,155)
Net change in cash and cash equivalents	217,977	(389,849)	(421,873)

F-181

Table of Contents

C) The loan portfolio of Banistmo S.A. designated as assets held for sale is composed as follows, as of December 31, 2025:

Loan portfolio designated as assets held for sale (by maturity)

As of December 31, 2025

Maturity	Less than 1 year	Between 1 and 5 years	Between 5 and 15 years	More than 15 years	Total
In millions of COP
COMMERCIAL
Corporate	5,071,736	5,478,286	1,257,424	-	11,807,446
SMEs	734,065	545,543	164,460	5,255	1,449,323
Total Commercial	5,805,801	6,023,829	1,421,884	5,255	13,256,769
CONSUMER
Credit cards	259,842	644,128	535	-	904,505
Vehicle	4,450	282,297	570,912	426	858,085
Payroll-deducted loans	11,881	336,325	2,069,195	529,454	2,946,855
Other	31,347	96,379	79,833	440	207,999
Total Consumer	307,520	1,359,129	2,720,475	530,320	4,917,444
MORTGAGE
Low-income Mortgage (VIS)	-	517	37,291	4,270,596	4,308,404
Non-VIS	4,397	85,976	743,170	4,233,488	5,067,031
Total Mortgage	4,397	86,493	780,461	8,504,084	9,375,435
FINANCIAL LEASING
Commercial leasing	47,085	389,000	5,822	-	441,907
Consumer leasing	2,345	37,860	11,165	-	51,370
Total financial leasing	49,430	426,860	16,987	-	493,277
SMALL BUSINESS LOANS
Microcredit	220,725	370,914	202,932	15,921	810,492
Total Small Business Loans	220,725	370,914	202,932	15,921	810,492
Total	6,387,873	8,267,225	5,142,739	9,055,580	28,853,417

Loan concentration by days past due

As of December 31, 2025

	Past-due
Period	0-30 days	31-90 days	91-120 days	121-360 days	More than 360 days	Total
In millions of COP
Commercial	11,844,958	99,581	5,374	359,769	947,087	13,256,769
Consumer	4,681,654	121,926	37,424	72,840	3,600	4,917,444
Mortgage	8,461,617	387,479	90,538	192,496	243,305	9,375,435
Financial leasing	472,732	2,791	195	13,674	3,885	493,277
Small Business Loans	725,035	27,535	1,213	23,940	32,769	810,492
Total	26,185,996	639,312	134,744	662,719	1,230,646	28,853,417

Maximum exposure to credit risk

As of December 31, 2025

Stage 1	Stage 2	Stage 3	Total

F-182

Table of Contents

In millions of COP
Commercial	10,125,423	1,012,057	2,119,289	13,256,769
Consumer	4,259,825	480,784	176,835	4,917,444
Mortgage	7,744,580	1,185,493	445,362	9,375,435
Financial leasing	449,408	17,860	26,009	493,277
Small Business Loans	630,534	120,440	59,518	810,492
Total customer loan portfolio	23,209,770	2,816,634	2,827,013	28,853,417
Allowance for loans, advances and lease losses	(137,198)	(232,330)	(1,050,742)	(1,420,270)
Total Net loans and advances to customers	23,072,572	2,584,304	1,776,271	27,433,147

D) Customer deposits of Banistmo S.A. classified as liabilities held for sale are as follows as of December 31, 2025:

Deposits from customers designated as liabilities held for sale

As of December 31, 2025

Deposits from customers	December 31, 2025
In millions of COP
Time deposits	16,875,344
Savings accounts	6,225,850
Checking accounts	4,106,875
Other deposits	85,449
Total deposits by customers	27,293,518

F-183

Table of Contents

NOTE 32. SUBSEQUENT EVENTS

Approval of Consolidated Financial Statements

The financial statements were authorized for issue by the Board of Directors on February 23, 2026.

On March 31, 2026, the board of directors of the Central Bank decided to increase the policy rate by 100 basis points, from 10.25% to 11.25%, in response to the persistence of inflationary pressures and the deterioration of macroeconomic balances.

On February 11, 2026, the Colombian government issued Legislative Decree No. 150, pursuant to which it declared a State of Economic, Social, and Ecological Emergency in certain departments of Colombia. Subsequently, on February 24, 2026, the government enacted Decree No. 173, which established, as a temporary tax measure for the 2026 fiscal year, a net worth tax applicable to Colombian legal entities that are taxpayers of the corporate income tax as of March 1, 2026. The general tax rate is 0.5% applied to net equity, while a special rate of 1.6% applies to financial institutions, brokerage firms, and other entities operating in certain specific sectors.

On January 30, 2026, the board of directors of the Central Bank decided to increase the policy rate by 100 basis points, from 9.25% to 10.25%, in response to the persistence of inflationary pressures and the deterioration of macroeconomic balances.

On January 29, 2026, the Constitutional Court of Colombia ordered the provisional suspension of Legislative Decree 1474 of 2025 while it carries out its constitutionality review. This decree established temporary tax measures applicable to fiscal year 2026 within the framework of the State of Economic Emergency.

As of December 31, 2025, Decree 1474 of 2025 was fully in force and, consequently, Cibest Corporate Group recognized its effects in the determination of income tax and the measurement of deferred tax (see Note 13. Income Tax).

The subsequent suspension does not provide evidence of conditions that existed at the reporting date, and the Decree has not been fully repealed, as it remains subject to the Court’s substantive review. Therefore, this event does not result in modifications to the amounts recognized as of December 31, 2025. However, it is disclosed due to its relevance for users of the financial statements.

F-184

Table of Contents

RISK MANAGEMENT

During 2025, the global economy showed a relatively favorable performance, despite the materialization of various risks stemming from the tariff and immigration policies promoted by the President of the United States. This environment was accompanied by a gradual and prudent easing of the Federal Reserve’s restrictive monetary policy stance, in a context marked by inflationary pressures resulting from rising tariffs, the persistence of geopolitical conflicts particularly between Russia and Ukraine and in the Middle East and the deterioration of fiscal conditions in most economies worldwide. Taken together, these factors increased uncertainty regarding the evolution of macroeconomic indicators and generated greater volatility in the prices of financial assets in international markets. At the same time, the level of political stability played a decisive role in investor confidence, in governments’ ability to implement stimulus policies, and ultimately in the dynamics of economic growth.

Considering the environment and the markets in which it operates, the development of the risk function and the supporting structure is aligned with the nature, size, complexity, and diversity of the activities carried out by the entities of Cibest Corporate Group.

F-185

Table of Contents

Credit risk

Credit risk is the possibility that Cibest Corporate Group incurs losses and that the value of its assets decreases as a result of a debtor or counterparty failing to meet their obligations.

The information below contains the maximum exposure to credit risk for the periods ending December 31, 2025 and 2024:

The maximum exposure to credit risk of the loans and advances decreases in 2025 due to the classification of Banistmo as a discontinued operation.

December 31, 2025

Maximum exposure to credit risk - Financial instruments subject to impairment
In millions of COP
	Stage 1	Stage 2	Stage 3	Total
Loans and Advances	230,529,201	13,291,069	12,533,711	256,353,981
Commercial	128,900,017	3,789,022	6,938,883	139,627,922
Consumer	45,368,880	4,597,424	2,787,242	52,753,546
Mortgage	31,451,240	1,551,976	1,413,156	34,416,372
Small Business Loans	885,674	120,330	57,008	1,063,012
Financial Leases	23,923,390	3,232,317	1,337,422	28,493,129
Off-Balance Sheet Exposures	45,080,299	398,436	439,419	45,918,154
Financial Guarantees	6,385,687	16,589	152,549	6,554,825
Loan Commitments	38,694,612	381,847	286,870	39,363,329
Loss Allowance	(2,126,247)	(2,321,812)	(9,043,389)	(13,491,448)
Total	273,483,253	11,367,693	3,929,741	288,780,687

December 31, 2024

Maximum exposure to credit risk - Financial instruments subject to impairment
In millions of COP
	Stage 1	Stage 2	Stage 3	Total
Loans and Advances	245,272,297	16,670,291	17,511,320	279,453,908
Commercial	137,761,467	5,545,788	9,945,556	153,252,811
Consumer	46,697,013	5,118,607	4,000,063	55,815,683
Mortgage	37,076,580	2,701,930	1,963,091	41,741,601
Small Business Loans	1,175,803	91,256	85,150	1,352,209
Financial Leases	22,561,434	3,212,710	1,517,460	27,291,604
Off-Balance Sheet Exposures	43,604,372	223,317	256,249	44,083,938
Financial Guarantees	9,926,719	17,800	199,782	10,144,301
Loan Commitments	33,677,653	205,517	56,467	33,939,637
Loss Allowance	(2,331,035)	(2,752,141)	(11,397,984)	(16,481,160)
Total	286,545,634	14,141,467	6,369,585	307,056,686

(1) The informational disclosed value of loan commitments has been updated.

F-186

Table of Contents

Other Financial Instruments

Maximum Exposure to Credit Risk - Other Financial Instruments
In millions of COP
	Maximum Exposure		Collateral		Net Exposure
	2025	2024	2025	2024	2025	2024
Maximum Exposure to Credit Risk
Debt instruments	32,840,048	36,583,512	(2,529,186)	(1,669,011)	30,310,862	34,914,501
Derivatives	1,308,744	929,498	(726,801)	(589,098)	581,943	340,400
Equity	1,463,622	1,011,310	-	-	1,463,622	1,011,310
Other financial instruments	30,285	34,385	-	-	30,285	34,385
Total	35,642,699	38,558,705	(3,255,987)	(2,258,109)	32,386,712	36,300,596
Note: Collateral Held (-) and Collateral Pledged (+)

Maximum exposure to credit risk of the loans and advances refers to the carrying amount at the end of the period. It does not take into account any collateral received or any other credit risk mitigants.

Maximum exposure to credit risk of financial guarantees an loan commitments corresponds to the total amount guaranteed at the end of the period. It does not take into account any collateral received or any other credit risk mitigants.

Maximum exposure to derivatives refers to the fair value at the end of the period, without considering any guarantee received or any other credit risk mitigants.

Maximum exposure to credit risk of debt instruments and equity securities refers to the carrying amount at the end of the period without considering any guarantee received.

Credit Risk Management - Loans and Advances

During 2025, the Colombian economy showed a gradual and moderate recovery, supported by limited improvements in economic activity, labor market conditions, and a partial rebound in investment. This performance occurred in a context of still‑restrictive monetary policy, although with gradual reductions in the intervention rate compared to 2024, which allowed for partial relief in financial conditions and a slight reactivation of credit, mainly in the commercial and consumer segments. Nonetheless, the high fiscal deficit and the increase in public debt continued to pressure sovereign risk perception and limit fiscal policy space, within an international environment characterized by higher volatility and geopolitical tensions.

At the regional level, Guatemala maintained a flexible monetary policy during 2025, with low interest rates that were gradually reduced, facilitating access to credit and stimulating domestic consumption in a context supported by strong remittance inflows and contained inflation. Panama showed an improvement in financial conditions compared to 2024, with relatively stable interest rates and a gradual recovery in credit, in line with the rebound in economic activity following the normalization of Canal operations and the dynamism of the services and logistics sectors. In contrast, El Salvador recorded more restrictive credit conditions, with high interest rates in the context of fiscal consolidation, which limited credit expansion; however, greater strength in the economic and financial sectors was observed, as well as a reduction in sovereign risk, supported by improved security conditions and the positive performance of remittances.

In a highly competitive financial market and an environment of uncertainty, Cibest Corporate Group prioritized decisions within the credit cycle that contribute to maintaining a stable risk profile for the portfolio, through continuous improvement of the processes, models, and methodologies used in all stages of the credit cycle. Our management is based on agile and predictive responsiveness to changes in the economic environment, enabling us to proactively adjust risk appetite and protect Cibest Corporate Group’s financial health. As a result, portfolio risk indicators improved, and we delivered more effective support to our clients.

Risk management associated with the different types of credit exposures undertaken by the entities of Cibest Corporate Group is managed in accordance with Cibest Corporate Group’s Credit Risk Management Framework, which sets out the corporate definitions and the overarching criteria for the assessment, measurement, monitoring, control, and mitigation of credit risk. Furthermore, Management has implemented policies, guidelines, and methodologies across the entire credit life cycle that operationalize the credit‑risk strategy approved by the Board of Directors for the oversight and control of credit risk.

F-187

Table of Contents

To maintain credit quality and manage the risk arising from its lending activities, Cibest Corporate Group has established general loan policies, including the following:

•Credit exposure limits: Contains guidelines with regards to the establishment of credit exposure limits. This is set as a result of legal requirements and according to Cibest Corporate Group’s internal guidelines.

•Origination policies: These policies aim to acquire ample and sufficient knowledge of the characteristics of current and potential borrowers and to select them properly. The risk level of the individual and legal entities is determined using rating and scoring models which define cut-off points that are applied in the process of issuing credit. These models use information such as customer behavior, sociodemographic conditions, credit history, transactional activity with Cibest Corporate Group, the type of business the borrower engages in, the borrower’s ability to repay the loan, and information received from the credit risk bureaus. In addition, sectorial and macroeconomic behavior is taken into account.

•Collaterals policies: For the purpose of mitigating risk associated with non-fulfillment of obligations agreed upon by the borrower, Cibest Corporate Group has established policies for the valuation of collateral received as well as for the determination of the maximum loan amount that can be granted against the value of the collateral.

•Allowance policies: The objective of this policy is to fulfill legal requirements and Cibest Corporate Group’s business policies. In addition, this policy is meant to provide the guidelines to analyze the client’s status and take the necessary actions in order to mitigate credit risk to which Cibest Corporate Group is exposed. For further information, please see Note 2. Material Accounting Policies.

•Monitoring policies: Contains various monitoring procedures, portfolio reports and policies for the purpose of overseeing, in an adequate and timely manner, the evolution of credit risk. These procedures include a continuous process of classification and reassessment of credit operations and they maintain consistency with the policies implemented for granting loans.

•Portfolio recovery policies: Through these policies, Cibest Corporate Group aims to establish those mechanisms that allow it to anticipate the action to be taken in the event of possible delays and minimize the impact resulting from non-fulfillment of payment or delays by the borrower. Additionally, the aspects established in this policy delimit what Cibest Corporate Group has defined as collection management and that make it possible to obtain information to improve the origination policies and the allowances for loans and advances and lease losses models. The established actions are combined with strategies to adjust to the economy, market and costumer conditions, allowing Cibest Corporate Group to offer alternatives tailored to each case, such as payment deals, foreclosed assets, cession agreements, modifications, restructuring, and so on.

Management of credit risk is carried out through all the credit life cycle. These stages are defined in the following way:

•Origination: Knowing the borrower, payment capacity analysis, payment behavior and credit approval and structure.

•Monitoring: Knowing the borrower’s situation during the life of the credit.

•Recovery: Collection management during the different stages of the same credit.

To support the credit origination processes, models, methodologies, and analytical techniques based on statistical information and expert criteria are used. Their purpose is to evaluate and differentiate the risk level of potential and current clients, thus facilitating informed decision-making. These models are mainly applied during the granting stage and also play a fundamental role in monitoring, by allowing the tracking of the client's evolution, and in recovery, by facilitating the implementation of risk mitigation and portfolio recovery strategies. Continuous monitoring of the client's evolution is carried out, which allows for the timely detection of credit deterioration and proactive risk management throughout the credit lifecycle. Additionally, strategies and mechanisms based on quantitative variables and objective criteria analysis are implemented to optimize collection management, reduce expected losses, and minimize the impact of defaults on the portfolio.

The Corporate Risk Vice Presidency is responsible for defining and documenting the specific characteristics of the models, methodologies, and analytical techniques employed. It has the authority to develop mathematical and expert formulas, as well as to establish key parameters according to market conditions, the product, and the risk appetite framework approved by the Board of Directors. The models may include variables of different natures, such as sociodemographic, sectoral as well as internal and external behavior, financial information related to investment, savings, and transactions, in addition to market studies and product-specific parameters. The adequate performance of the models

F-188

Table of Contents

is ensured, measured through their discriminative capacity, understood as the model's ability to differentiate between clients with different levels of risk.

In accordance with international risk‑management standards, backtesting tests are conducted on the models used in credit cycle management. The results of these tests are presented periodically to the Risk Committee and the Board of Directors for their information. Additionally, the Corporate Risk Vice Presidency establishes, issues internal circulars that establish the guidelines for the assignment and ongoing maintenance of internal credit ratings.

Monthly, the credit portfolio is rated using internal models that allow for the assessment of the credit risk of each debtor and the determination of the required provisions. These models are regularly updated to reflect changes in market conditions and ensure their accuracy and relevance. The monthly provisions allow for the assessment of risk collectively or individually, using parameters such as Probability of Default (PD), Loss Given Default (LGD), and Exposure at Default (EAD). For more details, see Note 2. Material Accounting Policies, section 4.1.2.

Individual analysis is applied to clients in stage 3 with significant balances and to corporate clients who recover from default and move to stage 2. This analysis is based on the projection of each client's cash flow, considering parameters associated with recovery rates estimated by models that incorporate financial information, behavior, collateral, and qualitative variables. Periodically, backtesting tests are conducted on these provisioning models to ensure an adequate level of coverage aligned with Cibest Corporate Group 's risk appetite.

To manage concentration risk, Cibest Corporate Group, conducts continuous monitoring of risk groups and supervises their corresponding exposures, ensuring adherence to both regulatory lending limits and those established by Management. Analytical tools are used to identify clients or sectors with elevated concentration risk and to implement diversification strategies aimed at mitigating potential adverse impacts. Methodologically, Cibest Corporate Group relies on international benchmarks defined by external credit rating agencies, enabling the assessment of concentration across different geographies. From a regulatory standpoint, Cibest Corporate Group adheres to the concepts and methodologies established in applicable external regulations.

The following classifications are established for the analysis of concentration:

•By country: Based on the country where the loans were originated.

•By sector: According to the sectorial sub-segmentation defined by Cibest Corporate Group based mainly on the code CIIU1.

•By categories: According to the portfolio category of each agreement (commercial, financial leases, consumer loans, small business loans and mortgages).

•By economic group: According to the characteristics of economic groups as established by regulations.

•By maturity: According to the remaining term to loan maturity.

•By past due days: This concentration evaluates loans that are more than one month overdue.

1 CIIU: International Standard Industrial Classification of All Economic Activities.

Country Risk2

Cibest Corporate Group credit risk management framework includes country risk management, which refers to the possibility that an entity may incur losses on financial transactions abroad due to a deterioration in the economic and/or socio-political conditions of the country receiving such transactions, either due to limitations on currency transfers or factors not attributable to the commercial and financial condition of the country receiving the transaction. This definition includes, among others, sovereign risk (SR) and transfer risk (TR) associated with such factors.

This framework has guidelines, processes, and methodologies that allow for the periodic assessment of the country risk to which it is exposed in its capital investments, understanding capital investments to be those made in jurisdictions other than Colombia that are economically relevant individually or in aggregate by country, and whose purpose is permanent. This management includes the stages of identification, measurement, control, and monitoring of the country risk to which the Group is exposed.

F-189

Table of Contents

The definition of capital investment appetite integrates the assessment of country risk, aligning with the Corporate Group's Risk Appetite Framework to ensure consistency with Cibest Corporate Group's financial strength.

For the year ended December 2025, compared to December 2024, no alerts associated with country risk were identified in the investments subject to this analysis. Likewise, no downgrades were observed in the country risk ratings of the countries where Cibest Corporate Group maintains investments.

During 2025, within the portfolio subject to country risk assessment, a reallocation of investing entities was recorded. The value of the investments decreased compared to 2024, mainly due to the appreciation of the colombian peso against the U.S. dollar and the distribution of dividends. These effects were partially offset by the profits generated during the year.

Additionally, as of December year‑end, Banistmo is considered a discontinued operation. For this reason, both Banistmo and its related investments were excluded from Cibest Corporate Group subject to country risk evaluation. For further detail, see Note 31 — Discontinued Operation.

Overall, the results for the period do not indicate adverse changes in the country risk profile of the portfolio, and the observed variations are primarily attributable to market effects and strategic decisions.

2 Nequi, Renting, Wenia, Wompi, Bancolombia Puerto Rico, Banca de Inversión Bancolombia and its subsidiaries have no investments subject to country risk review at the time of analysis.

a.Credit Quality Analysis - Loans and Financial Leases

Rating System for Credit Risk Management

The principal aim of this rating system is to determine the risk profile of the borrower, which is obtained through a rating.

The rating of the corporate portfolio is primarily conducted through a Rating model, based on the analysis of the interrelation of quantitative variables and objective criteria, which allow for determining the probability of default that may affect the fulfillment of the financial commitments acquired by a client. The rating model is applied from the origination and is periodically updated, incorporating determinants of credit risk, which can be summarized as the client's financial performance measured through financial figures and payment capacity, payment behavior both with Cibest Corporate Group and with other entities in the financial sector as well as transactional information of the client within Cibest Corporate Group as alternative variables.Taken together, this approach ensures a comprehensive and up‑to‑date view of risk, enhancing decision making and the proactive management of the portfolio.

In the case of a retail customer, granting and behavior scoring models are used in order to identify the level of risk associated with the borrower. These models include information such as personal details, financial information and transactional, historical behavior, the total number of credit products and external information from credit bureaus.

Description of Loans and Financial Leases

In order to evaluate and manage credit risk, the credits and financial leasing operations have been classified as:

•Commercial and Financial Leases:

Loans granted to individuals or companies in order to carry out organized economic activities and are not classified as small business loans.

F-190

Table of Contents

The borrowers in this portfolio are mainly made up of companies, segmented in homogenous groups that are constituted according to size, annual sales or main activity. The following variables are part of this classification:

Segment	Incomes/Sales
Corporate	Companies with consolidated annual sales by economic group >= COP 250,000M. Banistmo places borrowers with annual sales >= USD10M. BAM place borrowers with annual sales >= USD25M. Banco Agricola place borrowers with annual sales >= USD30M.
Business	Companies with consolidated annual sales by economic group > = COP 14,500M and < COP 250,000M. For Banco Agricola borrowers with annual sales >= USD7M y < USD30M and BAM, with annual sales >= USD5M and < USD25M
Commercial	For BAM, companies with annual sales >= USD2M y < USD5M.
Business Construction	Constructors who dedicate themselves professionally to the construction of buildings to be sold or rented as their main activity, with consolidated annual sales by economic group >= COP 58,000M and <= COP 200,000M or commercial size > = COP 15,000M and < COP 70,000M, or project size >= COP 500,000M and < COP 2.2 trillion.
Corporate Construction	Constructors who dedicate themselves to the construction of buildings to be sold or rented as their main activity, with consolidated annual sales by economic group > COP 200,000M or commercial size > = COP 70,000M or project size >=COP 2.2 trillion
SME Construction	Constructors who dedicate themselves professionally to the construction of buildings to be sold or rented as their main activity with consolidated annual sales by economic group >= COP 380M and <= COP 58,000M or commercial size < COP 15,000M or project size < COP 500,000M.
Institutional Financing	Financial sector institutions.
Government	Central government entities within the Corporate segment, as well as territorial entities that qualify under the public‑conglomerate model based on the variables analyzed (income level, investment, and population).
SME	Annual sales < COP 14,500M, with a classification between small, medium, large and plus except for Banistmo which places borrowers < USD10M in annual sales. For Banco Agrícola, borrowers with annual sales < USD7M and BAM, borrowers with annual sales < USD2M.

•Consumer:

Loans and advances, regardless of amount, granted to individuals for the purchase of consumer goods or to pay for non-commercial or business services. These loans are classified as follows:

Classification
Vehicles	Credits granted for the acquisition of vehicles and motorcycles. The vehicle financed is used as collateral for the loan.
Credit cards	Revolving credit limits for the acquisition of consumer goods, utilized by means of a plastic card, a virtual card or a token in digital wallets.
Payroll loans	It is a credit line attached to an authorized individual payroll and pension amount.
Other loans	Loans granted for the acquisition of consumer goods other than vehicles and Payroll loans Credit cards are not included in this segment.

The counterparties in this portfolio are mainly individuals, segmented in homogenous groups, which are formed according to their size, which is calculated by their monthly income.

•Mortgage:

These are loans, regardless of amount, granted to individuals for the purchase of a new or used house, commercial real estate or construction of a home. These loans include loans denominated in local units or local currency that are guaranteed by a senior mortgage on the property and that are financed with a total repayment term of 5 to 30 years.

The counterparties in the mortgage portfolio are mainly made up of individuals segmented in homogenous groups, which are formed according to their size, which is calculated by their monthly income.

•Small Business Loans:

F-191

Table of Contents

Productive credits are those constituted by credit operations carried out with individuals for the development of economic activities in rural and urban areas issued for the purpose of encouraging the activities of small business and are subject to the following requirements in Colombia: (i) their indebtedness with all entities cannot exceed 120 minimum wages (excluding mortgage obligations for housing financing); (ii) the client's total assets, excluding mortgage assets, are less than 500 minimum wages.

The borrowers in this portfolio are mainly individuals, segmented in homogenous groups, which are formed according to their commercial size, which is calculated by their monthly income.

Analysis of the behavior and impairment of the loan portfolio and financial lease operations

The analysis presented below for Cibest Corporate Group is based on a comparison with the information reported by Grupo Bancolombia as of December 31, 2024.

As of December 31, 2025, Cibest Corporate Group total loan portfolio, valued in Colombian pesos, registered an decrease of 8.3% compared to December 2024. This reduction was largely driven by the classification of the asset group of subsidiary Banistmo S.A. as held for sale (see Note 31 – Discontinued Operation), in addition to the impact of the depreciation of the U.S. dollar against the peso, which reduced the peso denominated value of the portfolios of the Central American subsidiaries. However, despite these factors, growth was observed in the corporate and consumer loan portfolios at Bancolombia and Banco Agrícola, as well as in the mortgage portfolio in Colombia, driven by a gradual and moderate recovery in commercial activity across all countries where Cibest Corporate Group operates. The 30-day past due loan ratio (consolidated) showed a reduction, standing at 3.95% in December 2025 compared to 5.20% in December 2024, mainly explained by the improvement in the quality of the consumer portfolio. This improvement reflects a strengthening in portfolio quality, mainly driven by the recovery of the consumer loan portfolio across all regions, as well as the favorable performance of the mortgage portfolio in Colombia. During the period, different strategies were developed throughout the credit cycle, allowing for the implementation of proactive and coherent actions in line with the reality of the clients and their environment, in order to contain deterioration and place them in better risk profiles:

•Commercial loans and financial leases amounted to COP 168.12 trillion, which represented a decrease of 6.9% compared to 2024. The 30-day past due loan ratio was 3.06% compared to 3.77% as of December 2024.

•Consumer loans amounted to COP 52.75 trillion, which represented a decrease of 5.5% compared to 2024. The 30-day past due loan ratio was 5.59% compared to 7.92% as of December 2024.

•Mortgage loans totaled to COP 34.42 trillion, which represented a decrease of 17.5% compared to 2024. The 30-day past due loan ratio was 5.67% compared to 7.62% as of December 2024.

•Small Business loans ended at COP 1.06 trillion, which represented a decrease of 21.4% with respect to 2024. The 30-day past due loan ratio was 8.23% compared to 8.11% as of December 2024.

In order to monitor credit risk associated with clients, Cibest Corporate Group Consolidated has established regular monitoring performed by the AEC Committee to identify events that can lead to a reduction in borrowers’ ability to pay. Generally, clients with good credit behavior could be included in the watch list in case of detecting any event that can lead to future financial difficulties to repay their loans; for instance, internal factors such as the economic activity and sector, financial weakness, impacts of macroeconomic conditions, changes in corporate governance and other situations that could affect clients’ business. The amount and allowance of clients included in the described watch list, as of December 31, 2025 and 2024 is shown below:

December 2025:

Watch List December 31, 2025
In millions of COP
Risk Level	Amount	%		Allowance
Level 1 – Low Risk	11,243,787	0.61	%	68,609
Level 2 – Medium Risk	3,242,865	7.19	%	233,252
Level 3 – High Risk	2,084,682	59.12	%	1,232,457
Level 4 – High Risk DOC (1)	4,602,690	72.27	%	3,326,436
Total	21,174,024	22.96	%	4,860,754

F-192

Table of Contents

(1) DOC: Origination and Collections Department.

December 2024:

Watch List December 31, 2024
In millions of COP
Risk Level	Amount	%		Allowance
Level 1 – Low Risk	14,081,182	0.72	%	101,994
Level 2 – Medium Risk	5,708,673	6.50	%	370,892
Level 3 – High Risk	3,811,886	53.84	%	2,052,135
Level 4 – High Risk DOC (1)	5,948,366	61.67	%	3,668,615
Total	29,550,107	20.96	%	6,193,636

(1) DOC: Origination and Collections Department.

Loans and Financial Leases Collateral

Collateral refers to the support provided by clients that enables Cibest Corporate Group to mitigate credit risk, as it serves as an alternative source for the repayment of granted loans in the event of client default. Such collateral is considered eligible and adequate when it meets the following conditions:

•Its fair value was established according to technical and objective criteria.

•Its provide Cibest Corporate Group with a legally effective privilege for the payment of the guaranteed obligation.

•Its performance is reasonably possible.

Cibest Corporate Group has defined the criteria for collateral enforceability, which are established according to the classification of the loan portfolio. In addition, Cibest Corporate Group has set guidelines to value collateral and the frequency of such valuations, as well as those guidelines related to the legalization, registry and maintenance of the collateral. Likewise, Cibest Corporate Group has defined the criteria for insurability, custody and the necessary procedures for their cancellation.

The update of the fair value of mortgages and vehicles collaterals for the loan portfolio is made at least once a year. The methodology used to estimate the fair value of the properties is applied by external and independent entities. Updating the fair value of the vehicles is done through guides and valid values commonly used as reference to set the value of a vehicle. The fair value of real state and vehicles are classified in levels 2 and 3 depending on the observability and significance of the inputs used in the valuation techniques according to the hierarchy established by IFRS 13.

To determine the suitability of appraiser’s selection, there are internal guidelines to be fulfilled related to independence, professional certification, reputation and experience. In a similar way, to validate the appraisal´s suitability, Cibest Corporate Group has defined guidelines based on current regulations which are related to methodologies, report quality and commercial value.

During the reporting period, Cibest Corporate Group’s collateral policies have not changed significantly in relation to the way collateral is held and its overall quality.

F-193

Table of Contents

The information included in the table discloses the nature of the collateral and the balances covered by it for the loan portfolio and financial leasing operations classified under the commercial, consumer, microcredit, and housing modalities for the periods ended December 31, 2025 and 2024:

December 31, 2025
In Millions of COP
Amount Covered by Collateral
Nature of the Collateral	Commercial	Consumer	Mortgage	Financial<br>Leasing	Small<br>Business	Total
Real Estate and Residential	17,856,646	1,565,026	31,026,884	93	13,887	50,462,536
Goods Given in Real Estate Leasing	-	-	174	17,725,642	-	17,725,816
Goods Given in Leasing Other Than Real Estate	-	120	-	7,927,066	-	7,927,186
Stand by Letters of Credit	1,459,362	-	-	-	-	1,459,362
Security Deposits	63,833	7,775	-	-	—	71,608
Guarantee Fund	3,607,654	3,175	-	33,154	553,423	4,197,406
Sovereign of the Nation	-	-	-	-	-	-
Collection Rights	10,054,510	105,181	-	-	—	10,159,691
Other Collateral (Pledges)	2,189,669	6,781,902	20,639	169	106	8,992,485
Without Guarantee (Uncovered Balance)	104,396,248	44,290,367	3,368,675	2,807,005	495,596	155,357,891
Total loans and financial leases	139,627,922	52,753,546	34,416,372	28,493,129	1,063,012	256,353,981		December 31, 2024
---	---	---	---	---	---	---
In Millions of COP
Amount Covered by Collateral
Nature of the Collateral	Commercial	Consumer	Mortgage	Financial<br>Leasing	Small<br><br>Business	Total
Real Estate and Residential	25,163,297	1,816,374	39,092,440	39	363,465	66,435,615
Goods Given in Real Estate Leasing	-	-	183	17,382,691	-	17,382,874
Goods Given in Leasing Other Than Real Estate	-	32	-	8,181,007	-	8,181,039
Stand by Letters of Credit	1,540,179	-	-	-	-	1,540,179
Security Deposits	1,398,254	326,722	-	-	139,481	1,864,457
Guarantee Fund	3,653,583	37	-	45,720	251,827	3,951,167
Sovereign of the Nation	-	-	-	-	-	-
Collection Rights	7,757,578	109,946	-	-	—	7,867,524
Other Collateral (Pledges)	3,688,378	8,039,811	30,223	280	6,209	11,764,901
Without Guarantee (Uncovered Balance)	110,051,542	45,522,761	2,618,755	1,681,867	591,227	160,466,152
Total loans and financial leases	153,252,811	55,815,683	41,741,601	27,291,604	1,352,209	279,453,908

F-194

Table of Contents

Cibest Corporate Group monitors the collateral associated with financial assets classified in Stage 3, as it is more likely to take possession of such collateral to mitigate potential credit losses. The following table presents financial assets classified in Stage 3 and the related collateral held to mitigate potential losses for the periods ended December 31, 2025 and 2024:

December 31, 2025
In Millions of COP
Classification	Amount	Allowance	Total	Fair Value of Collateral
Commercial	682,168	369,786	312,382	1,523,549
Consumer
Mortgage	—	—	—	—
Small Business Loans
Financial Leases	549,569	295,354	254,215	885,925
Total credit assets	1,231,737	665,140	566,597	2,409,475		December 31, 2024
---	---	---	---	---
In Millions of COP
Classification	Amount	Allowance	Total	Fair Value of Collateral
Commercial	783,435	372,156	411,279	1,660,829
Consumer
Mortgage	616,432	143,894	472,538	762,652
Small Business Loans
Financial Leases	761,892	327,257	434,635	1,305,365
Total credit assets	2,161,759	843,307	1,318,452	3,728,846

A portion of Cibest Corporate Group’s financial assets originated by the mortgage and commercial business has sufficiently low ‘loan to value’ (LTV) ratios, which results in no loss allowance being recognized in accordance with Cibest Corporate Group’s expected credit loss model. The carrying amount of such financial assets is and COP 60,688 as at 31 December 2024 and COP 273,574 as at December 31, 2025.

Foreclosed assets and other credit mitigants

Assets received in lieu of payment (foreclosed assets) are recognized on the statement of financial position when current possession of the asset takes place.

Foreclosed assets such as immovable and movable property, equity securities and other financial assets, are received based on a commercial valuation, and their net realizable value is given by a specialized team.

During the years ended December 31, 2025 and 2024, Cibest Corporate Group entered into non-cash operating and investing activities related to restructured loans and returned properties that were transferred to assets held for sale and inventories amounting to COP 1,251,021 and COP 1,408,331 , respectively.

Cibest Corporate Group classifies foreclosed assets after acknowledgment of the exchange operation according to the intention of use, as follows:

•Non-current assets held for sale.

•Other marketable assets.

•Other non-marketable assets.

•Inventories.

Foreclosed assets classified as non-current assets held for sale are those expected to be sold within the next 12 months. Non-current assets held for sale that no longer meet the immediate sale guidelines must be reclassified as “Other marketable assets”. If the updated fair value less costs to sell is lower than the carrying amount, the latter must be adjusted and an impairment loss recognized in the income statement for the same period.

F-195

Table of Contents

b.Risk Concentration – Loans and Advances

Cibest Corporate Group performs its credit risk concentration analysis by monitoring the loan portfolio through groupings such as modality, maturity, days past due, economic sector, country, and economic group, as shown below:

•Loans concentration by category

The composition of the credit portfolio in commercial, consumer, mortgage, financial leases and small business loans categories for the periods ending on December 31, 2025 and 2024, it is as follows:

Composition	2025	2024
In millions of COP
Commercial	139,627,922	153,252,811
Corporate	76,006,958	85,278,293
SME	13,856,981	15,203,496
Others	49,763,983	52,771,022
Consumer	52,753,546	55,815,683
Credit card	12,483,919	11,992,511
Vehicle	4,795,970	5,635,858
Payroll loans	6,834,747	10,381,247
Others	28,638,910	27,806,067
Mortgage	34,416,372	41,741,601
VIS	13,173,508	16,183,280
Non- VIS	21,242,864	25,558,321
Financial Leases	28,493,129	27,291,604
Small Business Loans	1,063,012	1,352,209
Loans and advances to customers and financial institutions	256,353,981	279,453,908
Allowance for loans and advances and lease losses	(13,253,946)	(16,179,738)
Total net loan and financial leases	243,100,035	263,274,170

VIS: Social Interest Homes, corresponds to mortgage loans granted by the financial institutions of amounts less than 135 minimum wages.

•Concentration of loan by maturity

The following table shows the ranges of maturity for the credit loans and financial leases, according for the remaining term for the completion of the contract of loans and financial leases at the end of December 2025 and 2024:

December 31, 2025
In millions of COP
Maturity	Less Than 1 Year	Between 1 and 5<br>Years	Between 5 and 15<br>Years	Greater Than 15<br>Years	Total
Commercial	37,701,890	59,704,817	39,337,022	2,884,193	139,627,922
Corporate	20,753,064	33,460,016	19,965,253	1,828,625	76,006,958
SME	4,070,363	8,539,793	1,060,389	186,436	13,856,981
Others	12,878,463	17,705,008	18,311,380	869,132	49,763,983
Consumer	5,393,052	34,827,883	12,296,414	236,197	52,753,546
Credit card	39,952	10,351,902	2,088,614	3,451	12,483,919
Vehicle	136,130	2,704,055	1,955,420	365	4,795,970
Order of payment	2,209,043	1,812,470	2,800,720	12,514	6,834,747
Others	3,007,927	19,959,456	5,451,660	219,867	28,638,910
Mortgage	820,792	983,691	10,696,429	21,915,460	34,416,372
VIS	19,358	300,678	3,002,419	9,851,053	13,173,508

F-196

Table of Contents

December 31, 2025
In millions of COP
Maturity	Less Than 1 Year	Between 1 and 5<br>Years	Between 5 and 15<br>Years	Greater Than 15<br>Years	Total
Commercial	37,701,890	59,704,817	39,337,022	2,884,193	139,627,922
Non-VIS	801,434	683,013	7,694,010	12,064,407	21,242,864
Financial Leases	2,283,462	8,690,954	13,328,370	4,190,343	28,493,129
Small business loans	53,098	987,314	20,720	1,880	1,063,012
Total gross loans and financial leases	46,252,294	105,194,659	75,678,955	29,228,073	256,353,981		December 31, 2024
---	---	---	---	---	---
In millions of COP
Maturity	Less Than 1 Year	Between 1 and 5<br>Years	Between 5 and 15<br>Years	Greater Than 15<br>Years	Total
Commercial	48,186,159	62,610,478	41,614,622	841,552	153,252,811
Corporate	29,076,028	32,243,275	23,454,114	504,876	85,278,293
SME	4,771,087	8,555,996	1,727,911	148,502	15,203,496
Others	14,339,044	21,811,207	16,432,597	188,174	52,771,022
Consumer	1,267,269	34,216,968	19,553,651	777,795	55,815,683
Credit card	234,325	9,587,518	2,170,668	-	11,992,511
Vehicle	81,066	3,270,554	2,283,873	365	5,635,858
Order of payment	47,981	2,261,874	7,525,578	545,814	10,381,247
Others	903,897	19,097,022	7,573,532	231,616	27,806,067
Mortgage	79,304	1,095,329	10,509,429	30,057,539	41,741,601
VIS	14,439	284,872	2,540,655	13,343,314	16,183,280
Non-VIS	64,865	810,457	7,968,774	16,714,225	25,558,321
Financial Leases	1,804,964	8,586,693	13,202,556	3,697,391	27,291,604
Small business loans	194,013	919,392	208,405	30,399	1,352,209
Total gross loans and financial leases	51,531,709	107,428,860	85,088,663	35,404,676	279,453,908

•Concentration by past due days

The following table shows the loans and financial leases according to past due days for the periods ending on December 31, 2025 and 2024. Loans or financial leases are considered past due if it is more than one month overdue (i.e. 31 days):

December 31, 2025
In millions of COP
Past-due
Period	0 - 30 Days	31 - 90 Days	91 - 120 Days	121 - 360 Days	More Than 360<br>Days	Total
Commercial	135,330,887	426,990	156,363	869,610	2,844,072	139,627,922
Consumer	49,805,549	1,224,406	407,456	1,100,716	215,419	52,753,546
Mortgage	32,463,354	646,147	166,300	477,855	662,716	34,416,372
Financial Leases	27,648,328	211,469	39,547	179,284	414,501	28,493,129
Small Business Loans	975,530	37,438	12,584	31,764	5,696	1,063,012
Total	246,223,648	2,546,450	782,250	2,659,229	4,142,404	256,353,981		December 31, 2024
---
In millions of COP

F-197

Table of Contents

Past-due
Period	0 - 30 Days	31 - 90 Days	91 - 120 Days	121 - 360 Days	More Than 360<br>Days	Total
Commercial	147,402,632	531,609	280,750	1,515,324	3,522,496	153,252,811
Consumer	51,393,527	1,761,496	624,945	1,776,361	259,354	55,815,683
Mortgage	38,560,253	1,184,755	285,466	830,743	880,384	41,741,601
Financial Leases	26,331,118	247,056	58,435	273,619	381,376	27,291,604
Small Business Loans	1,242,568	36,196	8,848	45,608	18,989	1,352,209
Total	264,930,098	3,761,112	1,258,444	4,441,655	5,062,599	279,453,908

•Concentration of loans by economic sector

The following table contains the detail of the portfolio of loans and financial leases by main economic activity of the borrower for the periods ending on December 31, 2025 and 2024:

December 31, 2025
In millions of COP
Economic sector	Loans and advances
	Local	Foreign	Total
Agriculture	5,065,174	1,454,157	6,519,331
Petroleum and Mining Products	2,130,531	357,951	2,488,482
Food, Beverages and Tobacco	8,825,753	1,892,783	10,718,536
Chemical Production	5,016,379	327,950	5,344,329
Government	12,277,316	8,399	12,285,715
Construction	12,668,236	6,276,866	18,945,102
Commerce and Tourism	27,512,932	4,127,906	31,640,838
Transport and Communications	12,508,329	306,414	12,814,743
Public Services	14,642,893	1,273,641	15,916,534
Consumer Services	69,086,088	16,617,819	85,703,907
Commercial Services	35,957,673	4,211,895	40,169,568
Other Industries and Manufactured Products	9,469,462	4,337,434	13,806,896
Total	215,160,766	41,193,215	256,353,981

F-198

Table of Contents

December 31, 2024
In millions of COP
Economic sector	Loans and advances
	Local	Foreign	Total
Agriculture	5,520,414	2,813,604	8,334,018
Petroleum and Mining Products	2,126,602	636,010	2,762,612
Food, Beverages and Tobacco	10,132,520	2,164,911	12,297,431
Chemical Production	4,507,362	364,649	4,872,011
Government	10,256,608	627,705	10,884,313
Construction	14,441,608	9,134,115	23,575,723
Commerce and Tourism	24,920,337	8,480,380	33,400,717
Transport and Communications	12,313,907	597,216	12,911,123
Public Services	13,253,631	1,265,243	14,518,874
Consumer Services	61,263,015	35,692,512	96,955,527
Commercial Services	30,662,353	13,347,867	44,010,220
Other Industries and Manufactured Products	9,671,905	5,259,434	14,931,339
Total	199,070,262	80,383,646	279,453,908

•Credit concentration by country

The following information shows the concentration of the loans and financial leases by country in which Cibest Corporate Group are located as of December 31, 2025 and 2024:

December 31, 2025
In millions of COP
Country	Loans and advances	% Participation		Allowance for loans and<br>advances and lease losses	% Participation
Colombia	207,855,500	81.08	%	(11,624,277)	87.70%
Panamá	11,012,553	4.30	%	(233,360)	1.76%
El Salvador	17,740,830	6.92	%	(557,515)	4.21%
Guatemala	18,335,468	7.15	%	(836,623)	6.31%
Puerto Rico	1,409,630	0.55	%	(2,171)	0.02%
Total	256,353,981	100.00	%	(13,253,946)	100.00%		December 31, 2024
---	---	---	---	---	---
In millions of COP
Country	Loans and advances	% Participation		Allowance for loans and<br>advances and lease losses	% Participation
Colombia	190,956,423	68.33	%	(12,490,991)	77.20%
Panamá	47,300,183	16.93	%	(2,089,269)	12.91%
El Salvador	18,712,218	6.70	%	(598,710)	3.70%
Guatemala	21,125,637	7.56	%	(995,339)	6.15%
Puerto Rico	1,359,447	0.49	%	(5,429)	0.03%
Total	279,453,908	100.00	%	(16,179,738)	100.00%

•Credit concentration by economic group

As of December 31, 2025 and 2024, concentration of the 20 largest economic groups amounted to COP 46,024,580 and COP 39,877,880 respectively. This exposure corresponds to all credit active operations of Cibest Corporate Group.

F-199

Table of Contents

c.Credit quality – Loans and Advances

The following information about credit quality of the borrower for the periods ending December 31, 2025 and 2024:

December 31, 2025
In millions of COP
Classification	Stage 1	Stage 2	Stage 3	Total
Commercial	128,900,017	3,789,022	6,938,883	139,627,922
Consumer	45,368,880	4,597,424	2,787,242	52,753,546
Mortgage	31,451,240	1,551,976	1,413,156	34,416,372
Small Business Loans	885,674	120,330	57,008	1,063,012
Financial Leases	23,923,390	3,232,317	1,337,422	28,493,129
Loans and Advances	230,529,201	13,291,069	12,533,711	256,353,981		December 31, 2024
---	---	---	---	---
In millions of COP
Classification	Stage 1	Stage 2	Stage 3	Total
Commercial	137,761,467	5,545,788	9,945,556	153,252,811
Consumer	46,697,013	5,118,607	4,000,063	55,815,683
Mortgage	37,076,580	2,701,930	1,963,091	41,741,601
Small Business Loans	1,175,803	91,256	85,150	1,352,209
Financial Leases	22,561,434	3,212,710	1,517,460	27,291,604
Loans and Advances	245,272,297	16,670,291	17,511,320	279,453,908

In order to determine the expected credit loss, Cibest Corporate Group considers the economic conditions and performance of the borrower’s industry, the analysis of payments behavior, events that could negatively affect the borrower’s ability to pay, among others factors.

The expected credit loss is determined either by a collective or individual evaluation according to the amount and characteristics of the loan. For further details please see Note 2 Significant Accounting Policies, section 4.1.2 Impairment of financial assets at amortized cost or at fair value through other comprehensive income “FVOCI”.

Sensitivity analysis

The variables with the greatest influence for each country on the expected credit loss (ECL) assessment for the loan portfolio and financial leasing are:

Colombia:

•Gross domestic product: due to its effects on employment and wages, and consequently on consumption.

•Interest rate: due to its direct impact on the repayment capacity of borrowers.

Panama:

•Gross domestic product: due to its effects on employment and wages, and consequently on consumption.

•10-year U.S. treasury yield: due to its impact on the demand for goods and services.

El Salvador:

•Gross domestic product: due to its effects on employment and wages, and consequently on consumption.

•Current account balance: due to its effect on import costs.

Guatemala:

•Gross domestic product: due to its effects on employment and wages, and consequently on consumption.

•Current account balance: due to its effect on import costs.

F-200

Table of Contents

The change in the expected credit losses (ECL) at 31 of December 2025, as a result of a possible positive or negative 1% (100 basis points) change in those variables were assessed based on the assumptions used to calculate the ECL for each of the scenarios: base, optimistic and pessimistic, as following:

Interest Rate – Current Account Balance - 10-year U.S. Treasury Yield
In Millions of COP
		[+1%]	Unchanged	[-1%]
	[+1%]	(2,871)	-63,930	-114,007
GDP	Unchanged	61,059	-	-50,077
	[-1%]	125,375	64,316	14,239

Cibest Corporate Group has estimated the impact on the expected credit loss (ECL) assuming the forward-looking scenarios (e.g. optimistic and pessimistic) were weighted 100% instead of applying scenario probability weights across the two scenarios. The table below shows the impact on the expected credit loss (ECL) for each methodology:

Expected credit loss by scenarios
In millions of COP
	2025		2024
Methodologies	Optimistic	Pessimistic	Optimistic	Pessimistic
Collective methodology	(322,851)	276,985	(435,740)	368,782
Collateral methodology	(166,770)	223,091	(155,591)	173,438
Individual methodology(1)	(444,920)	609,748	(408,368)	763,362
Total	(934,541)	1,109,824	(999,699)	1,305,582

(1) For individual methodology, the applied scenarios are the base in the optimistic scenario and the alternative in the pessimistic scenario with a weighting of 100% each.

d.Credit Risk Management – Other Financial Instruments:

Each one of the positions that make up the portfolio complies with the policies and limits that seek to diminish credit risk exposure. Those policies are, among others:

•Term Limits: The Credit Committee evaluates and reviews the result of the authorized model for the different counterparties according to quantitative and qualitative variables, allowing it to establish the maximum term to which Cibest Corporate Group wishes to have exposure.

•Credit Limits: Approved limits under the model and with authorization from the Credit Committee, as well as the exposure, are monitored in line or batch, in such a way as to mitigate the occurrence of excesses and, in the event that there is a need for them, applies to the current attribution system.

•Counterparty Limits: These limits, derived from the credit limits or from allocation models and are verified by the Front Office prior to the close of operations.

•Master Agreement: These bilateral agreements describe the handling of operations between the counterparties in accordance with good international practices and that limit the legal and financial risk under the occurrence of events of default (failure to pay or delivery). Mitigation mechanisms, procedures to be carried out in the case of these events of default, special conditions by type of operation and that are applied to OTC derivatives, Repos and other securities financing transactions, are all agreed upon.

•Margin Agreements: For OTC derivatives operations and other securities financing transactions, agreements that regulate the administration of guarantees, haircuts, adjustment periods, minimum transfer amounts, etc., and that limit risk for a period of time (one day, one week, etc.), are established for counterparties involved in the operation.

F-201

Table of Contents

•Counterparty Alerts: There are financial, qualitative and market indicators that allow Cibest Corporate Group to establish damages to the credit quality of an issuer or counterparty.

e.Credit Quality Analysis - investment financial instruments:

In order to evaluate the credit quality of a counterparty or issuer (to determine a risk level or profile), Cibest Corporate Group relies on two rating systems: an external one and an internal one, both of which allow to identify a degree of risk differentiated by segment and country and to apply the policies that have been established for issuers or counterparties with different levels of risk, in order to limit the impact on liquidity and/or the income statement of Cibest Corporate Group.

External credit rating system is divided by the type of rating applied to each instrument or issuer; in this way the geographic location, the term and the type of instrument allow the assignment of a rating according to the methodology that each examining agency uses.

Internal credit rating system: the “ratings or risk profiles” scale is created with a range of levels that go from low risk to high risk (this can be reported in numerical or alphanumerical scales), where the rating model is sustained by the implementation and analysis of qualitative variables and objectives criteria, which according to the relative analysis of each variable, determine credit quality; in this way the internal credit rating system aims to establish adequate margin in decision-making regarding the management of financial instruments.

In accordance with the criteria and considerations specified in the internal rating allocation and external credit rating systems methodologies, the following schemes of relation can be established, according to credit quality given to each one of the qualification scales:

Low Risk: All investment grade positions (from AAA to BBB-), as well as those issuers that according to the information available (financial statements, relevant information, external ratings, CDS, among others) reflect adequate credit quality.

Medium Risk: All speculative grade positions (from BB+ to BB-), as well as those issuers that according to the available information (Financial statements, relevant information, external qualifications, CDS, among others) reflect weaknesses that could affect their financial situation in the medium term.

High Risk: All positions of speculative grade (from B+ to D), as well as those issuers that according to the information available (Financial statements, relevant information, external qualifications, CDS, among others) reflect a high probability of default of financial obligations or that already have failed to fulfill them.

Following the downgrade of the Republic of Colombia’s credit rating by Moody’s (Baa3), S&P, and Fitch (BB), we recorded a change in the risk classification. Consequently, positions in Colombian sovereign debt and exposures to Colombian issuers were reclassified to the mid‑risk category.

Unless otherwise noted, the analysis below for Cibest Corporate Group is based on a comparison with the financial information reported by Grupo Bancolombia for the year ended December 31, 2024. Additionally, as of year‑end December 2025, Banistmo is considered a discontinued operation; its portfolio is therefore reported under the ‘Assets Held for Sale’ category in the balance sheet. For further details, see Note 31 — Discontinued Operation.”

Credit Quality Analysis of Cibest Corporate Group:

Maximum Exposure to Credit Risk
In millions of COP
	Debt instruments		Equity		Other financial instruments(1)		Derivatives(2)
	2025	2024	2025	2024	2025	2024	2025	2024
Low Risk	6,753,154	29,130,380	415	363,198	—	1,712	630,738	834,821
Medium Risk	24,402,902	4,873,025	1,143,337	57,119	19,014	16,479	659,717	1,154
High Risk	1,683,992	2,580,107	15,026	677	—	2,966	1,794	7,086
Without Rating		-	304,844	590,316	11,271	13,228	16,495	86,437
Total	32,840,048	36,583,512	1,463,622	1,011,310	30,285	34,385	1,308,744	929,498

(1) Corresponds to SAFE "Simple Agreement for Future Equity".

F-202

Table of Contents

(2) For derivatives transactions counterparty risk is disclosed as long as the valuation is positive.

•Financial credit quality of other financial instruments that are not in default nor impaired in value

Debt instruments: 100% of the debt instruments are not in default.

Equity: The positions do not represent significant risks.

Derivatives: 99.9% of the credit exposure does not present incidences of material default. The remaining percentage corresponds to default events at the end of the period.

•Maximum exposure level to the credit risk given:

Maximum Exposure to Credit Risk
In millions of COP
	Maximum Exposure		Collateral		Net Exposure
	2025	2024	2025	2024	2025	2024
Debt instruments	32,840,048	36,583,512	(2,529,186)	(1,669,011)	30,310,862	34,914,501
Derivatives	1,308,744	929,498	(726,801)	(589,098)	581,943	340,400
Equity	1,463,622	1,011,310	-	-	1,463,622	1,011,310
Other financial instruments	30,285	34,385	-	-	30,285	34,385
Total	35,642,699	38,558,705	(3,255,987)	(2,258,109)	32,386,712	36,300,596

Note: Derivative collateral received from counterparties, whose have their market value positive when consolidate all the portfolio derivaties of related ID, in December 2024 was COP 589,098 and in December 2025 was COP 726,801. In debt instruments, guarantees correspond to Repo, reverse repo, and securities lending trades

•Analysis of the maturity of other financial instruments past due but not impaired

–Debt instruments: Portfolio does not present past due nor impaired assets.

–Equity: Portfolio does not present impaired assets.

–Derivatives: The past due assets are not material.

•The information corresponding to the individual evaluation of impairment at the end of the period for other financial instruments, is detailed as follows:

Debt instruments

Maximum Exposure to Credit Risk
In millions of COP
	Exposure		Impairment		Final Exposure
	2025	2024	2025	2024	2025	2024
Fair Value	27,010,728	28,119,697	4,174	6,513	27,006,554	28,113,184
Amortized Cost	5,829,320	8,463,815	16,696	58,937	5,812,624	8,404,878
Total	32,840,048	36,583,512	20,870	65,450	32,819,177	36,518,062

Equity

Maximum Exposure to Credit Risk
In millions of COP
	Exposure		Impairment		Final Exposure
	2025	2024	2025	2024	2025	2024
Fair Value through profit or loss	1,136,645	537,213	-	-	1,136,645	537,213
Fair Value through OCI	326,977	474,097	-	-	326,977	474,097
Total	1,463,622	1,011,310	-	-	1,463,622	1,011,310

F-203

Table of Contents

Collateral - investment financial instruments:

Level of collateral: respect to the type of asset or operation, a collateral level is determined according to the policies defined for each product and the market where the operation is carried out.

Assets held as collateral in organized markets: the only assets that can be received as collateral are those defined by the central counterparties, the stock market where the operation is negotiated, those assets that are settled separately in different contracts or documents, which can be managed by each organization and must comply with the investment policies defined by Cibest Corporate Group, taking into account the credit limit for each type of asset or operation received or delivered, which collateral received are the best credit quality and liquidity.

Assets received as bilateral collateral between counterparties: the collateral accepted in international OTC derivative operations is agreed on bilaterally in the Credit Support Annex (CSA)5 and with fulfillment in cash in dollars and managed by Citibank N.A.. This company acts on behalf of Bancolombia for making international margin calls and providing a better management of the collateral.

Collateral adjustments for margin agreements: the adjustments will be determined by the criteria applied by both the external and internal regulations in effect, and at the same time, mitigation standards are maintained so that the operation fulfills the liquidity and solidity criteria for settlement. Among the main characteristics by product or market, we have:

–With respect to the derivative operations, these are carried out daily, with threshold levels of zero for the majority of counterparties, which reduces the exposure to a term that does not exceed 10 days, according to Basel.

–For buy-sell backs, repos and other securities financing transactions, daily monitoring is done in order to establish the need to adjust the collateral in such a way that these are applied in as little time as possible, according to the contracts or market conditions.

–For all international counterparties, margin agreements that limit exposure to the maximum and with a daily adjustment period are celebrated. These margin agreements are celebrated under ISDA(International Swaps and Derivatives Association)6 and GMRA (Global Master Repurchase Agreement)7 both for OTC derivatives and securities financing transactions.

–For every local counterparty, the local framework agreement is signed (agreement developed by the industry) and the mitigating actions to apply in each operation are agreed upon, whether for margin agreements, re-couponing, early termination, among others.

–For repos, buy-sell backs and other securities financing transactions, these are agreed upon by organized markets that in general implicate complying with haircut or additional collateral rules.

–The central counterparty carries out daily control and monitoring processes in order to comply with the rules imposed by these organizations in such a way that we are always making daily adjustments at the demanded collateral level.

5 A Credit Support Annex (CSA) provides credit protection by setting forth the rules governing the mutual posting of collateral. CSAs are used in documenting collateral arrangements between two parties that trade privately negotiated (over-the-counter) derivative securities. The trade is documented under a standard contract called a master agreement, developed by the International Swaps and Derivatives Association (ISDA).

Privately negotiated (over-the-counter) derivative securities. The trade is documented under a standard contract called a master agreement, developed by the International Swaps and Derivatives Association (ISDA).

6 ISDA: Organization of participants in the OTC derivatives markets. Its main objective is to establish a reference framework through standard contracts for OTC derivatives trading.

7 GMRA: It is a model legal agreement designed for parties transacting repos and is published by the International Capital Market Association (ICMA).

F-204

Table of Contents

•Level of collateral held:

Maximum Exposure to Credit Risk
In millions of COP
	Collateral(1)		Main type of collateral
	2025	2024	2025	2024
Debt Instruments	(2,529,186)	(1,669,011)	Government bonds (TES)	Government bonds (TES)
Derivatives	(726,801)	(589,098)	Cash	Cash
Equity
Other financial instruments
Total	(3,255,987)	(2,258,109)

f.Credit risk concentration - other financial instruments:

According to the regulations, Cibest Corporate Group must control on a daily basis the risk of positions of Cibest Corporate Group’s companies where the same issuer or counterparty stands, below the legal limits.

By the same way, the positions of Cibest Corporate Group are verified in respect of the authorized risk levels in each country in order to guarantee the alerts and positions limits, that are considered outside of Cibest Corporate Group´s risk appetite.

	Debt instruments		Equity		Other financial instruments(1)		Derivatives(2)
	2025	2024	2025	2024	2025	2024	2025	2024
Sector Concentration
Corporate	2,057,336	4,764,748	317,999	337,332	14,042	16,479	596,340	362,568
Financial	6,618,843	5,612,993	238,252	252,731	16,243	17,906	687,706	317,722
Government	24,163,869	26,201,390	-	-	-	-	831	829
Funds ETF	—	4,381	907,371	421,247			23,867	248,379
Total	32,840,048	36,583,512	1,463,622	1,011,310	30,285	34,385	1,308,744	929,498
Concentration by Region
North America	6,029,251	6,109,348	308	273	-	-	361,077	132,870
Latam	26,750,363	30,441,888	543,118	706,437	30,285	34,385	663,594	426,424
Europe	60,434	32,276	3,908	3,908	-	—	269,673	147,533
Others (Includes Funds and ETF)	-	—	916,288	300,692	-	-	14,400	222,671
Total	32,840,048	36,583,512	1,463,622	1,011,310	30,285	34,385	1,308,744	929,498

(1) Corresponds to SAFE "Simple Agreement for Future Equity".

(2) For derivatives transactions counterparty risk is disclosed as long as the valuation is positive.

F-205

Table of Contents

Risk exposure by credit rating

Maximum Exposure to Credit Risk
In millions of COP
Rating scale (1)	Investment Financial instruments
	2025	2024
Sovereign Risk	15,380,169	14,487,622
AAA	2,247,310	10,113,581
AA+	3,618,196	4,714,501
AA	27,534	770,266
AA-	187,873	68,124
A+	165,838	906,847
A	371,477	465,978
A-	254,259	352,619
BBB+	10,914	587,802
BBB	115,728	221,092
BBB-	385,178	219,676
BB+	10,531,642	2,824,168
BB	219,486	1,674,226
BB-	93,672	347,253
Other	1,700,813	114,969
Not rated	332,610	689,981
Total	35,642,699	38,558,705

(1) Internal homologation

As of December 31, 2025, Cibest Corporate Group’s positions are not in excess of the concentration limit, according to the applicable laws.

Market risk

Market risk refers to the possibility of incurring losses in the treasury book as a result of changes in stock prices, interest rates, exchange rates, and other indicators whose values are set in a public market. It also refers to the probability of unexpected changes in net interest income and economic equity value as a result of a change in market interest rates.

Activities through which market risks are assumed are divided into:

■Trading: Includes purchase - sale and positioning mainly in fixed income securities, equities, currencies and derivatives, as well as the financial services provided to customers, such as brokerage. Trading instruments are recorded in the treasury book and are managed by the Treasury Division which is also responsible for the aggregated management of exchange rate exposures arising from the banking book and treasury book.

Market risk can also arise from the crypto market fluctuations that affect our crypto assets portafolio held in reserve to facilitate our clients activities of Wenia, our digital asset company in Bermudas, which is the only company in Cibest Corporate Group authorized to take this kind of assets, according to our internal policies.

■Balance sheet management: Includes Cibest Corporate Group's assets and liabilities that are not part of the treasury and those operations intended to cover the banking book. The Assets Liability Management Division is responsible for the balance sheet management, preserving the stability of the financial margin and the economic value of equity, maintaining adequate levels of liquidity and solvency. Cibest Corporate Group holds instruments not intended for trading, such as loans, time deposits, checking accounts, and savings accounts, which are recorded in the banking ledger.

F-206

Table of Contents

At Cibest Corporate Group, market risks are identified, measured, monitored, controlled, and communicated in order to make timely decisions for their adequate mitigation and to generate greater added value for shareholders.

The guidelines, policies, and methodologies for market risk management are approved by the Board of Directors, thus ensuring consistency and unity in risk appetite among the entities of Cibest Corporate Group. There are local market risk and liquidity areas that incorporate corporate guidelines and methodologies into internal policies. The Board of Directors and Senior Management of Cibest Corporate Group have formalized the policies, procedures, strategies, and rules for market risk management in the Market Risk Manuals. These manuals define the responsibilities within the areas of each of Cibest Corporate Corporate Group's entities, as well as their interaction, with the aim of ensuring adequate market risk management.

The separate functions between the business areas and the risk areas responsible for the identification, measurement, analysis, control, and reporting of market risks provide sufficient independence and autonomy for their adequate control. The independent control function is complemented by periodic reviews carried out by Internal Audit.

The Corporate Market and Liquidity Risk Department of Cibest Corporate Group is responsible for: (a) identifying, measuring, monitoring, analyzing, and controlling the market risk inherent in Cibest Corporate Group's business activities, (b) analyzing Cibest Corporate Group's exposure under stress scenarios and ensuring compliance with the policies established for such measurement, (c) designing methodologies for the valuation at market prices of certain financial instruments, (d) reporting to Senior Management and the Board of Directors any breach of the policies defined in relation to Cibest Corporate Group's risk management, (e) reporting to Senior Management, on a daily basis, the levels of market risk exposure of the portfolio of instruments recorded in the Treasury Book, and (f) propose policies to the Board of Directors and Senior Management that allow for the proper management of market risk. Likewise, Cibest Corporate Group has implemented an approval process for new products, which was designed to ensure that each area of Cibest Corporate Group is prepared to incorporate the new product into its procedures, that all risks are considered, and that the respective approvals from the Board of Directors and Senior Management are obtained prior to trading the product.

The Value at Risk methodologies are used to measure, manage, and control market risks in the trading activities of Cibest Corporate Group: the standard methodology established by the SFC and the internal methodology based on weighted historical simulation. The standard methodology established by Chapter XXXI of the SFC's CBCF is based on the model recommended by the 2005 Basel Committee's Amendment to the Capital Accord to Incorporate Market Risk, which is included in the estimate of the Cibest Consolidated Group's solvency ratio. The internal historical simulation methodology uses a confidence level of 99%, a holding period of 10 days, and a time window of one year or 250 daily data points, obtained historically from the VaR calculation reference date. For digital assets, the internal methodology uses a multivariate model from the GARCH family, with a holding period of one day and a data window of four years. The standard methodology is used to report market risk exposure to the SFC and also to measure the capital requirements of Cibest Corporate Group. Therefore, the analysis included below is based on the information obtained from this model.

The hierarchical structure of VaR limits for trading activities is sufficient to effectively control the various types of market risk factors to which exposure is maintained. It ensures that market risk is not concentrated in certain asset classes and maximizes the diversification effect of the portfolio. These limits are defined by companies, products, or risk-taking responsibilities. Most of the limits are maximum VaR values to which a particular portfolio may be exposed; however, loss alerts, stop losses, and sensitivity limits are also managed, especially in derivative portfolios. The limits are approved by the Board of Directors, taking into account the size of the assets, the complexity and volatility of the markets, and the risk appetite. They are monitored daily, and any excesses or breaches are reported to the Board of Directors and the Risk Committee.

In order to capture tail risk, the Expected Shortfall is estimated at a 97.5% confidence level, which corresponds to the expected value of losses that are equal to or exceed the Value at Risk (VaR). In addition, extreme scenario analyses or stress tests are performed to estimate potential losses that occur with low frequency but remain plausible, either by replicating historical crisis events or by simulating hypothetical scenarios. Model validation exercises, including backtesting, are also conducted to assess the accuracy of loss forecasts relative to actual outcomes, leading to model adjustments when necessary.

As part of the market risk control and monitoring processes, daily and monthly reports are prepared, which include an analysis of risk measures and enable monitoring of market risk exposure levels and the legal and internal limits established for each level of the Organization. These reports are used as input for decision-making in the various committees and bodies of Cibest Corporate Group.

For the management and control of market risk in strategies other than trading, Cibest Corporate Group uses a comprehensive approach, with a short-term view, measuring the sensitivity of net interest margin over a one-year horizon, and a long-term view, estimating the impact on economic equity value through different scenarios. In addition, alerts are

F-207

Table of Contents

defined for monitoring and controlling the interest rate risk exposure of the banking book positions, which are reported periodically to senior management.

Market risk management for banking book positions is carried out in a decentralized and independent manner at each of Cibest Corporate Group's banking entities by the Asset and Liability Management departments within the Finance area.

Market Risk and banking book's interest rate risk management

The following section describes the market risks to which Cibest Corporate Group is exposed and the tools and methodologies used to measure these risks as of December 31, 2025. Cibest Corporate Group is exposed to market risk and banking book interest rate risk as a result of its lending activities, trading of financial instruments, and general investment operations.

Cibest Corporate Group uses VaR calculation to limit its exposure to the market risk of its Treasury Book. The Board of Directors is responsible for establishing the maximum VaR based on its assessment of the appropriate level of risk assumed across each of Cibest Corporate Group’s entities. The Risks Committee is responsible for establishing the maximum VaR for each company and the Propietary Trading Risks Committee is responsible for establishing the maximum VaR by type of investment. These limits are supervised on a daily basis by the Market Risk Management Office.

For the management of the interest rate risk of the banking book, Cibest Corporate Group estimates the impact of changes in market rates on the net interest income and the economic value of equity. In addition, the foreign currency exchange rate exposures arising from the banking book are provided to the Treasury Division where these positions are aggregated and managed.

A.Measurement of market risk of trading instruments

Cibest Corporate Group currently measures the treasury book exposure to market risk (including OTC derivatives positions) as well as the currency risk exposure of the banking book, which is provided to the Treasury Division, using a VaR methodology established in accordance with “Chapter XXXI of the Basic Accounting Circular”, issued by the SFC.

The VaR methodology established by “Chapter XXXI of the Basic Accounting Circular” is based on the model recommended by the Amendment to the Capital Accord to Incorporate Market Risks of Basel Committee, which focuses on the treasury book and excludes investments classified as amortized cost which are not being given as collateral and any other investment that comprises the banking book, such as non-trading positions excluding the currency risk position stemming from investment in affiliated but not consolidated entities denominated in foreign currencies. In addition, the methodology aggregates all risks by the use of correlations, through an allocation system based on defined zones and bands, affected by given sensitivity factors.

The total market risk for CibestCorporate Group is calculated by the arithmetical aggregation of the VaR calculated for each subsidiary.

For purposes of VaR calculations, a risk exposure category is any market variable that is able to influence potential changes in the portfolio value. Taking into account a given risk exposure, the VaR model assesses the maximum loss not exceeded, over a given period of time. The fluctuations in the portfolio’s VaR depend on volatility, modified duration and positions changes relating to the different instruments that are subject to market risk.

The relevant risk exposure categories for which VaR is computed by Cibest Corporate Group according to “Chapter XXXI, Appendix VI of the Basic Accounting Circular” are: (i) interest rate risks relating to local currency, foreign currency and UVR; (ii) currency risk; (iii) stock price risk; (iv) fund risk. and (v) credit default swaps risk.

•Interest Rate Risk (Treasury Book)

The interest rate risk is the probability of decrease in the market value of the position due to fluctuations in market interest rates. Cibest Corporate Group calculates the interest rate risk for positions in local currency, foreign currency and UVR separately; in accordance with Chapter XXXI of the Basic Accounting Circular issued by the SFC.

F-208

Table of Contents

In the first instance, the interest rate risk exposure is determined by the sensitivity calculation for the net position of each instrument. This sensitivity is calculated as the net present value (NPV) of each instrument, its corresponding modified duration and the estimated variation of interest rates. The possible variations in the interest rates are established by the SFC according to the historical behavior of these variables in the markets, and they are a function of the duration and currency, as seen in the following table:

		Modified Duration		Changes in Interest Rates (bps)
Zone	Band	Lower Limit	Upper Limit	Legal Currency	UVR	Foreign<br> Currency
	1	0	0.08	274	274	100
Zone 1	2	0.08	0.25	268	274	100
	3	0.25	0.5	259	274	100
	4	0.5	1	233	274	100
	5	1	1.9	222	250	90
Zone 2	6	1.9	2.8	222	250	80
	7	2.8	3.6	211	220	75
	8	3.6	4.3	211	220	75
	9	4.3	5.7	172	200	70
	10	5.7	7.3	162	170	65
Zone 3	11	7.3	9.3	162	170	60
	12	9.3	10.6	162	170	60
	13	10.6	12	162	170	60
	14	12	20	162	170	60
	15	20		162	170	60

Once the sensitivity factor is calculated for each position, the modified duration is then used to classify each position within its corresponding band. A net sensitivity is then calculated for each band, by determining the difference between the sum of all long-positions and the sum of all short-positions. Then a net position is calculated for each zone (which consists of a series of bands) determined by the SFC. The final step is to make adjustments within each band, across bands and within each zone, which results in a final number that is the interest rate risk VaR by currency. Each adjustment is performed following the guidelines established by the SFC.

Cibest Corporate Group’s exposure to interest risk primarily arises from investments in Colombian government’s treasury bonds (TES) and other Colombian government securities.

•Currency (Treasury and Banking Book), Equity (Treasury Book) and Fund (Treasury Book) Risk

The VaR model uses a sensitivity factor to calculate the probability of loss due to fluctuations in the price of stocks, funds and currencies in which Cibest Corporate Group maintains a position. As previously indicated, the methodology used in these financial statements to measure such risk consists of computing VaR, which is derived by multiplying the position by the maximum probable variation in the price of such positions (“∆p”). The (“∆p”) is determined by the SFC, as shown in the following table:

Currency	Sensitivity Factor
United States Dollar	12.49	%
Euro	11.00	%
Other currencies	13.02	%
Equity and Fund Risk	14.70	%

F-209

Table of Contents

Interest rate fluctuations and the sensitivity of exchange rate risk, share prices, and collective portfolios used in the model are established by the SFC in accordance with historical market behavior.

•Total Market Risk VaR

The total market risk exposure of Cibet Corporate Group is calculated as the algebraic sum of exposures to interest rate risk, the currency risk, the equity risk, fund risk and the credit default swaps risk, which, in turn, are calculated as the algebraic sum of exposures to these types of risk for each of the entities that make up the Group. Currently, Cibest Corporate Group has no exposure to credit default swap risk.

Our exposure to market risk decreased by 28.5%, from COP 1,697,566 in December 2024 to COP 1,213,155 in December 2025. There was a notable decrease in the exchange rate factor due to lower exposure to the U.S. dollar, driven by lower exposure to foreign currency securities. Meanwhile, the share price factor increased due to greater exposure to equity instruments, as did the collective portfolio factor, which also increased due to the valuation of the Fondo Inmobiliario Colombia.

The total variation in market risk, as well as the variation of its components, is shown below:

December 2025
In millions of COP
Factor	December 31	Average	Maximum	Minimum
Interest Rate Risk VaR	534,919	552,803	499,712	524,034
Foreign Exchange Rate Risk VaR	182,077	282,154	751,796	79,062
Equity Risk VaR	407,177	380,326	367,615	375,015
Fund Risk VaR	88,982	51,683	35,781	36,608
Total Value at Risk	1,213,155	1,266,967				December 2024
---	---	---	---	---
In millions of COP
Factor	December 31	Average	Maximum	Minimum
Interest Rate Risk VaR	540,397	507,425	586,194	433,465
Foreign Exchange Rate Risk VaR	764,920	554,900	764,920	364,421
Equity Risk VaR	360,287	351,134	360,287	340,363
Fund Risk VaR	31,962	25,653	31,962	18,005
Total Value at Risk	1,697,566	1,439,112

*As of December 31, 2024, the proprietary currency portfolio of Wenia amounted to - USD 74.3 thousand, with a Value at Risk (VaR) of USD 3.8 thousand. The VaR was calculated using an internal methodology based on a Dinamic Conditional Correlation (DCC) GARCH model, with a one-day time horizon and a 99% of confidence level.

•Assumptions and Limitations of VaR Models

Although Value at Risk (VaR) models are widely recognized tools for risk management, they have inherent limitations, including reliance on historical data that may not be indicative of future market behavior. Consequently, VaR models should not be considered predictive of future outcomes. In this regard, an institution may incur losses that exceed the values indicated by the models over a given day or time horizon, as VaR models do not estimate the maximum possible loss. Accordingly, the results produced by these models and their interpretation are subject to the expertise and sound judgment of the individuals involved in Cibest Corporate Group’s risk management process.

•Cibest Corporate Group’s results could adversely affected with high inflation rate

High level of inflation increases interest rates and reduces the market value of Cibest Corporate Group´s debt instruments and increases the market risk in general. Inflation also impacts the real interest rate. When the inflation rate is higher than the nominal interest rate, negative real interest rates discourage saving and the greater variability increases uncertainty and risk, not only in the loan market but also in the stock market.

F-210

Table of Contents

B. Non-trading instruments market risk measurement

The banking book’s relevant risk exposure is interest rate risk, which is the probability of unexpected changes in net interest income or in the economic value of equity as a result of a change in market interest rates. Changes in interest rates affect Cibest Corporate Group’s earnings because of timing differences on the repricing of the assets and liabilities. Cibest Corporate Group manages the interest rate risk arising from banking activities in non-trading instruments by analyzing the interest rate mismatches between its interest earning assets and its interest bearing liabilities, and estimates the impact on the net interest income and the economic value of equity. The foreign currency exchange rate exposures arising from the banking book are provided to the Treasury Division where these positions are aggregated and managed.

•Interest Risk Exposure (Banking Book)

Cibest Corporate Group has performed a sensitivity analysis of market risk sensitive instruments estimating the impact on the net interest income of each position in the Banking Book, using a repricing model and assuming positive parallel shifts of 100 basis points (bps).

The table 1 provides information about Cibest Corporate Group’s interest rate sensitivity for the statement of financial position items comprising the Banking Book.

Table 1. Sensitivity to Interest Rate Risk of the Banking Book

The chart below provides information about Cibest Corporate Group’s interest rate risk sensitivity in local currency (COP) at December 31, 2025 and December 31, 2024:

	December 31, 2025	December 31, 2024
In millions of COP
Assets sensitivity 100 bps	1,314,604	1,262,776
Liabilities sensitivity 100 bps	870,619	915,528
Net interest income sensitivity 100 bps	443,985	347,248

The chart below provides information about Cibest Corporate Group’s interest rate risk sensitivity in foreign currency (US dollars) at December 31, 2025 and 2024:

	December 31, 2024
In millions of
Assets sensitivity 100 bps	76,219
Liabilities sensitivity 100 bps	83,051
Net interest income sensitivity 100 bps	(6,832)

All values are in US Dollars.

A positive net sensitivity denotes a higher sensitivity of assets than of liabilities and implies that a rise in interest rates will positively affect Cibest Corporate Group´s net interest income. A negative sensitivity denotes a higher sensitivity of liabilities than of assets and implies that a rise in interest rates will negatively affect Cibest Corporate Group´s net interest income. In the event of a decrease in interest rates, the impacts on net interest income would be opposite to those described above.

Total Exposure:

As of December 31, 2025, the net sensitivity of the banking book in legal currency to positive and parallel variations in interest rates of 100 basis points was COP 443,985. The variation in interest rate risk sensitivity between 2025 and 2024 is due to the increase in the portfolio balance and accounting hedges.

On the other hand, the sensitivity of the net interest margin in foreign currency, assuming a parallel shift of 100 basis points, amounted to USD 15,337. This represents an increase compared to December 31, 2024, primarily driven by higher balances in rate‑sensitive deposit accounts and certificates of deposit.

•Assumptions and Limitations

Net interest income sensitivity analysis is based on the repricing model and considers the following key assumptions: (a) the effect of new transactions, defaults, etc. is not considered (b) the sensitivity of the fixed-rate balance sheet considers

F-211

Table of Contents

amounts maturing in less than one year, assuming that these will be placed again at market rates; and (c) changes in interest rates are presented immediately and in parallel in the yield curves for assets and liabilities.

•Structural equity risk exposure (Banking Book)

Cibest Corporate Group, Investment Banking, in its capacity as a Financial Corporation, holds structural capital investments directly and through its affiliated companies. These investments are mainly concentrated in the industrial and financial sectors. The market value of these positions showed a positive variation of 25.5%, going from COP 36,226 million at the end of 2024 to COP 45,460 at the end of 2025, mainly as a result of the appreciation of ENKA's shares.

When considering a negative impact of 14.70% on the value of structural equities as of December 2025, there would be a depreciation of COP 6,683.

Table 2. Sensitivity to equity price risk.

The structural equity positions are exposed to market risk. Sensitivity calculations are made for those positions:

	As of December 31,
	2025		2024
	In millions of COP
Market Value	45,460		36,226
Delta	14.70	%	14.70	%
Sensitivity	6,683		5,325

Considering a negative impact of 14.70% on the value of structural shares as of December 2025, there would be a devaluation of COP 6,683 million.

Liquidity risk

Liquidity risk is defined as the inability to fully and timely meet payment obligations as they fall due, as a result of insufficient liquid resources and/or the need to incur excessively high funding costs.

At Cibest Corporate Group, liquidity prevails over any objective of growth or revenue. Managing liquidity has always been a fundamental pillar of its business strategy, together with capital, in supporting its statement of financial position.

Cibest Corporate Group’s liquidity management model promotes the autonomy of subsidiaries, which must be self-sufficient in their structural funding. Each subsidiary is responsible for meeting the liquidity needs of its current and future activity, within a framework of management coordination at Cibest Corporate Group level. The metrics used to control liquidity risk are developed based on common and homogeneous concepts, but analysis and adaptation are made by each subsidiary.

In line with best governance practices, Cibest Corporate Group has established a clear division of function between executing liquidity management, responsibility of the Asset and Liability Division, and their monitoring and control, responsibility of the Market and Liquidity Risks Management Office.

The different authorities of senior management define the policies and guidelines for managing liquidity risk. These authorities are the Board of Directors, the Risk Committee, and senior management of the Parent Company, which set the risk appetite and define the financial strategy. The ALCO committees (Asset and liability committee) define the objective positioning of liquidity and the strategies that ensure the funding needs derived from businesses. The ALM division (Asset and liability management) and the Market and Liquidity Risks Management Office support the mentioned committees, which elaborate analysis and management proposals, and control compliance with the limits established.

The Corporate Risk Vice Presidency, through the Market and Liquidity Risk areas, is responsible for proposing the minimum amount of the liquidity reserve, the policies of the liquidity portfolio, defining premises and metrics in order to model the behaviour of the cash flows, proposing and monitoring liquidity limits in line with Cibest Corporate Group's risk appetite, simulating stress scenarios, evaluating and reporting the risks inherent to new products and operations; and submitting the reports required by the internal authorities for decision-making, as well as by regulators. All of the above activities are verified and evaluated by the Internal Audit.

F-212

Table of Contents

The measures to control liquidity risk include maintaining a portfolio of highly liquid assets, and the definition of triggers and liquidity limits, which allow for proactive assessment of Cibest Corporate Group's level of exposure.

The methodologies used to control liquidity risk include the liquidity gaps and stress scenarios. The liquidity gaps measure the mismatches of assets, liabilities and off-balance sheet position´s cash flows, separately for local currency and foreign currency. Regulatory metrics are also applied, in which the contractual maturities are used; and internal models in which the cash flows are adjusted by different ratios, to reflect a more accurate behaviour.

Periodically, a validation of the policies, limits, processes, methodologies and tools to evaluate liquidity risk exposure is performed, in order to establish its pertinence and functionality, and to carry out the necessary adjustments. The Market and Liquidity Risks Management Office elaborate reports daily, weekly and monthly basis in order to monitor the exposure levels and the limits and triggers set up, and to support the decision-making process.

Each subsidiary has its own liquidity contingency plan, which is tested annually. These contingency plans are aimed at optimizing the use of different funding sources.

Liquidity risk management

Cibest Corporate Group’s Board of Directors sets the strategy for managing liquidity risk and delegates responsibility for oversight of the implementation of this policy to the ALCO committee, which approve the liquidity policies and procedures of each entity. Treasury, in turn, manages the day to day liquidity position and reviews daily liquidity reports.

Periodically, a summarized report is submitted to the Risk Committee and the GAP Committees, including all exceptions identified and the corrective measures adopted.

a.Liquidity risk exposure:

In order to estimate liquidity risk, Cibest Corporate Group measures a liquidity coverage ratio to ensure holding liquid assets sufficient to cover potential net cash outflows over 30 days. This indicator allows Cibest Corporate Group to meet liquidity coverage for the next month. The liquidity coverage ratio is presented as follows:

Liquidity Coverage Ratio	December 31, 2025	December 31, 2024
Net cash outflows into 30 days	25,449,163	23,887,074
Liquid Assets	62,298,492	59,617,839
Liquidity coverage ratio(1)	244.80%	249.58%

(1) The minimum level required of the liquidity coverage ratio by the legal norm is 100%.

The coverage ratio showed a decrease, moving from 249.58% in December 2024 to 244.8% in December 2025. This variation is mainly explained by an increase in the 30‑day liquidity requirement, primarily due to the maturity of CDTs, obligations from derivative transactions, and bank loans in Colombia.

b.Liquid Assets

One of the main guidelines of Cibest Corporate Group is to maintain a solid liquidity position, therefore, the ALCO Committee, has established a minimum level of liquid assets, calculated based on liquidity requirements, in order to ensure the proper conduct of banking and financial services activities such as loan origination and deposit withdrawals while protecting capital and taking advantage of market opportunities.

F-213

Table of Contents

The following table shows the liquid assets held by Cibest Corporate Group:

Liquid Assets(1)	December 31, 2025	December 31, 2024
High quality liquid assets(2)
Cash	26,625,173	27,931,834
High quality liquid securities	25,531,243	24,862,860
Other Liquid Assets
Other securities(3)	10,142,076	6,823,145
Total Liquid Assets	62,298,492	59,617,839

(1)Cash and those liquid assets received by the Central Bank for its operations expansion and monetary contraction are the assets with highest liquidity. Liquid assets are adjusted by a haircut. The following are considered as liquid assets: cash, repos held for trading and investments held for trading in listed shares in Colombia’s stock exchange, in investment funds units or in other trading debt instruments.

(2) High-quality liquid assets: cash and shares that are eligible to be reportable or repo operations, in addition to those liquid assets that the Central Bank receives for its monetary expansion and contraction operations described in paragraph 3.1.1 of the Foreign Regulatory Circular DODM-142 of the Bank of the Republic.

(3) Other Securities: Securities issued by financial and corporate entities.

c.Contractual maturities of financial assets

The tables below set out the remaining contractual maturities of principal and interest balances of Cibest Corporate Group’s financial assets:

Contractual maturities of financial assets December 31, 2025

Financial Assets	0 – 30 days	31 days – 1 Year	1 - 3 Years	3 - 5 Years	More than 5 years
Cash and balances with central bank	24,625,309
Interbank borrowings - Repurchase agreements	9,596,081	465,662
Financial assets investments	3,192,341	25,014,014	10,270,300	5,093,609	2,781,776
Loans and advances to customers	16,362,824	98,293,420	108,624,480	64,191,216	120,638,340
Derivative financial instruments	72,577,065	9,762,318	2,851,659	1,666,495	1,207,055
Total financial assets	126,353,620	133,535,414	121,746,439	70,951,319	124,627,171

Contractual maturities of financial assets December 31, 2024

Financial Assets	0 – 30 days	31 days – 1 Year	1 - 3 Years	3 - 5 Years	More than 5 years
Cash and balances with central bank	24,881,536	-	-	-	-
Interbank borrowings - Repurchase agreements	7,815,791	146,772	-	-	-
Financial assets investments	2,303,523	13,929,810	13,318,529	5,257,338	7,910,771
Loans and advances to customers	13,067,571	102,476,191	106,645,598	61,320,760	113,075,471
Derivative financial instruments	8,858,966	5,306,353	2,288,557	757,393	847,796
Total financial assets	56,927,387	121,859,126	122,252,684	67,335,491	121,834,038

d.Contractual maturities of financial liabilities

Below are the contractual maturities of principal and interest of the liabilities:

F-214

Table of Contents

Contractual maturities of financial liabilities December 31, 2025:

Financial Liabilities	0 – 30 days	31 days – 1 Year	1 - 3 Years	3 - 5 Years	More than 5 years
Demand deposit from customers	174,901,209
Time deposits from customers	23,783,630	69,380,898	10,062,892	6,665,040	11,764,550
Interbank deposits-Repurchase agreements	940,817	390,690	—
Borrowings from other financial institutions	928,935	8,296,960	6,639,834	1,330,886	3,347,493
Debt securities in issue	683,998	2,584,102	5,011,604	3,965,631	699,430
Preferred Shares		—	—	—	583,477
Derivative financial instruments	71,016,919	10,059,979	2,938,120	1,843,291	2,310,372
Total financial liabilities	272,255,508	90,712,629	24,652,450	13,804,847	18,705,321

Contractual maturities of financial liabilities December 31, 2024:

Financial Liabilities	0 – 30 days	31 days – 1 Year	1 - 3 Years	3 - 5 Years	More than 5 years
Demand deposit from customers	162,015,643	-	-	-	-
Time deposits from customers	16,673,292	64,079,401	16,502,005	5,879,599	17,667,549
Interbank deposits-Repurchase agreements	1,801,163	46,538	-	-	-
Borrowings from other financial institutions	381,534	8,811,727	3,537,113	1,815,062	2,013,978
Debt securities in issue	56,666	1,698,794	6,917,904	1,131,868	5,846,266
Preferred Shares	—	57,701	115,403	115,403	295,697
Derivative financial instruments	8,644,300	5,100,947	2,152,992	777,663	766,037
Total financial liabilities	189,572,598	79,795,108	29,225,417	9,719,595	26,589,527

The expected cash flows for some financial assets and liabilities may vary significantly from their contractual maturity. The main differences are the following:

•Demand deposit accounts have historically exhibited a tendency to maintain stable balances and to grow over time.

•Although the mortgage loan portfolio has contractual maturities of 15, 20, and 30 years, its average life is shorter than these contractual terms.

e.Financial guarantees

The following are the financial guarantees:

December 31, 2025	0 – 30 days	31 days – 1 Year	1 - 3 Years	3 - 5 Years	More than 5 years
In millions of COP
Financial guarantees	759,832	3,860,361	1,249,931	632,287	52,414		December 31, 2024	0 – 30 days	31 days – 1 Year	1 - 3 Years	3 - 5 Years	More than 5 years
---	---	---	---	---	---
In millions of COP
Financial guarantees	744,077	6,535,071	2,135,249	60,876	669,028

F-215

Document

Exhibit 1.1

GRUPO CIBEST S.A. BYLAWS

CHAPTER I

NAME - TYPE - DOMICILE - OBJECT -TERM

Article 1. Name - Nature. Grupo Cibest S.A. is a Colombian business Stock Corporation, incorporated according to the laws of the Republic of Colombia.

Article 2. Domicile. The main domicile of the Company is the city of Medellín, Province of Antioquia, Republic of Colombia. The company may have branches or agencies in other places in the country or abroad, when so determined by its Board of Directors.

The domicile may not be changed without prior resolution from the General Meeting of Shareholders.

Article 3. Corporate object. The company's corporate purpose is investment in movable and immovable property, and especially, investment in shares, quotas or interest shares, or any other participation title in Colombian and/or foreign companies or entities, and the administration of said investments.

In carrying out its corporate purpose, the company may enter into all acts or contracts directly related to it and those whose purpose is to exercise the rights or fulfill the obligations, legally or conventionally derived from the existence and activity of the company; among others, it may acquire, give as security, exploit, deliver in fiduciary or fiduciary order, and dispose of all types of movable and immovable property; enter into credit operations giving to its related parties or third parties or receiving mutual money from its related parties or third parties without this implying the development of financial intermediation activities, as an occasional activity and without speculative interest and with the sole purpose of achieving funds required to fulfill the corporate purpose; give, accept, negotiate, transfer, pay, celebrate assignments in any capacity of all types of negotiable instruments and sign all types of civil and commercial documents.

PARAGRAPH: The company may guarantee obligations of the companies linked to it with prior authorization from the Board of Directors.

Article 4. Term. The term of the Company will extend until December eight (8), 2144.

CHAPTER II

CAPITAL

Article 5. Authorized Capital. The authorized capital of the Company is seven hundred thousand million Colombian legal currency Pesos (COP 700,000,000,000), divided into one million four hundred thousand shares (1,400,000,000), of a par value of five hundred pesos (COP 500.oo) each share.

Article 6. Subscribed and Paid-In Capital. The subscribed and paid-in capital of the Company shall be established and set in accordance with the Law, these bylaws.

Article 7. Variations of Capital. The authorized capital may be modified only by the General Meeting of Shareholders in compliance with the requirements of the Law, in accordance with the relevant amendment to the Bylaws, legally approved and formalized. Any modification to the subscribed and paid-in capital stock shall be certified by the Statutory Auditor in accordance with the legal provisions and shall be filed with the mercantile public record.

CHAPTER III

STOCK AND STOCKHOLDERS

Article 8. Share Classes. The company's shares are certificated and of capital stock and these may be a) common, b) privileged, and c) with preferred dividend and without voting right. To the extent that it is not contrary to their nature, privileged shares shall be subject to the provisions in these Bylaws that are applicable to common shares.

Shares in which social capital is divided will circulate in an electronic way; consequently, any negotiation or affectation to their rights will be legalized by electronic registry or registry in an account through a Centralized Securities Deposit. Pursuant to article 5 of the Bylaws, all shares issued shall have the same nominal value.

PARAGRAPH: The Shareholders authorize the registration of the shares of the Corporation in the National Registry of Securities and Issuers (RNVE), in the Colombian Stock Exhange (BVC) and in the New York Stock Exchange (NYSE).

Article 9. Limits on the issuance of shares with preferred dividend and without no voting rights. In the terms of Law, shares with preferred dividend and without voting rights, may not represent more than fifty percent (50%) of the subscribed capital.

Article 10. Certificates. Companys’s shares will be represented in deposited macro certificates and under the custody of Centralized Securities Deposit, for the shareholder’s rights, the notation and the registration of the certificate in Shareholders’ registry Book will be sufficient, with which he will credit his ownership before Centralized Securities Deposit.

Article 11. Payment of Shares. While shares are not fully paid up, only provisional certificates shall be issued to shareholders.

Article 12. Shareholders’ registry book. The Corporation shall keep a Stock Record in the manner prescribed by the law, where each stockholder's name, nationality, domicile, and identification number shall be recorded. Bearing in mind that the transfer of shares will be made with the notation on the account by Centralized Securities Deposit and its registry in the Shareholder’s book, the Company will acknowledge the quality of shareholder or owner of shares only to the person who appears registered in the Shareholder’s registry book.

Likewise, any lien, encumbrance, fractioning, use, legal demand, existing cautionary actions, or those which may be against the Company, as well as any other affectation of them will be in force or will be legalized, as the case may be in the corresponding registry through the notation in the accounts of Centralized Securities Deposit, according to Colombia Securities market.

Consequently, no sale or transfer of shares, lien or limitation, encumbrance or adjudication, will have any effect in relation to the Company or the third parties unless they are registered in the Shareholder’s registry book, to which the Company cannot deny unless there is an order of authorized authority or for shares for which requirements have not been met.

PARAGRAPH: Through decision of Board of Directors, the Company could delegate on a specialized entity or a Centralized Securities Deposit, the keeping of the Shareholder’s registry book.

Article 13. Shareholder’s information. Company shareholders shall update required information for registry, control of money laundering. Information and data contributed, including contact, financial and commercial information, will be kept by the Company, entity authorized to file and use it for the compliance of obligations and rights it has as issuing Company. This information may be provided to Centralized Securities Deposit and or to a delegated entity for the shareholders’ assistance; these entities will also be committed to use it, keep it, custody it and use it according to the norms of securities market in which shares are negotiated.

All these without preventing the use of such information by authorized authority.

Article 14. Negotiation of Shares. Shares are negotiable in accordance with the Law, except in the cases legally exempted and their sale will be formalized through a notation in an account by Centralized Securities Deposit.

The Company does not assume any responsibility by reason of facts or circumstances that might affect the validity of the contract between the transferor and the transferee of shares.

Article 15. Negotiation of Unpaid Shares. Shares not paid up may be negotiated in the same manner as paid-up shares, but both assignor and assignee shall also be responsible for the unpaid amount.

Article 16. Pending Dividends. When in the letter of transfer of shares or in the respective order the contrary is not explicitly stated, pending dividends shall belong to the buyer of the shares from the date of the letter or the order of transfer.

Article 17. Non-Transferable Stock. No stocks whose register has been cancelled or prevented by order of competent authority can be alienated.

To transfer stock whose ownership is under litigation, authorization from the respective judge is needed; as to attached shares, authorization from the plaintiff is also needed.

Article 18. Shares Given as Security and Usufruct. Shares levied with securities may not be alienated without consent of the creditor. The security on shares does not give the creditor the rights inherent to the capacity of shareholder but with authorization of explicit agreement. The writing or document containing the corresponding agreement shall be sufficient to exercise the rights conferred on the creditor before the Company.

The security shall be legalized through registration in the Shareholder’s registry book.

Except explicit stipulation to the contrary, the usufruct shall confer all the rights inherent to the capacity of shareholder excepting the right to alienate or encumber them and their reimbursement after liquidation. For the exercise of rights reserved by the owner, the presentation of the writing or document where such reserves are made is sufficient.

Article 19. Attachment of Shares. The attachment of shares shall be carried out with the registration in the Shareholder’s registry book with written order from the competent officer. The attachment covers the corresponding dividend and can be restricted only to this. In this last event, the attachment shall be carried out through order of the judge to perform the attachment and to place the respective amounts at his disposal.

Article 20. Withholding of Dividends. Whenever there is litigation over shares and withholding of their dividends is ordered, the Company shall keep these in deposit on hand, without interests, until the official ordering the withholding notifies to whom they shall be provided.

Article 21. Adherence to the Bylaws and the Good Governance Code. Who acquires shares in the Company, either by virtue of a subscription agreement, or by transfer, or any other purchasing instrument, is subject to these bylaws and its Good Governance Code.

Article 22. Taxes. Taxes levied on the issuance and transfer of stock certificates are to be charged to the stockholders.

CHAPTER IV

SUBSCRIPTION OF NEW STOCKS

Article 23. Share Issuance and Regulation. The shares currently on reserve, and those subsequently created by the General Shareholders´ meeting, shall be issued on the times and according to the basis determined by the competent corporate body.

It is a duty of the Board of Directors, to order the issuance of common stocks, and to publish the respective regulation of the issue of shares, subject to the applicable legal and statutory provisions.

The issuance of shares with preferential dividends and without voting right shall be ordered by the General Shareholders’ Meeting, and its regulation may be delegated to the Board of Directors.

If shares with preferential dividend and without right to voting are issued, the issuance regulation may indicate if they can be converted into common stocks, the term for such conversion and if it is optional or compulsory.

In a similar way, when because of changes in the Company structure, the type of shares with preferential dividend and without right to voting disappear, such shares shall be converted in common shares.

If shares with preferential dividends and without right to voting are converted into common shares, each share of the first kind, shall be entitled to one share of the second kind.

Issuance of privileged shares shall be approved by the General Meeting of Shareholders, which shall determine the nature and extent of any privileges, subject to the Bylaws and the legal provisions; and shall further regulate the placement thereof. Likewise, the diminution or suppression of privileges will be determined by the General Meeting of Shareholders.

Article 24. Preemptive Rights. In the regulation of subscription of shares, the pre-emptive right in favor of stockholders shall be regulated, indicating the proportion and manner such stockholders will be able to subscribe the new issued shares. The term for the exercise of this right shall also be stated in the regulation and it shall not be less than fifteen (15) business days after the date when the Company transmits the offer to the stockholders in the manner provided for in these bylaws to call the General Meeting of Shareholders.

The right to subscription of shares is negotiable since the date of the notice of the offer, through written document indicating the name of the assignee or assignees.

In the event there are stockholders with preference dividend and without right to voting, to safeguard the pre-emptive right of these shareholders, the legal and statutory provisions on the matter shall be observed.

Likewise, when approving the issuance of privileged shares, applicable regulations shall govern.

PARAGRAPH: The Board of Directors in the same resolution about placement of stocks, may authorize the Presidency to sell, through direct negotiation with third parties, or outside the stock market, the remaining stock of the issuance once the time for the exercise of the pre-emptive right has elapsed.

Article 25. Placement without pre-emptive right. The General Meeting of Shareholders through favorable voting of at least seventy per cent (70%) of the stock represented at the meeting may dispose that a certain issuance of stock be placed without subjection to the pre-emptive in favor of the shareholders.

Article 26. Payment of issued stock. The issued stock shall be paid in the manner indicated in the regulation, in accordance with applicable regulation.

Article 27. Minimum value of shares and authorization of issuance. The Company may not issue shares for a price lower than their par value. If needed and in order to be able to perform the subscription of the issued shares, it will require authorization of the competent authority.

CHAPTER V

SHAREHOLDERS’ REPRESENTATION

Article 28. Powers of Attorney. Shareholders may be represented before the Company to deliberate and vote at the General Shareholders' Meeting, for the collection of dividends, and for any other purpose, by means of a power of attorney granted in writing or by any electronic means, according to the law.

The Company shall make valid the proxies set up and votes cast by shareholders using electronic mechanisms, according to the terms established for this purpose by Colombian law and as regulated by the Board of Directors.

Article 29. Indivisibility of shares. Shares are indivisible, and therefore, when due to any legal or conventional cause, a share belongs to several people, these shall appoint a single and common representative to exercise the rights corresponding to the capacity of shareholder. In the absence of agreement, any interested party may request the judge with jurisdiction on the corporate domicile, the appointment of a representative of such shares.

Article 30. Representation of illiquid succession. When an illiquid succession own Company's stock, the executor with tenancy of property shall exercise the stockholders' rights. If there are several executors, they shall appoint a single representative, unless one of them would have been authorized by the judge to such effect. In the absence of executor, the representation shall be exercised by the person elected by a majority of votes of the successors recognized in the proceeding.

Article 31. Exercise of the Representation. The Company shall only recognize one representative per shareholder, whether this is a natural or legal person, a community, or a corporation. At the meetings of the General Meeting of Shareholders, the representation, and the right to voting are indivisible, that is, the representative or proxy is not allowed to fraction the vote of his principal or donor, which means that he may not vote with a group of represented shares, in one sense or for certain persons, and with another or other shares to the contrary or for other people. This indivisibility is not opposed, nevertheless, to the fact that the representative or proxy of several natural or legal persons, or several individuals or collectivities, may vote in each case adhering separately to the instructions given by each person or group represented or principal, but without dividing, in any event, the votes corresponding to the same person.

Article 32. Legal capacity. The fact that a person is registered in the stock record does not entitle him to exercise his shareholder's rights if he lacks legal capacity. In such case, those rights shall be exercised by his legal representative.

Article 33. Incompatibility of Administrators and Employees. While they hold their positions, the administrators and employees of the Company may neither have power to represent other people's shares at the meetings of the General Meeting of Shareholders, nor substitute the powers conferred on them. This prohibition does not include the case of legal representation.

They may neither vote, even with their own shares, the decision whose object is the approval of the end-of-term balances and accounts, nor those of the liquidation.

CHAPTER VI

MECHANISMS FOR CONFLICT RESOLUTIONS

Article 34. Dispute resolution mechanisms. Any differences of opinion that may arise between shareholders related to the company’s overall performance, its operations, projects and businesses, shall be discussed and resolved by the General Shareholders' Meeting, subject to the law and these bylaws.

An attempt will be made to resolve individual disputes that may arise between shareholders and the Company or its directors, or between shareholders, by means of a direct agreement, which shall have a term of thirty (30) business days from the date on which either party enjoins the other in writing, either via e-mail or any other written means.

Any differences that arise between the shareholders and the Company or between the shareholders and the Company´s directors, or between the shareholders themselves due to their status as such, during the course of the company’s existence, upon the Company's dissolution, and during its winding-up, which have not been resolved by direct agreement within thirty (30) business days, shall be submitted to the binding decision of an Arbitration Tribunal which will sit at the Arbitration and Conciliation Center of the Chamber of Commerce of Medellin, subject to the following rules:

(i) The tribunal shall be composed of three (3) arbitrators appointed by the parties by mutual agreement within ten (10) business days of a request submitted by either party to the other. If there is no agreement, the Arbitration and Conciliation Center of the Chamber of Commerce of Medellin will appoint them from a slate of ten names the parties submit together within ten business days of the expiration of the aforementioned period, or failing that, will make the appointment subject to the rules of the Chamber of Commerce. For the purposes of this clause, a party will be understood as a person or group of persons that maintain the same claim.

(ii) The rules of the Arbitration and Settlement Center of the Chamber of Commerce of Medellin will apply.

(iii) The Tribunal will decide according to the law.

PARAGRAPH: This clause also applies to any difference between the shareholders, the Company or its directors with any person who, by reason of any act or contract enforceable against it, is the holder of any political or economic right deriving from shares issued by the Company, which arises by reason of the exercise of such rights.

CHAPTER VII

MANAGEMENT AND DUTIES OF DIRECTORS AND OFFICERS

ARTICLE 35. Direction and Management Bodies. For the purposes of its direction and management, the Corporation has the following bodies:

1. General Meeting of Shareholders

2. Board of Directors

3. Presidency

Each such body shall have the functions and attributes provided in these bylaws, pursuant to the special provisions herein contained and the legal provisions.

Article 36. Duties of the Directors. The Company’s directors must act in good faith, with loyalty and with the diligence of a good businessman. Their actions shall be carried out in the interest of the company, considering the interests of its associates.

In the performance of their duties, and in fulfillment of their functions, directors shall:

1. Carry out efforts that lead to the proper performance of the corporate purpose.

2. Ensure strict compliance with legal or statutory provisions.

3. Ensure that the functions entrusted to the Statutory Auditor are properly carried out.

4. Safeguard and protect the Company’s commercial and industrial reserves. Any person appointed as a member of the Board of Directors will adhere to the Information Management Regulations in the Good Governance Code and is obliged to sign the Agreement for the Access and Use of Information.

5. Refrain from misusing inside information.

6. Treat all members equally and respect their rights of inspection.

7. Refrain from participating, directly or through an intermediary, for their own benefit or for the benefit of third parties, in activities that involve competition with the company or acts that give rise to conflicts of interest.

All directors, administrators and officers faced with potential conflicts of interest or who consider they may be facing one, must proceed as follows:

In any situation where doubts exist regarding the potential existence of a conflict of interest, the director, administrator or officer will be bound to proceed as though it existed, and the procedure established for this purpose by these Bylaws, the Good Governance Code, or any other regulations or policy applicable as a result of belonging to a financial conglomerate, under applicable law, will be followed.

The Company's business relations with its major shareholders shall be conducted within the limitations and conditions established by applicable regulations, and in any event, under market conditions. The Company's economic relations with its directors, CEO, and top executives, shall be conducted within the limitations and conditions established by applicable regulations, and by regulations related to the prevention, management, and resolution of conflicts of interest.

8. In general, comply with all legal and statutory provisions, as well as those found in the Company's Code of Ethics and Good Governance.

CHAPTER VIII

GENERAL MEETING OF SHAREHOLDERS

Article 37. Composition. The General Meeting of Shareholders shall consist of the stockholders registered in the Shareholder’s registry book, in person or through legal representative or attorneys authorized with power of attorney conferred in writing, met with the quorum and the conditions set forth in these bylaws.

PARAGRAPH: For the Company electronic participation of shareholders by internet will be valid, as well as the electronic vote, according to applicable legislation.

Article 38. President of the General Meeting of Shareholders. The General Shareholders' Meeting shall be chaired by the President of the Company; in his absence, by the members of the Board of Directors, according to their order; in the absence of the foregoing, by the person appointed by the General Shareholders’ Meeting among the participants at the meeting, by majority of the votes corresponding to the shares represented therein. The Secretary of the Company shall act as Secretary of the General Meeting, and in his absence, the person appointed by the President of such meeting.

Article 39. Summons. Summons for both ordinary and extraordinary sessions of the General Shareholders’ Meeting shall be issued by means of a notice published in at least one widely circulating newspaper in the Company’s principal place of business.

For meetings at which year-end balance sheets, increases in authorized capital, reductions in subscribed capital, spin-offs, or mergers are to be examined, or where members are to be elected to the Board of Directors, the summons shall be issued at least fifteen (15) business days prior to the date set for the meeting; in all other cases, five (5) calendar days’ notice will suffice. When calculating these deadlines, neither the day on which the summons is issued nor the day of the meeting will be counted.

The agenda shall be included in the summons.

PARAGRAPH: For meetings at which year-end balance sheets, increases in authorized capital, reductions in subscribed capital, spin-offs, mergers are to be examined , or where members are to be elected to the Board of Directors, these points will be included in the agenda and in the summons.

For these proposals, the Directors will prepare a report on the reasons for the proposal, which will be made available to shareholders at least fifteen (15) business days before the date set for the meeting.

In the event of spin-offs, mergers and transformations, the notice shall expressly indicate that shareholders may exercise their right of withdrawal.

Article 40. Ordinary meeting. The General Shareholders' Meeting shall be held every year, no later than the thirty-first of March, for the purpose of assessing the situation of the Company, designating and electing directors and other officers, reviewing reports, accounts, and balance sheets of the preceding fiscal year, deciding on the distribution of profits and agreeing on all measures deemed necessary to ensure achieving the company’s objective. The date of the meeting shall be established by the Board of Directors, and such meeting shall be called by the President of the Company. If not so called, the

Meeting shall automatically take place on the first business day of April, at 10:00 am, at the Company’s principal executive offices, where the shareholders will meet and make decisions with a majority vote of the number of represented shares at the General Shareholders Meeting.

PARAGRAPH: The shareholders may examine the financial statements, accounting books, vouchers, the report from the administrators supporting the increase to the authorized capital stock or the decrease of the subscribed capital stock, as the case may be, and every other documents and relevant information of the company, within the deadline and subject to the formalities provided by Law and the Good Governance Code.

Article 41. Extraordinary sessions: Extraordinary meetings shall be held when required by the Company’s unforeseen or urgent needs, and will be summoned by the Board of Directors, the CEO or the Statutory Auditor, either on their own initiative or when applicable regulations do not provide differently regarding the legitimation to request a summon, at the request of a plural number of shareholders representing no less than ten percent (10%) of the subscribed shares.

At the sessions called under this article the Shareholders’ Meeting may not deal with matters other than those indicated on the agenda included with the summons, except by a decision made by the number of shareholders required by law and once the agenda has been exhausted.

The shareholders’ request must be made in writing and clearly indicate the purpose of the summons.

Article 42. Place of meetings. Except in the case of representation of all subscribed shares, General Meetings of Shareholders shall take place in the municipality of the Company's main domicile, on the day, time and place set out in the notice of meeting.

PARAGRAPH: Likewise, remote, or mixed meetings may take place in the terms authorized by law, in which case the shareholders must have the necessary means to participate in the corresponding meeting.

Article 43. Meeting without notice. The General Meeting of Shareholders may validly meet, deliberate, and decide in any place, without need of prior notice, if all subscribed shares are duly represented.

Article 44. Deliberation Quorum. There shall be quorum to deliberate with the presence of shareholders representing, at least, one half plus one of the shares entitled to vote at the relevant meeting, whether ordinary or special.

If due to lack of quorum the meeting is not held, a new meeting shall be called which may validly deliberate and make decisions with any plural number of people, no matter the number of shares represented thereat.

The new meeting shall neither take place before ten (10) days, nor after thirty (30) days, both ends of business days computed from the date of the adjourned meeting.

PARAGRAPH 1: Issues requiring, pursuant to the law or these bylaws, voting of a special majority of the issued stock, may only be discussed, and passed if the number of shares required in each case is present.

PARAGRAPH 2: Issued stock reacquired by the corporation shall not be computed, in any event, to constitute a quorum.

Article 45. Functions of the General Meeting of Shareholders. The General Meeting of Shareholders shall exercise the functions listed below, in accordance with the Law:

1. Amend the Corporate bylaws.

2. To decree the merging of the Corporation, its demerging, transformation, operations which may be deemed as strategic ones.

3. To decree anticipated dissolution of the Corporation and o its liquidation.

4. Issuing privileged shares, regulating their placement, determining the nature and scope of privileges, diminishing, or suppressing them, subject to the bylaws and to legal provisions.

5. To order the issuance of preference shares, which regulation can be delegated into the Board of Directors.

6. To regulate that a certain issuance of shares be placed without being subject to the pre-emptive right.

7. Examining, approving, disapproving, modifying, and concluding the year-end financial statements and accounts to be rendered at the end of fiscal year by the Board of Directors and the President, or when required by the General Meeting of Shareholders.

8. To appoint, from its members, a plural committee to study the accounts, inventories, and balances when these are not approved, and report the results to the General Meeting of Shareholders when they required it.

9. To order the distribution of profits, providing for reserves and dividends.

10. To elect for a two-term year and according to succession policies that the Shareholder’s assemble has established to the Board of Directors composed of seven (7) Directors to determine their compensation and to remove them at its sole discretion.

11. To elect, for two (2) year terms, the Statutory Auditor of the Corporation and his Alternate, and assign their fees and remove them at its discretion.

12. To order actions against managers, directors or Statutory Auditor.

13. To approve policies and guidelines to be taken into consideration or the variable remuneration of presidents and vice-presidents if such remuneration is represented in Company shares or lined to their Price.

14. To exercise all other functions according to the bylaws and Law. And in general, those which do not correspond to any other body.

15. To generally adopt measures to comply with bylaws and common interest of shareholders.

FIRST PARAGRAPH: Functions stated in numbers 1 to 13 in this article cannot be delegated.

Article 46. Decisions Majorities. Generally, all resolutions by the General Meeting of Shareholders shall be adopted with the affirmative vote of the majority of shares represented at the meeting, taking into account that every share shall give right to one vote. The following decisions are exempted from the above rule:

1.The issuance of shares that do not imply the preference right, which will require the favorable vote of seventy per cent (70%) of the shares represented at the meeting.

2. The distribution of profits shall be approved by the Meeting with favorable vote of a plural number of shareholders representing at least seventy-eight per cent (78%) of the shares represented at the Meeting.

When the majority provided in the foregoing paragraph is not obtained, at least fifty per cent (50%) of the net profits, or from the balance thereof, shall be distributed, if loss from previous fiscal periods had to be cancelled. But if the amount of the reserves exceeds one hundred per cent (100%) the subscribed capital, the previous percentage will be raised to seventy per cent (70%).

3. When the payment of a dividend is to be paid with issued shares, a favorable vote of eighty per cent (80%) of the common shares represented, and eighty per cent (80%) of the preference shares subscribed shall be required.

4. In the event, that changes that would impair the conditions or rights established for the preference shares are to be approved, or when the conversion of such shares into common shares is to be voted, a favorable vote of seventy per cent (70%) of the common shares and of the subscribed preference shares, shall be required.

5. Those decisions, that according to the Law or by provision of these Bylaws, require a special majority.

Article 47. Elections and voting. Elections and voting by the General Shareholder’s Meeting will observe the following rules:

1. Votes may be written and private, or oral and public, but not secret.

2. The Assembly may not make appointments by acclamation.

3. If substitute proposals are submitted regarding the items on the agenda, the original proposal of the managers or shareholders presented first in time will be voted on first and then the substitute proposals, in the order in which they were made. When one proposal receives enough votes for its approval, the remaining proposals shall not be put to the vote.

4. Election of the Statutory Auditor and its alternate will require an absolute majority of all shares represented and may be performed simultaneously with the appointment of members of the Board of Directors.

5. When electing members of the Board of Directors, the Shareholders’ Meeting must consider the criteria for selection, independence and disqualifications and incompatibilities provided for by law, these Bylaws, the Regulations for Electing Members to the Board of Directors approved by the General Shareholders' meeting, those contained in the Company’s Good Governance Code, which will be shared regarding each candidate prior to voting. The election of a Board member that does not meet selection or independence criteria or is subject to disqualification or incompatibility will surpass the limits of the social contract.

Elections of independent directors shall be held by a separate vote from that of the other Board Members, unless it is ensured that the minimum number of independent members required by law or bylaws will be achieved, or, where only one slate is submitted, that slate includes the minimum number of independent members required by laws of bylaws.

Likewise, when setting the compensation for the directors, the Meeting shall consider the number and capacities of its members, their responsibilities and the time required, in such a way that such compensation adequately provides for the contribution the Company expects from its directors.

6. To guarantee the right of all shareholders to examine the proposals of the candidates to the Board of Directors received by management in advance of the General Meeting and to comply with the prior review by the Good Governance Committee, shareholders interested in submitting slates for the election of members of the Board of Directors, in compliance with the principles of corporate governance, must submit: (i) candidates to the Board of Directors within five (5) business days of the summons to the session of the General Shareholders' Meeting. The proposal must include a communication signed by the candidates indicating that they are not subject to any disqualifications or incompatibilities. Additionally, the proposal must include a written communication signed by the independent candidates indicating that they meet the criteria of independence and; and (ii) slates made up of candidates previously submitted under the former item, at least five (5) business days prior to the date of the General Shareholders' Meeting.

Slates that do not comply with the above requirements and terms will not be put to a vote. Candidates and slates must be submitted in writing, through the offices of the CEO or Secretary General or through the Investor Relations Office.

The Good Governance Committee shall evaluate (i) compliance with the independence criteria, with respect to independent candidates, and (ii) disqualifications or incompatibilities, with respect to all candidates, publishing the results of their evaluation at least six (6) business days before the date of the Assembly meeting.

7. The electoral quotient system will be applied for the election of members of the Board of Directors or any collegiate committee. This shall be determined by dividing the total number of votes validly cast by the number of persons to be elected. The count will begin with the slate that received the largest number of votes and in descending order. From each slate, as many names as the quotient in the number of votes cast by it will be declared elected, and if there are any places that remain to be filled, these will correspond to the highest residuals, counting them in the same descending order. Blank ballots will only be counted to determine the electoral quotient. If, at the time of the count, a person on one slate has already been elected because he or she appears on a previous slate, the person that comes next in the order of placement shall be chosen.

8. In the event of a tie in the residuals, in elections performed as provided for in the above rule, the position will be decided by drawing lots.

9. When the name of a candidate is repeated one or more times on the same slate, it will be understood that its name only appears on the first line of the slate they were included on. The other lines where they appear shall be understood to be occupied by the candidate immediately following them on the same slate.

10. If any slate contains a greater number of names than it should contain, the first names in the placement and up to the proper number shall be counted. If the number of names is less, the existing number of names will be counted.

11. When the Shareholders’ Meeting declares that the members of the Board of Directors have been legally elected, it shall number them in their order of appointment and election on the single slate or the several slates that, according to the number of votes received, have managed to have their candidates elected. It will thus decide the first, second, third, fourth, fifth, sixth and seventh directors.

12. Members of the Board of Directors may not be replaced in by-elections, without proceeding to a new election of the entire Board, using the electoral quotient system, unless vacancies are filled unanimously.

13. Shares that the company owns in any capacity may not vote.

Article 48. Number of debates. All the acts of the General Meeting of Shareholders, amendment of the bylaws included, shall require a single debate, at one regular or special meeting.

Article 49. Minutes. The procedures of the General Meeting of Shareholders shall be recorded in the Minutes Record, which shall be registered at the Chamber of Commerce of the main domicile.

The Minutes Record shall be signed by the President of the General Meeting and by the Secretary or ad-hoc Secretary, and in the absence of this one, by the Statutory Auditor, and they shall be approved by a committee composed of two persons elected by the General Meeting of Shareholders at the same meeting. The minutes shall contain the details and other

The resolutions of the General Shareholders Meeting regarding amendment of the bylaws and about dissolution of the corporation before the termination of its term shall be legalized by public deed executed by the President and the Secretary of the Company.

Article 50. Participation by shareholders entitled to preferred dividend and without voting rights. Shares with preference dividend do not grant their holders right to participate at the General Meeting of Shareholders and to voting except in the following cases:

1. In the event that changes that may impair the conditions or rights fixed for such shares and when the conversion of such shares into common shares are to be approved. In this event, such change shall have the approval of the majority established under No. 4 Article 46 of these Bylaws.

2. When voting the advance dissolution, merger, transformation of the corporation or change of its corporate object.

3. When the preference dividend has not been fully paid during two consecutive annual terms. In this event, holders of such shares shall retain their right to voting until the corresponding accrued dividends have been paid up to them.

4. When the General Shareholders´ Meeting orders the payment of dividends with issued shares. In this event, the decision shall be approved by the majority set forth under No. 3, Article 46 of these Bylaws.

5. If at the end of a fiscal period, the Company does not produce sufficient profits to cancel the minimum dividend, and the Superintendency of Finance by its own decision, or upon petition of holders of preference shares representing at least ten per cent (10%) of these shares, provides that benefits that decrease the profits to be distributed, had been concealed or misled, it may determine that the holders of these shares participate with right to speaking and voting at General Shareholders´ Meeting, according to the provisions of the Law.

6. When the register of shares at the Stock Exchange or at the National Register of Securities is suspended. In this event, the right to voting shall be maintained until the irregularities that determined such cancellation or suspension disappear.

CHAPTER IX

THE BOARD OF DIRECTORS

Article 51. Composition. The Board of Directors is composed of seven Directors, with the character of first, second, third, fourth, fifth, sixth and seventh, according to their order of election.

Article 52. Vacancy. The absence of a director for a period of more than three months, shall produce vacancy of his post.

Article 53. Disqualifications or incompatibilities. There may not be any majority in the Board of Directors formed by persons related to each other by marriage, or by kinship within the third degree of consanguinity, second degree of affinity, or first degree of civil relationship. Likewise, no Board member may be a Person that falls under any of the assumptions of disqualification and incompatibility defined in these Bylaws, the Good Governance Code and the Regulations for the Election of Members of the Board of Directors approved by the General Shareholders' Meeting.

Any Board elected in contravention of these Regulations may not act and the previous Board will continue performing its functions, which will immediately convene the Shareholder’s Meeting for a new election. Any and all decisions made by the Board by a majority vote in contravention of this rule will not be effective.

Article 54. Term of Directors. The Directors shall be elected for two (2) year periods, but they shall remain in their positions until their successors are elected, save when they have been removed or declared incompetent before. The directors may be re-elected and removed at the discretion of the General Meeting of Shareholders even before the termination of their term.

Article 55. Board Members. Following qualification, the directors elected by the General Meeting of Shareholders shall hold a meeting to elect a President and a Vice President.

These positions may rotate among the members of the Board of Directors, in the manner determined by the Board of Directors and will have to oversee the efficiency and best performance of the Corporation. Under any circumstances, a legal representative of the Company can be elected President of the Board of Directors. The President of the Board of Directors in coordination with the President of the Company or the Secretary will participate in the preparation of the annual Agenda of meetings and will provide necessary guidelines for the execution, will oversee the timely delivery of information to the Board

of Directors., will guide conversations with the purpose of assuring the participation of directors and the purpose of debates and will oversee evaluation processes of the body and its committees. They will also guide the interaction of directors among them and between the Board of Directors and the Shareholders.

In the event of temporary or accidental absences of the President of the Company and in a temporary way until the Board of Directors meets, the President of the Board of Directors will appoint as his deputy to one the vice-presidents who have legal representation.

Article 56. Board Meetings. The Board of Directors shall meet at least once a month on the day and at the time specified by the Board itself; and extraordinarily when summoned by itself, the Company CEO, the Statutory Auditor, or two of its own members by means of a written notice sent to the Board members, and copied to the company’s President and to the secretary, indicating the agenda and the reason for the summons.

Summons for extraordinary sessions shall be notified at least three (3) calendar days in advance, but when all the members in office are assembled, they may validly deliberate in any place and take decisions without the need for a summons.

It may also hold remote meetings under the terms provided for by law.

Article 57. Attendance of Company officials. The President of the Company shall attend the meetings of the Board with authority to speak but without right to voting. The Statutory Auditor may attend under the same conditions. In addition to these, other officials of the Company may attend, but none of them will earn special remuneration for this attendance.

Article 58. Place of meetings. The meeting of the Board of Directors shall be held at the corporate domicile or at any place, that for special cases, agree the Board.

Article 59. Functioning of the Board of Directors. The operation of the Board of Directors shall be governed by the following rules and by those determined by law, the bylaws. The Good Governance Code and all other norms or codes of the Company.

1. It shall deliberate validly without the presence of the Company´s President, Company´s Secretary or other members of the Company´s administration.

2. It shall deliberate with a minimum of four (4) members.

3. All decisions shall be made with the affirmative vote of the majority of members, except when the Law requires a higher number of votes.

4. In the event of a tie in voting proposals or resolutions, these are deemed denied. If the tie occurs when making an appointment, the voting shall be repeated, and if there is still a tie, such appointment shall be considered suspended.

5. Minutes shall be taken of all meetings, which shall be recorded in chronological order in a book, and shall include the date and time of the meeting, the names of the attendees, the matters discussed, the decisions adopted and the number of votes cast in favor, against or blank; the records left by the attendees, the appointments made and the date and time of the closing of the meeting.

6. The minutes shall be signed by the President or Vice President and by the Secretary of the meeting. The minutes of remote meetings must be signed by a legal representative and the Company Secretary.

7. In fulfilling their functions, the directors must abide to the principles set forth in the Corporate Governance Code approved by the Board of Directors.

8. When a director finds that in the exercise of their duties they may be faced with a conflict of interest, they or any other director aware of the potential conflict, shall immediately inform the other Board members. The director in a conflict situation shall, in any event, refrain from discussing and deciding on the matter giving rise to the conflict of interest; and the Board shall deliberate and decide without the participation of the directors in conflict if they are not required to form the quorum required to deliberate and decide. Otherwise, the dispute will be submitted to the competent body according to the regulations, including special regulations for financial conglomerates.

Article 60. Functions of the Board of Directors. Functions of the Board of Directors: The Board of Directors has sufficient powers to order the performance or conclusion of any act or contract included under the corporate purpose, to make any decisions required for the Company to fulfill its purpose, and, in particular, it will have the following functions in the

development of its responsibilities related to governance, senior management, business, control, and the promotion of ethical behavior:

1. Define the general policies and strategic objectives of the Company and the Group and evaluate their performance.

2. Create and abolish, subject to the legal provisions, the branches, and agencies abroad it considers necessary.

3. Fix the schedule of salaries and extralegal benefit payments.

4. Define the general structure he deems convenient for the proper management of the Company and the Group and approve the creation of vice-presidencies of the Company.

5. Designate the Company's President, his remuneration, to state his functions, to assure his following plan, and freely remove him.

6. To appoint the executives that are directed subordinated to the President, designate the general auditor and the compliance officer, to fix their evaluation policies payment and to make a follow-up to their management results and to freely remove them.

7. To determine the President's alternates in his definite, temporary, or accidental absences. This without preventing the temporary power of the President pf the Board to appoint a deputy, according to terms set up in article 55 of bylaws.

8. To designate the remaining legal representatives of the Company.

9. To authorize the establishment of affiliates and subsidiaries, subject to the legal provisions, and transfer, subscribe or alienate shares, "quotas" or right in such affiliates or subsidiaries or in other corporations or enterprises where it holds a direct share of more than 20% of the corresponding company’s stock. In any event, authorization from the Board of Directors will be required for investments or divestments in corporations where the Company holds a share of less than 20% of their stock, when the amount of the corresponding operation is greater than 5% of the value of the equity instruments account on Company’s separate balance sheet.

10. To order the issuance and regulate the subscription of common shares maintained on reserve and regulate the issuance of shares with preferential dividend and without right to voting, when delegated by the General Shareholders´ Meeting.

11. Set the date for the ordinary session of the General Shareholders' Meeting, within the period provided under these bylaws, and summon it extraordinarily when required by the Company’s unforeseen or urgent needs or when so requested by a plural number of shareholders representing no less than ten percent (10%) of the subscribed shares. In the latter case, the CEO shall submit the request to the Board of Directors at this body’s next meeting, and the summons shall be made on the date determined by the Board.

12. To give norms to the right to voting of shareholders through electronic means, according to provisions legally applicable to the Company.

13. To authorize the year-end financial statements, the management's report and the project on profits distribution or cancellation of losses, to be submitted to the General Meeting of Shareholders in its ordinary meetings.

14. To submit, together with the Company's President, to the ordinary General Meeting of Shareholders for approval or disapproval, the General Balance-Sheet as of December 31, of the immediately preceding year, accompanied by full details concerning loss and profits and the remaining Financial Statements of general purpose, the project for profits distribution, the written report from the President regarding his management, and the Board of Director's report on the Company's economic and financial condition together with pertinent accounting and statistical data and any other special data required by Law. For the latter, the Board of Directors may accept the President's report or file a different or supplemental one.

15. To determine the investment to be given to the appropriations that, with the character of special funds or of the investment reserve, has ordered the General Meeting of Shareholders, and establish or modify the policies for transitory investment of moneys not immediately necessary for the development of the business of the Company.

16. To regulate the placement of bonds on the basis that according to the law, may determine the meeting.

17. By explicit delegation from the General Meeting of Shareholders, order donations in favor of welfare, education, or civic services for the benefit of the Company employees.

18. To examine, when it deems it convenient, in person or through one or several delegates thereof, the books, documents, assets, offices and branch offices of the Company.

19. To grant authorization to the Company Administrators, in the cases and subject to the statutory requirements, to alienate or acquire shares of the corporation when dealing with operations other than speculation.

20. To appoint Centralized Securities Deposit or a specialized entity for the keeping of Company’s shareholder’s registry book.

21. Oversee the proper structure and effectiveness of the Company's internal control, risk monitoring and legal compliance system, submit the legally required reports to the General Shareholders' Meeting in this regard and make disclosures to shareholders and other investors, using the mechanisms defined in the Good Governance Code, the main risks to which the Company is exposed and its control mechanisms.

22. To designate the members of the Company's Audit Committee that will support the Board of Directors in supervising the effectiveness of the internal control system and Independence and effectiveness of the auditing.

23. To appoint members of the Risk, Good Governance, Appointment, Compensation and Development, and Audit committees and all other support committees, the Board deems convenient for the exercise of its functions.

24. To approve the Company’s Ethics Code, which will establish the principles and rules of conduct that will guide the attitude and behavior of directors, employees, officers, and collaborators regulating, among other aspects, mechanisms to prevent conflicts of interests and the use of privileged information.

25. To adopt, through approval of the Good Governance Code, any necessary measures in connection to the Company's governance, its conduct, and the information it discloses, to assure full respect of shareholders and investors' rights, the adequate management of its affairs and public disclosure of its performance and assure its compliance, reporting this to the Annual General Shareholders’ Meeting.

26. To promote respect and fair treatment of all shareholders and other securities investors, in accordance with the parameters established by the regulatory control agencies of the public stock market, the Good Governance Code and the internal regulations of the Company.

27. By approving the Good Governance Code, to regulate the procedure allowing investors to retain, at their expense and under their own responsibility, conduction of special audits on the company, regarding specific and determined matters.

28. By approving the Good Governance Code, to define any programs for information to investors, the mechanisms for adequate submission of proposals and participation in assemblies, mechanisms for appropriate attention of their interests and the system for reception of claims from investors in connection with the enforcement of the rules contained in the Good Governance Code.

29. To carry out an annual self-assessment of its performance and the performance of the Company's President. The evaluation must include all aspects detailed in the Company's Good Governance Code.

30. The Board of Directors may present proposals to the General Meeting of Shareholders in all matters considered necessary for the best operations of the Company, including among many others a proposal for remuneration of the Board of Directors.

31. To act as a consultant body for the President and the Company and, generally, exercise all other functions conferred on it by these bylaws and the law.

32. To adopt the policies for the prevention and control of ML/TF, approve the SIPLA manual, as well as its updates, and stay permanently informed about the evolution of the system.

PARAGRAPH: If a takeover bid is submitted to acquire Company shares, the Board of Directors, fulfilling its duties of diligence and loyalty toward the entity and its shareholders, and in view of its capacity as the parent company of Bancolombia S.A., a systemically important financial institution, may contract impartial third parties to comprehensively analyze and evaluate all the components of the proposal, without limiting itself to economic aspects and including its sources of funding and the capacities of the bidder, including any links to the local and international financial sector. The conclusions of the analysis contracted for consideration by the shareholders will be published to the market so shareholders can consider it when making their decision.

The foregoing is without prejudice to any confidential analyses and evaluations that may be requested by the Board of Directors for its own consideration.

Article 61. Delegation. The Board of Directors may delegate to the CEO or to a committee of Board members, whenever appropriate, for special cases or for a limited time, one or more of the functions listed in the preceding article, provided that their nature allows them to be delegated.

Article 62. Provision of vacancies. In the event of a definitive vacancy of a Director, the Board of Directors may call to a General Meeting of Shareholders to fill the vacancy, either by partial and unanimous voting or through a new election of the whole board, by the electoral quotient system as provided for in these bylaws.

CHAPTER X

PRESIDENCY

Article 63. President of the Company – Capacity. The Government and direct management of the Company shall be in the charge of the President who is appointed and removed by the Board of Directors at its own discretion.

Article 64. Replacement of the President. Upon temporary or accidental absences, and until the Board of Directors meet to appoint a deputy, the position of Company's President shall be exercised by the Vice-president indicated by the president of the Board of Directors. In the event of absolute absence, that is, because of death, accepted resignation or removal, the Board of Directors shall appoint a new President. Until such appointment is made, the Presidency of the Company shall be exercised as provided in the preceding paragraph.

Article 65. Hierarchical Superiority of the President. All the employees of the Company shall be under the authority of the President in the performance of their duties.

Article 66. Functions of the CEO. The following are the functions of the CEO, which he or she shall exercise directly or through delegates:

1. To execute the decrees and resolutions of the General Meeting of Shareholders and of the Board of Directors.

2. To create the positions, offices, or employees that he may consider necessary for the best operations of the Company; assign their functions, abolish or merger them.

3. To create and abolish, subject to the legal provisions, the branches, and agencies in the Colombian territory, necessary for the development of the corporate object.

4. To designate, remove and accept any resignations from the Company's employees, as well as fix their salaries and compensation, except those whose designation and removal correspond to the General Meeting of Shareholders, to the Board of Directors or to the Statutory Auditor. All the foregoing may be done directly or through his delegates. The President shall be responsible for evaluating annually the performance of executives that are his direct subordinates.

5. To decide as to the absences, excuses and leaves of the Company's employees, whether directly or through his delegates.

6. To order all actions concerning the acknowledgement and cancellations of benefit payments, subject to the provisions of the law and the Board of Directors.

7. To adopt the decisions related to the journalizing of depreciations, establishment of appropriations or reserves and other charges or entries to provide for depreciation, devaluation and guarantee of the Corporation's equity; method for valuation of inventories and other standards for the preparation and presentation of the inventory, the balance sheet and the profit and loss statement, subject to the laws, with the established accounting practices and the provisions of the Board of Directors.

8. To direct the placement of shares and bonds issued by the Company.

9. To call the General Meeting of Shareholders and the Board of Directors to extraordinary meetings.

10. To present in the ordinary meeting of the General Assembly a written report regarding the managing of the company, including the measures whose adoption he recommends to the Assembly, and to present to it, jointly with the Board of Directors, the general balance sheet, the complete detail of the statement of results and the other annexes and documents required by law. The Financial Statements shall be certified in accordance with the law.

11. To represent the Company to third parties.

12. To perform the functions that by virtue of delegation of the General Meeting of Shareholders or the Board of Directors are conferred on him.

13. To order the Internal General Rules of the Company.

14. To delegate any or some of his duties on the committees or officers that he considers convenient and for concrete cases; provided that these functions are not explicitly reserved to him, or those whose delegation is forbidden by the Law.

15. The president may present proposals to the General Meeting of Shareholders in all matters he consider necessary for the best operations of the Company.

16. Make decisions related to the operation, management and organization of the Company's investments.

17. All others corresponding to the position by law, these Bylaws, or the nature of the position.

CHAPTER XI

LEGAL REPRESENTATIVES OF THE COMPANY

Article 67. Legal Representation. For matters concerning the Company, the Company’s legal representation, in and out of court, shall correspond to the CEO and the Vice-Presidents, who may act jointly or separately.

These representatives have powers to conclude or execute, with no limitations other than those established in these bylaws in the case of operations that must be previously authorized by the Board of Directors or by the General Shareholders' Meeting, all acts or contracts included within the corporate purpose or merely preparatory, ancillary or complementary to the achievement of the purposes pursued by the Company, and those directly related to the Company’s existence and operation. In particular, they may settle, conciliate, arbitrate and compromise the corporate business, conclude conventions, contracts, arrangements and agreements, initiate or assist in judicial, administrative or contentious-administrative actions where the Company has an interest or must intervene, and file all appropriate remedies under the Law; withdraw any actions or remedies they may bring; novate obligations or receivables; give or receive goods in payment; configure attorneys-at-law or -in-fact, delegate powers to them, revoke mandates and proxies, and perform other acts that ensure the fulfillment of the Company's corporate purpose.

CHAPTER XII

THE SECRETARY GENERAL

Article 68. Appointment. The Company shall have a Secretary appointed by the Board of Directors, at its discretion, who shall also act as Secretary of the General Meeting of Shareholders, the Board of Directors, and the Presidency. For his appointment, the Board of Directors will accept a report prepared by a Board Committee as stated in the Good Governance Code.

Article 69. Functions of the Secretary. The Secretary shall:

1. Coordinate the organization of the meeting of the General Meeting of Shareholders and the Board of Directors.

2. Communicate the calls to the meetings of the General Meeting of Shareholders and the Board of Directors.

3. Attend the meetings of the General Meeting of Shareholders and the Board of Directors.

4. Maintain, subject to the law, the minutes record of the General Meeting of Shareholders and the Board of Directors and authorize with his signature any copies issued thereof.

5. To oversee the Shareholder’s registry book.

6. In his capacity as Vice-President, exercise the Company's legal representation.

7. Any others of special character conferred on him by the General Meeting of Shareholders, the Board of Directors, and the Presidency

CHAPTER XIII

AUDITING

Article 70. Appointment. The Statutory Auditor and its Substitute shall be designated by the General Assembly of Shareholders for periods of two (2) years, but they can be reelected indefinitely and removed by the Assembly at any time. The Substitute shall replace the principal in all the cases of absolute or temporary absence. Election of the Statutory Auditor according to Good Governance Code, shall be based on an objective and public evaluation conducted by the Company's Audit Committee, and submitted through the Board of Directors, on a fully transparent basis, with the previous analysis of at least two alternatives in aspects such as services offered, fees and expenses, experience, area knowledge, etc.

Article 71. Qualification. The Statutory Auditor and his Alternate shall be registered public accountants. Should a legal person be appointed as Statutory Auditor, this one shall appoint a registered accountant to audit the Company accounts.

Article 72. Inabilities. Anybody who is a partner of the same corporation or of its affiliates, one holding any other position at the Company, and the one he who is bound by marriage or kinship within the fourth degree of consanguinity, first civil or second of affinity, that is, copartner of the administrators and management officials, cashiers, treasures, Statutory Auditor, and accountant of the Company may not occupy the position of Statutory Auditor.

Article 73. Incompatibilities. The Statutory Auditor shall not hold any other position either at the Company or at its affiliates, and he is also forbidden to enter contracts with the corporation or to acquire shares thereof.

Article 74. Functions. The Statutory Auditor shall carry out the functions provided in the Second Book, Title I, Chapter VIII, of the Commerce Code, and is subject to the provisions therein, without harm to other provisions of other laws and regulations and the General Shareholders Assembly while it is compatible with the Examiner’s legal obligations.

PARAGRAPH: Revelation of findings: The Statutory Auditor, in his report to the Shareholders Assembly, shall include, in addition to what is required by law, the relevant findings he produces, so that the shareholders and other investors may rely on the necessary information to make decisions regarding the corresponding securities.

Article 75. Remuneration. The Statutory Auditor's remuneration shall be fixed by the General Meeting of Shareholders. The General Meeting of Shareholders where the Statutory Auditor is appointed shall include information related to the appropriations foreseen for the supply of human and technical resources, allocated to the performance of his functions.

CHAPTER XIII

BALANCES, PROFITS, RESERVE AND DIVIDENDS

Article 76. Intermediate Financial Statements. The Company's intermediate financial statements shall be prepared on the last day of each month.

Article 77. Financial Statements. The company fiscal year shall be the calendar year. As of the thirty-first (31) of December, the company shall prepare a General Financial Statement, an income statement corresponding to the fiscal year ending on such date, and an inventory detailing all assets and liabilities of the company, in accordance with all legal requirements and established accounting regulations, which shall be submitted for consideration to the General Shareholders Meeting, together with the reports, projections and other documents required by law.

The company shall state the economic result of the company as a profit or loss per each issued share. This does not preclude that such results be, in addition, expressed in the aggregate, if so, accepted by the Shareholders Meeting.

Financial Statements shall be published in the manner provided by the relevant regulations.

PARAGRAPH: The Company shall also present and make available, as applicable and in the manner and periodicity required by law, the consolidated financial statements with its subsidiaries, stating the financial condition, the results of operation, changes in the capital and the cash flows between the Company and its subsidiaries.

Article 78. Legal Reserve. The Company has established a legal reserve. Such reserve must amount to at least fifty percent (50%) of the subscribed capital, for which purpose ten percent (10%) of each year's profits shall be taken. Once the said limit has been reached, a lesser percentage or no amount may be set aside for said reserve. However, should the reserve fall below fifty percent (50%) of the subscribed capital, it shall be necessary to reach the limit in the manner stated above.

Article 79. Distribution of profits. Once the Balance Sheet has been approved, the appropriation for the payment of taxes of the corresponding taxable year has been made, and the transfers to the legal reserve, the General Meeting of Shareholders shall proceed to decree the distribution of the net profits, providing for reserves and dividends. The distribution of profits shall be made pro rata to the portion of the nominal value of the shares already paid. The amount of the profits to be distributed may not be less than the minimum percentage that shall be distributed among shareholders, according to the laws,

except when the General Meeting of Shareholders determines otherwise, with the majority established by the same laws, and provided that the undistributed benefits are assigned to the legal reserve, or to the statutory and voluntary reserves, prior fulfillment of the provisions contained in the law and in these bylaws.

PARAGRAPH: The General Meeting of Shareholders may allocate a portion of the profits to welfare, education, or civic services, or to support economic organizations of the Company employees.

Article 80. Shares with Preferred Dividend and without Right to Voting. Shares with preferred dividend, and without right to voting, are entitled to payment, on the profits of the fiscal year, after canceling the losses affecting the capital, once the amount that shall be legally set apart for the legal reserve has been deducted, and before creating or accruing any other reserve, of a minimum preferred dividend equal one per cent (1%) yearly on the subscription price of the share, provided this dividend is higher than the dividend assigned to ordinary shares, otherwise, the latter shall be recognized. The dividend received by holders of ordinary shares may not be higher than the dividend assigned to preferred shares. Payment of preferred dividend shall be made on the time and manner established by the competent corporate body and with the priority indicated by the law.

Article 81. Dividend periods. The dividend periods may be different from the periods of the general balance sheet. It is incumbent upon the General Meeting to determine such dividend periods, the effective date of such, the system and place for its payment.

Article 82. Claim of dividends. The Company shall not recognize interest on dividends that are not claimed on due time and they shall remain in the charge of the Company at the disposal of their owners.

Dividends not claimed within ten (10) years after they are caused are not withdrawable and shall be transferred to the reserve.

Article 83. Dividends in stocks. Subject to the decision of the General Meeting of Shareholders, the dividend may be payable in stock. This decision shall be compulsory to the stockholder's provided it has been approved of the majority in the manner provided for on number 3 of article 46 of these Bylaws. In the absence of this majority, the stockholder is free either to receive the stock dividend or to demand payment in cash.

Article 84. Absorption of Corporate Loss. Losses are cancelled with the reserves especially assigned to this purpose, lastly, with the legal reserve.

The reserves whose end is the absorption of specific losses may not be used to cover different losses, unless otherwise provided by the Stockholder's Meeting.

If the legal reserve is insufficient to cover the capital deficit, the social benefits of the following years will be applied to this purpose

Before losses from previous fiscal years affecting the capital are cancelled, profits may not be distributed; the losses affect the capital when because of them, the net capital decreases below the subscribed capital.

CHAPTER XIV

DISSOLUTION AND LIQUIDATION

Article 85. Dissolution. The corporation shall be dissolved:

1. Due to the expiration of its term unless it is validly extended before its maturity.

2. When 95% or more of the issued stock belong to a single stockholder.

3. By reduction of the number of stockholders below the number required by the law for its establishment and operation.

4. By decision of competent authority in the cases provided by the laws.

5. By decision of the General Meeting of Shareholders.

6. Because of the impossibility for the corporation to develop the corporate purpose, the termination of it or the extinction of the thing or things object of its exploitation.

7. By any other cause set forth in the laws.

If legally possible, the Corporation may avoid that the occurrence of a cause of dissolution may have irreversible effect, if it promptly adopts the measures and remedies provided or permitted by the law and if it carries out the formalities demanded by the situation.

Article 86. Dissolution formalities. After the dissolution of the Company is declared, due to any causes expressed in law or in its bylaws, compliance with formalities stated in these bylaws and in norms in force shall be followed.

Article 87. Liquidation. Once the corporation is dissolved, its liquidation shall be performed therewith. It shall not, therefore, initiate new operations in the development of its object and shall maintain its legal capacity only for the acts necessary for the immediate liquidation.

The name of the Company, once dissolved, shall always be accompanied with the legend, "under liquidation".

Article 88. Appointment of the liquidator. The liquidation and division of the capital shall be performed, subject to the legal provisions, by a special liquidator appointed by the General Shareholders' Meeting, without prejudice to the fact that the General Meeting may appoint several liquidators and determine, in such event, if they shall act jointly or separately.

The General Shareholders' Meeting shall appoint an alternate liquidator. Until the appointment of the liquidator and his alternate are made and registered at the Chamber of Commerce of the Corporate domicile, the President of the Company, at the moment it starts its liquidation, shall act as liquidator and the members of the Board of Directors shall act as his alternates in the order of precedence, except for the chairman of the Board.

Article 89. Rules for winding up. The Company will be wound up and its assets divided under mercantile law, including applicable regulations under the Civil Code, and observing the following rules:

1. The General Shareholders' Meeting shall be convened and shall meet at the times, in the manner and according to the terms prescribed for ordinary meetings and, extraordinarily, as many times as it is convened by the receiver, the Statutory Auditor, the Superintendent’s Office, or when requested by a plural number of shareholders representing no less than 10 % of the subscribed shares, and subject to the provisions of these Bylaws. At such meetings, it shall perform all functions compatible with the state of liquidation and, in particular, those related to freely appointing, changing and removing the receiver(s) and their deputies, holding them to account, determining the assets to be distributed in kind and establishing priorities for the realization of assets, forms and deadlines for realization, contracting the price of the receivers’ services and adopt any other appropriate determinations by law.

2. The General Shareholders’ Meeting may determine which property shall be distributed in kind, fix the value of such property or the manner of determining it, establish the manner of its assignment and authorize the liquidator to carry out the corresponding distribution, subject to the requirements of the law. The meeting shall have the power to authorize the assignment of in "proindiviso" assets by groups of shareholders, make arrangements for the sale of assets through private treaty among the shareholders or with the participation of external bidders, and arrange for the use of other approaches deemed proper.

3. Absolute majority of the votes present, shall be sufficient for the approval of the periodic accounts submitted by the liquidator, or of the occasional accounts he may be required to give as well as to authorize the assignment of property in kind, payments in kind, to carry out the transactions necessary or convenient to facilitate or conclude the liquidation, for the approval of the final account of the liquidation and the minute of the distribution.

Article 90. Duties of the liquidator. The liquidator or liquidators shall exercise their functions subject to the following standards:

1. They shall inform all creditors, in the manner required by the law, about the condition of liquidation of the Company.

2. They shall make the inventory of assets and liabilities and submit it to the approval of the Superintendency if it were required by applicable law, in compliance with the pertinent legal provisions.

3. They shall also conclude any pending operations, require that previous administrators render account of the management of the Company's business, collect the "active" credits of the corporation, alienate the corporate property, subject to the rules approved by the meeting, maintain and custody the books and the correspondence, render accounts or present statements of liquidation and, in general, do anything deemed necessary for the extinction of the Company.

4. The liquidator or liquidators shall cancel all the external liabilities before distributing the balance to the stockholders.

5. The balance of the assets shall be distributed among the stockholders, pro rata of the shares owned by each one.

6. The minute of distribution, once approved by the meeting, shall be legalized at a notary of the corporate domicile, together with the inventory procedures and the judicial action, in its case.

7. Once the final account of the liquidation has been approved by the General Meeting of Shareholders, each shareholder will be given his part in the manner determined by the law.

8. Once the liquidation has been duly concluded, its final approval shall be requested from the Superintendency if it were required by applicable law.

Article 91. Administrative liquidation. When the Superintendente de Sociedades (Superintendent of Corporations) has the assets, property, and business of the corporation under his possession, for its liquidation, the relevant legal provisions shall be applied.

Article 92. Price-Matching Obligation. (a) In the event that, after the date on which the Company´s shares begin to be traded on the Colombian Stock Exchange (the "Cut-off Date"), any beneficial owner of common shares in the Company that owns less than 25% of such shares on the Cut-off Date should acquire, in one or more transactions, directly or indirectly, during a period of 12 months following the first acquisition after the Cut-off Date ("Matching Period One"), ordinary shares that lead them to have a shareholding interest greater than 25% of the Company’s common shares, will be obliged to pay to each Seller that disposed of their common shares during Matching Period One, an amount equal to the difference between, (x) the highest price per common share in the Company paid by the beneficial owner during Matching Period One and, (y) the Company's common share price paid to Seller (“Matching Value One"). (b) Any beneficial owner who acquires common shares in the Company via an Initial Takeover Bid, and subsequently acquires, in one or more transactions, directly or indirectly, during a period of 12 months following the award of the Initial Takeover Bid ("Matching Period Two"), additional shareholding that increases its percentage of the Company's common stock by 5% or more, shall be obliged to pay each Seller that disposed of its common shares in the Company during Matching Period Two, an amount equal to the difference between, (x) the highest price per common share of the Company paid by the beneficial owner during Matching Period Two and, (y) the price per common share in the Company paid to the Seller (“Matching Value Two"). Once Matching Period Two has expired, if the beneficial owner makes a new Takeover Bid for common shares in the Company, that offer shall be considered a new Initial Takeover Bid and the provisions of this Article 95 shall be reapplied.

FIRST PARAGRAPH: Under this Article 92, (i) "acquire" shall mean any act by which a person or group of persons becomes, directly or indirectly, the beneficial owner of common shares in the Company; (ii) "beneficial owner" shall have the meaning given to this term in Decree 2555/2010, Article 6.1.1.1.3; (iii) the "Seller" shall mean a holder of common stock in the Company that sells his or her shares subject to subparagraph (a) or (b) of this Article 92; (iv) "Initial Takeover Bid" shall mean a public offering of shares (“Takeover Bid”) under the terms of Decree 2555, Article 6.15.2.1.1., awarded after the Cut-off Date; (v) "Matching Value" shall mean Matching Value One, or Matching Value Two, as applicable to subparagraph (a) or (b).

SECOND PARAGRAPH: When Takeover Bid or Bids are made in United States Dollars or another currency, the sum in Colombian pesos calculated at the current representative market rate certified by the Colombian Financial Superintendent on the date or dates defined in the corresponding takeover booklet will be used to determine the price and apply the provisions of this article.

THIRD PARAGRAPH: For payment of the Matching Value to Sellers: (i) A beneficial owner that has acquired common shares in the Company under subparagraph (a) or (b) of this Article 92 (the “Buyer") will be obliged to notify the Company (1) that the obligation to pay the Matching Value exists, (2) the date on which the said obligation arose, and (3) the period covered by Matching Period One, in the case of subparagraph (a), or the expiration date of Matching Period Two, in the case of subparagraph (b). (ii) Once the Company receives the information referred to in the preceding paragraph from the Buyer, it shall inform the market, using the appropriate reporting mechanism. (iii) The Buyer shall, no more than forty-five calendar days after the obligation to pay the Matching Value has arisen, lift the stock exchange reserve and grant any and all other consents and documents required to make effective the provisions of this Article 92, and to allow Sellers to verify if they are creditors of the Matching Value. Likewise, and during the same forty-five calendar day period, the Buyer shall establish the process for, directly or through a third party, receiving requests for payment of the Matching Value from Sellers, verify whether payment is applicable, and perform any and all other activities required for payment of the Matching Value to the Sellers. (iv) Buyer shall pay the Matching Value to Sellers no later than 15 business days from the date on which it receives the corresponding payment request from Seller.

FOURTH PARAGRAPH: If the Buyer fails to meet its reporting obligations under this Article 92 or fails to pay the Matching Value under the terms set forth in this Article 92, the Buyer agrees that (i) it will be in default and will therefore pay default interest at the highest rate permitted by law as of the date payment was due under the Third Paragraph; and (ii) it will be liable for any other damages caused to each holder of common shares in the Company due to its non-performance or late or defective performance of its obligation to pay the Matching Value.

Document

GRUPO CIBEST S.A.

AND

THE BANK OF NEW YORK MELLON

As Depositary

AND

OWNERS AND HOLDERS OF AMERICAN DEPOSITARY SHARES

Deposit Agreement

May 16, 2025

-1-

TABLE OF CONTENTS

ARTICLE 1. DEFINITIONS.....................................................................1

SECTION 1.1. American Depositary Shares....................................1

SECTION 1.2. Commission. ............................................................2

SECTION 1.3. Company..................................................................2

SECTION 1.4. Custodian. ................................................................2

SECTION 1.5. Deliver; Surrender....................................................2

SECTION 1.6. Deposit Agreement. .................................................3

SECTION 1.7. Depositary; Depositary’s Office. .............................3

SECTION 1.8. Deposited Securities.................................................3

SECTION 1.9. Disseminate..............................................................3

SECTION 1.10. Dollars......................................................................3

SECTION 1.11. DTC..........................................................................4

SECTION 1.12. Foreign Registrar. ....................................................4

SECTION 1.13. Holder. .....................................................................4

SECTION 1.14. Owner.......................................................................4

SECTION 1.15. Receipts....................................................................4

SECTION 1.16. Registrar...................................................................4

SECTION 1.17. Replacement.............................................................4

SECTION 1.18. Restricted Securities.................................................5

SECTION 1.19. Securities Act of 1933..............................................5

SECTION 1.20. Shares.......................................................................5

SECTION 1.21. SWIFT......................................................................5

SECTION 1.22. Superintendency of Finance.....................................5

SECTION 1.23. Termination Option Event. ......................................5

ARTICLE 2. FORM OF RECEIPTS, DEPOSIT OF SHARES,

DELIVERY, TRANSFER AND SURRENDER OF AMERICAN

DEPOSITARY SHARES ............................................................................6

SECTION 2.1. Form of Receipts; Registration and Transferability of

American Depositary Shares............................................................6

SECTION 2.2. Deposit of Shares. ....................................................7

SECTION 2.3. Delivery of American Depositary Shares. ...............8

SECTION 2.4. Registration of Transfer of American Depositary

Shares; Combination and Split-up of Receipts; Interchange of

Certificated and Uncertificated American Depositary Shares. ........9

SECTION 2.5. Surrender of American Depositary Shares and

Withdrawal of Deposited Securities. .............................................10

SECTION 2.6. Limitations on Delivery, Registration of Transfer

and Surrender of American Depositary Shares..............................11

SECTION 2.7. Lost Receipts, etc. ..................................................11

SECTION 2.8. Cancellation and Destruction of Surrendered

Receipts. 12

SECTION 2.9. DTC Direct Registration System and Profile

Modification System......................................................................12

-2-

ARTICLE 3. CERTAIN OBLIGATIONS OF OWNERS AND

HOLDERS OF AMERICAN DEPOSITARY SHARES ..........................13

SECTION 3.1. Filing Proofs, Certificates and Other Information. 13

SECTION 3.2. Liability of Owner for Taxes. ................................13

SECTION 3.3. Warranties on Deposit of Shares............................13

SECTION 3.4. Disclosure of Interests............................................14

SECTION 3.5. Ownership Restrictions..........................................14

ARTICLE 4. THE DEPOSITED SECURITIES .....................................15

SECTION 4.1. Cash Distributions..................................................15

SECTION 4.2. Distributions Other Than Cash, Shares or Rights..16

SECTION 4.3. Distributions in Shares...........................................17

SECTION 4.4. Rights. ....................................................................17

SECTION 4.5. Conversion of Foreign Currency. ..........................19

SECTION 4.6. Fixing of Record Date............................................20

SECTION 4.7. Voting of Deposited Shares. ..................................21

SECTION 4.8. Tender and Exchange Offers; Redemption,

Replacement or Cancellation of Deposited Securities...................22

SECTION 4.9. Reports. ..................................................................24

SECTION 4.10. Lists of Owners. .....................................................24

SECTION 4.11. Withholding. ..........................................................24

ARTICLE 5. THE DEPOSITARY, THE CUSTODIANS AND THE

COMPANY 25

SECTION 5.1. Maintenance of Office and Register by the

Depositary. 25

SECTION 5.2. Prevention or Delay of Performance by the Company

or the Depositary............................................................................25

SECTION 5.3. Obligations of the Depositary and the Company...26

SECTION 5.4. Resignation and Removal of the Depositary. ........27

SECTION 5.5. The Custodians.......................................................28

SECTION 5.6. Notices and Reports. ..............................................28

SECTION 5.7. Distribution of Additional Shares, Rights, etc.......29

SECTION 5.8. Indemnification. .....................................................30

SECTION 5.9. Charges of Depositary............................................30

SECTION 5.10. Retention of Depositary Documents......................31

SECTION 5.11. Exclusivity. ............................................................31

SECTION 5.12. Information for Regulatory Compliance................31

ARTICLE 6. AMENDMENT AND TERMINATION ...........................32

SECTION 6.1. Amendment............................................................32

SECTION 6.2. Termination............................................................32

ARTICLE 7. MISCELLANEOUS ..........................................................33

SECTION 7.1. Counterparts; Signatures; Delivery; Electronic

Records. 33

SECTION 7.2. No Third Party Beneficiaries. ................................34

SECTION 7.3. Severability. ...........................................................34

SECTION 7.4. Owners and Holders as Parties; Binding Effect.....34

-3-

SECTION 7.5. Notices. ..................................................................34

SECTION 7.6. Appointment of Agent for Service of Process;

Submission to Jurisdiction; Jury Trial Waiver...............................35

SECTION 7.7. Waiver of Immunities. ...........................................36

SECTION 7.8. Governing Law. .....................................................37

DEPOSIT AGREEMENT

DEPOSIT AGREEMENT dated as of May 16, 2025 among GRUPO CIBEST S.A., a company incorporated under the laws of the Republic of Colombia (herein called the Company), THE BANK OF NEW YORK MELLON, a New York banking corporation (herein called the Depositary), and all Owners and Holders (each as hereinafter defined) from time to time of American Depositary Shares issued hereunder.

W I T N E S S E T H:

WHEREAS, the Company desires to provide, as set forth in this Deposit Agreement, for the deposit of Shares (as hereinafter defined) of the Company from time to time with the Depositary or with the Custodian (as hereinafter defined) under this Deposit Agreement, for the creation of American Depositary Shares representing the Shares so deposited and for the execution and delivery of American Depositary Receipts evidencing the American Depositary Shares; and

WHEREAS, the American Depositary Receipts are to be substantially in the form of Exhibit A annexed to this Deposit Agreement, with appropriate insertions, modifications and omissions, as set forth in this Deposit Agreement;

NOW, THEREFORE, in consideration of the premises, it is agreed by and between the parties hereto as follows:

ARTICLE 1.    DEFINITIONS

The following definitions shall for all purposes, unless otherwise clearly

indicated, apply to the respective terms used in this Deposit Agreement:

SECTION 1.1.    American Depositary Shares.

The term “American Depositary Shares” shall mean the securities created under this Deposit Agreement representing rights with respect to the Deposited Securities. American Depositary Shares may be certificated securities evidenced by Receipts or uncertificated securities. The form of Receipt annexed as Exhibit A to this Deposit Agreement shall be the prospectus required under the Securities Act of 1933 for sales of both certificated and uncertificated American Depositary Shares. Except for those

-4-

provisions of this Deposit Agreement that refer specifically to Receipts, all the provisions of this Deposit Agreement shall apply to both certificated and uncertificated American Depositary Shares.

Each American Depositary Share shall represent the number of Shares specified in Exhibit A to this Deposit Agreement, except that, if there is a distribution upon Deposited Securities covered by Section 4.3, a change in Deposited Securities covered by Section 4.8 with respect to which additional American Depositary Shares are not delivered or a sale of Deposited Securities under Section 3.2 or 4.8, each American Depositary Share shall thereafter represent the amount of Shares or other Deposited Securities that are then on deposit per American Depositary Share after giving effect to that distribution, change or sale.

SECTION 1.2.    Commission.

The term “Commission” shall mean the Securities and Exchange Commission of the United States or any successor governmental agency in the United States.

SECTION 1.3.    Company.

The term “Company” shall mean Grupo Cibest S.A., a company incorporated under the laws of the Republic of Colombia, and its successors.

SECTION 1.4.    Custodian.

The term “Custodian” shall mean Fiduciaria Bancolombia S.A., as custodian for the Depositary in Colombia for the purposes of this Deposit Agreement, and any other firm or corporation the Depositary appoints under Section 5.5 as a substitute or additional custodian under this Deposit Agreement, and shall also mean all of them collectively.

SECTION 1.5.    Deliver; Surrender.

(a)     The term “deliver”, or its noun form, when used with respect to Shares or other Deposited Securities, shall mean (i) book-entry transfer of those Shares or other Deposited Securities to an account maintained by an institution authorized under applicable law to effect transfers of such securities designated by the person entitled to that delivery or (ii) physical transfer of certificates evidencing those Shares or other Deposited Securities registered in the name of, or duly endorsed or accompanied by proper instruments of transfer to, the person entitled to that delivery.

(b)    The term “deliver”, or its noun form, when used with respect to American Depositary Shares, shall mean (i) registration of those American Depositary Shares in the name of DTC or its nominee and book-entry transfer of those American Depositary Shares to an account at DTC designated by the person entitled to that delivery,

-5-

(ii) registration of those American Depositary Shares not evidenced by a Receipt on the books of the Depositary in the name requested by the person entitled to that delivery and mailing to that person of a statement confirming that registration or (iii) if requested by the person entitled to that delivery, execution and delivery at the Depositary’s Office to the person entitled to that delivery of one or more Receipts evidencing those American Depositary Shares registered in the name requested by that person.

(c)    The term “surrender”, when used with respect to American Depositary Shares, shall mean (i) one or more book-entry transfers of American Depositary Shares to the DTC account of the Depositary, (ii) delivery to the Depositary at its Office of an instruction to surrender American Depositary Shares not evidenced by a Receipt or (iii) surrender to the Depositary at its Office of one or more Receipts evidencing American Depositary Shares.

SECTION 1.6.    Deposit Agreement.

The term “Deposit Agreement” shall mean this Deposit Agreement, as it may be amended from time to time in accordance with the provisions of this Deposit Agreement.

SECTION 1.7.    Depositary; Depositary’s Office.

The term “Depositary” shall mean The Bank of New York Mellon, a New York banking corporation, and any successor as depositary under this Deposit Agreement. The term “Office”, when used with respect to the Depositary, shall mean the office at which its depositary receipts business is administered, which, at the date of this Deposit Agreement, is located at 240 Greenwich Street, New York, New York 10286.

SECTION 1.8.    Deposited Securities.

The term “Deposited Securities” as of any time shall mean Shares at such time deposited or deemed to be deposited under this Deposit Agreement, including without limitation, Shares that have not been successfully delivered upon surrender of American Depositary Shares, and any and all other securities, property and cash received by the Depositary or the Custodian in respect of Deposited Securities and at that time held under this Deposit Agreement.

SECTION 1.9.    Disseminate.

The term “Disseminate,” when referring to a notice or other information to be sent by the Depositary to Owners, shall mean (i) sending that information to Owners in paper form by mail or another means or (ii) with the consent of Owners, another procedure that has the effect of making the information available to Owners, which may include (A) sending the information by electronic mail or electronic messaging or (B) sending in paper

-6-

form or by electronic mail or messaging a statement that the information is available and may be accessed by the Owner on an Internet website and that it will be sent in paper form upon request by the Owner, when that information is so available and is sent in paper form as promptly as practicable upon request.

SECTION 1.10.    Dollars.

The term “Dollars” shall mean United States dollars.

SECTION 1.11.    DTC.

The term “DTC” shall mean The Depository Trust Company or its successor.

SECTION 1.12.    Foreign Registrar.

The term “Foreign Registrar” shall mean the entity that carries out the duties of registrar for the Shares and any other agent of the Company for the transfer and registration of Shares, including, without limitation, any securities depository for the Shares.

SECTION 1.13.    Holder.

The term “Holder” shall mean any person holding a Receipt or a security entitlement or other interest in American Depositary Shares, whether for its own account or for the account of another person, but that is not the Owner of that Receipt or those American Depositary Shares.

SECTION 1.14.    Owner.

The term “Owner” shall mean the person in whose name American Depositary Shares are registered on the books of the Depositary maintained for that purpose.

SECTION 1.15.    Receipts.

The term “Receipts” shall mean the American Depositary Receipts issued under this Deposit Agreement evidencing certificated American Depositary Shares, as the same may be amended from time to time in accordance with the provisions of this Deposit Agreement.

SECTION 1.16.    Registrar.

The term “Registrar” shall mean any corporation or other entity that is appointed by the Depositary to register American Depositary Shares and transfers of American Depositary Shares as provided in this Deposit Agreement.

-7-

SECTION 1.17.    Replacement.

The term “Replacement” shall have the meaning assigned to it in Section 4.8.

SECTION 1.18.    Restricted Securities.

The term “Restricted Securities” shall mean Shares that (i) are “restricted securities,” as defined in Rule 144 under the Securities Act of 1933, except for Shares that could be resold in reliance on Rule 144 without any conditions, (ii) are beneficially owned by an officer, director (or person performing similar functions) or other affiliate of the Company, (iii) otherwise would require registration under the Securities Act of 1933 in connection with the public offer and sale thereof in the United States or (iv) are subject to other restrictions on sale or deposit under the laws of the Republic of Colombia, a shareholder agreement or the By-laws of the Company.

SECTION 1.19.    Securities Act of 1933.

The term “Securities Act of 1933” shall mean the United States Securities Act of 1933, as from time to time amended.

SECTION 1.20.    Shares.

The term “Shares” shall mean preferred shares of the Company that are validly issued and outstanding, fully paid and nonassessable and that were not issued in violation of any pre-emptive or similar rights of the holders of outstanding securities of the Company; provided, however, that, if there shall occur any change in nominal or par value, a split-up or consolidation or any other reclassification or, upon the occurrence of an event described in Section 4.8, an exchange or conversion in respect of the Shares of the Company, the term “Shares” shall thereafter also mean the successor securities resulting from such change in nominal value, split-up or consolidation or such other reclassification or such exchange or conversion.

SECTION 1.21.    SWIFT.

The term “SWIFT” shall mean the financial messaging network operated by the Society for Worldwide Interbank Financial Telecommunication, or its successor.

SECTION 1.22.    Superintendency of Finance.

The term “Superintendency of Finance” shall mean the Colombian Superintendency of Finance (“Superintendencia Financiera de Colombia”), a technical

-8-

entity under the Ministry of Finance and Public Credit (“Ministerio de Hacienda y Crédito Público”) who supervises entities involved in financial activities, capital markets and insurance industries in Colombia.

SECTION 1.23.    Termination Option Event.

The term “Termination Option Event” shall mean any of the following events or conditions:

(i)    the Company institutes proceedings to be adjudicated as bankrupt or insolvent, consents to the institution of bankruptcy or insolvency proceedings against it, files a petition or answer or consent seeking reorganization or relief under any applicable law in respect of bankruptcy or insolvency, consents to the filing of any petition of that kind or to the appointment of a receiver, liquidator, assignee, trustee, custodian or sequestrator (or other similar official) of it or any substantial part of its property or makes an assignment for the benefit of creditors, or if information becomes publicly available indicating that unsecured claims against the Company are not expected to be paid;

(ii)    the Shares are delisted, or the Company announces its intention to delist the Shares, from a stock exchange outside the United States, and the Company has not applied to list the Shares on any other stock exchange outside the United States;

(iii)    the American Depositary Shares are delisted from a stock exchange in the United States on which the American Depositary Shares were listed and, 30 days after that delisting, the American Depositary Shares have not been listed on another stock exchange in the United States, nor is there a symbol available for over-the-counter trading of the American Depositary Shares in the United States;

(iv)    the Depositary has received notice of facts that indicate, or otherwise has reason to believe, that the American Depositary Shares have become, or with the passage of time will become, ineligible for registration on Form F-6 under the Securities Act of 1933; or

(v)    an event or condition that is defined as a Termination Option Event in Section 4.1, 4.2 or 4.8.

ARTICLE 2. FORM OF RECEIPTS, DEPOSIT OF SHARES, DELIVERY, TRANSFER AND SURRENDER OF AMERICAN DEPOSITARY SHARES

SECTION 2.1.    Form of Receipts; Registration and Transferability of American Depositary Shares.

Definitive Receipts shall be substantially in the form set forth in Exhibit A to this Deposit Agreement, with appropriate insertions, modifications and omissions, as permitted under this Deposit Agreement. No Receipt shall be entitled to any benefits under this Deposit Agreement or be valid or obligatory for any purpose, unless that Receipt has

-9-

been (i) executed by the Depositary by the manual signature of a duly authorized officer of the Depositary or (ii) executed by the facsimile signature of a duly authorized officer of the Depositary and countersigned by the manual signature of a duly authorized signatory of the Depositary or the Registrar or a co-registrar. The Depositary shall maintain books on which (x) each Receipt so executed and delivered as provided in this Deposit Agreement and each transfer of that Receipt and (y) all American Depositary Shares delivered as provided in this Deposit Agreement and all registrations of transfer of American Depositary Shares, shall be registered. A Receipt bearing the facsimile signature of a person that was at any time a proper officer of the Depositary shall, subject to the other provisions of this paragraph, bind the Depositary, even if that person was not a proper officer of the Depositary on the date of issuance of that Receipt.

The Receipts and statements confirming registration of American Depositary Shares may have incorporated in or attached to them such legends or recitals or modifications not inconsistent with the provisions of this Deposit Agreement as may be required by the Depositary or required to comply with any applicable law or regulations thereunder or with the rules and regulations of any securities exchange upon which American Depositary Shares may be listed or to conform with any usage with respect thereto, or to indicate any special limitations or restrictions to which any particular Receipts and American Depositary Shares are subject by reason of the date of issuance of the underlying Deposited Securities or otherwise.

American Depositary Shares evidenced by a Receipt, when the Receipt is properly endorsed or accompanied by proper instruments of transfer, shall be transferable as certificated registered securities under the laws of the State of New York. American Depositary Shares not evidenced by Receipts shall be transferable as uncertificated registered securities under the laws of the State of New York. The Depositary, notwithstanding any notice to the contrary, may treat the Owner of American Depositary Shares as the absolute owner thereof for the purpose of determining the person entitled to distribution of dividends or other distributions or to any notice provided for in this Deposit Agreement and for all other purposes, and neither the Depositary nor the Company shall have any obligation or be subject to any liability under this Deposit Agreement to any Holder of American Depositary Shares (but only to the Owner of those American Depositary Shares).

SECTION 2.2.     Deposit of Shares.

Subject to the terms and conditions of this Deposit Agreement, Shares or evidence of rights to receive Shares may be deposited under this Deposit Agreement by delivery thereof to any Custodian, accompanied by any appropriate instruments or instructions for transfer, or endorsement, in form satisfactory to the Custodian.

As conditions of accepting Shares for deposit, the Depositary may require (i) any certification required by the Depositary or the Custodian in accordance with the provisions of this Deposit Agreement, (ii) a written order directing the Depositary to

-10-

deliver to, or upon the written order of, the person or persons stated in that order American Depositary Shares representing those deposited Shares, (iii) evidence satisfactory to the Depositary that those Shares have been re-registered in the books of the Company or the Foreign Registrar in the name of the Depositary, a Custodian or a nominee of the Depositary or a Custodian, (iv) evidence satisfactory to the Depositary that any necessary approval for the transfer or deposit has been granted by any governmental body in each applicable jurisdiction and (v) an agreement or assignment, or other instrument satisfactory to the Depositary, that provides for the prompt transfer to the Custodian of any dividend, or right to subscribe for additional Shares or to receive other property, that any person in whose name those Shares are or have been recorded may thereafter receive upon or in respect of those Shares, or, in lieu thereof, such agreement of indemnity or other agreement as shall be satisfactory to the Depositary.

At the request and risk and expense of a person proposing to deposit Shares, and for the account of that person, the Depositary may receive certificates for Shares to be deposited, together with the other instruments specified in this Section, for the purpose of forwarding those Share certificates to the Custodian for deposit under this Deposit Agreement.

The Depositary shall instruct each Custodian that, upon each delivery to a Custodian of a certificate or certificates for Shares to be deposited under this Deposit Agreement, together with the other documents specified in this Section, that Custodian shall, as soon as transfer and recordation can be accomplished, present that certificate or those certificates to the Company or the Foreign Registrar, if applicable, for transfer and recordation of the Shares being deposited in the name of the Depositary or its nominee or that Custodian or its nominee.

Deposited Securities shall be held by the Depositary or by a Custodian for the account and to the order of the Depositary or at such other place or places as the Depositary shall determine.

SECTION 2.3.    Delivery of American Depositary Shares.

The Depositary shall instruct each Custodian that, upon receipt by that Custodian of any deposit pursuant to Section 2.2, together with the other documents or evidence required under that Section, that Custodian shall notify the Depositary of that deposit and the person or persons to whom or upon whose written order American Depositary Shares are deliverable in respect thereof. Upon receiving a notice of a deposit from a Custodian, or upon the receipt of Shares or evidence of the right to receive Shares by the Depositary, the Depositary, subject to the terms and conditions of this Deposit Agreement, shall deliver, without unreasonable delay, to or upon the order of the person or persons entitled thereto, the number of American Depositary Shares issuable in respect of that deposit, but only upon payment to the Depositary of the fees and expenses of the Depositary for the delivery of those American Depositary Shares as provided in Section 5.9, and of all taxes and governmental charges and fees payable in connection with that

-11-

deposit and the transfer of the deposited Shares. However, the Depositary shall deliver only whole numbers of American Depositary Shares.

SECTION 2.4.    Registration of Transfer of American Depositary Shares; Combination and Split-up of Receipts; Interchange of Certificated and Uncertificated American Depositary Shares.

The Depositary, subject to the terms and conditions of this Deposit Agreement, shall register a transfer of American Depositary Shares on its transfer books upon (i) in the case of certificated American Depositary Shares, surrender of the Receipt evidencing those American Depositary Shares, by the Owner or by a duly authorized attorney, properly endorsed or accompanied by proper instruments of transfer or (ii) in the case of uncertificated American Depositary Shares, receipt from the Owner of a proper instruction (including, for the avoidance of doubt, instructions through DRS and Profile as provided in Section 2.9), and, in either case, duly stamped as may be required by the laws of the State of New York and of the United States of America. Upon registration of a transfer, the Depositary shall deliver the transferred American Depositary Shares to or upon the order of the person entitled thereto.

The Depositary, subject to the terms and conditions of this Deposit Agreement, shall upon surrender of a Receipt or Receipts for the purpose of effecting a split-up or combination of such Receipt or Receipts, execute and deliver a new Receipt or Receipts for any authorized number of American Depositary Shares requested, evidencing the same aggregate number of American Depositary Shares as the Receipt or Receipts surrendered.

The Depositary, upon surrender of certificated American Depositary Share for the purpose of exchanging for uncertificated American Depositary Shares, shall cancel the Receipt evidencing those certificated American Depositary Shares and send the Owner a statement confirming that the Owner is the owner of the same number of uncertificated American Depositary Shares. The Depositary, upon receipt of a proper instruction (including, for the avoidance of doubt, instructions through DRS and Profile as provided in Section 2.9) from the Owner of uncertificated American Depositary Shares for the purpose of exchanging for certificated American Depositary Shares, shall cancel those uncertificated American Depositary Shares and register and deliver to the Owner a Receipt evidencing the same number of certificated American Depositary Shares.

Depositary may appoint one or more co-transfer agents for the purpose of effecting registration of transfers of American Depositary Shares and combinations and split-ups of Receipts at designated transfer offices on behalf of the Depositary. In carrying

-12-

out its functions, a co-transfer agent may require evidence of authority and compliance with applicable laws and other requirements by Owners or persons entitled to American Depositary Shares and will be entitled to protection and indemnity to the same extent as the Depositary.

SECTION 2.5.    Surrender of American Depositary Shares and Withdrawal of Deposited Securities.

Upon surrender of American Depositary Shares for the purpose of withdrawal of the Deposited Securities represented thereby and payment of the fee of the Depositary for the surrender of American Depositary Shares as provided in Section 5.9 and payment of all taxes and governmental charges payable in connection with that surrender and withdrawal of the Deposited Securities, and subject to the terms and conditions of this Deposit Agreement, the Owner of those American Depositary Shares shall be entitled to delivery (to the extent delivery can then be lawfully and practicably made), to or as instructed by that Owner, of the amount of Deposited Securities at the time represented by those American Depositary Shares, but not any money or other property as to which a record date for distribution to Owners has passed (since money or other property of that kind will be delivered or paid on the scheduled payment date to the Owner as of that record date), and except that the Depositary shall not be required to accept surrender of American Depositary Shares for the purpose of withdrawal to the extent it would require delivery of a fraction of a Deposited Security. That delivery shall be made, as provided in this Section, without unreasonable delay.

As a condition of accepting a surrender of American Depositary Shares for the purpose of withdrawal of Deposited Securities, the Depositary may require (i) that each surrendered Receipt be properly endorsed in blank or accompanied by proper instruments of transfer in blank and (ii) that the surrendering Owner execute and deliver to the Depositary a written order directing the Depositary to cause the Deposited Securities being withdrawn to be delivered to or upon the written order of a person or persons designated in that order.

Thereupon, the Depositary shall direct the Custodian to deliver, subject to Sections 2.6, 3.1 and 3.2, the other terms and conditions of this Deposit Agreement and local market rules and practices, to the surrendering Owner or to or upon the written order of the person or persons designated in the order delivered to the Depositary as above provided, the amount of Deposited Securities represented by the surrendered American Depositary Shares, and the Depositary may charge the surrendering Owner a fee and its expenses for giving that direction by cable (including SWIFT) or facsimile transmission. The Company agrees not to prevent, hinder or unreasonably delay any lawful delivery or

-13-

registration of transfer of Deposited Securities upon surrender of American Depositary Shares for the purpose of withdrawal.

If Deposited Securities are delivered physically upon surrender of American Depositary Shares for the purpose of withdrawal, that delivery will be made at the Custodian’s office, except that, at the request, risk and expense of an Owner surrendering American Depositary Shares for withdrawal of Deposited Securities, and for the account of that Owner, the Depositary shall direct the Custodian to forward any cash or other property comprising, and forward a certificate or certificates, if applicable, and other proper documents of title, if any, for, the Deposited Securities represented by the surrendered American Depositary Shares to the Depositary for delivery at the Depositary’s Office or to another address specified in the order received from the surrendering Owner.

SECTION 2.6.    Limitations on Delivery, Registration of Transfer and Surrender of American Depositary Shares.

As a condition precedent to the delivery, registration of transfer or surrender of any American Depositary Shares or split-up or combination of any Receipt or withdrawal of any Deposited Securities, the Depositary, Custodian or Registrar may require payment from the depositor of Shares or the presenter of the Receipt or instruction for registration of transfer or surrender of American Depositary Shares not evidenced by a Receipt of a sum sufficient to reimburse it for any tax or other governmental charge and any stock transfer or registration fee with respect thereto (including any such tax or charge and fee with respect to Shares being deposited or withdrawn) and payment of any applicable fees as provided in this Deposit Agreement, may require the production of proof satisfactory to it as to the identity and genuineness of any signature and may also require compliance with any regulations the Depositary may establish consistent with the provisions of this Deposit Agreement, including, without limitation, this Section 2.6.

The Depositary may refuse to accept deposits of Shares for delivery of American Depositary Shares or to register transfers of American Depositary Shares in particular instances, or may suspend deposits of Shares or registration of transfer generally, whenever it or the Company considers it necessary or advisable to do so. The Depositary may refuse surrenders of American Depositary Shares for the purpose of withdrawal of Deposited Securities in particular instances, or may suspend surrenders for the purpose of withdrawal generally, but, notwithstanding anything to the contrary in this Deposit Agreement, only for (i) temporary delays caused by closing of the Depositary’s register or the register of holders of Shares maintained by the Company or the Foreign Registrar, or the deposit of Shares, in connection with voting at a shareholders’ meeting or the payment of dividends, (ii) the payment of fees, taxes and similar charges, (iii) compliance with any U.S. or foreign laws or governmental regulations relating to the American Depositary Shares or to the withdrawal of the Deposited Securities or (iv) any other reason that, at the time, is permitted under paragraph I(A)(1) of the General Instructions to Form F-6 under the Securities Act of 1933 or any successor to that provision.

-14-

The Depositary shall not knowingly accept for deposit under this Deposit Agreement any Shares that, at the time of deposit, are Restricted Securities.

SECTION 2.7.    Lost Receipts, etc.

If a Receipt is mutilated, destroyed, lost or stolen, the Depositary shall deliver to the Owner the American Depositary Shares evidenced by that Receipt in uncertificated form or, if requested by the Owner, execute and deliver a new Receipt of like tenor in exchange and substitution for such mutilated Receipt, upon surrender and cancellation of that mutilated Receipt, or in lieu of and in substitution for that destroyed, lost or stolen Receipt. However, before the Depositary will deliver American Depositary Shares in uncertificated form or execute and deliver a new Receipt, in substitution for a destroyed, lost or stolen Receipt, the Owner must (a) file with the Depositary (i) a request for that replacement before the Depositary has notice that the Receipt has been acquired by a bona fide purchaser and (ii) a sufficient indemnity bond and (b) satisfy any other reasonable requirements imposed by the Depositary.

SECTION 2.8.    Cancellation and Destruction of Surrendered Receipts.

The Depositary shall cancel all Receipts surrendered to it and is authorized to destroy Receipts so cancelled.

SECTION 2.9.    DTC Direct Registration System and Profile Modification System.

(a)    Notwithstanding the provisions of Section 2.4, the parties acknowledge that DTC’s Direct Registration System (“DRS”) and Profile Modification System (“Profile”) apply to the American Depositary Shares upon acceptance thereof to DRS by DTC. DRS is the system administered by DTC that facilitates interchange between registered holding of uncertificated securities and holding of security entitlements in those securities through DTC and a DTC participant. Profile is a required feature of DRS that allows a DTC participant, claiming to act on behalf of an Owner of American Depositary Shares, to direct the Depositary to register a transfer of those American Depositary Shares to DTC or its nominee and to deliver those American Depositary Shares to the DTC account of that DTC participant without receipt by the Depositary of prior authorization from the Owner to register that transfer.

(b)    In connection with DRS/Profile, the parties acknowledge that the Depositary will not determine whether the DTC participant that is claiming to be acting on behalf of an Owner in requesting a registration of transfer and delivery as described in paragraph (a) above has the actual authority to act on behalf of that Owner (notwithstanding any requirements under the Uniform Commercial Code). For the avoidance of doubt, the provisions of Sections 5.3 and 5.8 apply to the matters arising from the use of the DRS/Profile. The parties agree that the Depositary’s reliance on and compliance with instructions received by the Depositary through the DRS/Profile system

-15-

and otherwise in accordance with this Deposit Agreement shall not constitute negligence or bad faith on the part of the Depositary.

ARTICLE 3.    CERTAIN OBLIGATIONS OF OWNERS AND HOLDERS OF AMERICAN DEPOSITARY SHARES

SECTION 3.1.    Filing Proofs, Certificates and Other Information.

Any person presenting Shares for deposit or any Owner or Holder may be required from time to time to file with the Depositary or the Custodian such proof of citizenship or residence, exchange control approval, or such information relating to the registration on the books of the Company or the Foreign Registrar, if applicable, to execute such certificates and to make such representations and warranties, as the Depositary may deem necessary or proper. The Depositary may withhold the delivery or registration of transfer of American Depositary Shares, the distribution of any dividend or other distribution or of the proceeds thereof or the delivery of any Deposited Securities until that proof or other information is filed or those certificates are executed or those representations and warranties are made.

SECTION 3.2.    Liability of Owner for Taxes.

If any tax or other governmental charge shall become payable by the Custodian or the Depositary with respect to or in connection with any American Depositary Shares or any Deposited Securities represented by any American Depositary Shares or in connection with a transaction to which Section 4.8 applies, that tax or other governmental charge shall be payable by the Owner of those American Depositary Shares to the Depositary. The Depositary may refuse to register any transfer of those American Depositary Shares or any withdrawal of Deposited Securities represented by those American Depositary Shares until that payment is made, and may withhold any dividends or other distributions or the proceeds thereof, or may sell for the account of the Owner any part or all of the Deposited Securities represented by those American Depositary Shares and apply those dividends or other distributions or the net proceeds of any sale of that kind in payment of that tax or other governmental charge but, even after a sale of that kind, the Owner of those American Depositary Shares shall remain liable for any deficiency. The Depositary shall distribute any net proceeds of a sale made under this Section that are not used to pay taxes or governmental charges to the Owners entitled to them in accordance with Section 4.1. If the number of Shares represented by each American Depositary Share decreases as a result of a sale of Deposited Securities under this Section, the Depositary may call for surrender of the American Depositary Shares to be exchanged on a mandatory

-16-

basis for a lesser number of American Depositary Shares and may sell American Depositary Shares to the extent necessary to avoid distributing fractions of American Depositary Shares in that exchange and distribute the net proceeds of that sale to the Owners entitled to them.

SECTION 3.3.    Warranties on Deposit of Shares.

Every person depositing Shares under this Deposit Agreement shall be deemed thereby to represent and warrant that those Shares and each certificate therefor, if applicable, are validly issued, fully paid and nonassessable and were not issued in violation of any preemptive or similar rights of the holders of outstanding securities of the Company and that the person making that deposit is duly authorized so to do. Every depositing person shall also be deemed to represent that the Shares, at the time of deposit, are not Restricted Securities. All representations and warranties deemed made under this Section shall survive the deposit of Shares and delivery of American Depositary Shares.

SECTION 3.4.    Disclosure of Interests.

When required in order to comply with applicable laws and regulations or the By-laws of the Company, the Company may from time to time request each Owner and Holder to provide to the Depositary information relating to: (a) the capacity in which it holds American Depositary Shares, (b) the identity of any Holders or other persons or entities then or previously interested in those American Depositary Shares and the nature of those interests and (c) any other matter where disclosure of such matter is required for that compliance. Each Owner and Holder agrees to provide all information known to it in response to a request made pursuant to this Section. Each Holder consents to the disclosure by the Depositary and the Owner or any other Holder through which it holds American Depositary Shares, directly or indirectly, of all information responsive to a request made pursuant to this Section relating to that Holder that is known to that Owner or other Holder. The Depositary agrees to use reasonable efforts to comply with written instructions requesting that the Depositary forward any request authorized under this Section to the Owners and to forward to the Company any responses it receives in response to that request. The Depositary may charge the Company a fee and its expenses for complying with requests under this Section 3.4.

SECTION 3.5.    Ownership Restrictions.

Notwithstanding any other provision of this Deposit Agreement, each Owner and Holder agrees to be bound by and subject to the By-laws of the Company and to any restrictions on Share ownership or transferability under applicable Colombian law (to the same extent as if such American Depositary Shares were the Shares represented by such American Depositary Shares, provided, however, that such provisions shall apply to such persons only to the extent feasible). The Company may restrict transfers of the Shares where such transfer might result in ownership of Shares exceeding the limits under applicable law or the Company’s charter. The Company may also restrict, in such manner

-17-

as it deems appropriate, transfer of the American Depositary Shares where such transfer may result in the total number of Shares represented by the American Depositary Shares beneficially owned by a single Owner or Holder to exceed the limits under any applicable law or the Company’s charter. Pursuant to the Company’s By-laws and applicable law as in effect on the date of this Deposit Agreement, (i) no individual holder of Shares may hold, directly or indirectly, in excess of 10% of the Company’s subscribed capital without the prior authorization of the Superintendency of Finance in Colombia; and (ii) no individual may offer for sale or purchase 10% or more of the Company’s subscribed capital

without the prior authorization of the Superintendency of Finance. The Company may, in its sole discretion, instruct the Depositary to take action with respect to the ownership interest, or transfer thereof, of any Owner or Holder in excess of the limitation set forth in the preceding sentence. The Depositary agrees to use its reasonable efforts to comply to the extent practicable with any reasonable instructions received from the Company requesting that the Depositary take the actions specified therein as contemplated in the preceding sentence.

ARTICLE 4.     THE DEPOSITED SECURITIES

SECTION 4.1.    Cash Distributions.

Whenever the Depositary receives any cash dividend or other cash distribution on Deposited Securities, the Depositary shall, subject to the provisions of Section 4.5, convert that dividend or other distribution into Dollars and distribute the amount thus received (net of the fees and expenses of the Depositary as provided in Section 5.9) to the Owners entitled thereto, in proportion to the number of American Depositary Shares representing those Deposited Securities held by them respectively; provided, however, that if the Custodian or the Depositary shall be required to withhold and does withhold from that cash dividend or other cash distribution an amount on account of taxes or other governmental charges, the amount distributed to the Owners of the American Depositary Shares representing those Deposited Securities shall be reduced accordingly. However, the Depositary will not pay any Owner a fraction of one cent, but will round each Owner’s entitlement to the nearest whole cent.

The Company or its agent will remit to the appropriate governmental agency in each applicable jurisdiction all amounts withheld and owing to such agency.

If a cash distribution would represent a return of all or substantially all the value of the Deposited Securities underlying American Depositary Shares, the Depositary may:

(i) require payment of or deduct the fee for surrender of American Depositary Shares (whether or not it is also requiring surrender of American Depositary Shares) as a condition of making that cash distribution; or

-18-

(ii) sell all Deposited Securities other than the subject cash distribution and add any net cash proceeds of that sale to the cash distribution, call for surrender of all those American Depositary Shares and require that surrender as a condition of making that cash distribution.

If the Depositary acts under this paragraph, that action shall also be a Termination Option Event.

SECTION 4.2.    Distributions Other Than Cash, Shares or Rights.

Subject to the provisions of Sections 4.11 and 5.9, whenever the Depositary receives any distribution other than a distribution described in Section 4.1, 4.3 or 4.4 on Deposited Securities (but not in exchange for or in conversion or in lieu of Deposited Securities), the Depositary shall cause the securities or property received by it to be distributed to the Owners entitled thereto, after deduction or upon payment of any fees and expenses of the Depositary and any taxes or other governmental charges, in proportion to the number of American Depositary Shares representing such Deposited Securities held by them respectively, in any manner that the Depositary deems equitable and practicable for accomplishing that distribution (which may be a distribution of depositary shares representing the securities received); provided, however, that if in the opinion of the Depositary such distribution cannot be made proportionately among the Owners entitled thereto, or if for any other reason (including, but not limited to, any requirement that the Company or the Depositary withhold an amount on account of taxes or other governmental charges or that securities received must be registered under the Securities Act of 1933 in order to be distributed to Owners or Holders) the Depositary deems such distribution not to be lawful and feasible, the Depositary may adopt such other method as it may deem equitable and practicable for the purpose of effecting such distribution, including, but not limited to, the public or private sale of the securities or property thus received, or any part thereof, and distribution of the net proceeds of any such sale (net of the fees and expenses of the Depositary as provided in Section 5.9) to the Owners entitled thereto, all in the manner and subject to the conditions set forth in Section 4.1. The Depositary may withhold any distribution of securities under this Section 4.2 if it has not received satisfactory assurances from the Company that the distribution does not require registration under the Securities Act of 1933. The Depositary may sell, by public or private sale, an amount of securities or other property it would otherwise distribute under this Section 4.2 that is sufficient to pay its fees and expenses in respect of that distribution.

If a distribution to be made under this Section 4.2 would represent a return of all or substantially all the value of the Deposited Securities underlying American Depositary Shares, the Depositary may:

(i) require payment of or deduct the fee for surrender of American Depositary Shares (whether or not it is also requiring surrender of American Depositary Shares) as a condition of making that distribution; or

-19-

(ii) sell all Deposited Securities other than the subject distribution and add any net cash proceeds of that sale to the distribution, call for surrender of all those American Depositary Shares and require that surrender as a condition of making that distribution.

If the Depositary acts under this paragraph, that action shall also be a Termination Option Event.

SECTION 4.3.    Distributions in Shares.

Whenever the Depositary receives any distribution on Deposited Securities consisting of a dividend in, or free distribution of, Shares, the Depositary may deliver to the Owners entitled thereto, in proportion to the number of American Depositary Shares representing those Deposited Securities held by them respectively, an aggregate number of American Depositary Shares representing the amount of Shares received as that dividend or free distribution, subject to the terms and conditions of this Deposit Agreement with respect to the deposit of Shares and issuance of American Depositary Shares, including withholding of any tax or governmental charge as provided in Section 4.11 and payment of the fees and expenses of the Depositary as provided in Section 5.9 (and the Depositary may sell, by public or private sale, an amount of the Shares received (or American Depositary Shares representing those Shares) sufficient to pay its fees and expenses in respect of that distribution). In lieu of delivering fractional American Depositary Shares, the Depositary may sell the amount of Shares represented by the aggregate of those fractions (or American Depositary Shares representing those Shares) and distribute the net proceeds, all in the manner and subject to the conditions described in Section 4.1. If and to the extent that additional American Depositary Shares are not delivered and Shares or American Depositary Shares are not sold, each American Depositary Share shall thenceforth also represent the additional Shares distributed on the Deposited Securities represented thereby.

If the Company declares a distribution in which holders of Deposited Securities have a right to elect whether to receive cash, Shares or other securities or a combination of those things, or a right to elect to have a distribution sold on their behalf, the Depositary may, after consultation with the Company, make that right of election available for exercise by Owners in any manner the Depositary considers to be lawful and practical. As a condition of making a distribution election right available to Owners, the Depositary may require satisfactory assurances from the Company that doing so does not require registration of any securities under the Securities Act of 1933 that has not been effected.

SECTION 4.4.     Rights.

(a)    If rights are granted to the Depositary in respect of deposited Shares to purchase additional Shares or other securities, the Company and the Depositary shall

-20-

endeavor to consult as to the actions, if any, the Depositary should take in connection with that grant of rights. The Depositary may, to the extent deemed by it to be lawful and practical (i) if requested in writing by the Company, grant to all or certain Owners rights to instruct the Depositary to purchase the securities to which the rights relate and deliver those securities or American Depositary Shares representing those securities to Owners, (ii) if requested in writing by the Company, deliver the rights to or to the order of certain Owners, or (iii) sell the rights to the extent practicable and distribute the net proceeds of that sale to Owners entitled to those proceeds. To the extent rights are not exercised, delivered or disposed of under (i), (ii) or (iii) above, the Depositary shall permit the rights to lapse unexercised.

(b)    If the Depositary will act under (a)(i) above, the Company and the Depositary will enter into a separate agreement setting forth the conditions and procedures applicable to the particular offering. Upon instruction from an applicable Owner in the form the Depositary specified and upon payment by that Owner to the Depositary of an amount equal to the purchase price of the securities to be received upon the exercise of the rights, the Depositary shall, on behalf of that Owner, exercise the rights and purchase the securities. The purchased securities shall be delivered to, or as instructed by, the Depositary. The Depositary shall (i) deposit the purchased Shares under this Deposit Agreement and deliver American Depositary Shares representing those Shares to that Owner or (ii) deliver or cause the purchased Shares or other securities to be delivered to or to the order of that Owner. The Depositary will not act under (a)(i) above unless the offer and sale of the securities to which the rights relate are registered under the Securities Act of 1933 or the Depositary has received an opinion of United States counsel that is satisfactory to it to the effect that those securities may be sold and delivered to the applicable Owners without registration under the Securities Act of 1933.

(c)    If the Depositary will act under (a)(ii) above, the Company and the Depositary will enter into a separate agreement setting forth the conditions and procedures applicable to the particular offering. Upon (i) the request of an applicable Owner to deliver the rights allocable to the American Depositary Shares of that Owner to an account specified by that Owner to which the rights can be delivered and (ii) receipt of such documents as the Company and the Depositary agreed to require to comply with applicable law, the Depositary will deliver those rights as requested by that Owner.

(d)    If the Depositary will act under (a)(iii) above, the Depositary will use reasonable efforts to sell the rights in proportion to the number of American Depositary Shares held by the applicable Owners and pay the net proceeds to the Owners otherwise entitled to the rights that were sold, upon an averaged or other practical basis without regard to any distinctions among such Owners because of exchange restrictions or the date of delivery of any American Depositary Shares or otherwise.

(e)    Payment or deduction of the fees of the Depositary as provided in Section 5.9 and payment or deduction of the expenses of the Depositary and any applicable

-21-

taxes or other governmental charges shall be conditions of any delivery of securities or payment of cash proceeds under this Section 4.4.

(f)    The Depositary shall not be responsible for any failure to determine that it may be lawful or feasible to make rights available to or exercise rights on behalf of Owners in general or any Owner in particular, or to sell rights.

SECTION 4.5.    Conversion of Foreign Currency.

Whenever the Depositary or the Custodian receives foreign currency, by way of dividends or other distributions or the net proceeds from the sale of securities, property or rights, and if at the time of the receipt thereof the foreign currency so received can in the judgment of the Depositary be converted on a reasonable basis into Dollars and the resulting Dollars transferred to the United States, the Depositary or one of its agents or affiliates or the Custodian shall convert or cause to be converted by sale or in any other manner that it may determine that foreign currency into Dollars, and those Dollars shall be distributed to the Owners entitled thereto. A cash distribution may be made upon an averaged or other practicable basis without regard to any distinctions among Owners based on exchange restrictions, the date of delivery of any American Depositary Shares or otherwise and shall be net of any expenses of conversion into Dollars incurred by the Depositary as provided in Section 5.9.

If a conversion of foreign currency or the repatriation or distribution of Dollars can be effected only with the approval or license of any government or agency thereof, the Depositary may, but will not be required to, file an application for that approval or license.

If the Depositary determines that in its judgment any foreign currency received by the Depositary or the Custodian is not convertible on a reasonable basis into Dollars transferable to the United States, or if any approval or license of any government or agency thereof that is required for such conversion is not filed or sought by the Depositary or is not obtained within a reasonable period as determined by the Depositary, the Depositary may distribute the foreign currency received by the Depositary to, or in its discretion may hold such foreign currency uninvested and without liability for interest thereon for the respective accounts of, the Owners entitled to receive the same.

If any conversion of foreign currency, in whole or in part, cannot be effected for distribution to some of the Owners entitled thereto, the Depositary may in its discretion make that conversion and distribution in Dollars to the extent practicable and permissible to the Owners entitled thereto and may distribute the balance of the foreign currency received by the Depositary to, or hold that balance uninvested and without liability for interest thereon for the account of, the Owners entitled thereto.

-22-

The Depositary may convert currency itself or through any of its affiliates, or the Custodian or the Company may convert currency and pay Dollars to the Depositary. Where the Depositary converts currency itself or through any of its affiliates, the Depositary acts as principal for its own account and not as agent, advisor, broker or fiduciary on behalf of any other person and earns revenue, including, without limitation, transaction spreads, that it will retain for its own account. The revenue is based on, among other things, the difference between the exchange rate assigned to the currency conversion made under this Deposit Agreement and the rate that the Depositary or its affiliate receives when buying or selling foreign currency for its own account. The Depositary makes no representation that the exchange rate used or obtained by it or its affiliate in any currency conversion under this Deposit Agreement will be the most favorable rate that could be obtained at the time or that the method by which that rate will be determined will be the most favorable to Owners, subject to the Depositary’s obligations under Section 5.3. The methodology used to determine exchange rates used in currency conversions made by the Depositary is available upon request. Where the Custodian converts currency, the Custodian has no obligation to obtain the most favorable rate that could be obtained at the time or to ensure that the method by which that rate will be determined will be the most favorable to Owners, and the Depositary makes no representation that the rate is the most favorable rate and will not be liable for any direct or indirect losses associated with the rate. In certain instances, the Depositary may receive dividends or other distributions from the Company in Dollars that represent the proceeds of a conversion of foreign currency or translation from foreign currency at a rate that was obtained or determined by or on behalf of the Company and, in such cases, the Depositary will not engage in, or be responsible for, any foreign currency transactions and neither it nor the Company makes any representation that the rate obtained or determined by the Company is the most favorable rate and neither it nor the Company will be liable for any direct or indirect losses associated with the rate.

SECTION 4.6.    Fixing of Record Date.

Whenever a cash dividend, cash distribution or any other distribution is made on Deposited Securities or rights to purchase Shares or other securities are issued with respect to Deposited Securities (which rights will be delivered to or exercised or sold on behalf of Owners in accordance with Section 4.4) or the Depositary receives notice that a distribution or issuance of that kind will be made, or whenever the Depositary receives notice that a meeting of holders of Shares will be held in respect of which the Company has requested the Depositary to send a notice under Section 4.7, or whenever the Depositary will assess a fee or charge against the Owners, or whenever the Depositary causes a change in the number of Shares that are represented by each American Depositary Share, or whenever the Depositary otherwise finds it necessary or convenient, the Depositary shall fix a record date, which shall be the same as, or as near as practicable to, any corresponding record date set by the Company with respect to Shares, (a) for the determination of the Owners (i) who shall be entitled to receive the benefit of that dividend or other distribution or those rights, (ii) who shall be entitled to give instructions for the exercise of voting rights at that meeting, (iii) who shall be responsible for that fee or charge

-23-

or (iv) for any other purpose for which the record date was set, or (b) on or after which each American Depositary Share will represent the changed number of Shares. Subject to the provisions of Sections 4.1 through 4.5 and to the other terms and conditions of this Deposit Agreement, the Owners on a record date fixed by the Depositary shall be entitled to receive the amount distributable by the Depositary with respect to that dividend or other distribution or those rights or the net proceeds of sale thereof in proportion to the number of American Depositary Shares held by them respectively, to give voting instructions or to

act in respect of the other matter for which that record date was fixed, or be responsible for that fee or charge, as the case may be.

SECTION 4.7.     Voting of Deposited Shares.

(a)    Upon receipt of notice of any meeting of holders of Shares at which holders of Shares will be entitled to vote, if requested in writing by the Company, the Depositary shall, as soon as practicable thereafter, Disseminate to the Owners a notice, the form of which shall be in the sole discretion of the Depositary, that shall contain (i) the information contained in the notice of meeting received by the Depositary, (ii) a statement that the Owners as of the close of business on a specified record date will be entitled, subject to any applicable provision of Colombian law and of the By-laws of the Company, to instruct the Depositary as to the exercise of the voting rights pertaining to the amount of Shares represented by their respective American Depositary Shares, (iii) a statement as to the manner in which those instructions may be given, including an express indication that instructions may be deemed given in accordance with the last sentence of paragraph (b) below, if no instruction is received, to give a proxy to Fiduciaria Bancolombia S.A. or any successor thereto or such other person as the Company may designate as permitted under Colombian law (the “Designee”) to vote that number of deposited Shares as to each matter in the same manner and in the same proportion that all deposited Shares are voted on the respective matter, and (iv) the last date on which the Depositary will accept instructions (the “Instruction Cutoff Date”).

(b)    Upon the written request of an Owner of American Depositary Shares, as of the date of the request or, if a record date was specified by the Depositary, as of that record date, received on or before any Instruction Cutoff Date established by the Depositary, the Depositary may, and if the Depositary sent a notice under the preceding paragraph shall, endeavor, in so far as practicable, to vote or cause to be voted the amount of deposited Shares represented by those American Depositary Shares in accordance with the instructions set forth in that request. The Depositary shall not vote or attempt to exercise the right to vote that attaches to the deposited Shares other than in accordance with instructions given by Owners and received or deemed received by the Depositary or as provided in the following sentence. If

(i) the Company instructed the Depositary to Disseminate a notice under paragraph (a) above and complied with the paragraph (d) below,

-24-

(ii) no instructions are received by the Depositary from an Owner with respect to a matter and an amount of American Depositary Shares of that Owner on or before the Instruction Cutoff Date, and

(iii) the Depositary has received from the Company, by the business day following the Instruction Cutoff Date, a written confirmation that, as of the Instruction Cutoff Date, (x) the Company wishes a proxy to be given under this sentence, and (y) the Company reasonably does not know (A) that there is any substantial opposition to the matter and (B) that the matter is materially adverse to the interests of shareholders,

then, the Depositary shall deem that Owner to have instructed the Depositary to give a proxy to the Designee with respect to that matter and the amount of deposited Shares represented by that amount of American Depositary Shares to vote that amount of deposited Shares as to that matter in the same manner and in the same proportion that all deposited Shares are voted on the respective matter, and the Depositary shall give a proxy to the Designee to vote that amount of deposited Shares as to each matter in the same manner and in the same proportion that all deposited Shares are voted on the respective matter.

(c)    There can be no assurance that Owners generally or any Owner in particular will receive the notice described in paragraph (a) above in time to enable Owners to give instructions to the Depositary prior to the Instruction Cutoff Date.

(d)    In order to give Owners a reasonable opportunity to instruct the Depositary as to the exercise of voting rights relating to Shares, if the Company will request the Depositary to Disseminate a notice under paragraph (a) above, the Company shall give the Depositary notice of the meeting, details concerning the matters to be voted upon and copies of materials to be made available to holders of Shares in connection with the meeting not less than 30 days prior to the meeting date.

SECTION 4.8.    Tender and Exchange Offers; Redemption, Replacement or Cancellation of Deposited Securities.

(a)    The Depositary shall not tender any Deposited Securities in response to any voluntary cash tender offer, exchange offer or similar offer made to holders of Deposited Securities (a “Voluntary Offer”), except when instructed in writing to do so by an Owner surrendering American Depositary Shares and subject to any conditions or procedures the Depositary may require.

(b)    If the Depositary receives a written notice that Deposited Securities have been redeemed for cash or otherwise purchased for cash in a transaction that is mandatory and binding on the Depositary as a holder of those Deposited Securities (a “Redemption”), the Depositary, at the expense of the Company, shall (i) if required, surrender Deposited Securities that have been redeemed to the issuer of those securities or its agent on the redemption date, (ii) Disseminate a notice to Owners (A) notifying them

-25-

of that Redemption, (B) calling for surrender of a corresponding number of American Depositary Shares and (C) notifying them that the called American Depositary Shares have been converted into a right only to receive the money received by the Depositary upon that Redemption and those net proceeds shall be the Deposited Securities to which Owners of those converted American Depositary Shares shall be entitled upon surrenders of those American Depositary Shares in accordance with Section 2.5 or 6.2 and (iii) distribute the money received upon that Redemption to the Owners entitled to it upon surrender by them of called American Depositary Shares in accordance with Section 2.5 (and, for the avoidance of doubt, Owners shall not be entitled to receive that money under Section 4.1). If the Redemption affects less than all the Deposited Securities, the Depositary shall call for surrender a corresponding portion of the outstanding American Depositary Shares and only those American Depositary Shares will automatically be converted into a right to receive the net proceeds of the Redemption. The Depositary shall allocate the American Depositary Shares converted under the preceding sentence among the Owners pro-rata to their respective holdings of American Depositary Shares immediately prior to the Redemption, except that the allocations may be adjusted so that no fraction of a converted American Depositary Share is allocated to any Owner. A Redemption of all or substantially all of the Deposited Securities shall be a Termination Option Event.

(c)    If the Depositary is notified of or there occurs any change in nominal value or any subdivision, combination or any other reclassification of the Deposited Securities or any recapitalization, reorganization, sale of assets substantially as an entirety, merger or consolidation affecting the issuer of the Deposited Securities or to which it is a party that is mandatory and binding on the Depositary as a holder of Deposited Securities and, as a result, securities or other property have been or will be delivered in exchange, conversion, replacement or in lieu of, Deposited Securities (a “Replacement”), the Depositary shall, if required, surrender the old Deposited Securities affected by that Replacement of Shares and hold, as new Deposited Securities under this Deposit Agreement, the new securities or other property delivered to it in that Replacement. However, the Depositary may elect to sell those new Deposited Securities if in the opinion of the Depositary it is not lawful or not practical for it to hold those new Deposited Securities under this Deposit Agreement because those new Deposited Securities may not be distributed to Owners without registration under the Securities Act of 1933 or for any other reason, at public or private sale, at such places and on such terms as it deems proper and proceed as if those new Deposited Securities had been Redeemed under paragraph (b) above. A Replacement shall be a Termination Option Event.

(d)    In the case of a Replacement where the new Deposited Securities will continue to be held under this Deposit Agreement, the Depositary may call for the surrender of outstanding Receipts to be exchanged for new Receipts specifically describing the new Deposited Securities and the number of those new Deposited Securities represented by each American Depositary Share. If the number of Shares represented by each American Depositary Share decreases as a result of a Replacement, the Depositary may call for surrender of the American Depositary Shares to be exchanged on a mandatory basis for a lesser number of American Depositary Shares and may sell American

-26-

Depositary Shares to the extent necessary to avoid distributing fractions of American Depositary Shares in that exchange and distribute the net proceeds of that sale to the Owners entitled to them.

(e)    If there are no Deposited Securities with respect to American Depositary Shares, including if the Deposited Securities are cancelled, or the Deposited

Securities with respect to American Depositary Shares have become apparently worthless, the Depositary may call for surrender of those American Depositary Shares or may cancel those American Depositary Shares, upon notice to Owners, and that condition shall be a Termination Option Event.

SECTION 4.9. Reports.

The Depositary shall make available for inspection by Owners at its Office any reports and communications, including any proxy solicitation material, received from the Company which are both (a) received by the Depositary as the holder of the Deposited Securities and (b) made generally available to the holders of those Deposited Securities by the Company. The Company shall furnish reports and communications, including any proxy soliciting material to which this Section applies, to the Depositary in English, to the extent those materials are required to be translated into English pursuant to any regulations of the Commission.

SECTION 4.10. Lists of Owners.

As promptly as practicable upon written request by the Company, the Depositary shall, at the expense of the Company, furnish to it a list, as of a recent date, of the names, addresses and American Depositary Share holdings of all Owners.

SECTION 4.11. Withholding.

If the Depositary determines that any distribution received or to be made by the Depositary (including Shares and rights to subscribe therefor) is subject to any tax or other governmental charge that the Depositary is obligated to withhold, the Depositary may sell, by public or private sale, all or a portion of the distributed property (including Shares and rights to subscribe therefor) in the amounts and manner the Depositary deems necessary and practicable to pay those taxes or charges, and the Depositary shall distribute the net proceeds of that sale, after deduction of those taxes or charges, to the Owners entitled thereto in proportion to the number of American Depositary Shares held by them respectively.

Services for Owners and Holders that may permit them to obtain reduced rates of tax withholding at source or reclaim excess tax withheld, and the fees and costs associated with using services of that kind, are not provided under, and are outside the scope of, this Deposit Agreement.

-27-

Each Owner and Holder agrees to indemnify the Company, the Depositary, the Custodian and their respective directors, employees, agents and affiliates for, and hold each of them harmless against, any claim by any governmental authority with respect to taxes, additions to tax, penalties or interest arising out of any refund of taxes, reduced withholding at source or other tax benefit received by it.

ARTICLE 5.     THE DEPOSITARY, THE CUSTODIANS AND THE COMPANY

SECTION 5.1.    Maintenance of Office and Register by the Depositary.

Until termination of this Deposit Agreement in accordance with its terms, the Depositary shall maintain facilities for the delivery, registration of transfers and surrender of American Depositary Shares in accordance with the provisions of this Deposit Agreement.

The Depositary shall keep a register of all Owners and all outstanding American Depositary Shares, which shall be open for inspection by the Owners at the Depositary’s Office during regular business hours, but only for the purpose of communicating with Owners regarding the business of the Company or a matter related to this Deposit Agreement or the American Depositary Shares.

The Depositary may close the register for delivery, registration of transfer or surrender for the purpose of withdrawal from time to time as provided in Section 2.6.

If any American Depositary Shares are listed on one or more stock exchanges, the Depositary shall act as Registrar or appoint a Registrar or one or more co-registrars for registration of those American Depositary Shares in accordance with any requirements of that exchange or those exchanges.

The Company shall have the right, at all reasonable times, upon written request, to inspect transfer and registration records of the Depositary, the Registrar and any co-transfer agents or co-registrars and to require them to supply, at the Company’s expense (unless otherwise agreed in writing between the Company and the Depositary) copies of such portions of their records as the Company may reasonably request.

SECTION 5.2.     Prevention or Delay of Performance by the Company or the Depositary.

Neither the Depositary nor the Company nor any of their respective directors, employees, agents or affiliates shall incur any liability to any Owner or Holder:

(i) if by reason of (A) any provision of any present or future law or regulation or other act or action of the government of the United States, any State of the United States or any other state or jurisdiction, or of any governmental or regulatory authority or stock exchange; (B) (in the case of the Depositary only) any provision, present

-28-

or future, of the By-laws of the Company, or any provision of any securities issued or distributed by the Company, or any offering or distribution thereof; or (C) any event or circumstance, whether natural or caused by a person or persons, that is beyond the ability of the Depositary or the Company, as the case may be, to prevent or counteract by reasonable care or effort (including, but not limited to, earthquakes, floods, severe storms, fires, explosions, war, terrorism, civil unrest, labor disputes, criminal acts or outbreaks of infectious disease; interruptions or malfunctions of utility services, Internet or other communications lines or systems; unauthorized access to or attacks on computer systems or websites; or other failures or malfunctions of computer hardware or software or other systems or equipment), the Depositary or the Company is, directly or indirectly, prevented from, forbidden to or delayed in, or could be subject to any civil or criminal penalty on account of doing or performing and therefore does not do or perform, any act or thing that by the terms of this Deposit Agreement or the Deposited Securities, it is provided shall be done or performed;

(ii) for any exercise of, or failure to exercise, any discretion provided for in this Deposit Agreement (including any determination by the Depositary to take, or not take, any action that this Deposit Agreement provides the Depositary may take);

(iii) for the inability of any Owner or Holder to benefit from any distribution, offering, right or other benefit that is made available to holders of Deposited Securities but is not, under the terms of this Deposit Agreement, made available to Owners or Holders; or

(iv) for any special, consequential or punitive damages for any breach of the terms of this Deposit Agreement.

Where, by the terms of a distribution to which Section 4.1, 4.2 or 4.3 applies, or an offering to which Section 4.4 applies, or for any other reason, that distribution or offering may not be made available to Owners, and the Depositary may not dispose of that distribution or offering on behalf of Owners and make the net proceeds available to Owners, then the Depositary shall not make that distribution or offering available to Owners, and shall allow any rights, if applicable, to lapse.

SECTION 5.3.    Obligations of the Depositary and the Company.

The Company assumes no obligation nor shall it be subject to any liability under this Deposit Agreement to any Owner or Holder, except that the Company agrees to perform its obligations specifically set forth in this Deposit Agreement without negligence or bad faith.

The Depositary assumes no obligation nor shall it be subject to any liability under this Deposit Agreement to any Owner or Holder (including, without limitation, liability with respect to the validity or worth of the Deposited Securities), except that the Depositary agrees to perform its obligations specifically set forth in this Deposit Agreement

-29-

without negligence or bad faith, and the Depositary shall not be a fiduciary or have any fiduciary duty to Owners or Holders.

Neither the Depositary nor the Company shall be under any obligation to appear in, prosecute or defend any action, suit or other proceeding in respect of any Deposited Securities or in respect of the American Depositary Shares on behalf of any Owner or Holder or any other person.

Each of the Depositary and the Company may rely, and shall be protected in relying upon, any written notice, request, direction or other document believed by it to be genuine and to have been signed or presented by the proper party or parties.

Neither the Depositary nor the Company shall be liable for any action or non-action by it in reliance upon the advice of or information from legal counsel, accountants, any person presenting Shares for deposit, any Owner or any other person believed by it in good faith to be competent to give such advice or information.

The Depositary shall not be liable for any acts or omissions made by a successor depositary whether in connection with a previous act or omission of the Depositary or in connection with any matter arising wholly after the removal or resignation of the Depositary, provided that in connection with the issue out of which such potential liability arises the Depositary performed its obligations without negligence or bad faith while it acted as Depositary.

The Depositary shall not be liable for the acts or omissions of any securities depository, clearing agency or settlement system in connection with or arising out of book- entry settlement of American Depositary Shares or Deposited Securities or otherwise.

In the absence of bad faith on its part, the Depositary shall not be responsible for any failure to carry out any instructions to vote any of the Deposited Securities, or for the manner in which any such vote is cast or the effect of any such vote.

The Depositary shall have no duty to make any determination or provide any information as to the tax status of the Company or any liability for any tax consequences that may be incurred by Owners or Holders as a result of owning or holding American Depositary Shares. The Depositary shall not be liable for the inability or failure of an Owner or Holder to obtain the benefit of a foreign tax credit, reduced rate of withholding or refund of amounts withheld in respect of tax or any other tax benefit.

SECTION 5.4.    Resignation and Removal of the Depositary.

The Depositary may at any time resign as Depositary hereunder by written notice of its election so to do delivered to the Company, to become effective upon the appointment of a successor depositary and its acceptance of that appointment as provided

-30-

in this Section. The effect of resignation if a successor depositary is not appointed is provided for in Section 6.2.

The Depositary may at any time be removed by the Company by 90 days’ prior written notice of that removal, to become effective upon the later of (i) the 90th day after delivery of the notice to the Depositary and (ii) the appointment of a successor depositary and its acceptance of its appointment as provided in this Section.

If the Depositary resigns or is removed, the Company shall use its best efforts to appoint a successor depositary, which shall be a bank or trust company having an office in the Borough of Manhattan, The City of New York. Every successor depositary shall execute and deliver to the Company an instrument in writing accepting its appointment under this Deposit Agreement. If the Depositary receives notice from the Company that a successor depositary has been appointed following its resignation or removal, the Depositary, upon payment of all sums due it from the Company, shall deliver to its successor a register listing all the Owners and their respective holdings of outstanding American Depositary Shares and shall deliver the Deposited Securities to or to the order of its successor. When the Depositary has taken the actions specified in the preceding sentence (i) the successor shall become the Depositary and shall have all the rights and shall assume all the duties of the Depositary under this Deposit Agreement and (ii) the predecessor depositary shall cease to be the Depositary and shall be discharged and released from all obligations under this Deposit Agreement, except for its duties under Section 5.8 with respect to the time before that discharge. A successor Depositary shall notify the Owners of its appointment as soon as practical after assuming the duties of Depositary.

Any corporation or other entity into or with which the Depositary may be merged or consolidated shall be the successor of the Depositary without the execution or filing of any document or any further act.

SECTION 5.5.    The Custodians.

The Custodian shall be subject at all times and in all respects to the directions of the Depositary and shall be responsible solely to it. The Depositary in its discretion may at any time appoint a substitute or additional custodian or custodians, each of which shall thereafter be one of the Custodians under this Deposit Agreement. If the Depositary receives notice that a Custodian is resigning and, upon the effectiveness of that resignation there would be no Custodian acting under this Deposit Agreement, the Depositary shall, as promptly as practicable after receiving that notice, appoint a substitute custodian or custodians, each of which shall thereafter be a Custodian under this Deposit Agreement. The Depositary shall require any Custodian that resigns or is removed to deliver all Deposited Securities held by it to another Custodian.

SECTION 5.6.    Notices and Reports.

-31-

If the Company takes or decides to take any corporate action of a kind that is addressed in Sections 4.1 to 4.4, or 4.6 to 4.8, or that effects or will effect a change of the name or legal structure of the Company, or that effects or will effect a change to the Shares, the Company shall notify the Depositary and the Custodian of that action or decision as soon as it is lawful and practical to give that notice. The notice shall be in English and shall include all details that the Company is required to include in any notice to any governmental or regulatory authority or securities exchange or is required to make available generally to holders of Shares by publication or otherwise.

The Company will arrange for the translation into English, if not already in English, to the extent required pursuant to any regulations of the Commission, and the prompt transmittal by the Company to the Depositary and the Custodian of all notices and any other reports and communications which are made generally available by the Company to holders of its Shares. If requested in writing by the Company, the Depositary will Disseminate, at the Company’s expense, those notices, reports and communications to all Owners or otherwise make them available to Owners in a manner that the Company specifies as substantially equivalent to the manner in which those communications are made available to holders of Shares and compliant with the requirements of any securities exchange on which the American Depositary Shares are listed. The Company will timely provide the Depositary with the quantity of such notices, reports, and communications, as requested by the Depositary from time to time, in order for the Depositary to effect that Dissemination.

The Company represents, continuously, that the statements in Article 11 of the form of Receipt appearing as Exhibit A to this Deposit Agreement or, if applicable, most recently filed with the Commission pursuant to Rule 424(b) under the Securities Ac of 1933 with respect to the Company’s obligation to file periodic reports under the United States Securities Exchange Act of 1934, as amended, or its qualification for exemption from registration under that Act pursuant to Rule 12g3-2(b) under that Act, as the case may be, are true and correct. The Company agrees to promptly notify the Depositary upon becoming aware of any change in the truth of any of those statements or if there is any change in the Company’s status regarding those reporting obligations or that qualification.

SECTION 5.7.    Distribution of Additional Shares, Rights, etc.

If the Company or any affiliate of the Company determines to make any issuance or distribution of (1) additional Shares, (2) rights to subscribe for Shares, (3) securities convertible into Shares, or (4) rights to subscribe for such securities (each a “Distribution”), the Company shall notify the Depositary in writing in English as promptly as practicable and in any event before the Distribution starts and, if requested in writing by the Depositary, the Company shall promptly furnish to the Depositary either (i) evidence satisfactory to the Depositary that the Distribution is registered under the Securities Act of 1933 or (ii) a written opinion from U.S. counsel for the Company that is reasonably satisfactory to the Depositary, stating that the Distribution does not require, or, if made in the United States, would not require, registration under the Securities Act of 1933.

-32-

The Company agrees with the Depositary that neither the Company nor any company controlled by, controlling or under common control with the Company will at any time deposit any Shares that, at the time of deposit, are Restricted Securities.

SECTION 5.8.    Indemnification.

The Company agrees to indemnify the Depositary, its directors, employees, agents and affiliates and each Custodian against, and hold each of them harmless from, any liability or expense (including, but not limited to any reasonable fees and expenses incurred in seeking, enforcing or collecting such indemnity and the reasonable fees and expenses of counsel) that may arise out of or in connection with (a) any registration with the Commission of American Depositary Shares or Deposited Securities or the offer or sale thereof or (b) acts performed or omitted, pursuant to the provisions of or in connection with this Deposit Agreement and the American Depositary Shares, as the same may be amended, modified or supplemented from time to time, (i) by either the Depositary or a Custodian or their respective directors, employees, agents and affiliates, except for any liability or expense arising out of the negligence or bad faith of either of them, or (ii) by the Company or any of its directors, employees, agents and affiliates.

The Depositary agrees to indemnify the Company, its directors, employees, agents and affiliates and hold them harmless from any liability or expense (including, but not limited to any reasonable fees and expenses incurred in seeking, enforcing or collecting such indemnity and the reasonable fees and expenses of counsel) that may arise out of acts performed or omitted by the Depositary or any Custodian or their respective directors, employees, agents and affiliates due to their negligence or bad faith.

SECTION 5.9.    Charges of Depositary.

The following charges shall be incurred by any party depositing or withdrawing Shares or by any party surrendering American Depositary Shares or to whom American Depositary Shares are issued (including, without limitation, issuance pursuant to a stock dividend or stock split declared by the Company or an exchange of stock regarding the American Depositary Shares or Deposited Securities or a delivery of American Depositary Shares pursuant to Section 4.3), or by Owners, as applicable: (1) taxes and other governmental charges, (2) such registration fees as may from time to time be in effect for the registration of transfers of Shares generally on the Share register of the Company or Foreign Registrar and applicable to transfers of Shares to or from the name of the Depositary or its nominee or the Custodian or its nominee on the making of deposits or withdrawals hereunder, (3) such cable (including SWIFT) and facsimile transmission fees and expenses as are expressly provided in this Deposit Agreement, (4) such expenses as are incurred by the Depositary in the conversion of foreign currency pursuant to Section 4.5, (5) a fee of $5.00 or less per 100 American Depositary Shares (or portion thereof) for the delivery of American Depositary Shares pursuant to Section 2.3, 4.3 or 4.4 and the

-33-

surrender of American Depositary Shares pursuant to Section 2.5 or 6.2, (6) a fee of $.05 or less per American Depositary Share (or portion thereof) for any cash distribution made pursuant to this Deposit Agreement, including, but not limited to Sections 4.1 through 4.4 and Section 4.8, (7) a fee for the distribution of securities pursuant to Section 4.2 or of rights pursuant to Section 4.4 (where the Depositary will not exercise or sell those rights on behalf of Owners), such fee being in an amount equal to the fee for the execution and delivery of American Depositary Shares referred to above which would have been charged as a result of the deposit of such securities under this Deposit Agreement (for purposes of this item 7 treating all such securities as if they were Shares) but which securities are instead distributed by the Depositary to Owners, (8) in addition to any fee charged under item 6 above, a fee of $.05 or less per American Depositary Share (or portion thereof) per annum for depositary services, which will be payable as provided in item 9 below, and (9) any other charges payable by the Depositary or the Custodian, any of the Depositary’s or Custodian’s agents or the agents of the Depositary’s or Custodian’s agents, in connection with the servicing of Shares or other Deposited Securities (which charges shall be assessed against Owners as of the date or dates set by the Depositary in accordance with Section 4.6 and shall be payable at the sole discretion of the Depositary by billing those Owners for those charges or by deducting those charges from one or more cash dividends or other cash distributions).

The Depositary may collect any of its fees by deduction from any cash distribution payable, or by selling a portion of any securities to be distributed, to Owners that are obligated to pay those fees.

In performing its duties under this Deposit Agreement, the Depositary may use brokers, dealers, foreign currency dealers or other service providers that are owned by or affiliated with the Depositary and that may earn or share fees, spreads or commissions.

The Depositary may own and deal in any class of securities of the Company and its affiliates and in American Depositary Shares.

SECTION 5.10.    Retention of Depositary Documents.

The Depositary is authorized to destroy those documents, records, bills and other data compiled during the term of this Deposit Agreement at the times permitted by the laws or regulations governing the Depositary, unless the Company requests in writing, at the Company’s expense and sufficiently prior to any such destruction, that those papers be retained for a longer period or turned over to the Company.

SECTION 5.11.    Exclusivity.

Without prejudice to the Company’s rights under Section 5.4, the Company agrees not to appoint any other depositary for issuance of depositary shares, depositary receipts or any similar securities or instruments so long as The Bank of New York Mellon is acting as Depositary under this Deposit Agreement.

-34-

SECTION 5.12.    Information for Regulatory Compliance.

Each of the Company and the Depositary shall provide to the other, as promptly as practicable, information from its records or otherwise available to it that is reasonably requested by the other to permit the other to comply with applicable law or requirements of governmental or regulatory authorities.

ARTICLE 6.    AMENDMENT AND TERMINATION

SECTION 6.1.    Amendment.

The form of the Receipts and any provisions of this Deposit Agreement may at any time and from time to time be amended by agreement between the Company and the Depositary without the consent of Owners or Holders in any respect that they may deem necessary or desirable. Any amendment that would impose or increase any fees or charges (other than taxes and other governmental charges, registration fees, cable (including SWIFT) or facsimile transmission costs, delivery costs or other such expenses), or that would otherwise prejudice any substantial existing right of Owners, shall, however, not become effective as to outstanding American Depositary Shares until the expiration of 30 days after notice of that amendment has been Disseminated to the Owners of outstanding American Depositary Shares. Every Owner and Holder, at the time any amendment so becomes effective, shall be deemed, by continuing to hold American Depositary Shares or any interest therein, to consent and agree to that amendment and to be bound by this Deposit Agreement as amended thereby. Upon the effectiveness of an amendment to the form of Receipt, including a change in the number of Shares represented by each American Depositary Share, the Depositary may call for surrender of Receipts to be replaced with new Receipts in the amended form or call for surrender of American Depositary Shares to effect that change of ratio. In no event shall any amendment impair the right of the Owner to surrender American Depositary Shares and receive delivery of the Deposited Securities represented thereby, except in order to comply with mandatory provisions of applicable law.

SECTION 6.2.    Termination.

(a)    The Company may initiate termination of this Deposit Agreement by notice to the Depositary. The Depositary may initiate termination of this Deposit Agreement if (i) at any time 90 days shall have expired after the Depositary delivered to the Company a written resignation notice and a successor depositary has not been appointed and accepted its appointment as provided in Section 5.4 or (ii) a Termination Option Event has occurred. If termination of this Deposit Agreement is initiated, the Depositary shall Disseminate a notice of termination to the Owners of all American Depositary Shares then outstanding setting a date for termination (the “Termination Date”), which shall be at least 90 days after the date of that notice, and this Deposit Agreement shall terminate on that Termination Date.

-35-

(b)    After the Termination Date, the Company shall be discharged from all obligations under this Deposit Agreement except for its obligations to the Depositary under Sections 5.8 and 5.9.

(c)    At any time after the Termination Date, the Depositary may sell the Deposited Securities then held under this Deposit Agreement and may thereafter hold uninvested the net proceeds of any such sale, together with any other cash then held by it hereunder, unsegregated and without liability for interest, for the pro rata benefit of the Owners of American Depositary Shares that remain outstanding, and those Owners will be general creditors of the Depositary with respect to those net proceeds and that other cash. After making that sale, the Depositary shall be discharged from all obligations under this Deposit Agreement, except (i) to account for the net proceeds and other cash (after deducting, in each case, the fee of the Depositary for the surrender of American Depositary Shares, any expenses for the account of the Owner of such American Depositary Shares in accordance with the terms and conditions of this Deposit Agreement and any applicable taxes or governmental charges), (ii) for its obligations under Section 5.8 and (iii) to act as provided in paragraph (d) below.

(d)    After the Termination Date, the Depositary shall continue to receive dividends and other distributions pertaining to Deposited Securities (that have not been sold), may sell rights and other property as provided in this Deposit Agreement and shall deliver Deposited Securities (or sale proceeds) upon surrender of American Depositary Shares (after payment or upon deduction, in each case, of the fee of the Depositary for the surrender of American Depositary Shares, any expenses for the account of the Owner of those American Depositary Shares in accordance with the terms and conditions of this Deposit Agreement and any applicable taxes or governmental charges). After the Termination Date, the Depositary shall not accept deposits of Shares or deliver American Depositary Shares. After the Termination Date, (i) the Depositary may refuse to accept surrenders of American Depositary Shares for the purpose of withdrawal of Deposited Securities (that have not been sold) or reverse previously accepted surrenders of that kind that have not settled if in its judgment the requested withdrawal would interfere with its efforts to sell the Deposited Securities, (ii) the Depositary will not be required to deliver cash proceeds of the sale of Deposited Securities until all Deposited Securities have been sold and (iii) the Depositary may discontinue the registration of transfers of American Depositary Shares and suspend the distribution of dividends and other distributions on Deposited Securities to the Owners and need not give any further notices or perform any further acts under this Deposit Agreement except as provided in this Section.

ARTICLE 7.    MISCELLANEOUS

SECTION 7.1.    Counterparts; Signatures; Delivery; Electronic Records.

This Deposit Agreement may be executed in any number of counterparts, each of which shall be deemed an original and all of those counterparts shall constitute one

-36-

and the same instrument. Copies of this Deposit Agreement shall be filed with the Depositary and shall be open to inspection by any Owner or Holder during regular business hours.

This Deposit Agreement may be executed by manual or electronic signatures, including images of manually executed signatures, DocuSign, AdobeSign or a similar agreed-upon electronic signature system, and may be delivered by exchange of copies of this Deposit Agreement by facsimile or email including a pdf or similar bit mapped image of the signature pages. The parties to this Deposit Agreement represent and agree that if it has been executed or delivered electronically as provided in the preceding sentence or subsequently stored in and retrieved from an electronic record-keeping system, it shall have the same legal effect, validity and enforceability as a manually executed agreement maintained in a paper-based record-keeping system to the fullest extent permitted by applicable law, including the Federal Electronic Signatures in Global and National Commerce Act, the New York State Electronic Signatures and Records Act and any other applicable law, and that they shall not argue to the contrary.

SECTION 7.2.    No Third Party Beneficiaries.

This Deposit Agreement is for the exclusive benefit of the Company, the Depositary, the Owners and the Holders and their respective successors and shall not be deemed to give any legal or equitable right, remedy or claim whatsoever to any other person.

SECTION 7.3.    Severability.

In case any one or more of the provisions contained in this Deposit Agreement or in a Receipt should be or become invalid, illegal or unenforceable in any respect, the validity, legality and enforceability of the remaining provisions contained in this Deposit Agreement or that Receipt shall in no way be affected, prejudiced or disturbed thereby.

SECTION 7.4.    Owners and Holders as Parties; Binding Effect.

The Owners and Holders from time to time shall be parties to this Deposit Agreement and shall be bound by all of the terms and conditions of this Deposit Agreement and of the Receipts by acceptance of American Depositary Shares or any interest therein.

SECTION 7.5. Notices.

Any and all notices to be given to the Company shall be in writing and shall be deemed to have been duly given if personally delivered or sent by domestic first class or international air mail or air courier or sent by facsimile transmission or email attaching a pdf or similar bit-mapped image of a signed writing, addressed to Grupo Cibest S.A.,

-37-

Carrera 48 #26-85, Avenida Los Industriales, Medellín, Colombia, Tel: +57 604 4041918, Attention: Investor Relations, email: ir@grupocibest.com.co, or any other place to which the Company may have transferred its principal office with notice to the Depositary.

Any and all notices to be given to the Depositary shall be in writing and shall be deemed to have been duly given if in English and personally delivered or sent by first class domestic or international air mail or air courier or sent by facsimile transmission or email attaching a pdf or similar bit-mapped image of a signed writing, addressed to The Bank of New York Mellon, 240 Greenwich Street, New York, New York 10286, Attention: Depositary Receipt Administration, email: bnymdepositarynotices@bnymellon.com or any other place to which the Depositary may have transferred its Office with notice to the Company.

Delivery of a notice to the Company or Depositary by mail or air courier shall be deemed effected when deposited, postage prepaid, in a post-office letter box or received by an air courier service. Delivery of a notice to the Company or Depositary sent by facsimile transmission or email shall be deemed effected when the recipient acknowledges receipt of that notice.

A notice to be given to an Owner shall be deemed to have been duly given when Disseminated to that Owner. Dissemination in paper form will be effective when personally delivered or sent by first class domestic or international air mail or air courier, addressed to that Owner at the address of that Owner as it appears on the transfer books for American Depositary Shares of the Depositary, or, if that Owner has filed with the Depositary a written request that notices intended for that Owner be mailed to some other address, at the address designated in that request. Dissemination in electronic form will be effective when sent in the manner consented to by the Owner to the electronic address most recently provided by the Owner for that purpose.

SECTION 7.6.    Appointment of Agent for Service of Process; Submission to

Jurisdiction; Jury Trial Waiver.

The Company hereby (i) designates and appoints the person named in Exhibit A to this Deposit Agreement as the Company’s authorized agent in the United States upon which process may be served in any suit or proceeding arising out of or relating to the Shares or Deposited Securities, the American Depositary Shares, the Receipts or this Deposit Agreement (a “Proceeding”), (ii) consents and submits to the jurisdiction of any state or federal court in the State of New York in which any Proceeding may be instituted and (iii) agrees that service of process upon said authorized agent shall be deemed in every respect effective service of process upon the Company in any Proceeding. The Company agrees to deliver to the Depositary, upon the execution and delivery of this Deposit Agreement, a written acceptance by the agent named in Exhibit A to this Deposit Agreement of its appointment as process agent. The Company further agrees to take any and all action, including the filing of any and all such documents and instruments, as may

-38-

be necessary to continue that designation and appointment in full force and effect, or to appoint and maintain the appointment of another process agent located in the United States as required above, and to deliver to the Depositary a written acceptance by that agent of that appointment, for so long as any American Depositary Shares or Receipts remain

outstanding or this Deposit Agreement remains in force. In the event the Company fails to maintain the designation and appointment of a process agent in the United States in full force and effect, the Company hereby waives personal service of process upon it and consents that a service of process in connection with a Proceeding may be made by certified or registered mail, return receipt requested, directed to the Company at its address last specified for notices under this Deposit Agreement, and service so made shall be deemed completed five (5) days after the same shall have been so mailed.

EACH PARTY TO THIS DEPOSIT AGREEMENT (INCLUDING, FOR AVOIDANCE OF DOUBT, EACH OWNER AND HOLDER) HEREBY IRREVOCABLY WAIVES, TO THE FULLEST EXTENT PERMITTED BY APPLICABLE LAW, ANY RIGHT IT MAY HAVE TO A TRIAL BY JURY IN ANY SUIT, ACTION OR PROCEEDING AGAINST THE COMPANY AND/OR THE DEPOSITARY DIRECTLY OR INDIRECTLY ARISING OUT OF OR RELATING TO THE SHARES OR OTHER DEPOSITED SECURITIES, THE AMERICAN DEPOSITARY SHARES OR THE RECEIPTS, THIS DEPOSIT AGREEMENT OR ANY TRANSACTION CONTEMPLATED HEREIN OR THEREIN, OR THE BREACH HEREOF OR THEREOF, INCLUDING, WITHOUT LIMITATION, ANY QUESTION REGARDING EXISTENCE, VALIDITY OR TERMINATION (WHETHER BASED ON CONTRACT, TORT OR ANY OTHER THEORY)AND ANY CLAIM BASED ON U.S. FEDERAL SECURITIES LAWS.

No disclaimer of liability under the United States federal securities laws or the rules and regulations thereunder is intended by any provision of this Deposit Agreement, inasmuch as no person is able to effectively waive the duty of any other person to comply with its obligations under those laws, rules and regulations.

SECTION 7.7.    Waiver of Immunities.

To the extent that the Company or any of its properties, assets or revenues may have or may hereafter become entitled to, or have attributed to it, any right of immunity, on the grounds of sovereignty or otherwise, from any duty of performance under this Deposit Agreement, claim, legal action, suit or proceeding, from the giving of any relief in any respect thereof, from setoff or counterclaim, from the jurisdiction of any court, from service of process, from attachment upon or prior to judgment, from attachment in aid of execution or judgment, or from execution of judgment, or other legal process or proceeding for the giving of any relief or for the enforcement of any judgment, in any jurisdiction in which proceedings may at any time be commenced, with respect to its obligations, liabilities or any other matter under or arising out of or in connection with the Shares or Deposited Securities, the American Depositary Shares, the Receipts or this Deposit Agreement, the Company, to the fullest extent permitted by law, hereby

-39-

irrevocably and unconditionally waives, and agrees not to plead or claim, any immunity of that kind and consents to relief and enforcement as provided above.

SECTION 7.8.    Governing Law.

This Deposit Agreement and the Receipts shall be interpreted in accordance with and all rights hereunder and thereunder and provisions hereof and thereof shall be governed by the laws of the State of New York.

-40-

-41-

EXHIBIT A

AMERICAN DEPOSITARY SHARES

(Each American Depositary Share represents

four (4) deposited Shares)

THE BANK OF NEW YORK MELLON

AMERICAN DEPOSITARY RECEIPT

FOR PREFERRED SHARES OF

GRUPO CIBEST S.A.

(INCORPORATED UNDER THE LAWS OF THE REPUBLIC OF COLOMBIA)

The Bank of New York Mellon, as depositary (hereinafter called the “Depositary”), hereby certifies that_________________________________________, or registered assigns IS THE OWNER OF _____________________________

AMERICAN DEPOSITARY SHARES

representing deposited preferred shares (herein called “Shares”) of Grupo Cibest S.A., incorporated under the laws of the Republic of Colombia (herein called the “Company”). At the date hereof, each American Depositary Share represents four (4) Shares deposited or subject to deposit under the Deposit Agreement (as such term is hereinafter defined) with a custodian for the Depositary (herein called the “Custodian”) that, as of the date of the Deposit Agreement, was Fiduciaria Bancolombia S.A. located in the Republic of Colombia. The Depositary’s Office and its principal executive office are located at 240 Greenwich Street, New York, N.Y. 10286.

THE DEPOSITARY’S OFFICE ADDRESS IS

240 GREENWICH STREET, NEW YORK, N.Y. 10286

-42-

1.    THE DEPOSIT AGREEMENT.

This American Depositary Receipt is one of an issue (herein called “Receipts”), all

issued and to be issued upon the terms and conditions set forth in the Deposit Agreement dated as of May 16, 2025 (herein called the “Deposit Agreement”) among the Company, the Depositary, and all Owners and Holders from time to time of American Depositary Shares issued thereunder, each of whom by accepting American Depositary Shares agrees to become a party thereto and become bound by all the terms and conditions thereof. The Deposit Agreement sets forth the rights of Owners and Holders and the rights and duties of the Depositary in respect of the Shares deposited thereunder and any and all other securities, property and cash from time to time received in respect of those Shares and held thereunder (those Shares, securities, property, and cash are herein called “Deposited Securities”). Copies of the Deposit Agreement are on file at the Depositary’s Office in New York City and at the office of the Custodian.

The statements made on the face and reverse of this Receipt are summaries of certain provisions of the Deposit Agreement and are qualified by and subject to the detailed provisions of the Deposit Agreement, to which reference is hereby made. Capitalized terms defined in the Deposit Agreement and not defined herein shall have the meanings set forth in the Deposit Agreement.

2.    SURRENDER OF AMERICAN DEPOSITARY SHARES AND WITHDRAWAL

OF SHARES.

Upon surrender of American Depositary Shares for the purpose of withdrawal of the Deposited Securities represented thereby and payment of the fee of the Depositary for the surrender of American Depositary Shares as provided in Section 5.9 of the Deposit Agreement and payment of all taxes and governmental charges payable in connection with that surrender and withdrawal of the Deposited Securities, and subject to the terms and conditions of the Deposit Agreement, the Owner of those American Depositary Shares shall be entitled to delivery (to the extent delivery can then be lawfully and practicably made), to or as instructed by that Owner, of the amount of Deposited Securities at the time represented by those American Depositary Shares, but not any money or other property as to which a record date for distribution to Owners has passed (since money or other property of that kind will be delivered or paid on the scheduled payment date to the Owner as of that record date), and except that the Depositary shall not be required to accept surrender of American Depositary Shares for the purpose of withdrawal to the extent it would require delivery of a fraction of a Deposited Security. The Depositary shall direct the Custodian with respect to delivery of Deposited Securities and may charge the surrendering Owner a fee and its expenses for giving that direction by cable (including SWIFT) or facsimile transmission. The Company agrees not to prevent, hinder or unreasonably delay any lawful

-43-

delivery or registration of transfer of Deposited Securities upon surrender of American Depositary Shares for the purpose of withdrawal. If Deposited Securities are delivered physically upon surrender of American Depositary Shares for the purpose of withdrawal,

that delivery will be made at the Custodian’s office, except that, at the request, risk and expense of the surrendering Owner, and for the account of that Owner, the Depositary shall direct the Custodian to forward any cash or other property comprising, and forward a certificate or certificates, if applicable, and other proper documents of title, if any, for, the Deposited Securities represented by the surrendered American Depositary Shares to the Depositary for delivery at the Depositary’s Office or to another address specified in the order received from the surrendering Owner.

3.    REGISTRATION OF TRANSFER OF AMERICAN DEPOSITARY SHARES; COMBINATION AND SPLIT-UP OF RECEIPTS; INTERCHANGE OF CERTIFICATED AND UNCERTIFICATED AMERICAN DEPOSITARY SHARES.

The Depositary, subject to the terms and conditions of the Deposit Agreement, shall register a transfer of American Depositary Shares on its transfer books upon (i) in the case of certificated American Depositary Shares, surrender of the Receipt evidencing those American Depositary Shares, by the Owner or by a duly authorized attorney, properly endorsed or accompanied by proper instruments of transfer or (ii) in the case of uncertificated American Depositary Shares, receipt from the Owner of a proper instruction (including, for the avoidance of doubt, instructions through DRS and Profile as provided in Section 2.9 of that Agreement), and, in either case, duly stamped as may be required by the laws of the State of New York and of the United States of America. Upon registration of a transfer, the Depositary shall deliver the transferred American Depositary Shares to or upon the order of the person entitled thereto.

The Depositary, subject to the terms and conditions of the Deposit Agreement, shall upon surrender of a Receipt or Receipts for the purpose of effecting a split-up or combination of such Receipt or Receipts, execute and deliver a new Receipt or Receipts for any authorized number of American Depositary Shares requested, evidencing the same aggregate number of American Depositary Shares as the Receipt or Receipts surrendered.

The Depositary, upon surrender of certificated American Depositary Shares for the purpose of exchanging for uncertificated American Depositary Shares, shall cancel the Receipt evidencing those certificated American Depositary Shares and send the Owner a statement confirming that the Owner is the owner of the same number of uncertificated American Depositary Shares. The Depositary, upon receipt of a proper instruction (including, for the avoidance of doubt, instructions through DRS and Profile as provided in Section 2.9 of the Deposit Agreement) from the Owner of uncertificated American Depositary Shares for the purpose of exchanging for certificated American Depositary Shares, shall cancel those uncertificated American Depositary Shares and register and deliver to the Owner a Receipt evidencing the same number of certificated American Depositary Shares.

-44-

As a condition precedent to the delivery, registration of transfer, or surrender of any American Depositary Shares or split-up or combination of any Receipt or withdrawal of

any Deposited Securities, the Depositary, the Custodian, or Registrar may require payment from the depositor of the Shares or the presenter of the Receipt or instruction for registration of transfer or surrender of American Depositary Shares not evidenced by a Receipt of a sum sufficient to reimburse it for any tax or other governmental charge and any stock transfer or registration fee with respect thereto (including any such tax or charge and fee with respect to Shares being deposited or withdrawn) and payment of any applicable fees as provided in the Deposit Agreement, may require the production of proof satisfactory to it as to the identity and genuineness of any signature and may also require compliance with any regulations the Depositary may establish consistent with the provisions of the Deposit Agreement.

The Depositary may refuse to accept deposits of Shares for delivery of American Depositary Shares or to register transfers of American Depositary Shares in particular instances, or may suspend deposits of Shares or registration of transfer generally, whenever it or the Company considers it necessary or advisable to do so. The Depositary may refuse surrenders of American Depositary Shares for the purpose of withdrawal of Deposited Securities in particular instances, or may suspend surrenders for the purpose of withdrawal generally, but, notwithstanding anything to the contrary in the Deposit Agreement, only for (i) temporary delays caused by closing of the Depositary’s register or the register of holders of Shares maintained by the Company or the Foreign Registrar, or the deposit of Shares, in connection with voting at a shareholders’ meeting or the payment of dividends, (ii) the payment of fees, taxes and similar charges, (iii) compliance with any U.S. or foreign laws or governmental regulations relating to the American Depositary Shares or to the withdrawal of the Deposited Securities or (iv) any other reason that, at the time, is permitted under paragraph I(A)(1) of the General Instructions to Form F-6 under the Securities Act of 1933 or any successor to that provision.

The Depositary shall not knowingly accept for deposit under the Deposit Agreement any Shares that, at the time of deposit, are Restricted Securities.

4.    LIABILITY OF OWNER FOR TAXES.

If any tax or other governmental charge shall become payable by the Custodian or the Depositary with respect to or in connection with any American Depositary Shares or any Deposited Securities represented by any American Depositary Shares or in connection with a transaction to which Section 4.8 of the Deposit Agreement applies, that tax or other governmental charge shall be payable by the Owner of those American Depositary Shares to the Depositary. The Depositary may refuse to register any transfer of those American Depositary Shares or any withdrawal of Deposited Securities represented by those American Depositary Shares until that payment is made, and may withhold any dividends or other distributions or the proceeds thereof, or may sell for the account of the Owner any part or all of the Deposited Securities represented by those American Depositary Shares,

-45-

and may apply those dividends or other distributions or the net proceeds of any sale of that kind in payment of that tax or other governmental charge but, even after a sale of that kind,

the Owner shall remain liable for any deficiency. The Depositary shall distribute any net proceeds of a sale made under Section 3.2 of the Deposit Agreement that are not used to pay taxes or governmental charges to the Owners entitled to them in accordance with Section 4.1 of the Deposit Agreement. If the number of Shares represented by each American Depositary Share decreases as a result of a sale of Deposited Securities under Section 3.2 of the Deposit Agreement, the Depositary may call for surrender of the American Depositary Shares to be exchanged on a mandatory basis for a lesser number of American Depositary Shares and may sell American Depositary Shares to the extent necessary to avoid distributing fractions of American Depositary Shares in that exchange and distribute the net proceeds of that sale to the Owners entitled to them.

5.    WARRANTIES ON DEPOSIT OF SHARES.

Every person depositing Shares under the Deposit Agreement shall be deemed thereby to represent and warrant that those Shares and each certificate therefor, if applicable, are validly issued, fully paid and nonassessable and were not issued in violation of any preemptive or similar rights of the holders of outstanding securities of the Company and that the person making that deposit is duly authorized so to do. Every depositing person shall also be deemed to represent that the Shares, at the time of deposit, are not Restricted Securities. All representations and warranties deemed made under Section 3.3 of the Deposit Agreement shall survive the deposit of Shares and delivery of American Depositary Shares.

6.    FILING PROOFS, CERTIFICATES, AND OTHER INFORMATION.

Any person presenting Shares for deposit or any Owner or Holder may be required from time to time to file with the Depositary or the Custodian such proof of citizenship or residence, exchange control approval, or such information relating to the registration on the books of the Company or the Foreign Registrar, if applicable, to execute such certificates and to make such representations and warranties, as the Depositary may deem necessary or proper. The Depositary may withhold the delivery or registration of transfer of any American Depositary Shares, the distribution of any dividend or other distribution or of the proceeds thereof or the delivery of any Deposited Securities until that proof or other information is filed or those certificates are executed or those representations and warranties are made. As conditions of accepting Shares for deposit, the Depositary may require (i) any certification required by the Depositary or the Custodian in accordance with the provisions of the Deposit Agreement, (ii) a written order directing the Depositary to deliver to, or upon the written order of, the person or persons stated in that order, the number of American Depositary Shares representing those Deposited Shares, (iii) evidence satisfactory to the Depositary that those Shares have been re-registered in the books of the Company or the Foreign Registrar in the name of the Depositary, a Custodian or a nominee of the Depositary or a Custodian, (iv) evidence satisfactory to the Depositary that any

-46-

necessary approval has been granted by any governmental body in each applicable jurisdiction and (v) an agreement or assignment, or other instrument satisfactory to the

Depositary, that provides for the prompt transfer to the Custodian of any dividend, or right to subscribe for additional Shares or to receive other property, that any person in whose name those Shares are or have been recorded may thereafter receive upon or in respect of those Shares, or, in lieu thereof, such agreement of indemnity or other agreement as shall be satisfactory to the Depositary.

7.    CHARGES OF DEPOSITARY.

The following charges shall be incurred by any party depositing or withdrawing Shares or by any party surrendering American Depositary Shares or to whom American Depositary Shares are issued (including, without limitation, issuance pursuant to a stock dividend or stock split declared by the Company or an exchange of stock regarding the American Depositary Shares or Deposited Securities or a delivery of American Depositary Shares pursuant to Section 4.3 of the Deposit Agreement), or by Owners, as applicable: (1) taxes and other governmental charges, (2) such registration fees as may from time to time be in effect for the registration of transfers of Shares generally on the Share register of the Company or Foreign Registrar and applicable to transfers of Shares to or from the name of the Depositary or its nominee or the Custodian or its nominee on the making of deposits or withdrawals hereunder, (3) such cable (including SWIFT) and facsimile transmission fees and expenses as are expressly provided in the Deposit Agreement, (4) such expenses as are incurred by the Depositary in the conversion of foreign currency pursuant to Section 4.5 of the Deposit Agreement, (5) a fee of $5.00 or less per 100 American Depositary Shares (or portion thereof) for the delivery of American Depositary Shares pursuant to Section 2.3, 4.3 or 4.4 of the Deposit Agreement and the surrender of American Depositary Shares pursuant to Section 2.5 or 6.2 of the Deposit Agreement, (6) a fee of $.05 or less per American Depositary Share (or portion thereof) for any cash distribution made pursuant to the Deposit Agreement, including, but not limited to Sections 4.1 through 4.4 and 4.8 of the Deposit Agreement, (7) a fee for the distribution of securities pursuant to Section 4.2 of the Deposit Agreement or of rights pursuant to Section 4.4 of that Agreement (where the Depositary will not exercise or sell those rights on behalf of Owners), such fee being in an amount equal to the fee for the execution and delivery of American Depositary Shares referred to above which would have been charged as a result of the deposit of such securities under the Deposit Agreement (for purposes of this item 7 treating all such securities as if they were Shares) but which securities are instead distributed by the Depositary to Owners, (8) in addition to any fee charged under item 6, a fee of $.05 or less per American Depositary Share (or portion thereof) per annum for depositary services, which will be payable as provided in item 9 below, and (9) any other charges payable by the Depositary or the Custodian, any of the Depositary’s or Custodian’s agents or the agents of the Depositary’s or Custodian’s agents, in connection with the servicing of Shares or other Deposited Securities (which charges shall be assessed against Owners as of the date or dates set by the Depositary in accordance with Section 4.6 of the Deposit Agreement and shall be payable at the sole discretion of the Depositary by billing

-47-

those Owners for those charges or by deducting those charges from one or more cash dividends or other cash distributions).

The Depositary may collect any of its fees by deduction from any cash distribution payable, or by selling a portion of any securities to be distributed, to Owners that are obligated to pay those fees.

The Depositary may own and deal in any class of securities of the Company and its affiliates and in American Depositary Shares.

From time to time, the Depositary may make payments to the Company to reimburse the Company for costs and expenses generally arising out of establishment and maintenance of the American Depositary Shares program, waive fees and expenses for services provided by the Depositary or share revenue from the fees collected from Owners or Holders. In performing its duties under the Deposit Agreement, the Depositary may use brokers, dealers, foreign currency dealers or other service providers that are owned by or affiliated with the Depositary and that may earn or share fees, spreads or commissions.

8.    DISCLOSURE OF INTERESTS.

When required in order to comply with applicable laws and regulations or the By- laws of the Company, the Company may from time to time request each Owner and Holder to provide to the Depositary information relating to: (a) the capacity in which it holds American Depositary Shares, (b) the identity of any Holders or other persons or entities then or previously interested in those American Depositary Shares and the nature of those interests and (c) any other matter where disclosure of such matter is required for that compliance. Each Owner and Holder agrees to provide all information known to it in response to a request made pursuant to Section 3.4 of the Deposit Agreement. Each Holder consents to the disclosure by the Depositary and the Owner or other Holder through which it holds American Depositary Shares, directly or indirectly, of all information responsive to a request made pursuant to that Section relating to that Holder that is known to that Owner or other Holder.

9.    TITLE TO AMERICAN DEPOSITARY SHARES.

It is a condition of the American Depositary Shares, and every successive Owner and Holder of American Depositary Shares, by accepting or holding the same, consents and agrees that American Depositary Shares evidenced by a Receipt, when the Receipt is properly endorsed or accompanied by proper instruments of transfer, shall be transferable as certificated registered securities under the laws of the State of New York, and that American Depositary Shares not evidenced by Receipts shall be transferable as uncertificated registered securities under the laws of the State of New York. The Depositary, notwithstanding any notice to the contrary, may treat the Owner of American Depositary Shares as the absolute owner thereof for the purpose of determining the person entitled to distribution of dividends or other distributions or to any notice provided for in

-48-

the Deposit Agreement and for all other purposes, and neither the Depositary nor the Company shall have any obligation or be subject to any liability under the Deposit Agreement to any Holder of American Depositary Shares, but only to the Owner.

10.    VALIDITY OF RECEIPT.

This Receipt shall not be entitled to any benefits under the Deposit Agreement or be valid or obligatory for any purpose, unless this Receipt shall have been (i) executed by the Depositary by the manual signature of a duly authorized officer of the Depositary or (ii) executed by the facsimile signature of a duly authorized officer of the Depositary and countersigned by the manual signature of a duly authorized signatory of the Depositary or the Registrar or a co-registrar.

11.    REPORTS; INSPECTION OF TRANSFER BOOKS.

The Company is subject to the periodic reporting requirements of the Securities Exchange Act of 1934 and, accordingly, files certain reports with the Securities and Exchange Commission. Those reports will be available for inspection and copying through the Commission’s EDGAR system or at public reference facilities maintained by the Commission in Washington, D.C.

The Depositary will make available for inspection by Owners at its Office any reports, notices and other communications, including any proxy soliciting material, received from the Company which are both (a) received by the Depositary as the holder of the Deposited Securities and (b) made generally available to the holders of those Deposited Securities by the Company. The Company shall furnish reports and communications, including any proxy soliciting material to which Section 4.9 of the Deposit Agreement applies, to the Depositary in English, to the extent such materials are required to be translated into English pursuant to any regulations of the Commission.

The Depositary will maintain a register of American Depositary Shares and transfers of American Depositary Shares, which shall be open for inspection by the Owners at the Depositary’s Office during regular business hours, but only for the purpose of communicating with Owners regarding the business of the Company or a matter related to the Deposit Agreement or the American Depositary Shares.

12.    DIVIDENDS AND DISTRIBUTIONS.

Whenever the Depositary receives any cash dividend or other cash distribution on Deposited Securities, the Depositary will, if at the time of receipt thereof any amounts received in a foreign currency can in the judgment of the Depositary be converted on a reasonable basis into Dollars transferable to the United States, and subject to the Deposit Agreement, convert that dividend or other cash distribution into Dollars and distribute the amount thus received (net of the fees and expenses of the Depositary as provided in Article 7 hereof and Section 5.9 of the Deposit Agreement) to the Owners entitled thereto; provided, however, that if the Custodian or the Depositary is required to withhold and does

-49-

withhold from that cash dividend or other cash distribution an amount on account of taxes or other governmental charges, the amount distributed to the Owners of the American Depositary Shares representing those Deposited Securities shall be reduced accordingly.

If a cash distribution would represent a return of all or substantially all the value of the Deposited Securities underlying American Depositary Shares, the Depositary may:

(i)    require payment of or deduct the fee for surrender of American Depositary Shares (whether or not it is also requiring surrender of American Depositary Shares) as a condition of making that cash distribution; or

(ii)    sell all Deposited Securities other than the subject cash distribution and add any net cash proceeds of that sale to the cash distribution, call for surrender of all those American Depositary Shares and require that surrender as a condition of making that cash distribution.

If the Depositary acts under this paragraph, that action shall also be a Termination Option Event.

Subject to the provisions of Section 4.11 and 5.9 of the Deposit Agreement, whenever the Depositary receives any distribution other than a distribution described in Section 4.1, 4.3 or 4.4 of the Deposit Agreement on Deposited Securities (but not in exchange for or in conversion or in lieu of Deposited Securities), the Depositary will cause the securities or property received by it to be distributed to the Owners entitled thereto, after deduction or upon payment of any fees and expenses of the Depositary and any taxes or other governmental charges, in any manner that the Depositary deems equitable and practicable for accomplishing that distribution (which may be a distribution of depositary shares representing the securities received); provided, however, that if in the opinion of the Depositary such distribution cannot be made proportionately among the Owners entitled thereto, or if for any other reason the Depositary deems such distribution not to be lawful and feasible, the Depositary may adopt such other method as it may deem equitable and practicable for the purpose of effecting such distribution, including, but not limited to, the public or private sale of the securities or property thus received, or any part thereof, and distribution of the net proceeds of any such sale (net of the fees and expenses of the Depositary as provided in Article 7 hereof and Section 5.9 of the Deposit Agreement) to the Owners entitled thereto all in the manner and subject to the conditions set forth in Section 4.1 of the Deposit Agreement. The Depositary may withhold any distribution of securities under Section 4.2 of the Deposit Agreement if it has not received satisfactory assurances from the Company that the distribution does not require registration under the Securities Act of 1933. The Depositary may sell, by public or private sale, an amount of securities or other property it would otherwise distribute under this Article that is sufficient to pay its fees and expenses in respect of that distribution.

-50-

If a distribution to be made under Section 4.2 of the Deposit Agreement would represent a return of all or substantially all the value of the Deposited Securities underlying American Depositary Shares, the Depositary may:

(i) require payment of or deduct the fee for surrender of American Depositary Shares (whether or not it is also requiring surrender of American Depositary Shares) as a condition of making that distribution; or

(ii) sell all Deposited Securities other than the subject distribution and add any net cash proceeds of that sale to the distribution, call for surrender of all those American Depositary Shares and require that surrender as a condition of making that distribution.

If the Depositary acts under this paragraph, that action shall also be a Termination Option Event.

Whenever the Depositary receives any distribution consisting of a dividend in, or free distribution of, Shares, the Depositary may deliver to the Owners entitled thereto, an aggregate number of American Depositary Shares representing the amount of Shares received as that dividend or free distribution, subject to the terms and conditions of the Deposit Agreement with respect to the deposit of Shares and issuance of American Depositary Shares, including the withholding of any tax or other governmental charge as provided in Section 4.11 of the Deposit Agreement and the payment of the fees and expenses of the Depositary as provided in Article 7 hereof and Section 5.9 of the Deposit Agreement (and the Depositary may sell, by public or private sale, an amount of Shares received (or American Depositary Shares representing those Shares) sufficient to pay its fees and expenses in respect of that distribution). In lieu of delivering fractional American Depositary Shares, the Depositary may sell the amount of Shares represented by the aggregate of those fractions (or American Depositary Shares representing those Shares) and distribute the net proceeds, all in the manner and subject to the conditions described in Section 4.1 of the Deposit Agreement. If and to the extent that additional American Depositary Shares are not delivered and Shares or American Depositary Shares are not sold, each American Depositary Share shall thenceforth also represent the additional Shares distributed on the Deposited Securities represented thereby.

If the Company declares a distribution in which holders of Deposited Securities have a right to elect whether to receive cash, Shares or other securities or a combination of those things, or a right to elect to have a distribution sold on their behalf, the Depositary may, after consultation with the Company, make that right of election available for exercise by Owners in any manner the Depositary considers to be lawful and practical. As a condition of making a distribution election right available to Owners, the Depositary may require satisfactory assurances from the Company that doing so does not require registration of any securities under the Securities Act of 1933 that has not been effected.

-51-

If the Depositary determines that any distribution received or to be made by the Depositary (including Shares and rights to subscribe therefor) is subject to any tax or other governmental charge that the Depositary is obligated to withhold, the Depositary may sell, by public or private sale, all or a portion of the distributed property (including Shares and rights to subscribe therefor) in the amounts and manner the Depositary deems necessary and practicable to pay those taxes or charges, and the Depositary shall distribute the net proceeds of that sale, after deduction of those taxes or charges, to the Owners entitled thereto in proportion to the number of American Depositary Shares held by them respectively.

Each Owner and Holder agrees to indemnify the Company, the Depositary, the Custodian and their respective directors, employees, agents and affiliates for, and hold each of them harmless against, any claim by any governmental authority with respect to taxes, additions to tax, penalties or interest arising out of any refund of taxes, reduced withholding at source or other tax benefit received by it. Services for Owners and Holders that may permit them to obtain reduced rates of tax withholding at source or reclaim excess tax withheld, and the fees and costs associated with using services of that kind, are not provided under, and are outside the scope of, the Deposit Agreement.

13.    RIGHTS.

(a)    If rights are granted to the Depositary in respect of deposited Shares to purchase additional Shares or other securities, the Company and the Depositary shall endeavor to consult as to the actions, if any, the Depositary should take in connection with that grant of rights. The Depositary may, to the extent deemed by it to be lawful and practical (i) if requested in writing by the Company, grant to all or certain Owners rights to instruct the Depositary to purchase the securities to which the rights relate and deliver those securities or American Depositary Shares representing those securities to Owners, (ii) if requested in writing by the Company, deliver the rights to or to the order of certain Owners, or (iii) sell the rights to the extent practicable and distribute the net proceeds of that sale to Owners entitled to those proceeds. To the extent rights are not exercised, delivered or disposed of under (i), (ii) or (iii) above, the Depositary shall permit the rights to lapse unexercised.

(b)    If the Depositary will act under (a)(i) above, the Company and the Depositary will enter into a separate agreement setting forth the conditions and procedures applicable to the particular offering. Upon instruction from an applicable Owner in the form the Depositary specified and upon payment by that Owner to the Depositary of an amount equal to the purchase price of the securities to be received upon the exercise of the rights, the Depositary shall, on behalf of that Owner, exercise the rights and purchase the securities. The purchased securities shall be delivered to, or as instructed by, the Depositary. The Depositary shall (i) deposit the purchased Shares under the Deposit Agreement and deliver American Depositary Shares representing those Shares to that Owner or (ii) deliver or cause the purchased Shares or other securities to be delivered to or to the order of that Owner. The Depositary will not act under (a)(i) above unless the offer

-52-

and sale of the securities to which the rights relate are registered under the Securities Act of 1933 or the Depositary has received an opinion of United States counsel that is satisfactory to it to the effect that those securities may be sold and delivered to the applicable Owners without registration under the Securities Act of 1933.

(c)    If the Depositary will act under (a)(ii) above, the Company and the Depositary will enter into a separate agreement setting forth the conditions and procedures applicable to the particular offering. Upon (i) the request of an applicable Owner to deliver the rights allocable to the American Depositary Shares of that Owner to an account specified by that Owner to which the rights can be delivered and (ii) receipt of such documents as the Company and the Depositary agreed to require to comply with applicable law, the Depositary will deliver those rights as requested by that Owner.

(d)    If the Depositary will act under (a)(iii) above, the Depositary will use reasonable efforts to sell the rights in proportion to the number of American Depositary Shares held by the applicable Owners and pay the net proceeds to the Owners otherwise entitled to the rights that were sold, upon an averaged or other practical basis without regard to any distinctions among such Owners because of exchange restrictions or the date of delivery of any American Depositary Shares or otherwise.

(e)    Payment or deduction of the fees of the Depositary as provided in Section 5.9 of the Deposit Agreement and payment or deduction of the expenses of the Depositary and any applicable taxes or other governmental charges shall be conditions of any delivery of securities or payment of cash proceeds under Section 4.4 of the Deposit Agreement.

(f)    The Depositary shall not be responsible for any failure to determine that it may be lawful or feasible to make rights available to or exercise rights on behalf of Owners in general or any Owner in particular , or to sell rights.

14.    CONVERSION OF FOREIGN CURRENCY.

Whenever the Depositary or the Custodian receives foreign currency, by way of dividends or other distributions or the net proceeds from the sale of securities, property or rights, and if at the time of the receipt thereof the foreign currency so received can in the judgment of the Depositary be converted on a reasonable basis into Dollars and the resulting Dollars transferred to the United States, the Depositary or one of its agents or affiliates or the Custodian shall convert or cause to be converted by sale or in any other manner that it may determine that foreign currency into Dollars, and those Dollars shall be distributed to the Owners entitled thereto. A cash distribution may be made upon an averaged or other practicable basis without regard to any distinctions among Owners based on exchange restrictions, the date of delivery of any American Depositary Shares or otherwise and shall be net of any expenses of conversion into Dollars incurred by the Depositary as provided in Section 5.9 of the Deposit Agreement.

-53-

If a conversion of foreign currency or the repatriation or distribution of Dollars can be effected only with the approval or license of any government or agency thereof, the Depositary may, but will not be required to, file an application for that approval or license.

If the Depositary determines that in its judgment any foreign currency received by the Depositary or the Custodian is not convertible on a reasonable basis into Dollars transferable to the United States, or if any approval or license of any government or agency thereof that is required for such conversion is not filed or sought by the Depositary or is not obtained within a reasonable period as determined by the Depositary, the Depositary may distribute the foreign currency received by the Depositary to, or in its discretion may hold such foreign currency uninvested and without liability for interest thereon for the respective accounts of, the Owners entitled to receive the same.

If any conversion of foreign currency, in whole or in part, cannot be effected for distribution to some of the Owners entitled thereto, the Depositary may in its discretion make that conversion and distribution in Dollars to the extent practicable and permissible to the Owners entitled thereto and may distribute the balance of the foreign currency received by the Depositary to, or hold that balance uninvested and without liability for interest thereon for the account of, the Owners entitled thereto.

The Depositary may convert currency itself or through any of its affiliates, or the Custodian or the Company may convert currency and pay Dollars to the Depositary. Where the Depositary converts currency itself or through any of its affiliates, the Depositary acts as principal for its own account and not as agent, advisor, broker or fiduciary on behalf of any other person and earns revenue, including, without limitation, transaction spreads, that it will retain for its own account. The revenue is based on, among other things, the difference between the exchange rate assigned to the currency conversion made under the Deposit Agreement and the rate that the Depositary or its affiliate receives when buying or selling foreign currency for its own account. The Depositary makes no representation that the exchange rate used or obtained by it or its affiliate in any currency conversion under the Deposit Agreement will be the most favorable rate that could be obtained at the time or that the method by which that rate will be determined will be the most favorable to Owners, subject to the Depositary’s obligations under Section 5.3 of that Agreement. The methodology used to determine exchange rates used in currency conversions made by the Depositary is available upon request. Where the Custodian converts currency, the Custodian has no obligation to obtain the most favorable rate that could be obtained at the time or to ensure that the method by which that rate will be determined will be the most favorable to Owners, and the Depositary makes no representation that the rate is the most favorable rate and will not be liable for any direct or indirect losses associated with the rate. In certain instances, the Depositary may receive dividends or other distributions from the Company in Dollars that represent the proceeds of a conversion of foreign currency or translation from foreign currency at a rate that was obtained or determined by or on behalf of the Company and, in such cases, the Depositary will not engage in, or be responsible for, any foreign currency transactions and neither it nor the Company makes any representation that the rate obtained or determined by the Company is the most favorable

-54-

rate and neither it nor the Company will be liable for any direct or indirect losses associated with the rate.

15.    RECORD DATES.

Whenever a cash dividend, cash distribution or any other distribution is made on Deposited Securities or rights to purchase Shares or other securities are issued with respect to Deposited Securities (which rights will be delivered to or exercised or sold on behalf of Owners in accordance with Section 4.4 of the Deposit Agreement) or the Depositary receives notice that a distribution or issuance of that kind will be made, or whenever the Depositary receives notice that a meeting of holders of Shares will be held in respect of which the Company has requested the Depositary to send a notice under Section 4.7 of the Deposit Agreement, or whenever the Depositary will assess a fee or charge against the Owners, or whenever the Depositary causes a change in the number of Shares that are represented by each American Depositary Share, or whenever the Depositary otherwise finds it necessary or convenient, the Depositary shall fix a record date, which shall be the same as, or as near as practicable to, any corresponding record date set by the Company with respect to Shares, (a) for the determination of the Owners (i) who shall be entitled to receive the benefit of that dividend or other distribution or those rights, (ii) who shall be entitled to give instructions for the exercise of voting rights at that meeting, (iii) who shall be responsible for that fee or charge or (iv) for any other purpose for which the record date was set, or (b) on or after which each American Depositary Share will represent the changed number of Shares. Subject to the provisions of Sections 4.1 through 4.5 of the Deposit Agreement and to the other terms and conditions of the Deposit Agreement, the Owners on a record date fixed by the Depositary shall be entitled to receive the amount distributable by the Depositary with respect to that dividend or other distribution or those rights or the net proceeds of sale thereof in proportion to the number of American Depositary Shares held by them respectively, to give voting instructions or to act in respect of the other matter for which that record date was fixed, or be responsible for that fee or charge, as the case may be.

16.    VOTING OF DEPOSITED SHARES.

(a)    Upon receipt of notice of any meeting of holders of Shares at which holders of Shares will be entitled to vote, if requested in writing by the Company, the Depositary shall, as soon as practicable thereafter, Disseminate to the Owners a notice, the form of which shall be in the sole discretion of the Depositary, that shall contain (i) the information contained in the notice of meeting received by the Depositary, (ii) a statement that the Owners as of the close of business on a specified record date will be entitled, subject to any applicable provision of Colombian law and of the By-laws of the Company, to instruct the Depositary as to the exercise of the voting rights pertaining to the amount of Shares represented by their respective American Depositary Shares, (iii) a statement as to the manner in which those instructions may be given, including an express indication that

-55-

instructions may be deemed given in accordance with the last sentence of paragraph (b) below, if no instruction is received, to give a proxy to Fiduciaria Bancolombia S.A. or any successor thereto or such other person as the Company may designate as permitted under Colombian law (the “Designee”) to vote that number of deposited Shares as to each matter in the same manner and in the same proportion that all deposited Shares are voted on the respective matter, and (iv) the last date on which the Depositary will accept instructions (the “Instruction Cutoff Date”).

(b)    Upon the written request of an Owner of American Depositary Shares, as of the date of the request or, if a record date was specified by the Depositary, as of that record date, received on or before any Instruction Cutoff Date established by the Depositary, the Depositary may, and if the Depositary sent a notice under the preceding paragraph shall, endeavor, in so far as practicable, to vote or cause to be voted the amount of deposited Shares represented by those American Depositary Shares in accordance with the instructions set forth in that request. The Depositary shall not vote or attempt to exercise the right to vote that attaches to the deposited Shares other than in accordance with instructions given by Owners and received or deemed received by the Depositary or as provided in the following sentence. If

(i) the Company instructed the Depositary to Disseminate a notice under paragraph (a) above and complied with the paragraph (d) below,

(ii) no instructions are received by the Depositary from an Owner with respect to a matter and an amount of American Depositary Shares of that Owner on or before the Instruction Cutoff Date, and

(iii) the Depositary has received from the Company, by the business day following the Instruction Cutoff Date, a written confirmation that, as of the Instruction Cutoff Date, (x) the Company wishes a proxy to be given under this sentence, and (y) the Company reasonably does not know (A) that there is any substantial opposition to the matter and (B) that the matter is materially adverse to the interests of shareholders,

then, the Depositary shall deem that Owner to have instructed the Depositary to give a proxy to the Designee with respect to that matter and the amount of deposited Shares represented by that amount of American Depositary Shares to vote that amount of deposited Shares as to that matter in the same manner and in the same proportion that all deposited Shares are voted on the respective matter, and the Depositary shall give a proxy to the Designee to vote that amount of deposited Shares as to each matter in the same manner and in the same proportion that all deposited Shares are voted on the respective matter.

(c)    There can be no assurance that Owners generally or any Owner in particular will receive the notice described in paragraph (a) above in time to enable Owners to give instructions to the Depositary prior to the Instruction Cutoff Date.

-56-

(d)    In order to give Owners a reasonable opportunity to instruct the Depositary as to the exercise of voting rights relating to Shares, if the Company will request the Depositary to Disseminate a notice under paragraph (a) above, the Company shall give the Depositary notice of the meeting, details concerning the matters to be voted upon and copies of materials to be made available to holders of Shares in connection with the meeting not less than 30 days prior to the meeting date.

17.    TENDER AND EXCHANGE OFFERS; REDEMPTION, REPLACEMENT OR CANCELLATION OF DEPOSITED SECURITIES.

(a)    The Depositary shall not tender any Deposited Securities in response to any voluntary cash tender offer, exchange offer or similar offer made to holders of Deposited Securities (a “Voluntary Offer”), except when instructed in writing to do so by an Owner surrendering American Depositary Shares and subject to any conditions or procedures the Depositary may require.

(b)    If the Depositary receives a written notice that Deposited Securities have been redeemed for cash or otherwise purchased for cash in a transaction that is mandatory and binding on the Depositary as a holder of those Deposited Securities (a “Redemption”), the Depositary, at the expense of the Company, shall (i) if required, surrender Deposited Securities that have been redeemed to the issuer of those securities or its agent on the redemption date, (ii) Disseminate a notice to Owners (A) notifying them of that Redemption, (B) calling for surrender of a corresponding number of American Depositary Shares and (C) notifying them that the called American Depositary Shares have been converted into a right only to receive the money received by the Depositary upon that Redemption and those net proceeds shall be the Deposited Securities to which Owners of those converted American Depositary Shares shall be entitled upon surrenders of those American Depositary Shares in accordance with Section 2.5 or 6.2 of the Deposit Agreement and (iii) distribute the money received upon that Redemption to the Owners entitled to it upon surrender by them of called American Depositary Shares in accordance with Section 2.5 of that Agreement (and, for the avoidance of doubt, Owners shall not be entitled to receive that money under Section 4.1 of that Agreement). If the Redemption affects less than all the Deposited Securities, the Depositary shall call for surrender a corresponding portion of the outstanding American Depositary Shares and only those American Depositary Shares will automatically be converted into a right to receive the net proceeds of the Redemption. The Depositary shall allocate the American Depositary Shares converted under the preceding sentence among the Owners pro-rata to their respective holdings of American Depositary Shares immediately prior to the Redemption, except that the allocations may be adjusted so that no fraction of a converted American Depositary Share is allocated to any Owner. A Redemption of all or substantially all of the Deposited Securities shall be a Termination Option Event.

(c)    If the Depositary is notified of or there occurs any change in nominal value or any subdivision, combination or any other reclassification of the Deposited Securities or any recapitalization, reorganization, sale of assets substantially as an entirety, merger or

-57-

consolidation affecting the issuer of the Deposited Securities or to which it is a party that is mandatory and binding on the Depositary as a holder of Deposited Securities and, as a result, securities or other property have been or will be delivered in exchange, conversion,

replacement or in lieu of, Deposited Securities (a “Replacement”), the Depositary shall, if required, surrender the old Deposited Securities affected by that Replacement of Shares and hold, as new Deposited Securities under the Deposit Agreement, the new securities or other property delivered to it in that Replacement. However, the Depositary may elect to sell those new Deposited Securities if in the opinion of the Depositary it is not lawful or not practical for it to hold those new Deposited Securities under the Deposit Agreement because those new Deposited Securities may not be distributed to Owners without registration under the Securities Act of 1933 or for any other reason, at public or private sale, at such places and on such terms as it deems proper and proceed as if those new Deposited Securities had been Redeemed under paragraph (b) above. A Replacement shall be a Termination Option Event.

(d)    In the case of a Replacement where the new Deposited Securities will continue to be held under the Deposit Agreement, the Depositary may call for the surrender of outstanding Receipts to be exchanged for new Receipts specifically describing the new Deposited Securities and the number of those new Deposited Securities represented by each American Depositary Share. If the number of Shares represented by each American Depositary Share decreases as a result of a Replacement, the Depositary may call for surrender of the American Depositary Shares to be exchanged on a mandatory basis for a lesser number of American Depositary Shares and may sell American Depositary Shares to the extent necessary to avoid distributing fractions of American Depositary Shares in that exchange and distribute the net proceeds of that sale to the Owners entitled to them.

(e)    If there are no Deposited Securities with respect to American Depositary Shares, including if the Deposited Securities are cancelled, or the Deposited Securities with respect to American Depositary Shares have become apparently worthless, the Depositary may call for surrender of those American Depositary Shares or may cancel those American Depositary Shares, upon notice to Owners, and that condition shall be a Termination Option Event.

18.    LIABILITY OF THE COMPANY AND DEPOSITARY.

Neither the Depositary nor the Company nor any of their respective directors, employees, agents or affiliates shall incur any liability to any Owner or Holder:

(i) if by reason of (A) any provision of any present or future law or regulation or other act or action of the government of the United States, any State of the United States or any other state or jurisdiction, or of any governmental or regulatory authority or stock exchange; (B) (in the case of the Depositary only) any provision, present or future, of the By-laws of the Company, or by reason of any provision of any securities issued or distributed by the Company, or any offering or distribution thereof; or (C) any event or circumstance, whether natural or caused by a person or persons, that is beyond the ability

-58-

of the Depositary or the Company, as the case may be, to prevent or counteract by reasonable care or effort (including, but not limited to earthquakes, floods, severe storms, fires, explosions, war, terrorism, civil unrest, labor disputes, criminal acts or outbreaks of infectious disease; interruptions or malfunctions of utility services, Internet or other communications lines or systems; unauthorized access to or attacks on computer systems or websites; or other failures or malfunctions of computer hardware or software or other systems or equipment), the Depositary or the Company is, directly or indirectly, prevented from, forbidden to or delayed in, or could be subject to any civil or criminal penalty on account of doing or performing and therefore does not do or perform, any act or thing that, by the terms of the Deposit Agreement or the Deposited Securities, it is provided shall be done or performed;

(ii) for any exercise of, or failure to exercise, any discretion provided for in the Deposit Agreement (including any determination by the Depositary to take, or not take, any action that the Deposit Agreement provides the Depositary may take);

(iii) for the inability of any Owner or Holder to benefit from any distribution, offering, right or other benefit that is made available to holders of Deposited Securities but is not, under the terms of the Deposit Agreement, made available to Owners or Holders; or

(iv) for any special, consequential or punitive damages for any breach of the terms of the Deposit Agreement.

Where, by the terms of a distribution to which Section 4.1, 4.2 or 4.3 of the Deposit Agreement applies, or an offering to which Section 4.4 of that Agreement applies, or for any other reason, that distribution or offering may not be made available to Owners, and the Depositary may not dispose of that distribution or offering on behalf of Owners and make the net proceeds available to Owners, then the Depositary shall not make that distribution or offering available to Owners, and shall allow any rights, if applicable, to lapse.

Neither the Company nor the Depositary assumes any obligation or shall be subject to any liability under the Deposit Agreement to Owners or Holders, except that they agree to perform their obligations specifically set forth in the Deposit Agreement without negligence or bad faith. The Depositary shall not be a fiduciary or have any fiduciary duty to Owners or Holders. The Depositary shall not be subject to any liability with respect to the validity or worth of the Deposited Securities. Neither the Depositary nor the Company shall be under any obligation to appear in, prosecute or defend any action, suit, or other proceeding in respect of any Deposited Securities or in respect of the American Depositary Shares, on behalf of any Owner or Holder or other person. Neither the Depositary nor the Company shall be liable for any action or non-action by it in reliance upon the advice of or information from legal counsel, accountants, any person presenting Shares for deposit, any Owner or Holder, or any other person believed by it in good faith to be competent to give such advice or information. Each of the Depositary and the Company may rely, and shall be protected in relying upon, any written notice, request, direction or other document

-59-

believed by it to be genuine and to have been signed or presented by the proper party or parties. The Depositary shall not be liable for any acts or omissions made by a successor depositary whether in connection with a previous act or omission of the Depositary or in connection with a matter arising wholly after the removal or resignation of the Depositary, provided that in connection with the issue out of which such potential liability arises, the Depositary performed its obligations without negligence or bad faith while it acted as Depositary. The Depositary shall not be liable for the acts or omissions of any securities depository, clearing agency or settlement system in connection with or arising out of book-entry settlement of American Depositary Shares or Deposited Securities or otherwise. In the absence of bad faith on its part, the Depositary shall not be responsible for any failure to carry out any instructions to vote any of the Deposited Securities or for the manner in which any such vote is cast or the effect of any such vote. The Depositary shall have no duty to make any determination or provide any information as to the tax status of the Company or any liability for any tax consequences that may be incurred by Owners or Holders as a result of owning or holding American Depositary Shares. The Depositary shall not be liable for the inability or failure of an Owner or Holder to obtain the benefit of a foreign tax credit, reduced rate of withholding or refund of amounts withheld in respect of tax or any other tax benefit.

19.    RESIGNATION AND REMOVAL OF THE DEPOSITARY; APPOINTMENT OF SUCCESSOR CUSTODIAN.

The Depositary may at any time resign as Depositary under the Deposit Agreement by written notice of its election so to do delivered to the Company, to become effective upon the appointment of a successor depositary and its acceptance of such appointment as provided in the Deposit Agreement. The Depositary may at any time be removed by the Company by 90 days’ prior written notice of that removal, to become effective upon the later of (i) the 90th day after delivery of the notice to the Depositary and (ii) the appointment of a successor depositary and its acceptance of its appointment as provided in the Deposit Agreement. The Depositary in its discretion may at any time appoint a substitute or additional custodian or custodians.

20.    AMENDMENT.

The form of the Receipts and any provisions of the Deposit Agreement may at any time and from time to time be amended by agreement between the Company and the Depositary without the consent of Owners or Holders in any respect which they may deem necessary or desirable. Any amendment that would impose or increase any fees or charges (other than taxes and other governmental charges, registration fees, cable (including SWIFT) or facsimile transmission costs, delivery costs or other such expenses), or that would otherwise prejudice any substantial existing right of Owners, shall, however, not become effective as to outstanding American Depositary Shares until the expiration of 30 days after notice of that amendment has been Disseminated to the Owners of outstanding American Depositary Shares. Every Owner and Holder, at the time any amendment so becomes effective, shall be deemed, by continuing to hold American Depositary Shares or

-60-

any interest therein, to consent and agree to that amendment and to be bound by the Deposit Agreement as amended thereby. Upon the effectiveness of an amendment to the form of Receipt, including a change in the number of Shares represented by each American Depositary Share, the Depositary may call for surrender of Receipts to be replaced with new Receipts in the amended form or call for surrender of American Depositary Shares to effect that change of ratio. In no event shall any amendment impair the right of the Owner to surrender American Depositary Shares and receive delivery of the Deposited Securities represented thereby, except in order to comply with mandatory provisions of applicable law.

21.    TERMINATION OF DEPOSIT AGREEMENT.

(a)    The Company may initiate termination of the Deposit Agreement by notice to the Depositary. The Depositary may initiate termination of the Deposit Agreement if (i) at any time 90 days shall have expired after the Depositary delivered to the Company a written resignation notice and a successor depositary has not been appointed and accepted its appointment as provided in Section 5.4 of that Agreement or (ii) a Termination Option Event has occurred. If termination of the Deposit Agreement is initiated, the Depositary shall Disseminate a notice of termination to the Owners of all American Depositary Shares then outstanding setting a date for termination (the “Termination Date”), which shall be at least 90 days after the date of that notice, and the Deposit Agreement shall terminate on that Termination Date.

(b)    After the Termination Date, the Company shall be discharged from all obligations under the Deposit Agreement except for its obligations to the Depositary under Sections 5.8 and 5.9 of that Agreement.

(c)    At any time after the Termination Date, the Depositary may sell the Deposited Securities then held under the Deposit Agreement and may thereafter hold uninvested the net proceeds of any such sale, together with any other cash then held by it hereunder, unsegregated and without liability for interest, for the pro rata benefit of the Owners of American Depositary Shares that remain outstanding, and those Owners will be general creditors of the Depositary with respect to those net proceeds and that other cash. After making that sale, the Depositary shall be discharged from all obligations under the Deposit Agreement, except (i) to account for the net proceeds and other cash (after deducting, in each case, the fee of the Depositary for the surrender of American Depositary Shares, any expenses for the account of the Owner of such American Depositary Shares in accordance with the terms and conditions of the Deposit Agreement and any applicable taxes or governmental charges), (ii) for its obligations under Section 5.8 of that Agreement and (iii) to act as provided in paragraph (d) below.

(d)    After the Termination Date, the Depositary shall continue to receive dividends and other distributions pertaining to Deposited Securities (that have not been sold), may sell rights and other property as provided in the Deposit Agreement and shall deliver Deposited Securities (or sale proceeds) upon surrender of American Depositary

-61-

Shares (after payment or upon deduction, in each case, of the fee of the Depositary for the surrender of American Depositary Shares, any expenses for the account of the Owner of

those American Depositary Shares in accordance with the terms and conditions of the Deposit Agreement and any applicable taxes or governmental charges). After the Termination Date, the Depositary shall not accept deposits of Shares or deliver American Depositary Shares. After the Termination Date, (i) the Depositary may refuse to accept urrenders of American Depositary Shares for the purpose of withdrawal of Deposited Securities (that have not been sold) or reverse previously accepted surrenders of that kind that have not settled if in its judgment the requested withdrawal would interfere with its efforts to sell the Deposited Securities, (ii) the Depositary will not be required to deliver cash proceeds of the sale of Deposited Securities until all Deposited Securities have been sold and (iii) the Depositary may discontinue the registration of transfers of American Depositary Shares and suspend the distribution of dividends and other distributions on Deposited Securities to the Owners and need not give any further notices or perform any further acts under the Deposit Agreement except as provided in Section 6.2 of that Agreement.

22.    DTC DIRECT REGISTRATION SYSTEM AND PROFILE MODIFICATION SYSTEM.

(a)    Notwithstanding the provisions of Section 2.4 of the Deposit Agreement, the parties acknowledge that DTC’s Direct Registration System (“DRS”) and Profile Modification System (“Profile”) apply to the American Depositary Shares upon acceptance thereof to DRS by DTC. DRS is the system administered by DTC that facilitates interchange between registered holding of uncertificated securities and holding of security entitlements in those securities through DTC and a DTC participant. Profile is a required feature of DRS that allows a DTC participant, claiming to act on behalf of an Owner of American Depositary Shares, to direct the Depositary to register a transfer of those American Depositary Shares to DTC or its nominee and to deliver those American Depositary Shares to the DTC account of that DTC participant without receipt by the Depositary of prior authorization from the Owner to register that transfer.

(b)    In connection with DRS/Profile, the parties acknowledge that the Depositary will not determine whether the DTC participant that is claiming to be acting on behalf of an Owner in requesting registration of transfer and delivery as described in paragraph (a) above has the actual authority to act on behalf of that Owner (notwithstanding any requirements under the Uniform Commercial Code). For the avoidance of doubt, the provisions of Sections 5.3 and 5.8 of the Deposit Agreement apply to the matters arising from the use of the DRS/Profile. The parties agree that the Depositary’s reliance on and compliance with instructions received by the Depositary through the DRS/Profile system and otherwise in accordance with the Deposit Agreement, shall not constitute negligence or bad faith on the part of the Depositary.

23.    Disclosure of Beneficial Ownership; Ownership Restrictions.

-62-

Notwithstanding any other provision of the Deposit Agreement or this Receipt, each Owner and Holder agrees to be bound by and subject to the By-laws and to any

restrictions on Share ownership or transferability under applicable Colombian law (to the same extent as if such American Depositary Shares were the Shares represented by such American Depositary Shares, provided, however, that such provisions shall apply to such persons only to the extent feasible). The Company may restrict transfers of the Shares where such transfer might result in ownership of Shares exceeding the limits under applicable law or the Company’s charter. The Company may also restrict, in such manner as it deems appropriate, transfers of the American Depositary Shares where such transfer may result in the total number of Shares represented by the American Depositary Shares beneficially owned by a single Owner or Holder to exceed the limits under any applicable law or the Company’s charter. Pursuant to the By-laws and applicable law as in effect on the date of this Deposit Agreement, (i) no individual holder of Shares may hold, directly or indirectly, in excess of 10% of the Company’s subscribed capital without the prior authorization of the Superintendency of Finance in Colombia; and (ii) no individual may offer for sale or purchase 10% or more of the Company’s subscribed capital without the prior authorization of the Superintendency of Finance. The Company may, in its sole discretion, instruct the Depositary to take action with respect to the ownership interest, or transfer thereof, of any Owner or Holder in excess of the limitation set forth in the preceding sentence. The Depositary agrees to use its reasonable efforts to comply to the extent practicable with any reasonable instructions received from the Company requesting that the Depositary take the actions specified therein as contemplated in the preceding sentence.

In addition, Owners and Holders are subject to regulations under the Securities Exchange Act of 1934, pursuant to which inter alia acquisition or sale of American Depositary Shares representing Shares in excess of prescribed limits must be notified to the Commission and to any securities exchange on which the American Depositary Shares are listed.

24.    APPOINTMENT OF AGENT FOR SERVICE OF PROCESS; SUBMISSION TO

JURISDICTION; JURY TRIAL WAIVER; WAIVER OF IMMUNITIES.

The Company has (i) appointed Puglisi & Associates, 850 Library Avenue, Suite 204, Newark, Delaware 19711 as the Company’s authorized agent in the United States upon which process may be served in any suit or proceeding arising out of or relating to the Shares or Deposited Securities, the American Depositary Shares, the Receipts or the Deposit Agreement, (ii) consented and submitted to the jurisdiction of any state or federal court in the State of New York in which any such suit or proceeding may be instituted, and (iii) agreed that service of process upon said authorized agent shall be deemed in every respect effective service of process upon the Company in any such suit or proceeding.

EACH PARTY TO THE DEPOSIT AGREEMENT (INCLUDING, FOR AVOIDANCE OF DOUBT, EACH OWNER AND HOLDER) THEREBY

-63-

IRREVOCABLY WAIVES, TO THE FULLEST EXTENT PERMITTED BY APPLICABLE LAW, ANY RIGHT IT MAY HAVE TO A TRIAL BY JURY IN ANY

SUIT, ACTION OR PROCEEDING AGAINST THE COMPANY AND/OR THE DEPOSITARY DIRECTLY OR INDIRECTLY ARISING OUT OF OR RELATING TO THE SHARES OR OTHER DEPOSITED SECURITIES, THE AMERICAN DEPOSITARY SHARES OR THE RECEIPTS, THE DEPOSIT AGREEMENT OR ANY TRANSACTION CONTEMPLATED HEREIN OR THEREIN, OR THE BREACH HEREOF OR THEREOF, INCLUDING, WITHOUT LIMITATION, ANY QUESTION REGARDING EXISTENCE, VALIDITY OR TERMINATION (WHETHER BASED ON CONTRACT, TORT OR ANY OTHER THEORY)AND ANY CLAIM BASED ON U.S. FEDERAL SECURITIES LAWS.

No disclaimer of liability under the United States federal securities laws or the rules and regulations thereunder is intended by any provision of the Deposit Agreement, inasmuch as no person is able to effectively waive the duty of any other person to comply with its obligations under those laws, rules and regulations.

To the extent that the Company or any of its properties, assets or revenues may have or hereafter become entitled to, or have attributed to it, any right of immunity, on the grounds of sovereignty or otherwise, from any duty of performance under the Deposit Agreement, claim, legal action, suit or proceeding, from the giving of any relief in any respect thereof, from setoff or counterclaim, from the jurisdiction of any court, from service of process, from attachment upon or prior to judgment, from attachment in aid of execution or judgment, or other legal process or proceeding for the giving of any relief or for the enforcement of any judgment, in any jurisdiction in which proceedings may at any time be commenced, with respect to its obligations, liabilities or any other matter under or arising out of or in connection with the Shares or Deposited Securities, the American Depositary Shares, the Receipts or the Deposit Agreement, the Company, to the fullest extent permitted by law, hereby irrevocably and unconditionally waives, and agrees not to plead or claim, any such immunity and consents to such relief and enforcement.

-64-

Document

Exhibit 2.4

EXHIBIT 2.4 DESCRIPTION OF SECURITIES REGISTERED UNDER SECTION 12 OF THE U.S. SECURITIES EXCHANGE ACT OF 1934

As of December 31, 2025, Grupo Cibest S.A. had the following series of securities registered pursuant to Section 12(b) of the U.S. Securities Exchange Act of 1934, as amended (the 'Exchange Act'):

Title of each class	Trading Symbol(s)	Name of each exchange on which<br><br>Registered
American Depositary Shares<br><br>Preferred Shares	CIB<br><br>CIB	New York Stock Exchange<br><br>New York Stock Exchange1

Capitalized terms used but not defined herein have the meanings given to them in Grupo Cibest’s annual report on Form 20-F for the fiscal year ended December 31, 2025. References to 'CIB', 'the Company', 'we', 'us', or 'our' in this document refer to Grupo Cibest S.A. only and not to the subsidiaries of Grupo Cibest S.A.

OVERVIEW OF CAPITALIZATION

Grupo Cibest’s bylaws provide for an authorized capital stock of COP 700 billion divided into 1,400,000,000 shares of a par value of COP 500 each, which must belong to one of the following classes: (i) common shares ('Common Shares'), (ii) privileged shares; and (iii) shares with preferred dividend and no voting rights ('Preferred Shares'). Pursuant to Article 8 of the bylaws, all shares issued shall have the same par value. As of December 31, 2025, a total of 509,103,132 Common Shares and 444,111,532 Preferred Shares were registered in Grupo Cibest’s stockholder registry in the name of 52,243 stockholders. A total of 113,309,660 representing 25.51% of Preferred Shares were directly held by the depositary in the United States and were held by 33 record holders registered in The Bank of New York Mellon’s registered stockholder list. Given that some of the Preferred Shares and American Depository Shares ('ADSs') are held by nominees, the number of record holders may not be representative of the number of beneficial owners.

PREFERRED SHARES

The following description of Grupo Cibest’s Preferred Shares is a summary of the material terms of the bylaws and Colombian corporate law regarding the Preferred Shares and the holders thereof. The following description is qualified in its entirety by reference to our bylaws (an English translation of which is attached as exhibit to our annual report on Form 20-F for the year ended December 31, 2025, as Exhibit 1.1) and applicable law.

General

Grupo Cibest’s Preferred Shares were approved for issuance from the authorized capital stock and are non-voting (except as described below), non-cumulative Preferred Shares. The Colombian Securities Exchange is the principal non-U.S. trading market for the Preferred Shares and the sole market for the Common Shares. As of December 31, 2025, the market capitalization for Grupo Cibest Preferred Shares based on the closing price in the Colombian Securities Exchange was COP 26,647 billion (Grupo Cibest’s total market capitalization,

1    Grupo Cibest’s Preferred Shares are not listed for trading directly, but only in connection with its American Depositary Shares, which are evidenced by American Depositary Receipts, each representing four preferred shares.

which includes the Common Shares and Preferred Shares, was COP 61,878 billion or USD 16.47 billion as of the same date).

There are no official market makers or independent specialists on the Colombian Securities Exchange to ensure market liquidity and, therefore, orders to buy or sell in excess of corresponding orders to sell or buy are not executed. The aggregate equity market capitalization of the Colombian Securities Exchange, as of December 31, 2025, was COP 500,564 billion (USD 133.21 billion), with 75 companies listed as of that date.

Neither the registration of Grupo Cibest Preferred Shares in the National Registry of Securities and Issuers (Registro Nacional de Valores y Emisores) nor the approval of any public offer by the SFC should be understood as a rating or assumption of liability by the SFC with respect to us, the price, quality or the tradability of the securities or of our solvency.

Registration and Transfer

The Preferred Shares are evidenced by a dematerialized global certificate held for custody by Deposito Centralizado de Valores de Colombia - Deceval S.A. ('Deceval'), in registered form without dividend coupons attached. Grupo Cibest maintains a stock registry through Deceval and only those holders listed in that stock registry as holders of Preferred Shares are recognized by Grupo Cibest as holders of Preferred Shares. Each registration or transfer of Preferred Shares will be effected only by the book entry record on such stock registry. Any such registration will be effected without charge to the person requesting such registration, but subject to payment by such person of any taxes, stamp duties or other governmental charges payable in connection therewith. The Bank of New York Mellon, which acts as depositary (the 'Depositary') for our American Depositary Receipts ('ADRs') facility, or the depositary’s nominee shall be the registered holder on behalf of beneficial owners of ADSs representing the Preferred Shares, which shall be deposited with Fiduciaria Bancolombia S.A., as agent of the Depositary (the 'Custodian').

In general, transfers of shares of listed companies in Colombia are required to be effected through the Colombian Securities Exchange. The following transfers, however, are not required to be effected through the Colombian Securities Exchange: (i) transfers between shareholders that have the same beneficial owner provided that such condition is evidenced to the SFC; (ii) transfers by operation of law (such as inheritance, liquidation of companies or judicial decisions, among others); (iii) transfers as payment in kind provided that a one year pre-existence of the payment obligation is evidenced to the SFC; and (iv) transfers whose amount does not exceed the value of 66,000 Unidades de Valor Real (or UVRs), a Colombian inflation-adjusted monetary index calculated by the board of directors of the Central Bank of Colombia (the 'Central Bank') and generally used for pricing home-mortgage loans; as of April 8, 2026 approximately U.S.$ 7,307.96. Neither Grupo Cibest nor the Depositary will be liable for any failure to comply with the ownership limitation or failure to respond to any request for information to determine compliance with the ownership limitation.

Colombian securities regulations forbid a shareholder to pre-arrange transactions on shares of listed companies unless the pre- arrangement is disclosed publicly and to the SFC at least one month in advance.

Voting Rights

The holders of Preferred Shares are not entitled to receive notice of, attend or vote at any general shareholders’ meeting of holders of Common Shares except as described below.

Each Preferred Share entitles its holders to vote on the basis of one vote per share at any general shareholders’ meeting, whenever a shareholders vote is required on the following matters:

(i) when voting the anticipated dissolution, merger or transformation of the corporation or change of its corporate purpose;

(ii) when the preferred dividend has not been fully paid during two consecutive annual terms. In this event, holders of such Preferred Shares shall retain their voting rights until the corresponding dividends have been fully paid to them;

(iii) if at the end of a fiscal year, Grupo Cibest’s profits are not enough to pay the minimum dividend and the SFC, by its own decision or upon request of holders of at least 10% of Preferred Shares, determines that benefits were concealed or shareholders were misled with regard to the benefits received from Grupo Cibest by Grupo Cibest's directors or officers decreasing the profits to be distributed, then, the Superintendency of Companies may resolve that holders of Preferred Shares should participate with speaking and voting rights at the general shareholders’ meeting, in accordance with the terms established by law;

(iv) when the registration of shares at the Colombian Securities Exchange or at the National Registry of Securities and Issuers (Registro Nacional de Valores y Emisores) is suspended or canceled. In this event, voting rights shall be maintained until the irregularities that resulted in such cancellation or suspension are resolved;

(v) when voting amendments that could impair the Preferred Shares' rights, or the conversion of the Preferred Shares to Common Shares, a favorable vote of a minimum of 70% of the subscribed capital stock, including the favorable vote of a minimum of 70% of the Preferred Shares, is required; and

(vi) when the general shareholders' meeting order the payment of dividends with issued shares. In this event, the decision shall be approved with a favorable vote of 80% of the Common Shares represented, and 80% of the Preferred Shares subscribed.

Except in the events set forth above, holders of Preferred Shares are not entitled to vote for the election of directors or to influence our management policies.

The holders of Preferred Shares will not be entitled to receive notice of a general meeting of the holders of Common Shares unless they have the right to vote on any of the matters to be addressed at such meeting. Each holder of Preferred Shares shall have the right to vote individually on any of the matters on which the holders of Preferred Shares have voting rights.

In accordance with Grupo Cibest's bylaws, notice of meetings at which holders of Preferred Shares are entitled to vote shall be published in at least one daily newspaper with a wide circulation in Grupo Cibest’s principal place of business, as is the case for any other shareholders’ meeting. Each notice must state: (i) the date of the meeting, (ii) a description of any resolution to be proposed for adoption at the meeting on which the holders of Preferred Shares are entitled to vote and (iii) instructions for the delivery of proxies.

General shareholders’ meetings may be ordinary meetings or extraordinary meetings. Ordinary general shareholders’ meetings are held at least once a year within the three months following the end of the prior fiscal year. Extraordinary general shareholders’ meetings may take place when duly called for a specific purpose, or, without prior notice, when holders representing all outstanding shares entitled to vote on the issues presented are present at the meeting.

Quorum for both ordinary and extraordinary general shareholders’ meetings to be convened at first call requires the presence of two or more shareholders representing at least half plus one of the outstanding shares entitled to vote at the relevant meeting. If a quorum is not present, a subsequent meeting is called at which the presence of one or more holders of shares entitled to vote at the relevant meeting constitutes a quorum, regardless of the number of shares represented.

Ordinary general shareholders' meetings may be called by the board of directors and the CEO. Extraordinary general shareholders' meetings may be called by the board of directors, the CEO or external auditor of Grupo Cibest. In addition, according to Grupo Cibest's bylaws, two or more shareholders representing at least 10% of the outstanding shares have the right to request that a general shareholders meeting be convened.

Notice of ordinary meetings and extraordinary meetings convened to approve year-end balance sheets, increases of authorized capital, reductions of the outstanding capital, mergers, spin-offs, or the assignment of assets, liabilities and contracts representing more than 25% of their total value, or where members are to be

elected to the Board of Directors, must be published in one newspaper of wide circulation at Grupo Cibest’s principal place of business at least 15 business days prior to the date set for such meeting. In all other cases, 5 calendar days’ notice will suffice. When calculating these deadlines, neither the day on which the call is issued nor the day of the meeting will be counted.

Except when Colombian law or Grupo Cibest's bylaws require a special majority, action may be taken at a general shareholders’ meeting by the vote of two or more shareholders representing a majority of Common Shares present. Pursuant to Colombian law and/or Grupo Cibest's bylaws, special majorities are required to adopt the following resolutions:

(i) a favorable vote of at least 70% of the Common Shares represented at a general shareholders’ meeting is required to approve the issuance of shares without preemptive rights available to the shareholders;

(ii) a favorable vote of at least 78% of Common Shares represented at a general shareholders’ meeting is required to decide not to distribute as dividend at least 50% of the annual net profits of any given fiscal year;

(iii) a favorable vote of at least 80% of the holders of Common Shares represented at a general shareholders’ meeting, and 80% of the holders of outstanding Preferred Shares is required to approve the payment dividend in shares; and

(iv) a favorable vote of at least 70% of the holders of Common Shares and of outstanding Preferred Shares is required to effect a decision to impair the conditions or rights established for such Preferred Shares, or a decision to convert Preferred Shares into Common Shares.

Dividends

The holders of Common Shares are entitled to receive dividends declared by the general shareholders' meeting out of legally available profits.

Under the Colombian Commerce Code, at least 50% of Grupo Cibest's annual net profits must be distributed to shareholders unless a higher majority of 78% of the Common Shares represented at the meeting approves a lower distribution. If total amount of reserves exceed paid-in capital, the minimum distribution increases to 70%.

Therefore, Grupo Cibest's, annual net profits are applied as follows:

(i) first, once the balance sheet has been approved, the appropriation for the payment of taxes of the corresponding taxable year has been made, 10% of net profits is allocated to the legal reserve until such reserve is equal to at least 50% of our paid-in capital;

(ii) second, payment of the minimum dividend on the Preferred Shares; and

(iii) third, the remainder is allocated as determined by the shareholders upon the recommendation of the Board of Directors and CEO.

In accordance with Colombian law and Grupo Cibest's bylaws, the dividends payable to the holders of Common Shares cannot exceed the dividends payable to holders of the Preferred Shares.

Holders of Preferred Shares are entitled to receive dividends based on the profits of Grupo Cibest from the preceding fiscal year, after deducting losses affecting the capital and allocating the legally required reserve, but before creating or accruing for any other reserve. Holders of Preferred Shares are entitled to a minimum preferred dividend equal to 1% yearly of the subscription price per share, provided this dividend is higher than the dividend assigned to Common Shares. If the dividend declared on Common Shares exceeds the minimum preferred dividend, the dividend payable on the Preferred Shares will be increased to equal the per share dividend on the Common Shares.

Payment of the preferred dividend shall be made at the time and in the manner established by the general shareholders’ meeting and in the priority indicated by Colombian law.

The general shareholders’ meeting may allocate a portion of the profits to welfare, education or civic services, or to support economic organizations of Cibest Corporate Group's employees.

The dividend payments may be made in installments which must be approved at the ordinary general shareholders’ meeting. In the general shareholders’ meeting, shareholders will determine the effective date, the system and the place for payment of dividends.

Dividends declared on the Preferred Shares will be payable to the record holders of those shares, as they appear on our stock registry, on the appropriate record dates as determined by the general shareholders’ meeting. Generally, any stock dividend payable by us to the holders of Preferred Shares will be paid in Preferred Shares. However, the general shareholders’ meeting may authorize the payment in Common Shares to all shareholders. Any in-kind dividend payable in shares requires the approval of 80% or more of the voting interest of the Common Shares present at a shareholders’ meeting and the approval of 80% or more of the voting interest of the outstanding Preferred Shares. In the event that such voting majority is not obtained, shareholders may individually elect to receive a stock dividend or in cash.

Liquidation Rights

Grupo Cibest will be dissolved if certain events take place, including the following:

(i) our term of existence, as stated in the by-laws, expires without being extended by the shareholders prior to its expiration date;

(ii) by reduction of the number of stockholders below the number required by the law for its establishment and operation;

(iii) by decision of the general shareholders’ meeting; and

(iv) in certain other events expressly provided for by Colombian law and our bylaws.

Upon dissolution, a liquidator must be appointed by the general shareholders’ meeting to wind up our affairs.

Upon liquidation, holders of fully paid Preferred Shares will be entitled to receive in pesos, out of the surplus assets available for distribution to shareholders, pari passu with any of the other shares ranking at that time pari passu with the Preferred Shares, an amount equal to the nominal value of those Preferred Shares before any distribution or payment may be made to holders of Common Shares or any other shares at that time ranking junior to the Preferred Shares with regard to participation in our surplus assets. If, upon any liquidation, the assets that are available for distribution among the holders of Preferred Shares and liquidation parity shares are insufficient to pay in full their respective liquidation preferences, then those assets will be distributed among those holders pro-rata in accordance with the respective liquidation preference amounts payable to them.

Subject to the preferential liquidation rights of holders of Preferred Shares, all fully paid Common Shares will be entitled to participate equally in any distribution upon liquidation. Partially paid Common Shares must participate in a distribution upon liquidation in the same proportion that those shares have been paid at the time of the distribution.

To the extent there are surplus assets available for distribution after full payment to the holders of Common Shares of the nominal value of the Common Shares, the surplus assets will be distributed among all holders of shares of capital stock pro-rata in accordance with their respective holdings of shares.

Preemptive Rights and Other Anti-Dilution Provisions

Pursuant to the Colombian Commerce Code, Grupo Cibest is allowed to have an amount of outstanding capital stock equal to or smaller than the authorized capital stock set out in the bylaws. Under Grupo Cibest bylaws, the holders of Common Shares determine the amount of authorized capital stock, and the board of directors has the power to (a) order the issuance and regulate the terms of subscription of Common Shares up to the total amount of authorized capital stock and (b) regulate the issuance of Preferred Shares, when expressly delegated by the general shareholders’ meeting. The issuance of Preferred Shares must always be first approved by the general shareholders’ meeting, which shall determine the nature and extent of any privileges, according to Grupo Cibest bylaws and Colombian law.

At the time a Colombian company is formed, its outstanding capital stock must represent at least 50% of the authorized capital. Any increases in the authorized capital stock or decreases in the outstanding capital stock must be approved by the majority of shareholders required to approve a general amendment to the by-laws.

Grupo Cibest’s by-laws and Colombian law require that, whenever Grupo Cibest issues new shares of any outstanding class, Grupo Cibest must offer the holders of each class of shares the right to purchase a number of shares of such class sufficient to maintain their existing percentage ownership of the aggregate capital stock. These rights are called preemptive rights.

Shareholders at a general shareholders’ meeting may suspend preemptive rights with respect to a particular capital increase by a favorable vote of at least 70% of the Common Shares represented at a general shareholders’ meeting. Preemptive rights must be exercised within the period stated in the share placement terms of the increase, which cannot be shorter than 15 business days following the publication of the notice of the public offer of that capital increase. From the date of the notice of the share placement terms, preemptive rights may be transferred separately from the corresponding shares.

The SFC will authorize decreases in the outstanding capital stock decided by the holders of Common Shares only if:

(i) Grupo Cibest has no liabilities;

(ii) Grupo Cibest creditors consent in writing; or

(iii) the outstanding capital stock remaining after the reduction represents at least twice the amount of Grupo Cibest’s liabilities.

Other Provisions

Limits on the Issuance of Shares with Preferred Dividends and No Voting Rights

Preferred Shares may not represent more than 50% of the outstanding capital.

Limits on Purchases and Sales of Capital Stock by Related Parties

Pursuant to the Colombian Commerce Code, the members of Grupo Cibest's Board of Directors and certain of Grupo Cibest's senior management may not, directly or indirectly, buy or sell shares of Grupo Cibest's capital stock while they hold their positions, except when dealing on a non-speculative basis and in that case they need to obtain the prior authorization of the Board of Directors passed with the vote of two thirds of its members, (excluding, in the case of transactions by a director, such director’s vote) or when deemed relevant by the Board of Directors with the authorization of the shareholders meeting the affirmative vote of the ordinary majority foreseen in the bylaws.

No Redemption Provisions

Under Colombian law, Grupo Cibest may repurchase shares of its capital stock, as long as any repurchases are approved at a shareholders' meeting and the repurchases meet certain Colombian law requirements.

AMERICAN DEPOSITARY SHARES

The following section summarizes the material provisions of the Amended and Restated Deposit Agreement, dated as of May 16, 2025, entered into by Grupo Cibest, the Depositary and the owners and beneficial owners from time to time of ADRs, (the 'Deposit Agreement'), pursuant to which the ADSs are issued.

As of December 31, 2025, Grupo Cibest had 444,111,532 Preferred Shares outstanding. A total of 113,309,660 representing 25.51% of Preferred Shares were part of the ADR program and were held by 33 record holders registered in The Bank of New York Mellon’s registered stockholder list. Given that some of the Preferred Shares and ADSs are held by nominees, the number of record holders may not be representative of the number of beneficial owners. A beneficial owner includes anyone who has the power to receive the economic benefit of ownership of the securities. ADRs evidencing ADSs are deliverable by The Bank of New York Mellon, as the Depositary pursuant to the Deposit Agreement. Each ADS represents four Preferred Shares or evidences the right to receive four Preferred Shares.

Copies of the Deposit Agreement are available for inspection at the Corporate Trust Office of the Depositary (the 'Corporate Trust Office'), currently located at 101 Barclay Street, New York, New York 10286, and at the office of the Custodian, currently located at Carrera 48 # 26-85, Medellin, Colombia or Calle 28 # 13a-75, Edificio Atrio, Bogota, Colombia. The Depositary’s principal executive office is located at One Wall Street, New York, New York 10286. The Deposit Agreement is also an exhibit to our registration statement on Form F-3 filed with the U.S. Securities and Exchange Commission on April 28, 2022.

Restrictions Regarding Foreign Investment in Colombia

The following includes a brief summary of certain restrictions on foreign investment in Colombia and does not purport to be complete.

Colombia’s International Investment Regime, Part 17 of Decree 1068 of 2015, as amended (the 'International Investment Regime') regulates the manner in which nonresident entities and individuals can invest in Colombia and participate in the Colombian securities markets. Among other requirements, the regime mandates the registration of certain foreign exchange transactions with the Central Bank and specifies procedures to authorize and administer certain types of foreign investments. International investments are regulated by the Central Bank by means of External Resolution 1 of 2018 and External Circular DCIP 83, both as amended, which set forth in detail the regulation and procedures regarding foreign investment in Colombia.

Investors who wish to hold Grupo Cibest's ADSs will be required to submit to the Custodian certain information and comply with certain registration procedures required under the foreign investment regulations in connection with foreign exchange controls regarding currency conversion (generally COP/USD, related to the foreign investment). Holders of ADRs who wish to withdraw the underlying Preferred Shares will also have to comply with certain registration and reporting procedures. See 'Deposit, Transfer and Withdrawal' below. Under Colombian foreign investment regulations, the failure of a non-Colombian resident investor to report or register foreign exchange transactions relating to investments in Colombia with the Central Bank, on a timely basis, may prevent the investor from obtaining remittance rights, constitute an exchange control infraction and result in a fine.

Approval was obtained from the SFC for the depositary facility established for Bancolombia ADSs as an institutional fund pursuant to the International Investment Regime. In addition, the SFC authorized the initial and subsequent deposits of Preferred Shares with the custodian for the purposes of issuing Bancolombia ADSs. Under such law, the custodian acted as the local administrator of such fund and had certain reporting obligations to the Central Bank and to the SFC. A subsequent approval of the SFC was not required in connection with the establishment of Grupo Cibest ADS facility.

Deposit, Transfer and Withdrawal

The Depositary has agreed, subject to the terms and conditions of the Deposit Agreement, that upon delivery to the Custodian of Preferred Shares (or evidence of rights to receive Preferred Shares) and pursuant to

appropriate instruments of transfer in a form satisfactory to the Custodian, the Depositary will, upon payment of the fees, charges and taxes provided in the Deposit Agreement, execute and deliver an ADR or ADRs, registered in the name or names of the person or persons named in the notice of the Custodian delivered to the Depositary or requested by the person depositing such Preferred Shares with the Depositary. Such ADR or ADRs shall evidence any authorized number of ADSs requested by such person or persons and shall be executed and delivered at the Depositary’s Corporate Trust Office. Each deposit must be accompanied by a written notice describing the price paid for the Preferred Shares being deposited (including any commissions paid to a securities broker in Colombia) in order to enable the Custodian to comply with the foreign exchange regulations of the Central Bank with respect to the fund or such other matters as may be required from time to time under applicable Colombian law.

Upon surrender at the Corporate Trust Office of the Depositary of an ADR for the purpose of withdrawal of the deposited securities represented by the ADSs evidenced by such ADR, and upon payment of the fees of the Depositary for the surrender of ADRs, governmental charges and taxes provided in the Deposit Agreement, and subject to the terms and conditions of the Deposit Agreement, our bylaws and the terms of the deposited securities, the owner of such ADR will be entitled to delivery, to such owner or upon his order, of the amount of deposited securities at the time represented by the ADS or ADSs evidenced by such ADR. The forwarding of share certificates, other securities, property, cash and other documents of title for such delivery will be at the risk and expense of the owner. Any non-resident owner or beneficial owner requesting withdrawals of Preferred Shares or other deposited securities upon surrender of ADRs must deliver to the Depositary a written notice specifying either that those Preferred Shares or other deposited securities:

(i) have been or are to be sold in Colombia simultaneously with such withdrawal of the Preferred Shares or other deposited securities; or

(ii) are to be held by such owner or beneficial owner, or to its order, without sale, in which case such owner or beneficial owner must acknowledge its obligations to register its investment under the foreign investment regulations, if applicable, and make the required foreign exchange report to the Central Bank.

Such non-resident withdrawing owner or beneficial owner must also deliver or cause to be delivered to the Central Bank a written notice relating to the sales price realized (net of sales commissions paid or payable to a Colombian securities broker) in respect of the sale of Preferred Shares (or other deposited securities, as the case may be) and such other certifications as may be required from time to time under applicable Colombian law.

A non-resident owner or beneficial owner who withdraws Preferred Shares or other deposited securities to or for his own account or for the account of a nonresident third party and who does not sell or cause to be sold such Preferred Shares or other deposited securities in Colombia simultaneously with such withdrawal will be subject to the foreign investment regulations and will be required individually to comply with one of the authorized forms of foreign investment in securities of Colombian issuers described below:

(i) investment through an institutional fund; or

(ii) investment through an individual fund.

Such owner, beneficial owner or third party may be required to register its foreign capital investment in the Preferred Shares (i.e., the purchase price of Preferred Shares plus any securities brokerage commissions paid to Colombian brokers) deposited pursuant to the terms of the Deposit Agreement by or on behalf of such owner or beneficial owner, or the purchase price of ADSs, if ADSs were purchased from a prior owner or beneficial owner thereof, with the Central Bank, in accordance with the requirements of the applicable exchange declaration.

Non-resident owners or beneficial owners should consult with their investment advisers prior to any withdrawal of Preferred Shares in the event that such securities may not be sold or held by such owner or beneficial owner in Colombia at the time of such withdrawal. Neither we, the Depositary nor the Custodian

will have any liability or responsibility whatsoever under the Deposit Agreement or otherwise for any action or failure to act by any owner or beneficial owner relating to its obligations under the foreign investment regulations or any other Colombian law or regulation relating to foreign investment in Colombia in respect of a withdrawal or sale of Preferred Shares or other deposited securities, including, without limitation, any failure to comply with a requirement to register such investment pursuant to the terms of the foreign investment regulations prior to such withdrawal or any failure to report foreign exchange transactions to the Central Bank, as the case may be. In addition, the Deposit Agreement provides that the owner or beneficial owner will be responsible for reporting of any false information relating to foreign exchange transactions to the Custodian or the Central Bank in connection with deposits or withdrawals of Preferred Shares or other deposited securities.

Subject to the terms and conditions of the Deposit Agreement and any limitations established by the Depositary, unless requested by us to cease doing so, the Depositary may deliver ADRs prior to the receipt of preferred shares (a 'Pre-release') and deliver shares upon the receipt and cancellation of ADRs which have been Pre-released, whether or not such cancellation is prior to the satisfaction of that Pre-release or the Depositary knows that any ADR has been Pre-released.

The Depositary may receive ADRs in lieu of Preferred Shares in satisfaction of a Pre-release. Each Pre-release must be:

(i) preceded or accompanied by a written representation from the person to whom the ADRs or Preferred Shares are to be delivered that such person, or its customer, beneficially owns the Preferred Shares or ADRs to be remitted, as the case may be, and assigns all beneficial right, title, and interest in such Preferred Shares or ADRs to the Depositary;

(i) at all times fully collateralized with cash or such other collateral as the Depositary deems appropriate;

(ii) terminable by the Depositary on not more than five business days’ notice; and

(iii) subject to such further indemnities and credit regulations as the Depositary deems appropriate.

Dividends, Other Distributions and Rights

Subject to any restrictions imposed by Colombian law, regulations or applicable permits, the Depositary is required, as promptly as practicable:

(i) to convert or cause to be converted into U.S. dollars, to the extent that in its judgment it can do so on a reasonable basis and can transfer the resulting U.S. dollars to the United States, all cash dividends and other cash distributions denominated in a currency other than U.S. dollars, including pesos ('Foreign Currency'), that it receives in respect of the deposited Preferred Shares; and

(ii) to distribute, as promptly as practicable, the resulting U.S. dollar amount (net of reasonable and customary expenses incurred by the Depositary in converting such Foreign Currency) to the owners entitled thereto, in proportion to the number of ADSs representing such deposited securities evidenced by ADRs held by them, respectively.

If the Depositary determines that in its judgment any Foreign Currency received by the Depositary or the Custodian cannot be converted on a reasonable basis into U.S. dollars transferable to the United States, or if any approval or license of any government or agency thereof which is required for such conversion is denied or in the opinion of the Depositary is not obtainable, or if any such approval or license is not obtained within a reasonable period as determined by the Depositary, the Depositary may distribute the Foreign Currency received by the Depositary or the Custodian to, or in its discretion may hold such foreign currency uninvested and without liability for interest thereon for the respective accounts of, the owners entitled to receive the same. If any such conversion of foreign currency, in whole or in part, cannot be distributed to some of the owners entitled thereto, the Depositary may in its discretion make such conversion and distribution in U.S. dollars to the extent permissible to the owners entitled thereto, and may distribute the balance of the foreign

currency received by the Depositary to, or hold such balance uninvested and without liability for interest thereon for, the respective accounts of, the owners entitled thereto.

If we declare a dividend in, or a free distribution of, Preferred Shares, the Depositary may, and will if we request, distribute to the owners of outstanding ADRs entitled thereto additional ADRs evidencing an aggregate number of ADSs that represents the amount of Preferred Shares received as such dividend or free distribution, in proportion to the number of ADSs evidenced by the ADRs held by them, subject to the terms and conditions of the Deposit Agreement with respect to the deposit of Preferred Shares and the issuance of ADSs evidenced by ADRs, including the withholding of any tax or other governmental charge and the payment of fees of the Depositary. The Depositary may withhold any such distribution of ADRs if it has not received satisfactory assurances from us that such distribution does not require registration under the U.S. Securities Act of 1933, as amended (the 'Securities Act'), or is exempt from registration under the provisions of the Securities Act. In lieu of delivering ADRs for fractional ADSs in the event of any such dividend or free distribution, the Depositary will sell the amount of Preferred Shares represented by the aggregate of such fractions and distribute the net proceeds in accordance with the Deposit Agreement. If additional ADRs are not so distributed, each ADS will thenceforth also represent the additional Preferred Shares distributed upon the deposited securities represented thereby.

If we offer or cause to be offered to the holders of any deposited securities any rights to subscribe for additional Preferred Shares or any rights of any other nature, the Depositary will have discretion as to the procedure to be followed in making such rights available to any owners of ADRs or in disposing of such rights for the benefit of any owners and making the net proceeds available in U.S. dollars to such owners or, if by the terms of such rights offering or for any other reason, the Depositary may not either make such rights available to any owners or dispose of such rights and make the net proceeds available to such owners, then the Depositary shall allow the rights to lapse; provided, however, if at the time of the offering of any rights the Depositary determines in its discretion that it is lawful and feasible to make such rights available to all owners or to certain owners but not to other owners, the Depositary may distribute to any owner to whom it determines the distribution to be lawful and feasible, in proportion to the number of ADSs held by such owner, warrants or other instruments therefor in such form as it deems appropriate. If the Depositary determines in its discretion that it is not lawful and feasible to make such rights available to certain owners, it may sell the rights, warrants or other instruments in proportion to the number of ADSs held by the owners to whom it has determined it may not lawfully or feasibly make such rights available, and allocate the net proceeds of such sales for the account of such owners otherwise entitled to such rights, warrants or other instruments, upon an averaged or other practical basis without regard to any distinctions among such owners because of exchange restrictions or the date of delivery of any ADR or ADRs, or otherwise.

In circumstances in which rights would not otherwise be distributed, if an owner of ADRs requests the distribution of warrants or other instruments in order to exercise the rights allocable to the ADSs of such owner, the Depositary will make such rights available to such owner upon written notice from us to the Depositary that:

(i) we have elected in our sole discretion to permit such rights to be exercised; and

(ii) such owner has executed such documents as we have determined in our sole discretion are reasonably required under applicable law.

Upon instruction pursuant to such warrants or other instruments to the Depositary from such owner to exercise such rights, upon payment by such owner to the Depositary for the account of such owner of an amount equal to the purchase price of the Preferred Shares to be received in exercise of the rights, and upon payment of the fees of the Depositary as set forth in such warrants or other instruments, the Depositary will, on behalf of such owner, exercise the rights and purchase the Preferred Shares, and we will cause the Preferred Shares so purchased to be delivered to the Depositary on behalf of such owner. As agent for such owner, the Depositary will cause the Preferred Shares so purchased to be deposited, and will execute and deliver ADRs to such owner, pursuant to the Deposit Agreement.

The Depositary will not offer rights to owners unless both the rights and the securities to which such rights relate are either exempt from registration under the Securities Act with respect to a distribution to all owners or are registered under the provisions of the Securities Act; provided, that nothing in the Deposit Agreement will create, or be construed to create, any obligation on our part to file a registration statement with respect to such rights or underlying securities or to endeavor to have such a registration statement declared effective. If an owner of ADRs requests the distribution of warrants or other instruments, notwithstanding that there has been no such registration under the Securities Act, the Depositary will not effect such distribution unless it has received an opinion from recognized counsel in the United States for Grupo Cibest upon which the Depositary may rely that such distribution to such owner is exempt from such registration. The Depositary will not be responsible for any failure to determine that it may be lawful or feasible to make such rights available to owners in general or any owner in particular.

Although Colombian law permits preemptive rights to be transferred separately from the Preferred Shares to which such rights relate, a liquid market for preemptive rights may not exist, and this may adversely affect the amount the Depositary would realize upon disposal of such rights.

Whenever the Depositary receives any distribution other than cash, Preferred Shares or rights in respect of the deposited securities, the Depositary will cause the securities or property received by it to be distributed to the owners entitled thereto, after deduction or upon payment of any fees and expenses of the Depositary or any taxes or other governmental charges, in proportion to their holdings, respectively, in any manner that the Depositary may reasonably deem equitable and practicable for accomplishing such distribution; provided, however, that if in the opinion of the Depositary such distribution cannot be made proportionately among the owners entitled thereto, or if for any other reason (including, but not limited to, any requirement that we or the Depositary withhold an amount on account of taxes or other governmental charges or that such securities must be registered under the Securities Act in order to be distributed to owners or beneficial owners) the Depositary deems such distribution not to be feasible, the Depositary may adopt such method as it may deem equitable and practicable for the purposes of effecting such distribution, including, but not limited to, the public or private sale of the securities or property thus received, or any part thereof, and the net proceeds of any such sale (net of the fees and expenses of the depositary) will be distributed by the Depositary to the owners entitled thereto as in the case of a distribution received in cash.

If the Depositary determines that any distribution of property (including Preferred Shares and rights to subscribe therefor) is subject to any taxes or other governmental charges which the Depositary is obligated to withhold, the Depositary may, by public or private sale, dispose of all or a portion of such property in such amount and in such manner as the Depositary deems necessary and practicable to pay such taxes or charges and the depositary will distribute the net proceeds of any such sale after deduction of such taxes or charges to the owners entitled thereto in proportion to the number of ADSs held by them, respectively.

Changes Affecting Deposited Preferred Shares

Upon any change in nominal or par value, stock split, consolidation or any other reclassification of deposited securities, or upon any recapitalization, reorganization, merger or consolidation or sale of assets affecting us or to which we are a party, any securities which shall be received by the Depositary or Custodian in exchange for, in conversion of, or in respect of deposited securities will be treated as new deposited securities under the Deposit Agreement, and the ADSs will thenceforth represent, in addition to the existing deposited securities, the right to receive the new deposited securities so received in exchange or conversion, unless additional ADRs are delivered pursuant to the following sentence. In any such case the Depositary may, and will, if we so request, execute and deliver additional ADRs as in the case of a distribution in Preferred Shares, or call for the surrender of outstanding ADRs to be exchanged for new ADRs specifically describing such new deposited securities.

Record Dates

Whenever:

(i) any cash dividend or other cash distribution shall become payable or any distribution other than cash shall be made;

(ii) rights shall be issued with respect to the deposited securities;

(iii) for any reason the Depositary causes a change in the number of Preferred Shares that are represented by each ADS;

(iv) the Depositary shall receive notice of any meeting of holders of Preferred Shares or other deposited securities; or

(v) the Depositary shall find it necessary or convenient,

the Depositary will fix a record date,

(a) for the determination of the owners who will be (A) entitled to receive such dividend, distribution or rights, or the net proceeds of the sale thereof, or (B) entitled to give instructions for the exercise of voting rights at any such meeting; or

(b) on or after which each ADS will represent the changed number of Preferred Shares, all subject to the provisions of the Deposit Agreement.

Voting of Deposited Securities

Holders of Preferred Shares, and consequently holders of ADS, have very limited voting rights. See “Preferred Shares --Voting Rights” above.

In the event holders of Preferred Shares are entitled to vote, upon receipt of notice of any meeting or solicitation of consents or proxies of holders of Preferred Shares or other deposited securities, if requested in writing by us, the Depositary will, as soon as practicable thereafter, mail to all owners a notice, the form of which notice will be in the sole discretion of the Depositary, containing:

(i) the information included in such notice of meeting received by the Depositary from us;

(ii) a statement that the owners as of the close of business on a specified record date will be entitled, subject to any applicable provision of Colombian law and of our bylaws, to instruct the Depositary as to the exercise of the voting rights, if any, pertaining to the amount of Preferred Shares or other deposited securities represented by their respective ADSs; and

(iii) a statement as to the manner in which such instructions may be given.

Upon the written request of an owner on such record date, received on or before the date established by the Depositary for such purpose, the Depositary will endeavor, insofar as practicable, to vote or cause to be voted the amount of Preferred Shares or other deposited securities represented by the ADSs evidenced by such ADRs in accordance with the nondiscretionary instructions set forth in such request. The Depositary will not vote or attempt to exercise the right to vote that attaches to the Preferred Shares or other deposited securities other than in accordance with such instructions. If the Depositary does not receive instructions from the owner on or before the date established by the Depositary for such purpose, the Depositary shall take such action as is necessary, upon our request, subject to applicable law, the bylaws and the terms and conditions of the deposited securities, to cause the underlying Preferred Shares to be counted for purposes of satisfying applicable quorum requirements.

There can be no assurance that the owners generally or any owner in particular will receive the notice described above sufficiently prior to the date established by the Depositary for the receipt of instructions to ensure that the Depositary will in fact receive such instructions on or before such date.

Reports and Other Communications

The Depositary makes available for inspection by ADR owners at its Corporate Trust Office any reports and communications, including any proxy soliciting material, received from us, which are both:

(i) received by the Depositary as the holder of the Preferred Shares or other deposited securities; and

(ii) made generally available to the holders of such Preferred Shares or other deposited securities by us.

The Depositary will also send to the owners copies of such reports and communications furnished by us pursuant to the Deposit Agreement. Any such reports and communications including any proxy soliciting material furnished to the Depositary by us will be furnished in English when so required pursuant to any regulations of the SEC.

Amendment and Termination of the Deposit Agreement

The form of ADRs and any provisions of the Deposit Agreement may at any time and from time to time be amended by agreement between us and the Depositary in any respect which they may deem necessary or desirable without the consent of the owners of ADRs; provided, however, that any amendment that imposes or increases any fees or charges (other than taxes and other governmental charges, registration fees, cable, telex or facsimile transmission costs, delivery costs or other expenses), or which otherwise prejudices any substantial existing right of ADR owners, will not take effect as to outstanding ADRs until the expiration of 30 days after notice of any amendment given to the owners of outstanding ADRs. Every owner of an ADR, at the time any amendment becomes effective, will be deemed, by continuing to hold such ADR, to consent and agree to such amendment and to be bound by the Deposit Agreement as amended thereby. In no event will such amendment impair the right of the owner or any ADR to surrender such ADR and receive therefor the Preferred Shares or other deposited securities represented thereby, except to comply with mandatory provisions of applicable law.

The Depositary will at any time at our direction terminate the Deposit Agreement by mailing notice of such termination to the owners of the ADRs then outstanding at least 90 days prior to the date fixed in such notice for such termination. The Depositary may likewise terminate the Deposit Agreement by mailing notice of such termination to us and the owners of all ADRs outstanding if, at any time after 90 days have expired after the Depositary has delivered to us a written notice of its election to resign, a successor depositary has been appointed and accepted its appointment, in accordance with the terms of the Deposit Agreement. If any ADRs remain outstanding after the date of termination of the Deposit Agreement, the Depositary thereafter shall discontinue the registration of transfers of ADRs, will suspend the distribution of dividends to the owners thereof and will not give any further notices or perform any further acts under the Deposit Agreement, except the collection of dividends and other distributions pertaining to the deposited securities, the sale of rights and other property and the delivery of underlying Preferred Shares or other deposited securities, together with any dividends or other distributions received with respect thereto and the net proceeds of the sale of any rights or other property, in exchange for surrendered ADRs (after deducting, in each case, the fees of the Depositary for the surrender of an ADR and other expenses set forth in the Deposit Agreement and any applicable taxes or governmental charges). At any time after the expiration of one year from the date of termination, the Depositary may sell the deposited securities then held thereunder and hold uninvested the net proceeds of such sale, together with any other cash, unsegregated and without liability for interest, for the pro-rata benefit of the owners that have not theretofore surrendered their ADRs, such owners thereupon becoming general creditors of the Depositary with respect to such proceeds. After making such sale, the Depositary will be discharged from all obligations under the Deposit Agreement, except to account for net proceeds and other cash (after deducting, in each case, the fee of the Depositary and other expenses set forth in the Deposit Agreement for the surrender of an ADR and any applicable taxes or other governmental charges).

Charges of Depositary

The Depositary will charge any party depositing or withdrawing Preferred Shares or any party surrendering ADRs or to whom ADRs are issued (including, without limitation, issuance pursuant to a stock dividend or

stock split declared by us or an exchange of stock regarding the ADRs or deposited securities or a distribution of ADRs pursuant to the Deposit Agreement) where applicable:

(i) taxes and other governmental charges,

(ii) such registration fees as may from time to time be in effect for the registration of transfers of ADSs generally on the ADS register of the issuer or foreign registrar and applicable to transfers of ADSs to the name of the Depositary or its nominee or the Custodian or its nominee on the making of deposits or withdrawals,

(iii) such cable, telex and facsimile transmission expenses as are expressly provided in the Deposit Agreement,

(iv) such expenses as are incurred by the Depositary in the conversion of foreign currency pursuant to the Deposit Agreement,

(v) a fee of $5.00 or less per 100 ADSs (or portion thereof) for the execution and delivery of ADRs pursuant to the Deposit Agreement, and for the surrender of ADRs pursuant to the Deposit Agreement,

(vi) a fee of $1.50 or less per certificate for an ADR or ADRs for transfers made pursuant to the Deposit Agreement, and

(vii) a fee for, and deducted from, the distribution of proceeds of the sale of rights pursuant to the Deposit Agreement, such fee being in an amount equal to the fee for the execution and delivery of ADSs referred to above which would have been charged as a result of the deposit of ADSs received upon the exercise of such rights, but which rights are instead sold and the proceeds of such sale distributed by the Depositary to owners.

The Depositary, pursuant to the Deposit Agreement, may own and deal in any class of securities issued by us and our affiliates and in ADRs.

Liability of Owner for Taxes

If any tax or other governmental charge shall become payable by the Custodian or the Depositary with respect to any ADR of any deposited securities represented by the ADSs evidenced by such ADR, such tax or other governmental charge will be payable by the owner or beneficial owner of such ADR to the Depositary. The Depositary may refuse to effect any transfer of such ADR or any withdrawal of deposited securities underlying such ADR until such payment is made, and may withhold any dividends or other distributions, or may sell for the account of the owner or beneficial owner thereof any part or all of the deposited securities underlying such ADR and may apply such dividends, distributions or the proceeds of any such sale to pay any such tax or other governmental charge and the owner or beneficial owner of such ADR will remain liable for any deficiency.

General

Neither the Depositary nor we nor any of our respective directors, employees, agents or affiliates will be liable to any owner or beneficial owner of ADRs, if by reason of any provision of any present or future law or regulation of the United States, Colombia or any other country, or of any other governmental or regulatory authority or stock exchange, or by reason of any provision, present or future, of our bylaws, or by reason of any provision of any securities issued or distributed by us, or any offering or distribution thereof, or by reason of any act of God or war or other circumstances beyond its control, the Depositary or us or any of our respective directors, employees, agents or affiliates shall be prevented, delayed or forbidden from, or be subject to any civil or criminal penalty on account of, doing or performing any act or thing which by the terms of the Deposit Agreement or the deposited securities it is provided will be done or performed; nor will the Depositary or us incur any liability to any owner or beneficial owner of any ADR by reason of any non- performance or delay, caused as aforesaid, in the performance of any set or thing which by the terms of the Deposit Agreement it is provided will or may be done or performed, or by reason of any exercise of, or failure

to exercise, any discretion provided for under the Deposit Agreement. Where, by the terms of a distribution pursuant to the Deposit Agreement, or an offering or distribution pursuant to the Deposit Agreement, or for any other reason, such distribution or offering may not be made available to owners, and the Depositary may not dispose of such distribution or offering on behalf of such owners and make the net proceeds available to such owners, then the Depositary will not make such distribution or offering, and will not allow the rights, if applicable, to lapse.

Neither we nor the Depositary assumes any obligation, nor we or the Depositary will be subject to any liability under the Deposit Agreement to owners or beneficial owners of ADRs, except that we and the depositary agree to perform our respective obligations specifically set forth under the Deposit Agreement without negligence or bad faith.

The ADRs are transferable on the books of the Depositary, provided, that the Depositary may close the transfer books at any time or from time to time when deemed expedient by it in connection with the performance of its duties or upon our written request. As a condition precedent to the execution and delivery, registration of transfer, split-up, combination or surrender of any ADR or withdrawal of any deposited securities, the Depositary, the Custodian or the registrar may require payment from the person representing the ADR or the depositor of the Preferred Shares of a sum sufficient to reimburse it for any tax or other governmental charge and any stock, transfer or registration fee with respect thereto (including any such tax or charge and fee with respect to Preferred Shares being deposited or withdrawn) and payment of any applicable fees payable by the holders of ADRs. The Depositary may refuse to deliver ADRs, to register the transfer of any ADR or to make any distribution on, or related to, Preferred Shares until it has received such proof of citizenship or residence, exchange control approval, approval or registration under the foreign investment regulations or other information as it may deem necessary or proper. The delivery, transfer, registration of transfer of outstanding ADRs and surrender of ADRs generally may be suspended or refused during any period when our or the Depositary’s transfer books are closed or if any such action is deemed necessary or advisable by us or the Depositary, at any time or from time to time.

The Depositary keeps books, at its Corporate Trust Office, for the registration and transfer of ADRs, which at all reasonable times are open for inspection by the owners, provided, that such inspection is not for the purpose of communicating with owners in the interest of a business or object other than our business or a matter related to the Deposit Agreement or the ADRs.

The Depositary may appoint one or more co-transfer agents for the purpose of effecting transfers, combinations and split-ups of ADRs at designated transfer offices on behalf of the Depositary. In carrying out its functions, a co-transfer agent may require evidence of authority and compliance with applicable laws and other requirements by owners or persons entitled to ADRs and will be entitled to protection and indemnity to the same extent as the Depositary.

Document

Exhibit 8.1

LIST OF SUBSIDIARIES (EXHIBIT)

ENTITY	JURISDICTION OF INCORPORATION	BUSINESS	PROPORTION OF OWNERSHIP INTEREST AND VOTING POWER HELD BY CIBEST CORPORATE GROUP 2025	PROPORTION OF OWNERSHIP INTEREST AND VOTING POWER HELD BY CIBEST CORPORATE GROUP 2024	PROPORTION OF OWNERSHIP INTEREST AND VOTING POWER HELD BY CIBEST CORPORATE GROUP 2023
Valores Cibest S.A.S.(1)	Colombia	Investments	100.00%	-%	-%
Inversiones Cibest S.A.S.(1)	Colombia	Investments	100.00%	-%	-%
Cibest Investment Management S.A.S.(1)	Colombia	Investments	100.00%	-%	-%
Cibest Inversiones Estratégicas S.A.S.(1)	Colombia	Investments	100.00%	-%	-%
Bancolombia S.A.(1)	Colombia	Banking	100.00%	100.00%	100.00%
Fiduciaria Bancolombia S.A. Sociedad Fiduciaria	Colombia	Trust	98.81%	98.81%	98.81%
Banca de Inversión Bancolombia S.A. Corporación Financiera	Colombia	Investment banking	100.00%	100.00%	100.00%
Valores Bancolombia S.A. Comisionista de Bolsa	Colombia	Securities brokerage	100.00%	100.00%	100.00%
Wompi S.A.S.	Colombia	Technology services provider	100.00%	100.00%	100.00%
Renting Colombia S.A.S.	Colombia	Operating leasing	100.00%	100.00%	100.00%
Transportempo S.A.S. "En liquidación"(2)	Colombia	Transportation	-%	-%	100.00%
Inversiones CFNS S.A.S.	Colombia	Investments	100.00%	100.00%	99.94%
P.A Tokenización Novus(3)	Colombia	Trust for administration and payments	100.00%	-%	-%
Negocios Digitales Colombia S.A.S.	Colombia	Payment solutions	100.00%	100.00%	100.00%
Fondo de Capital Privado Fondo Inmobiliario Colombia(4)	Colombia	Real estate investment fund	78.48%	80.47%	80.47%
P.A. Inmuebles CEM(4)	Colombia	Mercantile trust	78.48%	80.47%	80.47%
P.A. Calle 92 FIC-11(4)	Colombia	Mercantile trust	51.01%	52.31%	52.31%
P.A. FIC Edificio Corfinsura(4)	Colombia	Mercantile trust	78.48%	80.47%	80.47%
P.A. FIC-A5(4)	Colombia	Mercantile trust	78.48%	80.47%	80.47%
P.A. FIC Inmuebles(4)	Colombia	Mercantile trust	78.48%	80.47%	80.47%
P.A. FIC Clínica de Prado(4)	Colombia	Mercantile trust	60.47%	62.00%	62.00%
P. A. FIC A6(4)	Colombia	Mercantile trust	78.48%	80.47%	80.47%
P.A. Central Point(4)	Colombia	Mercantile trust	58.86%	60.35%	60.35%
---	---	---	---	---	---
Fideicomiso Irrevocable de Garantía, Fuente de Pago y Administración Inmobiliaria Polaris(5)	Colombia	Mercantile trust	-%	-%	80.47%
P.A. Fideicomiso Twins Bay(4)	Colombia	Mercantile trust	78.48%	80.47%	80.47%
Fideicomiso Lote Av San Martín(4)	Colombia	Mercantile trust	78.48%	80.47%	80.47%
P.A. Fideicomiso Lote 30(4)	Colombia	Mercantile trust	78.48%	80.47%	80.47%
Fideicomiso Fondo Inmobiliario Bancolombia(4)	Colombia	Mercantile trust	78.48%	80.47%	80.47%
P.A. Florencia Ferrara(4)	Colombia	Mercantile trust	43.16%	44.26%	44.26%
P.A. Flor Morado Plaza(4)	Colombia	Mercantile trust	78.48%	80.47%	80.47%
P.A. Galería la 33(6)	Colombia	Mercantile trust	-%	80.47%	80.47%
P.A Linz Granz del Rio(4)	Colombia	Mercantile trust	43.16%	44.26%	-%
Fideicomiso Selecto Terrazu Etapa 1 Torre 1(4)	Colombia	Mercantile trust	62.79%	64.38%	-%
Fideicomiso Selecto Terrazu Etapa 1 Torre 2(7)	Colombia	Mercantile trust	62.79%	-%	-%
Fideicomiso Lote C6 Carton de Colombia(7)	Colombia	Mercantile trust	43.16%	-%	-%
Fideicomiso Mokana Recursos(7)	Colombia	Mercantile trust	39.24%	-%	-%
Fideicomiso River Park(7)	Colombia	Mercantile trust	43.16%	-%	-%
Valores Simesa S.A.(8)	Colombia	Investments	57.40%	62.75%	64.93%
Fideicomiso Lote Distrito Vera B1B2(9)	Colombia	Mercantile trust	-%	62.44%	64.61%
Fideicomiso Lote Distrito Vera B3B4(10)	Colombia	Mercantile trust	-%	-%	64.61%
P.A. FAI Calle 77	Colombia	Mercantile trust	98.00%	98.00%	98.00%
P.A. Nomad Salitre	Colombia	Mercantile trust	98.00%	98.00%	98.00%
P.A. Nomad Central-2	Colombia	Mercantile trust	98.00%	98.00%	98.00%
P.A. Calle 84 (2)	Colombia	Mercantile trust	98.00%	98.00%	98.00%
P.A. Calle 84 (3)	Colombia	Mercantile trust	98.00%	98.00%	98.00%
P.A. Nomad Distrito Vera(11)	Colombia	Mercantile trust	98.00%	98.00%	-%
P.A Nexo(11)	Colombia	Mercantile trust	98.00%	98.00%	-%
P.A. Mercurio	Colombia	Mercantile trust	100.00%	100.00%	100.00%
P.A CEDIS Sodimac(11)	Colombia	Mercantile trust	100.00%	100.00%	-%
Wenia S.A.S.	Colombia	Technology services	100.00%	100.00%	100.00%
P.A. Wenia	Colombia	Mercantile trust	100.00%	100.00%	100.00%
Nequi S.A. Compañía de Financiamiento	Colombia	Financial services	100.00%	100.00%	100.00%
---	---	---	---	---	---
Sociedad Beneficiaria BC Panamá S.A.S(12)	Colombia	Holding	-%	100.00%	-%
P.A Títulos de Pagos por Ejecución(13)	Colombia	Mercantile trust	100.00%	-%	-%
Cibest Panamá Assets, S.A(14)	Panama	Investment	100.00%	-%	-%
Cibest Capital Panamá, S.A. (before Valores Banistmo S.A.)(14)	Panama	Purchase and sale of securities	100.00%	100.00%	100.00%
Bancolombia Panamá S.A.	Panama	Banking	100.00%	100.00%	100.00%
Sistemas de Inversiones y Negocios S.A. Sinesa	Panama	Investments	100.00%	100.00%	100.00%
Banagrícola S.A.	Panama	Holding	99.17%	99.17%	99.17%
Banistmo S.A.(15)	Panama	Banking	100.00%	100.00%	100.00%
Banistmo Investment Corporation S.A.(15)	Panama	Trust	100.00%	100.00%	100.00%
Leasing Banistmo S.A.(15)	Panama	Leasing	100.00%	100.00%	100.00%
Banistmo Panamá Fondos de Inversión S.A.(15)	Panama	Investment fund holder	100.00%	100.00%	100.00%
Desarrollo de Oriente S.A.(15)	Panama	Real estate	100.00%	100.00%	100.00%
Banistmo Capital Markets Group Inc.(15)(16)	Panama	Purchase and sale of securities	100.00%	100.00%	100.00%
Anavi Investment Corporation S.A.(15)(16)	Panama	Real estate	100.00%	100.00%	100.00%
Steens Enterprises S.A.(15)(16)	Panama	Portfolio holder	100.00%	100.00%	100.00%
Ordway Holdings S.A.(15)(16)	Panama	Real estate broker	100.00%	100.00%	100.00%
Grupo Agromercantil Holding S.A.	Panama	Holding	100.00%	100.00%	100.00%
Banco Agromercantil de Guatemala S.A.	Guatemala	Banking	99.68%	99.68%	99.68%
Seguros Agromercantil de Guatemala S.A.	Guatemala	Insurance agency	79.92%	79.92%	79.92%
Financiera Agromercantil S.A.	Guatemala	Financial services	100.00%	100.00%	100.00%
Agrovalores S.A.	Guatemala	Securities brokerage	100.00%	100.00%	100.00%
Arrendadora Agromercantil S.A.	Guatemala	Financial Leasing	100.00%	100.00%	100.00%
Asistencia y Ajustes S.A.	Guatemala	Roadside and medical assistance services	100.00%	100.00%	100.00%
Serproba S.A.	Guatemala	Maintenance and remodeling services	100.00%	100.00%	100.00%
Servicios de Formalización S.A.	Guatemala	Loans formalization	100.00%	100.00%	100.00%
Conserjeria, Mantenimiento y Mensajería S.A. "En liquidación"	Guatemala	Maintenance services	100.00%	100.00%	100.00%
Mercom Bank Ltd.(17)	Barbados	Banking	99.68%	99.68%	99.68%
New Alma Enterprises Ltd.	Bahamas	Investments	99.68%	99.68%	99.68%
Bancolombia Puerto Rico Internacional Inc.	Puerto Rico	Banking	100.00%	100.00%	100.00%
Sinesa Cayman, Inc.(18)	Cayman Islands	Banking	100.00%	100.00%	100.00%
Banco Agrícola S.A.	El Salvador	Banking	97.36%	97.36%	97.36%
Arrendadora Financiera S.A. Arfinsa	El Salvador	Leasing	97.37%	97.37%	97.37%
Accelera S.A. de C.V.	El Salvador	Credit card services	97.36%	97.36%	97.36%
---	---	---	---	---	---
Valores Banagrícola S.A. de C.V.	El Salvador	Securities brokerage	98.89%	98.89%	98.89%
Inversiones Financieras Banco Agrícola S.A. IFBA	El Salvador	Holding	98.89%	98.89%	98.89%
Gestora de Fondos de Inversión Banagrícola S.A.	El Salvador	Administers investment funds	98.89%	98.89%	98.89%
Bagrícola Costa Rica S.A.	Costa Rica	Business and management advising	99.17%	99.17%	99.17%
Cibest Capital Holdings USA LLC (before Bancolombia Capital Holdings USA LLC)	United States	Holding	100.00%	100.00%	100.00%
Cibest Capital Advisory Services LLC (before Bancolombia Capital Advisers LLC)	United States	Investment advisor	100.00%	100.00%	100.00%
Cibest Capital Securities LLC (before Bancolombia Capital LLC)	United States	Securities brokerage	100.00%	100.00%	100.00%
Wenia Ltd.	Bermuda	Technology services	100.00%	100.00%	100.00%

(1) Incorporation of subsidiaries due to changes in the corporate structure, whereby Grupo Cibest S.A. became the holding company of all financial entities and other companies within the Group, including Bancolombia.

(2) Company liquidated in July 2024. For further information, see Consolidated Financial Statement, Note 1. Reporting Entity.

(3) Trust for administration and payments consolidated by Inversiones CFNS S.A.S as of December 2025.

(4) Decrease in the shareholding percentage is due to the entry of a new investor into the private equity fund “Fondo de Capital Privado Fondo Inmobiliario Colombia” as of September 2025.

(5) On February 29, 2024, the trust rights were transferred as a result of the sale by Fondo de Capital Privado Fondo Inmobiliario Colombia.

(6) On August 21, 2025, the trust rights were transferred by Fondo de Capital Privado Fondo Inmobiliario Colombia.

(7) Trust funds consolidated through Fondo de Capital Privado Fondo Inmobiliario Colombia: Fideicomiso Selecto Terrazu Etapa 1 Torre 2 as of May 2025; Fideicomiso Lote C6 Cartón de Colombia and Fideicomiso Mokana as of September 2025; and Fideicomiso River Park as of November 2025.

(8) Decrease in the shareholding percentage is due to the share buyback process carried out by the subsidiary Valores Simesa S.A. during 2025.

(9) During 2025, the trust rights of the Trust Fund were transferred as a result of the sale by Valores Simesa S.A. (the Fund’s parent company).

(10) During 2024, the trust rights of the Trust Fund were transferred as a result of the sale by Valores Simesa S.A.

(11) During May, June and November 2024, the parent company was established as trustor of P.A. CEDIS Sodimac, P.A. Nomad Distrito Vera and P.A. Nexo, respectively through a management mercantile trust agreement, for real estate activity purposes.

(12) On September 27, 2024, Sociedad Beneficiaria BC Panamá was established, a company whose corporate purpose is to be the beneficiary of the division of a company domiciled in Panama, by virtue of which it partially transfers its assets, as a consequence of the above, to be the owner of the assets and liabilities received on the occasion of said operation, and merge with a company domiciled in Colombia. For further information, see Consolidated Financial Statement, Note 1. Reporting Entity. In 2025, once the transaction was completed, the company Beneficiaria BC Panamá was liquidated.

(13) Company consolidated as of December 2025 through Bancolombia S.A.

(14) Investments of Grupo Cibest resulting form the the partial spin-off by Banistmo of 100% of the shares it held in Cibest Capital Panamá, S.A. (before Valores Banistmo S.A.), in favor of Cibest Panamá Assets S.A., a Panamanian company wholly owned by Cibest. For further information, see Consolidated Financial Statement, Note 1. Reporting Entity.

(15) On December 18, 2025, Grupo Cibest informed to the market the execution of a share purchase agreement with Inversiones Cuscatlán Centroamérica S.A. for the sale of 100% of the shares of Banistmo S.A. For further information, see Consolidated Financial Statement, Note 1. Reporting Entity.

(16) Investments in non-operational stage.

(17) On September 30, 2021, Mercom Bank Ltd shareholder authorized the beginning of an organized and gradual process to transfer of the assets and liabilities of Mercom Bank, Ltd., to Banco Agromercantil de Guatemala, S. A. or other companies of Cibest Corporate Group. For further information, see Consolidated Financial Statement, Note 1. Reporting Entity.

(18) On October 5, 2020, the Board of Directors of Bancolombia Panamá (the subsidiary’s parent company) approved the commencement of a gradual wind-up process of Sinesa Cayman, Inc.’s operations (formerly Bancolombia Cayman). For further information, see Consolidated Financial Statement, Note 1. Reporting Entity.

Document

Exhibit 11.1

Code of Ethics and Conduct

Grupo Cibest

Hello team,

One of the things that most distinguishes us as an organization —and that personally fills me with pride— is that we are known for always acting with ethics and integrity. This is not just something we say; it is something we live every day. We hold a deep conviction that guides our decisions, both big and small: always do what is right, even when no one is watching.

We know that acting with integrity is not merely an expectation—it is a conscious choice we make every day. It is the foundation upon which we build our future, that of our families, and that of this organization with which we identify ourselves in every country where we operate. Ethics is not an accessory; it is the bedrock upon which we implement our purpose of promoting sustainable development for the well-being of all.

We live in a world that is constantly changing, and with it, our strategy and culture also evolve. In this context, I am pleased to share with you a new version of our Code of Ethics and Conduct that not only updates our behavioral guidelines but also reflects who we are today and where we want to go as an organization.

One of the key updates in this version is the incorporation of behavioral sciences. Why is this important? Because understanding how we think, how we make decisions, and how we behave in real life, allows us to build a more human, empathetic framework that connects with our everyday reality. This evolution is the result of actively listening to our employees and stakeholders. Thanks to that attentive listening, today we can say that our values, principles, and cultural traits are more aligned than ever.

I want to encourage you to make this code as a daily reference tool. Let’s not see it as just another document, but as a compass that guides us when facing dilemmas or complex situations. Let us remember that prudence is always our first option. And when we have doubts, consulting the code is not only valid—it is a sign of responsibility and commitment to our culture.

Every time we choose to act ethically, we strengthen something much bigger than ourselves: we are building an organizational culture based on trust, transparency, and respect. This culture has led us to be recognized as one of the best places to work, a company with excellent reputation and corporate governance, and one of the most sustainable banks in the world.

Thank you for being part of this journey. Thank you for living our values with authenticity. And thank you for continuing to build, day by day, an organization that not only does its job well, but also does good.

With confidence in what we continue to build,

Juan Carlos Mora

President, Grupo Cibest

President, Grupo Cibest

Index

1.Why do I need this Code?

2.How do we connect with our relationship groups?

aHow is the company culture built?

bHow do we connect with our relationship groups?

cHow do we interact in digital environments?

dHow do we use the company’s resources?

3.How do we manage risks?

aHow do we prevent money laundering, terrorist financing, and the proliferation of weapons of mass destruction?

bCompliance with tax and fiscal duties

cHuman rights

dAnti‑fraud and anti‑corruption

eOur handling of personal information and data

fInsider information and how we deal with it

gEthical framework for analytical and AI systems

4.How do we address possible conflicts of interest?

aWhen can conflicts of interest arise?

bPersonal conflicts of interest

cConflicts of interest in the performance of duties within the Group

dExternal activities

ePolitical participation

fActivities involving Related Parties

gClient‑funded activities

hAuthorities for conflict‑of‑interest administration

iInsider Information / Material Non‑Public Information

jHow can we manage personal investments?

kHow do we manage gifts and invitations?

5.What mechanisms promote and support our ethical behavior?

aCorporate Ethics Committee

bLocal ethics committees

cCompliance areas: advice on interpreting the Code of Ethics and ethical dilemmas.

dReporting channels and whistleblower protection

eComplaints and reports related to organizational climate and working relationships

fReports on unusual transactions

gComplaints and reports of fraud and malpractice

hCommunication channels with the Cibest Group Ethics Hotline

6.What is the disciplinary procedure like?

1.Why Do I Need This Code of Ethics and Conduct?

“A reflection of our purpose: to promote sustainable development for the well-being of all.”

Grupo Cibest S.A., as part of Grupo Cibest (hereinafter, “the Group”), are recognized for their responsibility within financial and non‑financial business activities. Through these activities, we seek to bring our purpose to life.

Our decisions adhere to the law, ethics, and integrity—values that prevail over immediate commercial results. These constitute the foundations on which we build sustainable growth.

The Code of Ethics and Conduct consolidates the declaration of our organizational culture. All employees and collaborators are required to practice it in their internal interactions and when engaging with different stakeholders.

We understand that the Code of Ethics and Conduct cannot regulate every action or anticipate every ethical dilemma that employees and collaborators may face. For that reason, we trust that good judgment, common sense, and prudence will guide our actions at all times. We emphasize that whatever is not explicitly forbidden is not implicitly allowed.

The provisions of this Code apply to: employees regardless of their level or role, interns and apprentices, members of the Board of Directors[1], suppliers, partners, and all other third parties who engage with us and adhere to this Code. For the exclusive purposes of this document, we refer to all of them as “collaborators.”

This Code is approved by the Board of Directors of each of the Companies.

The Company will develop guidelines to help regulate and clarify this Code of Ethics and Conduct, facilitating its understanding whenever necessary. These guidelines will be approved by the Corporate Ethics Committee, which is responsible for extending them to the other companies within the Group. All collaborators are subject to these guidelines, which—together with this Code—are available through the communication tools established by the organization.

The Corporate Ethics Committee establishes the guidelines for communicating this Code and conducting awareness and evaluation activities. It also defines the actions led by the Vice Presidency of Compliance of Bancolombia, through its corporate units and the different companies that make up the Group, to support its periodic updates.

1.How Do We Connect With Our Relationship Groups?

“Our cultural traits are the foundation of our decisions, actions, and relationships.”

2.1. How Is the Company’s Culture Built?

We are convinced that people make the difference; that is why our organizational culture is built on ethical principles and expressed through our cultural traits, which aim to ensure that each employee can become the best version of themselves.

Our commitment aligns with sustainability, corporate governance, and ethics. Therefore, it is essential that the actions of our collaborators reflect this commitment and remain consistent with the definitions of the six (6) cultural traits, as applicable to each entity based on its corporate purpose and strategy:

CUSTOMERS

Their loyalty and preference are our reason for being.

HUMAN BEING

People make the difference.

INTEGRITY

Our honesty, coherence, and rectitude make us worthy of trust.

EXTRAORDINARY PERFORMANCE

We strive to exceed goals and be our best selves.

SUSTAINABLE GROWTH

Our purpose is a source of pride.

DYNAMISM

Innovation, agility, and transformation drive us.

We firmly believe that every person—regardless of their origin, gender, age, identity, or beliefs—brings a unique perspective that enriches our organization. For this reason, we promote respect and provide the tools and resources necessary for the personal and professional development of each member of our community.

We are committed to the promotion, respect, and recognition of human rights as fundamental, inherent, and essential prerogatives of all people. We therefore reject any attempt to violate them and adhere to the International Bill of Human Rights.

Employees are the essence of the Company: we are the ones who deploy the strategy, make business models possible, and protect and strengthen the organization’s reputation through behavior aligned with the law and our organizational culture. Our selection and recruitment practices are designed to identify and attract individuals who—beyond their skills and talent—reflect who we are and what we believe in. These practices are transparent and focus on merit, competencies, and knowledge, ensuring that those who join our organization embody its identity and culture.

We guarantee diversity throughout our processes; for this reason, we build teams where characteristics such as age, ethnicity, cultural identity, disabilities, religion, ideology, sex, gender identity, sexual orientation, marital status, family composition, or socioeconomic background are not barriers.

We have policies in place to promote equal opportunities for job candidates and employees, regardless of gender.

When evaluating employee performance, the criteria and mechanisms used are free from biases related to competency‑management models. We also recognize that expanding into comprehensive solutions and ecosystems presents a significant opportunity to strengthen relationships with customers (for the companies to which this applies) and consolidate our market presence. In this regard, we commit to fostering a culture of responsible innovation and strategic collaboration with third parties and partners.

2.2. How Do We Connect With Our Relationship Groups?

In our day‑to‑day operations, our interactions must remain consistent with the Group’s purpose, acting competently and integrating our abilities and techniques to achieve outstanding results for each of the following stakeholder groups:

2.2.1. Employees

Members of the Board of Directors define our ethical principles, guide our behavior, and ensure that business results reflect conduct aligned with this Code, complementary standards, and the law.

Leadership positions must promote our organizational culture by example. This includes identifying and resolving situations in which their teams face ethical dilemmas, involving the Compliance area when proper

and timely management requires guidance. To learn more about identifying and managing conflicts of interest, refer to Chapter 4: How do we address potential conflicts of interest?

It is important for leaders to understand the personal, social, economic, and work‑related aspects of their team members in order to support their development and identify potential warning signs—always through an empathetic relationship that respects intimacy and privacy.

Our internal relationships must be grounded in our organizational culture, defined through our cultural traits, this Code, and in strict compliance with our Internal Work Regulations and our Corporate Governance Code.

We must promote collaborative work by combining diverse skills that enable learning and ensure equity and inclusion through empathetic, respectful, and close‑knit relationships—both among ourselves and with our different stakeholder groups.

We ensure that variable compensation aligns with performance and includes safeguards that prevent unethical behavior that could undermine the integrity we uphold as a Company. Our compensation model ensures unbiased remuneration that does not differentiate based on age, educational level, health condition, ethnicity, gender, cultural identity, sexual orientation, or socioeconomic background.

We reject all forms of illegal or abusive employment and any violation of human rights, including discriminatory acts, workplace or sexual harassment, disrespect, mistreatment, and physical or psychological abuse. Without exception, we must build respectful relationships and foster a positive and inclusive work environment. Any complaint will be received and managed immediately by the Talent and Culture area (or Internal Audit in cases of conflict of interest), which will conduct investigations and implement prevention, care, remediation, and non‑recurrence actions where needed.

The safety, health, and well‑being (physical, mental, and emotional) of our employees are essential to achieving superior results. Therefore, all leaders must promote a healthy, safe, productive work environment with equal opportunities for developing capabilities. Additionally, we support employees and their families in every location where we operate through strategies focused on comprehensive well‑being.

Our integral risk management promotes self‑management and self‑control. Control and audit activities complement the responsibilities of those executing processes and sub‑processes. We are all responsible for knowing and complying with the Company’s internal policies and controls associated with our roles. For this reason, we design training strategies, some of which are mandatory and must be completed annually.

We respect the privacy and personal time of our employees and expect that, at all times and places, they maintain full commitment and behavior aligned with our culture, principles, and the law. If an employee’s behavior in society jeopardizes our culture or reputation, we will take action to safeguard these values in accordance with applicable labor laws.

2.2.2. Suppliers

We are responsible and transparent in our supplier selection, contracting, and oversight processes, ensuring competitive procedures and building teams committed to extraordinary performance, sustainability, and compliance with this Code of Ethics and any applicable guidelines.

At the time of contracting and throughout the commercial relationship, we act objectively and base our decisions on technical, transparent, and ethical criteria, exercising independent judgment. We also ensure the identification, management, and disclosure of potential conflicts of interest, always seeking the best cost–benefit ratio for the Company.

2.2.3. Consumers

We strive to deeply understand the needs of our customers, promoting simple and relevant solutions that inspire trust and loyalty. For this reason, in our actions and decisions, it is essential to consider the loyalty and preference of our customers. In our interactions with consumers, we must:

Address consumer needs and expectations related to products, channels, and/or services, fostering a responsible and close relationship with them.

Avoid creating barriers that limit consumers from moving between different products, services, channels, or entities.

Provide consumers with proper attention, fair treatment, protection, respect, and service, complying with applicable quality and service standards.

Ensure consumers have access to clear, transparent, and timely information aligned with their needs and profile, so they can make informed decisions based on their rights and obligations.

Guarantee effective and appropriate handling of inquiries, requests, complaints, claims, or suggestions submitted by consumers, and clearly communicate the channels and timelines for addressing them.

Provide responses that are concrete, clear, sufficient, and timely, addressing each of the consumer’s needs.

For financial entities to which it applies, provide consumers with basic information about the Financial Consumer Ombudsman or the equivalent mechanism in each jurisdiction.

2.2.4. Shareholders

In our pursuit of value creation and superior results for our shareholders, we require continuous challenge and extraordinary performance from our employees. Furthermore, we strictly comply with the duties and responsibilities to which we are committed with this stakeholder group.

2.2.5. Authorities and Oversight, Surveillance, and Control Bodies

Our relationships with the organization’s control areas—especially Internal Audit, oversight, surveillance, and control authorities, as well as other public entities—are conducted within the framework of the law, with transparency, respect, and cordiality. We ensure full compliance with all commitments made to these institutions.

2.2.6. Competitors

Healthy, free, and fair competition is a fundamental element of all our operations and our relationships with other financial and non‑financial entities, in accordance with the applicable competition regulations. For this reason, as collaborators, we must avoid, among other actions:

Making comments that could harm the image of competitors, contributing to the spread of rumors about them, or engaging in unfair competitive practices.

Carrying out actions that could cause confusion or deception among customers.

Engaging in anti‑competitive practices that may affect the free participation of other companies, consumer well‑being, or economic efficiency. Such practices include—but are not limited to—agreements that seek to limit or restrict free competition, abuse of a dominant market position (if one exists), among others.

2.2.7. Media and Public Opinion

Through authorized spokespersons and the communication channels established for this purpose—and only in cases where it is not prohibited by regulation—the Company defines its communication strategy and provides corporate information aimed at informing the public about our activities, products, channels, and services, including efforts that promote financial education and inclusion.

The information disclosed by the Company, in compliance with national and international regulations, must be truthful, clear, timely, and reflective of our integrity.

The president (or equivalent role) of the Company, along with collaborators explicitly authorized to do so, are the only official spokespersons of their respective entities. When engaging with this stakeholder group, they must communicate from a place of empathy and promote cordial and respectful relationships with the media and, more broadly, with public opinion.

2.2.8. Public Entities, Their Officials, and Collaborators

Public entities and authorities provide a framework for action and essential inputs for the development of our businesses. Our interactions with them and with their officials must always take place within the boundaries of the law, under conditions of transparency and sound practices, and in a context of respect, collaboration, and adherence to the principles defined by the Company—particularly our principle of zero tolerance for corruption.

2.2.9. Environment

We are committed to the preservation of the environment and natural resources. For this reason, we support and promote initiatives that encourage sustainable business practices, and we incorporate environmental‑related elements into our risk‑assessment methodologies, in accordance with the identity and characteristics of each Company.

We raise environmental awareness through alliances with the public and private sectors, non‑governmental organizations (NGOs), and the broader community. Likewise, we encourage our employees to actively participate as volunteers in different sustainability projects aimed at supporting the most vulnerable communities.

Depending on the characteristics and strategic focus of each entity, we evaluate environmental, social, and economic aspects—including corporate governance—within the projects we finance or invest in. Additionally, we guide our clients in the implementation of responsible environmental projects and activities.

We support high‑impact social programs that contribute to building human capital and reducing inequality.

We align ourselves with local and international sustainability regulations and, based on the nature of each business unit, we participate in local and international groups focused on advancing sustainability goals such as climate change, biodiversity, and others.

2.3. How Do We Interact in Digital Environments?

Digital environments—including our own social platforms, third‑party social networks, and instant messaging services—are conversational and interactive spaces that play a significant role in everyday life. For this reason, we must protect our reputation and that of the Company in all social and digital platforms. Given the reach and impact of these environments, we must observe the following:

2.3.1. Impact on Corporate Image

Our behavior is the same inside and outside the organization—including digital environments.

We are aware that we are not official spokespersons of the organization, and having a personal social media account does not make us one. We must always publish content in a personal capacity.

Although social media is an open space, we act with respect and do not accept discriminatory or offensive expressions toward individuals or other organizations.

We remain mindful of what we say and do online and do not promote negative conversations or content that could directly or indirectly affect the organization or its stakeholders.

If we use our personal social media accounts for political purposes, we avoid presenting ourselves as Company employees. Our posts must not associate both roles.

2.3.2. Protecting Confidentiality

We always protect confidential information and any information that could affect the organization or its stakeholders.

Under no circumstances do we request or share personal data or contact information—ours or that of third parties.

2.3.3. Use of Official Channels

When receiving inquiries or when needing to share information about Company matters, we always use the appropriate channels and the organization’s official position.

When posting about securities issued by Grupo Cibest or about the organization’s products and services, we must always use corporate‑approved materials and language, including terms and conditions. If using graphic materials, these must be provided by the Company; we must not design or modify them ourselves.

We do not create social media spaces or groups on behalf of the organization.

We exercise caution when sharing audios or texts through digital platforms, as these can spread quickly and lead to reputational risks for ourselves, the Company, or its stakeholders.

2.4. How Do We Use the Company’s Resources?

The assets owned by the Company or under its administration must be used responsibly in the performance of each role and exclusively for the purposes for which they were acquired.

We must properly use: corporate devices (such as laptops, tablets, cell phones, among others); applications; digital channels (internet, intranet, chat, email, etc.); network services (printing, remote access, and others); and information (public, internal, confidential, or restricted) provided by the organization for work‑related activities.

Remember that we must use the same transactional and consultation channels available to our customers; that is, we may not use the access rights or permissions granted to us by virtue of our role to conduct queries or manage personal transactions or those of our Related Parties.

Keep in mind that all data transmitted, created, modified, sent, or retrieved is the property of the Company and, when permitted by regulation, may be monitored without requiring any form of authorization.

The use of digital channels to commit fraud or compromise personal integrity is expressly prohibited. This includes:

Messages intended to impersonate an employee of the organization.

Messages containing hostile or defamatory content intended to insult, slander, harass, intimidate, threaten, or pressure individuals based on political views, religious beliefs, sexual orientation, or personal viewpoints.

Messages containing pornographic, racist, terrorist content; as well as chain messages, propaganda, contests, gambling, surveys, or pyramid schemes.

Additionally, all collaborators must avoid opening emails from unknown senders or accessing malicious attachments or links that may compromise the organization’s security.

3. How Do We Manage Risks?

“We conduct comprehensive risk management committed to the evolution of the business and to delivering a superior experience for our customers.”

The entity’s comprehensive risk management framework operates in compliance with the applicable regulations for each Company, as well as with the internal standards established by the Board of Directors or Administrative Council. These bodies, in fulfilling of their supervisory functions, are supported by several areas and governance structures responsible for approving, monitoring, and controlling the policies, methodologies, tools, guidelines, and strategies for identifying, measuring, controlling, and mitigating risks.

Some of the risks that must be managed include:

3.1. How Do We Prevent Money Laundering, Terrorist Financing, and the Proliferation of Weapons of Mass Destruction (ML/TF/WMDP )?

Our Organization is committed to being a relevant and positive actor in the environments where we operate. For this reason, we assume the obligation to prevent money laundering, terrorist financing, and the proliferation of weapons of mass destruction (hereinafter “ML/TF/WMDP”), and to protect ourselves from being used as a vehicle for concealing such activities. Likewise, and without prejudice to the specific legislation governing each of our activities and Companies, we recognize as predicate or related offenses, among others: drug trafficking, terrorism, smuggling, human trafficking, and corruption in its many forms.

In line with the above, we have established a risk‑management system to prevent ML/TF/WMDP. These systems (depending on their nature) include policies, procedures, methodologies, and tools for identifying, measuring, controlling, and monitoring these risks. This requires all of us to comply with the rules, policies, and procedures established in the risk‑management system or program, including the execution of the controls designed to prevent LAFT. Non‑compliance with these procedures exposes the entity and constitutes a significant violation of our principles.

For the effective performance of commercial and operational roles by employees, partners, and suppliers when interacting with customers and consumers, we follow the guidelines below—even when doing so may require prioritizing them over commercial objectives:

• Management on knowledge of the customer:

We must gather the necessary customer information in an accurate and timely manner throughout the onboarding process and through periodic updates to manage alerts, complying with internal policies and applying a risk‑based approach according to the customer’s profile and associated risk factors.

• Maintain communication and cooperation with the Compliance areas:

Use established channels to report any unusual activity detected and respond to Compliance requests needed for evaluations and investigations conducted by this area.

• Manage Watchlists:

We must follow the instructions arising from matches identified between current or potential customers and watchlists.

• Constant ongoing training:

The Company makes mandatory annual training available to all employees on ML/TF/WMDP prevention, as well as continuous and specialized learning opportunities tailored to the specific risks associated with the responsibilities of each area.

3.2. Compliance With Tax and Fiscal Obligations

We are committed to complying with the tax and fiscal obligations that apply to our Companies. Therefore, our actions must align with our policies, which include the following:

•Companies fulfill their tax obligations in accordance with applicable tax laws, regulations, and the principles, spirit, and letter of the law. In this regard, the Companies are committed to not acting contrary to the intent of the law and to maintaining trustworthy relationships with tax authorities and society.

•Companies guarantee the payment of taxes (including duties, fees, and contributions) as required, making use of the alternatives and options available under tax regulations.

Companies disclose to their stakeholders, in the annual report, the resources allocated to the payment of taxes (duties, fees, and contributions).

•Companies do not engage in operations with abusive or tax‑evasive purposes. Neither do they conduct transactions in jurisdictions classified as non‑cooperative or as having low or no taxation—according to OECD standards for tax havens—when such transactions have abusive or evasive purposes.

•Companies do not participate in artificial tax structures without real economic justification or business purpose, or those lacking commercial substance.

•Companies identify, measure, monitor, and mitigate the risks associated with their fiscal matters in compliance with existing tax principles-As a standard practice, the Companies ensure the timely filing and payment of tax returns.Companies recognize transactions carried out between related parties following the Arm’s Length Principle. These operations are documented and reported to the tax authority, in accordance with the BEPS project guidelines issued by the OECD to combat base erosion and profit shifting.

Companies pursue cooperation with tax authorities to support the proper exercise of their functions, fostering relationships that strengthen institutional frameworks and constructive dialogue regarding fiscal matters.

•Companies participate in public and private discussions, forums, and industry working groups convened by associations and regulators, expressing objectively and transparently any concerns about policies or regulatory proposals that impact the industry or the sustainability of their businesses.

3.3. Human Rights

We are committed to respect and protection of human rights. Therefore, we seek to prevent, assess, and mitigate any potential risks that may lead to violations—whether through concealment, financing, tolerance, or any other form of support. This commitment is inserted in all our operations, therefore,we ensure that our external partnerships, the projects in which we invest or provide financing, and our suppliers and other stakeholder groups are aligned with our declaration and actions in favor of human rights.

3.4. Anti‑Fraud and Anti‑Corruption

Fully aware of our role, we lead by example and therefore do not tolerate acts of fraud or corruption. Additionally, through the agreements we sign with our suppliers, we require them to adopt the same standard. Likewise, in our business relationships with partners and companies in which we invest, we demand the adoption of these commitments against fraud and corruption through our contractual arrangements.

Our zero‑tolerance policy covers any form of fraud or corruption sanctioned by law and best practices incorporated into our internal policies and processes.

We define fraud as any act or intention to obtain an illegal benefit or advantage—whether personal or for third parties—through deception and to the detriment of the Company’s interests. This may include, but is not limited to, the following:

• Misappropriation, embezzlement, or improper use of assets:

This includes both,robbery and the use of Company assets—or assets under its custody—for purposes other than those established by the organization and without its authorization. Examples include: concealing assets, improper use of confidential information or intellectual property, unauthorized access or copying of digital assets, unauthorized expenses, or improper use of the internet.

• Falsification or manipulation of financial or non‑financial reports:

This refers to the deliberate misrepresentation of the Company’s financial condition through fraudulent or manipulated financial or non‑financial reporting, false statements, or intentional omissions of information.

• Corruption:

This consists of the abuse of an assigned function with the purpose of obtaining personal benefit, a benefit for a third party, or even for the Company itself, to the detriment of public or private interests. Examples include: cases of bribery, materialization of conflicts of interest, exceeding authority in the execution of public contracts, irregular support for activities that negatively impact the environment and constitute environmental crimes, and, in general, any situation involving overreach of functional responsibilities.

We have a corporate anti‑corruption policy aligned with applicable local and international regulations and best national and international standards that the Company has chosen to adopt. For more information, you may refer to the Corporate Anti‑Corruption Policy.t

Non‑compliance with applicable national or international anti‑corruption regulations may hold ourselves accountable to U.S. Department of Justice, as well as before the competent authorities in Colombia and other jurisdictions where we operate.

All collaborators, in their day work, must prevent, identify, and manage possible corruption risks, which may arise in interactions with public officials, in the administration of the Company’s assets, in the selection of suppliers and employees, among others.

3.5. Our Management of Information and Personal Data

Sustainable growth is closely tied to the responsible use of data that helps preserve the integrity, confidentiality, and availability of information, processes, technologies, and people. Our employees must use information appropriately, always grounded in respect for data subjects.

We recognize that information is essential for the execution of processes, activities that encourage innovation, the exploration of new opportunities, and improved ways of performing work‑related tasks. Analytical tools provide capabilities that allow us to better understand consumers and collaborators, enabling the creation of superior experiences within established privacy and data‑protection requirements.

Safeguarding confidentiality, integrity, and availability of information is a priority for the Company; therefore, collaborators must apply guidelines for identifying, classifying, and using information, and assigning access based on the principle of least privilege and the need‑to‑know basis.

Before sharing information—whether through digital or physical means—we must verify that the recipient has the necessary functions and authorizations to access or use such information.

When it is necessary to share internal or confidential[2] information with authorized third parties, they may access it strictly within the scope of their duties and for defined purposes, in compliance with confidentiality agreements and with our policies for database management and personal data protection. Information may be shared with third parties only through authorized channels and only if the proper authorization exists.

Collaborators must use, protect, and keep confidential all information that is owned by the organization or under its custody, according to the Company's definitions. Such information must be handled responsibly and in accordance with established policies, guidelines, and applicable regulations, with special attention to confidential information, privileged information, and/or Material Non‑Public Information.

[1] Members of Boards of Directors shall be included in the term“collaborators,” solely for the purposes of this Code, when they have no connection whatsoever as employees of the Group.

[2] Information classified as confidential indicates a “High Impact” for the organization or related parties. If this information is lost, corrupted, or disclosed, it could result in reputational damage or adversely affect the organization’s commercial capabilities. This is the default category and includes all personal information belonging to customers, shareholders, and employees. This information is only available to specific groups of individuals who require it to perform their duties.

Whenever in doubt about the classification of information, we must treat it as confidential.

3.6. Ethical Framework for Analytical and Artificial Intelligence (AI) Systems

We implement an ethical framework for our analytical and artificial intelligence (AI) systems based on the principles proposed by the OECD. This framework reflects our commitment to business ethics and social responsibility, aligning with the principles established in our Code of Ethics and Conduct.

3.6.1. Definition of Analytical and AI Systems for the Company

We understand analytical and artificial intelligence systems as those that use computational capabilities to create algorithms—or combinations of them—which, through prior learning or training processes, generate predictions, content, recommendations, or decisions based on the input data they receive, with the purpose of influencing physical or virtual environments.

These systems may vary in their level of autonomy and ability to adapt after deployment. They also include several subfields such as deep learning, natural language processing, machine learning, and various statistical and econometric techniques.

3.6.2. Ethical Principles for Analytical and Artificial Intelligence Systems

Inclusive Growth and Sustainable Development

•We promote the inclusion of underrepresented populations in analytical and AI systems and work toward reducing economic and social inequalities. We support initiatives that protect the environment and encourage sustainable development.

Human‑Centered Values

•We respect and promote human rights and democratic values throughout all phases of the lifecycle of analytical and AI systems.

•We assess privacy and data protection impacts and promote equity and social justice.

Transparency and Explainability

•We work toward implementing analytical and AI systems that are transparent and offer clear explanations of how they operate and make decisions.

•We encourage open dialogue with all stakeholders regarding the implications and functioning of analytical and AI systems.

•We promote transparency in how personal data is collected, used, and processed, adopting Privacy by Design principles and Impact Assessments in the development of analytical and AI systems.

•We ensure that personal data remains accurate, complete, up‑to‑date, and understandable, ensuring that its processing does not alter its truthfulness.

Robustness, Security, and Protection

•We promote the development of analytical and AI systems that are robust and secure, operating consistently with their intended purpose and without causing harm.

•We implement security measures to prevent misuse of analytical and AI systems and to ensure the protection of personal data.

•We encourage techniques that protect the identification of personal data, such as anonymization, pseudonymization, and differential privacy.

Accountability

•We assume responsibility for the operation of AI systems, ensuring they are traceable, auditable, and monitorable, including an approach grounded in personal‑data protection and stakeholder privacy.

•We establish accountability mechanisms to ensure that analytical and AI systems are used ethically and responsibly.

4. How do we handle potential conflicts of interest?

“Conflicts of interest are inherent to human nature; therefore, we manage them appropriately to make better decisions.”

4.1. When Can Conflicts of Interest Arise?

We recognize that conflicts of interest are inherent to human nature, and we understand that their existence is not objectionable. However, our actions in situations involving a conflict of interest—when such conflicts have not been identified, escalated, managed, and disclosed—may lead to inappropriate conduct and harm the Company’s reputation. For this reason, we require prudence when dealing with real conflicts of interest[1], potential conflicts of interest[2], or apparent conflicts of interest[3].

A potential conflict of interest arises when we face two or more opposing and incompatible interests, and we must make—or influence—a decision that may prefer one interest at the expense of another.

4.2. Personal Conflicts of Interest

Conflicts of interest are considered personal when we have direct or indirect personal interest in a matter, and that interest is in some way opposed to the Company’s interest. Some examples include:

•Accepting preferential investment or business terms or conditions from clients, suppliers, or counterparties with whom we have a direct or indirect relationship, when such terms are not offered equally to the rest of the employees of the entity.

•Participating in or influencing decisions related to the purchase, sale, or rental of assets by the Companies when such assets belong to us or are administered by us.

•Receiving commissions, compensation, or financial incentives for the sale of Company‑owned assets or assets received in lieu of payment.

•Borrowing money from clients, suppliers, or counterparties served by the collaborator—unless the loan originates from a commercial relationship with an entity whose corporate purpose includes providing of financing.

•Provide or receive loans from other collaborators, when such loans are significant in value, occur frequently, or involve interest payments.

•When involved in processes related to the acquisition, approval, or administration of assets received in lieu of payment or similar situations, the following practices constitute conflicts of interest:

◦Acquiring for ourselves or third parties, whether directly or indirectly, assets that have been received in lieu of payment by the Company where we work.

◦Participating in the approval of loans intended to provide financing to the buyer of such assets.

4.3. Conflicts of Interest in the Performance of Duties Within the Group

Conflicts of interest may arise when an employee, who must make a decision related to an action or business—or who may influence in the decision—faces two or more opposing and incompatible interests. In these situations, the guidelines established in this Code of Ethics and Conduct must be followed, along with any complementary guidelines, and with the support of the Compliance area.

If the individuals involved are administrators of the Company, the provisions of the Corporate Governance Code, the Company’s bylaws, and applicable regulations must also be observed.

4.4. Conflict of Interest Related to External Activities

We promote the holistic development of our employees and respect interests that complement their professional performance within the Company. For this reason, external activities are permitted. However, responsibilities acquired with the Company take precedence over any other employment relationship or external activities, whether for‑profit or non‑profit. In line with the above, if we wish to engage in these types of activities, we must consider the following criteria and obtain approval from our leader and disclose the activity to the Compliance area (when applicable):

•Always consider ethical and legal criteria, as well as any potential reputational impact on the employee or the Company.

•Prioritize the employment relationship with the Company and fulfill all assigned responsibilities.

•Do not use the role or function performed within the organization for personal benefit or self‑promotion.

•Do not use the Company’s intellectual property or access client or business information—unless the information is public.

•Ensure there are no conflicts of interest. If any exist, they must be managed appropriately according to this Code.

Without prejudice of other situations that may constitute real or apparent conflicts of interest, the following must not occur due to the conflict they entail: Participating directly or indirectly in activities that compete with the Company, including taking business opportunities for oneself or for a third party that could instead be taken by the Company. Being a significant shareholder, employee, administrator, or advisor of companies or businesses that compete with the organization.

•For Company administrators, the guidelines established in the Corporate Governance Code apply.

Participation on Boards of Directors or Advisory Committees of Third Parties

Employee participation on boards of directors or advisory committees of third parties—including non‑profit organizations—requires leader approval. Such authorization depends on the following requirements:

•The approving leader must have the proper authority, according to the guidelines of the Corporate Ethics Committee (see Annex 1). The leader must obtain authorization from the Compliance area, which may escalate the case to the Ethics Committee through a fast‑track mechanism if deemed necessary. The Talent and Culture area must maintain a record of employee participation on boards or committees.

•Unless the participation is carried out in compliance with instructions from the Group company we work for, we must always participate in a personal capacity.

•

•Employees must refrain from participating in discussions or deliberations involving the Company or situations that may create a conflict of interest and must consider resignation if necessary.

Approval from the leader and Compliance is not required for participation in labor unions, employee funds, condominium boards, community action boards, or other groups defined by the Corporate Ethics Committee. However, leaders must nonetheless be aware of such participation.

For questions, administrators and senior executives should consult the Legal area, while other employees should consult the Compliance area.

4.5. Political Participation

We respect and promote the exercise of individual rights, including political rights of our employees. Those who decide to participate in politics—whether by running public office, holding a political or diplomatic position, or managing or acting as treasurer for political campaigns—must inform previously the leader, the Talent and Culture area, and the Compliance area beforehand. Such political participation must be carried out exclusively in a personal capacity and must not affect the employee’s professional objectivity. Additionally, the time dedicated to these activities must not interfere with their work responsibilities or schedule.

Furthermore, political proselytism may not be conducted using Company tools or communication channels.

Political activities may not take place within Company facilities or in the work environment. Also, employees may not use their affiliation with the Company to promote political activities.

4.6. Activities Involving Related Parties[4]

The following situations are considered conflicts of interest when they involve Related Parties:

•Serving clients who are Related Parties, particularly when the collaborator participates in credit‑granting processes or holds authority to offer or approve products, services, discounts, or exemptions.

•Participating in selection processes for employees, partners, or suppliers when a Related Party is a candidate or bidder, or making decisions related to a contract involving a supplier who is a Related Party or in which the Related Party has an interest.

•Holding positions within the Company where a Related Party is led or supervised by the collaborator, or where the collaborator is led or supervised by a Related Party.

•Participating in negotiations or business exploration in which the counterparty is a Related Party or the Related Party has an interest.

Responding to oversight or regulatory entities in cases where the person conducting the review or supervision is a Related Party employed by such oversight entity.

4.7. Client‑funded activities

The following is also considered a situation of a possible conflict of interest, and must be managed accordingly accepting client‑funded expenses, such as travel costs or other expenses necessary to carry out Company‑related duties, including activities related to customer due diligence, suppliers, or counterparties.

As an exception, the Company may accept client‑funded transportation costs only when access to the required location is difficult, and only with the previously approval from the leader who holds conflict‑of‑interest management authority, along with validation from Compliance.

4.8. Authority for the management of conflicts of interest

The situations described in this Code are illustrative; therefore, we all share the responsibility of remaining alert and identifying any circumstances that may pose a conflict of interest.

When potential conflicts of interest arise, we must inform our leader immediately. The leader must escalate the matter to the leader who has the authority—assigned by the Corporate Ethics Committee—to manage such conflicts. This authorized leader will evaluate the situation and determine whether action can proceed because no conflict exists, or, if a conflict does exist, determine the appropriate management.If any doubt remains, the situation must be referred to the Compliance area for guidance.

To identify the leader who holds these authorities, collaborators should consult Annex 1.

All disclosures of conflicts of interest, as well as the decisions made regarding their management, must be documented using the mechanisms established by the Compliance area.

Members of the Board of Directors and Senior Management must disclose any conflicts of interest in which they may be involved, in accordance with the procedures outlined in the Corporate Governance Code, so they can be managed through the established processes. They may also disclose additional situations to the Compliance area—even those not formally required under the Corporate Governance Code—if they wish to document them or seek clarification.

To prevent conflicts of interest arising from relationships between employees, their Related Parties, clients, suppliers, or partners, as well as potential access to privileged information, we must periodically update disclosures related to family ties, potential conflicts of interest, and any other required declarations, following the processes defined by Talent & Culture and Compliance. This requirement, however, does not exempt collaborators from identifying, escalating, managing, and disclosing any conflict of interest in accordance with this Code, regardless of previous declarations.

4.9. Insider Information and/or Material Non‑Public Information (MNPI)

Applicable legislation defines what constitutes insider information and/or Material Non‑Public Information. However, this refers to information that is confidential, concrete, not publicly available, and that a reasonable investor would consider relevant when making investment decisions.

For Capital Markets purposes, insider information and/or Material Non‑Public Information is information that, if disclosed, could reasonably affect the price or market value of securities issued by the Company or other issuers, or influence an investment or divestment decision regarding such securities. Information is considered material when there is a substantial probability that a reasonable investor would view it as important when deciding whether to buy or sell securities, or when the information significantly alters the total mix of information available prior to the transaction.

Using insider information for personal benefit or for the benefit of a third party may constitute a crime.

In addition to the provisions in this Code regarding confidential information, insider information is subject to the restrictions established by law and the Company's internal guidelines.

Any collaborator who has access to Insider Information and/or Material Non‑Public Information (“Collaborators with Insider Information and/or MNPI”) must refrain from using it under any circumstances outside the scope of their responsibilities within the Company.

This prohibition also applies to any person who has access to such information due to their relationship with the Company or the collaborator.

For the purpose of protecting market integrity and act responsibly, Collaborators with Insider Information and/or MNPI must refrain from the following:

i. Conducting personal investments.when such investments involve the use of insider information and/or MNPI.

ii. Offering to buy or sell securitieswhen in possession of insider information and/or MNPI.

iii. Buying or selling securitiesif they received insider information and/or MNPI from another collaborator.

iv. Conducting short sales or using derivatives or hedging instruments designed to speculate on the value of the Company’s securities or those of other issuers, as well as engaging in liquidity or funding operations using such securities as underlying assets, when insider information and/or MNPI is known.

Additionally, Collaborators with Insider Information and/or MNPI must refrain from improper disclosure practices, including:

1)Revealing insider information and/or MNPI outside the normal scope of their duties, responsibilities, or role, particularly when such information could be used to gain benefits in the trading of securities issued by Grupo Cibest or any other issuer.

2)Recommending or inducing third parties to buy or sell securities while in possession of insider information and/or MNPI.

When in doubt about whether the information handled is insider information or MNPI, collaborators must treat it as such and consult the Legal and/or Compliance areas.

The following list includes several (but not all) situations where a collaborator may have access to insider information or MNPI, regardless of whether a confidentiality agreement exists:

•Access to confidential treasury, accounting, capital markets, legal, risk, internal control, or strategic information.

•Participation in the preparation of financial statements or related inputs.

•Development of products or services for clients who are issuers in capital markets.

•Discussions or supervision of high‑impact or strategic business opportunities involving issuer clients.

•Participation or knowledge of high‑impact or strategic corporate projects.

•Involvement in critical administrative decisions.

•Participation in investment decisions or the purchase or sale of material assets.

•Involvement in mandates granted to investment banking or other business units that involve an issuer.

•Participation in crisis management situations such as cyberattacks.

•Knowledge of structural changes in the Company, reorganizations, mergers, acquisitions, among others.

•Involvement in the assessment of events or risks that could significantly impact the Company or its reputation.

Any violation of these provisions may result in sanctions, as described in Chapter 6 of this Code.

4.10. How Do We Manage Personal Investments?

4.10.1. General Rules Applicable to All Collaborators

When making personal investments, we must observe the following provisions to avoid conflicts of interest, questions regarding the misuse of information, and other potential improper practices or inappropriate conduct in the market:

•We may not carry out transactions or operations while in possession of Inside Information and/or Material Non‑Public Information of Grupo Cibest or of any other issuer (as indicated in Section 4.9), and we must comply with the guidelines set forth in this Code, applicable regulations, and any complementary provisions.

Prior to making personal investments, we must evaluate whether such investments could create a conflict with the interests of the Company, its stakeholders, or our personal interests. If so, we must comply with the provisions established for managing such conflicts. We may not invest in businesses of clients, suppliers, or counterparties of the Company whose relationship we manage or in respect of which we play a relevant role, unless such investments are first managed as a potential conflict of interest, in accordance with the guidelines set out in this Code.

•During working hours, we must prioritize our responsibilities to the Organization and the needs of clients and the Company, while prudently and moderately attending to our personal matters.

•We must act prudently in managing our personal investments, considering at a minimum their legality, our financial capacity and level of indebtedness, the risks involved, and any potential reputational impact on the Company.

•Investments made in capital markets must be free from any practices intended to artificially affect asset prices or perceptions of liquidity and must, at all times, adhere to sound banking, securities, and market practices applicable to the market in which we participate.

•We must use the same transactional and inquiry channels available to our clients for these purposes; therefore, we may not use the system accesses or permissions granted by our position to conduct inquiries or manage our own transactions or those of our Related Parties.

•When conducting transactions using personal funds on behalf of third parties, such transactions must comply with the personal investment provisions of this Code and any complementary guidelines.

•If we act as decision‑makers or administrators of third‑party investments, such decisions will be subject to the provisions of this Code and any complementary personal investment guidelines defined by each Company.

We are authorized to acquire and dispose of any securities issued by any Company within the Group, subject only to the restrictions derived from the prohibition on the use of Inside Information and/or Material Non‑Public Information, the rules applicable to directors and officers as defined in the Corporate Governance Code, and the specific provisions contained in this Code and its complementary guidelines.

Employees whose compensation schemes are based on value generation may, upon meeting the defined goals and conditions, receive part of their bonus through an investment fund intended for the purchase of shares or Grupo Cibest S.A. ADRs. Employees to whom this scheme applies and who have access or potential access to Inside Information and/or Material Non‑Public Information of Grupo Cibest, must consult the Compliance Area of each entity to determine whether specific guidelines apply to the withdrawal of such funds due to the functions they perform.

4.10.2. Specific Rules Applicable to Employees and Other Collaborators Regarding the Trading of Shares Issued by Grupo Cibest Companies

4.10.2.1. Trading of Grupo Cibest S.A. Shares by Directors and Officers

Directors and officers of the Company who wish to conduct transactions involving shares of Grupo Cibest S.A. must comply with the provisions of this Code of Ethics and Conduct and all other applicable policies.

Where applicable, they must also comply with the restrictions set forth in the Corporate Governance Code and other corporate documents.

4.10.2.2. Trading by Employees and Other Collaborators Who Potentially Have Access to Inside Information and/or Material Non‑Public Information

No employee or collaborator may carry out personal investments that involve the use of Inside Information and/or Material Non‑Public Information.

Collaborators who have access to confidential Company information and who, due to the nature of their role or functions, may potentially have access to Inside Information and/or Material Non‑Public Information must be familiar with and apply the specific rules established to prevent its misuse or inadvertent disclosure.

Members of Senior Management and organizational leaders must identify employees who potentially have access to Inside Information and/or Material Non‑Public Information, inform them that they are subject to these specific rules, and notify the Compliance Area accordingly.

Likewise, collaborators who identify that they have access to such information must notify their leader and the Compliance Area, in accordance with the provisions governing the handling of Inside Information and/or Material Non‑Public Information. This identification may be complemented through the mechanism or procedure defined by the Company for this purpose, in accordance with its internal policies.

Transactions carried out by this group of collaborators involving shares issued by Grupo Cibest S.A., ADRs, single‑issuer funds, or any other issuing entity within the Group—provided they do not possess or have knowledge of Inside Information and/or Material Non‑Public Information—must comply with the following requirements:

•The transaction must not be speculative in nature. For purposes of this Code, speculative intent is presumed, for example, when all three of the following conditions occur simultaneously:

•An unusually short period elapses between the purchase and sale of the securities;

•Exceptionally favorable or unfavorable events have occurred for the issuing entity; and

•The transaction results in a significant gain or loss.

•A reference period of thirty (30) calendar days is used for opposite‑direction transactions.

The transaction must not take place during blackout periods. For purposes of this Code, the following periods constitute blackout periods for the Company:

•The months of January, April, July, and October of each year;

•The first ten (10) calendar days of the remaining months; and

•The period between the moment a relevant transaction or business opportunity (Inside Information and/or Material Non‑Public Information) becomes known and the moment the related information is disclosed to the market.

•The collaborator must express their intent to carry out the transaction, declaring that they do not possess Inside Information and/or Material Non‑Public Information, before to the transaction, through the mechanism defined and in accordance with Company procedures.

Prior approval must be obtained from the direct leader to carry out the transaction.

•The order or instruction must be placed within T+5 (calendar days) following the leader’s approval.

All other requirements and procedures defined by the Company must be met.

The provisions of this section do not apply when the collaborator does not participate in the decision‑making process for the purchase or sale of shares and the transactions result from the use of automated trading systems, robots, or algorithms.

To promote transparency, manage potential conflicts of interest, and facilitate control and monitoring activities, collaborators are encouraged to conduct transactions through Group companies.

4.10.2.3. Special Circumstances

The leader of each area or business line, in consultation with the Legal and Compliance Areas, may impose specific requirements, blackout periods, restrictions, or prohibitions on particular assets to prevent real or apparent conflicts of interest or the misuse of Inside Information and/or Material Non‑Public Information.

Collaborators involved in securities and foreign exchange intermediation activities must observe the additional guidelines applicable to the Capital Markets environment, in accordance with current regulations. In such cases, each Company will define its own specific policies, and each collaborator is responsible for knowing and complying with them, as well as adhering to the guidelines established in this Code.

In special situations, investment restrictions may be lifted or reinforced by the Ethics Committee, following consultation with the Legal and Compliance teams. Likewise, Group companies engaged in securities and foreign exchange intermediation activities that have specific guidelines to comply with local regulations may adjust such guidelines through the competent body defined by each Company.

4.11. How Do We Manage Gifts and Invitations?

Rules Governing the Offering and Acceptance of Gifts and Invitations

Just as we manage conflicts of interest, we must also prevent situations that may give rise to them. We recognize that, in the business world, the exchange of gifts, invitations, or symbolic gestures of appreciation is a common courtesy. However, when such gestures are recurrent, excessive, inappropriate, intended to unduly influence decision‑making, or when their purpose is unclear, they may give rise to an apparent or real conflict of interest and, among other consequences, restrict free competition or even be illegal in certain cases.

To guide the offering and acceptance of gifts and invitations, the Company has established the following rules. These apply to all employees and other people subject to this Code and must be complemented by good judgment, prudence, responsibility, common sense, and ethical reasoning.

4.11.1. Offering Gifts and Invitations to Third Parties

•As collaborators of the Company, we may only: Offer gifts that reflect the values of our brands, are consistent with our ethics and integrity, our zero‑tolerance policy toward corruption, and are reasonable in terms of cost. Preferably, such gifts should be provided or recommended by the Marketing Areas.

•Extend institutional invitations in the ordinary course of business relationships (for example, refreshments, lunches, or dinners), provided that the costs comply with the Company’s corporate expense policies or guidelines and with our zero‑tolerance approach to corruption. Institutional invitations may be intended to recognize third parties, suppliers, or allies who are relevant to the Company’s strategy, and, in some entities, clients may also be included. Selection must consider the provisions for managing potential conflicts of interest.

•Invite third parties to events organized or sponsored by the Company whose primary purpose is commercial or academic, such as forums or fairs relevant to the development of our businesses and those of our clients. Such events may include entertainment. Additionally, in coordination with the Marketing Areas, we may invite third parties to events for which the Company has tickets through commercial sponsorships (for example, sporting or cultural events), in which case we must observe, among others, the Corporate Anti‑Corruption Policy and free competition regulations. When offering a gift or extending an invitation, we must request a certification from the third party confirming that

acceptance of the gift or invitation does not contravene their own ethical guidelines and is not intended to retain business or influence decision‑making.

•We must not extend invitations to suppliers, allies, or clients who are participating in a selection or negotiation process for the offering of Company products or services.

4.11.1.1. Sponsorships

We may sponsor or make institutional contributions to programs with economic, social, environmental, or cultural impact, provided that such contributions are consistent with the principles of this Code, applicable policies and procedures, and aligned with the Company’s sustainability strategy and institutional positioning guidelines, as well as any specific policies defined by each entity within the Group Under no circumstances may sponsorships or contributions seek to obtain or retain business, induce an action or omission in favor of the Company, or result in personal gifts for public or private officials or employees.

4.11.1.2. Political Contributions

The Group may make donations or contributions (monetary or in kind) to political parties, candidates, movements, or campaigns, provided that such contributions are permitted by applicable law, duly authorized by the corresponding bodies, and compliant with the policies and procedures established for this purpose. Under no circumstances may such contributions seek to obtain an undue advantage for the Company, its directors, or Senior Management in exchange for the contribution.

To learn more about these contributions, click here.

Employees may also make personal political donations or contributions of their choosing, avoiding at all times the use of their affiliation with the Company or any Group entity to do so.

Before making contributions, directors and Senior Management must consult with the Legal and Compliance Areas regarding the amount and potential impact on the Organization.

4.11.1.3. Offering Gifts and Invitations to Local and Foreign Public Officials

Companies of the group may offer gifts to public officials only within the context of loyalty or relationship‑building campaigns. Offering gifts or invitations to public officials requires prior approval from the leader with the appropriate authority, in accordance with the guidelines established by the Corporate Ethics Committee.

In all cases, invitations to entertainment events, such as shows or sporting events, are not permitted.

The restrictions in this section do not apply to invitations offered as part of ordinary business relationships, such as breakfasts or lunches.

When invitations are extended to public officials or to diverse groups of third parties that include public officials, the invitation must clearly state that:(i) the recipient is responsible for verifying whether they are authorized to accept the invitation;(ii) attendance is not mandatory; and(iii) the event is not intended to facilitate or retain any business.

4.11.1.4. Offering Gifts and Invitations to Collaborators

The Companies of the group may offer gifts to recognize employees or other collaborators for extraordinary performance and contributions to achieving organizational objectives. Companies may also, for various reasons, receive tickets to entertainment events, promotional materials from other companies, or other items as gifts, in accordance with this Code.

Collaborators must not seek or request such items; however, the Company may distribute them among collaborators, ensuring that distribution is appropriate and considering, among other factors, the type of gift and performance.

4.11.2. Acceptance of Gifts and Invitations

Subject to the general rules established in this Code, collaborators may accept gifts and invitations from clients, suppliers, allies, and other current or potential counterparties, provided that such gifts or invitations do not affect—or appear to affect—our objectivity, impartiality, or independence. This applies whether gifts or invitations are offered directly or through third parties.

We must request from the supplier or ally offering the gift or invitation a statement or reference to their policies confirming that what is offered is consistent with their internal guidelines.

The Compliance Vice Presidency may require the rejection of a gift or invitation if it considers that it creates a permanent potential conflict of interest.

4.11.2.1. Acceptance of Gifts

When a gift offered by the same person, whether individually or cumulatively within a calendar year, equals or exceeds USD 200, and we consider that it can be accepted without affecting our objectivity, independence, or impartiality, we must obtain authorization from the leader with the appropriate authority, in accordance with the guidelines of the Corporate Ethics Committee (see Annex 1). In all cases, acceptance or rejection must be documented through the mechanisms established by the Compliance Areas.

The USD 200 threshold may be reduced in accordance with specific laws, regulations, or guidelines defined by the Corporate Ethics Committee for some of the Group’s Companies.

If the gift is below the established threshold and nevertheless, due to its nature you wish to disclose it because it could generate a potential, apparent, or actual conflict of interest, you must request authorization from the leader with the appropriate authority and disclose the management of the conflict to Compliance through the designated channels.

The powers to approve or reject for gifts and invitations may be redefined in accordance with organizational changes and guidelines issued by the Corporate Ethics Committee.

When employees or leaders determine that it is inappropriate to receive a gift, we must decline or return it, even if it has been sent to a home address or any other location, and we must inform the Compliance area of the rejection. If returning the gift could offend the sender, we must consult the leader with the authority granted by the Corporate Ethics Committee (see Annex 1), who may seek guidance from the Compliance area to determine whether the gift may be accepted, the appropriate purpose it should be given, and the message that should be communicated to the person offering it.

No collaborator may accept cash, electronic transfers, or equivalent instruments (such as vouchers) as a personal gift, gratuity, or commission. If return is not possible, guidance must be sought from the Compliance Area.

4.11.2.1.1. Acceptance of Gifts from Local and Foreign Public Officials

To preserve the objectivity and impartiality that must characterize relationships with public officials, collaborators must not accept any type of gift from them.

4.11.2.2. Acceptance of Invitations

4.11.2.2.1. Entertainment or Hospitality Invitations

Invitations received from third parties must be primarily intended for knowledge transfer. Invitations that do not meet this criterion must be treated as gifts.

The Company will not assume any expenses associated with such invitations. Collaborators may not use corporate credit cards. When relationship managers attend, it must be ensured that contract renewals are decided collectively.

4.11.2.2.2. Collective Invitations

To maintain objectivity in our relationships with third parties, we must not accept collective invitations—for example, situations in which a counterparty invites the entire team they work with to a dinner at a restaurant.

4.11.2.2.3. Invitations from Allies, Suppliers, or Potential Suppliers

It is frequent that allies, suppliers, or potential suppliers may extend invitations to academic or technical events focused on knowledge transfer. These institutional invitations may only be accepted after consulting the leader with the appropriate authority, according to the Corporate Ethics Committee guidelines (see Annex 1), who, after consulting relevant peers, will determine the most suitable collaborator to attend.If the invitation includes travel and accommodation expenses, the authorized leader must also determine whether such expenses will be partially or fully covered by the Company. The third party may not cover all expenses. This restriction does not apply to public events within the same city, which may be attended with leader approval.

If the invitation includes entertainment, it must be processed as a gift, and the decision must be documented through the mechanism established by the Compliance Area.

No gifts or invitations may be accepted from suppliers or allies participating in a competitive selection process, even if the invitation is academic or networking‑related.

If a supplier or partner extends an invitation on the eve of contracting, contract renewal, or an amendment to the contract, it must be ensured that the decision is made collectively and does not depend solely on the person receiving the invitation. The Supply Chain Management Department will review these cases to determine whether there is a potential conflict of interest at the time of the new negotiation.

If, as part of the selection process, it is necessary to visit the participants in order to gain a better understanding of the goods or services offered, this must be done for all participants, and any travel, lodging, or other applicable expenses must be covered by the Group company to which the employee belongs. If access to the facilities presents difficulties, only transportation covered by the supplier or partner will be accepted.

The commitments agreed upon in the various contracts with suppliers and partners, or in verbal negotiations with them, shall not include any clause or contractual requirement obligating the supplier to invite Grupo Cibest employees to events whose purpose is knowledge transfer, networking, or entertainment.

4.11.2.2.4. Invitations from Clients

During onboarding or business exploration processes, no gifts or invitations may be accepted other than customary commercial relationship settings (such as breakfasts or lunches).

If client visits are necessary for business understanding, travel and accommodation expenses must be covered by the Company, except in cases of access limitations, where transportation coverage by the client may be accepted.

Any invitation outside customary commercial interactions will be treated as a gift and managed accordingly.

4.11.3. Exceptions to the receipt or giving of Gifts and Invitations

When it is deemed necessary to receive or give a gift or invitation that does not fully align with this Code, authorization must be granted by the leader with the appropriate authority, in accordance with the guidelines of the Corporate Ethics Committee (see Annex 1).

4.11.4. Gifts and Invitations to External Members of the Board of Directors

External Board members must disclose any gift or invitation that meets the following conditions:

•Value: Gifts or hospitality equal to or exceeding USD 200.

•Source: Invitations originating from third parties unrelated to the Company’s ordinary course of business.

•Purpose: Gifts or invitations granted by virtue of their role as Board members and managed through internal Company channels.

In such cases, the matter must be brought to the attention of the Chair of the Board of Directors, who will determine whether acceptance is appropriate.When the gift or invitation is directed to the Chair of the Board, the decision shall be made by the Audit Committee.

The Compliance Team will support the process by conducting a prior analysis and issuing a recommendation to inform the decision.

5. What Mechanisms Promote and Support Our Ethical Conduct?

“We establish various mechanisms that support our ethical conduct.”

We are proud of our culture and aware that it must be continuously fostered and strengthened. For this reason, we have established a set of mechanisms that support this endeavor.

5.1. Corporate Ethics Committee

The Group has a Corporate Ethics Committee, with scope over all the companies that comprise it. This Committee defines the general policy and ethical, conduct, and integrity guidelines, and communicates corporate positions on highly complex ethical dilemmas.

The Corporate Ethics Committee ensures that our organizational culture and its core principles are interpreted and lived consistently across all Group companies. It also determines the actions required to disseminate our culture and ethical standards among collaborators, including the training programs deemed necessary. Additionally, the Committee may request diagnostic activities to assess ethics within the Group.

The Board of Directors of Grupo Cibest S.A. adopts the Operating Rules of the Corporate Ethics Committee, which establish, among other aspects, the members that make it up (in addition to the President of Grupo Cibest S.A., who serves as Chair), the people who may participate as invited guests, the quorum required for deliberation and decision‑making, and the frequency of meetings.

5.2. Local Ethics Committees

The Group entities operating in each of the countries where we have a presence will establish, or participate in, local ethics committees when so determined by the Corporate Ethics Committee, in accordance with its guidelines.

These local ethics committees have, among others, the following responsibilities: (i) reviewing cases escalated by the relevant areas to validate the consistency of decisions with the guidelines of the Corporate Ethics Committee; (ii) identifying cases or matters that should be brought to the attention of the Corporate Ethics Committee in order to define the organization’s ethical tone and issue guidance on specific topics; (iii) defining corrective measures within their scope and instructing the relevant areas on their implementation; and (iv) monitoring indicators related to the prevention, detection, and response to misconduct, as presented by the Compliance Areas in coordination with other relevant areas.

These local committees must periodically report to the Corporate Ethics Committee.

The Corporate Ethics Committee may delegate to the Bancolombia Ethics Committee, a corporate role so that it can provide the Group’s other companies with detailed guidelines to implement the general policy and ethical guidelines provided by the Corporate Ethics Committee.

5.3. Compliance Areas: Guidance on the Interpretation of the Code of Ethics and Ethical Dilemmas

As employees, we may encounter situations on a daily basis where we have doubts about how to act in compliance with this Code of Ethics and Conduct. [5] If we have any doubts about the interpretation of its contents, we should seek advice from our area leader and/or the Compliance area before acting. The Compliance Area has specialists in these matters who will guide us in making decisions to avoid non-compliance with the provisions of this Code.

The Compliance team conduct training, awareness‑raising, and communication activities so that we understand what the Company expects from our conduct. Annually, in conjunction with the Vice Presidency of Talent and Culture, and in accordance with the guidelines of the Corporate Ethics Committee, the mandatory training program is defined.

5.4. Reporting Channels and Protection for Whistleblowers

When any of our employees or stakeholders including shareholders, clients, suppliers, allies, and competitors suspect or become aware of violations of this Code or related policies, they may report such concerns through the Ethics Line or by contacting any of the following areas: (i) the Compliance Area; (ii) the Talent and Culture Area, for complaints related to labor matters; or

(iii) the Audit Area.

We can also channel the complaint or suspicion through our direct or indirect leader, so that they can communicate it to the areas responsible for its management.

Reports submitted through the Ethics Line may be made anonymously, should the reporter so choose. Those submitting anonymous reports should be aware that the more information provided, the greater the likelihood of conducting an effective investigation. The identity of the reporter, if disclosed, will remain confidential at all times. Confidentiality means that the reporter’s identity will not be disclosed and that the reported facts will be shared only with those who strictly need to know in order to conduct the investigation and address its findings.

Reports are handled differently depending on their characteristics.

5.5. Complaints and Reports Related to Organizational Climate and Workplace Relationships

We encourage our collaborators to engage in open dialogue to resolve differences and conflicts that may arise in workplace relationships. However, certain situations may undermine our culture and require specific mechanisms for their management, such as harassment, discrimination, and similar conduct.

Complaints or reports related to these topics must be submitted to the Talent and Culture Vice Presidency, which addresses them comprehensively and in a timely manner through dialogue, feedback, support, and, where appropriate, corrective or disciplinary actions against the responsible individuals or entities, regardless of their position or level.

As a general rule, if a report involves a collaborator from the Talent and Culture Area, the investigation will be conducted by Internal Audit.

5.6. Reports of Unusual Transactions

Reports of unusual transactions may be submitted through various channels, including the Ethics Line, which is available to collaborators and third parties alike. These reports are forwarded to the Compliance Area, which is responsible for assessing alerts related to money laundering and terrorist financing.

With the support of the business units, the Compliance Area determines whether the transactions are justified or should be classified as suspicious transactions and, consequently, reported to the competent authorities. The Compliance Area may also recommend additional measures to manage money laundering risk.

If the report involves the conduct of a collaborator, it will be handled as described below.

5.7. Complaints and Reports of Fraud and Misconduct

Complaints and reports related to fraud and practices that violate this Code or deviate from the conduct expected of our collaborators are investigated by the responsible area, in accordance with what is established in the policies of the antifraud program.

Investigations are carried out in line with established internal processes and must ensure the confidentiality of the investigation. If a report involves a collaborator from the area responsible for conducting the investigation, Internal it must instead be carried out by Internal Audit.

Our collaborators, who because of their knowledge and their functions, are able to detect improper practices. For this reason, the Company encourages reporting and ensures that those who report, in good faith, violations of this Code, complementary policies, applicable laws, or the Company’s expected standards are protected against retaliation. Collaborators who observe or are victims of retaliation may report such conduct through any of the available channels so that it may be investigated by the corresponding areas.

When collaborators report suspicious acts based on a reasonable belief, it is assumed in good faith that such acts may be true. Conversely, reporting facts with knowledge of their falsity constitutes misconduct and will be sanctioned in accordance with the provisions of this Code.

The Ethics Line is also one of the channels available to report human rights violations. If any conduct is reported in which the Company or any of its affiliates violates or threatens human rights, the procedures for remediation, rectification, and non‑recurrence, as well as the applicable intervention protocols, will be applied.

5.8. Communication Channels with the Group Cibest Ethics Line

Colombia:

•National: 018000524499

•Mobile: #955

•Medellín: 448 4868

•Mi Bancolombia App: Contact Us / Ethics Line

El Salvador:

•503‑2259‑7898

Guatemala:

•502‑2378‑6933

•etica@bam.com.gt

Panamá:

•National: 01 100 800 157 00 76

•Panama City: (507) 306 55 74

Puerto Rico:

•1‑866‑687‑6201

Email: lineaeticaCibest@grupocibest.com.co

We encourage you to learn about and use the Ethics Line whenever you deem it necessary.

6. What Is the Disciplinary Process?

“All cases are carefully analyzed in order to make the best decisions.”

All reports and complaints received are subject to investigation. Additionally investigations may also be initiated as a result of alerts detected by the areas responsible for ensuring compliance with this Code.

When investigations determine that any of our collaborators have failed to comply with the provisions set forth in this Code, its complementary policies, or the ethical standards required by the Company—whether through action or omission—sanctions must be imposed in accordance with the Internal Work Regulations and applicable laws.

In determining the appropriate sanction, the following factors are taken into account, among others: the severity of the conduct, any recurrence, economic losses, reputational impact, and related circumstances. At all times, due process and respect for human rights are ensured.

In addition to internal sanctions, the Company may, at its discretion, initiate civil or criminal actions in accordance with applicable laws.

Annex 1

[1] It refers to an existing conflict of interest.

[2] It refers to a conflict that does not yet exist, but that is likely to occur or materialize later due to a change in circumstances, roles, or activities.

[3] An apparent conflict of interest occurs when a situation may create the perception that someone is acting in favor of a particular interest, even though that is not actually the case.

[4] Direct Related Parties are: (i) the basic family group, that is, parents, siblings, children, spouses or permanent partners, grandparents, and grandchildren; (ii) legal entities in which the person serves as an administrator, executive, and/or member of any oversight body; (iii) legal entities in which the person is the owner or beneficial owner of more than 10% of the company’s share capital, or any lower percentage required by applicable law. Indirect Related Parties include all natural and/or legal persons with whom there is a contractual, personal, family, or any other type of relationship that may affect the objectivity and impartiality that must characterize commercial relationships. Examples include: romantic partners, best friends, in-laws, coworkers (day‑to‑day colleagues or those who, due to a close or friendly relationship, may affect objectivity, impartiality, or independence), among others.

[5] If you have questions, require advice, or need to disclose information, contact the Compliance area.

Document

GOOD GOVERNANCE CODE

GRUPO CIBEST

February 2026

INTRODUCTION

For the company Grupo Cibest S.A. ("Parent Company") and its subsidiaries (hereinafter, the "Group" or "Grupo Cibest"), a business culture based on transparency, integrity and responsible decision taking allows us to achieve its purpose: promote sustainable development to attain everyone’s welfare and contributes to foster trust and generate value of the companies that are part of it.

This Good Governance Code (hereinafter referred to as “The Code”), includes direction, administration, and control measures aimed at consolidating and preserving good governance and integrity in business, as objectives with which we are committed to our investors and other groups of interest, and that are permanently being reviewed in order to incorporate the best practices.

SECTION 1. GENERAL PRINCIPLES OF GOOD GOVERNANCE AT GRUPO CIBEST

Application Scope. The Companies´ shareholders, senior management and employees are recipients of this Code; therefore, they must comply with its provisions and with the purpose of its principles and policies as a model of action.

Reach. The Code is designed to be adopted by the Companies, in order to guarantee that the corporate governance policies are aligned. Therefore, it is the Companies’ Boards of Directors’ or the competent bodies responsibility to ensure that the Code is incorporated as a corporate document, with the particularities that may be applicable.

When reference is made in this Code to the “Companies” or the “Company”, it shall be understood that is referred to: (i) the companies that are part of the Cibest Business Group, (ii) the companies directly or indirectly controlled by more than 90% by the Parent Company, and (iii) those subordinate companies that voluntarily decide to adopt the Code, with the particularities that may be applicable, in accordance with their size, jurisdiction, and the restrictions inherent to their business.

When reference is made to the "Parent Company," it shall be understood that these are provisions exclusively applicable to this company as the parent of the Group, and when reference is made to "Bancolombia," it shall be understood that these are provisions exclusively applicable to Bancolombia S.A., a banking establishment of the Group domiciled in Colombia.

Competent Body to Issue Good Governance Policies and Measures. The Code is a document complementary to the Companies Bylaws or Articles of Incorporation (hereinafter “Bylaws”), which shall be updated and adjusted to the business’s dynamics and evolution. The creation, modification, and repeal of provisions related to the good governance of the Group will be the responsibility of the Board of Directors of the Parent Company as the parent of the Group. Notwithstanding the foregoing, the Boards of Directors of the other Companies, in the adoption of the Code, may approve for the Companies, the modifications that may be applicable, in accordance with the procedure defined in this Code.

The Good Governance Committee of the Parent Company will be the competent body to previously study the proposals for bylaws amendments of the Parent Company, regarding corporate governance measures, and the Code, and to present these proposals for consideration by the Board of Directors of the Parent Company.

When any of the Companies needs to adopt a policy or measure of good governance based in their business or applicable regulations, or if they have concerns about the application of the provisions, the Corporate Governance Vice Presidency and General Secretariat of the Parent Company will be the instance in charge of providing clarity and guidance on such matter prior to its presentation to the respective Board of Directors.

Good governance for Stakeholders. In terms of good governance, the main stakeholders are recognized as, but not limited to: shareholders and/or investors, administrators (Directors, Senior Management and main executives), employees, suppliers, customers and financial consumers, internal and external control bodies, and the supervisory and regulatory entities of the Companies.

Within the Group, relationships with stakeholders must be conducted within the framework of the law, transparency, and sound business practices, in a context of respect, a spirit of collaboration, and equitable treatment. For this purpose, the Companies must encourage and promote active participation and cooperation for value creation, share relevant information in a complete and timely manner on issues where they participate according to laws and regulations in force and promote the effective resolution of conflicts with their stakeholders.

SECTION 2. GOOD GOVERNANCE PRINCIPLES AND MEASURES RELATED TO SHAREHOLDERS - RULES OF PROCEDURE OF THE GENERAL SHAREHOLDERS’ MEETING

Each Company recognizes a shareholder as the person or entity registered in its Shareholder Registration Book or electronic means, indicating the number of subscribed and registered shares and under the conditions set in current regulations applicable to each of the Companies.

Shareholders are, in terms of good governance, a group of great importance and therefore are granted with a set of rights, prerogatives, benefits, and duties consistent with legal provisions, the Bylaws and this Code.

All shareholders shall have, among others, the possibility to know and exercise their rights, to make relevant observations to the management, and to propose amendments or making pertinent proposals for the better performance of the Company of which they are shareholders.

The Companies commit to:

1.Recognize and promote their shareholders’ rights.

2.Inform shareholders of their duties and obligations to the Companies.

3.Disclose the regulations for the operation of the general shareholder’s meeting, in order to promote shareholders’ participation.

4.In the case of the Parent Company, set the necessary mechanisms for shareholders to be properly informed about the main figures and indicators of the Company's business, and those of the most relevant affiliated companies, the ratings obtained, the general financial, and risk policies, and all other topics related to share issuance.

2.1. Shareholders’ Rights

In addition to other rights set forth in the law and the Bylaws, each Company provides its shareholders with the following rights:

a. Dividends: To have a participation of the dividends as established by the Company’s Shareholders’ Meeting, according to the type of shares they hold, provided that there is distribution of these.

b. Exercise of political rights: According to the type of shares owned, to participate and vote in the General Shareholders’ Meeting to make the corresponding decisions, including the appointment of bodies and dignitaries that, according to the law and the bylaws, should be elected. Likewise, shareholders shall be entitled to have effective mechanisms to be represented in the meetings.

Shareholders of the Parent Company and the Companies issuing securities in the Colombian market who represent 5% or more of the Company's share capital will have the possibility to request, at the beginning of the shareholders' meeting where a reform to the Bylaws is intended to be adopted, that the review and voting of certain articles be done separately or individually due to the significance or impact that a change may generate, or request the review of a group of articles seeking that the analysis be done based on thematic unity. If the request is not accepted, the proposal will be voted on as a whole.

Such a request must be duly substantiated and presented to the Chairman of the General Shareholders’ Meeting, who shall inform all other shareholders of the content of the petition. Without prejudice to the foregoing right, and in order to guarantee the effectiveness of the meetings, all requests made by shareholders with the exclusive purpose of delaying the meeting without a justified reason, or that do not have specific support or reasons for individualized review of the articles to be amended, shall be dismissed.

c. To transfer or assign their shares, as contemplated by law, the Bylaws, and shareholders’ agreements, if any; as well as know the methods of registering the shares and the identity of the main shareholders of the Company, as established by the applicable law.

d. To have access to the Company's public information in a clear, timely, and comprehensive manner, allowing them to make decisions about their investment in the Company. Shareholders will have the right to receive annually, from the Chairman and the Board of Directors, the report on their management and the economic and financial situation of the Company.

e. To make recommendations on good governance, in the case of the Parent Company, through the Investor Relations Office.

f. To associate to exercise their rights.

g. To request, in conjunction with other shareholders, the convening of a shareholders' meeting, in accordance with the provisions of this Code, the Bylaws, or the law.

h. Right of Withdrawal. In the case of Bancolombia and financial companies domiciled in Colombia, shareholders may exercise the right of withdrawal in accordance with the provisions

applicable to each Company. This right may be exercised when, in the event of a merger, the exchange ratio resulting from the technical study is modified by a decision of a majority exceeding eighty-five percent (85%) of the subscribed shares of each of the interested entities.

In this case, shareholders who do not agree with the new ratio will have the right to withdraw. If a shareholder of the Company chooses to exercise this right, the Company will pay for the shares in cash within the month following the date of the meeting that decided the merger. Such acquisitions will be charged to the Company's equity, either as a reduction of capital or as the acquisition of own shares, under the terms and conditions specified by the supervisor. The price of such shares will be equal to the price per share that served as the basis for the exchange ratio proposed in the technical study.

Likewise, shareholders may exercise the right of withdrawal in the events of spin-offs where this is applicable according to the relevant regulations. In any case, the right of withdrawal will be subject to the provisions of the current regulations.

In the case of the Parent Company and other non-financial Companies domiciled in Colombia, shareholders may exercise the right of withdrawal in the events of mergers and spin-offs, in accordance with the applicable regulations.

i. Special Audits for the Parent Company: A Shareholder or a group of shareholders having a participation equal to or exceeding five percent (5%) of the capital of the Parent Company, percentage deemed as sufficiently representative and from which financial legislation and Stock Market legislation recognizes certain rights to shareholders, shall be entitled to request, before the Presidency or the Investor Relations Office, an authorization to hire, at the shareholder’s or group of shareholders’ expense and responsibility, special audits based on the following terms:

• Special audits shall deal with matters different that those audited by the External Auditor.

• Special audits shall be conducted within ten (10) business days of the Ordinary General Shareholders’ Meeting held during the first quarter each year, and within the first ten (10) business days of October each year.

• When conducting a special audit, under no circumstances, will the violation of the rights of the Parent Company or its subsidiaries, their information and that of their clients, their projects, the contracts that constitute competitive advantages, and, in general, all those documents or information considered privileged or confidential or belonging to third parties, be permitted, in accordance with the regulations applicable to the Parent Company.

• Special audits cannot be conducted about industrial confidential information or with respect to topics covered by legislation about intellectual property rights or information over which there is a confidentiality commitment.

•Special audits may only cover the examination of information and documentation that is in the possession of the Parent Company, that is no older than two (2) years, and that is directly related to the purpose of the audit.

•Under no circumstances, special audits shall affect normal operation of the Parent Company, nor the autonomy and competencies of the administrators, as contemplated by law and Bylaws.

• A request to conduct special audits shall be made in writing no later than one (1) month prior to the date the special audit will be conducted, indicating clear reasons and facts such a request is based on, specific topics for the audit consistent with the cited reasons and the duration time which should not exceed fifteen (15) calendar days. The request should include specific information to have access to, and no general, unspecific, or ambiguous requests will be admitted.

• Such a request shall be filed with the Presidency or the Investor Relations Office.

• The Board of Directors, through its Good Governance Committee, will analyze the relevance of the audit and authorize or deny its execution, informing the shareholder of this decision within a maximum period of fifteen (15) calendar days from the date the request was received.

• The firms contracted to carry out such audits must have, at a minimum, the qualifications of the external audit firm designated by the general shareholders' meeting of the Parent Company for the corresponding period and must have recognized prestige and professional trajectory. Additionally, the proposed firm must demonstrate criteria of independence from competitors of Grupo Cibest and the absence of conflicts of interest.

•The Parent Company will allocate a space and assign responsible personnel for the attention of special audits.

•The working papers provided to the special auditor or firm conducting the specialized audits, as well as the results of the audits, will be kept confidential and will remain in the possession of the Parent Company. o physical or electronic copies of the consultation documents will be provided. The Parent Company reserves the right to take appropriate measures to ensure the confidentiality of the documents and the disclosure of any confidential information.

•The results obtained must be retained by the Parent Company for no less than five (5) years from the date of their creation.

•The results of the audit may not be disclosed without the prior written consent of the Parent Company.

Whenever the audit originates from a shareholder who, directly or indirectly, is also a shareholder or real beneficiary of a shareholding equal to or greater than 0.5% of the capital with voting rights or an employee of financial institutions competing with the financial institutions of Grupo Cibest, the Board of Directors may reserve the right to withhold sensitive information, proposing measures it deems appropriate to protect it, including the formation of "clean teams" with the special auditor or firm conducting the specialized audits.

The Companies issuing securities in the Colombian market may regulate the application of specialized audits in their Annex to the Code of Good Governance.

j. Equitable treatment of shareholders: The shares of the Companies domiciled in Colombia will be registered and capital shares and may be ordinary, preferred, or shares with preferred dividend and without voting rights.

The Companies will ensure that their shareholders are treated equally, considering that each shareholder will have the same rights according to the class of shares they own and the number of shares they hold.

Consequently, the Companies shall ensure that all shareholders receive the same treatment as other shareholders within their same class and will seek to provide timely and complete responses to concerns, claims, and requests regarding information related to mandatory disclosure matters, corporate governance information, and generally any information that does not have legal, statutory, or contractual confidentiality or secrecy restrictions or that could be detrimental to the Company's interests. This is without prejudice to those events where, due to regulatory considerations or by order of a competent authority, it is necessary to provide specific information to a particular shareholder.

In the Parent Company, shares with preferential dividends will not confer the right to vote in shareholders' meetings to their holders, except in cases established by the Bylaws and legal provisions regulating the matter. In the event that such cases arise, the Parent Company will promptly inform these shareholders so that they can exercise their voting rights or grant the necessary powers to be represented at the meetings. In any case, the Parent Company will ensure that these shareholders with preferential dividends and without voting rights are promptly notified of the shareholders' meetings in which they must be convened and have the opportunity to be represented at the meetings where their vote is required, for which they must designate a spokesperson to represent them.

k. Representation of Shareholders: Any shareholder may be represented at shareholders' meetings through a written proxy. The proxies must identify themselves in accordance with the legal provisions regulating the matter.

In Colombia, managers and employees of the Companies may not exercise proxies to represent shares belonging to others at the meetings of the Company of which they are managers or employees, nor may they substitute the proxies granted to them. They also may not vote, even with their own shares, on decisions aimed at approving the balance sheets and year-end accounts, or liquidation decisions.

Similarly, an employee who is also a shareholder of the respective Company domiciled in Colombia, who decides to represent their shares at a shareholders' meeting or be represented at the meeting by granting a proxy to a third party, must expressly inform, when requesting their credential or in the respective proxy, their condition as a shareholder and employee, so that their vote is not counted in the approval of the financial statements.

Except for provisions of paragraph above, managers or employees of the respective Company shall be entitled to exercise the political rights inherent to their own shares and those they represent when acting as legal representatives or in cases expressly established in the current regulations.

With the purpose of assuring an equitable treatment of shareholders and avoiding potential conflicts of interest, the following prohibitions are directed at executives and employees of the Parent Company and other Companies issuing shares in Colombia, as well as the entity managing the Company's shareholder registry, in case a third party is responsible for such management:

•Encourage, promote or suggest that shareholders grant blank-check powers of attorney, where the name of the representative for the shareholders' meetings is not clearly stated.

•Receive powers of attorney from the shareholders where the name of the respective representative for the shareholders’ meeting is not clearly stated.

• Accept powers of attorney conferred by the shareholders as valid if all legal requirements have not been fulfilled. Powers of-attorney must be granted in writing, indicating the name

of the representative, the person who can replace the representative, if applicable, and the date of the meeting. Legal entities that grant powers-of-attorney must include a recent certificate of good standing that proves their existence and representation in accordance with the law.

•Suggest or determine the names of those who will act as representatives of the shareholders at the meetings.

•Recommend that shareholders vote for a certain list. This does not restrict the Board of Directors or the President, in the exercise of their duties, from presenting proposals for the consideration of the shareholders’ meeting.

• Coordinate or enter into an agreement with any shareholder or with any representative of shareholders to vote in favor or against any proposal that is presented in the shareholders’ meeting.

Actions described above shall be also prohibited when they are executed through proxy, intermediary or third party.

l. Mechanisms to prevent capital dilution: In the case of Companies issuing securities in the Colombian market, when a capital increase is to be carried out with a waiver of the preemptive right in the subscription of shares or processes of merger, spin-off, or segregation, the Company's Board of Directors will make available to the shareholders, during the term of the meeting notice, a report containing the main terms of the transaction to be carried out, which will be accompanied by an opinion from an independent external advisor, contracted by the Company for this purpose. In the case of merger, spin-off, and transformation, the term for presenting the reports will be at least fifteen (15) business days prior to the date of the meeting.

m. Incorporation of new items in the agenda of ordinary shareholders' meetings: Without prejudice to what is established by law, shareholders of the Parent Company and Companies issuing securities in the Colombian market may request the management to include additional items in the agenda of ordinary shareholders' meetings, for which they must comply with the procedure established in this Code.

Requests for the inclusion of new items in the agenda of ordinary meetings must be received in writing addressed to the Chairman of the Company or the Secretary General, at the main address of the Company, or through the Investor Relations Office, within five (5) calendar days following the meeting notice. The request must be accompanied by the corresponding justification motivating the inclusion of the respective item.

The Company shall respond to requests received in due form, indicating in writing whether the request has been accepted or not, and in case of denial, the reasons for the refusal.

When the request to include new items in the agenda comes from a shareholder or group of shareholders representing five percent (5%) or more of the Company's share capital, and the request is intended to be denied, the reasons for the denial must be previously known by the Board of Directors through its Good Governance Committee.

If the inclusion of new items in the agenda is accepted, the management of the Company, with prior approval from the Board of Directors, will publish the new agenda of the meeting on its website at least fifteen (15) calendar days before the meeting date. The publication may be carried out with

less advance notice prior to the date of the meeting, considering the terms required by the management and/or the Board of Directors to apply the procedure provided herein.

n. Presentation of Proposals: The Parent Company and the issuing Companies in the securities market in Colombia will present to the shareholders, through their website and prior to the meeting, the proposals from the Board of Directors, the management, or the shareholders, as long as they are received.

In accordance with the above and in order to guarantee the right of all local and international shareholders to be informed about the various proposals that will be presented at the meeting and to prepare the direction of their vote, shareholders interested in presenting proposals must, in compliance with the principles of corporate governance, submit such proposals in writing, through the President’s Office or the Secretary General’s Office or the Investor Relations Office, at least three (3) business days prior to the date of the meeting. The foregoing, notwithstanding the applicable legal provisions in Colombia.

2.2. Main Obligations of the Shareholders

Shareholders of the Companies accept, by acquiring their shares, to adhere to and respect the Bylaws and the rights and duties contemplated in the Code of Good Governance. The main obligations are:

a. Provide the information required by law, the Bylaws, and this Code. Keep the Company duly informed about their current address or that of their legal representative or proxy, as the case may be, in order to send the registered address the summons or communications as appropriate and to maintain effective and direct contact with them when necessary.

b. The transfer of shares may be made by simple agreement between the parties, but for it to take effect with respect to the Company and third parties, the transferring shareholder must inform the Company or the person responsible for the shareholder registry of such transfer, indicating the number of shares transferred and the full name and identification of the acquirer, so that the transaction can be recorded in the shareholder registry book or electronic registry enabled for this purpose. This is without prejudice to previously exhausting the procedures established in the Bylaws or applicable regulations to transfer shares to third parties, as well as internal procedures for the prevention and control of money laundering and terrorism financing.

c. In the case of the Parent Company, comply with the regulations established for the exercise of the right of inspection.

d. In the case of the Parent Company and the Issuing Companies in the securities market in Colombia, comply with the procedure established in this Code to request the inclusion of items on the agenda or to present proposals for consideration at the meeting.

e. In case of interventions at the meeting, such interventions must be respectful, brief, timely, and relevant to the matter under discussion, in accordance with the provisions of this Code of Good Governance. This obligation also applies to shareholder representatives.

f. Accurately, timely, and completely inform the Companies of the data they require to report and update the information of their beneficial owners in the Unique Registry of Beneficial Owners, in accordance with the applicable regulations.

2.3. Relationships of Shareholders with the Company

Shareholders must act with loyalty and good faith towards the Company of which they are shareholders, refraining from participating in acts or behaviors where there is a conflict of interest or that may give rise to crimes related to money laundering or terrorism financing. They must also refrain from participating in acts or behaviors aimed at concealing assets from criminal activities and, in general, from acts or behaviors that harm the interests of the Company or involve the disclosure of confidential information or threaten the sustainability of the Company.

The Company's commercial relationships with its main shareholders will be carried out within the limitations and conditions established by the relevant regulations and, in any case, under market conditions.

Section nine (9) establishes the principles and measures in the management of the Parent Company's business with related parties.

2.4. Policies for the Exercise of Political Rights by Colombian Pension Fund Management Companies (AFPs)

The Parent Company, considering the existing legal regulations in Colombia applicable to Colombian Pension Fund Management Companies (AFPs), which invest in the Company's shares with third-party resources under their management, has established the following policies aimed at the legitimate exercise of political rights by these entities:

a. Without prejudice to the right of inspection that AFPs have as shareholders, and in order to provide timely, clear, and transparent information that allows them to exercise their voting rights in an informed manner, the Parent Company will address the requests, petitions, and information requirements prior to the meeting made by the designated representatives of the AFPs. For this purpose, AFPs will be asked to designate a representative through whom the relevant information on the agenda items of the meeting will be channeled.

b. The Parent Company may request a certification establishing that the designated person has no conflicts of interest with the Company to access the information to be provided.

c. In order to guarantee equitable treatment and access to information under equal conditions for all shareholders, the Parent Company will make available to other shareholders the responses provided to the AFPs. In any case, the Parent Company will not provide information related to clients or users, information related to special projects or strategic business information, personal data of its managers, contracts that constitute competitive advantages, and, in general, all those documents considered confidential, reserved, or belonging to third parties in accordance with applicable regulations and the internal policies established by the Company.

d. When a proposal for the election of the auditing firm is to be presented on the agenda of the meeting, the Parent Company, in addition to complying with the policies established for its appointment in this Code of Good Governance and legal provisions, will inform through its website the proposal approved by the Audit Committee, as well as the criteria considered for such proposal.

e. When a proposal for the election of the Board of Directors is to be presented on the agenda of the meeting, the Parent Company will inform about the proposals previously submitted by shareholders

and considered by the Good Governance Committee, which meet the requirements established by law, the Bylaws, and this Code, providing on its website a brief summary of the resume of each candidate and the result of the evaluation.

f. In case of re-election of Board members, information will be provided about the attendance of these members at both Board sessions and the supporting Committees.

g. Similarly, the Parent Company will attend to and provide, to the extent of its capabilities, the certifications required by the AFPs, confirming whether a particular candidate is independent of the respective AFP.

h. Regarding Bylaws amendments, the Parent Company will publish on its website the most relevant aspects intended to be modified and the reasons for presenting such a proposal.

2.5. Operating Regulations of the General Shareholders' Meeting for Colombian Companies

The highest governing body of the Company is the general shareholders' meeting, and its conduct will follow the guidelines indicated below. In the case of the Parent Company, the meeting will also be governed by the provisions contained in Chapter VIII of the Bylaws.

a. Notice of of Shareholders’ or Partners’ Meetings: Without prejudice to the mechanisms established in the Bylaws to convene meetings of shareholders or partners, Companies that are going to hold the meeting and have a significant number of shareholders located in different parts of the territory will use electronic mechanisms to disseminate and announce the notice and the agenda of such meetings. In the case of the Parent Company and the Issuing Companies in the securities market in Colombia, the notice will also be published through the Company's website.

b. Right of Inspection: At least fifteen (15) business days prior to the scheduled date of the annual general shareholders’ meeting of Companies domiciled in Colombia, the financial statements, the management report, and other relevant documents and information necessary for decision-making shall be made available to shareholders at the principal place of business. In the case of Companies for which a different term applies by law or under their Bylaws, and for Companies domiciled outside Colombia, the right of inspection or information shall be granted to shareholders in accordance with the applicable legal or bylaw-prescribed term.

In the case of the Parent Company, and in order to safeguard and protect the Company’s information, a procedure shall be in place to ensure clarity, transparency, and effectiveness in the exercise of the right of inspection. This procedure shall be available on the Company’s website and shall be mandatory for any party intending to inspect the Company’s books and documents.

The Companies shall promote access to information for all shareholders. The Parent Company and the Companies listed on the Colombian securities market shall make available on their website all information relevant for decision-making at the shareholders’ meeting, including the financial statements, the proposed profit distribution, and the management report. Any proposals shall be published through the same channel as soon as they are submitted to management.

c. Chair and installation of the meeting: The general shareholders’ meeting of the Parent Company shall be chaired by the Company’s President; in the absence of the President, by the members of the Board of Directors in their order of precedence; and if none of the above are present, by the person elected by the shareholders’ meeting from among those in attendance, by

majority vote of the shares represented therein. The Secretary of the meeting shall be the Secretary of the Company or, in their absence, the person appointed by the Chair. The meeting shall be opened by the Chair, followed by verification of quorum, reading and approval of the agenda, and the appointment of the committee for scrutiny, approval, and signing of the minutes.

d. Agenda: The agenda proposed for consideration by the shareholders at the beginning of ordinary or extraordinary shareholders’ meetings shall itemize the matters to be discussed, ensuring that each item is clearly distinguishable from the others and follows a logical sequence, except for those items that must be addressed jointly due to their interrelation.

The Companies shall refrain from including items such as “proposals and miscellaneous,” “miscellaneous,” or “other matters” in the meeting agendas, and have defined, in accordance with the provisions of this section, relevant procedures so that shareholders interested in presenting proposals can do so in advance.

In addition to those aspects for which this requirement operates by legal provision, in Companies in Colombia, the following matters or decisions can only be analyzed and developed by the shareholders meeting if they were expressly included in the notice to the respective meeting: change of corporate purpose; waiver of preemptive rights; change of corporate domicile; early dissolution; and segregation (improper spin-off). In the case of the Parent Company, in addition to the aforementioned matters, the election of Board members can only be analyzed and developed by the meeting if it is expressly included in the notice, in accordance with the provisions of the Bylaws.

e. Information: Shareholders may ask questions or request additional information or clarifications regarding the different agenda items through the Investor Relations Office or the Secretary General’s Office during the period for exercising the right of inspection. The Company will make the provided responses available to shareholders. In any case, Companies will not provide information protected by the commercial and industrial confidentiality of the company, information that is not part of the right of inspection, or information classified as "Confidential Information" in accordance with applicable regulations and the policies established by Grupo Cibest.

f. Types of meetings: The general shareholders' meeting of Companies in Colombia will hold its ordinary meeting each year no later than March 31, to examine the Company's situation, appoint directors and other officials according to the established terms for each position, consider reports, accounts, and balances of the last fiscal year, decide on the distribution of profits, and agree on all measures deemed appropriate to ensure the fulfillment of the corporate purpose.

In the case of the Parent Company, the President and the Secretary will lead the presentation of the agenda items, without prejudice to the participation of other executives, as determined by the President. As indicated in section 3.3 of this Code, the President of the Audit Committee of the Parent Company, or in their absence, one of its members, will present information on the activities carried out by that body.

There will be an extraordinary meeting when required for the Company’s emergencies or unforeseen needs, through notice made by the Board of Directors, the President or the External Auditor, or when applicable regulation do not provide otherwise with respect to the legitimacy to convene an assembly, by request made by a number of shareholders representing not less than ten percent (10%) of subscribed shares. The meeting shall not discuss topics different from the ones contemplated in the meeting agenda described in the notice, except for decision made by the number of shareholders demanded by law and upon completion of the agenda.

If the meeting is requested by a plurality of shareholders, those shareholders must submit a written communication addressed to the Board of Directors, the President of the Company, or the External Auditor, as applicable, with a copy to the Company’s Secretary, stating: (a) the names of the shareholders requesting the meeting; (b) the number and class of shares owned by each of the requesting shareholders; (c) the proposed agenda to be included in the meeting notice; and (d) the rationale for the proposals to be submitted to the shareholders’ meeting. In the case of the Parent Company and companies listed on the Colombian securities market, such rationale shall be made available to shareholders on the company’s website during the notice period for the meeting. The shareholders who submitted the request for the meeting may withdraw it at any time prior to the publication of the meeting notice. Once the request has been submitted and the notice of the extraordinary meeting has been published, the requesting shareholders may no longer modify the proposed agenda.

g. Suspension of the shareholders’ meeting: When extraordinary circumstances arise that hinder the normal conduct of the meeting, the shareholders may request a suspension for the time necessary to restore the conditions required to continue the meeting or may request that the meeting be postponed as many times as decided by a plurality of attendees representing at least fifty-one percent (51%) of the shares represented at the meeting.

In all cases, deliberations cannot take longer than three days, except for those cases where all subscribed shares are represented.

h. Shareholder interventions during the shareholders’ meeting: During the course of the agenda, shareholders may speak on matters related to the specific item under discussion. Each shareholder who wishes to intervene shall identify themselves by stating their name and identification number. If acting through a proxy, the name of the shareholder being represented must also be provided. Each intervention may not exceed five (5) minutes.

i. Quorum for deliberation and decision-making: The quorum for deliberation at shareholders’ meetings shall consist of a number of shareholders with voting rights representing more than half of the subscribed and paid-in shares, unless special quorum requirements are established by applicable regulations for specific meetings.

As a general rule, resolutions at the shareholders’ meeting shall be adopted by a simple majority of the votes corresponding to the voting shares represented at the meeting, bearing in mind that each share entitles its holder to one vote, subject to the exceptions established by law and the Bylaws.

Decisions adopted by the Shareholders’ Meeting shall be binding upon all shareholders, without prejudice of legal provisions in force with respect to absent or dissident shareholders.

j. Minutes: A record of the proceedings of the meeting shall be entered in a minute book. The minutes shall be signed by the Chair of the meeting and the Secretary, and shall be approved by a committee of two persons elected by the shareholders during the same meeting.

k. Discrepancies of opinion among shareholders: Discrepancies in shareholders’ criteria in relation to the general operation of the Company, its operations, projects, and businesses, shall be discussed and resolved according to legal provisions and the Bylaws.

l. Attendance of Directors at the shareholders' meeting: The Directors of the Parent Company and of the issuers listed on the Colombian securities market, particularly those serving as chairs of

Board support committees, shall attend the ordinary shareholders’ meetings. The Board table at the meeting shall include, together with the Chair and the Secretary of the meeting, the members of the Board of Directors who are present. This requirement shall not apply in the case of extraordinary or non-presential meetings, where the participation of the Chair and the Secretary shall suffice.

m. Elections and voting: In connection with the elections and voting processes to be carried out by the Parent Company’s shareholders’ meeting, the rules set forth in the Company’s Bylaws and those contained in the Good Governance Code shall apply.

SECTION 3: PRINCIPLES AND MEASURES RELATED TO MANAGERS AND MAIN EXECUTIVES AND OPERATING REGULATIONS OF THE BOARD OF DIRECTORS

The managers and senior executives of the Companies shall act in good faith, with loyalty, and with the diligence of a prudent and diligent businessperson. Their actions shall be aimed at serving the interests of the Company, taking into account the interests of its shareholders and complying with the duties established in the Bylaws, the Good Governance Code, and the law.

In the performance of their duties, and in the fulfillment of their functions, managers and Senior Executives shall:

a. Make the best efforts to ensure the proper development of the Company’s corporate purpose.

b. Ensure strict compliance with legal provisions and the Bylaws.

c. Ensure that the functions entrusted to the Company’s various oversight bodies—particularly the Statutory Auditor or External Auditor and Internal Audit—are properly carried out.

d. Safeguard and protect the Company’s banking, securities, commercial, and industrial confidentiality, as well as that of its dealings with consumers and suppliers, and the information defined as “Confidential Information” under applicable regulations, the Good Governance Code, and Grupo Cibest’s policies.

e. Refrain from the improper use of privileged information.

f. Treat all shareholders equitably and respect the exercise of the right of inspection.

g. Refrain from participating directly or through an intermediary, for personal interest or the interest of third parties, in activities that compete with the Company or in transactions where a conflict of interest exists.

h. Oversee compliance with and ensure the implementation of the Group’s good governance and ethics provisions and adopt the necessary mechanisms to strengthen them.

i. Ensure that the principles of sound, free, and fair competition are a fundamental element in all operations and business relationships of the Companies.

j. Ensure that, within each Company, a culture of diversity and inclusion is promoted—one that recognizes individual differences, fosters respect, and builds upon different personal styles, cultures,

experiences, beliefs, abilities, and preferences. Likewise, ensure that the Companies provide workplaces that are dignified, respectful, safe, and healthy.

In this Good Governance Code, the following terms have the meanings assigned to them below:

a. “Affiliate” means, with respect to a person, any person who controls, is controlled by, or is under common control with, such person. For the purposes of this definition, "control" means the ability to direct or govern, directly or indirectly, individually or in conjunction with another or others, the will of another person, and any derivative term of the noun "control" shall have the corresponding related meaning. Control is presumed in the situations provided for in Article 261 of the Commercial Code. With respect to any natural person, the term "Affiliate" refers to (a) any person controlled, directly or indirectly, individually or in conjunction with others, by such natural person, (b) their relatives up to the third degree of consanguinity, second degree of affinity, and first degree civil, (c) the spouse, permanent partner, or person who resides in the same household as the natural person in question or with the persons referred to in subsection (b), and (d) any person controlled, directly or indirectly, individually or in conjunction with others, by any of the persons referred to in subsections (a), (b), and (c) above. For the purposes of this definition, it is presumed that if a natural person and any of the persons referred to in subsections (a) to (d) above participate in the capital, have voting rights, or otherwise participate in the same entity, there is an event of joint control.

b. "Executive Officers" means, with respect to a company or other legal entity, its managers and members of the senior management team.

c. "Person" means any natural or legal person, including any corporation, limited liability company, interest shares (or equivalent structures according to the applicable legislation for the formation or operation of the respective Person), or any other form of participation in the equity capital, as well as any entity assimilated to a person, or that can be the recipient of rights or obligations, in all the aforementioned cases according to the applicable law for its formation or operation, including, without limitation, any corporation, cooperative, union, trust, autonomous patrimony, trust, investment fund, and any other analogous or equivalent entity.

d. "Competition Situation" means the situation that arises when a person is a Relevant Partner or an Executive Officers of one or more companies engaged in the same economic activities or participating in the same value chains of any of the companies that are part of Grupo Cibest.

e. "Relevant Partner" means, with respect to any legal or similar person (including any entity that may be the recipient of rights or obligations, such as, without limitation, companies, cooperatives, unions, autonomous estates, trusts, investment funds and analogous or equivalent figures), the partner, associate, member, real beneficiary (as said term is defined in Decree 2555 of 2010) or equivalent figure of said legal or similar person that has, directly or indirectly, more than 10% of the voting interest in such Person.

3.1. Board of Directors Operating Regulations

The activity of the Boards of Directors, in their role as the highest governing and administrative body of the Companies, will primarily be aimed at defining their general policies and strategic objectives, as well as monitoring all actions taken to achieve them, with a permanent focus on the rights of the shareholders and the sustainability and growth of the Company. The specific functions of the Board of Directors are established in the bylaws of each Company, in the law, and in this Code.

The Board of Directors shall also promote the best treatment and assistance to shareholders, customers, consumers, employees, suppliers, and all its stakeholders in general. Powers of the Board of Directors shall be enough for ordering the execution of any action or contract as contemplated in the Company’s trade purpose and for making necessary decisions so the Company can comply with its purposes as contemplated by law and Bylaws.

a. Election, Composition, and Remuneration of the Board of Directors: The Boards of Directors of the Companies shall be elected by the respective General Shareholders’ Meeting and shall be composed of the number of members established in the Bylaws.

In the case of the Parent Company, the members of the Board of Directors ("Directors") will have terms of two (2) years.

In the case of Bancolombia and financial companies domiciled in Colombia, Directors will remain in their positions until their successors are elected and take office before the Financial Superintendence, unless they have been removed, disqualified, or resigned from their position beforehand, situations that will be reported to the Financial Superintendence or the commercial registry as applicable.

Directors may be re-elected and freely removed by the General Shareholders’ Meeting even before the end of their term.

For the election of Directors of the Parent Company:

•Shareholders will be informed, prior to the meeting, of the profiles and resumes of the candidates, and the results of the prior evaluation by the Good Governance Committee.

•All shareholders will be guaranteed the possibility of presenting slates with candidates to join the Board of Directors, as long as they meet the requirements demanded by applicable regulations, the Bylaws, and this Good Governance Code. The evaluation of suitability, compliance with the selection criteria defined in this Code, and the analysis of disqualifications and incompatibilities regarding the candidates to be part of the Boards of Directors must be carried out prior to the shareholders' meeting. This process will be led by the Good Governance Committee.

•In order to guarantee the right of all shareholders to examine the proposals of candidates to join the Board of Directors in advance of the meeting, which are received by the administration and comply with the prior evaluation of the Good Governance Committee, shareholders interested in presenting slates for the election of Board members, in compliance with corporate governance principles, must submit: (i) the candidates to join the Board of Directors within five (5) business days following the notice to the general shareholders' meeting. The proposal must include a communication signed by the candidates indicating that they are not subject to disqualifications or incompatibilities. Additionally, the proposal must include a communication signed by the independent candidates indicating that they meet the independence criteria; and (ii) the slates integrated with candidates previously submitted according to the previous numeral, at least five (5) business days prior to the date of the meeting. The Good Governance Committee will evaluate: (i) compliance with the independence criteria, regarding independent candidates,

and (ii) disqualifications and incompatibilities, regarding all candidates, publishing the results of its evaluation at least six (6) business days before the date of the meeting.

•Proposals or slates for the composition of the Board of Directors that do not meet the requirements or follow the established procedure will not be submitted to a vote.

•The electoral quotient system will be applied.

For the election of Directors of the other Companies of Grupo Cibest, the President of the Parent Company, with the support of the Corporate Vice Presidents, will define and nominate the candidates for the Boards of Directors, for which prior approval of the Parent Company's Board of Directors will not be required.

All Companies, for the election of their Directors, will apply the provisions contained in the Bylaws and in the manuals or policies of the Anti-Money Laundering and Terrorism Financing Risk Management System, as applicable.

In order to set the Directors’ remuneration, the Shareholders’ Meeting shall bear in mind number and quality of its members, their responsibilities, and time required in such a way that such remuneration can be consistent with the contribution expected by the Company from its Directors. Shareholders may approve at the meeting a different remuneration for the Chairman of the Board of Directors compared to the other members of the Board, considering the skills and responsibilities involved, as well as the greater time dedication that such a position entails.

b. Selection Criteria for Directors: Shareholders of the Parent Company may examine, prior to the general shareholders’ meeting, the proposals of candidates to join the Board of Directors that are received by the management and have complied with the procedures for submitting proposals and prior evaluation by the Good Governance Committee established in this Code.

The general shareholders’ meeting of the Parent Company will take into account, for the election of Directors, the selection criteria, suitability, and incompatibilities and disqualifications established by law, the Bylaws, the Regulation for the Election of Board Members approved by the general shareholders’ meeting, and this Good Governance Code, which will be made known to shareholders so that they have the appropriate judgment elements for the appointment of Directors.

Among the main selection criteria, the general shareholders’ meeting should consider the following:

• General principles. The selection criteria will be applicable to all candidates to join the Board of Directors of the Companies, as appropriate. Whenever possible, each Director should contribute some professional specialty in line with the Company's business.

•Academic and professional background. In the evaluation process of the candidates, it will be verified that each candidate possesses personal and professional qualities, academic preparation, and/or work experience that accredits them as a suitable and competent person to direct and guide the company.

As the parent company, the Parent Company will seek Board members who can make valuable contributions to the guidance of relevant and strategic decisions of the Cibest Business Group, as well as to the businesses and products of the Parent Company and its subsidiaries, and who also understand the responsibilities that the Group’s financial entities have toward their users, clients, shareholders, and other stakeholders.

•Basic Competencies. All Directors must have basic skills that allow them to adequately perform their functions. These include analytical and managerial skills, a strategic vision of

the business, objectivity,and the ability to present their point of view, and the ability to evaluate senior management teams, as well as the analysis of the main components of the different control and risk systems, and financial results and indicators. Additionally, they must have the ability to understand and question financial information and business proposals and to work in an international environment.

•Specific Competencies. In addition to basic competencies, each member of the Board of Directors must have other specific competencies that allow them to contribute in one or more dimensions, due to their special experience, industry knowledge, financial or risk aspects, legal matters, or commercial or economic topics.

The Company will provide the best means to ensure that each Director's knowledge regarding its business and the general environment is the most appropriate. When a Director is appointed for the first time, sufficient information will be made available to them so that they can have specific knowledge about the Company and the sector in which it operates, as well as information related to the responsibilities, obligations, and powers derived from the position. The Company's General Secretariat will coordinate the induction and training process for Directors, in accordance with the Induction and Training Policy.

•Availability. The candidate to be a Director of any of the Companies must have the time availability to assume the responsibilities in service of the Company.

Availability includes, in the case of the Parent Company and the Issuing Companies in the securities market in Colombia, attendance that should not be, except in cases of justified force majeure, less than 80% of the total annual meetings of the Board of Directors and Committees. Additionally, the Director must have time for evaluating the material and information prior to the meetings, monitoring information about the financial sector, training and updating programs, meetings with supervisors, and generally for making studies or recommendations to the company.

•Not Subject to Disqualifications or Incompatibilities. In compliance with applicable regulations in Colombia and the best international standards for financial entities and securities issuers, without prejudice to the disqualifications and incompatibilities established in current regulations and the Company's Bylaws, a person who falls under any of the following circumstances cannot be a member of the Board of Directors:

1.Belongs, as a member, to the board of directors of other four (4) Colombian public limited companies (sociedades anónimas), in addition to the respective Company.

2.In the case of the Parent Company: (a) belong to or have belonged within the previous two (2) years to boards of directors of other credit institutions different from those of the Grupo Cibest, in jurisdictions where the Grupo Cibest has a presence, (b) be or have been president, legal representative, administrator, or employee of other financial groups, or entities whose purpose or that of their affiliates is the provision of financial services provided by the companies that are part of the Grupo Cibest during the two (2) years prior to their appointment as Director. In (a) and (b) except for companies of the Grupo Cibest or the Financial Conglomerate to which the Grupo Cibest belongs.

Transitional Paragraph: The causes (a) and (b) provided in this numeral II will not apply to Directors who are elected in the year 2025.

1.Have provided services or received any remuneration, directly or indirectly, for an annual amount exceeding the equivalent of USD $250,000, from financial groups or conglomerates different from the one to which the Grupo Cibest belongs, during the two (2) years prior to their appointment.

2.That the candidate for Board Member, directly or together with their Affiliates, has direct or indirect shareholding or is the real beneficiary of a shareholding equal to or greater than 0.5% of the voting capital of financial entities different from Bancolombia or securities market intermediaries in Colombia or in the countries where Grupo Cibest operates.

3.Be a counterparty, directly or through their Affiliates or entities in which the candidate or their Affiliates hold an executive position, in judicial, administrative, or arbitration processes, or in judicial or extrajudicial conciliation proceedings, in which the counterparty is any of the companies of the Grupo Cibest or any of the entities of the Conglomerate to which Grupo Cibest belongs.

4.Being an Affiliate, of a member of the Board of Directors of the Parent Company or of credit institutions or their equivalent of Grupo Cibest, who performs functions as a director on the date when the election of the respective candidate or another candidate for member of the Board of Directors of the Parent Company is submitted for consideration by the general shareholders' meeting in the same election.

5.Being in a Competition Situation directly or through their Affiliates, with the financial entities of Grupo Cibest.

6.Being involved in a situation of material and permanent conflict of interest, as determined by the Board of Directors.

7.Having been convicted or found responsible, in Colombia or another jurisdiction, in judicial or administrative processes, within the ten (10) years prior to the date of the general shareholders' meeting in which the Board of Directors would be elected for: (a) the violation of the regulations governing the securities market, (b) the violation of the regulations governing the activities of financial institutions, as well as having been disqualified, totally or partially, by public or private entities, from engaging in commercial activities in any jurisdiction.

8.Having been an Executive Officer of Persons who incurred, within the ten (10) years prior to the date of the general shareholders' meeting in which the Board of Directors would be elected, in the disqualifications contemplated in the previous numeral, provided that the candidate was an Executive Officer of the respective Person at the time the events constituting the infraction occurred.

9.Having been convicted in a criminal proceeding within the ten (10) years prior to the date of the general shareholders' meeting in which the Board of Directors would be elected.

10.The Boards of Directors shall not be composed of a number of members employed by the respective Company who can, by themselves, form the necessary majority to adopt any decision.

In any case, it is the duty of the Directors to inform the Company of any possible disqualification or incompatibility they may have to exercise their position as Director.

The above causes of disqualifications and incompatibilities will apply to the Directors of the Parent Company. The other Companies will take these disqualifications and incompatibilities as a reference point, being able to exempt the adoption of those that are not applicable given their size, jurisdiction, or restrictions inherent to their business. Likewise, they may include those that

correspond according to the applicable regulation. The causes approved by the Companies will be submitted for consideration by the General Secretariat of the Parent Company.

•Aptitude before the Financial Superintendency. For financial Companies domiciled in Colombia, candidates for Directors must be fit to take office before the Financial Superintendence of Colombia, which conducts a thorough analysis of their resumes, academic and professional trajectory, disciplinary and credit history, among other aspects.

•Independence. Independent Directors must verify the requirements demanded by the regulation of each country, those established in the Bylaws of the respective Company, and in the case of the Parent Company, the additional criteria established in this Code. Independent Directors are required to certify compliance with these requirements to the Company through a certification signed for this purpose.

For the Board of Directors of the Parent Company, at least two (2) of the seven (7) members of the board must be independent directors.

Independent candidates must certify to the Parent Company and to the pension funds that they meet the independence criteria to validate such status. This certification will also include the candidate's certification of independence from the senior management of the Parent Company.

Similarly, the Board of Directors of the Parent Company, through the Good Governance Committee, will carry out a procedure to certify that as a body it has evaluated the compliance with the required independence criteria and that the candidate is independent from the Board of Directors as a body.

In addition to the independence criteria established in Law 964 of 2005 for securities issuers in Colombia, the election of an independent member of the Board of Directors of the Parent Company will adhere to standards established by the New York Stock Exchange for issuers based in the United States, the independence criteria established in the Bylaws of the Parent Company, and the provisions below:

Persons will not be considered independent if (a) they themselves; or (b) their Affiliates are:

1.Employees or Executive Officers of the companies of Grupo Cibest, including those persons who have had the status of employee or Executive Officer during the two (2) years immediately preceding the appointment, unless it is the re-election of an independent person.

2.Any of the following persons: (a) any of the Relevant Partners of the Parent Company; (b) any Person who determines the majority composition of the management or direction bodies of the Parent Company.

3.Shareholders, or employees or advisors of shareholders, who directly or by agreement direct, guide, or control more than 10% of the voting rights of the entity or who determine the majority composition of the management, direction, or control bodies of the same.

4.Partner or employee of associations or companies that receive payments from Grupo Cibest for services or other concepts, for (a) an amount exceeding the equivalent of USD $250,000 or corresponding to 2% or more of the total income of the association or company receiving the payment in the last 3 years (whichever is higher), or (b) an amount representing twenty

percent (20%) or more of the operational income of the last year for the respective association or company.

5.Partner or employee of legal entities or similar entities (such as trusts) that have made payments to the Parent Company or its affiliates, subsidiaries, or controlling entities, for an amount exceeding the equivalent of USD $1 Million or corresponding to 2% of the total income of the respective company or association (whichever is higher) in the last 3 years, except for payments for interest or financial services provided by the Parent Company or its affiliates or subsidiaries, in the ordinary course of their business.

6.Employees or executives of legal entities or similar entities (such as trusts) that receive significant donations from Bancolombia or the Parent Company or from Persons with direct or indirect shareholding equal to or greater than 0.5% of the capital with voting rights of the Parent Company. Significant donations are considered those that represent more than twenty percent (20%) of the total donations received by the respective institution.

7.Administrators of an entity in whose board of directors a legal representative of the Parent Company participates.

8.Persons who receive from Grupo Cibest any remuneration other than fees as a member of the board of directors, the audit committee, or any other committee created by the board of directors, or who have received remuneration in an amount exceeding the equivalent of USD $120,000 during 12 months, in the last 3 years, other than payments for membership on the Board of Directors or Board Committees.

9.Persons who are partners or employees of the external auditors or were in the last three (3) years.

10.Executive Officers of another Person in which any of the current Executive Officers of the Parent Company is a member of the compensation committee.

The above independence criteria will apply to the independent Directors of the Parent Company. The other Companies will take these criteria as a reference point, being able to exempt the adoption of those that are not applicable given their size, jurisdiction, or restrictions inherent to their business. Likewise, they may include those that correspond according to the applicable regulation. The criteria approved by the Companies will be submitted for consideration by the General Secretariat of the Parent Company.

•Diversity. Grupo Cibest promotes diversity in the composition of its Boards of Directors, including gender, nationality, and ethnicity diversity, among others. Thus, shareholder proposals for candidates to integrate the Boards of Directors will consider the value that diversity brings to the superior performance expected from the governing body.

The Good Governance Committee of the Parent Company, considering its differentiated strategic vision and business approach, will consider the participation of women as a particularly relevant attribute in the evaluation of candidate profiles.

The Board of Directors of the Parent Company, through the Good Governance Committee, will carry out a prior internal procedure to evaluate incompatibilities and disqualifications and the suitability of the candidate to the profiles as appropriate, disclosing the results of that procedure.

Whenever the Board of Directors of the Parent Company identifies other profiles or characteristics necessary for the composition of the management body, in addition to those established in this Code, it will inform through the Company's website.

c. Principles of Conduct for Directors. In order to maintain the highest objectivity, independence, and knowledge in decision-making, Directors must individually and as a collective body, adhere to the following principles:

• Directors, once elected, will represent all shareholders and therefore will not act in the interest of particular shareholders or groups of shareholders.

• They will perform their duties in good faith, independently, with due diligence, loyalty, and care, always ensuring that their decisions are in the best interest of the Company.

• Directors of the Companies of Grupo Cibest Business Group will also consider the aligned interests of Grupo Cibest in general and its various stakeholder groups as an element in their decision-making process.

• They shall promote and enforce applicable laws, the Bylaws, the Good Governance Code, the Code of Ethics and Conduct, anti-corruption norms, and other rules and regulations adopted by the Company.

• They shall exercise their position objectively.

• They shall define the Company's plans, strategies, and objectives.

• They shall be knowledgeable about the financial and operational condition and the important segments of the Company's business.

• They will actively participate in Board meetings and the Committees to which they belong, knowing and reviewing in advance the study and analysis material for the meetings, which the Company's management will provide completely and timely.

• They will avoid conflicts of interest with the Company, informing the other members of the Board of Directors about their existence. Likewise, they will inform the Board of Directors when they are aware of a possible conflict of interest of another Director. The Director in a conflict situation must abstain from voting on the matter subject to the conflict, unless the Board of Directors, with the unanimous vote of the other attending members, has considered that the respective Director is not in a conflict situation. Section eight (8) of this Good Governance Code develops the principles and measures related to conflicts of interest.

• They shall refrain from participating, either personally or through an intermediary, in activities that involve competition with the Company for personal or third-party interest.

• They shall refrain from using privileged or confidential information of Grupo Cibest and its various stakeholder groups, to which they have access due to their position. Every person appointed as a member of the Board of Directors adheres to the Information Management Regulations contemplated in this Good Governance Code. Members of the Board of Directors of the Parent Company are obliged to sign the Agreement for Access and Use of Information. Members of the Boards of Directors of the other Companies must sign an agreement for access and use of information, with the particularities that apply to them, taking as a reference the Agreement for Access and Use of Information of the Parent Company.

For the purposes of protecting the information of Grupo Cibest, Directors individually considered may not access information of the respective company that is not requested by the Board of Directors in accordance with the provisions of section 3.7 of this Good Governance Code.

Directors will be obliged to sign additional confidentiality agreements to protect the information. The failure to sign confidentiality agreements does not relieve the administrator from the strict compliance with the confidentiality and information protection duties and obligations established by law and the Bylaws.

d. Main Responsibilities of the Board of Directors. In addition to what is established by law and the Bylaws, the main duties and powers of the Board of Directors are:

• In terms of Good Governance. The Board of Directors will be responsible for ensuring its own performance, for the fulfillment of the functions and competencies it is in charge of, strictly monitoring the principles, policies, and measures of good governance contained in this Good Governance Code, ensuring their adoption, compliance, and implementation, and seeking the progressive development of better standards in the matter that are compatible with the culture and philosophy of the Group, in accordance with the development of the topic at the national and international level. The Board of Directors will be responsible for approving the applicable policies for related party transactions. Section nine (9) of this Good Governance Code includes the policies that have been established for this purpose.

• Ethics and Transparency. The Board of Directors of each Company will promote ethical, integral, and transparent behavior in accordance with the principles and guidelines established in the Group's Code of Ethics and Conduct.

The Board of Directors of the Parent Company will establish the existence and composition of a Corporate Ethics Committee and regulate its operation. This Committee will be responsible for overseeing compliance with the provisions contained in the Code of Ethics and Conduct, as well as determining the necessary actions for the awareness, dissemination, and strengthening of the highest standards of ethical conduct within the Group and communicating corporate positions regarding conflicts within its competence.

Notwithstanding the above, each of the Boards of Directors of the Companies must strictly monitor the principles, policies, and guidelines established in the Code of Ethics and Conduct and will determine the cases in which it considers necessary the creation of ethics committees within its Company, in which case these committees will act in a coordinated and complementary manner with the Corporate Ethics Committee.

• Senior Management. "Senior Management" of the Parent Company refers to the President and the Vice Presidents who report directly to the President. The Board of Directors is responsible for the selection, evaluation, remuneration, and replacement of Senior Management, for the assignment of their main responsibilities, and for the supervision of the succession plan, for which it may rely on the Nomination, Compensation, and Development Committee. Each Company will define whether the concept of Senior Management applies to it and who are part of it.

• Business. Regarding business operations, the Board of Directors has the authority to approve and review major projects, risk policy and management, strategic planning and the evolution of its execution, and the financial and innovation plan, among others.

• Control. The Board of Directors will promote the integrity of accounting systems, information, corporate governance, internal control, risk management, and financial consumer attention, as applicable, among others. Additionally, it will ensure the proper functioning of each control system,

risk monitoring, and legal compliance. Similarly, it will monitor and pronounce on the entity's risk profile and approve the methodologies for segmentation, identification, measurement, and control of money laundering and terrorism financing.

If material weaknesses or exceptions are presented by the Statutory Auditor in their annual opinion of the financial statements, these will be brought to the attention of the Audit Committee. If the management has a different opinion regarding them, the Board of Directors will issue a report to the assembly including the relevant considerations and explanations and the reasons for the differences in criteria with the Statutory Auditor's opinion.

e. External Advisors. The Board of Directors may hire, directly or instruct the management to hire, external advisors for the service of the Board of Directors, independent of those hired by the management, when it considers it necessary for the better performance of its functions.

The Director who requests the intervention of an external advisor must declare if there is a conflict of interest between him/her and the requested advisor, a family relationship, or a commercial or personal relationship with the Director, his Affiliates, or Persons in which the Director is an Executive Officer, in which case the decision to hire the advisor will be made by the other Directors.

In any case, the hired advisor must maintain confidentiality regarding the matters of the advisory and must refrain from any conduct that involves a conflict of interest or the use of privileged information.

According to the provisions in the Bylaws of the Parent Company, if a takeover bid is submitted to acquire shares of the Company, the Board of Directors, in compliance with the duties of diligence and loyalty to the entity and its shareholders, and considering its status as the parent of Bancolombia, a financial entity with systemic importance, may hire impartial third parties to analyze and evaluate the proposal comprehensively in all its components, not limited to economic aspects and including its sources of financing and the qualities of the proposer, among them, their connection with the local and international financial sector. The conclusions of the analysis contracted for the consideration of the shareholders will be published to the market to be taken into account by the shareholders in making their decision. This is without prejudice to the confidential analyses and evaluations that the Board of Directors may request for its consideration.

f. Budget. The Board of Directors may annually allocate an expense budget required to carry out its management. This budget will especially consider aspects related to fees necessary to hire external advisors different from those hired by the management when needs require, national and international travel, representation expenses, attendance at seminars and events, fees for the support committees of the Board, and other expenses required to ensure proper management.

g. Board Meetings. Board meetings will be held with the frequency established in the Bylaws or by law. In the case of the Parent Company and financial Companies domiciled in Colombia, Board meetings will be held at least once a month; however, when special circumstances warrant, extraordinary meetings may be held when convened in accordance with the provisions set forth in the Bylaws.

The Board of Directors of the Parent Company will meet at least once a year in a special session to analyze, evaluate, and decide on the entity's planning and strategy.

The minutes of the Board meetings will identify the studies, foundations, and other sources of information that served as the basis for decision-making, as well as the reasons for and against that were considered in making the decisions, in cases where a decision is not reached unanimously by the attending members. It will also record cases where a Director warns of a conflict of interest.

The minutes of the meetings will be the mechanism through which the deliberations and decisions adopted by the Board are recorded, and when applicable, the decisions will be communicated through relevant information mechanisms.

The Board of Directors of each Company will approve the annual calendar of its regular sessions, without prejudice to those meetings that must be held extraordinarily. Based on the annual agenda, the Secretary will send out the meetings notice electronically.

h. Meetings without the Presence of Management. The Board of Directors may hold necessary meetings without the presence of Company management officials. These meetings will be held when determined by the Board of Directors itself, and their decisions will be fully valid as long as they comply with the requirements stipulated by law and the Bylaws.

i. Intranet or any other means of information and communication for analysis, discussions, documents, etc. Members of the Board of Directors of the Companies will have access in advance to the information that is relevant for decision-making, according to the agenda included in the notice.

The Companies will provide the Directors with the necessary, useful, and pertinent information required to participate and make reasoned decisions at each Board meeting, with a term of no less than two (2) days prior to the meeting through any physical or electronic means that ensures the receipt of the information.

j. Chair and Vice Chair of the Board of Directors. The Board of Directors will have a Chair and may have a Vice Chair, positions that may be rotated among the members of the Board in the manner it determines and will be responsible for ensuring the efficiency and better performance of the Board.

The Chair of the Board, in coordination with the President of the Company or the Secretary, will participate in the preparation of the annual meeting agenda and provide the necessary guidelines for its proper execution, ensure the sufficiency and timeliness of information delivery to the Board of Directors, guide discussions to ensure the participation of Directors and the relevance and conduciveness of debates. Additionally, the Chair will lead the interaction among Directors and between the Board and shareholders.

k. Secretary of the Board of Directors. The Board of Directors will have a secretary appointed by the Board itself, whose main competencies and responsibilities will be defined in the Bylaws. Generally, the Secretary will be responsible for:

1.Issuing the notice for Board meetings in accordance with the annual schedule established for such purpose and coordinating the meetings of the Board of Directors.

2.Ensuring the delivery of the information required in advance of each Board meeting, as well as any other information that is necessary and relevant to keep the Directors properly informed or to support decision-making.

3.Keeping the minutes books of the Board of Directors, along with their respective annexes, in accordance with the law, and certifying copies thereof with their signature, attesting to the resolutions adopted by the Board when required.

4.Ensuring compliance with the policies and guidelines set forth in the Bylaws and in this Code regarding the operation of the Board of Directors.

5.Any other responsibilities established in the applicable regulations of each Company or within the Group.

l. Meeting agenda. The periodic agendas of the Board of Directors will be prepared by the Secretary, taking as a reference an annual thematic agenda led by the Chair of the Board, which includes the recommendations of the Directors and the Good Governance Committee (if such a Committee exists), as well as the recommendations of the President and the management. The agenda responds to the functions and responsibilities of the Board of Directors with a strategic, business, and risk focus and will flexibly address the dynamics of the environment, the evolution of the business, and the needs of the Companies.

m. Induction and Training Policy. With the aim of facilitating the understanding, by the persons appointed as members of the Board of Directors of the Companies, of their responsibilities and the functioning of the organization, the General Secretariat will coordinate their induction plan, based on the experience, trajectory, and profile of each Director, the Support Committees in which they will participate, and their prior knowledge of the entity.

The plan will include, among other things, an induction into the mission, vision, and values of the organization; a presentation of the corporate governance structure of Grupo Cibest; a presentation on the main challenges and opportunities facing the organization; meetings with the main executives of the entity; and training on the legal and fiduciary responsibilities as a member of the Board of Directors, and on the powers derived from their appointment.

In the case of the Parent Company, the Good Governance Committee will oversee the compliance with the induction plan for new members of the Company's Board of Directors.

Additionally, the Companies will provide Board members with regular opportunities to update their knowledge and skills through training and education in academic, commercial, and strategic topics related to the competencies of the Board and its Support Committees, and in the subjects that the Board of Directors and Senior Management define as relevant and pertinent for each year.

The Good Governance Committee will promote the training of Directors and their attendance at seminars and events that allow them to stay in contact with national and international organizations, entities, and companies.

3.2. Appointment of President and main executives

The Board of Directors is responsible for the appointment and free removal of the President of the Company, their substitute, and the other vice presidents, who are in charge of the ordinary course of business.

The maximum age for working in Senior Management positions (President and Vice Presidents who report directly to the President) and general managers, as applicable, of the Parent Company is set at sixty-five (65) years.

The Board of Directors of the Parent Company, for the purpose of setting the remuneration of the President and other members of Senior Management, must consider their qualities, experience, responsibilities, functions, value-added generation to the company, and the financial situation of the company. Regarding variable remuneration elements, the Board of Directors will adhere to the general policies issued by the assembly for this purpose.

For the appointment of these employees, it will be taken into account that the candidates share the corporate philosophy and culture of the Group, as well as its principles and values, and possess managerial skills, technical knowledge, human qualities, and moral suitability.

In the case of the Parent Company, the governance and administration functions in charge of the President and the Corporate Governance Vice President and the General Secretary or General Secretary, as the case may be, are established by the Bylaws and in this Good Governance Code. The functions of the other executives will be set by the President.

Basic information about the Directors, President, and other members of Senior Management of the Parent Company can be consulted on the corporate website and in the annual report presented in Form 20-F, as well as on the website of the United States Securities and Exchange Commission ("SEC"): http://www.sec.gov/

3.3. Support Committees of the Parent Company designated by the Board of Directors

Without prejudice to the support committees that the Companies must have by law or that they decide to establish as a good practice, the Parent Company will have corporate support committees of the Board of Directors that will help develop and strengthen the competencies of the Board, which will be designated in accordance with the provisions of numeral 23 of article 60 of the Bylaws.

In forming its Support Committees, the Board of Directors will consider the profiles, knowledge, and professional experience of its members.

The Support Committees of the Board of Directors will have internal operating regulations, which will regulate, among other matters, their composition and invited attendees to the meetings, the competencies and responsibilities of the Committee, and the rules of operation.

In the case of the Parent Company, these Committees are as follows:

•Good Governance Committee. The Good Governance Committee of the Parent Company will be composed of a minimum of three (3) members of the Board of Directors, and at least one (1) of them must be independent. The President of the Parent Company will attend permanently. The Corporate Governance Vice President General Secretary of the Parent Company will act as Secretary of this Committee. The main task of this Committee is to assist the Board of Directors of the Parent Company and of Bancolombia S.A. in its functions related to the corporate governance of the Parent Company, Bancolombia S.A., and the Group, and in supervising compliance with the corporate governance measures established for the Parent Company, Bancolombia S.A., and the Group in general. The Committee will present reports of its activities to the Board of Directors of the Parent Company and will approve an annual corporate governance report for the general shareholders' meeting of the Company.

•Appointment, Compensation, and Development Committee. The Appointment, Compensation, and Development Committee of the Parent Company will be composed of a minimum of three (3) members of the Board of Directors and will be chaired by an independent member. The main task of the Committee will be to assist the Board of Directors of the Parent Company and of Bancolombia S.A. in matters related to determining the policies and standards for the selection, appointment, hiring, and remuneration of the Senior Management of the Parent Company and the Group, and in general, everything related to the Group’s remuneration model. The Committee will present reports of its activities to the Board of Directors of the Parent Company, and at the request of the Chair of the general shareholders’ meeting, the Chair of the Committee may inform the general shareholders’ meeting about specific aspects of the work carried out by the Committee.

•Audit Committee. The Audit Committee of the Parent Company will be composed of three (3) members of the Board of Directors, including the independents, and will be chaired by an independent member. At least one of its members, in compliance with current regulations, will be an expert in financial matters. The Committee will have a Chair and Secretary appointed by the Committee itself.

This Committee's purpose is to assist the Board of Directors of the Parent Company in its function of supervising the proper functioning of the internal control system, through the evaluation of policies, standards, and procedures, the reliability and timeliness of financial information, and the protection of the Company's assets.

The Audit Committee of the Parent Company will establish mechanisms aimed at promoting communication channels with the Presidents, Boards of Directors, and Audit Committees of the Group's subordinate Companies, including Bancolombia, to have channels that allow

comprehensive and effective supervision of the internal control system and other matters within its competence at the Group level.

This Committee will not replace the functions of the Board of Directors or management regarding the supervision and execution of the internal control system.

It will be the responsibility of the Chair of the Committee, in cases where exceptions are presented in the reports of the External Auditor, to disclose them at the general shareholders' meeting, as well as the defined action plans. At the request of the Chair of the general shareholders’ meeting, the Chair of the Audit Committee will inform the general shareholders’ meeting, about specific aspects of the work carried out by the Committee.

Companies engaged in financial activities, including Bancolombia, must establish Audit Committees, which must include members of the Board of Directors of the respective Company. They will also have internal operating regulations that will regulate, among other matters, their composition and invited attendees to the meetings, the competencies and responsibilities of the Committee, and the rules of operation. Without prejudice to other competencies attributed by regulation, the Bylaws, or the internal regulations of each Company to this Committee, the main task will be to support the Board of Directors in matters related to supervising the proper functioning of the Company's internal control system, the reliability and timeliness of financial information, and the protection of the Company's assets.

The Audit Committees will present reports of their activities to the Board of Directors of each Company.

•Risk Committee. The Risk Committee of the Parent Company will be composed of at least three (3) members of the Board of Directors and will be chaired by an independent member.

The main function of this Committee is to support the Board of Directors of the Parent Company in the approval, monitoring, and control of corporate-wide policies, guidelines, and strategies for the administration and management of risks within Grupo Cibest.

The Risk Committee of the Parent Company will establish mechanisms aimed at promoting communication channels with the Companies of the Group, allowing effective supervision of the functioning of the different risk management systems and other matters within the Committee's competence at the Group level.

The Companies, according to the activities they develop and in accordance with applicable legislation, will define the existence of a local Risk Committee, which will have internal operating regulations that will regulate, among other matters, its composition and invited attendees to the meetings, the competencies and responsibilities of the Committee, and its rules of operation.

The local Risk Committees of the Companies will present reports of their activities to the Board of Directors of each Company.

In the case of the Parent Company, at the request of the Chair of the general shareholders’ meeting, the Chair of the Committee may inform the general shareholders’ meeting about specific aspects of the work carried out by the Committee in the year prior to the meeting.

Other Committees established by the Board of Directors of the Parent Company:

The Board of Directors of the Parent Company has established a set of committees to address strategic business matters. These committees are:

•Corporate Credit Committee. This Committee's purpose, among others, is to analyze, discuss, evaluate, and recommend to the Local Credit Committees in the different Companies of Grupo Cibest operations and credit ratings both individual and for economic groups, which may: (i) affect the exposure and risk profile of Grupo Cibest, (ii) affect the risk appetite, (iii) compromise the viability of the business, or (iv) generate credit risk concentration situations that are not within the appetite; recommend the maximum exposure in sectors that present a high concentration of credit risk and inform the Risk Appetite Committee of the Parent Company; and propose to the Board of Directors of the Parent Company improvements to corporate policies, processes, and procedures for credit approval.

The Board of Directors of the Parent Company will determine its members, among whom may be two (2) independent members of the Board of Directors, the Corporate Vice President of Risks, and the Corporate Governance Vice President and General Secretary of the Parent Company.

•Corporate Ethics Committee. This Committee's purpose, among others, is to define the general policy and ethical, conduct, and integrity guidelines through the Code of Ethics and Conduct and its annexes, which will have a corporate scope, and communicate positions on complex ethical dilemmas; ensure that the organizational culture and its fundamental principles are interpreted and lived in the same way in all Companies, and determine the necessary actions to disseminate the culture and its standards; and designate diagnostic activities on ethics within Grupo Cibest.

The Board of Directors of the Parent Company will determine its members, among whom may participate the President of the Parent Company, the Presidents of the subordinate banks, and the Corporate Governance Vice President. The Compliance Vice President of Bancolombia will act as the secretary of the Committee.

•Disclosure Committee. The Parent Company has a Disclosure Committee responsible for supervising how the Parent Company discloses its information to the market, ensuring that it is clear, sufficient, and timely, in accordance with the applicable regulations to the entity. This Committee reports to the Audit Committee of the Parent Company.

The Board of Directors of the Parent Company will determine its members.

The Companies may take as a reference the committees established by the Board of Directors of the Parent Company and/or Bancolombia to implement internal committees with similar competencies. This is without prejudice to the authority of the President of the Company to form other committees that support the various activities and matters of management.

3.4. Procedure for the acquisition and disposal of shares of the Parent Company

In accordance with Colombian legislation, the Directors and management of the Parent Company may, directly or through an intermediary, dispose of or acquire shares of the Company while they are in office, provided that the transactions are unrelated to speculative motives and with authorization from the Board of Directors of the Parent Company, granted with the favorable vote of two-thirds of its members, excluding the vote of the applicant, or when deemed appropriate by the Board of Directors, with authorization from the assembly, with the favorable vote of the ordinary majority provided in the Bylaws, excluding the vote of the applicant.

In any case, the trading of shares by the administrators must not have speculative purposes, which will be presumed, for example, when the following three requirements occur simultaneously: i) suspiciously short periods between the purchase and sale of shares, ii) exceptionally favorable or unfavorable situations for the Parent Company have occurred, and iii) a significant profit or loss has been obtained from the transaction.

For the purposes of monitoring and effectively complying with the adopted procedure, the following requirements must be met, and are applicable to the acquisition and/or disposal of shares of the Parent Company, convertible bonds, or single‑share fund interests of the Parent Company:

1.The duty of prior information by the manager to the Corporate Governance Vice Presidency General Secretariat of the Parent Company, indicating the intention to acquire or dispose of shares, convertible bonds into shares, or interests in single‑share funds of the Parent Company. For such purposes, the number of shares, their class or the approximate value of the investment, and the reasons motivating this transaction, shall be indicated. In the case of interests in single‑share funds, the number of interests in the fund, the approximate value of the investment, and the reasons motivating the transaction shall be indicated.

2.The Corporate Governance Vice President General Secretary and their substitute will notify the Compliance Vice‑Presidency of the request submitted by the administrator and will bring the request to the next meeting of the Board of Directors of the Parent Company for it to be addressed under the conditions specified by law and in the Good Governance Code.

3.Regarding Directors and Senior Management, the mentioned authorization will be informed to the market as relevant information.

4.The Board of Directors of the Parent Company will establish a maximum period of two (2) months from the authorization for the transaction to be completed, to avoid speculative motives.

In any case, managers may not carry out operations during the following periods:

1.During: (a) the months of January and February until the publication of the year‑end results; and (b) from four (4) weeks prior to the publication of the quarterly results as of March 31, June 30, and September 30, and until their publication.

2.In the period between the moment managers become aware of a significant operation or business to be undertaken by the Parent Company or its subsidiaries and the moment this is disclosed to the market.

When cases arise for exercising the preemptive right in the Parent Company's issuances, managers may exercise it without authorization from the Board of Directors, but will need authorization for the acquisition of additional rights beyond those corresponding to their shareholding.

In the case of variable compensation paid through a contribution to the Institutional Performance Incentive Fund, whose investment is composed mainly of shares of Grupo Cibest S.A. (the SVA Fund), the Director or administrator may liquidate his or her interest in the SVA Fund with respect to the contributions that have met the required holding period, subject to prior authorization from

the Board of Directors of the Parent Company, granted by a favorable vote of two‑thirds of its members, excluding the vote of the requesting party, and in accordance with the following rules:

1.The administrator’s duty to provide prior notice to the Corporate Governance Vice‑Presidency and General Secretariat of the Parent Company, indicating the intention to liquidate the interest in the SVA Fund.

2.The Corporate Governance Vice‑President and General Secretary, or their designee, shall notify the Compliance Vice‑Presidency of the request submitted by the administrator and shall present the request at the next meeting of the Board of Directors of the Parent Company for its consideration.

3.With respect to Directors and Senior Management, the aforementioned authorization shall be disclosed to the market as material information.

4.The administrator may proceed with the liquidation of the contributions one calendar month after the date of the authorization. The instruction to the SVA Fund Manager may be issued from the date of the authorization granted by the Board of Directors and up to a maximum of ten (10) calendar days immediately following the conclusion of the aforementioned calendar month. Should this period be exceeded, the administrator must undergo the authorization process again.

5.The administrator may not request authorization during the month of January.

6.The transaction must be unrelated to speculative purposes.

The Board of Directors may authorize those Directors or administrators who so request to issue an irrevocable instruction to the SVA Fund’s management company so that, as contributions meet the required holding period, such management company shall, on the date such period is met, initiate the process of liquidation and transfer to the Director or administrator of the corresponding contributions. This authorization shall allow the automatic liquidation of the contributions as the respective holding period is fulfilled, without the need for additional procedures by the Director or administrator.

The Corporate Governance Committee of the Parent Company may monitor the development of the authorized transactions, and for such purposes may rely on the Compliance area.

3.5. Economic relationships of the Company with Directors, President, and Senior Management

The economic relationships of the Companies with their Directors, President, and other members of Senior Management, and key executives, will be carried out within the limitations and conditions established by the relevant regulations and rules on prevention, management, and resolution of conflicts of interest.

All relevant information regarding the existing economic relationships between each of the Companies and their Directors, President, and key executives will be disclosed in the reports corresponding to each fiscal year, in accordance with applicable regulations.

3.6. Evaluation mechanisms for Directors, President, and Senior Management

The Boards of Directors of the Companies will annually conduct an evaluation of their management and that of their support committees, which should include, among other aspects, attendance at meetings, active participation, monitoring of key aspects of the Company, evaluation of their tasks, and their contribution to defining the entity's strategies and projection. In the case of the Parent Company, the Board of Directors will determine the mechanism through which this evaluation will be carried out, which may alternate between internal self-evaluation or external evaluation.

Similarly, the Boards of Directors of the Companies, through the Chair of the Board, will annually evaluate the management of the President of the Company. Each President or General Manager will do the same regarding the executives who report directly to them.

Additionally, the President or General Manager of the Company will keep the Chair of their Board of Directors generally informed of the results of the evaluations conducted on their executive team.

In the case of the Parent Company, the evaluation of the President will be supported by the Nomination, Compensation, and Development Committee.

3.7. Information Management Regulations

3.7.1. Special Rules of Conduct. Every person appointed as a member of the Board of Directors of the Parent Company adheres to this Regulation and is obliged to sign the Agreement for Access and Use of Information.

Directors will be required to comply with the following special rules for the protection of information (including Confidential Information) of the Parent Company and the Companies.

For the purposes of this section, the following definitions will be taken into account:

•"Confidential Information" means all information, whether identified as confidential or not, that the Director receives, whether orally, in print, digitally, in writing, or by any other means of transmission, including data messages and presentations at Board meetings, that is owned by or related to the Companies, persons in which the Parent Company or its subsidiaries are Relevant Partners, persons with whom the Parent Company or its subsidiaries have alliances or legal vehicles, persons or companies where any of the above have any direct or indirect participation, or the clients, suppliers, or allies of any of the above, along with any notes, analyses, worksheets, compilations, comparisons, studies, or any other document that contains, reflects, or is based on or generated by such information. Confidential Information includes, but is not limited to: (i) information from contracts with third parties, including, but not limited to, investment agreements, divestitures, joint ventures and potential M&A transactions, except for those terms and conditions that, pursuant to securities market disclosure rules, are required to be disclosed to the market and once such has occurred; ii) business plans and information about the future plans of the Companies, including short, medium or long term plans, or information about the plans of the Companies that have the object or that may give it a competitive advantage or an advantageous positioning against its competitors; (iii) technical, legal, accounting, commercial, operational and financial information; (iv) product and service plans; (v) information on costs, expenditures, prices; (vi) marketing reports; (vii) analyses, research and projections; (viii) information related to the telecommunications network, platforms and software; ix) the information of customers, suppliers, employees and/or shareholders including but not limited to past, current, and potential credit operations entered into with Bancolombia, and their financial conditions; x) the reports and minutes of the different instances of Corporate Governance, or others related to corporate matters; (xi) information on corporate strategy and competitive strategy; xii) information on human talent and compensation, including information regarding compensation of executives, administrators and employees; (xiii) financial information that has not been disclosed to the public in accordance with applicable disclosure rules; xiv) information on litigation or other legal actions for or against; (xv) documents which are subject to lawyer's professional secrecy; (xvi) contracts, agreements or documents subject to confidentiality, whether contractual or legal; (xvii) internal control information; (xviii) information from the institution's risk map, including credit risk reporting and analysis; and xix) valuation and technical analysis reports prepared by independent third parties or employees, including fairness opinions, adequacy or inadequacy opinions, media used for the preparation of valuations or opinions, including unpublished management projections, any forward looking statements, and

forward-looking statements, and forward-looking statements. Management's analysis and discussions regarding the future financial performance of any of the Companies.

•“Reserved Information” means Confidential Information submitted to the knowledge of the Board of Directors restricted to one or more Directors as a result of the particular analysis carried out about the existence of a Competition Situation or Conflict of Interest with any of the Companies.

a. Request and Access: Directors are not authorized to act independently and separately from the Board of Directors, as it is a collegiate body, which requires that their actions follow decisions made as a social organ. The Parent Company will not process information requests that are not made in accordance with the provisions of this section. When a Director considers that a review or analysis of information held by the Parent Company is required, they must recommend to the Board of Directors to make the corresponding request during a Board meeting. Any request received by the administration or the secretary outside of a Board meeting will be considered by the Board at its next meeting. In any case, any such request must be made in writing and properly substantiated, and must be sent to the designated institutional email for this purpose. Information requests made within the support committees of the Board of Directors will be transmitted in the same manner to the full Board to comply with the provisions of this section. The president of the respective committee will be responsible for transmitting the request to the president and secretary of the Board. If the Board does not approve such a request, the Director who made the recommendation has the right to request that their petition be recorded in the minutes or in the documents related to their management.

b. Delivery: If the Board of Directors, as a collegiate body and with the majority required by law and the Bylaws for the adoption of decisions of this body, authorizes the delivery of Confidential Information in accordance with section (a) above, the management of the Parent Company will deliver the Confidential Information requested by the Board of Directors according to the following rules:

1.The management will only deliver the Confidential Information indicated by the Board of Directors, as a collegiate body;

2.The requested Confidential Information will be made available to the Board of Directors through appropriate physical or electronic means for this purpose;

3.If the Confidential Information delivered is Reserved Information, the procedure for the protection of Reserved Information of the Companies established in section 3.7.3 will be applied; and all Confidential Information delivered to the Board of Directors will be subject to the confidentiality agreements that the directors must sign.

c. Abstention: Directors must refrain from requesting or knowing any Confidential Information related to a situation of Conflict of Interest or Competition with the Companies.

d. Disclosure: Directors must disclose to the Board of Directors all personal situations that could potentially generate a Conflict of Interest or possible Competition Situations with the Companies. Similarly, any change or subsequent situation after the declaration must be reported to the Board of Directors through its Secretary. When a Director considers that another Board member is in a situation that should prevent them from accessing certain Confidential Information, they must inform the chairman of the Board of Directors, so that the same procedure described in the previous paragraph is applied.

e. Restricted Use: Directors must keep and protect the confidentiality of the Confidential Information they have access to and, therefore, must:

1.Use the Confidential Information exclusively to perform their functions as Directors, always in the best interest of the Parent Company (and, when applicable, the Companies), considering the interests of their associates, and, therefore, refrain from using the

Confidential Information for any purpose other than the exercise of their functions (including, without limitation, competing with the Parent Company or one of the Companies, or taking advantage of opportunities that the Parent Company or one of the Companies could exploit);

2.Before starting to perform their functions as Board members, sign confidentiality agreements; and

3.Protect the Confidential Information and use it in accordance with the provisions of the confidentiality agreements.

f. Caution: Each Director acknowledges that the Confidential Information is the property of the Parent Company, its Affiliates, or the Companies, as appropriate. Each Director is obliged to keep and protect the confidentiality of the Confidential Information with the same level of diligence that a good businessperson, expert, and diligent, would use in the care of their most sensitive information. To this end, among other things, they must receive, retain, send, and, in general, use the Confidential Information only through the secure devices and channels that the Parent Company makes available to them.

g. Decision: The Board of Directors will be the body responsible for evaluating and deciding on the existence or non-existence of situations that prevent Directors from accessing Confidential Information. The decision will be made by the Board without the participation of the evaluated Director. The decision thus adopted will be mandatory for the Directors.

3.7.2. Reserved Information. Each Director agrees that, unless expressly authorized by the Board of Directors, they cannot access Confidential Information when the Director is in a Competition Situation or Conflict of Interest by virtue of which they could exploit that Reserved Information to the detriment of the Parent Company or one of the Companies.

3.7.3. Procedure for the protection of Reserved Information in Board meetings. In the ordinary and extraordinary sessions of the Board of Directors of the Parent Company, the following procedure will be followed to protect the Reserved Information of the Companies:

a. The Secretary of the Board of Directors or the President of the Parent Company will send the agenda to be addressed in the board session, including the express indication of the agenda items that, according to the declarations of Conflicts of Interest or possible Competition Situations with the Companies, are considered Reserved Information concerning one or some members of the Board of Directors.

If the Board meeting is convened directly by two or more Directors, before the meeting, the Secretary will send a report to all members of the Board of Directors indicating the agenda items that would involve the delivery of Reserved Information.

In any case, the procedure indicated in section 3.7.1 above will be applied if the items included in the agenda imply a request for Confidential Information.

b. When making information available to the Directors prior to the Board meeting, it will be evaluated whether such information contains Reserved Information. If so, the possibility of providing the information in an aggregated form that allows maintaining its confidentiality will be evaluated, thus preventing the Director(s) from engaging in any conduct that affects the fulfillment of their duties or the interests of the Companies.

c. Likewise, when addressing the agenda items regarding which there is Reserved Information, the possibility of addressing these items without presenting the information that generates the situation of Conflicts of Interest and/or Competition with the Companies or presenting it in an aggregated form that allows maintaining its confidentiality will be evaluated. In these cases, the Board of Directors may meet and decide with the presence of the Director who is in this situation, who will not be able to access such Reserved Information except as established in this section.

d. If it is not possible to aggregate, omit, or modify the Reserved Information while maintaining its confidentiality, the respective Director will not be given access to such information prior to the

Board meeting and must withdraw from the meeting and refrain from participating in the deliberations and decisions related to the agenda item. This fact will be recorded in the minutes of the Board meeting.

e. In cases where there is doubt about whether certain information to be presented is Reserved Information or if the Director disagrees with the decision made regarding the treatment of Reserved Information, the matter will be submitted to the Board of Directors for consideration so that it can decide on the reserved nature of the information, along with a recommendation for handling the case, which may be accompanied by opinions from independent and competent experts in the matter. The Director whose situation is being examined must abstain from this deliberation and decision. In case of a tie, the information will be considered Reserved Information.

f. The restriction on access to Reserved Information will end when the Companies disclose it to the general public, and access will be granted to the Director regarding whom the information was considered Reserved Information, under the same terms and conditions as it was made available to the other members of the Board of Directors.

g. If the Reserved Information is requested or necessary for the functioning of a support committee of the Board of Directors, the provisions of this section will apply. In such cases, if there are differences regarding the reserved nature of the information, the matter will be submitted to the full Board of Directors to proceed in accordance with the provisions of this section.

3.7.4. Compliance with the Information Management Regulations.

None of the Directors may use Confidential Information in violation of this section and, to that extent, in cases of decisions based on Confidential Information and until such information becomes public knowledge, they may not share such information, including the nature of the decision, with any Person. Non-compliance with the provisions of this section will constitute a breach of the confidentiality agreements signed by the directors and will be considered a serious breach of the Director's duties.

SECTION 4: PRINCIPLES AND MEASURES RELATED TO INFORMATION DISCLOSURE

In order to provide adequate knowledge to the stakeholders of each of the Companies, financial and non-financial information will be disclosed through the channels established in this Code for that purpose.

Among other matters, each Company must inform its shareholders and investors, when appropriate, about:

a. he main foreseeable risks and the measures to address them, as well as the mechanisms used for risk management. Each Company will determine the way to communicate these to its shareholders.

b. The year-end financial statements audited by the External Auditor. In the case of the Parent Company, unaudited financial information will also be disclosed quarterly.

c. The relevant findings made by the External Auditor and external audits contracted by the Company. The reports containing these findings will be disclosed as they are produced through the means established by law. Each Company will determine the way to communicate these to its shareholders.

d. The substantial findings revealed by the internal control systems implemented by the Company, as well as important projects related to this system and any significant changes in its structure.

e. The types of shares issued by the Company, the number of shares issued for each type, the shares in reserve, as well as the rights and obligations derived from each type of share.

f. Major shareholders. The Parent Company will disclose those shareholders who are real beneficiaries of more than 5% of the Company's outstanding shares and all significant changes in shareholding and control.

g. Agreements between major shareholders of which the Company is aware and that concern the shares, their rights, the exercise of such rights, the administration of the company, among others.

h. Relevant transactions entered into between the Company and its major shareholders, and with its Directors, administrators, and key executives, as provided in the applicable regulations for each Company or in this Code. Sections eight (8) and nine (9) of this Code establish disclosure rules on this matter.

i. Notice to the general shareholders' meeting and any other information deemed necessary for its development.

j. Other reports of relevant events that occur in financial matters, risk, internal control that may materially affect the Company.

These events will be disclosed as they occur, through the information channel deemed appropriate for each specific case, and when applicable, through the relevant information mechanism.

The relevant information published by the Parent Company will also be published through the mechanism established by the Securities and Exchange Commission (SEC) and will be available to investors on the Company's website.

The Board of Directors of the Parent Company, through the Disclosure Committee and as provided in sections 3.3 and 9.3 of this Code, will ensure the proper disclosure of information to the market.

4.1. Information Channels for Shareholders, Investors, and Market in General.

The Group will maintain the following information channels with its shareholders, investors, and the market in general:

•Corporate website. The Parent Company has a corporate website through which it discloses corporate information, structure and governance, financial information, and documents related to corporate governance and ethics, as well as mechanisms through which stakeholders can contact the Company.

The Parent Company has a Group website in Spanish and English. This website, in its corporate information section, includes the "Investor Relations," "Corporate Governance," and "Sustainability" sites that provide information of interest to investors, shareholders, and the market in general.

This website can be accessed by visiting http://www.grupocibest.com.

The Companies will define the form and information they will disclose through their websites, if they have one.

•Investor Relations Office. The Investor Relations Office of the Parent Company performs, among other functions, the duties corresponding to the Shareholder and Investor Service Office.

Through the Investor Relations Office, clear and objective information about the Parent Company and its activities will be provided, enabling shareholders and investors to make informed decisions regarding their investments in the Parent Company. This Office will maintain permanent contact with the community of shareholders, investors, and local and international analysts.

Any stakeholder who wishes to know information related to the provisions governing corporate governance and ethical standards in the Companies may direct their request to the Investor Relations Office, which will be responsible for directing the request to the competent area and ensuring that the interested party receives a response to their request.

This office can be accessed by visiting www.grupocibest.com or by writing to the following email address:

ir@grupocibest.com.co

or by mail to: Investor Relations Office

Carrera 48 No. 26-85 Torre Sur

Medellín-Colombia

This is without prejudice to the fact that other Companies may create a contact email on their website for direct communication with their investors or may allocate a physical space for attending to inquiries and requests if they deem it appropriate and necessary.

•Management Report. Each of the Companies shall prepare an annual management report that includes the reports of the administrators addressed to the shareholders, the separate and consolidated financial statements, when applicable, the opinions issued by the Statutory Auditor or External Auditor, as applicable, and the notes to the financial statements.

•Relevant Information. The Parent Company and the other Companies that are issuers in the Colombian securities market shall strictly comply with the regulations governing relevant information and issuer updates, publishing the corresponding information through the website of the Colombian Financial Superintendence.

The Parent Company may also publish relevant information related to other Companies within the Business Group whenever such information is relevant and material for the purposes of Grupo Empresarial Cibest.

Relevant information shall be understood as that which would have been considered by a prudent and diligent expert when buying, selling, or holding securities, as well as that which a shareholder would take into account when exercising political rights at the General Shareholders Meeting, in accordance with the legal criteria applicable to the Parent Company or to the respective company that is a securities issuer in Colombia.

The Parent Company has defined the procedures, responsible parties, timelines, and, in general, the necessary structure to ensure the complete and timely disclosure of relevant information that may be of interest to the market, as well as to update the entity’s basic information. For this purpose, it shall be supported by the Disclosure Committee, as established in section 3.3 of this Code.

Shareholders, investors, and the market in general may consult the Parent Company’s relevant information at any time through the website of the Colombian Financial Superintendency: www.superfinanciera.gov.co and through the Company’s website.

•The Parent Company shall publish quarterly reports containing information about its performance, which shall be made available to shareholders and the market in general, both in Colombia and abroad.

Likewise, it shall file with the Securities and Exchange Commission an annual report on Form 20-F, containing information about the Parent Company’s results during the previous fiscal year.

The relevant information disclosed by the Parent Company shall also be filed through the mechanism established by the Securities and Exchange Commission (SEC), in accordance with the rules applicable to foreign issuers listed in the United States.

•National and International Meetings and Conference Calls. The management of the Parent Company shall hold in-person meetings, conference calls, and/or video conferences with domestic and international investors and shareholders. These meetings and calls shall be held with the frequency determined by the Presidency and disclosed through the website, in order to present the results of Grupo Cibest and the performance of its businesses.

•Confidentiality. In accordance with the provisions of the Code of Ethics and Conduct and the data protection policies of each Company, managers and employees must maintain due confidentiality regarding working documents and any confidential information in their care or to which they have had access in the course of their duties. Therefore, they must ensure control and prevent any misuse of such information within any unit or department of the Company for which they work, and ensure that such information is not disclosed to unauthorized persons or to individuals who are not part of the relevant area.

Also, they are not allowed to disclose or transfer to other officers or third parties, technologies, methodologies, know-how, and industrial, commercial or strategic confidential information of the company, its customers or suppliers. They are not allowed to disclose or transfer this kind of information to people who have had access to that information due to their positions. Likewise, they shall not have or try to have access to information deemed as industrial, commercial or strategic confidential information in an illegal manner.

4.2. Credit Rating Agencies. The Companies may engage the services of independent securities rating agencies to conduct the corresponding analyses and inform the market regarding the likelihood of timely payment of obligations arising from securities issued by the Company, and, in general, to provide an opinion on the Company’s qualities as a market maker, when applicable, in accordance with the regulations governing such activity.

The Companies may also be rated by other international firms, which will assess the entity’s condition and periodically publish their reports.

Additionally, each issue of bonds or trade papers of the Company will be accompanied with a risk and investment rating conducted by independent and international securities rating companies.

4.3. Bondholders. The Parent Company and the other Companies issuing bonds in Colombia comply with the regulations applicable to Ordinary Bondholders’ Meetings, ensuring full observance of the legal provisions and the terms and conditions set forth in the corresponding issuance and placement prospectuses, which are available on the website.

4.4. Anti-Money Laundering and Counter-Terrorism Financing Risk Management System. In line with best practices and in compliance with the regulatory frameworks applicable to each jurisdiction or economic activity in which they operate, the Group Companies have implemented systems for the prevention and control of money laundering and other illicit activities. These systems comprise the stages of identification, measurement or assessment, control, and monitoring.

To ensure compliance with such systems, Compliance Officers have been appointed for each Company where required by regulation, and policies have been established for the prevention and control of money laundering. These policies reflect the applicable rules and guidelines to be followed in this matter.

4.5. Financial Consumer Ombudsman. The Companies supervised by the Colombian Financial Superintendence have appointed a principal and an alternate Financial Consumer Ombudsman, designated by the general shareholders' meetings. The Ombudsman shall act as the spokesperson for customers or users before the Company and shall objectively and free of charge address and resolve individual complaints, within the legal timeframes, concerning potential breaches by the Company of legal or internal rules governing the provision and execution of services offered or rendered by financial institutions, or related to the quality of such services.

As a demonstration of their respect for the rights of clients and financial consumers, and in order to ensure absolute transparency in all operations, the Companies supervised by the Colombian Financial Superintendence undertake to consider as binding the decisions rendered by the Financial Consumer Ombudsman, provided such decisions are accepted by the client.

In the event that, during the nomination, appointment, or performance of the duties of the Financial Consumer Ombudsman, the managers of Grupo Cibest become involved in a conflict of interest, they shall follow the procedures set forth in Section 8 of this Code.

Likewise, if the Financial Consumer Ombudsman becomes involved in a conflict of interest in relation to a dispute or with a financial consumer, the Ombudsman must refrain from acting, in which case the Alternate Ombudsman shall intervene. This is without prejudice to the obligation to report the conflict to the Compliance Officer, who shall issue guidelines for its proper management.

Both the managers of Grupo Cibest and the Financial Consumer Ombudsman are responsible for identifying any situation that may result in a conflict of interest and for complying with the applicable procedure for its proper management.

SECTION 5: PRINCIPLES AND MEASURES RELATED TO THE CONTROL ARCHITECTURE

For Grupo Cibest, the control architecture is an essential element of good governance that encompasses aspects related to the Internal Control System and the Risk Management System, in such a way that these elements ensure a governance structure and that the internal policies and guidelines of each Company are aligned with the achievement of the strategic objectives established by the Group.

To this end, the Companies, taking into account the nature, structure, and volume of their operations, shall define clear rules of conduct related to the control architecture and shall seek to ensure strict compliance with the regulations applicable to them, depending on the sector in which they operate.

5.1. Internal Control System – ICS. The Group has an Internal Control System based on the values and corporate culture developed through policies, rules, components, procedures, and behaviors that allow management to reasonably ensure that, through the implementation of suitable, sufficient, and adequate controls, the risks to which the Companies are exposed due to their activities do not affect the achievement of their strategic objectives.

The Internal Control System contributes to the achievement of the objectives of each Company, while also ensuring that all operations and activities are carried out in accordance with internal rules and applicable regulations.

In line with the Group’s commitment to maintaining a solid Internal Control System that guarantees the sustainability and continuity of the Group’s business over time, the Boards of Directors of the Companies, through their respective Audit Committees, must periodically review the elements and components of such System in order to implement the necessary improvements and corrective measures, as well as to incorporate new national and international standards governing this matter.

Grupo Cibest shall take the COSO and COBIT standards as a reference and shall ensure that the Internal Control System complies with the regulations and practices applicable in each jurisdiction and with the provisions or standards required for issuers registered with the SEC.

5.2. Risk Management System. The Risk Management System of each of the Companies belonging to the Grupo Cibest Business Group encompasses the definition of risk policies and guidelines, specific objectives for risk management, the definition and implementation of the system’s components (identification, assessment, measurement, management, monitoring, and reporting of risks), the creation and follow-up of a risk map, as well as minimum and maximum exposure limits, among other elements.

Within the Grupo Cibest Business Group, t, the general risk management policies and objectives take into account financial companies, thereby ensuring cohesion and control.

The Internal Control and Risk Management Systems require an organizational culture and philosophy grounded, among other principles, in self-control, understood as the ability of all members of the organization to consider control as an inherent part of their responsibilities and decision-making processes.

Based on this principle, and on the pillars of the control and risk culture and philosophy adopted by the Grupo Empresarial Cibest, the Companies have implemented mechanisms aimed at effectively communicating this culture across all levels of the organization, ensuring that the information disclosed allows all employees of the Grupo Empresarial Cibest to understand the importance of risk management and the proper identification of controls as fundamental elements for the sustainability of the business.

5.3. Compliance Programs. Grupo Cibest has implemented compliance programs with the following objectives: (i) to foster compliance with applicable regulations and corporate policies within each of the Companies, (ii) to promote ethical standards throughout the Organization, and (iii) to protect its reputation, all within a risk-based approach aligned with the Group’s purpose and strategy.

For the purpose of managing and overseeing compliance risk at the corporate level, the Parent Company shall appoint a Compliance Officer, who will report to the Audit Committee and the Board of Directors. This officer will be responsible for ensuring the execution of the guidelines established by the Board of Directors in compliance matters, and for promoting ethics, integrity, and transparency, as a reflection of the Group’s culture. In turn, the Companies of the Group shall also appoint Compliance Officers, when required to do so under their local regulations.

5.4. Control Bodies. Without prejudice to the internal control responsibilities assigned to employees in the course of their duties, the following are the bodies responsible for monitoring the effectiveness of the control architecture:

•External Auditor. The Companies shall have a Fiscal Auditor or external auditor, as required by law or their bylaws, who shall carry out the functions established in the applicable regulations and shall be subject to the provisions set forth therein, without prejudice to the provisions of the Bylaws.

The External Auditor of the Parent Company shall be appointed by the shareholders’ meeting for a term of two (2) years. The same body shall be responsible for determining the auditor’s compensation, as well as for removing the auditor at its discretion when deemed necessary.

The appointment of the External Auditor shall be carried out through a competitive process, in which proposals for the provision of external audit services shall be requested from auditors or audit firms with the capacity to provide such services to the Companies.

The Audit Committee shall conduct an objective and fully transparent evaluation of the proposals received. The selection and evaluation process shall include an analysis of the proposals, taking into account factors such as services offered, costs and fees, experience, and industry knowledge, among others. The evaluation shall also consider, as one of its criteria, whether the firm is registered with the Public Company Accounting Oversight Board – PCAOB. Following the assessment by the Audit Committee, the proposal for the appointment of the External Auditor and the determination of fees shall be submitted to the general shareholders’ meeting by the Board of Directors.

The Parent Company shall not appoint as External Auditor any individual or firm that has received income from the Companies and/or from its corporate group amounting to twenty-five percent (25%) or more of its annual revenues. Likewise, the Companies of the Group shall not engage the External Auditor or its affiliates for services other than those directly or indirectly related to auditing.

The Audit Committee of the Parent Company shall ensure that no audit firm provides external audit services to Grupo Cibest for a period exceeding ten (10) years, extendable for an additional ten (10) years by decision of the Board of Directors, and shall promote the adoption of international best practices regarding the rotation of audit teams within the same firm.

The external audit firm will rotate the individuals acting as external auditors for the Companies at least every five (5) years. A rotated individual may only resume auditing the same Company after a period of two (2) years. The same periods will apply when the External Auditor is a natural person.

Grupo Cibest will make its best efforts to have a single external audit firm for all the Companies.

Furthermore, an individual cannot serve as External Auditor if they are a partner in the same company or any of its subsidiaries, if they hold any other position in the Parent Company, or if they are related by marriage or within the fourth degree of consanguinity, first civil degree, second affinity degree, or are a business partner of the administrators and senior executives, or an auditor or accountant for the Parent Company.

The External Auditor may not hold any other position in the Parent Company or its subsidiaries, other than the role of external auditor. They are also prohibited from entering into contracts with the company or acquiring shares in it.

The External Auditor, in their report to the shareholders' meeting, will include, in addition to the requirements set forth by law, any relevant findings made, to ensure that shareholders and other investors have the necessary information to make decisions regarding the relevant securities.

•Internal Audit. The internal Audit, as the third line, is responsible for enhancing and protecting the organization's value by providing assurance, advisory, and risk-based analysis. It is the area responsible for evaluating the internal control system and enables the Board of Directors, the Audit Committee, other supporting committees of the Board, and Senior Management to perform their supervisory role and validate the proper functioning of the organization’s Internal Control System.

SECTION 6: PRINCIPLES AND MEASURES RELATED TO CAPITAL INVESTMENTS OF THE GROUP IN OTHER COMPANIES

Grupo Cibest will direct its actions to ensure that the Companies in which it holds capital investments maintain better corporate governance standards, such as:

1.Providing equitable treatment to shareholders and ensuring the respect and compliance with legal and statutory provisions related to shareholders' rights.

1.Holding meetings at least once a year where the administrators present management reports, financial statements with their notes, and any other relevant information for the shareholders and their investment in the Company.

1.Processing shareholder information requests or claims and ensuring timely responses.

1.Establishing mechanisms to ensure the confidentiality of company and shareholder information, as well as preventing and controlling the misuse of confidential information.

1.Implementing mechanisms to allow for alternative dispute resolution for potential conflicts with shareholders, such as direct settlement, arbitration, conciliation, etc.

1.Maintaining high ethical standards in the development of their business activities.

The Companies will refrain from supporting proposals with their vote that violate the above principles.

SECTION 7: PRINCIPLES AND POLICIES RELATED TO THE ORGANIZATIONAL STRUCTURE OF GRUPO CIBEST

To achieve the purpose of Grupo Cibest Business Group, the Board of Directors of the Parent Company, as the parent entity, decides and directs a corporate strategy that guides the actions of the Companies in the Group towards the achievement of a unified purpose and the leveraging of synergies to maximize value and sustainability. Furthermore, it has established an organizational structure based on the following principles:

1.The structure must ensure the integrated and coordinated implementation of the corporate strategy, where each country’s businesses are viewed as part of the global strategy, ensuring that all commercial and support functions pursue a common objective.

2.A vision of comprehensive governance for all the Companies in the Group, both nationally and internationally, led by the President of the Parent Company, with clear reporting lines and assignment of responsibilities.

3.The President of the Parent Company, with the support of the Senior Management team, is responsible for directing the goals and objectives of each of the Group’s businesses and validating the execution of strategies and plans, ensuring they are integrated within the context of the Group.

4.The Parent Company, as the holding entity of the Group, has Corporate Vice Presidents at the financial, services, legal, risk, and auditing levels, who are responsible for their functions across all geographies.

5.The President of the Parent Company, with the support of the Corporate Vice Presidents, defines and nominates candidates for the Boards of Directors of the Companies, other than the Parent Company. The Corporate Vice Presidents, in accordance with the President’s instructions, may also be members of the Boards of Directors of these Companies.

6.At the international level, the Companies of the Group have local leaders (Local Presidents) in each jurisdiction, whose role is to lead the execution of the strategy defined by the Parent Company and represent the Group in the country, ensuring understanding of local realities. The Local Presidents report to the Board of Directors of their respective Companies.

7.In the areas of risk, auditing, and anti-money laundering prevention, local functional heads in each geography, as well as the Corporate Vice Presidents responsible for these functions, report to both the local Boards of Directors and the parent company’s Board of Directors, through the Audit and Risk Committees.

8.The Companies of the Group in Colombia have established a shared services model for the execution of processes, with cross-company teams, in which common functions and processes, generally support-related, are identified across the different companies or business units.

This model aims for unity in the comprehensive management of processes to drive efficiency, compliance with policies and guidelines set by the Parent Company, achievement of a unified purpose, consistency of information, automation, measurement, documentation, contingency support, scalability, and standardization.

Under this framework, each Company contributes human resources and assumes operational costs when dealing with third parties.

Where feasible and beneficial, this model may be extended to Companies in other jurisdictions.

The structure and operation of Grupo Cibest will comply with the regulatory requirements applicable to each Company, in accordance with the regulations that apply to them.

SECTION 8: PRINCIPLES AND GUIDELINES RELATED TO CONFLICT OF INTERESTS

Grupo Cibest understands a conflict of interest to be a situation in which a person, having to make a decision regarding an act or business, or being able to influence its adoption, faces two or more

conflicting and incompatible interests, such that any course of action they choose will result in favoring one interest over the others.

Conflicts of interest may arise with any of our managers, and their existence in itself is not inherently reprehensible. However, acting in a conflict of interest situation without disclosing and managing it can lead to inappropriate conduct. Therefore, managers are expected to exercise the utmost caution when faced with a real or apparent conflict of interest.

8.1. Situations That May Lead to Conflicts of Interest

Due to the impossibility of describing all potential conflicts of interest, the Group relies on the commitment, transparency, sound judgment, and good faith of its managers (Board members, senior management, and first- and second-level executives of the Companies) as essential to managing their personal and professional matters and to handling situations that could lead to conflicts of interest.

The Grupo Cibest Code of Ethics and Conduct broadly sets out the rules for the prevention and management of conflicts of interest applicable to employees in general. In addition to this framework—and for illustrative purposes only—the following are identified as situations that may generate conflicts of interest for management:

•Establishing, directly or indirectly (including, but not limited to, through Interposed Persons, Affiliates, or Persons in which the Director or an Affiliate of the Director is an Executive Officer), businesses or companies that carry out similar activities or that compete with entities of Grupo Cibest, or being, directly or indirectly (including through Interposed Persons, Affiliates, or Persons in which the Director or an Affiliate of the Director is a Executive Officer), a partner, shareholder, employee, officer, or advisor of such companies—unless acting under instructions given by Grupo Cibest.

•Making, directly or indirectly (including through Interposed Persons, Affiliates, or Persons in which the Director or an Affiliate of the Director is an Executive Officer), a personal investment in a company if such investment could affect, or appear to affect, the person’s ability to make impartial and objective decisions regarding business related to the Group.

•Participating in the evaluation, analysis, or decision-making process of transactions within Grupo Cibest, whenever the manager has—directly or indirectly (including through Interposed Persons, Affiliates, or Persons in which the Director or an Affiliate of the Director is an Executive Officer)—a personal or family interest in the respective business.

Additionally, Section Ten (10) of the Code establishes prohibitions applicable to administrators of the Companies.

8.2. Conflicts of interest that may arise in Transactions with Related Parties

Grupo Cibest encourages the execution of agreements and contracts among Companies within Grupo Cibest, between these Companies and their related parties, as well as transactions between entities that are part of the Sura Bancolombia Group and their related parties (hereinafter “Transactions with Related Parties”).

These Transactions with Related Parties are not, in and of themselves, considered to give rise to conflicts of interest.

However, there is a possibility that administrators involved in decision-making related to such transactions, agreements, and contracts may face conflicts of interest.

Therefore, in addition to requiring that Transactions with Related Parties be carried out only when they are not prohibited by applicable regulation and in strict compliance with the parameters defined therein, a series of internal policies and guidelines have also been established for administrators to observe:

•Ensure that Transactions with Related Parties do not jeopardize the ability of the involved companies to meet their obligations to third parties.

•Ensure that Transactions with Related Parties are executed at prices that fall within market ranges for operations that are comparable in terms of the quality and quantity of the goods or services involved, as well as the credentials and experience of the respective counterparty. In cases where no market exists to serve as a benchmark, the transactions shall be carried out at objectively comparable prices, taking into account potential synergies and business alliances among the Companies and aiming to avoid value transfers that would undermine the rights of other shareholders.

Section Nine (9) of this Code sets out additional good governance procedures established for Transactions with Related Parties.

8.3. Procedure for the management, administration, and disclosure of situations that may give rise to conflicts of interest

The Group considers that situations which may give rise to conflicts of interest must be managed and resolved in accordance with the specific circumstances of each case. In any situation where there is doubt regarding the existence of a conflict of interest, the Director or administrator is required to act as if a conflict of interest exists and to comply with the procedure established by the Bylaws, this Code, and any other regulation or policy applicable due to membership in a financial conglomerate, in accordance with applicable law.

Conflicts of interest can be classified as permanent or occasional. A conflict of interest is deemed permanent when the person is disqualified or incompatible with performing the role or is unable to make decisions regarding the company’s full range of operations. All other conflicts of interest are considered occasional.

The Companies will not appoint as managers any persons in a situation of permanent conflict of interest when such conflict relates to the expected duties of the position.

Managers who are faced with or believe they may be faced with a potential conflict of interest must act in accordance with the following provisions:

•When a Director (member of the Board of Directors) finds that a potential conflict of interest may arise in the performance of their duties, the Director in conflict or any other Director aware of the situation must immediately inform the rest of the Board. The Director in conflict must refrain from participating in the discussion and decision-making regarding the matter giving rise to the conflict. The Board will deliberate and decide without the participation of the Directors in conflict, unless their presence is required to form the quorum necessary for deliberation and decision-making. In that case, the conflict must be submitted to the competent body pursuant to applicable regulations, including special rules applicable to financial conglomerates.

•Special rule for transactions among companies in the Sura Bancolombia Conglomerate. When a Director (Board member) of the Parent Company is faced with a decision that meets the following conditions:

•It concerns a transaction, act, or business that requires Board approval, and

•The transaction, act, or business involves Grupo Sura – Holding Financiero, or a company belonging to the Sura Bancolombia conglomerate, or one of its related parties, other than a subsidiary or sub-subsidiary of the Parent Company (hereinafter the “Conglomerate Counterparty”), and

•The Director is also an administrator of the Conglomerate Counterparty or of a company that controls the Conglomerate Counterparty.

In such cases, the Director must notify the Board of Directors, providing information about the circumstances giving rise to the conflict, and must refrain from intervening or influencing the decision. Accordingly, the Director must abstain from participating in the deliberation and adoption of the decision. This is without prejudice to their attendance at the Shareholders’ Meeting if required.

The secretary of the Board of Directors shall record the abstention in the respective minutes. The decision regarding the act or business shall be made by the Board with the majority vote of the members present, excluding the vote of the conflicted Director.

Whenever the requirements of section nine (9) of this Code are met, such transactions may be subject to special corporate governance procedures.

•If the President or General Manager of a Company is potentially faced with a conflict of interest arising from personal circumstances or from those of related parties, they must follow the procedure established in the Code of Ethics and Conduct, which includes immediately notifying the Chair of the Board of Directors of the respective Company, who will guide the handling of the situation and escalate it to the Board if deemed necessary.

•Other members of Senior Management who are faced with a potential conflict of interest must follow the procedure established in the Code of Ethics and Conduct, which includes notifying the President of the respective Company, who will guide the handling of the situation.

8.4. Disclosure

In the case of Transactions with Related Parties, the annual report that is made available to the General Shareholders' Meeting shall include the information related to situations of potential conflicts of interest that have been known and managed as established in this section. The disclosure will account for the decisions and actions taken in this regard.

SECTION 9: PRINCIPLES AND MEASURES FOR TRANSACTIONS WITH RELATED PARTIES

The Companies offer their products and services and develop alliances or agreements with other companies of the Group, entities within the Conglomerate, and other natural or legal persons who are considered related parties by regulation.

It is common for our related parties to have products or services with the companies and engage in transactions with them on a daily basis. Therefore, it is essential to maintain high standards of good governance and transparency in conducting these transactions and entering into agreements and contracts in such transactions with related parties.

9.1. Related Parties Map of the Parent Company. Without prejudice to other legal or contractual definitions that the Parent Company must comply with in relation to related parties, for corporate governance purposes, the following natural or legal persons will be considered related parties:

•Companies under the control of the Parent Company.

•Members of the Board of Directors and Senior Management of the Parent Company.

•Spouses and children of the members of the Board of Directors and Senior Management of the Parent Company.

•Capital investments in companies over 10% made by members of the Board of Directors and Senior Management of the Parent Company.

•The financial holding group, its subsidiary companies, and entities forming part of the financial Conglomerate.

•Grupo Sura, financial holding company, its subordinate companies and the entities that make up the Sura Bancolombia Conglomerate.

•Other shareholders of the Parent Company who hold more than 10% of the share capital of the company. In such cases, entities under the control of the respective shareholder will also be considered related parties.

9.2. Corporate governance rules applicable to transactions with related parties. Transactions carried out by the Parent Company with its Related Parties, from the perspective of good governance, will be classified as (i) recurring or non-recurring, and (ii) material or non-material.

9.2.1. Recurring transactions are those that correspond to the ordinary course of business of the companies. Among these recurring transactions, the following are included, in addition to others that the parent company may engage in as part of its ordinary business activities:

•Active and passive credit transactions.

•Financial service contracts.

•Treasury transactions and buying and selling of securities and currencies.

•Securities market transactions.

•Investment banking and structuring transactions.

•Fiduciary business.

•Leasing transactions.

•Collective investment fund transactions.

•Factoring transactions.

•Framework contracts, adhesion or standardized contracts for financial products and services.

•Investment in movable and immovable property.

•Investment in shares, quotas or interest units, or any other title of participation and management of such investments.

•Capital contributions to subsidiary companies.

Recurring transactions will not require a recommendation from the Audit Committee or prior approval from the Parent Company's Board of Directors, regardless of their amount, unless legally or statutorily required.

Regarding non-recurring transactions, their materiality will be analyzed as indicated in numeral 9.2.2 below.

9.2.2. A non-recurring transaction will be considered material when its amount is equal to or greater than USD 20 million.

Non-recurring and material transactions must be accompanied by a report containing the criteria that were considered in determining the price and other conditions of the transaction. This report must be reviewed in advance by the Parent Company's Audit Committee. With the Audit Committee's approval, the respective transactions may proceed, without prejudice to them being presented for ratification by the Board of Directors when required. In such cases, a quorum of at least half of the members of the Board and a majority of independent Board members will be necessary.

When applicable, the procedure for handling, managing, and disclosing situations that could lead to a conflict of interest, as outlined in section eight (8) of this Code, must be followed.

If the non-recurring transaction amount is less than USD 20 million, it is considered non-material and therefore does not require the procedure to be followed. These transactions will be reported to the Audit Committee within the month following their completion or at the next Committee meeting.

9.3. Disclosure.

The Parent Company will disclose its transactions with related parties in the notes to the financial statements at the end of each fiscal year. Material transactions will be disclosed in the corporate governance report made available to the shareholders.

9.4. Principles applicable to transactions between companies within the Sura Bancolombia conglomerate

The transactions carried out by the Group with entities within the Conglomerate will be governed by the following principles:

a. Business relationships as clients of products and services reflect the interest of each party in obtaining the best conditions for their own business, with full freedom to compete for business under pricing and service conditions.

b. The provision of financial services by the Group to entities within the Conglomerate must be preceded by a profitability analysis, and the offer of products and services must be priced based on value generation. Prices should always seek to ensure that the business relationship, as a whole, results in a financial contribution to Grupo Cibest.

c. The Board of Directors will be informed of those transactions that, by law or pursuant to the Bylaws, fall within its purview.

d. Transactions between the Group and entities of the Conglomerate shall be fundamentally governed by compliance with applicable laws.

e. Transactions between the Group and entities of the Conglomerate shall not put at risk the Companies’ ability to meet their obligations to third parties.

f. Transactions between the Group and entities of the Conglomerate shall be carried out at prices that fall within market ranges for comparable transactions in terms of the quality and quantity of the goods or services involved and the credentials and experience of the respective counterparty. Where no market reference exists, transactions shall be conducted at objectively comparable prices, taking into account potential synergies and commercial alliances between the Companies and seeking to avoid value transfers that may undermine the rights of other shareholders.

g. In accordance with existing regulations for financial conglomerates in Colombia, it is necessary for entities of Grupo Cibest and Grupo Sura as financial holding company to exchange additional information in order to comply with obligations before the Colombian Financial Superintendency. Such exchange of information shall be governed by protocols that restrict its use to the purposes for which it was provided and include procedures and measures aimed at protecting and properly handling confidential and privileged information.

SECTION 10: PROHIBITED SITUATIONS FOR MANAGERS

The Group has identified a set of prohibited situations applicable to the managers of the Companies, pursuant to which managers shall:

•Refrain from participating, directly or through an intermediary, for personal interest or on behalf of third parties, in activities that imply competition with the entity or in actions involving a conflict of interest.

•Refrain from engaging in activities, businesses, or transactions that are contrary to the law or the interests of the Group, and that could hinder the performance of their duties and responsibilities or jeopardize the Group’s reputation.

•Refrain from entering into any transaction or business based solely on feelings of friendship or enmity.

•Refrain from recommending a transaction based on privileged information to which they have access due to their role or duties.

•Avoid, in the exercise of their position, obtaining personal or family benefits from suppliers, contractors, third parties, clients, or users; except as provided for in the Code of Ethics and Conduct regarding gifts and invitations.

•Refrain from offering, soliciting, or accepting commissions or any other form of remuneration in any transaction or business involving the Group, with the purpose of securing the effectiveness or outcome of such transaction or business.

•Refrain from granting rebates, discounts, preferential rates, waivers, or exemptions of any kind based solely on friendship or kinship, or that are not consistent with the Group’s commercial policies.

•Refrain from serving as an advisor, legal representative, or managing the business affairs of clients or third parties whose interests are incompatible with and contrary to those of Grupo Cibest.

SECTION 11: PRINCIPLES AND ENFORCEMENT MEASURES OF THE GOOD GOVERNANCE CODE

Any violation of the procedures and rules contained in this Code, as well as in the Group’s Code of Ethics and Conduct—whether through active conduct or by omission of duties—will result in the imposition of the corresponding sanctions on the Director, manager, or employee who commits the infraction, pursuant to the provisions of the Colombian Substantive Labor Code, the Internal Labor Regulations, and current regulations. This is without prejudice to any applicable civil or criminal liability actions, which will be pursued by the Company’s legal representatives.

In In order to assess the penalty, factors such as prior records, losses for the Company or the customers, among others, will be taken into consideration. Such provisions will be included in relevant agreements and will be reported to the managers.

Claims Related to the Good Governance Code

Shareholders and investors of each one of the Companies may submit claims to the Investor Relations Office or to the Presidency of the other Companies when they believe that there has been a breach of the provisions of the Good Governance Code. In such cases, the Company’s management, through the relevant Office or area, will provide a clear and sufficient response to the claimant with the utmost diligence and timeliness.

Shareholders and investors may also file complaints and claims before the External Auditor for non-compliance with the Good Governance Code. For these purposes, the Company will provide timely and thorough responses to any requests made by the External Auditor as a result of the complaint and will address the observations made by the Auditor if a breach is found to have occurred.

Any amendment, modification, or supplementation to this Code will be disclosed on the website of the Parent Company.

Document

Exhibit 12.1

CERTIFICATION 302

I, Juan Carlos Mora Uribe, certify that:

1.I have reviewed this annual report on Form 20-F of Grupo Cibest S.A.;

2.Based on my knowledge, this report does not contain any untrue statement of a material fact or omit to state a material fact necessary to make the statements made, in light of the circumstances under which such statements were made, not misleading with respect to the period covered by this report;

3.Based on my knowledge, the financial statements, and other financial information included in this report, fairly present in all material respects the financial condition, results of operations and cash flows of Grupo Cibest as of, and for, the periods presented in this report;

4.Grupo Cibest’s other certifying officer(s) and I are responsible for establishing and maintaining disclosure controls and procedures (as defined in Exchange Act Rules 13a-15(e) and 15d-15(e)) and internal control over financial reporting (as defined in Exchange Act Rules 13a-15(f) and 15d-15(f)) for Grupo Cibest and have:

a)Designed such disclosure controls and procedures, or caused such disclosure controls and procedures to be designed under our supervision, to ensure that material information relating to Grupo Cibest , including its consolidated subsidiaries, is made known to us by others within those entities, particularly during the period in which this report is being prepared;

b)Designed such internal control over financial reporting, or caused such internal control over financial reporting to be designed under our supervision, to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles;

c)Evaluated the effectiveness of Grupo Cibest’s disclosure controls and procedures and presented in this report our conclusions about the effectiveness of the disclosure controls and procedures, as of the end of the period covered by this report based on such evaluation; and

d)Disclosed in this report any change in Grupo Cibest’s internal control over financial reporting that occurred during the period covered by the annual report that has materially affected, or is reasonably likely to materially affect, Grupo Cibest’s internal control over financial reporting; and

5.Grupo Cibest’s other certifying officer(s) and I have disclosed, based on our most recent evaluation of internal control over financial reporting, to Grupo Cibest ’s auditors and the audit committee of Grupo Cibest’s board of directors (or persons performing the equivalent functions):

a)All significant deficiencies and material weaknesses in the design or operation of internal control over financial reporting which are reasonably likely to adversely affect Grupo Cibest’s ability to record, process, summarize and report financial information; and

b)Any fraud, whether or not material, that involves management or other employees who have a significant role in Grupo Cibest’s internal control over financial reporting.

Date:	April 8, 2026
		/s/
		Name: Juan Carlos Mora Uribe<br><br>Title: Chief Executive Officer

Document

Exhibit 12.2

CERTIFICATION 302

I, Mauricio Botero Wolff, certify that:

1.I have reviewed this annual report on Form 20-F of Grupo Cibest S.A.;

2.Based on my knowledge, this report does not contain any untrue statement of a material fact or omit to state a material fact necessary to make the statements made, in light of the circumstances under which such statements were made, not misleading with respect to the period covered by this report;

3.Based on my knowledge, the financial statements, and other financial information included in this report, fairly present in all material respects the financial condition, results of operations and cash flows of the company as of, and for, the periods presented in this report;

4.Grupo Cibest’s other certifying officer(s) and I are responsible for establishing and maintaining disclosure controls and procedures (as defined in Exchange Act Rules 13a-15(e) and 15d-15(e)) and internal control over financial reporting (as defined in Exchange Act Rules 13a-15(f) and 15d-15(f)) for Grupo Cibest and have:

a)Designed such disclosure controls and procedures, or caused such disclosure controls and procedures to be designed under our supervision, to ensure that material information relating to Grupo Cibest, including its consolidated subsidiaries, is made known to us by others within those entities, particularly during the period in which this report is being prepared;

b)Designed such internal control over financial reporting, or caused such internal control over financial reporting to be designed under our supervision, to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles;

c)Evaluated the effectiveness of Grupo Cibest’s disclosure controls and procedures and presented in this report our conclusions about the effectiveness of the disclosure controls and procedures, as of the end of the period covered by this report based on such evaluation; and

d)Disclosed in this report any change in Grupo Cibest’s internal control over financial reporting that occurred during the period covered by the annual report that has materially affected, or is reasonably likely to materially affect, Grupo Cibest’s internal control over financial reporting; and

5.Grupo Cibest’s other certifying officer(s) and I have disclosed, based on our most recent evaluation of internal control over financial reporting, to Grupo Cibest’s auditors and the audit committee of Grupo Cibest’s board of directors (or persons performing the equivalent functions):

a)All significant deficiencies and material weaknesses in the design or operation of internal control over financial reporting which are reasonably likely to adversely affect Grupo Cibest’s ability to record, process, summarize and report financial information; and

b)Any fraud, whether or not material, that involves management or other employees who have a significant role in Grupo Cibest’s internal control over financial reporting.

Date:	April 8, 2026
		/s/
		Name: Mauricio Botero Wolff
		Title: Chief Financial Officer

Document

Exhibit 13.1

CERTIFICATION

Pursuant to Section 906 of the Sarbanes-Oxley Act of 2002

Pursuant to 18 U.S.C. § 1350, the undersigned officer of Grupo Cibest S.A., hereby certifies, to such officer’s knowledge, that the Company’s Annual Report on Form 20-F for the year ended December 31, 2025 (the “Report”) fully complies with the requirements of Section 13(a) or 15(d), as applicable, of the Securities Exchange Act of 1934 and that the information contained in the Report fairly presents, in all material respects, the financial condition and results of operations of the Company.

Date:	April 8, 2026
		/s/
		Name: Juan Carlos Mora Uribe<br>Title: Chief Executive Officer

The foregoing certification is being furnished solely pursuant to 18 U.S.C. § 1350 and is not being filed as part of the Report or as a separate disclosure document.

Document

Exhibit 13.2

CERTIFICATION

Pursuant to Section 906 of the Sarbanes-Oxley Act of 2002

Pursuant to 18 U.S.C. § 1350, the undersigned officer of Grupo Cibest S.A., hereby certifies, to such officer’s knowledge, that the Company’s Annual Report on Form 20-F for the year ended December 31, 2025 (the “Report”) fully complies with the requirements of Section 13(a) or 15(d), as applicable, of the Securities Exchange Act of 1934 and that the information contained in the Report fairly presents, in all material respects, the financial condition and results of operations of the Company.

Date:	April 8, 2026
		/s/
		Name: Mauricio Botero Wolff<br><br>Title: Chief Financial Officer

The foregoing certification is being furnished solely pursuant to 18 U.S.C. § 1350 and is not being filed as part of the Report or as a separate disclosure document.

Document

Exhibit 97.1

Grupo Cibest S.A.<br>CLAWBACK POLICY	Grupo Cibest S.A.<br>POLÍTICA DE CLAWBACK
I. BACKGROUND<br><br><br><br><br><br>Grupo Cibest S.A. (the "Company") has adopted this policy (the "Policy") to regulate the process of recuperating excess Incentive-Based Compensation granted to Executive Officers in the event of a Restatement of its financial statements.<br><br><br><br>This Policy is intended to comply with, and will be interpreted to be consistent with, the requirements of Section 303A.14 of the New York Stock Exchange ("NYSE") Listed Company Manual (the "Listing Standard").<br><br><br><br>The terms in uppercase will have the meaning assigned to them within this document.<br><br><br><br>II. STATEMENT OF POLICY<br><br><br><br>The Company will recover the amount of erroneously awarded Incentive-Based Compensation in the event that the Company is required to prepare an accounting restatement of its financial statements due to the material noncompliance of the Company with any financial reporting requirement under the securities laws, (the "Restatement") including accounting restatements made to correct an error in previously issued financial statements that is material to the previously issued financial statements or that would result in a material misstatement if the error were corrected in the current period or left uncorrected in the current period.<br><br><br><br>In compliance with this Policy, the Company must recover the erroneously awarded Incentive-based Compensation except to the extent provided under Section V below.	I. ANTECEDENTES<br><br><br><br><br><br>Grupo Cibest S.A. (la "Compañía") ha adoptado esta política (la "Política") para regular el proceso de recuperacion de la Compensacion Basada en Incentivos reconocida en exceso a los Ejecutivos en el evento de una Reexpresión de sus estados financieros.<br><br><br><br>Esta Política tiene la intención de cumplir, y será interpretada de forma consistente con la Sección 303A.14 del Manual de Empresas Cotizantes de la Bolsa de Valores de Nueva York (NYSE).<br><br><br><br>Los términos en mavúscula tendrán el significado asignado a los mismos en el presente documento.<br><br><br><br>II. OBJETO DE LA POLÍTICA<br><br><br><br>La Companía recuperará la Compensación Basada en Incentivos que haya sido erróneamente reconocida a los Ejecutivos, en el evento en el<br><br>que la Companía sea requerida para preparar una reexpresion de sus estados financieros debido a un incumplimiento material de la Companía de un requerimiento de reporte de informacion financiera<br><br>bajo la ley de mercado de valores (la "Reexpresión"), incluyendo reexpresiones contables realizadas para corregir un error material en estados financieros previamente emitidos, o que resultaría en una representación erronea material si el error fuera corregido en el período actual o quedara sin corregir en el período actual.<br><br><br><br>En cumplimiento de esta Política, la Companía deberá recuperar la Compensación Basada en Incentivos reconocida erróneamente, salvo en los casos previstos bajo la Sección V del presente documento.
III. SCOPE OF POLICY<br><br><br><br>A. Covered Persons and Recovery Period<br><br><br><br>This Policy applies to Incentive-Based Compensation received by an Executive Officer who served as such at any time during the performance period for that Incentive-Based Compensation, while the Company has securities listed on an American Securities Exchange.<br><br><br><br><br><br>The Company shall recover the erroneously awarded Incentive-Based Compensation received during the three completed fiscal years immediately preceding the date on which the Company is required to prepare a Restatement (the "Recovery Period").<br><br><br><br>Notwithstanding this look-back requirement, the Company is only required to apply this Policy to the Incentive-Based Compensation received by the Executive Officers on or after May 16, 2025.<br><br><br><br>For purposes of this Policy, the Incentive-Based Compensation shall be deemed "received" in the Company's fiscal period during which the Financial Reporting Measure is attained, even if the payment occurs after the end of that fiscal period.<br><br><br><br>B. Transition Period<br><br><br><br>This Policy applies to any transition period that results from a change in the Company's fiscal year within the Recovery Period, provided that the transition period between the last day of previous fiscal year and the first<br><br>day of the new fiscal year that comprises a period of nine to 12 months and is considered a complete fiscal year.	III. ALCANCE DE LA POLÍTICA<br><br><br><br>A. Personas Cubiertas y Periodos de Recuperación<br><br><br><br>Esta Política aplica a la Compensación Basada en Incentivos recibida por un Ejecutivo que haya tenido tal calidad en cualquier momento durante el periodo de calculo de la respectiva Compensacion Basada en<br><br>Incentivos, mientras que la Compañía tenga valores inscritos en una Bolsa de Valores de Estados Unidos.<br><br><br><br>La Compañía recuperará la Compensación Basada en Incentivos reconocida erróneamente durante los tres (3) años fiscales completos inmediatamente anteriores a la fecha en la cual la Compañía sea requerida para preparar una Reexpresión (en delante el "Periodo de Recuperación").<br><br><br><br>Sin perjuicio de lo anterior, la Compañía solo está obligada a aplicar esta Política con respecto a la Compensación Basada en Incentivos recibida por los Ejecutivos a partir del 16 de mayo de 2025<br><br><br><br>Para los propósitos de esta Política, la Compensación Basada en Incentivos se tiene por recibida en el periodo fiscal durante el cual el Indicador Basado en Estados Financieros se alcanzó, incluso si su pago<br><br>se produce de forma posterior al cierre de dicho periodo fiscal.<br><br><br><br>B. Periodo de Transición<br><br><br><br>Esta Política aplica a cualquier periodo de transición que resulte de un cambio en el ejercicio fiscal de la Compañía dentro del Período de Recuperación, siempre que el periodo de transición comprendido entre el último día del ejercicio fiscal previo y el primer día del nuevo ejercicio fiscal que comprenda un periodo de 9 a 12 meses sea considerado un<br><br>ejercicio fiscal completo.
---	---
C. Determining Recovery Period<br><br><br><br><br><br>For the purpose of determining the Recovery Period, the date on which it is considered that the Company was required to prepare the Restatement is the earliest that occurs between:<br><br><br><br>•The date the Board of Directors concludes, or reasonably should have concluded, the Company is required to prepare a Restatement, and<br><br><br><br>•The date a court, regulator, or other legally authorized body directs the Company to prepare a Restatement.<br><br><br><br><br><br>For clarity, the Company's obligation to recover erroneously awarded Incentive-Based Compensation under this Policy is not dependent on if or when a Restatement is filed<br><br><br><br>IV. AMOUNT SUBJECT TO RECOVERY<br><br><br><br>(a) Recoverable Amount: The amount of Incentive-Based Compensation subject to recovery under this Policy is the amount that exceeds the amount of Incentive-Based Compensation that would have been received had it been determined based on the restated amounts, computed without regard to any taxes or social security paid.<br><br><br><br>(b) Compensation based on stock price or TSR: For Incentive-Based Compensation based on stock price or total shareholder return ("TSR"), where the amount of erroneously awarded Incentive-Based Compensation is not subject to mathematical recalculation, the recoverable amount will be determined by the Designation, Compensation and Development Committee based on a reasonable estimate of the effect of the Restatement on the stock price or TSR upon which the Incentive-Based Compensation was received. In such event, the Company must maintain documentation that supports	C. Determinando el Periodo de Recuperación<br><br><br><br><br><br>Con el propósito de determinar el Período de Recuperación, la fecha en la que se considera que la Companía fue requerida para preparar la Reexpresión es la primera que se produzca entre:<br><br><br><br>•La fecha en la que la Junta Directiva determine, o en la que debió haber determinado, que la Companía debe efectuar una Reexpresión, y<br><br><br><br>•La fecha en que un órgano judicial, ente regulador o cualquier otra autoridad competente ordene a la Compania preparar la Reexpresión.<br><br><br><br>Para mayor claridad, la obligacion de la Compania de recuperar la Compensación Basada en Incentivos reconocida por error según esta Política no depende de si o cuándo se presente la Reexpresión.<br><br><br><br>IV. MONTO SUJETO A RECUPERACIÓN<br><br><br><br>(a) Monto Recuperable: El monto de la Compensación Basada en Incentivos sujeto a recuperación bajo esta Política es el monto que exceda la compensacion que se habría recibido si se hubiera determinado con base en las cifras reexpresadas, sin tener en cuenta la seguridad social ni los impuestos pagados por el Ejecutivo.<br><br><br><br>(b) Compensación basada en el precio de las acciones: En el caso de compensaciones por incentivos basadas en el precio de la acción o en el retorno total para los accionistas donde la compensación basada en incentivos reconocida en exceso no esté sujeta a un nuevo cálculo matemático, el monto recuperable será determinado por el Comité de Designación, Compensación y Desarrollo a partir de una estimación razonable del efecto de la Reexpresión sobre el precio de la accion o el retorno sobre el cual la compensación basada en incentivos fue recibida. EEn dicho evento, evento, la Compania deberá
---	---
the determination of the estimation and provide such<br><br>documentation to NYSE.<br><br><br><br>V. EXCEPTIONS<br><br><br><br>In compliance with this Policy, the Company shall recover the overpaid Incentive-Based Compensation reasonably promptly, except to the extent that the conditions set out below are met and that the Designation, Compensation and Development Committee determines that recovery would be impracticable:<br><br><br><br>(a)Direct expense exceeds recoverable amount. The direct expense paid to a third party to assist in the enforcement of this Policy would exceed the amount to be recovered; provided, however, that before concluding it would be impracticable to recover any amount of the erroneously awarded Incentive-Based Compensation based on expense of enforcement, the Company has made a reasonable attempt to recover the such erroneously awarded Incentive-Based Compensation, has documented said attempt, and has provided the documents to NYSE.<br><br><br><br>(b)Violation of Home Country Law. Recovery would violate Colombian law where such law was adopted prior to May 16, 2025; provided, however, that the Company obtains an opinion of a Colombian counsel acceptable to NYSE in that sense and provides such opinion to NYSE.<br><br><br><br>(c) Recovery from Certain Tax-Qualified Retirement Plans. Recovery would likely cause an otherwise tax-qualified retirement plan, under which benefits are broadly available to employees of the Company, to fail to meet the requirements of 26 U.S.C. 401(a)(13) or 26 U.S.C. 411(a) and regulations thereunder.	mantener documentacion que soporte dicha estimacion razonable y proveer dicha documentación a la NYSE.<br><br><br><br>V. EXCEPCIONES<br><br><br><br>En cumplimiento de esta Política, la Compañía deberá recuperar la Compensacion Basada en Incentivos pagada en exceso dentro de un período de tiempo razonable, excepto en los siguientes casos, siempre que el Comité de Designación, Compensación y Desarrollo determine que la recuperación es inviable:<br><br><br><br>(a) El gasto directo supera el monto recuperable. Los gastos directos asociados a la contratacion de terceros para la ejecución de la Política excedan el monto recuperable. Lo anterior, siempre que antes de concluir la inviabilidad de recuperar cualquier suma de la Compensación Basada en Incentivos erróneamente reconocida por efectos de los costos de la ejecución, la Compañía haya adelantado un intento razonable para obtener la devolución, dicho intento de recuperación esté documentado y la documentación se ponga a disposición de la NYSE.<br><br><br><br>(b) Violación de la ley colombiana. La recuperación sea contraria a la regulación colombiana vigente con anterioridad al 16 de mayo de 2025, siempre y cuando la Compañía obtenga un concepto de un abogado colombiano, aceptable para la NYSE, en dicho sentido, y el concepto sea proporcionado a la NYSE.<br><br><br><br>(c) Recuperación de ciertos planes de jubilación calificados a efectos<br><br>fiscales. La recuperación probablemente causaría que un plan de jubilación calificado a efectos fiscales, en el cual los beneficios están ampliamente disponibles para los empleados de la Compañía, no cumpla con los requisitos del Codigo de Impuestos de los Estados Unidos, Sección 401(a)(13) o 411(a) y las regulaciones correspondientes.
---	---
VI. PROHIBITION AGAINST INDEMNIFICATION<br><br><br><br>Notwithstanding the terms of any indemnification arrangement or insurance policy with any Executive Officer covered by this Policy, the Company will not indemnify any Executive Officer or former Executive Officer for the devolution of the overpaid Incentive-Based Compensation, nor will it pay or reimburse any costs associated with the hiring of insurance to finance the amounts recoverable under this Policy.<br><br><br><br><br><br>VII. DISCLOSURE<br><br><br><br><br><br>The Company will file all disclosures with respect to this Policy in accordance with the requirements of the U.S. Federal securities laws, including the disclosure required by the applicable Securities and Exchange Commission ("SEC") filings and the Colombian securities law regarding relevant information.<br><br><br><br><br><br>VIII. DEFINITIONS<br><br><br><br><br><br>The following terms will have the following definitions for the purposes of this Policy:<br><br><br><br>"Executive Officer" means the Company's president, principal financial officer, principal accounting officer (or if there is no such accounting officer, the controller), any vice-president of the Company in charge of a principal business unit, division, or function (such as sales, administration, or finance), any other officer who performs a policy- making function, or any other person who performs similar policymaking functions for the Company. Executive officers of the Company's subsidiaries are deemed Executive Officers of the Company if they perform such policy making functions for the Company. Policy-making function is not intended to include policymaking functions that are not significant. Identification of an Executive Officer for purposes of this Policy will include at a minimum executive officers identified pursuant to 17 CFR 229.401(b).	VI. PROHIBICIÓN DE INDEMNIZACIÓN<br><br><br><br>Sin perjuicio de los términos de cualquier acuerdo indemnizatorio o póliza de seguro que cubra a un Ejecutivo, la Compañía no indemnizará a ningun Ejecutivo o ex Ejecutivo por la devolucion de la Compensación Basada en Incentivos reconocida en exceso, ni pagará ni reembolsará ningun costo asociado a la contratacion de seguros para financiar los montos recuperables bajo esta Política.<br><br><br><br><br><br>VII. REVELACIÓN DE INFORMACIÓN<br><br><br><br><br><br>La Compañía deberá divulgar esta Política, de acuerdo con los requisitos de las leyes federales de los Estados Unidos sobre valores, incluyendo la divulgación requerida bajo la regulación de la Securities and Exchange Commission ("SEC") y bajo la regulación colombiana en materia de información relevante.<br><br><br><br><br><br>VIII. DEFINICIONES<br><br><br><br><br><br>Los siguientes términos tendrán las siguientes definiciones para efectos de esta Política:<br><br><br><br>"Ejecutivo": Significa el presidente de la Compañía, el Vicepresidente Financiero, el Director de contabilidad (o, si no hay tal Director de contabilidad, el controlador), cualquier vicepresidente de la Compañía a cargo de una unidad de negocios, división o función principal (como ventas, administración o finanzas), cualquier otro funcionario que tenga dentro de sus funciones la aprobación de políticas, o cualquier otra persona que realice funciones similares de aprobacion de politicas para la Compañía. Los ejecutivos de las subsidiarias de la Compañía seconsideran ejecutivos de la Compania si aprueban politicas para la Compañía. La función de aprobación de políticas no tiene la intención de incluir la aprobacion de politicas que no sean significativas. La identificación de un ejecutivo para los fines de esta política incluirá,
---	---
"Financial Reporting Measures" means any of the following: (i) measures that are determined and presented in accordance with the accounting principles used in preparing the Company's financial statements, and any measures that are derived wholly or in part from such measures, (ii) stock price and (iii) TSR. A Financial Reporting Measure need not be presented within the Company's financial statements or included in a filing with the SEC.<br><br><br><br><br><br><br><br><br><br>"Incentive-Based Compensation" means any compensation that is granted, earned, or vested based wholly or in part upon the attainment of a Financial Reporting Measure.<br><br><br><br><br><br>IX. APPROVAL BY OFFICERS AND RATIFICATION BY THE BOARD<br><br><br><br><br><br>This Policy may be approved by two Corporate Vice Presidents, provided<br><br>that it is subsequently ratified by the Board of Directors at its next scheduled meeting. Such interim approval must remain consistent with Section X below.<br><br><br><br>X. ADMINISTRATION; AMENDMENT; TERMINATION<br><br><br><br>All determinations under this Policy will be made by the Board of Directors, including determinations regarding how any recovery of the overpaid Incentive-Based Compensation under this Policy is effected. Any determinations of the Board of Directors will be final, binding and conclusive and need not be uniform with respect to each individual covered by this Policy.	como mínimo, a los ejecutivos identificados de conformidad con el 17<br><br>CFR 229.401(b)<br><br><br><br>"Indicadores Basados en Estados Financieros" significa cualquiera de lo siguiente: (i) indicadores que se determinan en base a, y se presentan, de acuerdo con los principios contables utilizados en la preparación de los estados financieros de la Compañía, así como cualquier indicador que se derive total o parcialmente de tales indicadores, (ii) precio de las acciones y (iii) TSR (rendimiento total para el accionista, por sus siglas en inglés). Para ser considerado tal, no es requisito que un "Indicador Basado en Estados Financieros" se presente dentro de los estados financieros de la Compañía o sea incluido en una presentación ante la SEC (Comisión de Valores y Bolsa, por sus siglas en inglés).<br><br><br><br>"Compensacion Basada en Incentivos" significa cualquier compensación que se otorgue, gane o adquiera en funcion total o parcial del logro de un Indicador Basado en Estados Financieros.<br><br><br><br>IX. APROBACIÓN POR PARTE DE LOS VICEPRESIDENTES Y RATIFICACION POR LA JUNTA DIRECTIVA<br><br><br><br>Esta Política puede ser aprobada por dos Vicepresidentes Corporativos, siempre y cuando sea posteriormente ratificada por la Junta Directiva en su próxima reunión programada. Dicha aprobación provisional debe ser coherente con lo establecido en la Sección X a continuación.<br><br><br><br>X. ADMINISTRACIÓN, ENMIENDA Y TERMINACIÓN<br><br><br><br>Todas las decisiones bajo esta Política seran tomadas por la Junta Directiva, incluidas las decisiones relativas a cualquier recuperación de la Compensacion Basada en Incentivos pagada en exceso. Cualquier decisión de la Junta Directiva será definitiva, vinculante y concluyente, y no necesita ser uniforme con respecto a cada persona cubierta por esta política.
---	---
The Board of Directors may amend or terminate this Policy anytime.<br><br><br><br><br><br><br><br>XI. EFFECTIVENESS; OTHER RECOUPMENT RIGHTS<br><br><br><br>This Policy shall be effective as of May 16, 2025. Any right of recoupment under this Policy is in addition to, and not in lieu of, any other remedies or rights of recoupment that may be available to the Bank and its subsidiaries and affiliates under applicable law or pursuant to the terms of any similar policy or similar provision in any employment agreement, equity award agreement or similar agreement.	La Junta Directiva podra modificar o terminar esta Política en cualquier<br><br>momento.<br><br><br><br><br><br>XI. EFICACIA, OTROS DERECHOS DE COBRO<br><br><br><br>Esta política entrara en vigor a partir del 16 de mayo de 2025. Cualquier derecho de recuperacion en virtud de esta Política se suma, y no sustituye, a cualquier otro remedio o derecho de recuperación que pueda estar a disposicion de la Compania y sus subordinadas bajo la ley aplicable, o en virtud de los términos de cualquier otra política o disposiciones similares en cualquier contrato de trabajo, convenio de aporte a capital o cualquier acuerdo similar.
---	---