CEO Message

Dear reader,

As we reflect on 2025, I want to highlight the progress CM.com has made during a year of transformation. While the year brought its share of complexities, it also highlighted the strength of our business model, the dedication of our teams, and the opportunities ahead. By the second half of the year, we saw clear improvements in performance, successfully meeting our revised guidance and positioning ourselves for sustainable growth in the future.

2025 was a year of building foundations - foundations for innovation, operational excellence, and long-term value creation. Our transformation into an AI-first company remains central to our strategy, and the advancements we made this year have set the stage for exciting opportunities in 2026 and beyond.

Throughout 2025, CM.com demonstrated its ability to adapt and deliver results in a dynamic market environment. While certain areas of our business, such as Messaging and FX-sensitive revenue streams, experienced some pressure, we achieved a 7% increase in Annual Recurring Revenue (ARR). This growth reflects the strength of our subscription-based business model and reinforces the stability of our revenue base.

Our disciplined approach to cost management and focus on improving our gross margin contributed to further EBITDA growth, underscoring our commitment to operational excellence. A key milestone this year was the successful refinancing of our € 100 million convertible bonds ahead of schedule. By securing an € 80 million revolving credit facility and raising € 20 million in equity, we strengthened our financial position and created a solid foundation for future growth. These efforts reflect our focus on prudent financial management and our ability to execute on strategic priorities.

2025 was a year of innovation and forward momentum for CM.com. The launch of our Agentic AI Platform HALO marked a significant step forward in our product portfolio. In a world where the speed of change increases rapidly, fueled by AI, CM.com responded and expanded its product portfolio for its customers. The rapid adoption of HALO highlights its potential to redefine customer engagement and business operations.

HALO builds on the fast-moving technological landscape, tapping into CM.com’s deep in-house R&D expertise and our agnostic platform design, which allows us to innovate ahead of the market. Being headquartered in Europe also means HALO is developed within strict regulatory frameworks, meeting the highest European standards. In 2025, CM.com further reinforced this position by becoming one of the first technology companies worldwide to obtain ISO 42001 certification, the international standard for responsible AI development and management. This certification underscores our commitment to delivering AI solutions that are transparent, controllable, and compliant with European regulations, strengthening trust among customers in regulated sectors. Together, these strengths position HALO as the future of personalized, scalable customer interactions, and we are excited about its long-term impact.

Next to that, CM.com also introduced Voice AI to be able to speak to an AI agent – also via WhatsApp. It underlines the growth in richer, more personalized messaging and interactive communication on a mass scale. This trend is on the rise, and the demand for WhatsApp and RCS rose substantially.

For our ticketing clients, we introduced a ticket resale platform, expanding our capabilities and unlocking new revenue opportunities. While the summer period saw fewer events and cautious consumer spending, we are optimistic about the potential for growth as we expand into European markets. These developments demonstrate our ability to adapt to evolving market conditions and seize opportunities for growth.

On our Capital Markets Day, we unveiled the concept of the CM.com platform for customer interaction. This platform represents the next evolution of our business, combining AI-driven capabilities with our expertise in customer interaction and payments. Our ability to combine and integrate various elements of our product portfolio into a unified solution empowers our customers to create personalized, automated, and impactful interactions with their customers. Our platform is not just a product - it is a vision for the future of customer experience, and we are committed to bringing this vision to life.

Looking ahead to 2026, we are focused on growing profitably while continuing to innovate and expand our capabilities. By leveraging AI, we aim to enhance scalability, efficiency, and margins, while navigating market dynamics with care and precision. We are confident in our ability to build on the progress made in 2025 and capture the opportunities that lie ahead.

2025 also marked a transition in our leadership team, with Jörg de Graaf stepping down as CFO effective November 1. I would like to thank Jörg for his contributions to CM.com and for his collaboration as a colleague, and wish him all the best in his future endeavors.

We are delighted to welcome Geert Beullens as our incoming CFO. Geert brings over 25 years of financial experience, including his tenure at ASML, and we look forward to working with him to execute on the growth opportunities ahead. Geert’s nomination will be formally presented at the upcoming AGM in April 2026.

I am truly grateful for our talented and resilient teams, who continue to adapt, innovate, and support our customers every day. Their dedication and creativity are the driving forces behind our success, and I deeply appreciate their contributions to building a stronger CM.com.

As we close the chapter on 2025, we are energized by the progress we made as an organization and the opportunities that lie ahead. The fundamentals of our business remain strong: a scalable platform, an international client base, and a commitment to innovation. We are confident in our ability to unlock the value we see within our firm as we continue to build a CM.com that creates sustainable value for all stakeholders.

Thank you for your continued trust and support. I look forward to embarking on the next phase of our journey as we focus on growing profitably, expanding our capabilities, and shaping the future of customer interaction, AI, and payments.

Sincerely,

Our Strategy

In 2025, Artificial Intelligence became a defining force in how companies operate and communicate. For CM.com, this was the next logical step in our long-term product vision: a single, intelligent platform that orchestrates every interaction between businesses and their customers.

With the launch of HALO, our Agentic AI Platform, we added a new layer of intelligence on top of our Platform for Customer Interaction. HALO shifts AI from being reactive to truly proactive and task-oriented: instead of simply answering questions, it understands context, takes action, and coordinates complex workflows across communication, marketing, service, and payments. Over time, the CM.com Platform, powered by HALO, will increasingly act as the “operating system” of customer interaction - continuously learning from data, optimizing journeys, and orchestrating the right interaction, on the right channel, at the right moment.

Our mission remains to make life easier, safer, and more beautiful. Mobile has always been the fabric of that mission; AI now becomes its amplifier.

Where we once started with SMS as a single channel, we now design for continuous, fluid conversations that move effortlessly across WhatsApp, RCS, Messenger, email, voice, and in-person touchpoints. HALO uses unified customer profiles and real-time data from every interaction - including payments and live events - to help our customers deliver experiences that feel personal at scale, without adding complexity behind the scenes.

Looking ahead, our product strategy is focused on three principles:

• AI-native by design - embedding Agentic AI deeply into every part of the platform, from customer service and marketing to ticketing and payments.
  

• One unified data foundation - a single source of truth that powers personalization, automation, prediction, and decisioning in real time.
  

• Channel-agnostic interaction - building journeys around people, not channels, so interactions remain consistent and contextual wherever they happen.
  

This is the direction in which we are evolving our integrated platform: from tools that support interactions to an intelligent system that continuously optimizes them.

Our business model is built around a simple idea: one intelligent platform that makes it easy for our customers to create seamless experiences for theirs. By unifying communication, marketing, service, payments, and live experiences in a single Platform for Customer Interaction, we help organizations replace fragmented point solutions with one coherent, data-driven journey for end-users.

As market trends shift towards vendor consolidation and AI-powered “all-in-one” solutions, our focus is to be that central platform of choice. Clients can start with a single capability - such as messaging, customer service, payments, or ticketing - and expand over time, adding new channels and use cases without adding complexity. HALO, our Agentic AI layer, further accelerates this by automating tasks, orchestrating journeys, and enabling smarter decisioning across the entire platform based on unified data as stored in our Customer Data Platform.

Every interaction that runs through CM.com - whether it’s a message, a payment, a support conversation, or a ticket scan - adds to a richer understanding of the end-user. This creates a positive feedback loop: more engagement leads to better insights; better insights lead to more relevant, efficient, and personal experiences. Over time, our customers benefit from higher satisfaction, loyalty, and conversion, while end-users experience interactions that feel natural, intuitive, and consistently on-brand.

In practice, this means customer journeys can flow effortlessly across channels and touchpoints: from a marketing message to a service interaction, from a ticket purchase to an on-site payment, all powered by one integrated platform. Our role in this model is to provide the technology, intelligence, and reliability that make these journeys work — so our customers can focus on their relationships with the people they serve.

Our value creation model is centered on one integrated Platform for customer interaction, powered by advanced technology and the expertise of our people. By combining communication, marketing, service, payments, and live experiences in a single environment based on contextual data, we help customers design journeys that feel effortless for end-users and efficient for their teams.

With the introduction of HALO, our Agentic AI Platform, this model moved into a new phase. Customers can now create their own AI Agents - without coding or complex prompting - to handle standard processes, automate workflows, and support teams across the entire customer lifecycle. Multiple AI Agents can work together across channels to create seamless, 24/7 customer service experiences, from first contact to resolution.

Our platform is channel-agnostic, but deeply channel-aware. It supports rich OTT channels like WhatsApp and RCS, which enable more interactive, feature-rich conversations than traditional SMS. At the same time, SMS remains a foundational part of the ecosystem, often serving as the starting point to activate these richer channels and ensure global reach.

When a conversation turns into a transaction, it is completed within the same platform. Our in-house payment processing is directly connected to Visa and Mastercard, bypassing intermediary layers that many providers rely on. This direct setup enables faster, more flexible, and tightly integrated payment flows that can be embedded directly into customer journeys - from a message or chatbot to a checkout and receipt, all in one environment.

By continually investing in AI, connectivity, and payments, we ensure our platform can support the full commercial journey: from engagement and intent to transaction and loyalty. This end-to-end approach is how we create value for our customers and, in turn, for their customers.

For many of our customers, trust, security, and compliance are as critical as innovation. Through collaborations with institutions such as banks, governments, global leading law firms, and insurance companies, we have developed an enterprise-grade compliance framework that is tested and proven in highly regulated environments.

As regulatory requirements grow in scope and complexity, this framework becomes an increasingly important part of our value proposition. It covers data protection, security, fraud prevention, and sector-specific standards, ensuring that new capabilities such as Agentic AI and integrated payments are delivered in a controlled, compliant way.

We continuously invest in training, governance, and horizon-scanning to stay ahead of evolving regulations. This allows our customers to scale their use of our platform with confidence, knowing that the experiences they create are not only seamless and intelligent, but also robust, secure, and compliant by design.

CM.com continuously works to improve the way it operates, with a strong focus on durability and efficiency. While AI requires significant energy resources, it also offers great potential to drive sustainable innovation for both our customers and our organization.

As outlined in the Our Culture chapter, the company began its transformation toward becoming an AI-first organization in 2025. Furthermore, CM.com consistently evaluates working conditions for its employees, who represent one of its most important assets. Creating an environment that fosters entrepreneurship and enables employees to fully leverage their talents is essential to enhancing company performance. Providing the right tools and technologies to support staff in executing the company’s growth strategy remains a key priority. For example, AI agents are increasingly handling tasks within CM.com’s organizational structure, rapidly improving efficiency and accuracy.

Beyond technological advancement, CM.com is equally committed to safeguarding the personal well-being of its employees. Several initiatives were introduced to enhance health, balance, and engagement — more about these initiatives can be found in the section on Our commitment to Sustainability.

As part of its sustainable footprint, CM.com leases electric company cars for employee travel to client appointments and actively manages its energy consumption. The company strives to provide the right working environment for its staff while minimizing its impact on the planet.

CM.com’s Sustainability Statements outline its key focus areas and results under the EU Taxonomy, demonstrating steady progress while recognizing that there is still work to be done. Remaining at the forefront of innovation also means doing so in a sustainable way.

Our Platform for Customer Interaction

For more than 25 years, we’ve been building technology that makes life easier, safer, and more beautiful. In a world where people spend hours a day on their phones, mobile has become the primary place where conversations, transactions, and relationships happen. Our role is to help businesses be present in those moments - with relevance, reliability, and impact.

CM.com offers one unified Platform for Customer Interaction that brings together communication, marketing, customer service, payments, and live experiences. Instead of multiple point solutions and vendors, our customers work with a single, integrated platform that connects every interaction across the customer journey.

Our platform enables businesses to have secure, scalable conversations with their customers on the channels they use every day: SMS, Voice, WhatsApp, RCS, Email, and more.

With direct connections to over 1,000 mobile network operators worldwide, we ensure reliable message delivery at global scale, serving more than 16,000 customers - including some of the world’s largest technology companies. As richer messaging channels like WhatsApp and RCS grow, our platform helps businesses move from one-way notifications to contextual, conversational interactions that feel personal and timely.

At the heart of our platform is a suite of AI-driven customer service and marketing capabilities that turn every interaction into an opportunity to engage.

Our Platform for customer interaction includes:

• AI-powered service tools such as an intelligent agent inbox and no-code chatbots that handle routine questions, route complex cases, and support human agents in real time.
  

• Multichannel marketing automation that orchestrates personalized campaigns across messaging, email, and other channels.
  

• A Customer Data Platform (CDP) that unifies data from messaging, payments, website behavior, service tickets, and campaigns into real-time 360-degree customer profiles.
  

In 2025, we strengthened this foundation with HALO, our Agentic AI Platform. HALO marks a shift from reactive to proactive AI: instead of simply answering questions, it can autonomously perform complex tasks, such as handling emails end-to-end or resolving service requests via voice. This improves response times, reduces operational costs, and unlocks new levels of personalization at scale.

Payments are a crucial part of the customer journey. Our platform combines online and in-person payments in one ecosystem, enabling merchants across Europe to accept all major payment methods through both payment terminals (powered by our own software) and comprehensive online payment services.

We offer an offline payment module that keeps transactions running even without a stable internet connection - particularly valuable for events and outdoor venues.

Our platform also powers live experiences for museums & parks, sports organizations, and music & event venues. With integrated ticketing, event apps, payments, and secure ticket resale, we help organizers deliver seamless visitor journeys from first click to final applause. By unifying ticket, payment, and engagement data, businesses gain rich fan profiles and can use AI-driven campaigns and messaging to boost ticket sales, increase on-site spend, and turn one-time visitors into loyal communities.

Performance and Results 2025

1. The other comprehensive result consists completely of foreign currency translation which may be reclassified subsequently to profit or loss.

Our Culture

At CM.com, our actions are driven by a positive entrepreneurial spirit that fits seamlessly into the framework of our global organization. We seek to hire and nurture individuals who are eager to innovate, develop, and lead in their field. Our employees are not only encouraged to be free thinkers with a growth mindset but are also valued as team players. Our non-hierarchical structure empowers everyone to contribute based on their unique strengths and interests. And, of course, we make it a point to have fun together – an essential component for sustaining our vibrant culture!

At the heart of our culture are four shared values:

• Drive & Lead: We are action-oriented, seizing opportunities, acting decisively, and sharing information transparently.

• Grow & Learn: Creative solutions, informed perspectives, effective implementation, continuous reflection, and learning from mistakes define our approach.

• Together & Care: Humility, approachability, and empathy guide our interactions, fostering inclusiveness and integrity.

• Speed & Change: We embrace change and navigate uncertainty with an open mind, continually enhancing our skills.

We are committed to maintaining our culture to drive sustainable growth, with shared values at its core, enabling us to embrace change, adapt, innovate, and thrive in a dynamic environment, contributing to the creation of sustainable long-term value. Our DNA is captured in the principle “Do what you like, do what you’re good at, and contribute” — inspiring our employees to find purpose in their work, use their strengths, and make a meaningful impact every day.

The tree is a perfect metaphor for our organization, capturing the essence of our organic, non-hierarchical growth. From roots to leaves, every part functions in harmony and contributes to the health of the whole organism. Our organizational structure empowers small, self-managed teams to innovate, grow, and nurture talent, all while supporting colleagues across the entire organization. This unity defines CM.com and drives us toward sustained success.

At CM.com, we believe the growth of our people is essential to the success of our organization. That’s why we actively invest in learning opportunities, training programs, and personal development at every level. We don’t just train for skills, we train with purpose. Across all our training programs, we mix colleagues from different departments and business units. This encourages cross-functional collaboration, strengthens our internal network, and creates opportunities for knowledge sharing. Besides this, we link our trainings to our CM.com Shared Values to promote these and foster these internally, ensuring to reinforce CM.com’s unique culture.

Beyond many department-specific and team workshops, we also invested in company-wide programs:

In 2025, we launched the CM.com Leadership Program. This was our first dedicated training for current team leads. This program focuses on what it means to be a lead within CM.com: examples of training elements are mastering conversation techniques, absence management, and human skills to reinforce our CM.com Shared Values (Drive & Lead, Grow & Learn, Together & Care, and Speed & Change). Our ambition is to make our leadership training a yearly initiative, ensuring that every team lead is equipped with the right tools to lead with impact.

Since 2021, our CMBA talent program has helped accelerate internal talent across departments. The CMBA focuses on personal leadership, business strategy, and operating in a global context. Within the CMBA, we focus on two groups; The Rising Stars and The Future Leaders. In 2025 both of the groups have finished this program successfully. In November 2025, we started with two new groups with colleagues from all around the world. A quote from a CMBA candidate; “The CMBA helped me step out of my daily bubble and connect with colleagues from different parts of the organization. It expanded my internal network and gave me a broader understanding of the business, which has been invaluable in my day-to-day work.”

Our Young Professional Program offers monthly soft skills training sessions derived from our CM.com Shared Values. These sessions are designed to strengthen communication, collaboration, and critical thinking skills early in our colleagues' careers. Besides this, it helps our young professionals in increasing their internal network and provides the opportunity to learn from colleagues from different areas within the company.

In 2025 we had trainings on: Communication, Feedback, Networking, Presenting Skills, Thriving through Change, Mastering Productivity, and more. In 2025 we have decided to open up the trainings for colleagues from outside the Young Professional Program as well, when seats were available.

To help new colleagues hit the ground running, our 3-day Global Onboarding Program connects them to our culture, systems, and teams. This recurring program has been running for several years, forming valuable connections across departments and regions.

As we move into 2026, our ambition is to keep raising the bar for ourselves. We want to continue with the successful programs, but also want to expand with other type of trainings. From AI skills to soft skills and departmental training, we will continue to invest in the growth of our people, which in turn drives the growth of our company.

We believe that AI empowers our customers to get more value out of our products, while also offering opportunities to make work smarter, simpler, and more enjoyable within our own organization. Our ambition is to embed this AI-driven mindset deeply into our culture and daily operations.

At the core of our culture is the principle of digital inclusiveness — ensuring that technology, particularly AI, is accessible and beneficial to everyone. We recognize that the rise of AI may widen social inequalities if access to technology, knowledge, or skills is unevenly distributed. At CM.com, we take a proactive stance in addressing these challenges both internally and in society at large.

Within our organization, we encourage every employee to explore and apply AI in their work. During recruitment, we emphasize that all employees should be capable of creating an AI agent — a reflection of our hands-on, innovative spirit. Employees receive access to AI tools and training, and we share knowledge through initiatives like the “Agent of the Week” competition, AI workshops, and the AI Frontrunners community, where colleagues exchange insights and benchmark tools globally.

In addition, our annual DEV Days event, where we bring together all developers for learning purposes, also had a strong focus on AI workshops and the use of AI within our development teams. Our quarterly meetings feature live AI demonstrations, showcasing how AI can enhance daily work — for example, by using our Voice Agent to place real-time orders.

Beyond our own workforce, we are committed to bridging the digital divide in society. We recognize that future generations need equal access to AI education to thrive in a rapidly changing world. To contribute to this, CM.com offers AI training initiatives and collaborates with primary schools, in partnership with JINC, an organization supporting schools in underprivileged areas. By introducing children — especially girls — to technology in a creative, accessible, and inclusive way, we aim to inspire future talent and break down gender stereotypes in the tech industry.

At CM.com, we believe that technology should empower people. By fostering digital inclusiveness, developing AI skills, and nurturing a culture of curiosity and collaboration, we strive to create a future where innovation benefits everyone — both within our company and beyond.

Our Commitment to Sustainability

In 2025, we continued to make strides in advancing our Environmental, Social, and Governance (ESG) agenda. Despite the ongoing uncertainty surrounding the implementation of the Corporate Sustainability Reporting Directive (CSRD), as well as the amendments thereto under the Omnibus I-package, we remained committed to the path we have set. Building on the commitments outlined in our previous sustainability statements, we have worked diligently to integrate ESG considerations into our strategy, operations, and stakeholder engagement.

Our approach to material topics has evolved further this year, guided by both intrinsic motivation and a business perspective. Recognizing the growing importance of energy provision and talent acquisition — particularly in the context of AI — we have deepened our focus on these areas. While AI requires significant energy resources, it also offers great potential to drive sustainable innovation for both our customers and our organization. To fully leverage this potential, we are investing in attracting and developing top AI talent through collaborations with leading knowledge institutions in the Netherlands. This includes offering internships, co-developing AI curricula, and inspiring the next generation through educational initiatives in AI and robotics for young children. This ensures a future pipeline of talent to advance sustainability and innovation.

As climate change is a material topic for CM.com, we continue to measure our emissions, refine our approach, and contribute meaningfully to the transition to a low-carbon economy. Additionally, we expanded our circular economy practices, increasing the use of recycled materials in our supply hardware chain and minimizing waste generation across our operations. These efforts were supported by enhanced data collection and monitoring systems, ensuring transparency and accountability in our environmental performance.

Our DMA-driven approach to social responsibility focuses on fostering an inclusive and equitable workplace while addressing broader societal challenges. On the next page, we further highlight our commitment to improving digital accessibility, demonstrating our efforts to help create more inclusive online experiences for people with disabilities. In 2025, we strengthened our diversity, equity, and inclusion (DEI) programs and placed strong emphasis on employee well-being. We introduced several initiatives to promote mental and physical health, including an in-house lunch ordering system to minimize food waste while providing healthy meals, the launch of CM Vitalize Week with discounted gym memberships, and employees also gained access to a range of well-being programs and support services addressing both mental and physical health. Beyond our organization, we expanded our community engagement efforts, investing in local partnerships that tackle key social issues such as education, poverty, digital inclusiveness, and economic empowerment. Recognizing the crucial role of talent in driving innovation and growth —particularly in the age of AI— we have made talent acquisition and development a central element of our social responsibility strategy.

Strong governance is the foundation of our ESG strategy, and the double materiality assessment ("DMA") framework has been instrumental in shaping our approach. In 2025, we enhanced our governance framework by adopting more robust policies on ethical business practices, data privacy, and supply chain transparency.

While we are proud of the progress made in 2025, we recognize that there is still much work to be done. As we move forward, we remain steadfast in our commitment to driving positive change and addressing the challenges of climate change, social inequality, and ethical governance. By continuing to align our actions with the DMA framework and our long-term sustainability goals, we aim to create a more sustainable and resilient future for all.

We thank our employees, partners, and stakeholders for their unwavering support and collaboration in advancing our ESG journey. Together, we are making a meaningful impact and building a legacy of sustainability for generations to come.

One in six people globally lives with a significant disability. While accessibility refers to the technical ability to use products and services, inclusion relates to the feeling of being able to participate fully. At CM.com, we aim to address both.

Driven by our Be part of it philosophy, we feel a strong intrinsic motivation to make our products and services accessible to everyone. Although our business model is primarily B2B, our solutions are used by millions of consumers. We therefore see it as our responsibility to consider accessibility across the entire chain, even in situations where we are not formally accountable.

Accessibility is equally important within our own organisation. Everyone should be able and feel welcome to work at CM.com, which means our internal systems and tools must also meet accessibility standards.

From June 2025, the European Accessibility Act enforces digital accessibility requirements for web shops and communication services. Our dedicated Accessibility project owner is leading the company-wide Accessibility initiative, embedding it into our organizational DNA as a social responsibility beyond regulatory compliance. Together with our Head of Risk & Compliance, he has established a robust audit structure that recognizes that accessibility is not a one-time fix but a continuous journey in which we keep investing. The initiative is focused on driving a cultural shift toward accessibility across all aspects of our organization. Raising awareness through knowledge sharing and workshops, creating ambassadors, and embedding the discipline in fostering collaborations between legal, HR, compliance, product, and client.

We initially focused on implementing the necessary changes in the core of our products, our Design Language System “Aurora”, to ensure we can support clients using assistive technologies. Company-wide iterative internal audits of all products are conducted. Each product is assessed against the EN 301 549 accessibility standard, with findings and remediation plans documented. Two CM.com employees are currently pursuing the internationally recognized CPWA certification from the International Association of Accessibility Professionals to further improve their expertise.

Beyond these assessments, we aim to strengthen internal capabilities by exploring the training of accessibility ambassadors and offering enhanced training for R&D teams.Our goal is to embed Accessibility-by-Design into our development lifecycle, supported by clear governance and reporting to ensure lasting accountability.

We invest in strategic partnerships that embrace this topic and bring expertise and substantial experience on accessibility. Through these collaborations, we jointly share knowledge with the market and support clients in achieving their accessibility goals. These efforts not only allow us to increase our collective societal impact but also strengthen our reputation and open opportunities in sectors, such as the public domain, where accessibility requirements are especially stringent.

Shareholder Value Creation

CM.com is committed to creating value for investors over both the short and long term. This is achieved through the focused execution of its strategy, aligned with ambitious financial and non-financial objectives. Building and maintaining strong relationships with the investor community remains a priority, supported by transparent communication and fair disclosure. By providing accurate, complete, and timely information, CM.com enables investors to make informed decisions. Through press releases, webcasts, conference calls, and other communication channels, CM.com offers clear insights into its performance, strategic progress, and key developments.

Throughout 2025, CM.com actively engaged with the investor community to update stakeholders on its growth strategy and financial developments. In February 2025, alongside the publication of the FY 2024 results, CM.com launched a comprehensive refinancing package to replace the outstanding € 100 million convertible bonds by a debt package of € 80 million. CM.com was able to redeem the outstanding convertible bonds early at a discount, paying € 87 million for all the outstanding bonds. Next to that, CM.com strengthened its balance sheet by issuing € 20 million in new equity at € 6.70 per share.

On November 5, 2025, CM.com received an unsolicited, non-binding indication of interest from Bird to acquire all issued and outstanding shares in CM.com N.V. After careful review in line with our fiduciary duties, the Management Board and Supervisory Board unanimously concluded that the proposal did not reflect the current and future value of CM.com, nor did it offer a more compelling path for our clients, employees, or shareholders than our stand-alone strategy.

CM.com's remains committed to executing the profitable growth strategy outlined at the Capital Markets Day, leveraging its strong technology platform, AI capabilities, and global footprint to create long-term value for all stakeholders. In line with its long-term strategy, CM.com has set financial ambitions towards 2028, including gross profit growth of at least 15% year-on-year, a gross margin of approximately 35%, and an EBITDA margin between 12% and 15%.

In November CM.com further strengthened its capital position through a € 5 million private placement with Dutch entrepreneur Valentijn Rensing, founder of Youfone. CM.com issued 1,020,408 new shares at € 4.90 per share, in line with the authority granted by the Annual General Meeting of Shareholders, resulting in an initial stake of approximately 3% for Rensing, with the intention to increase this to above 5%. This long-term investment from an experienced telecom entrepreneur underlines the confidence in CM.com’s strategy, technology, and market position, while providing additional financial flexibility to support our balance sheet and accelerate our strategic growth initiatives.

CM.com is committed to providing accurate and timely information to shareholders, investors, analysts, and other stakeholders. This, to ensure all parties remain well informed about CM.com’s strategy and performance. Financial and strategic updates are shared through annual reports, interim reports, press releases, and the company website. CM.com’s Investor Relations page serves as a central hub for financial calendars, reports, press releases, presentations, webcasts, and shareholder information. Investor Relations acts as the primary point of contact for current and potential shareholders, analysts, and other stakeholders.

CM.com adheres to high standards of integrity and compliance with applicable laws, regulations, and best practices. To ensure compliance and transparency in interactions with investors and other stakeholders, CM.com has a Bilateral Contact Policy.

Ahead of financial results announcements, CM.com observes silent periods during which it refrains from engaging in meetings with analysts or shareholders. Silent periods last 30 days before the publication of annual and semi-annual results and seven working days before the release of first- and third-quarter trading updates.

In 2025, CM.com successfully restructured its capital base. Following the early redemption of € 100 million convertible bonds due in September 2026, CM.com now has an € 80 million Revolving Credit Facility (RCF) with HSBC, ING, and ABN AMRO. This facility was utilized to repurchase the convertible bonds for € 87 million. Additionally, CM.com issued € 20 million in equity to strengthen its balance sheet and allocated small amounts of shares for its Long-Term Incentive Plan (LTIP) and Restricted Stock Unit (RSU) programs.

On November 12, 2025, CM.com issued € 5 million worth of shares separately to Coöperatie Rensing Group in a private placement agreement. This was the result of months of engagement and discussion and resulted in an expansion in number of shareholders by investors such as Gleneagles B.V.

The company remains committed to maintaining a robust capital structure to support its growth strategy and deliver value to shareholders.

CM.com has one type of share, which is an ordinary share. Each share has equal weight and voting rights, where one share equals one voting right.

NUMBER OF SHARES OUTSTANDING

CM.com is a founder-led company, with the two founders jointly owning 44% of the shares at December 31, 2025. In 2024, the two founders announced a sell-down program, to be spread over 7 years. This, to reduce their aggregate holdings from approximately 50% to 40% to improve liquidity in the shares.

Following the refinancing transaction and the subsequent issue of new shares in February 2025, the founders paused their sell-down program for a period of at least 12 months and participated as buyers in the share issue. As a result of the private placement on November 12, 2025, the founders’ shareholdings were diluted to 22.0% each.

Currently, CM.com’s free float is approximately 41%. CM.com strives to increase the share of institutional investors supportive of its growth strategy, while further enhancing its visibility in global capital markets and improving share liquidity.

As per the Financial Supervision Act, the Act on the Disclosure of Major Holdings in Listed Companies (WMZ), and the Decree Takeover Directive, the following parties are known to CM.com as shareholders with an interest of 3% or more of the share capital of CM.com on December 31, 2025:

The Management Board members have the following shareholdings in the company:

• Jeroen van Glabbeek (CEO): 7,298,228 shares

• Gilbert Gooijers (COO): 7,298,228 shares

On November 1, 2025, Jörg de Graaf stepped down as Chief Financial Officer (CFO) of CM.com. Until his departure, Jörg de Graaf held 13,747 shares in CM.com.

The Chairman of the Supervisory Board, Jacques van den Broek, owns 5,500 shares in CM.com since June 5, 2023. Furthermore, Supervisory Board member Stephan Nanninga indirectly owns 105,679 shares of CM.com via his 25% ownership of Lindespac B.V. These shares stems from his earlier shareholding in Dutch Star Companies ONE N.V., which was renamed into CM.com N.V. Other members of the Supervisory Board do not own CM.com shares.

SHARE PRICE INFORMATION¹

1. Source: Investing.com

Currently, ING, ODDO ABN AMRO BHF, and Kepler Cheuvreux analysts actively cover the CM.com share. Although analyst reports and valuations contain the independent views of analysts and not ours, they are of great importance to us. These reports help (institutional) investors make well-informed investment decisions. The following analysts cover CM.com as of the date of this annual report:

CM.com intends to retain any future distributable profit to expand the growth and development of the company’s business and, therefore, does not anticipate paying any dividends to shareholders in the foreseeable future. CM.com’s dividend policy can also be found on our company website.

Risk Management

As a global and entrepreneurial company, CM.com continuously seeks to balance effective risk management with regulatory compliance across the organization. Risk and compliance management is embedded throughout the organization and forms an integral part of both strategic decision-making and day-to-day operations.

In 2025, CM.com further refined its risk management methodology to align with its evolving services and regulatory environment, including enhancements to the Enterprise Risk Management framework, compliance mapping, and alignment with ISO standards and applicable legislation. These updates, approved by the Management Board and the Audit Committee, strengthened accountability, transparency, and reporting quality.

CM.com applies the principles of the three-lines model to ensure effective governance, dependable risk management, and a robust internal control system. Within this framework, the business (first line), Risk and Compliance (second line), and Internal Audit (third line) operate independently while working in close collaboration.

First-line management is responsible for identifying, managing, and mitigating risks within CM.com’s defined risk appetite, which accepts low to moderate risk magnitudes and remains unchanged compared to previous years. Risks assessed as substantial or high exceed this risk appetite and require enhanced or additional control measures. Risks are managed through a combination of Actively Managed Risks (AMR), which require direct oversight, and risks monitored through the Internal Control Environment (ICE). The allocation between AMR and ICE is regularly reviewed by senior management, supported by independent oversight from the second line.

Second-line risk management and assurance activities support the first line through risk assessments, advice, and improved reporting, while maintaining independent oversight. A single, consistent risk management methodology is applied across the organization, enabling alignment between risk identification, control implementation, and assurance activities. An annual plan is prepared based on stakeholder interests, external developments, audit outcomes, and internal changes such as reorganizations, new products, and the effectiveness of risk management practices.

Trust in the quality, reliability, and compliance of CM.com’s services underpins sustainable growth. CM.com supports this trust through transparency, proactive compliance with applicable legislation, and adherence to recognized industry standards, including ISO and PCI, supported by independent assurance such as ISAE 3402. Relevant assurance outcomes are made available through CM.com’s Trust Center. In response to customer expectations and technological developments, CM.com expanded its assurance framework in 2025, adding ISO 27701 certification for privacy information management within CPaaS services and ISO 42001 certification for AI management systems. Existing certifications, including ISO 27001, were successfully renewed, and additional certifications were obtained where required, such as HDS certification for the French market and ISAE 3402 Type 2 reports for payment services.

A culture of integrity and compliance is promoted across CM.com through awareness initiatives, support in the implementation and testing of controls, and adherence to applicable laws, regulations, and internal policies. In 2025, the focus was on early engagement with the business, close collaboration with Legal and the CISO, and embedding new legislation into operational procedures. Compliance is validated through control testing and risk reporting.

During the year, two concerns related to business ethics were raised via the Speak-Up channels and were handled appropriately. These cases highlighted opportunities to further strengthen awareness of company values and the code of conduct, resulting in the introduction of mandatory compliance, privacy, and security training. Participation is monitored and incorporated into performance reviews under the “Grow & Learn” company value.

The Internal Audit function fulfills the third line of defense within CM.com and operates in accordance with the Dutch Corporate Governance Code. Internal Audit provides independent assurance to the Management Board and the Supervisory Board Audit Committee on the quality and effectiveness of internal controls, risk management, governance, and systems and processes across both the first and second lines of defense. Each year, a risk analysis is performed to determine the scope of the annual audit plan. The 2025 audit plan was approved in December 2024, and progress and outcomes were reported quarterly to the Management Board and the Audit Committee. In line with the Dutch Corporate Governance Code, an external quality assessment of the Internal Audit function was conducted in the fourth quarter of 2024, concluding that the function complies with the requirements of the Code. The next assessment is scheduled to take place by 2029.

As of 2025, the Statement on Risk Management (Verklaring Omtrent Risicobeheersing – VOR) has become applicable under the Dutch Corporate Governance Code. CM.com acknowledges the importance of this statement as a key governance instrument to enhance transparency regarding the design, implementation, and effectiveness of the company’s risk management and internal control framework.

In response to the VOR requirements, CM.com has further strengthened its enterprise risk management framework. This framework covers the full scope of financial reporting, sustainability, operational, and compliance risks, which are embedded in the Key Topics section. Based on the company’s risk appetite, an appropriate risk response is defined for each material risk, including the design of controls and, where relevant, targeted control testing.

The effectiveness of the risk management and internal control framework is defined as the degree to which material risks are:

• appropriately identified and assessed;

• mitigated through adequately designed and operating controls; and

• continuously monitored, escalated, and remediated where necessary.

Identified deficiencies and improvement actions are recorded in a central Improvement Register, including clear ownership, timelines, and prioritization based on risk impact. Progress is monitored through dashboard reporting and is periodically reviewed by the Management Board.

Management has assessed the effectiveness of the company’s risk management and internal control framework based on the implementation of the approach described above and on the findings and observations substantiated through reporting by the Risk and Compliance team. This assessment forms the basis for the In Control Statement included in this Annual Report.

CM.com operates in a rapidly changing environment where risks are increasingly interconnected. While established risk themes remain relevant, new legislative, technological, and societal developments continue to reshape priorities. Managing these risks in an integrated and forward-looking manner is essential to maintaining stakeholder trust and supporting sustainable growth.

Technological developments, particularly in artificial intelligence, present both opportunities and risks.

AI enables efficiency gains and new customer value propositions, while also challenging existing business models. At the same time, stakeholders - especially customers and employees - are becoming more vocal, with sustainability and climate-related topics driving much of this engagement. CM.com actively incorporates these perspectives into its strategy.

Cybersecurity and data protection remain among the most critical risks. The increasing use of AI by threat actors has intensified the speed and sophistication of cyber threats, making employee awareness and a strong security culture as important as technical safeguards. Regulatory developments such as DORA and NIS2, applicable from 2025, further reinforce the need for a resilient and comprehensive approach to ICT risk management.

Artificial intelligence also introduces regulatory and ethical considerations. The EU AI Act, effective in 2025, requires transparency, governance, and responsible use of AI. CM.com addresses these requirements by promoting AI literacy and embedding governance frameworks within its services, enabling innovation while ensuring compliance.

Regulatory complexity continues to increase, driven by developments such as GDPR, PSD2/PSD3, DORA, the European Accessibility Act, sustainability reporting updates including the Omnibus I package, and telecommunications regulations. CM.com closely monitors these developments and adapts its operations accordingly.

External uncertainties, including geopolitical developments and macroeconomic volatility, may impact global trade, supply chains, and customer demand. Strengthening organizational resilience, therefore remains a priority. This includes managing talent and human capital risks, as competition for skilled IT and AI professionals intensifies and employee expectations continue to evolve.

See the Key Topics section for more details.

CM.com continues its journey to become a talent-driven organization where employees are supported in their development and contribute to the objectives of CM.com. To achieve this, the focus is on retaining highly qualified talent and supporting employees in optimizing their career paths to take on roles that best match their skills and ambition, supported by the internal vacancy portal.

As part of the CM.com people strategy, we focus on hiring young, entry-level talent and developing them internally through functional growth paths and talent management programs, such as the CMBA and leadership programs. Employee learning and development are further supported through an expanding range of trainings offered via the CM Academy (online learning platform). CM.com aims to optimize the individual development potential of our current and future employees.

CM.com continues to actively embed its culture and inclusive values across all teams globally through initiatives such as the D&I Taskforce and awareness trainings. Completion of mandatory trainings is increasingly integrated into the performance evaluation processes, reinforcing shared responsibility for inclusion, compliance, and professional development. As the emphasis on retaining and empowering highly qualified employees aligns with previous years, the risk level remains moderate.

The conversational commerce market will continue to evolve over the coming years, moving from the simple one-way interactions of the past to a richer form of customer engagement enabled by technological innovation. Our future success depends on our ability to respond timely to commercial and technological developments, as well as the success of new product introductions, which rely on the effective execution of our R&D programs. If our go-to-market and service development strategies are not aligned, we risk being outpaced in the rapidly changing and highly competitive markets in which we operate.

To stay ahead of the competition, we create value by innovating our services and platforms to support our strategy. Standardization, consolidation, and scalability are key themes driving the development of our product portfolio today. As we continue this path, we will ensure that our products are integrated into one platform and will constantly monitor the wider market to avoid missing critical commercial and technological advancements. Over the past two years, we have increased our focus on AI innovations, leading to a strategy of being an “AI-First” company.

The major outcome of this strategy is the release of our own AI Platform, HALO, in 2025. HALO unites everything needed for customer experience in one platform, combining AI Agents, Messaging, Voice, Data, and Marketing—all developed, owned, and operated by CM.com.

Access to capital markets and an accurate view of future funding needs are essential to the implementation of our strategy. We need to maintain strong and transparent relationships with the capital markets and banking partners to reflect the fundamental value of our business and maintain financial and strategic flexibility. CM.com is listed on Euronext Amsterdam. Since our listing, we have devoted considerable time and effort to building investor interest in CM.com.

CM.com manages financial risks, including credit, market, and liquidity risks. Credit risk from customer receivables is mitigated through credit limits, monitoring, and actions on overdue invoices. Market risk includes interest rate exposure on the € 80 million revolving credit facility (EURIBOR + margin) and foreign currency risk, particularly USD, partially offset by natural hedging. Liquidity risk is managed through budgets, cash flow planning, and the revolving credit facility to ensure sufficient liquidity under various conditions. For more information on these risks, reference is made to note 11 in the consolidated financial statements.

These financial risks, combined with the increased focus on EBITDA growth and compliance with financial covenants, have heightened sensitivity to performance metrics, raising the gross risk level from moderate in 2024 to substantial in 2025.

CM.com’s financial health is continuously monitored using key financial indicators, including Revenue, Gross profit growth, OPEX, EBITDA, Net debt, Leverage ratio, and cash position. Failure to respond adequately to changes in these metrics or reliance on inaccurate data could negatively impact the company’s strategy for sustainable growth. To mitigate this risk, robust accounting and reporting processes ensure accurate, complete, and timely financial reporting. These processes, along with the internal control framework, are reviewed annually to align with organizational changes, enhance financial insights, and strengthen controls.

Financial and operational performance metrics are monitored regularly. Monthly analyses by the Finance Department and periodic reporting, including quarterly forecasts, are shared with the Supervisory Board, Management Board, and leadership teams.

The security of our platform is our top priority. As this platform grows, so does the potential impact of a successful cyberattack. Failing to properly deal with cyberattacks could lead to loss of (customer) data as well as disruption or damage to our systems. Ultimately, any such disruption would lead to a loss of confidence in our brand. With our increasing presence at the center of society’s digital ecosystem, it is even more challenging and important to address these issues. We are, therefore, committed to continuously improving our security program. This is focused on improving the operational security of our platform and the security awareness of our employees.

Our commitment to cybersecurity remains a cornerstone of our operational excellence and a key driver of trust. Building on our foundation, we have strengthened defenses through comprehensive research, partnerships, and innovations. We have explored advanced security tools, ensuring our systems remain resilient. By collaborating with industry experts, we have enhanced security policies and optimized systems for improved configuration and audit capabilities. Our custom AI solutions are now more robust, and we have integrated effective tools for data discovery and analysis.

Our proactive incident response measures effectively address issues such as hardware theft, data leaks, physical breaches, and unauthorized access attempts. We have strengthened our security workforce by achieving and renewing key certifications, including ISO27001, ISO27701, and HDS, the French certification ensuring compliance with strict security and confidentiality standards for hosting health data. By designing tailored security awareness training programs and addressing vulnerabilities, we maintain a rigorous focus on platform security. Through cross-team collaboration, we have reinforced critical environments with robust threat modeling.

We remain committed to fostering a secure, stable, and trusted environment. Through smarter systems, advanced tools, and continuous training, we aim to further reduce incidents, strengthening CM.com's standing as a secure digital platform. Our journey in cybersecurity is ongoing, marked by dedication and a shared goal: unwavering security for every user.

CM.com recognizes that the need to safeguard service availability is paramount. To recover from disruptive incidents in the shortest possible time and ensure a rapid restoration of services, a significant level of planning and preparation is required. Therefore, CM.com has developed a comprehensive Business Continuity Plan to minimize potential damage to the business caused by major issues impacting our staff, office, and data center locations, or equipment.

In addition, CM.com has taken several measures to ensure that the likelihood of a major incident is minimized. These include continuous investments in the stability and performance of our cloud platform, and performing regular load and capacity tests on our platform and other services. We also perform disaster recovery tests based on different scenarios to align them with the current risks, such as critical supplier dependencies, ransomware, and geo-redundancy.  In addition, we enact backup and recovery strategies and build redundancy into our operations by establishing multiple server locations to host our cloud platform. Our Network Operating Center (NOC) monitors the availability and traffic across all our systems 24/7.

We adhere to the ISO 9001, ISO 20000, and ISO 27001 standards, which provide us with guidance to further improve and deliver our high-quality, reliable services.

Effective leadership and governance are key to CM.com, ensuring clear goals, open communication, and alignment with company values. A strong tone at the top, combined with a management strategy based on planning, doing, checking, and acting, drives performance, integrity, and informed decision-making.

CM.com’s Code of Conduct guides employees on ethical behavior, covering anti-corruption, human rights, and conflicts of interest, supported by the Speak-Up Policy for reporting concerns. Updated in 2025, the Code now includes real-life scenarios and ethical AI, reflecting CM.com’s AI-first strategy.

The Risk and Compliance team maintained and tested internal control frameworks in 2025, providing periodic risk reports to the Management Board and Supervisory Board. These reports ranked risks, monitored developments, and supported the In Control Statement, increasing awareness of key risks among stakeholders. Our governance includes accountability, measurable objectives, and agile practices.

We strive to deliver exceptional products and services, enabling our customers to enhance the lives of their own customers by making them easier, safer, and more beautiful. Customer experience is a core element of our company, and we focus on maintaining satisfaction and growing alongside our customers to better meet their needs. We believe that high customer satisfaction, paired with a strong brand identity, will help us attract new customers globally. Data plays a crucial role in this process. We integrate Customer Satisfaction Score (CSAT) and Customer Health Status measurements into our strategy to gain deeper insights into customer needs and target service improvements for maximum value delivery. By analyzing probability and data points, we mitigate churn and implement tailored customer plans to retain clients. Keeping our customers happy and expanding our base is key to achieving our growth ambitions.

In 2025, our AI capabilities advanced significantly, empowering our customers to excel in their customer engagement. Our commitment to the responsible development and use of AI systems earned us the ISO42001 certification, making us one of the first technology companies in the Netherlands to achieve this milestone.

The Risk and Compliance function at CM.com operates in a business partner model, combining independent oversight with close collaboration across the organization to ensure compliance with applicable laws and regulations. In response to increasing regulatory complexity and supervisory expectations, CM.com has continued to strengthen its governance, risk management, and compliance framework.

CM.com is committed to acting with integrity. In 2025, a revised Code of Conduct was implemented, supported by mandatory employee training that is actively monitored. High participation levels and the absence of substantiated misconduct or Code of Conduct breaches during the year indicate that the framework is operating effectively.

Legal and Risk and Compliance monitor and assess new and evolving legislation relevant to CM.com’s activities, including the EU Artificial Intelligence Act, the European Accessibility Act, and telecom-specific requirements. Identified compliance risks remain within the Management Board’s approved risk appetite and are assessed as moderate. Continuous enhancements to the compliance framework support a controlled and transparent operating environment.

For CM.com’s payments business, an updated Risk Appetite Statement guides risk management practices. All reporting and payment obligations to Dutch supervisory authorities were met in 2025. In line with European Banking Authority guidelines, a designated board member oversees anti-money laundering and financial crime prevention.

Internal audit findings are addressed with relevant risk owners to ensure timely remediation. Ongoing regulatory developments, including DORA, NIS2, and GDPR, are continuously embedded into operations to ensure demonstrable compliance.

In 2025, CM.com continued to advance its Environmental, Social, and Governance (ESG) agenda, recognizing the close interconnection between financial performance and sustainability. CM.com assesses its impact across its value chain and integrates ESG considerations into strategic and operational decision-making, while identifying and managing risks that may affect long-term performance.

Following extensive preparation in previous years to meet regulatory requirements such as the Corporate Sustainability Reporting Directive (CSRD) and the EU Taxonomy, CM.com further implemented its ESG framework in 2025. This included the full integration of the Double Materiality Assessment (DMA), which identifies and prioritizes material ESG topics.

CM.com strengthened its ESG controls, which are now subject to validation and verification. Sustainability reporting is subject to limited assurance by an external auditor, requiring CM.com to demonstrate effective control over ESG topics and related risks. As a result, ESG topics transitioned from Actively Managed Risk (AMR) to the Internal Control Environment (ICE), and the risk score was reduced to moderate.

In Control and Responsibility Statement

The Management Board states, based on the approach described above, that,
to the best of its knowledge:

• the Management Board report provides sufficient insights into any deficiencies in the effectiveness of the internal risk management and control systems with regard to the risks as referred to in best practice provision 1.2.1 of the Corporate Governance Code. In the 2025 financial year, no major failings have been detected;

• the risk management and control systems provide reasonable assurance that the 2025 financial reporting does not contain any material inaccuracies;

• based on the current state of affairs, it is justified that the financial reporting is prepared on a going concern basis;

• the risk management and control systems provide limited assurance that the 2025 sustainability reporting does not contain any material inaccuracies;

• the Management Board at balance sheet date is not aware that the internal risk management and control systems do not provide sufficient comfort that the operational and compliance risks are effectively managed considering the company's risk appetite, where "sufficient comfort" is to be read as: comfort considering our risk appetite, the complexity of our company, inherent limitations to these systems and other disclosures on these systems in our Management Board report; and

• the Management Board report states those material risks and uncertainties, as referred to in best practice provision 1.2.1 of the Corporate Governance Code, that are relevant to the expectation of CM.com’s continuity for the period of twelve months after the issue date of this Management Board report.

Properly designed and implemented risk management and internal control systems significantly reduce, but cannot fully eliminate, the possibility of human errors, poor judgment, deliberate circumvention of controls, fraud or infringements of laws, rules, or regulations, or the occurrence of unforeseeable circumstances. Another factor considered within CM.com’s risk management approach is that efforts related to risk management and internal control systems should be balanced against the costs of implementation and maintenance.

Each member of the Management Board declares that, to the best of his knowledge:

• the financial statements in this Annual Report 2025 are prepared in accordance with accounting standards (in accordance with International Financial Reporting Standards (IFRS) as issued by the International Accounting Standards Board (IASB), adopted and endorsed by the European Union (EU-IFRSs), and with the statutory provisions of Part 9, Book 2 of the Dutch Civil Code), and give a fair and accurate view of the assets, liabilities, and financial positions as at December 31, 2025 and profit or loss of the company (and its affiliates included in the consolidation taken as a whole);

• the Sustainability Report, which is subject to implementation of the CSRD into Dutch legislation covering financial year 2025, has been prepared in accordance with the sustainability reporting standards referred to in Article 29b of the Accounting Directive and with the requirements of Article 8(4) of Regulation (EU) No. 2020/ 852 of the European Parliament and of the Council of June 18, 2020, on the establishment of a framework to promote sustainable investment and amending Regulation (EU) 2019/2088 (OJEU 2020, L 198); and

• the Management Board Report includes a fair and accurate view of the position on December 31, 2025, the developments and performance during the financial year 2025 of the company (and its affiliates included in the consolidation taken as a whole), together with a description of the principal risks the company is confronted with.
  

Breda, The Netherlands

February 12, 2026

Governance

This chapter outlines the corporate governance framework of CM.com and provides insights into:

1. Our corporate structure, including corporate bodies and share capital.

2. The rules and regulations applicable to CM.com.

3. Diversity within the Supervisory Board, the Management Board, the Executive Committee, and Senior Management.

4. Other corporate governance matters.

CM.com is a public limited liability company, incorporated under Dutch law. Our shares are listed on Euronext Amsterdam. Accordingly, our governance framework is based on Dutch legislation and our Articles of Association, complemented by internal policies and procedures. Proper corporate governance, including a focus on sustainable long-term value creation and maintaining CM.com’s company culture, is an important component of our way of working.

CM.com has a two-tier board structure, with a Management Board and a Supervisory Board. The Management Board manages the company's operations and strategy, while the Supervisory Board provides independent oversight and advice. Both the Management Board and Supervisory Board report to the General Meeting, where shareholders exercise their voting rights.

The founders are actively involved as members of the Management Board. In addition to their executive positions, they are members of the Founder Committee.

CM.com's corporate bodies are:

• General Meeting.

• Supervisory Board, supported by the:

  • Audit Committee; and

  • Nomination, Selection, and Remuneration (NSR) Committee.

• Management Board, supported by the:

  • Executive Committee.

• Founder Committee.

Our shareholders are important for the governance of CM.com. In 2025, we engaged with shareholders through financial updates (some accompanied by webcast), an investor deep dive, the Capital Markets Day, press releases, and the Annual General Meeting held on May 9, 2025. Additional details are included in the Shareholder Value Creation chapter.

The Annual General Meeting is held within six months of the end of the financial year (31 December). Our next meeting is scheduled for 17 April 2026.

Shareholders may cast votes on agenda items of a General Meeting either in person or by proxy. Each share carries one vote, and resolutions are adopted by an absolute majority of the votes cast, with no quorum required, unless otherwise required by law or the Articles of Association.

Regular voting items include:

• Approval of the consolidated and corporate financial statements.

• Determination of the dividend – in line with the Dividend Policy.

• Advisory vote on the remuneration report.

• Discharge of the Management Board and Supervisory Board.

• (Re)appointment of the external auditor.

• Authorization of the Management Board, with Supervisory Board approval, to:

  • issue shares and grant rights to acquire shares; and

  • restrict or exclude preemptive rights.

• Authorization of the Management Board, with Supervisory Board approval, to repurchase shares.

Finally, the following actions (among others) require the approval of the General Meeting:

• Appointing, suspending, or dismissing a member of the Management Board.

• Appointing, suspending, or dismissing a member of the Supervisory Board, provided that the Founder Committee is authorized to do so for up to one-third of these positions.

• Discharging a member of the Management Board or Supervisory Board.

• Adapting a remuneration policy for the Management Board or the Supervisory Board.

• Determining the remuneration of the Supervisory Board.

• Issuing shares or granting rights to acquire shares outside the authorization provided to the Management Board by the General Meeting.

• Repurchasing shares outside the authorization provided to the Management Board by the General Meeting.

• Reducing the issued share capital.

• Taking any action resulting in an important change in the identity or character of CM.com.

• Adopting the annual accounts.

• Appointing an auditor.

• Amending the Articles of Association at the proposal of the Management Board that has been approved by the Supervisory Board.

The Supervisory Board advises the Management Board on a wide range of topics. In addition to advising the Management Board, the Supervisory Board supervises the Management Board. This supervision includes strategy, policies, risk management, and overall performance. For more information, please see our Supervisory Board Report.

The Supervisory Board consists of six members. Profiles of the members are included in the Supervisory Board Composition section.

Supervisory Board members are appointed by the General Meeting on the basis of a binding nomination from the Supervisory Board, while that the Founder Committee is authorized to appoint up to one-third of its members. Supervisory Board members are generally appointed for a period of four years and may be reappointed.

The first reappointment may be for a maximum period of four years. The second reappointment may be for a maximum period of two years, which may be extended by a further two years.

The Founder Committee may designate one member of the Supervisory Board as chair. Supervisory Board members may be suspended or dismissed by the corporate body that has appointed them.

The duties, composition, and statement of the Supervisory Board and its committees are included in the Supervisory Board Report.

The Management Board is collectively responsible for the overall management, strategic direction and performance of CM.com. It defines objectives, sets the strategy and risk management framework, and ensures effective daily operations. The Management Board may perform all acts related to achieving these objectives, except those which are prohibited by Dutch law or the Articles of Association or which are expressly assigned to the General Meeting, the Founder Committee, or the Supervisory Board.

The rules of procedure of the Management Board determine the division of responsibilities among the Managing Directors. The Management Board has delegated its responsibility to identify and consequently manage sustainability matters to the CFO. Despite this division of responsibilities, the Management Board remains collectively responsible for the management of CM.com.

In performing their duties, the members of the Management Board are guided by the interests of CM.com and its business enterprise, taking into consideration CM.com’s stakeholders. The Management Board provides the Supervisory Board with all information necessary for the Supervisory Board to exercise its duties in a timely manner. The Management Board submits resolutions to the Supervisory Board and/or the General Meeting and/or the Founder Committee for approval, as required by Dutch law, the Articles of Association, or the Management Board's rules of procedure.

In 2025 the Management Board consists of:

Profiles of the members are included in the Management Board Composition section. The proposal to appoint Geert Beullens as a member of the Management Board will be included on the agenda for the 2026 General Meeting.

Management Board members are appointed by the General Meeting through a binding nomination by the Supervisory Board. The founders have been appointed as Management Board members for an indefinite period. Both founders wish to continue in their active roles as Managing Directors for as long as possible to implement and safeguard CM.com’s long-term strategy.

Any member of the Management Board may be dismissed by the General Meeting. A resolution of the General Meeting to dismiss a Managing Director who is a founder requires a resolution adopted with a two-thirds majority of the votes cast, representing more than half of the issued share capital.

The Executive Committee enhances and broadens the knowledge and expertise supporting the Management Board. It assists in executing strategy and operational priorities.

The Executive Committee is bound by the Management Board's rules of procedure. Notwithstanding the existence of the Executive Committee, the rights and obligations of the Management Board under Dutch law, the Articles of Association, and the Dutch Corporate Governance Code remain in full force. Therefore, the Management Board remains accountable for the actions and decisions (if applicable) of the Executive Committee and bears ultimate responsibility toward the Supervisory Board and for CM.com’s external reporting to its shareholders.

On December 31, 2025 the Executive Committee consists of the Management Board members and:

The Founder Committee ensures that the founders remain actively involved in CM.com. The committee consists of: Jeroen van Glabbeek and Gilbert Gooijers, each appointed for an indefinite term.

A founder ceases as a member five years after ending active involvement in CM.com (i.e. not being a Management Board or Supervisory Board member or holding another meaningful and value-adding position within the CM.com group). In addition, a founder ceases to be a member of the Founder Committee, if: (i) the founders jointly hold fewer than 6,400,000 shares in CM.com; (ii) voluntarily resignation; or (iii) death.

The Founder Committee will meet at the request of any member of the Founder Committee. In 2025, the Founder Committee did not convene.

The Founder Committee has the right to:

• Approve the number of members of the Management Board and Supervisory Board.

• Appoint or replace the chair of the Supervisory Board.

• Directly appoint, suspend, and dismiss up to one-third of the Supervisory Board members.

In addition, a resolution of the General Meeting to (a) amend the Articles of Association, if the rights of the Founder Committee or the founders are prejudiced in the proposed amendment, (b) effect a legal merger, (c) effect a legal division, (d) effect any other form of corporate restructuring if such corporate restructuring requires a resolution of the General Meeting, or (e) dissolve CM.com, will require the prior approval of the Founder Committee. The Founder Committee has the right to decide at its discretion whether to exercise these rights.

Our Works Council is relevant for corporate governance in the Netherlands as certain resolutions are subject to its advice or consent. At CM.com, we value the views of our employees. Therefore, the Works Council is relevant in a broader sense. Accordingly, the Works Council and Management Board held meetings approximately every six weeks in 2025.

CM.com has a single class of shares, each carrying one vote. As at December 31, 2025, no shares were held in the treasury. No shares with limited entitlement to profits or reserves, nor bearer shares, have been issued. The company is not aware of any shareholder agreements restricting share transfers or voting rights.

CM.com has an Employee Share Purchase Plan, allowing employees to voluntarily periodically acquire shares at a fixed percentage of their gross salary. Additionally, CM.com has share plans as described under note 22. Share-based Payments of the consolidated financial statements.

CM.com is subject to various legal and regulatory requirements. Key corporate governance frameworks include:

As of this report, CM.com is not yet subject to the provisions of Dutch law applicable to large corporations. On 23 June 2023, CM.com lodged a declaration with the trade register of the Dutch Chamber of Commerce. Once the declaration has been registered at the trade register for three consecutive years, the large company regime (as included in articles 2:158 up to and including 2:164 of the DCC) shall apply to CM.com. This will lead to a further concentration of control for the Supervisory Board over certain decisions, resolutions, and transactions. Since the large company regime becomes applicable in 2026, CM.com will propose to amend its Articles of Association.

The Articles of Association ware last amended on April 30, 2020 and are available in English and Dutch.

The Corporate Governance Code, as amended in March 2025 applies to CM.com.

CM.com complies with the Corporate Governance Code and endorses its principles, with the exception of the following:

• Best practice provision 2.2.1 states that a member of the Management Board is appointed for a maximum period of four years. As addressed above, both founders have been appointed for an indefinite period. Whenever the position of the founders in their capacity as Management Board members leads to a conflict of interest, CM.com has a thorough procedure that must be followed.

• Best practice provision 4.3.3, which only applies to companies that are not subject to the large company regime, states that the binding nature of a nomination (for the appointment or dismissal of a Managing Director or a member of the Supervisory Board) may be canceled by a portion of the issued share capital not exceeding one third. The Articles of Association state that a majority of two-thirds of the votes cast is required for such a cancellation. As a result, the cancellation of the binding nature is currently only possible through a combined action of one or both of the founders, in their capacity as shareholders, and other shareholder(s). This deviation from the Corporate Governance Code is temporary and will be taken into consideration with the proposed amendment of the Articles of Association. When CM.com applies the large company regime, CM.com intends to update its Articles of Association accordingly.

All internal rules and policies are published on our company website, except for the Insider Dealing Policy. Whenever a person (internal or external) is added to an insider list, he or she will be notified along with the Insider Dealing Policy.

CM.com has the following internal rules and policies relating to Corporate Governance:

The following values are of such importance to CM.com that they are included in the Code of Conduct:

• Operating with integrity.

• Privacy & security.

• Social responsibility.

Some examples of how our values are effectively incorporated and complied with include:

• Our dedicated Data Privacy Governance Board, which consists of a multidisciplinary team of qualified professionals who govern our Global Privacy Program.

• CM.com’s Speak Up Policy and Speak Up line, which encourages and helps everyone within the CM.com group to raise concerns about any suspected misconduct, irregularities, or incidents.

• Mandatory training throughout the year of all employees on multiple security topics.

CM.com has set out its diversity targets for the Management Board, Executive Committee, Senior Management, and Supervisory Board in the Diversity & Inclusion Policy.

As in previous years, the diversity aspects taken into consideration are not limited to gender but also include nationality, age, education, and experience. The purpose of the Diversity & Inclusion Policy is to achieve a diversified composition of the boards to facilitate a well-balanced decision-making process and the proper functioning of the respective Boards.

During 2025, the composition of the Management Board changed, while the composition of the Supervisory Board remained unchanged. Following the departure of the company’s Head of Central Sales in 2025, the Executive Committee decreased by one member. In 2025, the composition of Senior Management also changed. Upon the departure of members of Senior Management, the company assessed whether and, if so, how the resulting vacancies would be filled. As a result, the size of Senior Management decreased by five members. In the assessment and fulfilment of vacancies, multiple factors were taken into consideration, including the company’s Diversity & Inclusion policy, while ensuring that the most suitable individuals were appointed to each position. This resulted in a slight increase in the representation of women in Senior Management to 38.7% in 2025 (2024: 36.1%), with men representing 61.3% (2024: 63.9%). The information presented below regarding the Executive Committee and Senior Management relates exclusively to employees of CM.com.

Following the above, CM.com’s male/female distribution is as follows, as of December 31, 2025:

Information about our policies and taken actions to meet and maintain our set diversity targets are included in the Social chapter of our Sustainability Statements.

In line with legislation, CM.com discloses its:

• Conflicts of interest.

• Anti-takeover measures.

• Transactions with shareholders holding 10% or more.

• Corporate Governance Statement.

CM.com is aware that the founders will continue as directors and are members of the Founder Committee while remaining (indirect) shareholders. If this (or any other situation) gives rise to a conflict of interest, the director may not participate in the deliberations and decision-making process on a subject where a conflict of interest exists. To avoid overlooking conflicts of interest, a (potential) conflict of interest of material significance must be reported to the chairperson of the Supervisory Board. The Supervisory Board decides whether a member of the Management Board has a conflict of interest. The rules on conflicts of interest for the Management Board members are included in the Management Board's rules of procedure.

For the year 2025, CM.com is not aware of any (potential) conflict of interest between the private interests or other duties of members of the Management Board and the private interests or other duties of members of the Supervisory Board toward CM.com. Consequently, the best practice provisions 2.7.3 and 2.7.4 of the Corporate Governance Code were complied with.

CM.com has not imposed restrictions on transferring (depository receipts of) CM.com shares. CM.com can take the following anti-takeover measures:

1. Issue shares. The Management Board can issue shares within the authorization granted by the General Meeting, subject to the Supervisory Board’s approval. If the authorization by the General Meeting toward the Management Board is absent (or used for other purposes), the General Meeting may resolve to issue shares.

2. Repurchase shares. The Management Board may repurchase shares within the authorization granted by the General Meeting, subject to the Supervisory Board’s approval.

3. 180-day response time (Dutch Corporate Governance Code). The Management Board and Supervisory Board may invoke a response time of up to 180 days.

4. 250-day reflection period (article 2:114b DCC). The Management Board, subject to the Supervisory Board’s approval, may invoke a legally binding reflection period of up to 250 days in response.

In 2025, CM.com did not enter into agreements with any of its directors or employees that would lead to a payment obligation on termination of employment in connection with a public offering.

For the year 2025, CM.com is, apart from the related party transactions disclosed in the Notes to the Consolidated Financial Statements, not aware of any transaction between CM.com and a shareholder holding at least 10% of the shares in CM.com.

The information required to be included in this Corporate Governance Statement as described in the Decree on the Content of the Management Board Report (Besluit inhoud bestuursverslag) can be found in the following sections of this Annual Report:

• The statement on compliance with the principles and best practice provisions of the Corporate Governance Code and deviations therefrom can be found in this section under the subsection ‘Dutch Corporate Governance Code.’

• Information concerning the main features of the internal risk management and control systems relating to the financial reporting process can be found under the ‘Risk' section and the ‘Supervisory Board Report’ section, subsection ‘Audit Committee.’

• Information regarding the functioning of the General Meeting and the main authorities and rights of the General Meeting can be found in this section, under the subsection ‘General Meeting.’

• Information regarding the composition and operation of the Management Board and the Supervisory Board and its committees can be found in this section, under the subsections ‘Management Board’ and ‘Supervisory Board’ and the ‘Supervisory Board Report’ chapter.

• Information regarding the Diversity & Inclusion Policy in relation to the composition of the Management Board, Supervisory Board, and Senior Management can be found in this section, under the subsection ‘Diversity' and the Social chapter of our Sustainability Statements.’

Management Board Composition

Jeroen van Glabbeek
(Dutch, 1979)

Founder, Chief Executive Officer (CEO) and Managing Director

Before founding CM.com as ClubMessage in 1999 together with Gilbert Gooijers, Jeroen van Glabbeek studied Technology Management at the University of Technology in Eindhoven (1997-2002). In 1998, he started his career as a project manager at Getronics PinkRoccade Civility. He also completed the Nyenrode Business University's Advanced Management Program in 2009. As of October 1, 2025, he is a member of the supervisory board of BOM Holding B.V. (Brabantse Ontwikkelings Maatschappij), an organization strengthening the Brabant economy through development, investment and internationalization.

Gilbert Gooijers
(Dutch, 1979)

Founder, Chief Operating Officer (COO) and Managing Director

In 1999, Gilbert Gooijers founded and launched CM.com (at the time still known as ClubMessage) together with Jeroen van Glabbeek. Gilbert Gooijers obtained a degree in Technology Management from the University of Technology in Eindhoven (1997-2002). He also completed the Nyenrode Business University's Advanced Management Program in 2009. Gilbert is a member of the board of Stichting TURF, a non-profit organization dedicated to stimulating and positioning Breda based on its potential and vision.

Supervisory Board Composition

Jacques van den Broek
(Dutch, 1960, second term)

Chair of the Supervisory Board and
member of the NSR Committee

Jacques van den Broek is the former CEO of Randstad N.V. and has held various leadership positions within Randstad for more than 30 years. He was CEO from 2014 to 2022. After graduating in law, he held a management position with an international trading company before joining Randstad. Currently, Jacques is chair of the supervisory board of Intergamma (leading DIY chain in the Netherlands and Belgium). He is also Chair of the board of the Leiden Academic hospital and since April 2025 a member of the board of Total Care. Finally, he chairs the Dutch Committee for Entrepreneurship, an advisory body of the Dutch Ministry of Economic Affairs.

Mariken Tannemaat
(Dutch, 1971, second term)

Vice-Chair of the Supervisory Board and
Chair of the NSR Committee

Mariken Tannemaat is a member of the supervisory boards of CM Payments B.V., and ABN AMRO Bank N.V. She also serves as a non-executive director at Prudential Assurance Company Limited and Investment Funds Direct Limited and advises the management board of Erasmus Enterprise B.V. Previously, she was Chief Innovation Officer (CIO) at Robeco and NN Group, where she oversaw the Customer & Commerce business unit at Nationale Nederlanden. She has also held key roles at ING Direct in Paris, London, and Amsterdam.

Stephan Nanninga
(Dutch, 1957, second term)

Member of the Supervisory Board and
Chair of the Audit Committee

Stephan Nanninga is a supervisory board member at Bunzl Plc, IMCD N.V., and Cabka N.V. Previously, he held executive roles at Technische Unie, CRH, and Royal Dutch Shell in the Netherlands and abroad. From 2007 to 2016, he was a board member at SHV Holdings N.V., serving as CEO from 2014 to 2016. Stephan will technically not be an independent member under the Dutch Corporate Governance Code, as he was a director of Dutch Star Companies Promotors Holding B.V., an associated company of CM.com N.V., five years before his appointment.

Lex Beins
(Dutch, 1965, second term)

Member of the Supervisory Board and
the Audit Committee

Lex Beins is the founder of Pyton Communication Services B.V., Beins Travel Group B.V., and cofounder of Cheaptickets.nl. In 2011, Cheaptickets.nl was merged into Travix International B.V. Lex served as a member of the supervisory board of P1Travel B.V. until July 2025. Currently, he is chairperson of the supervisory board of Écart Invest 1 B.V.

Joëlle Frijters
(Dutch, 1974, second term)

Member of the Supervisory Board

Joëlle Frijters is a technology entrepreneur and former CEO. She co-founded Improve Digital, which was sold to Swisscom in 2016, remaining CEO until 2017. Previously, she held international roles at Microsoft and KLM. Currently, she serves on the supervisory boards of Basic-Fit N.V., HightechXL Group B.V., and Timber and Building Supplies Holland N.V. (a HAL investment), where she is also on the remuneration committee. Additionally, she is an advisory board member at Cronos Groep and part of an independent commission overseeing TTT seed capital funds at the Netherlands Enterprise Agency.

Diederik Karsten
(Dutch, 1956, second term)

Member of the Supervisory Board and
the NSR Committee

Diederik Karsten is currently also a member of the supervisory boards of Holland Casino N.V. and of Stadion Amsterdam N.V. (Johan Cruijff Arena). Previously, he held supervisory board roles at, among others, VodafoneZiggo Group, easyJet (UK), E-Plus (Germany), ANP Holding and Telenet (Belgium). He has held several management positions in FMCG at Procter and Gamble and PepsiCo (in the Netherlands, UK, Germany and the US) and executive positions in the Telecoms and Media industries at KPN (as CEO Mobile N.V.) and at Liberty Global (as CCO of the group). 

Supervisory Board Report

Dear shareholders,

As we close the year 2025, I am pleased to address you on behalf of the Supervisory Board of CM.com. This year has been marked by significant innovation and the navigation of challenges that have further shaped CM.com. CM.com further strengthened its position as a trusted, innovation-driven partner for businesses worldwide, with one clear focus: building a single, intelligent Platform for Customer Interaction that connects every interaction between companies and their clients.

In 2025, CM.com advanced its long-term vision by adding powerful new capabilities to its unified platform. The launch of HALO, CM.com’s proprietary Agentic AI platform, was a pivotal milestone. HALO is an intelligence layer woven into the entire platform, enabling businesses to design smarter, more autonomous, and more personalized customer journeys across communication, payments, and live experiences. It reflects CM.com’s commitment to using AI as a practical, value-creating engine for its customers. The platform was further enriched with innovations that deepen engagement and trust.

The ticketing resale platform for events brings transparency, security, and control to secondary ticket sales, helping organizers protect their brands and deliver better fan experiences within the same CM.com ecosystem they use for primary ticketing, messaging, and payments. Voice AI, including its integration with WhatsApp and other channels, opens up new possibilities for people to interact naturally with businesses in a more intuitive and more accessible way. The continued rise of rich messaging channels such as WhatsApp and RCS was anticipated and embraced in the platform architecture, ensuring that CM.com’s customers can reach their audiences via interactive, high-impact conversations while relying on the platform’s strong global messaging backbone. These developments all serve the same strategic goal: one platform, powered by AI and data, that helps our customers deliver seamless, secure, and meaningful experiences at scale.

2025 was a year in which AI reshaped expectations for technology providers and enterprises alike. In this dynamic environment, CM.com sharpened its strategic focus around its core strengths: its integrated Platform for Customer Interaction, AI capabilities, and enterprise-ready compliance and reliability. The Supervisory Board has closely supported the Management Board as CM.com invested in HALO, platform integration, and operational excellence, positioning the company to capture new opportunities and drive profitable growth. We remain convinced that CM.com’s stand‑alone strategy – centered on one unified, AI-powered platform – offers the strongest foundation for sustainable value creation for customers, employees, and shareholders.

2025 also marked an important leadership transition. After 5.5 years, Jörg de Graaf stepped down as CFO of CM.com. Under his tenure, CM.com reinforced its financial steering capabilities and risk management framework, supporting the evolution from a fast-growing scale-up to a more mature, scalable technology company. On behalf of the Supervisory Board, I thank Jörg for his significant contribution and wish him every success in his next chapter.

We are pleased to welcome Geert Beullens as incoming CFO. With more than 22 years of experience at ASML, Geert brings deep expertise in driving profitable growth, scaling technology businesses globally, and maintaining financial discipline in complex, high-growth environments. His appointment reflects our commitment to strong governance, strategic clarity, and long-term value creation. Geert’s nomination will be formally presented at the upcoming AGM in April 2026.

As AI continues to transform markets and customer expectations, agility, creativity, and clear strategic focus remain essential. CM.com is well-positioned to benefit from these developments: it has a robust, scalable technology platform; an increasingly AI-native product vision; and a growing base of loyal enterprise and mid-market customers who depend on CM.com for critical customer interactions.

The Supervisory Board will continue to support and challenge the Management Board in executing the strategy: simplifying and strengthening the platform, embedding HALO more deeply across the product portfolio, and driving profitable growth with disciplined capital allocation.

On behalf of the Supervisory Board, I would like to thank our employees for their dedication, our clients for their trust, and you, our shareholders, for your continued support. Your confidence in CM.com’s mission and strategy enables the company to keep pushing boundaries and delivering on its promise: one platform that makes customer interactions easier, safer, and more meaningful.

Yours sincerely,

The composition of the Supervisory Board is in accordance with their profile. During 2025, the composition of the Supervisory Board remained unchanged following the reappointments in the Annual General Meeting of CM.com N.V. on May 9, 2025.

The Supervisory Board has an Audit Committee and a Nomination, Selection, and Remuneration (NSR) Committee. Each of the committees has a preparatory and advisory role to the Supervisory Board. The committees cannot adopt resolutions on behalf of the Supervisory Board. Each committee has a charter on its role, responsibilities, and functioning. Their charters are published on the company's website.

Meetings are convened at least four times a year following a schedule set annually by the Supervisory Board. Additional meetings are held at any Supervisory Board or Management Board request. The Supervisory Board held four meetings in 2025 and one offsite meeting in May for two days to discuss strategy in more depth. Furthermore, three ad hoc calls were arranged at short notice in early November to discuss the intended announcement of an acquisition proposal.

Given the low absenteeism rates, it is fair to conclude that the Supervisory Board members are dedicated to CM.com.

Supervisory Board meeting and attendance

The table on the next page contains information about the members of the Supervisory Board. Positions outside CM.com are included in the description of each member of the Supervisory Board. All members of the Supervisory Board are appointed in accordance with Dutch law.

83.3% (5 out of 6) of the Supervisory Board members meet the independence criteria as described in Sections 2.17 to 2.19 of the Corporate Governance Code. Only Stephan Nanninga does not meet those criteria. He was a director of Dutch Star Companies Promotors Holding B.V., an associated company of CM.com N.V., five years before his appointment as a member of the Supervisory Board. A Supervisory Director holds any (in)direct participation in CM.com (such as shares) as a long-term investment.

The Supervisory Board resolves issues by an absolute majority of the votes cast unless Dutch law, the Articles of Association, or the Rules of Procedure governing the internal proceedings of the Supervisory Board prescribe a larger majority.

A Supervisory Board member may not participate in the adoption of resolutions (including deliberations in respect of these) if he or she has a direct or indirect personal interest that conflicts with the interests of the company and its associated business enterprises. For the exact wording of the regulation, reference is made to the Supervisory Board Rules of Procedure. During 2025, no Supervisory Board member had a conflict of interest.

The Supervisory Board supervises the Management Board and the general course of business within CM.com. Its responsibilities include overseeing the company’s strategy, policies, management and overall affairs, as well as advising the Management Board on matters of strategic importance. The Supervisory Board also monitors the company’s relationship with its shareholders and other stakeholders.

The Supervisory Board met regularly throughout 2025, with meetings convened at least four times a year in accordance with an annual schedule set by the Supervisory Board. Meetings were generally held at the company’s headquarters in Breda and covered all aspects of the company’s operations and governance. In addition to the regular meetings, a two-day offsite meeting was held in May 2025 to discuss strategy in greater depth. Furthermore, three ad hoc calls were arranged at short notice in early November to discuss the intended announcement of an acquisition proposal. Additional meetings were held whenever requested by either the Supervisory Board or the Management Board.

Through these meetings, the Supervisory Board maintained a comprehensive and well-informed view of developments within the organization and its workforce. CM.com actively involved the Supervisory Board in the organization by inviting its members to internal events such as quarterly meetings and company gatherings, thereby ensuring strong visibility and engagement across the company. Members of the NSR committee attended the CMBA Rising Star and Future Leader final presentations, acting as jury members, and participated in the graduation ceremonies.

In 2025, the Supervisory Board devoted significant attention to refining the company’s strategic direction. Together with the Management Board, multiple strategic scenarios were explored to safeguard sustainable long-term growth and value creation. These scenarios were assessed with regard to market positioning, financial resilience and the ability to respond effectively to changing market conditions. Particular emphasis was placed on maintaining strategic flexibility and control over the company’s future, including preparedness for potential acquisition interest.

A key element of the strategy discussed was the continued use of artificial intelligence and digital transformation as drivers of differentiation and growth. The Supervisory Board supported initiatives aimed at strengthening CM.com’s positioning as a leading European technology provider, with a focus on a clear and simplified value proposition, product innovation and a strong commitment to privacy, security and certification standards.

Financial discipline formed an integral part of the strategic discussions. The Supervisory Board closely monitored the financial performance of CM.com N.V., receiving regular updates on EBITDA development, cash flow and forecasts. The Board reviewed and approved the annual budget and business plans, assessed covenant compliance and monitored liquidity and financing arrangements.

Rather than focusing solely on budget adherence, the Supervisory Board emphasized performance against strategic and financial targets, supported by rolling forecasts and strict performance management.

Profitability and sustainable value creation remained key focus areas throughout the year. The Supervisory Board regularly reviewed margin development, pricing strategies and monetization initiatives, with the aim of optimizing revenue quality and strengthening the company’s financial position. In addition, the design and operation of the internal risk management and control systems were evaluated to ensure their effectiveness and to support sound decision-making.

The Supervisory Board also recognized the importance of culture, leadership and talent development. Attention was given to fostering a positive and inclusive working environment, transparent communication and effective succession planning. Talent management and leadership development were discussed within the relevant committee structure, with a focus on retaining key capabilities and supporting long-term organizational continuity.

Diversity and inclusion were acknowledged as essential components of a strong and future-proof organization. The Supervisory Board, through its NSR committee, reviewed progress in this area and emphasized the importance of a balanced and inclusive workforce and leadership teams.

Through its meetings, interactions and oversight activities, the Supervisory Board remained closely involved with the company throughout 2025 and fulfilled its supervisory and advisory role with a clear focus on long-term value creation, sound governance and strategic resilience.

The Audit Committee supports the Supervisory Board in fulfilling its oversight responsibilities by supervising, monitoring and advising the Management Board on the effectiveness of CM.com’s internal risk management and control systems. In this context, the Committee oversees the integrity of the company’s financial and non-financial reporting, compliance with recommendations from internal and external auditors, the company’s tax policy and financing arrangements, as well as its information and communications technology, including cybersecurity-related risks.

The Audit Committee maintains regular contact with and supervises the external auditor, prepares the nomination of the external auditor for appointment by the General Meeting, and advises the Supervisory Board on the approval of the financial statements, the annual budget and major capital expenditures. In addition, the Committee supports the Supervisory Board in the exercise of its governance duties, including the preparation of nominations and reviews.

The Audit Committee meets as often as required for the proper performance of its duties and whenever requested by one or more of its members, but in any event at least four times a year. In 2025, the Audit Committee held six meetings. All Committee members, the internal auditor and the external auditor attended all meetings in 2025. The Chief Financial Officer (CFO) also attended all meetings, and the Chief Executive Officer (CEO) and business experts were invited for specific agenda items where relevant.

The agenda during these meetings combined recurring governance topics with developments relevant to CM.com’s operating environment and long-term objectives. Regular items included press releases, management reporting, the review of annual plans and budgets, and quarterly updates from Internal Audit and Risk and Compliance. These were discussed in conjunction with the company’s financial results, outlooks and forecasts, cost reduction measures, the refinancing of the convertible bonds and the monitoring of bank covenants, as well as the CFO transition and the HALO sales plan.

The Committee also addressed broader external and emerging risks, including ESG matters, geopolitical and macroeconomic developments, artificial intelligence (AI) risks and opportunities, fraud and integrity, and cybersecurity. These topics were assessed in relation to their impact on strategy, risk exposure and the control environment.

As part of its integrated oversight, the Audit Committee reviewed the 2025 annual plan of the external auditor, together with the engagement letter, management letter, auditor’s report, remuneration and reappointment. With regard to the 2025 interim and full-year financial statements, the Committee was satisfied with the explanations and findings provided by the Management Board and the external auditor and advised the Supervisory Board accordingly.

The Audit Committee also reviewed the 2025 Internal Audit Plan and Internal Audit Charter, which were approved by the Supervisory Board in December 2024. Quarterly Internal Audit reports provided insight into audit activities, findings and observations across the group. The Committee monitored the implementation of recommendations and the timely follow-up of agreed actions addressed to the business.

Finally, the Committee reviewed the company’s strategic plan and monitored its key risks, risk exposure, the In Control Statement and the design, operation and (level of) effectiveness of the risk management and internal control systems. In doing so, the Audit Committee also advised the Supervisory Board on the sustainability reporting process and material sustainability topics, enabling informed oversight and decision-making.

The Nomination, Selection, and Remuneration Committee advises the Supervisory Board on the exercise of its duties regarding the Remuneration Policy of the Management Board and prepares proposals for the Supervisory Board on these subjects. Both remuneration policies were adopted by the General Meeting at the proposal of the Supervisory Board on April 21, 2022 and continued to serve as the framework for compensation decisions during this reporting year.

The Committee’s duties include preparing the remuneration proposals for individual Management Board members for determination by the Supervisory Board, as well as, where applicable, preparing proposals for the Supervisory Board on an updated Remuneration Policy for the Management Board, to be adopted by the General Meeting. The Committee also advises the Supervisory Board on its duties regarding the selection and appointment of Management Board members, Supervisory Board members, and the consultation of the Founder Committee in that regard. The Committee meets whenever one or more of its members have requested such a meeting and at least twice a year. In 2025, the Nomination, Selection, and Remuneration Committee held five scheduled meetings and one additional interim call. Discussions during these meetings included:

• The remuneration of the Management Board, Supervisory Board, Executive Committee, and Business Unit Leadership teams;

• Management Board 2025 results for the Long-Term and Short-Term Incentive Plans;

• Target settings for the LTIP and STIP for the Management Board for 2026;

• Salary review process for 2026;

• Employee engagement;

• Succession planning of (Supervisory) Board Members;

• Equal pay for similar weight roles;

• Talent sessions focused on succession, potential assessment, and leadership development;

• Discussions on CSRD and ESG objectives and their integration into performance frameworks; and

• The transition toward a structured company (structuurvennootschap).

In addition, the NSR Committee progressed the search for a new CFO, working closely with an executive recruiter. Key criteria included gender balance, sector experience, finance expertise, geographical flexibility, and technological capability.

Benchmark data from the Amsterdam Small Cap Index remained the primary reference point for Management Board remuneration. European benchmark data were updated based on observed market movements and used as supportive information. The Committee also functioned as an important sounding board on engagement, leadership development, and target setting. In addition, the integration of the Customer Satisfaction Score (CSAT) and Customer Health Status measurements - replacing NPS - into the company’s strategy and as part of the LTIP framework, to gain deeper insights into customer needs and more targeted service improvements to maximise value delivery.

The Committee reviewed the organizational implications of CM.com’s transition toward a structured company, including the formal role of the Works Council. The Committee also discussed the composition and functioning of the Supervisory Board and its Committees, with attention to required expertise and a balanced division of roles.

Within CM.com, we are always looking for ways to improve. Therefore, the overall composition of the Supervisory Board, as well as the different committees and their members, have been evaluated.

The Supervisory Board evaluated its own performance, as well as that of its committees and members. During the individual-evaluation, the members of the Management Board were not present. The evaluation focused on: (i) substantive matters, interaction within the Supervisory Board or its committees, and the interaction with the Management Board; (ii) key events and lessons learned; and (iii) the desired profile, composition, competencies, and expertise of the Supervisory Board.

Based on the evaluations, the Supervisory Board concluded that, overall, its committees and members have functioned effectively and efficiently. The Supervisory Board appreciates the openness and transparency of the Management Board and the further invitations throughout the year. This allows the Supervisory Board to gain a broader and deeper view of the company and its business, while allowing its members to share their knowledge and experience.

At the 2025 AGM, two Supervisory Board members were re-appointed. The Supervisory Board reconfirmed that its current composition provides an appropriate balance of expertise, skills and experience.

A proposal will be submitted to the General Meeting to adjust Supervisory Board remuneration annually in line with CM.com’s merit increase.

The Supervisory Board evaluated the functioning of the Management Board as a whole and each member individually, with preparatory work by the NSR Committee. These evaluations took place without the presence of the Management Board.

Based on these evaluations, the Supervisory Board concluded that the Management Board continued to perform effectively and efficiently during the year 2025.

In addition, the Management Board conducted its own self‑evaluation, which led to similar conclusions.

Remuneration Report

The 2025 Remuneration Report is in line with the applicable Dutch legislation (Article 2:135b and Article 2:145(2) of the Dutch Civil Code and the Dutch Corporate Governance Code). The 2025 Remuneration Report will be submitted to the General Meeting of Shareholders for an advisory vote. The advisory vote during the AGM of 2025 on the previous Remuneration Report was overwhelmingly positive, with 100% approval and only 207 votes against. This strong support demonstrates alignment with shareholders' expectations and has been taken into account in preparing the 2025 Remuneration Report. The detailed voting results can be found on the company's website.

The Remuneration Policy for the Management Board and Supervisory Board is crafted to align with CM.com's long-term strategic goals. By offering competitive compensation tied to clear short- and long-term targets, we position ourselves to attract and retain capable directors who can steer CM.com forward as an entrepreneurial entity in a dynamic and challenging market landscape in order to remain at the forefront of innovation.

Our Remuneration Policy aims to drive high performance, addressing both financial metrics and personal objectives while rewarding talent in line with market benchmarks suited to CM.com. The core principles of our remuneration strategy are:

1. Attract and Retain Excellence: Provide a reward structure and compensation levels that are competitive with other internationally operating Western European companies of similar size and complexity, enabling CM.com to draw and maintain top talent and highly qualified directors.

2. Cultivate a High-Performance Culture: Foster an environment where Senior Management is keenly focused on achieving business outcomes that align with CM.com's strategy, purpose, and core values.

3. Ensure Fairness and Consistency: Maintain a reward framework that is internally consistent and equitable.

4. Support Strategic and Sustainable Growth: Reinforce the business strategy and promote long-term sustainable value creation for all stakeholders.

5. Adhere to Legal and Social Standards: Ensure compliance with local laws and regulations while remaining attentive to societal expectations.

To support the alignment of our Remuneration Policy with our long-term sustainable strategy, the Nomination, Selection, and Remuneration (NSR) Committee regularly reviews and evaluates the remuneration framework for the Management Board, as well as the remuneration of individual Board members.

When deemed appropriate, the NSR Committee submits corresponding proposals to the Supervisory Board for approval. For further details of the current Remuneration Report, please refer to the company's website, which includes the policy as approved by 93% of the votes at the General Meeting of Shareholders on April 21, 2022.

Remuneration for the Management Board

The remuneration for the Management Board contains a base salary, an short-term incentive (STI), and an long-term incentive (LTI), which together are referred to as the total direct compensation (TDC). The total remuneration complies with the Remuneration Policy. To support the alignment of our Remuneration Policy with our long-term growth strategy, regular reviews are conducted of the remuneration structure for the Management Board and the remuneration of the individual Board Members. The Company’s LTI principles are laid down in a long-term incentive plan (LTIP), which is an equity-based, pay-for-performance plan aimed at rewarding long-term performance and the delivery of stakeholder value. TDC is composed as follows, denominated as a percentage of the base salary:¹

Traditionally, CM.com focused on fixed remuneration (base salary), resulting in relatively low variable income compared to the market. To address this, the long-term variable component has been adjusted over time, most recently in 2024, when the on-target LTI percentage was raised to 40% in line with the Remuneration Policy approved on April 21, 2022, bringing TDC more in line with market practice.

In 2025, CM.com continued on its path toward improved profitability, guided by clear targets to support this goal, in particular through the Short-Term Incentive Plan, which includes challenging performance thresholds and carries the risk of lower variable payouts. Scenario analyses are conducted to assess the potential financial outcomes of both under performance and maximum performance. Various scenarios were discussed during NSR Committee meetings as part of the decision-making process. These analyses, combined with the ambitious targets set in line with our strategic objectives, are considered to be appropriate relative to the potential variable components expressed as percentages above.

The foundation of our reward strategy is the base salary, which provides our Board members with a guaranteed level of income paid in monthly installments. As noted above, CM.com has traditionally placed primary emphasis on this fixed component. When determining the appropriate base salary adjustments for each Management Board member, we consider, among other factors, the following:

We aim to reward our Management Board members at the midpoint of the relevant market.

For Management Board and Supervisory Board positions, we benchmark against the local reference market using the current constituents of the AScX index of Euronext Amsterdam, CM.com’s listing environment. Looking at the AScX companies, this results in a position of P25, as our average positioning within the AScX based on revenue and market capital is just above the 25^th percentile.

We are also using the European reference market as a secondary source of information, in line with the ISS best practice guidelines. Within this reference group, CM.com is positioned around the median.

Within CM.com, we place great importance on ensuring that salary levels are positioned fairly in relation to those of other employees within the organization. Consistent with our values, differences in salary should be driven by role characteristics (such as responsibility, relevant experience, complexity, and educational requirements) and not by personal characteristics, including age, gender, or ethnic background. For all executive roles, including Management Board members, internal salary positioning is reviewed annually based on the specific requirements of the role. Adjustments are made where necessary and are aligned with the general merit increase process applied throughout the organization.

Base salary levels for the Management Board are reviewed annually, using the relevant reference markets described above. For each position, we assess the appropriate placement of the Management Board member relative to the market midpoint for comparable roles. In the local reference market, this corresponds to positioning around the 25th percentile (P25), while in the European reference market positioning is aimed at the median. New salary levels are determined by comparing current salaries with the updated market midpoints, taking into account the general merit increase applied across the organization and, in particular, the adjustments granted to the most senior staff.

Base salaries within CM.com are generally targeted between 80% and 120% of the relevant market reference point. For the Management Board specifically, we also aim for Total Direct Compensation (TDC) to fall within 80% to 120% of the market midpoint.

Upon the recommendation of the NSR Committee, the Supervisory Board decided to increase the base salary of the CEO and COO by € 13,135 (3%) gross per annum to € 450,975 gross per annum, effective as of 1 January 2025. The base salary of the CFO was increased by € 9,438 (3%) gross per annum to € 324,038 gross per annum, effective as of 1 January 2025. These changes are in line with the increase received by employees with an succesful, based on a merit increase of 3% in September 2024.

Members of the Management Board are eligible for a cash-based, performance-related STI plan. STI awards are based on achievements against predetermined financial and personal targets, which are set annually by the Supervisory Board prior to the start of the performance period. The on-target STI opportunity for 2025 was set at 35% of base salary, which is consistent with the targeted TDC range of 80% to 120% of the market midpoint. STI payouts are determined based on actual performance between threshold and maximum levels, with awards calculated on a linear basis as follows:

The financial performance targets (75% of the STI scorecard) are set in advance, with weightings based on on-target performance, and results are adjusted to avoid distortion from unusual or one-off events outside the individual’s control. The STI targets for 2025 are directly derived from the 2025 annual budget, approved by the Supervisory Board on January 22, 2025. The budget does not include any future M&A; therefore, the impact of new M&A will be excluded from actuals. This approach reflects our continued focus on profitability and long-term sustainable value creation.

The financial objectives for 2025 are summarized in the table below:

1. Excluding severance and restructuring costs

Following the assessment of the Supervisory Board, and based on the recommendation of the NSR Committee, the overall financial score was 53.7%, reflecting a performance between threshold and on-target for EBITDA, an almost maximum performance for OPEX, and below threshold performance for both Gross profit and Free cash flow, whereby the NSR Committee exercised its discretionary authority with respect to Gross profit.

Personal objectives (25% of the STI scorecard) were set by the Supervisory Board in the form of clear and concise personal targets for each Management Board member for 2025, aligned with the following themes:

• Jeroen van Glabbeek (CEO): Strategic vision and leadership, value creation, specific business objectives, and executive sponsorship of the Pay business unit.

• Gilbert Gooijers (COO): Business unit operations, value creation sales & marketing, and executive sponsorship of the Live business unit.

• Jörg de Graaf (CFO): Corporate finance, value creation, specific business objectives, and executive sponsorship of the Engage business unit.

The personal targets set for 2025 directly reflect the Supervisory Board’s vision of achieving our long-term ambition of becoming a profitable and sustainable company. These targets are intended to drive long-term sustainable value creation.

Following the assessment of the Supervisory Board, and based on the recommendation of the NSR Committee, the personal objectives - representing 25% of the STI scorecard for individual Management Board members - were assessed at 85% for the CEO and 87% for the COO. The CFO did not receive an assessment due to his departure during 2025.

While significant progress was initiated across numerous initiatives in 2025, some of these efforts could not yet be brought to completion. This was primarily due to the Management Board’s need to reallocate time and priorities in 2025 in response to evolving market circumstances and other developments. Consequently, less focus could be directed toward individual targets than originally anticipated. Despite the challenges, the achievements realized throughout 2025 are considered highly commendable. The NSR Committee values the dedication and leadership displayed by the Management Board in steering the organization forward

Short-term Incentive: Management Board Scorecard

1. Excluding severance and restructuring costs

The LTI plan is designed to link a portion of Management Board remuneration to the company’s long-term sustainable performance and the creation of stakeholder value, thereby aligning the interests of Management Board members with those of shareholders. To achieve this, conditional performance shares are used. The on-target incentive opportunity is determined at the grant date and is set at 40% of annual base salary for all Management Board members. The number of conditional performance shares is calculated based on the average closing share price during the five trading days preceding the grant date. The awards under the LTI are subject to a three-year performance period starting on January 1 of each financial year, and they vest on April 1, following the end of that performance period.

The vesting scheme attached to the conditional performance shares is as follows:

The performance criteria determine the vesting of the awards granted under the 2025 LTI plan, which will vest in 2028. The Supervisory Board believes that these criteria are fully aligned with the company’s long-term objectives and support sustainable value creation.

The performance criteria set for the 2025 LTI plan are as follows:

• Total Shareholder Return (TSR) (weight 25%) is defined as the increase in share price including reinvested dividends. TSR is measured over a three-year performance period, using the three-month average share price before the grant date and the three-month average before the end of the performance period. For 2025–2027, our TSR reference groups align with our benchmarking group. The TSR target compares CM.com’s TSR to that of the European reference market² used for Management Board benchmarking. The average percentile ranking of CM.com’s TSR relative to this index determines the performance score — with the threshold level set at the median.

• Cumulative EBITDA (weight 25%) represents the total EBITDA generated by CM.com over the three-year performance period.

• The average customer health score (weight 20%) reflects multiple aspects of our customer relationships, including customer satisfaction, churn rate, and payment history. These elements are combined into a single overall score.

• ESG – Gender diversity: female leadership (weight 15%) measures the proportion of women in leadership roles within CM.com.

• Employee engagement (weight 15%) measures the development of employee engagement and well-being.

Vested shares are subject to a mandatory two-year holding period during which participants may not dispose of any shares, except to cover income taxes due upon vesting. This holding period continues to apply after termination of employment.

The vesting of the performance-based shares for the 2023–2025 performance period will take place on 1 April 2026. The vesting percentage has been determined at 57% of the target, based on the following scores:

1. Compared to European reference market plus local reference market (AScX).
2. % women in leadership roles according to CM.com structure.

The relative TSR score, based on the company’s average percentile ranking compared to the reference markets used (the AScX index for the 2023 awards, and the European Peer Group for the 2024 and 2025 awards), was below the threshold. In line with the company’s shift in focus toward profitability, average revenue growth was also below the threshold, as expected. The company is very pleased with the customer satisfaction score and remains committed to maintaining these high levels going forward. The % of women in leadership roles was slightly above the threshold; in line with expectations. The employee engagement score was slightly below the threshold; however, it should be noted that the threshold was set at a relatively high level. Therefore, the NSR Committee exercised its discretionary authority in determining the final score.

1. Please note that the CFO also receives pension benefits and a mobility allowance. This is not reflected in the table, as it has no impact on the STI and the LTI, which are only based on base salary.
2. European reference market includes the following companies: TomTom, Claranova, 74Software, Mensch und Maschine Software, PSI Software, RM, Linedata Services, Vitec Software Group AB, Truecaller, Accesso Technology Group, and Banqup Group.

This overview presents the annualized target remuneration of the Management Board members for the full 2025 financial year:

Additional contractual arrangements applicable to the CFO include a monthly mobility allowance of €2,000 and participation in the CM.com DC pension scheme, supplemented by an additional annual premium of €10,000 to compensate for the fiscal cap on pensionable salary (2025: €137,800).

The overview below shows the contractual remuneration elements paid or payable for the 2025 financial year:

1. In 2025, 43.75% of the LTIP granted in 2022 has vested at a market price of € 6.52 per share, resulting in the values as mentioned.

Over 2025, no revisions, claw-back actions, or other deductions were applied to the remuneration of any Management Board member. All remuneration was borne by the company, and no severance payments were made to any of the Management Board members. In addition, no remuneration for any Management Board member was charged to any entity other than CM.com Netherlands B.V. during 2025.

No variable remuneration was awarded to Jörg de Graaf due to his departure as of October 31, 2025.

The actual remuneration was determined in accordance with the Remuneration Policy, and CM.com confirms that no deviations, due to exceptional circumstances, were made from the decision-making process for its implementation or from the Remuneration Policy itself.

The overview below shows the employee benefit amounts for the Management Board members, as recognized in the profit or loss statement for the respective financial years.

1. Social Security contribution for CFO based on fixed-term contract.

Base salary, social security contributions, post-employment and pension benefits, STI in cash, and other benefits are classified as short-term employee benefits, as further detailed in note 21 of the consolidated financial statements. Additional information on the classification and accounting treatment of LTI shares and other share-based payments is provided in note 22 of the consolidated financial statements.

The overview below presents a five-year comparison of the remuneration of the Management Board members and the company’s performance:

1. As of 2024, interns are excluded from the FTE calculations, ensuring consistent application of this definition throughout the Annual Report.

The overview below presents the performance of the Management Board members during the 2025 financial year and demonstrates how this performance has been translated into remuneration outcomes under the 2025 STI plan. No variable remuneration was awarded to Jörg de Graaf due to his departure as of October 31, 2025.

The overview below presents the total number of performance shares granted to the Management Board members under the respective LTI plans, along with the movements and balances for the 2025 financial year.

1. The vesting percentage was 43.75% for the performance shares that vested on April 1, 2025.
2. The unvested shares forfeited when Jörg de Graaf stepped down as CFO as of November 1, 2025.
3. Shares are granted and remain unvested at year-end, as they are subject to performance conditions.
4. The Company sold on behalf of the Management Board members the number of shares needed to cover withholding taxes due upon vesting in 2025.

No stock options were awarded to the Management Board in 2025, nor is there an intention to grant stock options in the coming years. In line with the Remuneration Policy, CM.com has not provided any loans, advance payments, or guarantees to the Management Board. The minimum shareholding guidelines set out in the Remuneration Policy (i.e., 1% of annual fixed base salary) have been met. An overview of the number of shares held by the members of the Management Board as of December 31, 2025 can be found in the Shareholder value creation section of this Annual Report.

Remuneration for the Supervisory Board

The remuneration of the Supervisory Board was determined by the General Meeting of Shareholders on May 9, 2025 and is in accordance with the Supervisory Board Remuneration Policy. For 2025, the fees for the Supervisory Board Chair and members were increased by 3%, consistent with the merit increase applied to the overall CM.com employee population in 2024. This overview presents the annualized target remuneration of the Supervisory Board members for the full 2025 financial year:

No variable performance-based, equity-based, or pension compensation is provided to members of the Supervisory Board, ensuring that they remain fully independent from the company’s results. In 2025, CM.com did not grant any loans, advances, guarantees, or share acquisition rights to members of the Supervisory Board.

The overview below presents the contractual remuneration elements paid or payable for the five most recent financial years. Amounts are excluding the compensation for roles in CM Payments B.V. Boards.

1. Took over chair position from April 21, 2022.
2. Resigned from the Board per April 21, 2022.
3. Resigned from the Board from September 30, 2021

General

Basis of Preparation

As of the financial year 2024, CM.com reports under sustainability reporting standards introduced by the EU ¹Corporate Sustainability Reporting Directive (CSRD). The sustainability statements of CM.com have been:

• Prepared in accordance with European Sustainability Reporting Standards (ESRS).²

• Prepared on a consolidated basis and includes CM.com N.V. and its subsidiaries (hereafter: CM.com). The scope of consolidation is the same as for the consolidated financial statements.

• Subject to limited assurance by the external auditor.

Within the scope of our double materiality assessment of impacts, risks, and opportunities (IROs), the upstream value chain is defined as tier 1 suppliers and contractors (including co-locations and data centers), while the downstream value chain consists of customers, consumers, and end-users.

Our reporting on policies, actions, and/or targets relates to our own operations within our direct sphere of influence. If elements of the upstream and/or downstream value chain are included, this will be indicated and disclosed in these sustainability statements, including disclosures where we rely on estimates and industry standards.

Unless otherwise indicated, the terms short-, medium- and long-term time horizons used in this Sustainability statements are defined in line with the stipulations set out in ESRS 1. Short-, medium- and long-term time horizons are taken to mean, respectively, one year or less (2026), two to five years (2027 to 2030) and more than five years (2031 and beyond).

When information is incorporated by reference, the relevant section in the annual report is indicated. The ESRS Content Index also provides a list and description of all ESRS disclosure requirements and a reference to where the information is addressed in this annual report.

In preparing the sustainability statements, management used accounting estimates, assumptions, and judgments that affect the disclosed metrics, the most significant of which are for the company’s GHG emission-related environmental disclosures, the total remuneration ratio, and the performance review participation rate disclosed as part of the social disclosures. As a result, there is inherent uncertainty in our calculations. To keep stakeholders informed and to enhance comparability and understandability, we have indicated when estimates and assumptions were applied and if metrics or amounts are subject to a high level of measurement uncertainty in the disclosures of these metrics in the subsequent sections of these sustainability statements.

As sustainability reporting continues to evolve, so do the metrics and methodologies used. This applies to all data included in this report and may lead to revisions or updated interpretations in the future.

In our commitment to transparency, we include forward-looking information within our statements to share our future-oriented goals and initiatives. We believe that discussing our plans and anticipated outcomes is essential for addressing issues such as climate change and resource management. However, it is important to note that forward-looking information inherently involves uncertainties and assumptions about future conditions. While we strive to provide the most accurate projections possible, actual results may differ due to factors beyond our control. By clearly stating these uncertainties, we enhance stakeholder understanding and maintain transparency in our sustainability journey.

We made use of the following phased-in disclosure requirements in line with ESRS 1 Appendix C:

• SBM-3 Disclosure requirement 48e (anticipated financial effects);

• E1-6 Disclosure requirement 51, 53 and 55 (gross Scope 3 GHG emissions, and GHG emissions intensity);

• E1-9 Disclosure requirement 64-70 (anticipated financial effects);

• S1-11 Disclosure requirement 72-76 (social protection);

• S1-13 Disclosure requirement 81-85 (training and skills development metrics, respectively the average number of training hours per employee, by gender);

• S1-15 Disclosure requirement 93 (work-life balance, for non-NL employees).

1. Council Directive 2022/2464/EC of 14-12-2022 regarding corporate sustainability reporting and amending EU Regulation 537/2014, Directive 2004/109/EC, Directive 2006/43/EC, and Directive 2013/13/EU.
2. As set out in Annex 1 to the Commission Delegated Regulation (EU) 2023/2772 of 31-07-2023 supplementing Directive 2013/34/EU of the European Parliament and of the Council as ameded by Commission Delegated Regulation (EU) 2025/1416 of 11-07-2025 regarding the postponement of the date of application of the disclosure requirements for certain undertakings (Quick Fix).

Governance

CM.com installed the CSRD working group, containing expertise from Legal, ESG, Risk and Compliance, and Reporting. Throughout 2025, the working group met regularly to discuss developments and progress related to the CSRD, and related sustainability topics. Members of the working group followed sustainability courses, and attended several sustainability events and webinars.

Next to the working group, key process owners on Senior Management level are involved and accountable for all required information on disclosure requirements relevant to their domain. Within CM.com, key process owners are designated to report to the working group. Members of the working group assist these key process owners with the identification of sustainability matters, reporting requirements, and further improving the provided information, resulting in the disclosures in these sustainability statements.

The rules of procedure for both the Management Board and the Supervisory Board, as well as the Audit Committee Charter, outline their responsibilities concerning Sustainability Matters. The Management Board is tasked with identifying and managing sustainability matters, respectively material IROs, and has delegated this responsibility to the CFO. Together with the working group, he provides periodic reports to the Management Board and the Audit Committee regarding sustainability, ensuring that the Management Board, Audit Committee, and Supervisory Board are informed and able to bring sustainability matters into their decision-making.

The Supervisory Board supervises how the Management Board identifies and manages sustainability matters. This oversight is facilitated by the Audit Committee, which assists in preparing the Supervisory Board's decisions concerning the integrity and quality of the company's financial and sustainability reporting, as well as the effectiveness of its internal risk management and control systems.

More specifically, the Audit Committee monitors (i) the financial and sustainability reporting process and drawing up proposals to safeguard the integrity of the process (ii) the identification and management of sustainability matters and issuing advise to the Supervisory Board in that regard (iii) the effectiveness of the internal control systems, the internal audit function and the risk management systems with regard to the company's financial and sustainability reporting. For further details on the performance and frequency of duties, please refer to our Supervisory Board Report.

Several members of the Supervisory Board hold positions in Sustainability Committees at companies with years of experience in sustainability reporting and membership in the Dow Jones Sustainability Index. Members with less direct experience have gained knowledge this year, particularly regarding the CSRD, through training such as webinars.

The Management Board, Supervisory Board, and Audit Committee are sufficiently qualified to perform their duties for the identification and management of sustainability matters.

A broader description of the roles and responsibilities of our Boards, and information regarding their composition and diversity, is available under Governance in our Management Board Report.

CM.com has integrated sustainability-related performance into the incentive schemes of the Management Board and Senior Management. The set targets mostly regard the material social topics: Employee Engagement and Diversity & Inclusion.

The Remuneration policy for the Management Board is followed, as established by the General Meeting upon the proposal of the Supervisory Board, based on the advice of the Nomination, Selection and Remuneration (NSR) Committee. The remuneration of our Management Board members is described in our Remuneration Report. Incentives for Senior Management, as described below, are adopted and approved by the Management Board.

In the Short-Term Incentive Plan (STIP) for our Management Board, we have included a few personal objectives (non-financial targets). One of the COO's targets is to improve employee engagement by fostering dialogue between leaders and employees. This represents one-third of the organizational development target, which accounts for 10% of the total target.

The business unit leadership teams also participate in a Short-Term Incentive Plan designed to incentivize them based on their business unit's performance results. Within this plan, employee engagement in the respective business unit is specified as a key target, carrying a weight of 20%, to underscore its significance.

Our Long-Term Incentive Plan (LTIP) applies to our Management Board, our Executive Committee, and specific senior leaders. In LTIP 2025-2027, we have included a clear target on gender diversity concerning female leadership, measured as the percentage of women in leadership roles (on target: 33% women in leadership roles) and another target on overall employee engagement for 2027 (on target: 75).  Both targets have a weight of 15% each, so in total 30% of total targets. This again shows the long-term commitment of our management towards these targets.

We acknowledge the significance of performing due diligence on environmental and social impacts, within our value chain. The results of our due diligence process are incorporated in our double materiality assessment. To reflect the main aspects and steps of our undertaken due diligence process, our references to our core elements of due diligence are included in the table below.

Since 2024, CM.com has embedded sustainability in its overall risk management and control framework by translating sustainability IROs in the manner defined under Double materiality assessment (DMA), to fit into our enterprise risk management. The DMA scores are utilized for risk prioritization within the overarching ERM framework, as well as in developing mitigating strategies and controls. We also leveraged our internal control framework for sustainability reporting related risks, relating to relevance, faithful representation, comparability, verifiability, and understandability of disclosed information, based on ESRS 1 (Appendix B). Furthermore, sustainability reporting should align with legislation (e.g., CSRD, ESRS, and EU Taxonomy), even if not (yet) applicable to CM.com.

The scope of risk management on sustainability reporting includes all underlying disclosure requirements of these sustainability statements, plus all relevant data from source systems that substantiate the disclosures. The qualitative and quantitative information provided is relevant as of the reporting date and covers the reporting period of the financial year 2025 unless stated otherwise.

The company has designed and implemented a system of risk management and internal control relating to sustainability risks. Internal controls were established, building on the diversity of expertise within the working group and the company’s key process owners. This approach supports the identification, assessment and mitigation of the principal risks to the company’s objectives. Governance structures are in place to ensure that the Management Board is actively involved in risk oversight and that the Audit Committee provides independent supervision. Through this governance framework, management is able to continuously monitor the effectiveness of the internal control environment and confirm, in the context of the VOR ("Verklaring Omtrent Risicobeheersing"), that the risk management and control systems provide reasonable assurance regarding the reliability of financial reporting, of which sustainability information forms an integral part.

Also, in preparing these sustainability statements, the EFRAG IG 3 List of ESRS Data Points is used to verify and monitor that all disclosure requirements are addressed.

We have engaged our independent external auditor, Deloitte Accountants B.V., to provide limited assurance on our sustainability statements. For the assurance report, we refer to the Independent Auditor's Report. The Annual Report of which these sustainability statements form an integrated part is published after approval by the Audit Committee.

For further information on these processes and systems, how findings of risk assessment and internal controls are integrated into relevant functions and processes, and on the periodic reporting of findings to the Management Board and Supervisory Board, see Risk Management.

Strategy

In our Management Board report, Our Strategy chapter highlights the core elements of our strategy. Our business model focuses on creating value for our clients by integrating mobile technology into our Engagement Platform. This approach is illustrated in our Value Creation Model, as presented in Our Strategy chapter. To stay aligned with the continuously evolving opportunities in our industry, we chose to adapt our organizational structure. As a result, CM.com has been transformed into an organization built around dedicated business units. Our value chain and potential stakeholders are visually presented on the next page.

Double Materiality Assessment

In 2024, CM.com published its first sustainability statements based on the Impact, Risk and Opportunity (IROs) identified through the double materiality assessment (DMA). The Double Materiality Assessment (DMA) - conducted by the CSRD working group - was initiated in 2023, and finalized in 2024.

In line with the company’s internal policies, these sustainability IROs, as part of the enterprise risk management framework, were reassessed in 2025. This reassessment included a peer analysis, comparing the 2024 sustainability reports of CM.com’s main competitors by reviewing the material topics disclosed and evaluating any deviations.

In addition, the assessment incorporated emerging risks that may affect CM.com as a result of internal and external developments anticipated in 2025. The outcomes of this review were discussed and finalized by the CSRD working group and subsequently shared with the Management Board.

Furthermore, there were no material changes in CM.com’s organizational or operational structure during 2025. The same applies to the company’s relevant stakeholder groups, which remained consistent throughout the reporting period.

Based on the outcomes of these activities, management concludes that the 2024 materiality assessment remains valid as of December 31, 2025, except that Reliability of our Solutions is no longer considered a material topic in the DMA and will therefore not be included in the 2025 sustainability statements. Following the reassessment, this topic no longer meets the financial materiality threshold and is also no longer material from an impact perspective. No need saying that CM.com continues to maintain high service availability, with pricing, functionality, and innovation being the main drivers of customer satisfaction and retention.

At CM.com, our commitment to sustainability is grounded in a rigorous materiality assessment process. In this section, we describe our original processes to identify and assess material IROs. We started with the long list of sustainability matters covered in topical ESRS published by the EFRAG (ESRS 1 - AR 16), which we assessed for potential material IROs throughout our value chain, included below. Relevant stakeholders are identified in the upstream, own operations, downstream, the supporting activities, and the environment we operate in. We considered the operating activities that are carried out in and what financial impact they have. This deep dive into our value chain helps us identify where we can have the greatest impact, ensuring that our sustainability efforts are both meaningful and effective. This assessment was carried out by the working group as a starting point for which potential topics could be relevant for CM.com and is enriched with knowledge of the industry and engagement with our internal and external stakeholders. Our peer analysis has been used to benchmark our practices against industry standards.

To ensure that our assessment is comprehensive and reflective of the concerns and aspirations of those we serve and work with, we have engaged in extensive dialogue with our internal stakeholders and reached out to external stakeholders via a survey, on which the response rate was limited. In the figure below, we identified the potential stakeholders in our value chain. In deep dive sessions with the key process owners within CM.com, we categorized stakeholders as either an 'affected stakeholder' or 'users of sustainability reporting' and assessed the influence of CM.com on these stakeholders and vice versa. Based on this assessment, we identified relevant stakeholder groups for CM.com with whom we actively engage.

We've included an overview of our key stakeholders on the next page, describing how we engage with them, and the purpose of the engagement. Included are the stakeholder groups on which we deem our sustainability impact and vice versa material. Stakeholder engagement entails seeking input and feedback to understand the concerns and the evidence of actual and potential impacts of the company on people and the environment. This helps to substantiate the importance of sustainability matters through the lenses of the affected stakeholder groups or users of the sustainability statements. The views and interests of affected stakeholders concerning sustainability-related impacts are shared with the Management Board and Audit Committee as part of the regular updates. Further learning and continuous interaction with stakeholders might lead to insights that will influence our Double Materiality Assessment in the future.

Once we had an initial idea of possible material topics to be included in our materiality assessment, we sought input from our key process owners and defined a short list of expected sustainability IROs. The topics on this list are weighed based on impact materiality ('inside-out') and financial materiality ('outside-in'), the so-called double materiality assessment (DMA).

The assessment of impact materiality for a negative impact is based on the severity of the impact, whereas for potential negative impacts, it considers both the severity and the likelihood of the impact. Severity is based on scale, scope, and the irremediable character of the impact. Scaled from one to four (minor, moderate, significant, and severe). For positive impacts, materiality is based on scale and scope, and in the case of potential impacts, also the likelihood. Aligning with our enterprise risk framework, scores based on ESRS definitions were translated, whereby sub-scores on the sum of scale, scope, and irremediability were weighted and, if applicable, multiplied by the estimated likelihood. Likelihood is rated using four levels from unlikely to very likely using percentages, based on our knowledge, public information, and historical data as far as presently available. In general, also time horizons are considered in assessing materiality.

A sustainability matter is material from a financial perspective if it triggers, or could reasonably be expected to trigger, material financial effects on the company's development, financial position, financial performance, cash flows, access to finance, or cost of capital. Dependency on natural, human, and social resources can be sources of financial risks or opportunities.

The assessment of financial materiality for risks and opportunities is based on a combination of the likelihood of occurrence and the potential magnitude of the financial effects, using a threshold. We have chosen to include Gross profit as a benchmark to determine the threshold for financial materiality in our double materiality assessment. It provides a direct and sensitive measure of core business performance, aligns with stakeholder priorities, enables industry comparisons, and highlights the financial impacts of sustainability initiatives.

By focusing on Gross profit, CM.com can ensure that materiality assessments are both comprehensive and relevant, effectively linking financial performance with sustainability considerations to support informed decision-making and strategic planning. A risk or opportunity is assessed to be material if the expected financial impact exceeds 2% of the Gross profit realized over the previous reporting year.

Based on the above statements, we have scored the likelihood and size on a range of one to four and recorded the outcomes for both the financial and impact materiality as stated below. Where substantial and high scores are deemed material for either impact materiality or financial materiality, aligned with our enterprise risk framework (ERM).

The material topics, as well as more detailed descriptions of their associated IROs, are presented in the next sections, respectively Environmental, Social, and Governance. All material topics are disclosed in accordance with the Minimum Disclosure Requirements (MDR). The table presents the link between the material topics and one or more sustainability matters as identified by the ESRS.

A description of ESRS disclosure requirements is included in the ESRS Content Index. If the MDR are not met, when policies and/or actions are not adopted or no measurable outcome-oriented targets are set it is explained in the ESRS Content Index.

Similarly, a list of data points derived from other EU legislation is provided, offering an overview of the relevant information.

Environmental

Material Environmental Impacts, Risks and Opportunities

1. The Paris Agreement is an international treaty on climate change, as adopted by 196 parties (including the European Union on behalf of amongst others, the Netherlands) at the UN Climate Change Conference (COP21) in Paris, France, on 12 December 2015. The Paris Agreement entered into force on 4 November 2016 and as further elaborated in the Dutch Klimaatakkoord, as adopted on July 2, 2019.

At CM.com, sustainability is an integral part of our identity and operations. As an innovative player in digital communications, our technologies, products, and services empower individuals to be better informed, more conscious, connected, and in control of their lives.

We recognize that our business activities have an environmental impact through the greenhouse gas (GHG) emissions generated by our operations and our broader value chain. Our primary sources of GHG emissions include purchased goods and services (such as SMS and voice traffic, public cloud services, and POS terminals), business travel, employee commuting, and the energy consumption associated with our offices and data center co-locations. Due to the nature of our business model and asset base, as well as our use of renewable energy - our headquarters are fully powered by green electricity and operate as GHG-emission neutral - our actual impact within Scope 1 and Scope 2 emissions remains relatively limited. This assessment is supported by the results of our Carbon Footprint Measurement.

In anticipation of potential changes in EU sustainability reporting requirements under the Omnibus package, including those expected to become applicable to the company, and in light of the flexibilities provided, the phase-in provisions have been applied and Scope 3 greenhouse gas emissions are therefore no longer disclosed for the 2025 reporting year.

Although our direct impact is relatively small, these emissions still contribute to global climate change, which in turn causes well-known environmental consequences and indirectly affects people’s well-being and safety. Failing to meet the expectations of our stakeholders could lead to loss of business opportunities and challenges in attracting and retaining top talent in the short to medium term. We therefore identify this as a climate-related transition risk. Effectively managing our GHG emissions strengthens our position as an attractive business partner and employer, and helps secure long-term access to the labor market. CM.com acknowledges its responsibility to take meaningful action to help mitigate climate change. We strive to reduce our GHG emissions and, where necessary, applying credible compensation measures, in alignment with the Paris Agreement’s 1.5°C pathway.

Assessing material climate-related risks and opportunities requires the analysis of both physical and transition risks, including current and emerging regulatory requirements. We evaluate these risks and opportunities using our established risk methodology and governance processes, supported by qualitative scenario analysis. At this stage, only qualitative information is disclosed; no estimated or anticipated financial effects of material physical or transition risks are reported.

The process for identifying, assessing, and managing climate-related risks and opportunities is fully integrated into our overall risk management process. Climate-related considerations are assessed alongside other business risks within our enterprise risk framework, facilitated by our Risk Management and Compliance team. In 2025, responsibility for climate-related risks was assigned to our ESG Manager, who provides oversight and active support in managing these risks. The Risk and Compliance team employs a risk dashboard to assess climate-related and other business risks, providing updates and validation to the Management Board as part of our In Control Statement.

As no significant changes occurred in our business model, risk profile, or external context during the reporting year, it was not necessary to repeat the resilience analysis in 2025. Complementing our initial Double Materiality Assessment, we conducted a business resilience analysis in 2024 to identify, understand, and manage the transition and physical risks and opportunities associated with our own operations and data center co-locations in the context of climate change. This analysis evaluated the company’s ability to adapt to regulatory developments, market fluctuations, and emerging threats while maintaining customer trust and operational efficiency. In doing so, we considered the recommendations of the Task Force on Climate-Related Financial Disclosures (TCFD).

To support this assessment, we conducted a climate scenario analysis using two scenarios from the Intergovernmental Panel on Climate Change (IPCC), explained below. These scenarios were used to evaluate the potential impacts of physical climate-related hazards and transition risks and opportunities across short-, medium-, and long-term time horizons.

A high-emission scenario was considered for physical risks, focusing on mid- and long-term timeframes. Under this scenario, assuming no significant mitigation efforts, global temperatures could rise by approximately 4°C above pre-industrial levels by 2100. To analyze the regions where CM.com and its data center co-locations operate, we used data from Copernicus and KNMI Climate Scenarios. Climate risks from extreme weather, temperature rise, sea level rise, heat stress, and cold waves/frost are not deemed significant for CM.com up to 2050, as it operates with relatively low investment in physical assets. Our assets include our headquarters in Breda, rented office space, and data center co-locations. For our assessment, we focused on offices covering 90% of employees and significant co-locations, both with a lifespan of over 10 years.

To assess transition risks, we considered the IPCC's RCP 1.9 scenario aiming to limit global warming below 1.5°C by 2050. Under this scenario, CM.com anticipates a widespread shift to renewable energy sources and continued improvements in energy efficiency worldwide. Anticipated environmental regulations and policies are expected to tighten globally, accelerating the transition to environmentally friendly and low-carbon technologies. As a result, changing customer preferences towards more sustainable products and services may make the existing services of CM.com less attractive and we risk reputation damage if CM.com cannot demonstrate an active contribution to sustainable development, e.g., by reducing emissions from its own operations and value chain. Additionally, the transition to a low-carbon economy may lead to stricter regulations, particularly concerning CO₂ reduction, which may lead to increased investments and costs for compliance. This transition risk (policy & legal) is assessed as material for medium- and long-term and relates to both own operations as the value chain, based on potential size and likelihood.

CM.com has implemented an overarching Environmental, Social, and Governance (ESG) Policy that addresses sustainability in a broad sense. In 2025, an additional Environmental Policy¹ was initiated to specifically address climate change. In addition to measuring our Scope 1 and Scope 2 GHG emissions, we have adopted an ISO 14001-certified Environmental Management System (EMS) as of 2024 to effectively identify, manage, and mitigate environmental risks. The EMS provides a structured framework that helps us reduce environmental impacts, ensure legal compliance, achieve our sustainability objectives, identify and address environmental risks, and drive continual improvement. Throughout 2025, our ESG Manager - who reports to the CFO and works closely with topic owners across housing, fleet, travel, IT, procurement, and talent - contributed to the further development and implementation of our sustainability strategy. Sustainability is also a recurring topic on the agendas of both the Management Board and the Supervisory Board and is discussed regularly in Audit Committee meetings.

CM.com is committed to supporting the goals of the Paris Agreement and aims to contribute to the global transition needed to mitigate the impacts of climate change. We work to minimize our environmental footprint across both our own operations and our broader value chain. As part of our efforts to address climate change, CM.com purchases renewable energy for its headquarters. In 2024, we also invested in 66 solar panels to generate sustainable energy on the roof of our headquarters.

The main actions taken during 2025 to reduce Scope 1 and 2 emissions focused on the increased use of renewable electricity, the reduction of fossil fuel consumption, and improvements in energy efficiency. Our electricity providers for office locations are transitioning to renewable energy sources and, for our most impactful offices, renewable electricity is already being utilized. Where feasible, we plan to switch the remaining offices to renewable electricity contracts. In 2025, we made further progress in this area: our office in London (UK) is now fully heated electrically, with no gas usage, and operates on renewable electricity. In addition, our office in Denmark is now fully supplied with renewable energy.

In parallel, CM.com aims to avoid acquiring or leasing new fossil fuel vehicles. During 2025, no new lease cars were added and only existing leases were renewed. Finally, we aim to implement measures to improve energy efficiency and reduce Scope 1 and 2 emissions. When equipment is replaced, priority is given to the purchase and installation of energy-efficient devices.

The results of this positive contribution to renewable energy production are presented in the table under Results.

Responsible AI deployment enables us to innovate for our customers, strengthen efficiency, and enhance our competitiveness. CM.com continues to expand its portfolio of customer-facing AI solutions - such as the generative AI platform HALO and AI voice agents - positioning the company as a frontrunner in intelligent communication technologies. By enabling more efficient digital interactions and reducing the need for resource-intensive processes—such as physical travel or manual communication workflows - these innovative technologies also contribute to reducing the carbon footprint across the supply chain. As demand for our AI-integrated products continues to grow, we remain committed to embedding sustainability into our journey toward becoming an AI-First company. We recognize that energy consumption is a central topic within the global AI landscape, particularly for organizations conducting extensive model pretraining. CM.com does not perform large-scale pretraining of AI models. Instead, we efficiently finetune Open Weights models and use closed-source models such as Azure OpenAI, Google Gemini, and Anthropic Claude, thereby reusing the substantial computational efforts already undertaken by major AI developers such as Meta. Our AI-related workloads predominantly consist of inference and finetuning. Inference involves using a trained AI model to make predictions or decisions based on new, unseen data. Finetuning refers to optimizing an existing pre-trained model for a specific task or dataset to enhance its performance. For both processes, we use state-of-the-art hardware (GPUs) selected for their energy efficiency, helping us minimize power consumption while maximizing production capacity. GHG emissions associated with our use of public cloud infrastructure are limited, as our major cloud providers operate on renewable electricity.

We continue to integrate ESG principles into our supplier management processes - for example, by evaluating suppliers’ sustainability practices, ethical AI development standards, and data governance frameworks. These considerations form an important part of our assessments, although they are weighed alongside essential AI-specific criteria such as technical performance, model accuracy, pricing structure, and innovation capability.

We are committed to measuring the impact and effectiveness of our intended measures annually as part of these sustainability statements. We are still in the process of further formalizing target setting for reducing GHG emissions, including proposed short-, medium-, and long-term targets.

1. Please note that this policy is pending Management Board approval as per the signing date of the sustainability statements.

CM.com's energy consumption originates from the electricity usage in offices, the fuel and electricity usage of leased cars, and limited gas usage for heating offices. The total usage mainly originates from renewable energy, whereby the overall decrease is resulting from the overall lower energy usage of our offices and fewer leased cars. Energy produced and consumed from self-generated non-fuel renewable energy by CM.com relates to the installed solar panels at our CM Campus.

1. Based on new information acquired on our spain locations we have reclassified their usage from fossil and nuclear to renewable, as the locations use 100% green energy. The total energy usages has remained unchanged.

The total energy consumption is based upon the identical boundaries and inputs used for the scope one and two calculations, as presented in the next section. Following this, identical assumptions and extrapolations apply. First, the petrol and diesel consumption (in liters) was converted into MWh consumption based upon the lowerering heating values of Petrol (E10) and Diesel (B7) following the GLEC framework V3. Related to electricity consumption, all green electricity purchased is classified as 100% renewable. CM.com adopts a conservative approach in line with ESRS Disclosure Requirement E1-5 AR 32 j, whereby CM.com only considers these energy consumptions as deriving from renewable sources if the origin of the purchased energy is clearly defined in the contractual arrangements with its suppliers. For calculations, all other facilities with unknown energy sources use the electricity mix of their respective countries. This data is broken down into categories of renewable, nuclear, and non-renewable energy, based on EMBER 2024 information.

CM.com's carbon footprint for 2025 (scope 1 and 2) shows a decrease versus 2023 (base year). This saving is the result of fewer office locations, a smaller and more sustainable fleet, and a decreasing and renewable energy consumption in foreign offices. Overall, this leads to a lower energy consumption, as presented in the previous section, resulting in lower GHG emissions. As a result, both scope 2 location-based and market-based emissions have decreased in 2025 compared to 2024.

In this section, we elaborate on the methodologies used and assumptions applied. CM.com accounts for all scope one and two emissions from its operations. The scope of the total GHG emissions is based on the operational control approach following the financial consolidation, as disclosed in note 27 Group structure of the consolidated financial statements.

Scope one direct GHG emissions from owned or controlled sources mainly relate to fuel consumption for our vehicles and some gas usage for heating a limited number of external office facilities. Given that our business minimally uses refrigerants, their impact on our environmental footprint is minor. Our analysis shows that refrigerants are immaterial to our operations, existing only in office installations. In the last 3 years, there were no refills in the Netherlands, as confirmed by our facilities manager. These facilities represent 72% of our locations, based on the number of FTEs at the end of the reporting period.

Scope two indirect GHG emissions are from energy purchased and consumed by the company. These emissions occur outside the organization but are a consequence of our electricity consumption for vehicles and facilities. Our headquarters in Breda, Netherlands, which accounts for 59,2% (2023: 58,4%) of the total energy usage of all facilities, purchases exclusively green Dutch wind electricity. Next to this, four other offices purchase green electricity. For our other offices, grey electricity is assumed. Scope two emissions are presented as location-based emissions (average emissions intensity of grids where energy consumption occurs using region-specific average emission factors) and market-based emissions (based on contractual energy purchases (e.g., specific suppliers or products) considering renewable energy certificates (RECs) and similar instruments).

For both scope one and two GHG emissions, we have used the actual usage for the period from January 2025 up to and including November 2025, and extrapolated the usage for the last month. This approach assumes the usage of December 2025 is equal to the average monthly consumption rate of the eleven other months during the year. In some smaller locations, where actual usage for 2025 was not yet available, we used 2024 actual usage as a proxy. This was the case for approximately 20% of the Scope two GHG emissions. If no actual usage data were available, we used the square meters rented and the local market average GHG emissions as a proxy.

1. GHG intensity is calculated as total GHG emissions (market- and location-based) divided by revenue (in millions) of the reporting period as presented in our consolidated financial statements.

Emissions in this table include scope one and scope two GHG emissions only, whereas in the prior period, we also reported scope three emissions.

EU Taxonomy Report

In accordance with the EU Taxonomy Disclosure Requirements and following the publication of the amended reporting options in the Official Journal of the European Union, the company has applied the existing (pre-amendment) EU Taxonomy reporting rules when reporting on the 2025 financial year. This choice is made in line with the transitional provisions, which allow reporting undertakings to apply either the existing or the amended disclosure requirements for the 2025 reporting period.

The EU Taxonomy is one of the cornerstones of the Green Deal, the EU’s strategy to become the first climate-neutral continent by 2050. Redirecting capital flows toward sustainable investments and increasing transparency are central to achieving this goal. For this purpose, the European Commission (EC) developed a classification system for sustainable activities called the EU Taxonomy.

The EU Taxonomy provides investors with a common language for identifying sustainable economic activities. Under the EU Taxonomy, companies must disclose the proportion of their turnover, capital expenditure, and operational expenditure that meets the criteria outlined in the EU Taxonomy and provide both investors and other stakeholders with transparent information to enable them to make informed investment decisions.

The EU Taxonomy identifies the following six environmental objectives:

• Climate change mitigation (CCM).

• Climate change adaptation (CCA).

• The sustainable use and protection of water and marine resources.

• The transition to a circular economy.

• Pollution prevention and control.

• The protection and restoration of biodiversity and ecosystems.

As of December 31, 2024, CM.com is required to disclose its taxonomy-eligible activities¹ and taxonomy-aligned activities² in terms of the six environmental objectives. Eligibility indicates that an activity is in scope for screening under the taxonomy regulation. Once an activity is assessed to be eligible against the EU Taxonomy, this activity is assessed for alignment.

For an economic activity to be classified as aligned, it will have to adhere to the following requirements:

1. Compliance against the identified Technical Screening Criteria (TSC).

2. Meet the requirements of the Do Not Significantly Harm (DNSH) criteria.

3. Compliance against the Minimum Social Safeguard (MSS) criteria.

CM.com has performed its asessments in accordance with the EU Taxonomy Disclosure delegated act and environmental act.

In 2025, CM.com carried out an eligibility assessment of its four primary activities related to the designated business units Connect, Engage, Pay, and Live against the six environmental objectives.

This assessment of taxonomy-eligibility is based on the specific description of the respective activities provided in the Climate Delegated Act. Based on this assessment, we concluded that the economic activities carried out in our four designated business units can all be mapped under activity 8.2 computer programming, consultancy, and related services. This activity is mapped as an adaptation activity under Climate Change Adaptation (CCA) and as such the related turnover cannot qualify as eligible. Corresponding Operating Expenditures (OPEX) and Capital Expenditures (CAPEX) can qualify as eligible activities when certain requirements are met. For this adaptation activity (8.2), we need to demonstrate that a climate risk and vulnerability assessment has been performed and that an expenditure plan has been set up to implement adaptation solutions that reduce our activities' most significant physical climate risks. Only if these requirements are fulfilled, we can count the related CAPEX and OPEX of the adaptation activity for taxonomy-eligibility. However, it is important to note that due to the nature of these activities as adaptation activities, the turnover is not eligible under the EU Taxonomy.

In 2024, CM.com updated and expanded the comprehensive Climate Risk and Vulnerability Assessment conducted in 2023, incorporating the latest developments and emerging insights. This updated analysis, in which existing and additional new sources (e.g. Copernicus interactive Atlas tool) were used, builds upon the previous assessment, identifying potential new risks and opportunities arising from evolving climate conditions and market demands. Our investigation objects, including offices and co-locations, were reassessed with a long-term perspective aligned with other CSRD paragraphs, maintaining a projected lifetime of over 10 years, and thus considering future IPCC climate scenarios. This ongoing evaluation highlights our commitment to ensuring that our adaptation strategies remain robust and sustainable, addressing both current and future environmental challenges. As no significant changes occurred in our business model, risk profile, or external context during the reporting year, it was not necessary to repeat this resilience assessment in 2025.

Our analysis covered all physical climate risks as categorized by the EU Taxonomy, including temperature-related, wind-related, water-related, and solid mass-related risks. For temperature-related risks, we looked into the potential impact of, among others, extreme heat and cold on our infrastructure and the efficiency of our cooling and heating systems. In terms of wind-related risks, we evaluated, among others, the structural integrity of our buildings and facilities in the face of strong winds and storms.

The assessment also delved into water-related risks, focusing on aspects such as the potential effects of flooding, heavy rainfall, and rising sea levels on our operations. This part of the analysis was particularly relevant for our locations near coastlines or in flood-prone areas. For solid mass-related risks, we considered issues like land subsidence and the stability of the ground on which our buildings are situated. Reference is made to the in-depth analysis under section Climate Scenario Analysis and Risk Assessment.

Throughout this extensive assessment, we utilized climate projections, including insights from the KNMI report, with a special focus on scenarios relevant to the Netherlands. This enabled us to create a comprehensive understanding of various potential climate scenarios and their likely impact on our operations. Based on these insights, we are now better positioned, as we have developed and implemented effective adaptation strategies that mitigate these identified physical climate risks.

The KPI related to turnover is calculated in accordance with Article 8 of the EU Taxonomy Regulation. The numerator of each business unit was compiled by taking the total eligible turnover for that business unit for 2025. The total denominator equals the total turnover combined for all the different business units, as stated in note 4 Revenue recognition and segment reporting of the consolidated financial statements. Following the outcome of the eligibility assessment for 2025, the turnover is not eligible as it is derived from activity 8.2 computer programming, consultancy, and related services which concerns an adaptation activity in the EU Taxonomy. Hence, the related turnover associated with eligible activities is 0%.

The KPI related to CAPEX has been compiled in accordance with Article 8 of the EU Taxonomy Regulation for 2025. The numerator is compiled by taking the total eligible CAPEX for 2025. This is the CAPEX that directly relates to our taxonomy-eligible economic activities, being those linked to '8.2 computer programming, consultancy, and related services'. For CAPEX, the total denominator amounts to € 16.5 million and equals total CAPEX including the additions as set out in the movement schedules of note 5 Intangible assets, note 7 Property, plant and equipment, and note 8 Right-of-use assets of the consolidated financial statements. As the total CAPEX in the scope of the EU taxonomy is directly associated with taxonomy-eligible activities, respectively 8.2 ' Computer programming, consultancy, and related activities, related CAPEX associated with eligible activities is 100%. In total, 100% of CM.com’s CAPEX in 2025 is deemed to be eligible for the EU Taxonomy, of which 0% is aligned.

The KPI related to OPEX has been compiled in accordance with Article 8 of the Taxonomy Regulation for 2025. The numerator is compiled by taking the total eligible OPEX for 2025. This is the OPEX that directly relates to our taxonomy-eligible economic activities, being those linked to '8.2 computer programming, consultancy, and related services'. For OPEX, the total denominator amounts to € 12.2 million and includes the non-capitalized costs relating to R&D, IT maintenance and repair expenses, and immaterial other expenses, part of note 21 Employee benefits and note 23 Other operating expenses of the consolidated financial statements. As the total OPEX in the scope of the EU taxonomy is directly associated with taxonomy-eligible activities, respectively 8.2 ' Computer programming, consultancy, and related activities, related OPEX associated with eligible activities is 100%. In total, 19% of CM.com’s OPEX in 2025 is deemed to be eligible for the EU Taxonomy, of which 0% is aligned.

Only once an activity is deemed to be eligible against the EU Taxonomy can it be assessed for alignment. For an economic activity to be classified as aligned, it must do the following (as set out in the EU Taxonomy Regulations):

1. Comply with the identified TSC activities.        

2. Meet the requirements of the Do No Significant Harm (DNSH) criteria.

3. Comply with the Minimum Social Safeguard (MSS) criteria.

CM.com has put significant effort into conducting a Climate Risk and Vulnerability Assessment in previous years, assessing compliance with the other TSC activities, and conducting an analysis on adherence to the Minimum Social Safeguard (MSS) criteria preliminarily resulting in alignment for its identified eligible activities. In 2025, CM.com had planned to further refine and deepen the assessments underlying the alignment of its economic activities with the applicable EU taxonomy requirements. However, this process has been deferred, as additional evaluation is required before determining the appropriate timeline.

As stated above, CM.com set its alignment percentage at 0% as the criteria are not met.

1. Taxonomy-eligible economic activity means an economic activity that is described in the delegated acts adopted pursuant to Article 10(3), Article 11(3), Article 12(2), Article 13(2), Article 14(2), and Article 15(2), of Regulation (EU) 2020/852, irrespective of whether that economic activity meets any or all of the technical screening criteria laid down in those delegated acts.
2. Taxonomy-aligned economic activity means an economic activity that complies with the requirements laid down in Article 3 of Regulation (EU) 2020/852.

This section presents the Taxonomy Table for Nuclear and Gas as outlined in the Complementary Climate Delegated Act. The table categorizes and evaluates the environmentally sustainable activities associated with nuclear and natural gas energy sectors. It provides a framework for recognizing eligible investments and practices that contribute to the transition towards a low-carbon economy. The table aims to guide stakeholders in identifying activities that align with the European Union's climate and energy objectives, ensuring transparency and consistency in sustainable finance practices.

Social Impacts

Material Social Impacts, Risks and Opportunities

By focusing on Diversity & Inclusion, Employee engagement, Training and skills development, and Privacy & Data security, we aim to create and maintain a thriving, innovative, and resilient workforce. These efforts enhance our company’s performance and help us pursue our goal to stay at the forefront of innovation while contributing positively to our workforce and, therefore, to the future of our company.

The characteristics of our employees are sourced from information available in our human resource platform, as registered via our employee administration system. No estimates are applied when reporting on the characteristics of our employees. Headcount is reported as the number of employees at the end of the reporting period. Interns with the primary intention of learning on the job and gathering knowledge and experience are not considered employees in the sustainability statements. Reference is made to note 21. Employee Benefits of the financial statements, where the average number of employees of CM.com during the year is converted to full-time equivalents (FTEs). A split has been made by region based on the location of the legal entity in which the employee is employed. Apart from the Netherlands, there are no other countries where CM.com has more than 50 employees or represents at least 10% of its total number of employees. Upon joining our company, employees are in most cases offered a temporary contract that can be converted to a permanent position after a specified period.

Our Principles for Integrity and Responsibility (hereafter: Code of Conduct) applies to all employees, contractors, and agency workers (hereafter: workforce). The Code of Conduct provides clear guidelines on how we expect our workforce to conduct their work with integrity and in alignment with our core values. They contain provisions on many areas relevant to our social impacts, such as fair treatment and diversity, a safe working environment, and how to find support.

Headcount by contract type and region, broken down by gender per 31 December 2025:

Headcount by contract type and region, broken down by gender per 31 December 2024:

The employee turnover rate is calculated as the number of employees (on a temporary or permanent contract) who have left the company relative to the number of employees at the end of the reporting period.

As of December 31, 2025, CM.com employed 646 own employees (705 in 2024) and engaged 29 self-employed contractors (31 in 2024) as well as 1 agency worker (7 in 2024). Of the contractors, 8 were independent specialists contributing their knowledge and experience in our R&D and General departments (12 in 2024), while 21 were operational staff members supporting live events for our clients in the Netherlands (19 in 2024).

At CM.com, diversity drives our innovation and is essential to a thriving, forward thinking workplace. We are committed to creating an inclusive environment with equal opportunities for all employees, regardless of gender (identity), age, ethnic background, religion, sexual orientation, social status, disability, chronic illness, working time, or contract type.

Our approach to Diversity and Inclusion is embedded in the way we work and formalized through our core policies: The Principles for Integrity and Responsibility (Code of Conduct), Employee Handbook, Working Conditions Policy for Dutch employees, and the Diversity and Inclusion Policy. These policies clearly state that CM.com does not tolerate bullying, discrimination, or harassment. Accountability for these policies lies with our Head of HR.

Employees have clear and accessible reporting channels to address misconduct through their manager, HR, or an independent external confidential adviser. In addition, our Speak Up tool ensures concerns can be raised safely, confidentially, and without fear of retaliation.

All policies are now centrally published in CM.com’s Policy House, providing employees with a single, accessible source for all relevant governance documents. Each policy is reviewed and updated annually to remain current, compliant, and aligned with best practices.

CM.com’s Diversity & Inclusion Policy outlines the company's commitment to diversity within the Management Board, Executive Committee, Senior Management, and the Supervisory Board, in line with the Dutch Corporate Governance Code. We are committed to maintaining gender diversity, ensuring at least 33% of our Supervisory Board and 30% of our Senior Management are women. Additionally, we aim for at least 30% female representation in our Management Board by 2032. Beyond gender representation, CM.com continues to broaden nationality and age diversity to ensure a balance of education and experience across leadership levels. These commitments are supported through inclusive recruitment, retention, mentoring, and development initiatives. CM.com is dedicated to providing equal opportunities for men and women in their career paths, as transparently reported through our Sociaal Economische Raad (SER) diversity reporting.

Diversity was a key consideration during the recruitment process for a new CFO in 2025. The search focused on candidates with strong technology and growth experience, broad financial expertise, and proven experience in a listed company environment, while also emphasizing gender diversity, nationality, and proximity to the company’s home market. Women were well represented throughout the selection process and in the final rounds. Ultimately, the selected candidate best matched the full set of required competencies and strategic priorities of the company. The appointment resulted in a male candidate; the process reflects the company’s continued commitment to diversity and inclusion, the selection of the best candidate for the role, and progress towards its long-term diversity objectives.

At its core, Diversity & Inclusion means that at CM.com:

• Diversity is about bringing in a wide range of perspectives and experiences

• Inclusion ensures that every voice is heard and every employee has the chance to contribute and thrive

• Equity guarantees fairness in opportunities and decision-making

• Accessibility removes barriers so everyone can participate fully

• Belonging creates a culture where people feel free to be themselves

Or, to put it in CM terms:

• Diversity: Being invited to the party

• Accessibility: Being able to enter the building

• Inclusion: Being asked to dance

• Belonging: Being able to dance how you want

• Equity: Having a turn to pick the DJ

This framework was introduced during the Global Leadership Training, reinforced through the We Are CM onboarding session, and communicated across internal channels to align understanding across the organization.

At CM.com, diversity is our superpower, fueling innovation and driving success. Every job posting includes our commitment: “Here, diversity is our superpower. Our diverse perspectives fuel innovation and drive us forward. We celebrate every member, regardless of age, background, or beliefs.”

Our inclusive culture is strengthened through our representation in traineeships and hiring processes, diverse recruitment panels, and formalized internal application processes that ensure equal access to opportunities for all employees.

We celebrate diversity of nationalities, cultures, and perspectives that make up our workforce. While English serves as our common business language, we actively embrace linguistic and cultural diversity through language courses, time zone awareness, and accessible facilities for employees and visitors with disabilities.

Learn more about Accessibility & Inclusion at CM.com, specifically in relation to our products and services, and gain insights from our Accessibility Specialist in our Managment Board Report under the Our Commitment to Sustainability section.

We strengthen inclusion through training programs such as:

• We are CM Training (Onboarding): Interactive onboarding sessions focused on discrimination awareness, reporting pathways, internal policies, and the importance of inclusion and safety at work.

• Leadership Training: A two-day workshop hosted at our Breda Headquarters, bringing together Team Leads from across the world and all business units. The Diversity & Inclusion session focused on microaggressions, bias awareness, intercultural communication, fairness, and pathways to reporting misbehavior. By connecting leaders from different regions, cultures, and experiences, this training fostered a truly global perspective on inclusion, ensuring that our leaders are equipped to champion diversity across all CM.com locations.

To further embed inclusion across the organization, CM.com has an established Diversity & Inclusion Task force, composed of employees from all over the world, from Cape Town, to London, to our Head Quarters in Breda. The Task Force serves as the first point of contact for issues related to equal opportunity and bias and plays an active role in identifying challenges and proposing solutions to strengthen fairness and inclusion across the company.

Gender distribution in number and percentage at Senior Management level:

1. Supervisory Board members are not employees of the company.
2. Members of the Executive Committee and BU Leadership Teams

Further information on the composition of the Management Board, Supervisory Board, and Senior Management is disclosed in the Governance section of this Annual Report.

Age distribution among employees:

CM.com is committed to ensuring that all employees, regardless of gender, are compensated fairly and equally. The gender pay gap provides insight into any pay disparities between male and female employees within the company. The gender pay gap is defined as the difference in average gross hourly pay level between female and male employees, expressed as a percentage of the average gross hourly pay level of male employees. It is essential to note that this figure alone does not reflect the full scope of gender pay equity within CM.com. According to our data analysis, the pay gap is mainly caused by an underrepresentation of women in higher job grades – an issue we are actively addressing as part of our strategic objectives – and significant differences in international salaries, making aggregated comparisons less representative for gender pay gaps based on same-level roles.

The annual total remuneration ratio provides insight into whether wide pay disparities exist. The ratio is defined as the annual remuneration total for the highest-paid individual divided by the median of employees' annual total remuneration (excluding the highest-paid individual).

Employee-specific salary data is largely retrieved from our payroll service provider's system and relates to employees employed at the end of the reporting period. Components of pay levels included in the calculations are actual gross salaries, cash benefits (such as sales and short-term bonuses), and benefits in kind all derived from the payroll system and paid out during the reporting year, along with the value of long-term incentive bonuses (share-based) granted in the reporting year. Data is extrapolated to full-time equivalents (FTEs), and assuming employment for the entire year for those who joined mid-year.

At CM.com, our employee engagement is driven by our credo, “Do what you like, do what you’re good at, and contribute,” which is emphasized in our Employee Handbook, the Club Manifesto, along with our shared values that are the foundation of our culture and the key to our success. By fostering intrinsic motivation and excellence, we prioritize monitoring engagement through corporate values, conducting employee engagement surveys, and providing safe and healthy working conditions for our entire workforce.

Dutch CM.com employees on a temporary or permanent contract are protected by our working conditions, which is part of every employee contract. These comply with labor laws and regulations, covering social protection such as paying living wages, secure employment, social security, leave, retirement, and working hours. Our CM.com Employee Handbook outlines the regulations and benefits available to our Dutch employees in case of sickness, disability, (family-related) leave, and retirement. Also, information on working hours in case of overtime, pregnancy, adoption, or recent birth is described. Furthermore, safety instruction videos are available to prevent workplace accidents. We plan to develop specific working conditions and employee handbooks for each of our foreign offices in the future.

In accordance with ESRS S1-11, social protection requires entities to disclose whether their employees are covered against income loss due to major life events. The standard identifies the following five majorlife events for disclosure: sickness, unemployment (starting from when the worker is employed by the undertaking), employment injury and acquired disability, parental leave and retirement. Additionally, entities must disclose any countries where such coverage is not provided. At this stage, we do not yet have detailed information at this level and apply for the transition relief. As we are utilizing phase-in provisions, no targets have been set yet.

In accordance with ESRS S1-15, work-life balance requires entities to disclose the extent to which employees are entitled to and make use of family-related leave. We report on family-related leave according to the definitions of ESRS, i.e., it includes maternity leave, paternity leave, and parental leave from work. Everyone employed by CM.com entities in the Netherlands is entitled to take family-related leave, regardless of gender. In addition to maternity leave for the primary caregiver giving birth, Dutch law allows secondary caregivers to take five weeks of additional birth leave at 70% of the daily wage, covered by the Dutch employee insurance agency UWV. CM.com supplements this payment to 100% of the maximum daily wage. At this stage, we do not yet have detailed information at this level for employees who are employed outside the Netherlands and apply for the transition relief. As we are utilizing phase-in provisions, no targets have been set yet.

The percentage of Dutch employees that took family-related leave is calculated by the number of (male/female) Dutch employees that took family-related leave relative to the number of (male/female) Dutch employees at the end of the reporting period.

CM.com believes that physical and mental health are very important for the overall health of employees. That’s why CM.com offers vitality workshops on a regular basis and access to our care team. The team consists of external experts who can provide support and advice on issues. The issues don’t necessarily need to be work-related. The care team consists of a corporate social worker, an occupational physician, an occupational psychologist, a budget coach, a financial adviser, a dietitian, and an external confidential adviser.

CM.com fosters collaboration and a sense of community through specific guidelines for working together and encouraging office work over remote work. Events like Dev Days, an internal network event for our developers, bring employees from different backgrounds together to collaborate on new solutions. Additionally, the company supports an informal work environment and organizes various social gatherings, such as sports activities, Friday afternoon drinks, social trips abroad, and board game nights. These initiatives help employees feel valued and comfortable being themselves, which in turn allows them to flourish and contribute effectively to the company’s growth.

To measure employee sentiment and engagement, we conduct a global employee engagement survey annually. The results are reviewed at the highest levels, including the Management Board and Senior Management, with the HR department leading discussions on employment matters and guiding future actions and communication strategies. This survey allows us to measure the effectiveness of our actions. To enhance responsiveness, a new survey tool was introduced in 2024, enabling more frequent and topic-specific surveys. The survey questions are distributed quarterly, and anonymous results are shared with team leads, who are encouraged to address feedback and proactively discuss survey outcomes during team meetings. Striving to be an employer of choice, we aimed for an employee engagement score of 80 over 2025 (on target score for LTIP 2023-2025). During 2025, CM.com scored 74 (2024: 73). The on target score for LTIP 2025-2027 is set on 75 over 2027.

Engaging with our workforce and their representatives is a cornerstone of our approach to managing impacts and fostering a positive work environment. Our HR department is responsible for dialogue on employment matters. We believe that open communication and the active involvement of employees in workforce-related decision-making processes are crucial for our success. Besides the employee surveys, we maintain a robust communication framework that includes quarterly town hall meetings and regular CEO and CFO updates where employees have the opportunity to send in questions beforehand or ask them live. We offer live and recorded training sessions on various topics.

In the Netherlands, our Management Board members bi-monthly engage with the Works Council representing the interests of the Dutch CM.com employees, discussing, for example, topics like Diversity & Inclusion and outcomes of the employee survey. CM.com as a company is obligated to share important information with the Works Council which in return may have the right to give advice or the right of consent, depending on the topic, and the right to propose initiatives. The exact rights and responsibilities of the Works Council are described in the WOR. Feedback from the Works Council helps us prioritize actions that address the most pressing issues for our employees and directly influence our decision-making processes. For example, the introduction of a new survey tool and the implementation of more regular surveys in 2024 are direct responses to the need for more timely and actionable feedback. These initiatives demonstrate our commitment to creating a responsive and inclusive workplace where employees feel empowered to contribute to the company’s success. For clarity, CM.com has no Works Councils outside the Netherlands.

Additionally, we have established an easily accessible site on our company intranet that outlines various options for employee representation, such as HR business partners, a Speak-Up tool, Works Councils, a Diversity & Inclusion task force, the care team, and personal development dialogues. New or changed employment conditions are communicated through email and intranet updates.

Being a socially safe and respectful workplace is essential to creating a culture that empowers and facilitates our workforce to speak up and raise concerns or questions, as well as provide remedies in cases where employees have experienced negative circumstances.

Our CM.com Working Conditions Policy, which is part of the employment contract for Dutch employees, is very clear on our zero tolerance for bullying, harassment, and/or discrimination on any ground. The policy includes clear steps that can be taken as well as possible consequences and disciplinary actions in case this behavior does seem to occur.

Multiple reporting channels are offered, both internally and externally, through confidential advisers. Individuals are encouraged to first discuss matters directly with the individual(s) involved or escalate to a direct lead, HR business partner, or the Head of Risk & Compliance. Concerns can also be addressed with an external confidant or through the external Speak-Up tool. Our Speak-Up Policy (Whistle-blower Policy) is intended to encourage everyone to speak up about any misconduct. This policy goes beyond things like bullying and harassment and includes, for example, criminal offenses or violation of the law, human rights violations, bribery and corruption, and threats to the environment. All reports and concerns need to be reported through the Speak-Up Tool, in order for the Speak-Up Committee to take them into consideration. Reference is made to the section Business Ethics for more information.

At CM.com, we foster a culture of continuous learning and improvement, with professional and personal development captured under our shared value "Grow & Learn." Investing in career and skills development demonstrates our commitment to our workforce and helps us attract, grow, and retain talent.

We believe continuous training is crucial in a rapidly evolving technological landscape to stay at the forefront of innovation and contribute to the company’s success. To support this we established an internal Training Policy covering all employees of CM.com, including contractors and agency workers, and with accountability lying with our HR department. The policy is a guiding framework to ensure that our workforce is well-informed and equipped to conduct their work effectively and in alignment with our shared values and regulatory requirements. By aligning training needs with organizational goals, job requirements, and performance evaluations, we ensure every team member is knowledgeable.

To foster the growth of our existing talent, CM.com offers a mix of training formats, including both internal and external sessions, classroom learning, and e-learning modules, tailored to fit different learning styles and needs. We have implemented various initiatives to champion our 'Grow & Learn' shared value, such as (but not limited to) our CM Academy (online learning platform); Udemy (technical e-learnings); LinkedIn Learning; we support fresh starters through our Young Professional program; equip future leaders with essential skills and knowledge through the CMBA - Our high-potential program which focuses on personal leadership, business strategy, and operating in a global context; our DEV Day's - a yearly event for our developers to connect, share knowledge, and learn from each other; and our COO hosts workshops on developing presentation skills. The CM.com Employee Handbook (for Dutch employees) outlines the available opportunities for participating in external training programs.

In 2025, we launched the CM.com Leadership Program, our first dedicated training for current team leads. The program focuses on what it means to lead at CM.com, covering conversation techniques, absence management, human skills, and reinforcing our Shared Values (Drive & Lead, Grow & Learn, Together & Care, Speed & Change). We aim to make this leadership training an annual initiative, ensuring all team leads are equipped to lead with impact.

We believe that AI empowers our customers to maximize the value of our products while offering significant opportunities within our own organization. We encourage employees to explore AI applications and propose ways to improve work processes. As an AI-driven company, we strive to embed this philosophy throughout our organization. Our AI specialists host workshops like "How to Build an AI Agent" to promote knowledge sharing and skill development. All employees have access to AI technologies and are supported in developing their skills. We also collect and share practical AI use cases across the organization, including initiatives like the "Agent of the Week" competition to showcase innovative AI applications.

Learn more about talent development at CM.com and becoming an AI-first company through insights from our Talent Manager and Head of HR in our Management Board report under the Our Culture section.

We monitor the usage of training options, aiming that 95% of our employees (excluding employees on parental or long-term sickness leave) participate in at least one learning or development activity annually. Participation and scoring are addressed by team leads during the annual performance review cycle under 'cultural fit'. We ensure equal access to training hours for all employees, regardless of gender, promoting an inclusive and balanced learning environment. Across all our training initiatives, we intentionally bring together colleagues from various departments and business units. This fosters cross-functional collaboration, strengthens internal networks, and encourages knowledge sharing beyond the classroom.

We encourage employees to think about and grow their careers through career dialogues. Additionally, we offer workshops to help teams and individuals discover their personality styles, enhancing engagement and motivation. By fostering an environment where employees feel understood and valued, we aim to boost overall engagement. We believe periodic performance review contributes to the professional growth and development of our employees.

Every employee has an annual performance review meeting unless they have been employed for less than four months before the review or if a contract termination was communicated. For clarity, employees in the Netherlands, Germany, Belgium, and Denmark who started after April, as well as employees outside these countries who started during 2025, are considered not to have participated in the performance review for 2025. While they are not included in the review process, these employees are included in the denominator of the calculation. The numerator of the calculation contains an estimation based on employment date and, the number of reviews is proportional to the number agreed upon by management.

Employees who request a career dialogue in addition to their annual performance review do not lead to a higher participation rate in the calculation.

In accordance with ESRS S1-13, training and skills development metrics require entities also to disclose the average number of training hours per employee, by gender. At this stage, we do not yet have detailed and robust information at this level and apply for the transition relief.

Our internal training programs are consistently evaluated by employees, allowing us to continuously improve the content and delivery of our offerings. We focus on providing training that is relevant to our employees’ current roles and prepares them for future opportunities. From AI and digital skills to soft skills and specialized departmental training, we are dedicated to supporting the growth of our people, which drives the success of our company.

In this section, we will address the (potential) impacts and risks related to the material topic of Privacy & Data Security, as indicated in our Double Materiality Assessment. This sustainability matter is covered in topical ESRS S4 under the subtopic 'Information-related impacts for consumers and/or end-users,' specifically 'Privacy.' Considering CM.com also anticipates potential negative impacts and risks on its own workforce in this context, we have expanded the scope in this chapter, also addressing own workforce.

At CM.com, privacy and data security are integral to our operations and essential for maintaining the trust of our stakeholders. In today’s digital world, safeguarding personal and corporate data is not only a regulatory requirement but also a responsibility we embrace to uphold our reputation and integrity. The trust placed in us by our employees, clients, and partners depends on our ability to protect their data from unauthorized access and breaches, which could result in harm to individuals, financial penalties, and reputational damage.

As an AI-first organization, CM.com embeds privacy, security, and responsible AI principles into the design of its solutions. Our AI governance is aligned with ISO 42001, which helps identify and mitigate AI-related risks, including those affecting data protection, transparency, and accountability. Together with our privacy and security controls, this ensures that innovation remains trustworthy, compliant, and socially responsible.

As a licensed Payment Service Provider and a global conversational commerce leader, CM.com connects enterprises and brands to billions of mobile users worldwide. Our services enable seamless communication between businesses and their customers, often involving the handling of sensitive and confidential data. While our primary focus is on serving businesses, we also interact directly with consumers and end-users in specific cases, such as ticket insurance within our Live offering and customer support for ticketing services. This responsibility underscores the importance of our robust privacy and data security measures.

CM.com has established a comprehensive Privacy Program to ensure compliance with data protection regulations and uphold the highest standards of privacy and data security. This program is guided by our Privacy Policy and overseen by the Data Privacy Governance Board ('DPGB'), a multi-disciplinary team comprising members of the Legal, HR, Security, Revenue Operations, and Risk & Compliance departments. The DPGB adopts a risk-based approach to data protection, ensuring compliance with the European General Data Protection Regulation (GDPR) and other applicable regional privacy laws. The DPGB is responsible for defining and implementing privacy policies, raising awareness among employees, and managing the data process register. This register ensures that every service and internal process involving personal data has a designated data process owner.

Each data process owner is a representative of the relevant CM.com product team or department responsible for processing data on an operational level, often product owners and HR employees. They are responsible for maintaining and updating the data process register, ensuring compliance with privacy legislation. The DPGB reviews all data processing activities annually, with additional oversight provided by the Internal Audit department on a rotational basis. This review monitors if data is properly processed and measures are taken to sufficiently safeguard the data.

To effectively manage privacy-related risks, CM.com has established an extensive Risk & Control framework aligned with industry standards, including ISO 27001, ISO 27017, and ISO 27018. This framework involves annual testing and reporting to the Management Board and Audit Committee to evaluate the effectiveness of our data protection measures. In 2025, CM.com extended the achieved ISO standards by obtaining ISO 27701 (Privacy Information Management System) and ISO 42001 (AI Management System) for AI-related products, underscoring our commitment to data privacy. Obligations from these new ISO certifications are also embedded in our internal risk and control framework.

In the event of a data breach involving Personally Identifiable Information (PII), CM.com has a clear Incident Management Policy supported by tools and processes to ensure a coordinated and effective response. The new incident process enhances CM.com's ability to identify PII-related incidents and other legal obligations, such as DORA and NIS2. It also ensures timely and accurate reporting to oversight bodies. The incident management process aligns with ISO 27001 and ISO 27018 standards, and CM.com provides clients with the necessary information to meet regulatory obligations.

Additionally, our platform, status.cm.com keeps all stakeholders informed of any service disruptions or planned maintenance.

Privacy is a key focus in the development of all CM.com software and applications. From the design phase, we implement privacy-enhancing measures such as advanced encryption, strict access controls, and ¹data retention policies. Following the principle of ‘privacy by design,’ CM.com performs Privacy Impact Assessments (PIAs) for new projects or initiatives to identify and mitigate privacy risks early. For sensitive data, we apply additional security measures to ensure maximum protection.

To maintain a culture of privacy and security, CM.com provides ongoing training for all employees. In late 2024, we updated our basic privacy training and integrated it into the CM Academy. All employees must complete mandatory training modules annually, as outlined in our Training Policy and described in Own Workforce section. Starting in 2025, we aim for a 95% completion rate for mandatory security and compliance training within set timeframes. For new employees, these trainings are part of the onboarding process. Privacy awareness training participation was 87%. Participation in mandatory training is improving but requires further attention. Advanced training for data process owners was introduced in November 2025, with participation actively monitored by the DPGB. Participation measeured at year-end was 65%. Besides training participation, no other targets are adopted to manage private and data security-related material negative impacts and risks, as these are covered by our Risk & Control framework as described.

To further raise awareness, a internal Privacy Knowledge Page for employees was implemented, providing all relevant information about privacy at CM.com.

Additionally, the data processing register was fully migrated to a new environment, enabling CM.com, as of 2025, to automate updates, review the accuracy and relevance of data processes, and actively monitor and report on the progress of updating the register. The register now reflects all changes in services and internal processes, with stopped services decommissioned and new services added before year-end. In preparation for the EU Artificial Intelligence Act, AI-related requirements were also incorporated into the register. This Act establishes a legal framework for AI, promoting innovation while safeguarding the fundamental rights and safety of consumers and end-users. As AI developers and users, we are committed to complying with this regulation.

CM.com’s proactive approach to privacy and data security delivered positive results. In 2025, no data breaches required notification to the Dutch Data Protection Authority under GDPR, and no complaints were received from the Dutch Data Protection Authority. There were no data breaches in other countries either. These outcomes reflect our commitment to minimizing privacy risks and protecting entrusted data.

To promote transparency and accountability, we encourage stakeholders to report concerns or violations related to CM.com or its representatives, via our Speak-Up tool. Our publicly available Speak-Up Policy ensures concerns are addressed and whistle-blowers are protected. For more information, reference is made to the Business Ethics section.

1. Please note that this policy is pending Management Board approval as per the signing date of the sustainability statements.

Governance

Material Governance Impacts, Risks, and Opportunities

At CM.com, we are deeply committed to fostering a culture of trust, integrity, and social responsibility. These principles form the foundation of our business ethics and guide our interactions with clients, employees, partners, and stakeholders. As a global leader in conversational commerce, we understand the importance of maintaining the highest ethical standards in all aspects of our operations. This commitment is reflected in our robust policies, proactive approach to compliance, and dedication to creating a safe and transparent environment for everyone associated with CM.com while contributing to a positive societal impact.

Our approach to business ethics is built on a strong foundation of values that define who we are and how we operate. At CM.com, we believe that ethical business practices are not just a requirement but a responsibility. Our Code of Conduct, which is accessible on our website and intranet, serves as a cornerstone for our ethical framework. It outlines clear principles for all employees, contractors, and partners to act with integrity and align their actions with CM.com core values, as described in Our Culture section.

The Management Board oversees business conduct and ensures compliance with the Code of Conduct, which is aligned with the Dutch Corporate Governance Code. This ensures that every individual representing CM.com adheres to the highest standards of ethical behavior and actively works to prevent actions that could harm the company’s reputation or interests. Our Code of Conduct encompasses a wide range of policies, including anti-corruption and bribery, anti-harassment, gifts and hospitality, insider trading, security, and privacy. These policies are designed to safeguard our operations, protect our stakeholders, and ensure that CM.com remains a trusted partner in the industry.

To make the policies more visible and searchable, with use of our HALO product an AI agent is built, called Norma, which allows CM.com employees to search for policies and specific content from the Policy House, a knowledge base with all policies. Based on the number of policy search prompt we see an increase in awareness of the policies and how to act in line with these.

Driven by the updated Dutch Corporate Governance Code, specifically the Statement on Risk Management, CM.com deems it important to be transparent about risk management implementation for operational and compliance risks and where necessary keep improving on these topics. Compliance in this matter includes both regulations as well as policies supporting ethical behavior. For more information see our Management Board report under the Risk Management section.

At CM.com, we recognize the risks associated with fraud and corruption and are committed to mitigating them. Our Anti-Fraud and Corruption Policy emphasize the importance of cultivating an ethical business environment that prioritizes safety and integrity. Employees are expected to act ethically and report any suspicions of fraud or bribery through our dedicated Speak-Up channels.

To prevent unethical behavior, we have established clear guidelines for accepting gifts and hospitality. For example, any gift exceeding €250 requires prior approval to ensure it does not compromise CM.com reputation or interests. Violations of these policies are treated seriously and may result in disciplinary action. By encouraging transparency and accountability, we aim to uphold the highest standards of ethical conduct.

CM.com is dedicated to integrity in business, complying with laws, regulations, and company policies. Awareness of potential violations is key to safeguarding our company and stakeholders from any (financial) consequences. During 2025, no incidents of bribery or corruption have been reported, nor have there been any convictions or fines for violating anti-corruption and anti-bribery laws.

We believe that an open and secure work environment is essential for fostering trust and collaboration. Our Speak-Up Policy empowers employees, clients, suppliers, and other stakeholders to report suspected misconduct or violations in a safe and confidential manner. This proactive approach allows us to address concerns promptly and prevent potential issues from escalating.

CM.com offers multiple reporting channels, both internally and externally, including confidential advisors and an independent Speak-Up Tool. This tool provides a 24/7 platform for reporting concerns in employees’ native languages, with the option to remain anonymous. The Speak-Up Policy guarantees that no retaliatory action will be taken against individuals who report concerns in good faith, in line with the Dutch Whistleblower Protection Act and the EU Directive 2019/1937.

To ensure accessibility and awareness, the Speak-Up Policy is prominently featured on our website and intranet and is included in mandatory training programs. We also conduct regular surveys to measure employees’ trust in the policy and their comfort level in raising concerns. Reported issues are handled by the Speak-Up Committee, which operates independently from management to ensure objectivity and thorough investigations. The committee reports its findings to the Management Board on a quarterly basis.

In 2025, 2 cases of possible misconduct have been reported and processed in line with the Speak Up policy. The investigation by the Speak -Up committee showed that the 2 cases were one-off deviations from the desired ethical behavior. Follow-up actions to create more awareness about desired behavior have been taken, as well as improvement in operational procedures preventing more likewise cases to happen.

At CM.com, we believe that fostering a culture of ethics requires continuous education and engagement. Our corporate values—honesty, integrity, and respect—are deeply embedded in our policies and reinforced through various initiatives. From onboarding new employees to quarterly meetings and leadership updates, we ensure that our ethical principles are consistently communicated and upheld.

Our CM Academy offers mandatory training modules that provide employees with the knowledge and tools they need to act with integrity. These e-learning courses cover key policies, ethical decision-making, and reporting channels for concerns as well as basic knowledge on among others security and privacy. In 2025, we updated our basic compliance training to reflect the latest legal and regulatory requirements. Since the start of 2025, we actively monitor training completion aiming at 95% completion rate for mandatory security and compliance training within designated timeframes. The Code of Conduct training reached 90% participation. This is an increase in comparison to previous years but can be increased still. Actions are taken to improve the participation grade via actively involving BU management teams and HR business partners. Including participation of mandatory trainings in the yearly employee performance reviews, as part of the cultural fit axis, is postponed to 2026.

CM.com not only communicates about and provides training on business ethics but also validates via employee surveys whether employees perceive CM.com as a safe environment, specifically that CM.com will take appropriate action when an employee experiences misconduct. In general, this is the case resulting in a 8.0 score (out of 10) in the employee survey.

In providing payment services, CM.com actively monitors and prevents illegal activities through Know Your Customer (KYC) and customer due diligence procedures. We exercise due care and attention when accepting new customers and partners, refusing to engage with those on national or international sanction lists. In 2025, CM.com started to expand the KYC procedures to other service offerings.

In providing payment services, CM.com actively monitors and prevents illegal activities through Know Your Customer (KYC) and customer due diligence procedures. We exercise due care and attention when accepting new customers and partners, refusing to engage with those on national or international sanction lists. In 2025 CM.com started to expand the KYC procedures to other service offerings.

The scope of business ethics is expanded with the enforcement of the Accessibility Act. For the products and services that are in scope of this act, like pin terminals, ticketing services but also our chatbot solutions gap analysis against Voluntary Product Accessibility Template (VPAT) Level A and Level AA requirements are performed. If necessary, improvements will be made and monitored. This will continue in 2026. Learn more about Accessibility & Inclusion at CM.com, and gain insights from our Accessibility Specialist in our Management Board Report under the Our Commitment to Sustainability section.

ESRS Content Index

List of data points that derive from other EU legislation

Consolidated Financial Statements

Consolidated Statement of Financial Position as at December 31, 2025

(After proposal of appropriation of result)

1. Of which restricted: € 20.1 million (2024: € 20.3 million). Refer to note 15 for more details.

Consolidated Statement of Comprehensive Result for the Year Ended December 31, 2025

1. The other comprehensive result consists completely of foreign currency translation which may be reclassified subsequently to profit or loss.

Consolidated Statement of Changes in Equity for the Year Ended December 31, 2025

1. The equity component of convertible bonds is presented net of tax (note 17). It includes a Deferred tax liability recognized through equity offset by a related deferred tax asset recognized through equity, see note 9.
2. On March 11, 2025, CM.com repurchased its convertible bonds for € 87 million, refer to note 17. As part of this transaction, the equity component of the convertible bonds of € 5.5 million, previously recognized as a separate component of equity, was reclassified to accumulated deficits in accordance with IAS 32.IE46, with no impact on total equity.

Notes to the Consolidated Financial Statements