To the General Assembly of Shareholders of Türkiye Vakıflar Bankası T.A.O.:

Auditors’ Report was prepared in accordance with the Article 31 of Türkiye Vakıflar Bankası T.A.O. Articles of Incorporation and presented to you.

The Bank is open to public scrutiny and periodically audited by the Banking Regulation and Supervision Agency (BRSA) and the Court of Accounts as well as the Independent Auditing Firm pursuant to Article 30 of the Bank’s Articles of Incorporation.

In 2025, the Bank

• Increased its assets by 34% to TL 5,388,289,819 and increased its loans, which have the most important share with 34%, to TL 2,925,229,862 by increasing by 46%.
• Raised its deposits by 36% to TL 3,449,194,644 thousand to expand its deposit base. In this context, it increased its demand deposits by 69% to TL 1,127,911,091; and savings deposits by 28% to TL 1,549,735,686.

Attaining a profit of TL 70,050,312 thousand in 2025, the Bank’s capital adequacy ratio is 16.71%.

Providing service with a total of 980 branches and 19,147 personnel, the Bank continued to support the economy with its strong funding sources and structure. The development of the staff is supported by training courses given by the Bank’s Corporate Academy and 756,190 person/hour training was given to employees in 2025.

The financial information regarding the annual activities of the Bank, is presented in conformity with the procedures and principles in force under Banking Law numbered 5411, Turkish Commercial Code numbered 6102, Capital Market Law numbered 6362, generally accepted accounting principles, relevant legislation and the Regulation on Banks’ Internal Systems and Internal Capital Adequacy Assessment Process.

The internal systems departments of the bank consist of the Board of Auditors Department, the Internal Control Department, the Risk Management Department and the Compliance and Regulation Department. It is observed that,

• Within the framework of the risk-focused audit plan; audit activities are carried out in a way that they include domestic and foreign branches, business units, and consolidated partnerships,
• Procedures regarding the performance of the Bank’s activities, information systems, and financial reporting system are checked,
• The risks the bank is exposed to, the controls related to them, and the results of the risk assessment are presented to the Audit Committee,
• The risks exposed or anticipated risks are identified on the basis of materiality, and such risks are defined in policies, which then govern the monitoring, calculation, and reporting activities,
• For risks to be identified in further detail, various sensitivity analyses, internal scenario analyses, stress tests, and similar activities are carried out on a daily, weekly, or annual basis,
• Validation and monitoring activities of credit risk parameter models used in the process of internal rating and TFRS 9 provision calculations are conducted throughout the bank,
• Audits and assessment were made to check whether the companies providing the Bank with support services comply with the stipulated terms and conditions,
• Within the scope of compliance and legislation checks; the legislation regarding the banking activities and the developments regarding the banking practices are followed up daily and their effects on the banking activities are evaluated, the measures to be taken by the Bank and the changes to be made in the Bank’s internal legislation and practices are determined, and the efforts to harmonize with the legislative changes in the Bank are coordinated, the actions taken by the relevant business departments, as well as the new products and services, are monitored and controlled in terms of the compliance with the legislation, efforts to comply with FATCA and CRS legislation is coordinated; corporate policies and procedures regarding risk management, monitoring and control, training and internal auditing, which are enforced within the scope of MASAK legislation are formed,
• The transactions carried out at the bank are examined through monitoring and control programs; the results of the analysis are analyzed and necessary notifications are made in line with the reporting obligation, and in this context, it is ensured that all transactions and activities of the Bank are carried out in accordance with the legal regulations regarding the prevention of laundering proceeds of crime and financing of terrorism,
• The Board of Directors Declaration of 2025, which was prepared in accordance with the BRSA’s circulars and communiqués and includes evaluations regarding the internal control system, was approved by the Board of Directors and shared with the Independent Auditing Firm.

As a result; it is understood that the internal control, internal audit and risk management systems established by the bank are operated effectively, adequately and appropriately, and the studies and trainings to prevent and detect fraudulent transactions are carried out.

Yours sincerely,