Company: CIB
Filing Date: 2025-11-14
Form Type: 6-K
Source: 0002058897-25-000052
Chunk: 28

Company: Grupo Cibest S.A.
Filing Date: 2025-11-14
Form: 6-K
Chunk 28
---
 traceability of the process. Furthermore, an early warning engine was implemented to anticipate the expiration of findings and action plans resulting from independent model validation, generating proactive alerts aimed at reducing the average closure time.

#### •

#### Cybersecurity And Information Security Risk
| 28 |

As Grupo Cibest Consolidated its business model leveraged on emerging technologies, it is increasingly facing more relevant challenges and risks in terms of cybersecurity and information security. This exposure can generate impacts on the operation of the business, reputational damage or even fraudulent events.

So far in the third quarter of 2025, the focus is on building, disclosing, and approving cyber risk appetite, defined by the number of vulnerabilities Grupo Cibest Consolidated is willing to accept in its technological environment to achieve business objectives efficiently and securely.

#### •

#### Internal Fraud Risk
At Grupo Cibest Consolidated, we uphold a firm stance of zero tolerance toward fraud, in any of its forms. To support this commitment, we have an anti-fraud program currently in operation, with formally approved policies, based on the COSO internal control framework. This program aims to strengthen the internal control environment through mechanisms that enable the prevention, detection, and coordinated response to internal fraud risks, fostering collaboration among the various areas involved.

Additionally, it serves as a comprehensive risk management framework within Grupo Cibest Consolidated, addressing issues related to fraud in financial reporting, misappropriation of assets, and corruption, ensuring an effective response aligned with international best practices.

#### •

#### Risk Of AML/CFT
Regarding AML/CFT and corruption risks, during the quarter efforts were focused on stabilizing processes, controls, and activities related to prevention, awareness, detection, and response at Grupo Cibest S.A. These actions have strengthened the control environment and advanced the proper identification, assessment, and effective management of risks, thereby contributing to the achievement of the organizational purpose.

Throughout the quarter, notable efforts were made to align compliance actions with the corporate vision and strategy, reinforcing a control environment that supports sustainability and decision-making as a group. This approach has enabled progress in technical specialization, process optimization, aspirational profiling, and alignment of our actions with organizational objectives. Positive evaluations by oversight bodies reflect strong performance and validate the maturity of compliance systems as a key enabler for risk management and value creation.

Within this context, it is recognized that current challenges demand a permanent commitment from all compliance teams to challenge established models, drive continuous evolution, and ensure strategic contribution to the business.

#### •

####