Banco de Chile seeks to maintain a risk profile that ensures the sustainable growth that is aligned with its strategic objectives, maximizing value creation and guarantee its long-term solvency. The Overall risk management takes into consideration the different business segments to which the Bank, provides services, being approached from a comprehensive and differentiated perspective.

Our risk management policies are established to identify and analyze the risks faced by the Bank, set appropriate risk limits, alerts and controls, monitor risks and compliance with limits and alerts in order to perform the necessary action plans. Through its administration policies and procedures, the Bank develops a disciplined and constructive control environment. Policies as well as risk management standards, procedures and systems are regularly reviewed, and with strict adherence to compliance with the current regulatory framework.

For such purposes, the Bank has teams with extensive experience and knowledge in each area associated with risks, ensuring comprehensive and consolidated management of such risks, including the Bank and its subsidiaries.

Credit, Market and Operational Risk Management are at all levels within the Organization, with a Corporate Governance structure that recognizes the significance of the different risk areas that exist.

The Bank’s Board of Directors as the maximum authority is responsible for establishing risk policies, the Risk Appetite Framework, and the guidelines for the measurement criteria and follow up of risks. Also, it approves the risk limits and contingency plans for each of the risks. Moreover, it approves the following policies: Credit risk policy, policy for complex products and services, operational risk policy, business continuation policy, outsourcing policy, market risk policy and liquidity risk policy. Likewise, it approves the provision models, Additional Allowances Policy and pronounces annually on the adequacy of allowances. Additionally, it approves the capital management policy for the monitoring, control, administration and the management of the Bank´s capital. Also, it confirms the strategies, functional structure and comprehensive management model of Operational Risk and guarantees the consistency of this model with the Bank’s strategy and proper implementation of the model within the organization. Accordingly, it has approved the risk management policy of the model together with the development framework, validates and follows up on the models. Furthermore, it establishes the Subsidiary Risk Control Policy, describing the supervision scheme that the Bank applies to the relevant subsidiaries to control the risks that affect them. Management is responsible both for the establishment of standards and associated procedures as well as for the control and compliance with that agreed by the Board of Directors, ensuring that there is consistency between the criteria applied by the Bank and its subsidiaries, maintaining strict coordination at the corporate level and informing the Board of Directors at the defined instances.

The Bank’s Corporate Governance considers the active involvement of the Board, acting directly or through different committees made up of Directors and members of the Senior Management. It is regularly informed and becomes aware of the evolution of the different risk management areas, being involved through its Finance, International and Financial Risk, Credit, Portfolio Risk Committee, Higher Committee on Operational Risk and Capital Management, in which the status of credit, market and operational risks and the Bank’s capital management are reviewed.

In addition to the Directors’ Committees, the Bank’s Management has the Technical Committee for the Supervision of Internal Models, the Model Risk Management Committee and the Operational Risk Committee, which review specific matters.

The sections below describe the different Board of Directors’ and Management’s committees mentioned above.

Risk Management is performed by the Corporate Risk Division, which by having highly experienced and specialized teams, together with a sound regulatory framework, allows for optimal and effective management of the matters it addresses.

The Corporate Risk Division contributes to providing effective governance to the Corporation’s main risks, with a focus on optimizing the risk-return relationship, ensuring business continuity and generating a robust risk culture, identifying potential losses derived from the non-compliance of counterparties, movements in market factors or the lack of adequacy of processes, people or systems, comprehensively contributing to capital management.

Likewise, it continually manages risk knowledge from a comprehensive approach, in order to contribute to the business anticipating threats that may damage the solvency and quality of the portfolio, promoting a unique risk culture towards the Corporation through training and permanent training.

Within this Division, the Bank’s risk functions are integrated as follows, ensuring, at the same time, the correct segregation of duties and independence:

The regulatory body, manages credit risk, policies, standards and procedures of credit risk, adapting the established requirements and processes, for all segments on a cross-cutting manner in the Bank. Likewise, it conducts reviews of the quality of the credit process applied to retail banks and the continuous training of executives.

In addition, it is responsible for managing the sale of assets recovered by the Bank, arising from credit recovery processes.

Likewise, it provides information to the different governance bodies and areas involved in the decision-making process and contributes to providing effective governance to the Corporate Risk Division projects, ensuring regulatory compliance and the proper performance of the projects. Themselves, as well as being responsible for the management control of the Corporate Risk Division.

Additionally, this Area is responsible for managing the process of calculating allowances for credit risk, ensuring the correct perfomance of the processes and analysis of the results obtained.

It conducts an independent review, evaluating the quality of the data, modeling techniques, compliance with regulatory provisions, its implementation within the institution and existing documentation. It also tracks the performance of the models and monitors each stage of the life cycle of the models within its scope, with the final purpose of generating mechanisms that allow it to measure and manage the level of model risk to which the Bank is exposed.

Finally, it is responsible for conducting an independent assessment of the internal control environment. For this purpose it has procedures that use the COSO 2013 (Committee of Sponsoring Organizations of the Treadway Commission) framework as a reference, which comprises five components: control environment, risk assessment, control activities, information and communication, and monitoring. This is carried out within the context of complying with local and international regulatory requirements, through the Updated Compilation of Regulations issued by the Financial Market Commission and Section 404 of the Sarbanes-Oxley Act, respectively.

As part of the structure, the Business Continuity Management is responsible for the management, control, and administration of recovery strategies in contingency situations. In addition, it ensures the Bank’s operational resilience by maintaining the crisis-management governance model, guaranteeing the continuity of critical services and operations, particularly those related to critical payment products and services. This model is strengthened through a comprehensive resilience framework that includes ongoing training programs, plan updates, and controlled testing to validate the effectiveness of the strategies against disruptive events that may impact the Bank, thereby reinforcing its capacity to respond safely and efficiently. Additionally, the structure includes the role and responsibilities of the Information Security Officer (ISO), who operates independently from the Cybersecurity Division. The ISO’s function is to design and implement controls by monitoring the activities carried out by the organizational units responsible for information security, cybersecurity, and technology risk within the Bank and its subsidiaries.

Additionally, the Bank has the Cybersecurity Division, which is responsible for defining, implementing and reporting the progress of the Strategic Cybersecurity Plan in line with the Bank’s business strategy, with one of its main focuses being to protect internal information, of its clients and collaborators.

This Division consists of the Governance and Identity Management, the Cyber Defense Management and the Technological Risk and Cyber Intelligence Management. The Cybersecurity Management and Subsidiaries Control Department is also part of the division, as a control unit. Section 5 of this Note describes the responsibilities of the indicated Managements.

Bank’s Board of Directors’ and Management’s Committees

In general terms, the objectives of this committee are to monitor and continuously review the liquidity status and, trends in the most important financial positions, as well as the associated results, and the price and liquidity risks that will be generated. Certain of its specific functions include, the review of the proposal to the Board of Directors of the Risk Appetite Framework (RAF), the Financing Plan and the structure of limits and alerts for price and liquidity risks, reviewing and approving the Comprehensive Risk Measurement (CRM) for subsequent due review in the Capital Management Committee and approval by the Board of Directors, the design of policies and procedures related to the establishment of limits and alerts for price risk and liquidity risk; reviewing the evolution of financial positions and market risks; monitoring limit excesses and alert activations; ensuring adequate identification of risk factors in financial positions; ensuring that the price and liquidity risk management guidelines in the Bank’s subsidiaries are consistent with those of the Bank, and that these are reflected in its own policies and procedures.

The credit approval process is performed mainly through several credit committees, which are composed of qualified professionals and with the sufficient powers to make the decisions required.

Each committee defines the terms and conditions under which the Bank accepts counterparty risks, and the Corporate Risk Division participates independently and autonomously of the commercial areas. They are constituted according to the commercial segments and the amounts to be approved and have different meeting periodicities.

Within the Bank´s risk management structure, the maximum approval instance is the Director´s Credit Committee. Its functions are to resolve all credit transactions associated with customers and economic groups with approved lines of credit in excess of UF 750,000, and to approve all credit transactions where the Bank’s internal regulations require approval from this Committee, except for any special powers delegated by the Board of Directors to Management.

Among other duties, the Portfolio Risk Committee must understand the composition, concentration and risks attached to the bank’s loan portfolio, from a global, sectoral and business unit perspective, review and approve the comprehensive risk measurement (CRM) and the Credit Risk Appetite Framework (RAF) in the area of credit risk; It must review the main debtors, their delinquency, past-due portfolio and impairment indicators, together with the write-offs and loan portfolio allowances for each segment. It must propose differentiated management strategies, as well as analyzing and agreeing on the and analyze credit policy proposals that will be approved by the Board of directors. This committee also reviews and confirms the approvals of management models and methodologies Also, this committee is responsible for reviewing and ratifying the approvals of management models and methodologies previously conducted by the Technical Committee for the Supervision of Internal Models, as well as proposing the regulatory models and methodologies for final approval by the Board of Directors.

The purpose of the Collection Committee is fundamentally to ensure the ongoing and proper monitoring of credit collection activities. In particular, it focuses on reviewing the results and evolution of the amounts assigned to collection across the different delinquency stages of each product, as well as the productivity and recovery performance of the various banking segments

The Senior Operational Risk Committee makes any necessary changes to the processes, controls and information systems that support the Bank’s transactions, to mitigate operational risks, and assure that areas can appropriately manage and control these risks.

This Committee has functions dedicated to supervising appropriate operational risk management at the bank and its subsidiaries, and for implementing the policies, standards and methods associated with the bank’s comprehensive operational risk management model. It plans initiatives to develop it and publishes them throughout the bank. It promotes a culture of operational risk management within the bank and its subsidiaries; review and approve the comprehensive risk measurement regarding Operational Risk. It approves the bank’s operational risk appetite framework; ensures compliance with the current regulatory framework, in matters that are limited to Operational Risk; become aware of the main frauds, incidents, events and their root causes, impacts and corrective measures accordingly; ensure the long-term solvency of the Organization (business continuity plans, information security and cybersecurity, controls, among others), avoiding risk factors that may jeopardize the continuity of the Bank. To decide about new products and services, and to verify the consistency of the operational risk management policies, business continuation, information security and cyber security across the bank’s subsidiaries, monitors their compliance, and reviews operational risk management at subsidiaries; become aware of the level of risk to which the bank is exposed in its outsourced services, sanction the selection of the model to perform stress tests and scenario selection methodologies and evaluate the results, among others.

The main purpose of this committee is to assess, monitor and review capital adequacy in accordance with the principles in the bank’s capital management policy and its risk framework, to ensure that capital resources are adequately managed, the CMF’s principles are respected, and the bank’s medium-term sustainability.

Among other functions, this committee must ensure compliance with the main guidelines to be used for the construction of models; analyze the adopted criteria and review and approve methodologies associated with non-regulatory models, which must be submitted to the Portfolio Risk Committee for consideration, for final confirmation; For regulatory models, this Committee is limited to its review, leaving approval in the hands of the Portfolio Risk Committee and subsequently the Board of Directors. He is also in charge of ensuring compliance with the model monitoring guidelines, which are also approved by the Board of Directors.

Its main function is to establish and oversee the institution-wide model risk management framework. Among other responsibilities, this committee reviews and discusses the identification and assessment of model risks based on aggregated results, provides guidelines and verifies the consistency of policies with subsidiaries, ensures the updating of the institutional inventory of models and methodologies, reviews the status of observations and action plans, and submits the Model Risk Management Policy to the Board of Directors for review and approval.

The risk management processes of the entire Bank are permanently audited by the Internal Audit Area, which examines the sufficiency of the procedures and their compliance. Internal Audit discusses the results of all evaluations with Management and reports its findings and recommendations to the Board of Directors through the Audit Committee.

Regarding to Credit Risk, loan loss provision and write offs are the fundamental metrics of the credit quality of our portfolio.

Banco de Chile permanently evaluates its loan portfolio, timely recognizing its risks. The bank has a set of guidelines related to modelling techniques for decision model development (scoring, campaigns and collection models), expected credit losses and stress testing. These guidelines and the resulting models are approved by the Board of Directors.

As a result of this evaluation, on both individual and group portfolios, expected credit losses are determined.

The individual portfolio encompasses companies that due to their size, complexity or indebtedness, require a more detailed and a case-by-case analysis. Each obligor is assigned one of 16 risk categories (according to qualitative criteria based on the Bank’s internal credit rating system and a scale proposed by the regulator), in order to establish its expected credit losses in a timely and appropriate manner. The review of these classifications is carried out permanently considering the financial situation, payment behavior and the environment of each client.

The group portfolio encompasses natural persons and smaller companies. These assessments are carried out monthly through statistical models that estimate the appropriate level of expected credit losses. The consistency of these models is assessed through an independent validation and, subsequently, through the model monitoring process (i.e. retrospective tests) that compare actual vs expected losses.

In 2025, the Bank made a few adjustments to the ECL models, more precisely to their PD forecasting (forward-looking) model for the individual portfolio, including more recent macroeconomic data. As a result of that, these adjustments resulted in an non-material variation of our ECL estimates.

The monitoring and control of risks are carried through a set of limits established by the Board of Directors. These limits reflect the Bank’s business and market strategy, as well as the level of risk that it is willing to accept.

Credit risk considers the likelihood that the counterparty in the credit operation will not be able to fulfill its contractual obligation due to inability or financial insolvency, and this leads to a potential credit loss.

The Bank seeks an adequate risk-return relation, and an appropriate balance of the risks assumed, through permanent credit risk management considering the processes of admission, monitoring and recovery of the loans granted. It establishes the risk management framework for the different business segments to which it provides services, responding to regulatory demands and commercial dynamism, being part of the digital transformation and contributing from a risk perspective to the various businesses addressed, through a vision of the portfolio that allows managing, resolving and controlling the business approval and monitoring process in an efficient and proactive manner.

The Bank’s credit risk disclosures presented in this note are prepared using internal risk management metrics, including gross exposure and exposure at default (EAD). The gross carrying amounts exposed to credit risk are disclosed in Note 11 and Note 23.

In the business segments, the application of additional management processes is taken into consideration, to the extent required, for those financing requests that that will have a greater exposure to environmental and/or social risks.

The Bank integrates the socio-environmental criteria in its evaluations for the granting of financing destined to the development of projects, whether nation wide or regional, and that can generate an impact of this type, where they are executed. For the financing of projects, projects must have the corresponding permits, authorizations, patents and studies, according to the impact they generate. In addition, the Bank has specialized units for proving services to large customers, through which the financing of project development is concentrated, including those of Public Works concessions that contemplate the construction of infrastructure, mining, electrical and real estate developments that can generate an environmental impact.

During 2025, the Bank continues to identify risks associated with climate change, producing heat maps for the individual portfolio related to exposure to Physical Risks (at the level of geographic areas within the country) and Transition Risks (at the level of economic sectors).

Credit policies and processes materialize in the following management principles, which are addressed with a specialized approach according to the characteristics of the different markets and segments to which services are provided, recognizing the singularities of each one of them:

Based on these management principles, the Corporate Risk Division contributes to the business and anticipates threats that may affect the solvency and quality of the portfolio, delivering timely responses to customers, maintaining the solid foundations that characterize the Bank’s portfolio in its different segments. and products.

The credit risk management process consists of the stages of Admission, Monitoring and Recovery or Collection for the retail and wholesale business segments to which the Bank provides services.

In the retail segments, admission management performed mainly through a risk evaluation that uses scoring tools and credit attribution to approve each transaction. These evaluations, for natural persons without a business line and clients in the SME segment, take into consideration the level of indebtedness, the payment capacity and the maximum acceptable exposure for the customer, through information on payment behavior, indebtedness in the financial system and business and financial information, as applicable.

Additionally, the Bank has proactive admission processes for a diverse portfolio of customers. These consist of mass evaluation of customers through statistical models of eligibility and payment capacity, generating credit offers aligned with the strategies defined. This results in having preapproved loan offers available through multiple channels taking into consideration the business plan and the relation between risk and return.

Also, for the Wholesale segments, the management of admission is conducted through an individual analysis of the customers, also considering the relationship with the rest of the entities, if applicable. This analysis takes into consideration among other factors the capacity to generate cash, the financial position with an emphasis on the equity solvency, the levels of exposure, variables of the industry, evaluation of the shareholders and the Management, the specific aspects of the operations like the structure and term of the financing, products and guarantees. The aforementioned evaluation is supported by a rating model that allows higher uniformity in the analysis of the customer and its group.

There are also specialized areas of segments that by their nature need the knowledge of an expert, such as real estate, construction, agriculture, finance, international, among others. These experts support the preparation of the transactions having certain tools designed to meet the needs of the specific characteristics of the businesses and their related risks.

From granting a loan until its full extinction, it is necessary to have a follow up of the behavior and financial position of the debtor with an emphasis on its payment capacity, as the situation of the customer and associated risk change over time. Portfolio monitoring allows the Bank to act proactively if indications of overall impairment are noted or if the debtor’s ability to meet its obligations is affected.

In the follow up function, methodologies and tools for the different segments in which the bank operates, have been developed, which allow proper management of its credit portfolio.

In the retail segments, the control and follow up concentrate on monitoring the main indicators of the portfolio and analysis of the groups, reported in the management reports, generating significant information for the decision making process in different instances defined. In addition, special follow ups are generated according to the significant events in the environment.

In the wholesale segments, a permanent follow up is performed through management tools at individual level taking into consideration the business segments and economic sectors. Through this process the alarms are generated that guarantee the proper and timely recognition of the risk in the individual portfolio and the special conditions established in the admission stage are monitored , including financial covenants, coverage of certain guarantees and conditions imposed at the time of the approval.

Additionally, in the Admission area, simultaneous follow up tasks are perform that allow the Bank to monitor the evolution of the transactions from the beginning until recovery, with the purpose of making sure that the portfolio’s risks are properly and timely, and proactively managing the cases posing higher risks.

The Bank has specific regulations related to customer collection and normalization, which ensure the quality of the portfolio in accordance with credit policies, and the desired risk appetite framework and strict adherence to the current regulatory framework. Through collection management, customers with temporary cash flow problems are favored, debt normalization plans are proposed for viable customers, so that it is possible to maintain the relationship in the long term once their situation is regularized. The recovery of assets at risk is maximized and the necessary collection actions are conducted, in a timely manner, to ensure the recovery of debts or reduce the potential loss.

In the retail segments, the Bank defines refinancing criteria through the establishment of predefined renegotiation guidelines to resolve the debt issues of viable customers with payment intentions, maintaining an adequate risk-return ratio, along with the incorporation of robust tools for differentiated collection management.

In the wholesale segments, when detecting customers that show indications of impairment or default of any type or condition, the commercial area to which the customers belongs, together with the Corporate Risk Division, establish action plans for their regularization. For cases of higher complexity where specialized management is required, the Special Asset Management, area is directly in charge of collection management, establishing action plans and negotiations based on the characteristics of each customer.

The Bank estimates the Pre-Settlement Exposure (PSE), used for credit risk management purposes, through simulations of market factors that allow forecasting the potential evolution of the economic value (CMTM) for all derivatives. The PSE corresponds to the value that a transaction could reach, in favor of the Bank, under scenarios of market volatility and with a 95% confidence level.

PSE is calculated daily for each counterparty, updating volatilities, correlations, and the parameters used in the simulation models, in order to keep market conditions as up to date as possible. Each simulation incorporates a full valuation of the transactions at every point in time.

A portfolio approach is taken into account when computing exposures of several transactions executed with a single counterparty.

Credit mitigating conditions for derivative transactions are commonly used in the local financial market. Financial institutions may use early termination clauses, netting arrangements, among others, provided the corresponding contractual documentation has been duly executed.

For counterparties residing abroad (mostly global banks), transactions are documented under ISDA Master Agreements and CSA, where netting and cash collateral above agreed threshold levels constitute the typical credit mitigation schemes.

Collateral agreements have been requested by certain banks for inter-banking transactions within other financial institutions, but its effective application under Chilean Law make advisable not to include it in the exposure measurement.

This metric is used for measuring, limiting, controlling and reporting credit exposures by counterparty.

The maximum exposure to credit risk, by customer or counterparty, without taking into account guarantees or other credit enhancements as of December 31, 2025 and 2024, does not exceed 10% of the Bank’s effective equity.

The tables below show credit risk exposure per balance sheet item, including derivatives, detailed by both geographic region and industry sector as of December 31, 2025:

The tables below show credit risk exposure per balance sheet item, including derivatives, detailed by both geographic region and industry sector as of December 31, 2024: