*Information on the issuer's outstanding securities can be found in section Our Shareholders

In this report, we cover the key topics of our management in 2024. We report on the main achievements aligned with the strategy and the goals to be met.

In the final segment, we present the GRI (Global Reporting Initiative) content index, the economic, environmental, and social indicators that contribute to the compilation of a sustainability report. We also present the SASB (Sustainability Accounting Standards Board) indicator index. Additionally, we have a chapter that complies with Notice 031 of the Financial Superintendency of Colombia, through which we disclose our TCFD (Taskforce on Climate-Related Financial Disclosures) and SASB reports.

This document has been prepared in accordance with the GRI Standards Core option. We will continue to use this methodology to deliver a management report increasingly tailored to different stakeholders. This report was verified by a third party who reviewed its content adaptation to the Global Reporting Initiative's Sustainability Reporting Standard (GRI Standard).

Likewise, we demonstrate our commitment to sustainability by showcasing our efforts in voluntarily managing the 10 Global Compact Principles, our contribution to the fulfillment of the Sustainable Development Goals (SDGs), the commitments of the Paris Agreement, and participation in frameworks such as the Dow Jones Sustainability Index (DJSI), Equator Principles, United Nations Environmental Program – Financial Initiative (UNEP FI), Carbon Disclosure Project (CDP), Principles for Responsible Investment (PRI), Principles for Responsible Banking (PRB), Partnership for Carbon Accounting Financials (PCAF), Net Zero Banking Alliance (NZBA), Task Force on Climate-Related Financial Disclosure (TCFD), the Global Investors for Sustainable Development (GISD) Alliance, and the Glasgow Financial Alliance for NetZero (GFANZ), among others.

I.ABOUT BANCOLOMBIA GROUP

Bancolombia Group celebrates 150 years of operation, marking a perfect occasion to reaffirm our commitment to promoting sustainable development to achieve the well-being of ALL.

For more than a century and a half we have been witnesses and protagonists of the growth of the countries in which we operate, understanding that our success is determined by the positive impact we generate on the economy, society and the environment.

We are more than 34,000 employees in Colombia, Panama, Guatemala, El Salvador, among other countries, who work under a culture of ethics and integrity towards all our stakeholders.

Our experience, financial strength and knowledge allow us to accompany countries to strengthen the production network, build sustainable cities and communities, and promote financial inclusion.

This is possible thanks to a wide range of financial and non-financial solutions and the largest physical and digital network in the countries where we operate, serving more than 33 million people and companies that trust us. We strive to make interactions easy, timely, reliable and close, always aiming for financial well-being.

In 15 decades, we have developed capabilities on different fronts of financial activity. Banking (accounts, deposits, transactional services, consumer, commercial, and mortgage loans, microloans, and our platforms A la Mano and Nequi), leasing, renting, brokerage, trust services, investment banking, and capital market solutions are some of the offerings designed to meet the needs of households, businesses, and governments.

We are known in the market with brands such as Bancolombia, Plink, Wompi, Nequi, Sufi, Renting, among others, in Colombia, Banistmo in Panama, BAM in Guatemala, and Banco Agrícola in El Salvador.

We evolve at the pace of people and businesses. That’s why we expand our capabilities alongside partners, fintechs, and other industries, aiming to become a platform that provides comprehensive solutions. Our goal is also to integrate our products and services into third-party platforms.

We are also celebrating 30 years of listing our shares on the New York Stock Exchange (NYSE), which, together with our continued presence in the Colombian Stock Exchange, has ensured us permanent access to the local and international capital markets, as well as a continuous improvement in our corporate governance.

For several years, we have been the company with the best reputation in the country, the one with the best corporate governance, the one with the best ESG responsibility and the one with the best capacity to attract and retain talent, according to the Merco monitor.

Our commitment goes beyond the countries where we operate. We engage beyond our borders, as we are aligned with the United Nations Sustainable Development Goals and work with global actors to find solutions to the environmental and social challenges facing the world.

These 150 years of history allow us to look to the future with optimism. We believe that our growth should translate into both profitability and dynamism for the economy and a better quality of life for people. Our vision is long term, because we seek to continue contributing to the construction of our countries for the well-being of ALL.

Under our purpose of promoting sustainable development for the well-being of all, at Bancolombia Group we transform ourselves every day to face the economic, environmental and social challenges we face, and to accompany more than 30 million customers in their daily lives.

From this purpose we derive the strategic priorities and vision of success that allow us to ensure our sustainability as an organization and our positive impact on the well-being of society.

Our strategic objectives are based on the following premises:

We are adequately managing risk, taking care of soundness, while expecting moderate growth in the economy and a good performance in the quality of our portfolio. We support our growth with pre-approvals, instant answers and personalized offers from our portfolio of products and services according to our customers' needs. We take care of our level of efficiency, proactively managing the organization's expenses and focusing on being more productive.

We offer services that generate well-being and development in the communities where we operate, to be the ally that allows them to take advantage of opportunities and better manage their resources on a daily basis. We strengthen the competitiveness of companies, promote financial inclusion to integrate more people and companies into economic development, and offer solutions that contribute to building more sustainable cities and communities, while contributing to a cleaner planet.

We are a customer-focused organization. We stand out by providing reliable, approachable, timely, and user-friendly experiences for our customers. We want to earn their loyalty by being their top choice for recommendations. To achieve this, we are working to offer them a better service, with greater speed and reduced friction, with more and more digital solutions to make their processes faster and simpler.

Our team of more than 34,000 employees works under a culture based on ethics, integrity, customer focus and sustainable growth, seeking to achieve extraordinary performance. Talent is one of our competitive advantages, which is why we prioritize its well-being and development. We foster a culture of inclusivity, closeness, and empathy, ensuring our team embraces the behaviors that define our organization and connect with our customers’ realities. In addition, we develop leadership with programs that enable employees to acquire leadership skills and assume greater responsibility. This strengthens our organization, ensuring that we have leaders prepared to take on the challenges.

In our constant quest to improve and adapt to the needs of the environment, we have incorporated the objective of achieving operational excellence. This objective focuses on the automation of processes and services, which will allow us to be more efficient and reduce human errors. In addition, we have focused on ensuring the availability of key channels, so that our customers can access our services. We also work to minimize the impact on customers affected by mass events, implementing proactive and reactive measures to maintain service continuity and customer satisfaction.

*Private Funding    

                

Bancolombia has a Level III ADR listed on the New York Stock Exchange. Each ADR is equivalent to four preferred shares.

-Bancolombia completed a decade as the company with the best reputation in the country, according to Merco Empresas.

-TIME magazine and Statista highlighted Bancolombia as one of the 1,000 best companies in the world, with a consolidated score of 84.18 out of 100.

-In the Dow Jones Sustainability Index, Bancolombia consolidated its position as the most sustainable bank in the Americas and the tenth most sustainable in the world.

-Bancolombia was the only Colombian company in TIME and Statista's ranking of companies with the highest sustainable growth, where it ranked 33rd out of 500 organizations.

-Bancolombia was, for the fifth consecutive year, the company with the highest environmental, social and corporate governance responsibility in the country, according to Merco ESG.

-Bancolombia is a success story in circular finance for the Ellen MacArthur Foundation.

-Bancolombia is the best company to work for in the financial sector, and has the best human resources team in the country, according to Merco Talento.

-Banistmo was recognized as the Bank of the Year 2024 in Panama by The Banker.

-For its work with startups, Bancolombia received the Startup Friendly corporate recognition from Andi.

-Best private bank and best digital bank for individuals and businesses in Colombia, according to Global Finance.

-Best investment banking in Colombia, according to LatinFinance.

-Banistmo received the 2024 Central America Infrastructure Financing of the Year award from LatinFinance for financing the Fourth Bridge over the Panama Canal.

-Bancolombia was recognized by Euromoney for its digital solutions, diversity, equity and inclusion, ESG, investment banking and SME banking.

-The Latin American Stock Exchange Latinex awarded Banistmo three recognitions for its ESG management.

-For its efforts to contribute to closing gender gaps, Camacol awarded the company the Construimos a la Par prize.

-Bancolombia ranked fifth in the Inclusive Companies in Latin America – Chamber of Diversity ranking.

-“De Colombia pa'l mundo", a documentary created and developed by Bancolombia, which portrays a journey through the different regions of the country to rediscover the agriculture and identity of Colombian cuisine, received the award for Best Branded Audiovisual Content at the India Catalina Awards.

-Juan Carlos Mora is the second business leader with the best reputation, according to Merco Líderes.

-She is and the Fundación Juanfe recognized the president of Bancolombia as a business leader and a male ally of gender equality.

We implement communication and engagement strategies with our different stakeholders to identify how we are generating shared value through the most relevant economic, social, and environmental actions. At the time of writing this report, we had the 2023 materiality assessment. However, in December 2024 we started an update of our materiality by consulting new stakeholder groups. To learn more, click here.

II.MAINTAINING FINANCIAL STRENGTH

Main Trends in the Region (LAC)

In 2024, Latin America experienced moderate growth, shaped by challenges stemming from the economic slowdown of some of its main trading partners, persistently tight financial conditions due to a delayed easing cycle in advanced economies, and a rebound in inflation in several countries.

According to the International Monetary Fund (IMF), the region grew by 2.1% in 2024, following a 2.2% expansion in 2023. This performance reflected moderate growth in various sectors, with a behavior similar to that of the global economy, where growth was driven by the tertiary sector, while industrial production lagged behind.

Globally, the monetary easing process began in advanced economies in 2024, boosting global liquidity, except in Japan. The U.S. Federal Reserve (FED) cut its interest rate by 50 basis points (bps) in September, followed by two 25 bps cuts in November and December. The European Central Bank cut its rate four times, bringing it from 4.0% to 3.0%. The Bank of England cut its rate by 50 bps, while Japan raised its rates in March and held them steady at 0.25% since July.

The increase in global liquidity led to a rise in capital flows. However, due to the strengthening of the dollar and the uncertainty caused by geopolitical conflicts and the U.S. electoral process, capital flows shifted toward assets considered risk-free. This caused emerging markets to experience a net outflow of capital, as more positions were liquidated than received.

At the same time, rate cuts in advanced economies allowed for the continued normalization of monetary policy in the region, aiming to stimulate growth while maintaining a cautious stance toward local risks and the volatility of international financial markets. However, currency depreciation, among other factors, limited the magnitude of the cuts and, in cases such as Brazil, led the Issuer to raise its interest rates in the latter part of the year.

Otherwise, the political agenda in the region included presidential elections in Mexico, El Salvador, Venezuela, Panama, Dominican Republic, Uruguay and Puerto Rico. In particular, no political changes were observed in Venezuela, El Salvador, Puerto Rico, or the Dominican Republic, while in Mexico, Uruguay, and Panama, the election results predict some changes for the next government term. In Mexico, Claudia Sheinbaum's victory made her the first woman to hold the position. Her proposals suggest a strong focus on social policies, expanded education, poverty eradication, reducing inequality, and new measures to promote the energy transition. In Uruguay, Yamandú Orsi's victory marked the return of the left-wing to power, driven by a predominantly progressive agenda. In Panama, legislative fragmentation and the need for political agreements suggest a shift towards a model of greater negotiation, breaking with a tradition of clear majorities in Congress.

Finally, the main challenge for the Latin American region remains fiscal policy. As a consequence of the pandemic, Latin American economies experienced an increase in public debt, which has been difficult to manage due to the higher cost of financing. This has made it clear that the sustainability of public finances is a factor of vulnerability for the region.

Performance of the main Latin American economies

Among the region's major economies, Mexico experienced a sharp slowdown, from 3.2% growth in 2023 to 1.4% in 2024. Meanwhile, Chile and Peru moved toward a path of recovery after Chile’s consumption was affected in 2023 by the depletion of pandemic-related aid, while various supply shocks impacted production in Peru. The Chilean economy expanded by 2.5% in 2024, while Peru's GDP grew by 3.0%.

In Colombia, a moderate recovery took hold following a 0.6% expansion in 2023, with an estimated growth of 1.8% in 2024. The local regulatory environment remains uncertain for investment decisions, but the economy is being driven by the reduction in the monetary policy interest rate. In contrast, fiscal stimulus in Brazil led to a consistent upward revision of growth expectations, despite adverse weather conditions. As a result, the economy grew at a similar pace to 2023 (3.0%).

Recent economic history has been marked by a gradual process of convergence towards lower inflation and higher growth rates. The Colombian economy reached the lowest growth of the post-Pandemic era during 2023 (0.6%), and from there accelerated to levels closer to 1.8% during 2024. Likewise, inflation went from 9.3% at the end of 2023 to 5.2% at the end of last year. This enabled the Colombian Central Bank to continue lowering the repo rate, bringing it down to 9.50%.

In terms of GDP growth, the economy showed tremendous signs of resilience, with the agricultural, entertainment and recreation and public administration sectors showing pronounced progress. In the first case, despite the occurrence of the El Niño climate phenomenon in the first part of the year, the good performance of harvests, together with favorable international coffee prices, resulted in double-digit GDP growth for agricultural activities. In parallel, the boost in household consumption, which coincided with higher remittances, a resilient labor market and lower interest rates, led the growth of some service activities.

The public sector played a key role in 2024 due to the sharp increase in real government spending. This was reflected in the rapid expansion of the public administration sector, which saw higher GDP growth in the first half of the year compared to the private sector. However, in the second half of the year, this trend reversed due to reduced fiscal space, which forced the National Government to curb government spending in order to uphold its commitment to the Fiscal Rule. Negative tax collection dynamics led the government to make budget cuts during the second half of last year.

Meanwhile, inflation consolidated its convergence process towards levels increasingly consistent with Colombian Central Bank's objectives. All components of the consumer basket slowed down in 2024, resulting in the lowest inflation since late 2021. Food and goods drove the decline, while the services and regulated categories slowed at a more moderate pace due to indexation and lingering inflation in fuel, electricity, and tolls. The risks associated with the convergence of inflation led the Issuer's Board of Directors to adopt a cautious approach to the rate-cutting cycle, resulting in a 350-basis-point reduction in the repo rate, bringing it to its lowest level since August 2022.

Finally, in external terms, the current account reached its lowest external deficit in fifteen years, at -1.7% of GDP. This was possible due to an increase in current transfers and lower factor income outflows, which compensated for the increase in the trade imbalance. Despite reduced external account vulnerabilities, the exchange rate depreciated in the second half of the year due to a stronger U.S. dollar globally and an increase in Colombia’s sovereign risk premium.

The first half of 2024 was marked by a slowdown in growth, as the completion of major infrastructure projects led to a drop in investment and a less dynamic public sector, whose fiscal consolidation efforts accelerated the negotiations of the agreement with the IMF. Additionally, starting in the second quarter, the normalization of remittance growth was reflected in a slowdown in private consumption. Despite the boom in the tourism sector due to the increased perception of security, El Salvador's GDP showed modest growth during the year (3.4% in 1Q24, 1.5% in 2Q24 and 1.6% in 3Q24).

During the first four months of the year, inflation was close to 1% due to lower price increases in food, restaurants and hotels, and lower prices for transportation, recreation and household goods. However, by mid-2024, supply-side inflationary pressures—such as the El Niño climate phenomenon and heavy rainfall in several regions—drove price growth up to 1.8% annually in July. The measures taken by the government to contain food inflation, together with the decrease in fuel prices, resulted in an inflation rate of 0.3% at the end of the year, after two consecutive months of deflation.

In the fiscal environment, 2024 was characterized by mixed signals. First, the multiple debt bond repurchase processes by the government sent a message of responsibility and commitment to the sustainability of public finances in view of the negotiations for an agreement with the IMF (reached in December). In addition, the approved 2025 state budget is the first fully funded budget in several decades. However, the elimination of tariffs on imported food and taxes on foreign investment and remittances put extra pressure on the fiscal balance.

Finally, as for the external sector, the boom in tourism (which increased by 14.7% in 2024 compared to 2023) and its boost to service exports, allowed the current account to be in surplus during the second quarter of the year. However, the fall in the services surplus during the third quarter brought the current account back into deficit territory (-0.9% of GDP in that period).

During 2024, economic activity in Guatemala stood out for its good dynamics, driven by the robustness of consumption and investment, growing 3.1%, 3.7% and 3.5% annually in the first three quarters of the year. The performance of consumption is explained by increases in labor income and remittance inflows (which represent close to 20% of GDP), as well as by the dynamism of the credit portfolio. Meanwhile, investment growth was concentrated in machinery and equipment. Thus, we estimate that the economy closed 2024 with a growth rate of 3.5%, in line with the strong performance of the vast majority of activities.

Regarding prices, the disinflationary process observed since November 2023 was temporarily interrupted in mid-2024 due to rising food prices, which offset declines in the housing, fuel, and utilities segments. As a result, annual inflation stood at 3.8% in July. In the second half of the year, inflation resumed its decline once food pressures were overcome, closing 2024 at 1.7%, well below the Banco de Guatemala's tolerance range (4.0% +/- 1pp).

Regarding monetary policy, the Banco de Guatemala implemented two 25-bps cuts to its benchmark interest rate, one in September and another in November, bringing it down from 5.00%—which had been in place for 17 months—to 4.50%. The Monetary Board indicated in the communications that its members took into consideration the recent low inflation records, growth data in line with its projections and the coordination of its monetary policy with that of the FED.

Regarding the fiscal environment, Guatemala has been characterized by low levels of indebtedness and fiscal deficits. Despite the budget expansion that took effect in September, the Government has restrained public spending by eliminating exceptional expenses and slowing the pace of execution. Thus, throughout 2024 the fiscal deficit remained consistently below 1% of GDP and ended the year close to 1.2% of GDP.

Finally, the current account balance benefited from the strength of remittance inflows due to the robust U.S. labor market. This contained the deficit in other areas, especially the widening of the trade deficit in goods. Thus, the current account surplus stood at 1.9%, 4.6% and 3.2% of GDP in the first three quarters of the year.

The Panamanian economy experienced a sharp slowdown in 2024, compared to its 7.4% growth in 2023. The factors that had the greatest impact were: (1) the impact of the closure of the Cobre Panamá mine, which was estimated to contribute around 5% to GDP; (2) the decline in vessel traffic through the Panama Canal due to the effects of El Niño; and (3) the decrease in housing demand, which affected the construction sector. However, the good performance of sectors such as tourism, commerce and finance contributed to better results than anticipated, such that in the first three quarters of the year, the Panamanian economy grew 1.8%, 2.5% and 2.0% annually. Given this, we estimate that growth in 2024 was 2.5%.

The rapid disinflationary process was driven by falling food and fuel prices, as was the case in the other Central American countries. For this reason, in September, Panama entered deflation territory, mainly due to price controls on basic food basket items and fuel. This trend persisted until the end of the year, with 2024 likely closing at around 0.2%, despite a slight annual increase in food prices.

In the external environment, the elimination of copper production hit Panamanian exports particularly hard, widening the deficit in the balance of trade in goods. Despite a 73.3% annual drop in exports during the first 11 months of 2024, the gradual restructuring of the goods export basket and the strong performance of tourism, which boosted the services balance, allowed the current account to remain in surplus during the first three quarters of the year.

Finally, the fiscal outlook remains one of the challenges. Greater spending pressures, driven by high debt interest payments, increased country risk perception (reflected in the loss of investment grade by Fitch Ratings and the credit rating downgrade by S&P), and lower government revenues, have significantly eroded the country's public finances. Thus, we estimate that the fiscal deficit widened to 4.5% of GDP during 2024.

2025 Economic Outlook

By 2025, we anticipate a gradual desynchronization of economic growth and monetary policy across countries. In the midst of this scenario, the risks associated with geopolitical conflicts, the arrival of Donald Trump to the U.S. presidency and a more cautious FED in its monetary easing process will continue to mark the feeling of uncertainty and volatility in global financial markets.

We anticipate modest growth for the global economy, a continuation of gradual cuts in monetary policy interest rates, a convergence of inflation toward the central banks' target and increased investor appetite for safe-haven assets. Likewise, the unpredictable application of protectionist economic measures by the new Trump administration will lead emerging countries to face a hostile international scenario, which could exacerbate near-shoring trends and migrant employment.

By 2025, we anticipate higher economic growth of 2.6%. At the same time, we expect inflation to continue its convergence process towards lower levels, with a year-end forecast of 4.0%. Meanwhile, since there are some upside risks to inflation—driven by the increase in the minimum wage, depreciation, the rise in the risk premium, and lingering inflation in certain regulated goods and services—Colombian Central Bank is expected to continue its rate-cutting process at a slower pace, bringing the monetary policy rate to 6.50% by year-end.

In terms of economic growth, acceleration to 2.6% would be possible due to a gradual recovery of the construction and manufacturing areas, an outstanding performance of the agricultural macro-sector and a gradual recovery of key service activities, such as commerce, transportation, accommodation and food. All of this would be driven by lower interest rates, lower inflation and a relatively resilient labor market. Additionally, we expect fixed investment to play a more significant role in growth, consistent with further advances in private consumption, which will continue to accelerate, supported by strong remittance flows and a resilient labor market.

Second, we expect the disinflation process to continue, but at a slower pace and with upside risks. We estimate that annual inflation will end 2025 at 4.0%, within Colombian Central Bank's tolerance range. Despite this, we highlight the presence of upside risks, such as the sharp increase in the minimum wage above inflation, the recent devaluation of the Colombian peso and its effect on the prices of imported goods, as well as the increase in the costs of inputs, raw materials and international transportation due to geopolitical tensions and the adjustment in the price of ACPM (Diesel oil).

As a result, the monetary policy interest rate will continue its downward trend, amid the caution demanded by inflationary persistence and international financial conditions. The moderation in the pace of cuts revealed by Colombian Central Bank in its December 2024 decision leads us to believe that in 2025 a marked bias towards caution will prevail in the process of interest rate cuts.

We expect the slowdown to continue, driven by lower government spending, lower private consumption due to the normalization of emittance inflows, lower external demand due to the expected slowdown in the U.S. economy (El Salvador's main trading partner) and the consequences for agriculture, transportation and infrastructure that could result from the La Niña climate phenomenon. Thus, we expect 2025 growth to be 2.4%.

As for inflation, we expect it to return to a level of 1.8% in 2025. This would be possible due to the lower pressures derived from the consolidation process of public finances and the country's dollarization. However, we recognize that the Trump administration's shift in energy transition priorities could put pressure on fuel prices, while a protectionist trade policy would put pressures on other goods and services.

Likewise, reaching a technical agreement with the IMF for USD 1,400 million in December would allow the Government to increase its credibility, as long as it meets the fiscal adjustment targets and strengthens its international reserves holdings. This would allow a recovery of El Salvador's integration with international capital markets, which would strengthen its integration with the region and attract investment to the country.

We anticipate that strong macroeconomic fundamentals will allow Guatemala to maintain 3.5% growth in 2025. However, there are risks that put downward pressure on this projection, such as the expected slowdown in the U.S. economy or the anti-immigration and protectionist policy that could be adopted by the Trump administration, factors that would reduce the flow of remittances, consumption and exports.

At the same time, we expect inflation to converge towards the Banco de Guatemala's tolerance range (4.0% +/- 1pp), reaching 3.8% in 2025, due to the volatility in oil prices and the effect that adverse weather events may have on food prices. In this context, the Monetary Board will continue with monetary easing, bringing its interest rate to 3.25% at the end of the year.

The main risk is in the fiscal environment. We expect the government to continue its efforts to improve fiscal transparency and combat corruption under an environment of strong political opposition. However, we anticipate that spending pressures will continue to be relevant due to the priority given by the government to social spending within its budget.

We expect the economic dynamics to flourish again, supported by the recovery of the logistics and transportation sector, and by investment driven by new public infrastructure works. It is worth noting that, despite the downgrade in its credit rating, Panama continues to be an attractive destination for foreign investment thanks to its location and its consolidation as a strategic logistics center in the region. Thus, we project growth to accelerate to 3.5% in 2025. Favorable economic activity would also boost prices, despite downward pressures from the Federal Reserve's tighter monetary policy. As a result, the year ended with inflation close to 1.5%.

As for the external sector, new public works would increase imports of intermediate goods for construction, while the improved dynamics of domestic demand would boost imports of consumer goods. As a result, we expect the current account deficit to widen to 3.8% of GDP.

Finally, the economic recovery in 2025, along with the government's efforts to improve the fiscal situation—reflected in the approval of a budget lower than that of 2024—would help increase fiscal revenues throughout the year and, consequently, reduce the deficit to 3.5% of GDP.

Source: Bancolombia Group, FocusEconomics.

*Focus Economics forecasts.

2024 was characterized by a macroeconomic context in which the decrease in inflation allowed for a sustained decrease in interest rates. This resulted in a lower cost of credit, due to less pressure on customers' ability to pay.

Similarly, the unemployment rate during the year showed a moderate recovery trajectory, reflecting a gradual improvement in Colombia's economic activity.

During this same period, the Colombian economy showed progress in its recovery during the year, with GDP growth higher than the previous year, which was driven mainly by the services and agricultural sectors. Finally, the Colombian peso depreciated throughout the year as a result of geopolitical conflicts, U.S. elections and a moderate global economic growth.

For 2025, economic growth is expected to surpass that of the previous year, accompanied by gradual interest rate cuts throughout the year and steady progress toward the inflation target. However, certain events such as a greater fiscal deterioration may impact risk perception, generate pressure on the Representative Market Rate (TRM, by its Spanish acronym) and cause a possible increase in inflation, which could also be affected by the increase in the minimum wage, which was higher than expected by the market.

These events may materially influence the moderate inflation expected by the Colombian Central Bank for 2025, which, if it materializes, could translate into an increase in the cost of credit, due to the impact on the payment capacity of our customers, as well as an increase in operating expenses, generating greater pressures on the Bancolombia Group's income.

Moreover, the fall in interest rates could generate negative effects on the net interest margin, due to the bank's greater sensitivity on the asset side.

During 2024 the Colombian peso depreciated against the dollar, with a devaluation of COP 587.10 (15.36%) in the Representative Market Rate, which went from COP 3,822.05 at the end of 2023 to COP 4,409.15 at the end of 2024. This factor influenced the annual variations in the organization's consolidated Statement of Financial Position, given our operation in Central America and the exposure of some local book balances that are denominated in foreign currency (USD).

Our total assets at the end of 2024 stood at COP 372.22 trillion, reflecting an increase of COP 29.29 trillion (8.54%) compared to the previous year. This growth was driven by a COP 25.55 trillion (10.75%) increase in net loans and a COP 11.83 trillion (41.25%) rise in net investments. This expansion was supported by the continued growth of customer deposits and the use of liquid assets, which led to a COP 8.09 trillion (10.57%) decline in other assets.

The gross loan portfolio grew by COP 25.50 trillion (10.04%), with the commercial loan portfolio increasing by COP 18.57 trillion (11.47%), driven mainly by the corporate segment in Colombia. The mortgage portfolio recorded a growth of COP 5.49 trillion (15.15%), reflecting improved sector dynamics compared to the previous year, supported by the “Housing for All” strategy in Colombia. Likewise, the consumer loan portfolio increased by COP 1.23 trillion (2.26%), where the currency devaluation helped offset the lower disbursements in this segment throughout the year.

Loan and financial leasing provisions decreased by COP 43,365 million, ending the year at COP 16.18 trillion, primarily due to lower provisions for individuals. Meanwhile, the loan coverage for accounts past-due over 30 days closed at 159.48%, reflecting our strength in facing potential future impairments.

Other assets contracted during the year, mainly due to movements in cash and cash equivalents, which decreased by COP 6.96 trillion. Likewise, trading derivatives declined by COP 3.31 trillion, partially offset by a COP 1.20 trillion increase in goodwill, driven by exchange rate fluctuations.

We ended 2024 with total liabilities for the Group amounting to COP 327.63 trillion, reflecting an annual increase of COP 23.75 trillion (7.82%). Customer deposits grew by COP 31.12 trillion (12.55%), closing the year at COP 279.06 trillion, driven by our customers' preference for our deposit portfolio. The savings account showed the largest increase, rising by COP 15.67 trillion, followed by term deposits with an increase of COP 11.07 trillion, while the checking account grew by COP 3.04 trillion.

Debt securities issued ended 2024 with a balance of COP 11.28 trillion, decreasing by COP 3.39 trillion (23.11%), in line with maturities during the year and the restructuring of the funding structure, in accordance with the Bancolombia Group's liquidity management.

Equity attributable to shareholders increased by COP 5.46 trillion (14.32%), closing the year at COP 43.54 trillion, supported by profit generation and the restatement of the financial statements of foreign subsidiaries. As a result, we maintained solvency levels above the regulatory requirements, achieving a core solvency ratio of 11.89%, 47 basis points (hereinafter referred to as bps) higher than the figure reported in 2023, driven by equity strengthening to support the expected operational growth in 2025.

Net interest income grew by COP 142,446 million (0.70%), mainly due to a decrease in financial expenses of COP 1.64 trillion (9.87%), in line with the funding restructuring strategy in response to the economic cycle and macroeconomic conditions.

Loan income decreased by COP 2.63 trillion due to the reduction in the monetary policy rate and lower activity in the consumer loan portfolio. However, this was partially offset by a COP 1.13 trillion increase in interest income from debt instruments and the valuation of financial instruments.

As a result, total interest income declined by COP 1.50 trillion (4.05%). Meanwhile, net commissions grew COP 193,446 million (4.86%), mainly due to the net income obtained from our clients' transactional activities.

The provision expense for loans and net leasing decreased by COP 2.01 trillion (26.93%), due to lower impairment provisions in the individual portfolio in Colombia and an improved economic outlook, which has led to better customer performance in meeting their financial obligations.

Operating expenses increased by COP 691,481 million (5.34%), remaining below observed inflation, in line with efficient resource management. Labor expenses grew by COP 277,828 million (5.19%), mainly due to salary increases. Similarly, general expenses rose by COP 413,653 million (5.45%), with the most significant contributors being technology expenses—driven primarily by maintenance and licensing costs—payment method expenses, and regulatory expenses related to deposit insurance.

Operating income before provisions decreased by COP 707,365 million (2.48%), which, when compared to the increase in operating expenses, led to a deterioration in financial efficiency of 364 bps, closing at 48.96%.

During the year, the income tax provision reached COP 2.39 trillion, a significant contribution that reinforces our commitment to the country's development through national revenue collection.

We achieved net income attributable to shareholders of COP 6.27 trillion in 2024, reflecting an increase of COP 150,808 million. This result allowed us to maintain a return on assets of 1.79% and a return on equity attributable to shareholders of 15.77%, with the latter registering a decline of 37 bps due to the increase in equity, in line with our growth strategy for 2025.

Bancolombia's results at year-end 2024 reflect our commitment to financial strength and sustainable development, fundamental pillars that have allowed us to face the challenges of a changing and competitive economic environment, while consolidating our market position.

In 2024, we achieved a 4.37% growth in our assets, representing an increase of COP 10.99 trillion compared to the end of 2023. This performance was driven by several factors: the gross loan portfolio, which grew by 4.92% during the year (COP 9.01 trillion), in line with economic growth; and the investment portfolio, which recorded an annual variation of 58.13% (COP 8.00 trillion), resulting from greater use of liquidity and a continuous increase in our deposits (COP 5.1 trillion).

The growth in loan portfolio balances was largely driven by the commercial segment, which increased by 7.54% (COP 7.21 trillion), mainly due to new interest rate strategies that incentivized loan placements. Similarly, the mortgage portfolio closed the year with an annual growth of 15.21% (COP 3.32 trillion), aligned with the “Housing for All” strategy, through which we reduced interest rates in this segment. Meanwhile, the consumer loan portfolio experienced a significant slowdown during the year, ending with a decline of 4.46% (COP 1.73 trillion), due to restrictions in risk appetite, which led to the adoption of more conservative policies regarding exposure to certain sectors and customer profiles, thereby limiting portfolio growth.

Investments in subsidiaries recorded an annual appreciation of 16.02%, equivalent to COP 3.97 trillion. This result was mainly driven by investments in foreign subsidiaries and is largely explained by the restatement effect due to the variation in the TRM, which increased from COP 3,822.05 at the end of 2023 to COP 4,409.15 at the end of 2024, reflecting a 15.36% depreciation of the Colombian peso.

We closed 2024 with a total deposit balance of COP 185.80 trillion, representing an increase of COP 15.57 trillion (9.15%) compared to the previous year. This dynamic was mainly driven by demand accounts, which grew by COP 11.66 trillion (11.20%), while term deposits recorded an annual increase of 4.14% (COP 2.53 trillion). This reflects a shift in the funding structure, where demand accounts are gaining greater share, thereby strengthening Bancolombia's competitive advantage in terms of deposit costs.

Debt securities issued (bonds) closed at COP 7.80 trillion, reflecting a decrease of COP 3.16 trillion (28.82%), due to bond repurchase operations in U.S. dollars carried out during the year, along with maturities in Colombian pesos totaling approximately COP 1.60 trillion.

Equity increased by COP 5.19 trillion (14.00%), driven by profit generation during the period and the restatement of investments in associates and subsidiaries due to a higher TRM.

Net interest income increased by COP 442,454 million (2.86%) in a context of declining interest rates in Colombia, where the Colombian Central Bank’s benchmark rate dropped by 350 bps, leading to a COP 2.53 trillion (8.94%) decrease in interest income from the loan portfolio. This was offset by a larger reduction in financial expenses of COP 1.91 trillion (13.77%), driven by an optimization of the liability structure, along with a favorable performance in interest income and investment valuation, which grew by COP 1.05 trillion (125.09%). This growth was mainly due to the dollar-denominated portfolio, which benefited from a COP 587 depreciation in the TRM during the year.

The risk dynamics led to a decrease in provisioning expenses of COP 834,399 million, primarily driven by an improved performance in the consumer loan portfolio, which experienced lower impairment compared to the previous year, particularly in unsecured loans and credit cards. As for the commercial loan portfolio, provisioning remained stable in line with the balance growth. In the mortgage portfolio, provisioning expenses were also lower due to reduced impairment.

Net fee and other service income closed with a positive variation of 0.96% (COP 25,749 million), with revenues growing by 7.61% (COP 405,855 million), mainly driven by higher transaction volumes in payment methods and electronic services. Meanwhile, expenses increased by 14.39% (COP 380,106 million) due to a higher number of operations conducted through banking correspondents.

Other net operating income closed with a negative variation of 33.56% (COP 974,314 million), explained by the performance of foreign exchange differences and foreign exchange derivatives, which registered declines of 72.34% (COP 593,686 million) and 50.22% (COP 170,198 million), respectively.

Additionally, income from the equity method closed at COP 1.88 trillion, with an annual decrease of COP 156,852 million, driven by lower earnings from subsidiary investments, mainly Banistmo and Bancolombia Panama.

In 2024, an impairment loss of COP 121,788 million was recorded for Tuya.

All of the above led to a net total income (Operating Income) annual increase of COP 58,251 million.

Operating expenses increased by 7.03% (COP 617,573 million), exceeding the growth of total net income, which grew 0.35% (COP 58.251 million), leading to a deterioration in the financial efficiency ratio, which stood at 41.98%.

Finally, we closed 2024 with a net income of COP 5.58 trillion, representing an annual decrease of 6.71%, equivalent to COP 401,510 million, leading to a decline in return on equity by 171 bps, reaching 14.06%.

One of the Bank’s main guidelines is to maintain a strong liquidity position. Therefore, the Asset and Liability Management (ALM) Committee has established a minimum level of liquid assets based on the financing needs of the parent company and each subsidiary. The objective is to ensure, as far as possible, that there will always be sufficient liquidity to meet its liabilities as they mature. This is both in normal conditions and stress scenarios without incurring significant losses or risking damage to the Bank's reputation.

As mentioned earlier, the Bank aims to maintain the optimal level of liquid assets to ensure not only smooth operation under normal conditions but also to operate under stress scenarios in the markets. During 2024, we maintained a solid liquidity position, with high levels of liquidity during the second half of the year.

The following table shows the distribution of liquid assets in the last two years:

(1)Cash and liquid assets are those assets readily accepted as collateral by central banks in Colombia and other jurisdictions for monetary expansion or contraction operations. Liquid assets are adjusted by a haircut. Liquid assets include cash, repos held for trading, and investments held for trading in stocks listed on the Colombian Stock Exchange, units of investment funds, or other debt trading instruments.

*High-quality liquid assets: cash and shares that are eligible for reportable or repo operations, in addition to those liquid assets that the Central Bank receives for its monetary expansion and contraction operations described in paragraph 3.1.1 of the Circular Regulatoria Extranjera (Foreign Regulatory Notice) DODM-142 of Colombian Central Bank.

**Other marketable securities: Securities issued by financial and corporate entities.

As of December 31, 2024, liquid assets grew by COP 8,937 billion, mainly due to the increase in high-quality liquid securities. This change stems from increased deposits and excess liquidity managed through the treasury portfolio with purchases of liquid securities.

Liquid assets are measured daily and this result is compared with a target established by the Risk Committee. Under this rule, daily liquid assets must be equal to or greater than the target. In case the limit is not reached, there is a period of five days to increase liquidity levels.

Cash is important to ensure branch and ATM operations. Our expansion across Colombia requires significant cash levels; however, cash levels are monitored daily to minimize opportunity costs. In addition, cash is considered in the mandatory bank reserve established by the Central Bank.

Marketable securities comprising liquid assets are reviewed by the ALM Committee considering the Bank's liquidity objective. Although available-for-sale and held-to-maturity debt securities cannot be sold, they can be pledged as collateral in repurchase agreements. Some of them are mandatory investments that can be sent to the Central Bank as collateral.

The Financial Superintendency of Colombia requires financial institutions to have liquid assets greater than the contractual one-month accumulated liquidity gap. This contractual gap reflects the maturity of current asset and liability positions and does not reflect projections of future operations. The maturity of the loan portfolio for this purpose is affected by the historical default indicator and the maturity of deposits is modeled in accordance with regulation.

We believe that the current liquidity level is adequate and will aim to maintain a strong deposit base while ensuring access to alternative funding sources, such as loans from national and international development and commercial banks, repurchase agreements, bond issuances, overnight funds, and Central Bank funding. This approach takes into account market conditions, interest rates, and the desired maturity profile of liabilities.

As of December 31, 2024, the Bank's liabilities reached COP 327,631 billion, an increase of 7.82% compared to December 31, 2023. Liabilities in COP increased by 3.75%, and liabilities in USD increased by 15.38%. This change is mainly due to the growth of term deposits in COP and USD, and savings accounts in COP. However, although liabilities in USD increased by 15.38%, this increase was affected by the depreciation of the USD/COP exchange rate (15.36% in 2024).

In 2024, our deposits reached a balance of COP 279,059 billion at year-end, an increase of COP 31,118 billion, or 12.55% compared to 2023. Deposits in COP increased by 8.86%, mainly explained by the increase in savings accounts; while deposits in USD increased by 20.06%, as a result of the increase in term deposits and the effect of exchange rate variations. The ratio between deposits and total assets was 75%. This represented an increase of 267 basis points compared to 2023.

The following table shows checking accounts, savings accounts, and term deposits as a percentage of the Bank's total liabilities for 2024 and 2023:

Our main sources of funding are deposits, which are mainly composed of checking accounts, term deposits and savings accounts. During 2024, savings accounts and term deposits played a key role in the balance sheet funding structure. As inflation began to decline during 2024, the Central Bank began to gradually reduce its monetary policy rate. As a result, the cost of funds was positively affected due to lower interest rates and growth in savings accounts.

Deposits as a percentage of the Bank's total liabilities in 2024 were 85.2%. This percentage increased compared to the 81.6% of total liabilities at the end of the 2023 fiscal year.

The ratio of the net loan portfolio to deposits (including loans from other entities) was 89.32% at the end of 2024. This figure decreased from 90.19% compared to 2023. This change is mainly explained by the increase in net loans and advances to customers, which went from COP 237,728 billion in 2023 to COP 263,274 billion in 2024, which was lower compared to the variation in deposits (the increase was COP 31,159 billion, reaching an amount of COP 294,748 billion in 2024).

We also finance our operations with loans from financial institutions. However, the main source of funding during 2024 was savings accounts and term deposits, as interest rates tended to decline during the year. In addition, our term deposits and loans with financial institutions are indexed to different market rates / indexes such as IBR (a short-term reference interest rate of the Colombian money market liquidity that reflects the price at which banks are willing to lend or borrow funds from the financial market), DTF (Colombia’s fixed-term deposit rate), CPI (Consumer Price Index, certified by the National Administrative Department of Statistics - DANE) and SOFR.

In 2024, we issued USD 1,005 million in securities, distributed as follows: Bancolombia issued securities for USD 800 million, Banistmo for USD 173.2 million, Banagrícola for USD 21.3 million and Bancolombia Puerto Rico for USD 14.7 million. However, a prepayment of USD 1,320 million of bonds was executed during 2024. Consequently, the carrying amount of issued obligations decreased by COP 3,388 billion.

As of December 31, 2024, the total outstanding aggregate principal amount of bonds issued by the Bank was COP 11,275 billion.

The following table shows the maturity profile of the Bank's debt securities in issue:

The following table shows the components of the Bank's liabilities for fiscal years 2024 and 2023:

(1) Includes borrowings from commercial banks and other non-financial entities.

The following table displays the net cash provided by operating activities, net cash used in investing activities, and net cash used in financing activities for the years ended December 31, 2024, 2023, and 2022:

In 2024, operating activities generated positive net cash flow as a result of an increase of COP 18,329 billion in customer deposits, compared to an increase of COP 17,025 billion in 2023, and COP 33,225 billion in interest received in 2024, compared to COP 34,702 billion in 2023.

The increase in loans and advances to customers and financial institutions was COP 21,622 billion in 2024, compared to COP 10,554 billion and COP 37,593 billion in 2023 and 2022, respectively. Interest paid generated a use of cash of COP 14,982 billion in 2024, COP 15,978 billion in 2023 and COP 7,508 billion in 2022. The net change in the value of investment securities recognized at fair value through profit and loss was negative COP 8,401 billion in 2024, compared to 2023 where the net variation was COP 1,988 billion.

In 2024, we purchased debt securities at amortized cost for COP 2,114 billion, COP 3,629 billion in 2023 and COP 4,915 billion in 2022. The maturity of debt securities at amortized cost contributed cash of COP 1,622 billion in 2024, COP 4,738 billion in 2023 and COP 4,260 billion in 2022.

Investing activities related to debt instruments at fair value through OCI provided net cash of COP 1,858 billion during 2024 and COP 1,415 billion during 2023. Furthermore, investing activities related to equity securities and interests in associates used net cash of COP 93,892 billion in 2024, compared to COP 106 billion used in 2023. Likewise, investing activities related to purchases and sales of premises, equipment and investment properties used net cash of COP 1,628 billion, compared to COP 2,226 billion in 2023 and COP 3,117 billion in 2022.

Proceeds from loans with other financial institutions contributed COP 9,416 billion in 2024, COP 9,855 billion in 2023 and COP 14,374 billion in 2022. The placement of outstanding debt securities provided COP 4,155 billion in 2024, COP 1,781 billion in 2023 and COP 2,138 billion in 2022. On the one hand, loan repayments used COP 10,496 billion in 2024, compared to COP 9,921 billion in 2023 and COP 5,874 billion in 2022. On the other hand, payments of debt securities in issue used COP 9,276 billion in 2024, COP 3,928 billion in 2023 and COP 6,699 billion in 2022. Cash was also used to pay dividends to shareholders of COP 3,398 billion in 2024, while in 2023 and 2022 this amount was COP 3,298 billion and COP 2,310 billion, respectively.

The increase in repurchase agreements provided cash of COP 550 billion in 2024, compared to COP 304 billion used in 2023 and COP 579 billion used in 2022.

Historically, we have experienced some seasonality in our demand deposits, with low levels of liquidity during the first months of the year and high levels of liquidity at the end of the year. This behavior is mainly explained by the increase in liquidity due to the monetary expansion operations carried out by Colombian Central Bank and the National Government injecting liquidity to the market in response to the greater dynamics in the economic activity and the high transaction rate.

During 2024, the Central Bank began to gradually reduce its monetary policy rate as inflation began to decline and approach its target. However, it has maintained a moderate monetary policy. This has led to low credit demand, which, combined with deposit growth, has resulted in excess liquidity throughout the year.

However, we believe that the seasonality in deposits does not have a significant impact on the operation of the business, as the excess/shortage of liquidity is managed through the treasury portfolio.

An uninsured deposit is defined as any deposit that does not have a mechanism to protect and guarantee the resources of the depositors (individual or legal entity) in the event of insolvency or liquidation of any financial institution.

The amount of uninsured deposits for 2024 and 2023 are COP 190,359,916 and COP 164,601,948, respectively.

The following table shows the uninsured term deposits held by the Bancolombia Group as of December 31, 2024, and 2023:

For more information on customer deposits, see Consolidated Financial Statements, Note 15. Customer Deposits.

Bancolombia's operational results are affected by macroeconomic factors, mainly in Colombia, but also in the other countries where the bank operates. The key variables include GDP growth, interest rates, inflation, and exchange rates, mainly the USD to COP exchange rate. The trends of these variables for Colombia in 2024 are summarized below.

Colombia's real GDP growth in the first three quarters of 2024 was 1.6% per annum (national accounts data for the fourth quarter of 2024 are not yet available at the time of writing). Therefore, based on the figures available so far, 2024 was a period of strengthening of the country's economic dynamics, after the low growth in 2023 (0.6%). The acceleration in GDP growth has been part of a cycle in which the central bank has gradually reduced the policy rate in a context in which inflation has declined significantly. Consequently, the gradual reductions in high interest rates have eased pressure on household and business budgets, reactivating consumption and investment momentum. At the same time, the Government increased its contribution to economic growth by accelerating public spending.

The performance of the key components of GDP in the first three quarters of 2024, compared to the same period of 2023 and in real terms (constant prices), was as follows: fixed investment grew by 0.6% annually, private consumption grew by 1.0%, government spending increased by 0.1%, imports advanced by 1.4% and exports strengthened by 5.0%. As a reference to understand the growth of each GDP component over the past year, in 2023, gross fixed capital formation accounted for 17.4% of nominal GDP, private consumption represented 76.5%, government spending 14.8%, exports 17.8%, and imports 22.7%.

The sectors with the greatest dynamism in the first three quarters of 2024, compared to the same period in 2023, were the arts, entertainment and recreation activities, with an annual growth of 9.8%; agriculture, with 8.9%; and the public administration, defense, health and education macro-sector, with 4.2%.

As of December 31, 2024, Colombian Central Bank's reference interest rate stood at 9.50%, after a reduction of 350 basis points during the year. At the eight interest rate decision meetings, the Board decided to cut the repo rate. However, after six consecutive meetings with 50 bp cuts, at the December meeting the Board decided to moderate the pace of easing and opted for a 25 bp cut.

Despite the cuts to the benchmark interest rate, the monetary policy stance remains highly contractionary. The Central Bank has significant room to continue to advance in the process of cutting interest rates without abandoning the contractionary stance of the policy, which will allow inflation to continue to approach its target throughout 2025.

Annual consumer inflation (measured by CPI) stood at 5.2% at the end of 2024, significantly below the 9.28% recorded in 2023. The components that contributed the most to the rise in inflation in 2024 were rent (with an annual increase of 7.30% for imputed rent and 7.56% for actual rent), dining out (up 8.12%), and urban transportation (up 8.21%). In contrast, prices of eggs (down 2.72% year-over-year), vehicles (down 9.84%) and telephone equipment (down 14.96%) contributed the most to the decline.

During the latter part of 2024, annual inflation maintained a consistent but gradual downward trend, a behavior that is expected to persist during 2025. This trend will allow Colombian Central Bank's interest rate to continue decreasing at a moderate pace throughout the year.

The Colombian peso depreciated by 15.4% against the U.S. dollar in 2024, bringing the USD/COP exchange rate to COP 4,409 at the end of the year. This sharply contrasts with the 20.5% appreciation that the pair experienced in 2023, which resulted in a year-end exchange rate of COP 3,822. Therefore, 2024 was a year of decline for the Colombian peso, after the recovery experienced in 2023. Several signs of institutional and fiscal uncertainty were added to an international environment that exacerbated investors' risk aversion globally, causing emerging currencies to lose value against the dollar. In the case of Colombia, fiscal setbacks reinforced this trend, leaving the Colombian peso as the third most devalued currency in the Latin American region at the end of 2024.

The future dynamics of the Colombian economy, the financial sector at large, and Bancolombia in particular are expected to be influenced by the following factors:

In 2024, the Bancolombia Group's investment amounted to COP 714.7 billion, with investments in channel development and technology assets (COP 603.6 billion), followed by investment in digital evolution and fixed assets (COP 111.1 billion).

By 2025, the Bank expects to invest around COP 763.9 billion, which represents a 7% variation compared to 2024. The investment will focus mainly on channels, driving the evolution of the portfolio of financial and non-financial digital experiences. It will also include new capabilities for fraud management, such as facial biometrics and behavioral analytics. In addition, resources will be allocated to the Product Core to ensure the speed, timeliness and scalability of the operation of channels and services.

It is likely that in the medium term, investments associated with channels, cybersecurity, cloud migration and digital offerings will continue to be a priority for Bancolombia in order to maintain operational excellence and customer experience.

The performance of Bancolombia's common and preferred shares maintains a strong correlation with the performance of the COLCAP index throughout 2024.

Bancolombia's common stock closed 2024 with an annual variation of +13%, showing an appreciation throughout the year, reaching a low of COP 30,600 on February 19, 2024 and a high of COP 39,980 on November 20, 2024.

The preferred stock had an annual variation of +18%, with a higher appreciation than the market (COLCAP +15% annually), reaching a maximum level of COP 36,800 on November 25, 2024, from a minimum of COP 29,220 during the first months of the year.

Bancolombia's ADR showed an upward trend in the first months of the year, reaching its peak in May, with a value of USD 37.3, from a level of USD 30.8 at the beginning of the year. Although in the following months it fell to a low of USD 30.73 in August, the price recovered slightly with significant fluctuations to close the year at USD 31.7. These variations reflect a behavior influenced by the devaluation of the Colombian peso, which in annual terms was 15.36%.

General Local Market Information

The trading volume of Bancolombia's common and preferred shares reached significant peaks in March, when common shares exceeded COP 566,000 million. Meanwhile, preferred shares recorded an outstanding volume of COP 703,000 million in April.

Throughout the first quarter, volume in common shares showed a notable increase due to the FTSE rebalancing on March 15, generating flows of close to COP 433,000 million and a share volume of 13.9 million shares. However, after this period there was evidence of a decrease in trading volume, falling to levels below COP 100,000 million in the following months.

In contrast, preferred shares continued with more stable volumes, hovering around COP 346,000 million, and showed a rebound in September (COP 387,000 million). On average, the monthly volume traded in common shares for 2024 was COP 160,000 million, while the volume of preferred shares remained 2.3 times higher than that of common shares.

In 2024, Bancolombia managed its debt in the international market through three bonds. This included the partial repurchase and early redemption of the ordinary bonds maturing on January 29, 2025, the partial repurchase of the subordinated bonds maturing on October 18, 2027 and the early redemption of the subordinated bonds maturing on December 18, 2029. In total, USD 1,320 million was collected.

Additionally, a subordinated bond was issued in the international market with maturity on December 24, 2034 for USD 800 million, with a rate of 8.625%, achieving an investor appetite 2.3 times greater than the amount sought.

When analyzing the behavior of the rates of the bonds issued in the international market by Bancolombia Group during 2024, we notice that all the debt outstanding at the end of the year had favorable fluctuations in its rate. The Banistmo 2027 bond presented the best performance, with a reduction of 139 basis points (bps). Meanwhile, the Bancolombia 2034 bond, issued during the year, decreased its rate by 98 bps, while the Bancolombia 2027 bond reduced its rate by 24 bps.

We continue to advance in our positioning and partnership strategy with the different communities in the capital markets through active participation in different local and international events.

During 2024 we held more than 340 meetings with investors through attendance at seven international conferences in London, New York, Santiago and Lima, complemented by four group events held virtually. In addition, we had the opportunity to meet with 65 fixed income funds on the occasion of the marketing tour of the new subordinated bond issue in June.

Aware of the importance of providing clear information and having closer contact with the individual shareholder segment, this year we participated in 8 virtual events through the Valores Bancolombia and Trii eTrading platforms, including Issuer Week, Bolsa Millonaria (visits to universities), Masterclasses and two sessions on Financial Sector Perspectives.

We also maintained coverage of 14 investment analysts with whom we held 38 meetings in order to provide them with an update on quarterly results, the competitive environment, corporate strategy and future prospects.

Finally, we are pleased to share that once again Bancolombia reaffirmed its status as an issuer with IR Recognition in 2024, granted by the Colombian Stock Exchange to those companies that adopt best practices in disclosure and investor relations.

Additionally, the Liquidity Builder Program for Bancolombia's common and preferred stock was renewed indefinitely. This favored liquidity conditions and mitigated volatility in share trading for the benefit of all investors.    

The Board of Directors of Bancolombia S.A. has decided to propose to its shareholders at the upcoming Ordinary General Shareholders' Meeting in March, a profit distribution project that considers the following aspects:

(i) Bancolombia will continue to maintain an adequate capital structure and an optimal level of solvency to meet the expected growth of the business, maintaining prudential standards above regulatory levels.

(ii) Business projections in 2025 are based on moderate asset growth, stability in overall business performance and a return on equity substantially above projected inflation for Colombia.

Based on the foregoing, the Board of Directors will submit to the consideration of the shareholders the profit distribution project described below:

(i) Payment of an annual dividend of COP 3,900 per share, payable in one installment on April 01, 2025.

(ii) The constitution of an occasional reserve for the strengthening of equity and future growth of the entity for COP 1.86 trillion.

(iii) An occasional reserve available to the Board of Directors for donations to social benefit projects for COP 34,000 million.

The following is the proposed profit distribution that the Board of Directors will present for approval at the Meeting:

We are the financial ally of countries.

We support more than 19.7 million clients in Colombia. During 2024, we granted disbursements for COP 136.8 billones , aimed at meeting the diverse needs of individuals, households and businesses. Our portfolio balance in the country closed in 2024 at COP 191.9 trillion.

Meanwhile, in Central America, through our subsidiaries, we supported 766,000 customers in Panama, 622,000 in Guatemala and 1.65 million in El Salvador.

In 2024, we faced a context of inflation, high interest rates and deterioration of the loan portfolio. In response, we are managing risk more cautiously, without restricting access to credit.

On the corporate side, we maintained our permanent support with solutions in ordinary portfolio, treasury, development and leasing, aimed at financing working capital and investment, among other needs. In addition, to take care of their financial health, we provided contextual alternatives to those who had payment difficulties, including rating models with a preventive approach, strengthening the use and management of guarantees, and lowering interest rates.

In the case of individuals, pre-approvals were an instrument to maintain the balance between portfolio management and the granting of the financing they needed. In 2024, we disbursed more than COP 10.6 trillion to more than 534,000 clients in this segment in Colombia, ensuring a healthy placement with the use of analytical models and client knowledge.

In Guatemala, we have strengthened customer knowledge to increase commercial opportunities, develop the route to personalization, and develop tools to enhance targeting efforts. In fact, at BAM we adopted a model in the collections teams to boost portfolio recovery. This model included a digital strategy to contact more customers and became an additional support channel.

Financial management that leverages the business

To ensure the responsible growth and financial strength of the business, we carried out several key transactions in 2024.

We successfully executed a multi-stage debt management transaction. We began with the partial repurchase of 2025 senior bonds and 2027 subordinated bonds, allowing us to optimize our financial obligations.

Subsequently, we issued a Basel III subordinated bond for USD 800 million, with a 10-year term. Despite the challenging international environment, this issue was oversubscribed 2.3 times and 116 investors participated. This reflects the confidence that the markets continue to place in us. We closed the transaction with the repurchase of the remaining 2025 ordinary and 2029 subordinated bonds.

These transactions allowed us to reduce interest payments and strengthened our capital structure, consolidating our position as a benchmark in the capital markets and demonstrating our ability to proactively manage debt.

We developed a robust hedge accounting model to design new interest rate and exchange rate risk management strategies, which contributed to the reduction of our deposit costs. This allowed us to offer competitive rates to our clients, which is key to accompanying them in their productive projects.

From Treasury, we consolidated our regional presence and continued to provide comprehensive solutions to our clients in Colombia, Guatemala, El Salvador, Panama and Costa Rica. Throughout the year, more than 1,000 companies from different sectors were accompanied through financial education programs, fostering a culture of market risk management.

We reaffirmed our commitment to sustainable development by including ESG criteria in our investment decisions and increasing by 75% the sustainable hedges we offer our clients in the SME, business, corporate and institutional segments, aligning our financial strategy with their sustainability objectives.

We promoted various initiatives to optimize the use of our resources. Through interdisciplinary teams, we gave greater impetus to the management of the organization's most representative expenses, while accompanying the management of the efficiency of products and distribution channels.

We rallied the organization around the EFITÓN, an event in which more than 1,900 employees contributed to designing improvement initiatives that resulted in estimated savings of COP 924,000 million. This management allowed us to keep expense growth below inflation in 2023. This highlights our ability to generate value through efficiency.

Focusing on digital evolution, we implemented an analytical model for the management of our ATM network that optimizes maintenance and improves the planning of their renewal, extending their useful life from 7 to 8 years and generating efficiencies of COP 1,774 million.

Bancolombia Capital

With our treasury, investment banking, securities and fiduciary services, we supported a wide range of industries that required specialized financial advice for the administration of resources, investment management and with specialized solutions and structures tailored to the needs ofthe clients.

In Fiduciaria, we have 2,136 businesses under management, with assets of COP 163.3 trillion.

From Fiduciaria Bancolombia, we promote the creative industry, managing more than COP 1.6 trillion, with the commitment to generate transparency and security for investors, promote foreign investment, the development of regions, cultural diversity and creativity as pillars of transformation for the country. We are allied with Colombian production companies and major streaming platforms worldwide. We currently manage more than 65 audiovisual productions, including films, series, animated projects, video games, short films, and nine cultural and creative industry projects.

We engaged with initiatives focused on financial inclusion, financial education, and the development of new credit products through schemes that provide over COP 3 trillion in funding for local and international Fintechs. We also supported other key players in the ecosystem, including HealthTech companies in Colombia that help over 18,000 patients finance their medical procedures. We worked with Agrotech firms to unlock the potential of more than 15,000 agricultural producers across 24 departments nationwide. Additionally, we partnered with Hometech initiatives aimed at improving connectivity, quality, and service stability for internet users in socioeconomic strata 1, 2, and 3, among others.

Meanwhile, in Banca de Inversión (Investment Banking), during 2024 we accompanied 47 transaction closings and advisory services. In Mergers and Acquisitions, we must highlight our participation as exclusive financial advisors to Grupo Calleja, in the acquisition of 86.8% of Grupo Éxito. This was an iconic and unprecedented transaction in the region, which required simultaneous tender offer processes in Colombia and the United States due to Grupo Éxito's dual listing on the stock exchanges of Colombia, New York, and Brazil.

In Structured Finance, the year was one of good dynamics in project finance and corporate debt, with renewable energy projects and large corporate transactions standing out.

The infrastructure sector was one of the most relevant in our operations in 2024. We supported projects of high relevance for road connectivity in the countries and impact on communities (see the chapter on Infrastructure in the chapter Achieving well-being for all).

In terms of investments, we managed COP 33.1 trillion in assets. This year alone we received 33 new portfolios, reaching a total of COP 6.3 trillion under management. We launched innovative funds focused on secured credit, payroll deduction and specialized attention to foreign investors, as well as international portfolios to accompany clients in meeting their objectives. Likewise, we had a 36.6% share of the total amount placed in the fixed-income market and participated in 22 issuances.

As a result, we continue to bring capital markets closer to more individuals. During the year, more than 133,000 transactions were made through e-trading, 84% more than the previous year.

With our broker dealer and investment adviser operation in the United States, we offer new opportunities for professional investors interested in optimizing their liquidity and exploring medium and long-term alternatives, with access to products in public and private markets, as well as funds with diversified strategies in stocks and bonds from different sectors and countries.

We closed 2024 with USD 815 million in assets under management and USD 4.38 million in revenues. In both cases, we exceeded the annual target by more than double.

Bancolombia's sustainable finance

The financial sector is key to leveraging low-carbon economies and sustainability challenges. With the purpose of promoting sustainable development to achieve the well-being for all, we identified opportunities to offer new and diverse financial instruments. These instruments not only generated new sources of income but also supported various stakeholders in meeting their needs. Additionally, we integrated environmental, social, and governance (ESG) factors into every segment of the banking business, as well as in investments and asset management, among others.

At Bancolombia, sustainable finance focuses on the following products and services:

•Credit: seven sustainable lines, which in 2024 disbursed credits for COP 9.22 trillion (the details are in the chapter Achieving well-being for all).

•Sustainable Investment: assets under management with ESG criteria for COP 32.3 trillion.

•Funding: outstanding sustainable bond issues for COP 1.07 trillion, and sustainable loans for USD 100 million.

•Treasury: sustainable hedges for COP 736,669 million.

We are committed to implementing responsible investment best practices and are aware that Environmental, Social and Corporate Governance (ESG) criteria are fundamental to fulfilling our fiduciary duty.

Since our 2014 adherence to the Principles for Responsible Investment (PRI), supported by the United Nations, we have challenged ourselves to incorporate these criteria as a fundamental and integral element in all our investment processes. On this journey, and with the experience and knowledge acquired, we have deepened the integration of sustainability in our products and service offerings, our recommendations to the market, and our own position. In 2024, we reached the following milestones:

•As part of our goal to mobilize at least COP 500 trillion by 2030 through financial services in activities aligned with our sustainable business purpose, we continued to make progress in the area of Asset Management. By the end of 2024, we achieved that 90% of the Assets Under Management incorporated ESG criteria in their investment decisions.

•We joined the Net Zero Asset Managers initiative because we are committed to aligning our investment portfolios with carbon neutral scenarios by 2050. To achieve this, we measured our investments' indirect carbon footprint using the PCAF methodology and set science-based targets validated by the Science Based Targets Initiative (SBTi). We commit to aligning scope 1 and 2 emissions of our asset management investment portfolio to 1.5°C by 2040 and 2.0°C including scope 3, using 2021 as the base year.

•Due to the lack of information and ESG ratings in the region, we continue to apply our own ESG assessment models under international standards. As of 2024, we have 56 internally rated companies, expanding the coverage of ESG ratings that allow us to make responsible decisions aligned with our ESG policies.

•We developed and published our Engagement Policy, which provides us with guidelines for building long-range dialogues with our customers, issuers and suppliers based on different environmental, social and governance issues.

•We built tools that allow us to perform sustainability analysis for assets that did not have an assessment methodology, such as thematic emission, and measurement of industries sensitive to climate change.

At Bancolombia Group, we have been consolidating a sustainable finance strategy to offer individuals and businesses solutions for harmonious relationships with the environment and the community.

With the issuance of green, social, sustainable and sustainability-linked bonds, we seek to promote business projects that facilitate the transition to a low-carbon economy. We also want to contribute to closing social gaps, such as access to health or drinking water. In addition, we bring to the securities market the message that investments can generate social and environmental value.

We have issued 6 bonds, two of which have already matured, for a total of COP 2.7 trillion. These funds have enabled us to finance initiatives in renewable energy, sustainable construction, empowerment of women entrepreneurs, social infrastructure, circular economy and access to affordable housing. As part of this, we also committed to increasing access to finance for unbanked and underserved low-income people and to achieve a reduction in financed CO2 emissions.

These bond issuances were conducted in Colombia and Panama. They had both domestic and international buyers, including the International Finance Corporation (IFC), the Inter-American Development Bank (IDB), and investors from the primary market.

As established in ICMA's Green, Social, Sustainable & Sustainability-Linked Bond Principles standards, we present below the status of the four bond issuances that remained active during 2024.

On July 19, 2019, we conducted the first sustainable bond issuance for COP 657,000 million. This was fully acquired by the IDB and marked the third issuance with sustainable characteristics. This bond matured in July 2024. A total of 74% of the resources corresponded to green projects focused on sustainable construction, renewable energy and energy efficiency. The remaining 26% corresponded to social projects focused on public housing. 100% of the resources were allocated and disbursed.

•Disbursements for COP 657,000 million

•11 projects in 4 departments

•7 green projects and 4 social projects

•Average disbursement per operation: COP 82,717 million

•Balance of assigned projects as of July 2024: COP 659,979 million

Sustainable Development Goals to which we contribute with this issuance: SDG 11: Sustainable cities and communities, SDG 9: Industry, innovation, and infrastructure, SDG 7: Affordable and clean energy, SDG 6: Clean water and sanitation, SDG 4: Quality education and SDG 3: Good health and well-being.

On September 16, 2021, we issued a second sustainable bond for COP 600,000 million in the Colombian primary market in 3 series: Series 1 for COP 164,703 million, which matured in September 2024; Series 2 for COP 183,797 million, and Series 3 for COP 251,500 million, both of which remain active. A total of 60% percent of the resources correspond to green projects focused on renewable energy, energy efficiency and circular economy. The remaining 40% corresponds to social projects focused on public housing and women's empowerment. 100% of the resources were allocated and disbursed.

•Disbursements for COP 435,297 million

•90 projects nationwide

•6 green projects and 84 social projects

•Average disbursement per operation: COP 10,253 million

•Balance of projects assigned at the end of 2024: COP 472,334 million

•Average term per operation: 5.9 years

Sustainable Development Goals to which we contribute with this issuance: SDG 1: No poverty, SDG 3: Good health and well-being, SDG 5: Gender equality, SDG 7: Affordable and clean energy, SDG 8: Decent work and economic growth, SDG 9: Industry, innovation, and infrastructure, SDG 10: Reduced inequalities, SDG 11: Sustainable cities and communities; SDG 12: Responsible consumption and production and SDG 13: Climate action.

In October 2022, we were the first financial institution in Latin America to issue a bond linked to sustainability, for an amount of COP 640,000 million and a term of 5 years, and acquired by the IDB, IDB Invest and the Latin American Green Bond Fund (LAGreen). Under this operation, the conditions are linked to achieving two objectives by 2025 aligned with our purpose: 1) To increase financing for unbanked or underserved individuals with low incomes and 2) To reduce CO2-intensive emissions financed (tons of CO2e per COP million) per portfolio. The results achieved at the end of 2024 are directly disclosed on our website.

Additionally, this issuance has a specific framework aligned with the 2023 Sustainability-linked Bonds Principles (SLBP) of the ICMA (International Capital Market Association), certified by Sustainalytics as an independent third party, and the local regulations applicable to these instruments.

In August 2019, Banistmo, our subsidiary in Panama issued the first gender-focused social bond in Latin America for USD 50 million. It was structured and subscribed by IDB Invest, in line with its women's economic empowerment strategy and its commitments to the Gender Parity Initiative, the Seal of Equality and UN Women's Empowerment Principles.

100% of the resources were used to enable access to financing for SMEs led by women, through commercial loans for small women-owned businesses in the trade, services and agribusiness sectors.

In August 2021, 100% of the resources were allocated and disbursed, benefiting 311 SMEs led by women.

Sustainable Development Goals to which we contribute with this issuance: SDG 5: Gender equality, SDG 8: Decent work and economic growth and SDG 9: Industry, innovation and infrastructure.

This bond matured in 2024.

We currently have a loan tied to sustainability indicators for USD 100 million that we received from international banks. Through this loan, we have committed to manage and make progress on the following indicators:

Percentage of women in leadership positions (Colombia): 40.3% (target: 47%).

Absolute CO2 emissions, scope 1+2, from operations in Colombia, Panama, El Salvador and Guatemala (measured in thousands of tons of CO2e): 4.8 (target: 5.4)

Eco-efficiency

This chapter includes the eco-efficiency management implemented in 2024 and describes the results obtained in Bancolombia Group's operations in Colombia, Panama, El Salvador, and Guatemala.

In our direct operation we use natural resources such as energy, water, among others, which requires a conscious management to reduce our impact and a commitment to define a strategy to reduce consumption consistent with our corporate purpose. For this purpose, we carry out permanent monitoring aligned with reduction goals.

For the 2010 – 2020 period, we exceeded our goals. To reinforce our commitment, we challenged ourselves to reach higher goals, establishing a new baseline in 2019. During 2024, we achieved our goals in general terms. Among the most notable achievements were the reduction of emissions related to corporate travel and the decrease in paper consumption.

Describes the framework, structures, principles and guidelines for planning, organizing, executing, monitoring, controlling and ensuring the continuous improvement of our environmental performance. This is achieved through the prevention, control and minimization of the environmental impacts of the operation in all the territories where we operate and by complying with the current environmental regulations that apply to us.

We continue to focus our efforts on identifying opportunities for improvement and strengths of our actions. This allows us to continually improve the indicators of our mission axes in eco-efficiency, Environmental and Social Risk Analysis (ESRA), sustainable business and climate change strategy.

In 2024, compliance with current mandatory regulations and the commitments we have made in voluntary sustainability protocols and adhesions have remained among our priorities. We kept our environmental and social legal matrix periodically updated and managed, making the respective mandatory annual reports on the corresponding platforms.

At Bancolombia Group, we have undertaken several actions to redesign our processes and digitize and reduce paper consumption.

Not applicable: Given the bank's activities, non-renewable materials are not used in the provision of services.

Renewable materials used: We only quantify paper usage within this category.

In 2024, our paper consumption totaled 737,7 tons. This represents an improvement in consumption compared to 2023, with a reduction of 10%. Compared to 2019, there was a reduction in consumption of 367 tons, representing a 33% decrease.

Our Energy Model seeks to efficiently manage energy consumption. For 2024, an increase of 1.3% was generated compared to 2023. Compared to 2019, we achieved a 16% reduction.

For 2024, the energy matrix of Guatemala and El Salvador was taken into account for the calculations:

Each year, we aim to reduce energy consumption. The following table illustrates the changes since the baseline year. For the calculation of energy intensity, we used the number of employees of Bancolombia, Banistmo, Bancoagrícola and Bam and the number of suppliers that remain in Bancolombia's facilities.

Remarks:

•To calculate energy intensity, we consider the total energy consumed within the organization (renewable electricity: purchased, self-generated and from the grid, and non-renewable: fuels), along with the number of direct group employees plus suppliers.

•Currently, there is no steam, cooling, or heating consumption.

•Currently, we do not sell energy.

•For unit conversion, we use the technical regulations and legal metrology of the SIC, UPME and Gas País.

•During 2024, we made an adjustment to the calculation of energy consumption in order to report what was actually consumed during the year, since we had been reporting based on billing dates.

•In Panama, El Salvador and Guatemala, fuels of different qualities are consumed, but they are grouped into diesel and regular gasoline.

•For Colombia and Panama, only fuel consumption for backup power plants is included. In Guatemala and El Salvador, vehicle fuel is also included.

We continued with the implementation and research of energy efficiency strategies, based on constant monitoring of energy consumption in branches and buildings, to identify and intervene in deviations that could alter the achievement of our goals. Thus, we have strengthened our strategies at the corporate level, integrating the actions we implement in each of the countries where we operate.

We integrated buildings into BMS (Building Manager System) for decision making and preventive management for energy and water efficiency, consumption control, and indoor personnel comfort.

We remain committed to our goal of purchasing 100% of our operation's renewable energy certificates by 2030. In 2024, 81% of our electricity consumption came from renewable sources, contributing to our climate commitments. This percentage reflects the contribution of each country.

•Colombia: 100%

•Panama: 100%

•Guatemala: 23%

Self-generated energy

Self-generated non-conventional renewable energy: we continue to explore implementation projects based on the analysis of our infrastructure.

•Colombia: our main building, General Management, has 1,964 panels, an installed power of 600 kWp, which generated 623.1 MWh during 2024. Additionally, our La Palmas and Torre Oriente branches generated an additional 55.32 MWh. This allows for a total annual generation of 678.39 MWh.

•El Salvador: solar panels were implemented in our data center and 7 branches during 2024, generating 462 MWh.

•Guatemala: has panels at several sites that generated 22.7 MWh.

Climate change is a growing challenge. Therefore, Bancolombia is committed to defining concrete actions to actively contribute to mitigation and compensation from our direct operations and move towards a low-carbon economy.

In 2020, we redefined our science-based target for Scopes 1 and 2, aligned with a 1.5°C scenario and with a challenge to achieve carbon neutrality in the countries where we operate by 2030.

The definition of this target was based on the science-based methodology (SBTi – Science Base Targets Initiative).

Currently, we implement energy efficiency strategies and utilize renewable energy in 100% of our facilities. This includes the installation of photovoltaic systems in Colombia and El Salvador, as well as the purchase of 100% renewable energy certificates (REC) in Colombia and Panama, and 23% in Guatemala. In addition, we have planted more than 170,000 trees with Fundación Natura, with which we estimate a capture of 2,727 tons of CO2e.

We calculate our carbon footprint using the methodology proposed by the GHG Protocol under the operational control scheme. Only CO2 is included in the calculation as a greenhouse gas, since at the time of making the calculation, we identified that the other gases do not have a significant contribution.

Direct emissions associated with our consumption of fossil fuels in emergency power generation plants at our branches, the use of our own vehicles in El Salvador, and indirect emissions associated with the electricity purchased for our operations.

During 2024, we increased our Scope 1 + 2 market-based emissions by 32.8% compared to 2023, with an emission of 4,807.16 Tons of CO2e/year and a 75% reduction compared to 2019.

During 2024, we updated fuel emission factors for fuels and electricity across countries.

Market-Based emissions correspond to the purchase of renewable energy, which accounts for 100% in Colombia and Panama, and 23% in Guatemala.

Biogenic emissions: In the case of Colombia, where B2, B8 and B10 biodiesel are used, the corresponding percentage is calculated as biogenic emissions.

Emissions associated with our paper consumption (category 1), the logistical processes of our branches and buildings in Colombia (category 4) and business air travel (category 6). We will discuss our financed issues in detail in a later chapter.

During 2024, we decreased our Scope 3 emissions by 8.4% compared to 2023 with an emission of 1,545.37 Tons of CO2e/year. Compared to 2019, we achieved a 51% decrease.

During that year, we set a 7% reduction goal for emissions associated with the process of delivering supplies to our branches in Colombia. Thus, thanks to the efforts made between the supplier OFIX and our logistics and distribution area, we achieved a reduction compared to 2023, going from 11 Tons of CO2e/year to 10 Tons of CO2e/year.

Biogenic emissions: This doesn't apply as we lack the necessary information for this calculation.

Remarks:

The emission factors were sourced from:

•Energy

Colombia: Obtained from UPME's annual report.

Panama: It is sourced from local government reports.

El Salvador: Obtained through Low Carbon Power's website

Guatemala: It is sourced from local government reports.

•Fuels

Obtained from UPME calculator and IPCC 2006.

•Paper

It is data provided by the paper supplier.

•Travel

Data provided by the airlines and shared by the travel agency in Panama. For Guatemala, Colombia and El Salvador it is extracted from the EPA Simplified GHG Emissions Calculator (U.S. Environmental Protection Agency).

Due to the purchase of renewable energy certificates, we calculate our footprint based on location and market:

The changes in emissions since the base year are shown below, as well as the intensity of emissions using as calculation data the number of employees of Bancolombia, Banitsmo, Banco Agrícola and Banco Agromercantil and the number of employees of suppliers that remain at Bancolombia S.A.'s facilities.

By 2024, an increase in total emissions of 20% Tons of CO2e was generated compared to 2023 (Market Based).

In the following table, we present the emissions intensity of Scope 1+2 and Scope 3.

As denominator, we use the number of employees of Bancolombia, Banitsmo, Banco Agrícola and Banco Agromercantil and the number of employees of suppliers that remain in Bancolombia S.A.'s facilities.

During 2024, 7 solar photovoltaic power generation projects were installed in El Salvador and iREC power was purchased. This allowed the avoidance of emissions for Scope 2 as seen below:

To offset the impact of the carbon footprint generated by our travel, we continued with the implementation of the internal carbon tax for business travel. In 2024, we generated internal revenue of COP 269,614,972, which we invested in energy efficiency initiatives to reduce energy consumption and the purchase of renewable energy certificates (REC).

In 2024, we managed a total of 1,665 tons of waste, decreasing the amount of waste going to final disposal by 18.3% compared to 2023. Compared to 2019, there was a 3% increase. This poses a challenge for 2025.

For 2024, we recalculated the ppc (per capita production) for the calculation of ordinary waste. This recalculation was performed using the information reported by DANE related to waste generation. In addition, we adjusted the reporting form, classifying WEEE (Waste Electrical and Electronic Equipment) as HW (Hazardous Waste).

In this section, we outline the waste generated during Bancolombia Group's operations. They are differentiated between those disposed of by a third party and those also utilized by third parties. All this information is validated through certificates confirming final disposal or utilization, as applicable.

The managed waste includes recyclables (paper, plastic, glass, PET, cardboard, scrap), special waste, WEEE, and hazardous waste.

In the process of delivering supplies to the branches in Colombia, we seek to reduce the number of times that contact is generated with the branch. Therefore, at the same time as orders are delivered, a reverse logistics process is carried out to collect waste. In 2023, we carried out 1,104 activations, while in 2024 we reached 1,401 activations, representing an increase of 27% over the previous year. This process reached 506 branches nationwide, with a total of 29,144 kilos collected and a recovery rate of 99.3% of the material.

We conducted awareness campaigns for the correct separation of waste in Colombia, Panama and Guatemala.

In Colombia, we carried out a campaign with “Marce La Recicladora” to raise awareness among our personnel on how to separate waste.

We remain a member of the Ellen MacArthur Foundation with the objective of strengthening the circular economy within the group.

We are part of the Repack collective in Colombia, which is responsible for the proper management of packaging placed on the market.

At Bancolombia Group, we believe that corporate governance and transparency of information are fundamental pillars for maintaining the trust of our investors, materializing our corporate strategy, guaranteeing sustainability and promoting ethical behavior.

The adoption and implementation of the best corporate governance practices in Bancolombia Group strengthen risk management and the internal control system. The documentation and disclosure of the evolution of these practices provides clarity on the responsibilities of our management bodies and their members, facilitating their compliance. Likewise, the delivery of complete, accurate and timely information enables our stakeholders to make informed decisions.

The share capital of Bancolombia S.A. is made up of common and preferred shares. On the one side, common shares grant their holder the right to participate in the deliberations of the Shareholders' General Meeting and to vote, and to receive a proportional share of the profits declared. On the other side, preferred shares grant the right to receive, at the time and in the manner approved by the General Meeting, a minimum preferential dividend based on the profits of the previous fiscal year. As a general rule and except for specific decisions identified in the corporate bylaws, preferred shares do not grant voting rights to their holders.

The Bank has an authorized capital of COP 700,000,000,000.00 and a subscribed and paid-in capital of COP 480,913,500,000.00, represented by 961,827,000 subscribed and paid-in shares. As of December 31, 2024, the total number of shareholders was 43,522. Of these, 25,700 are holders of preferred shares, 14,634 are holders of common shares, and 3,188 are holders of both common and preferred shares.

The following is the distribution of share capital as of December 31, 2024:

To date, we are not aware of any beneficial owners with a percentage of more than 10% of our share capital.

The information on shareholders with significant shareholdings as of December 31, 2024, is listed below:

No public entity has a shareholding of more than 5%.

We are not aware of any agreements entered into among our shareholders that have as their purpose the management of the business, voting alignment or similar matters. In addition, in accordance with current applicable regulations, we do not have any shares held in reserve.

In accordance with our Good Governance Code, the Directors and Administrators of Bancolombia S.A. may, directly or through an intermediary, sell or acquire shares of the Bank, while they are in the exercise of their positions, as long as they involve operations unrelated to speculation and have authorization from the Board of Directors. The administrators may not carry out the operation during the months of January, April, July and October of each year, nor during the first ten calendar days of the remaining months, nor during the period between the time when the administrators become aware of a relevant operation or business to be carried out by the entity and the time when it is disclosed to the market. The regulations adopted by the Board of Directors in this regard are regulated in paragraph 3.4. of the Good Governance Code, which can be consulted at the following link:

www.grupobancolombia.com/wcm/connect/

www.grupobancolombia.com15880/44349919-2d9d-4b5a-b153-8740ac95e42b/Codigo-de-Buen-Gobierno-Bancolombia-27-agosto-2024.pdf?MOD=AJPERES&CVID=p9pGh3X

In the case of Directors and members of Senior Management, the authorization of the Board is promptly informed to the market through the relevant information mechanism.

As of December 31, 2024, our members of the Board of Directors and Senior Management held the following shares in the company:

As explained below, the Bank's employees, including members of Senior Management, receive 30% of their variable compensation in units of a fund that invests exclusively in the Company's shares and is managed by Protección.

Likewise, the Directors, as agreed by the shareholders, receive 30% of their remuneration through this fund.

Communication with our Shareholders

For Bancolombia Group it is essential to maintain open and transparent communication with its shareholders, ensuring their access to complete, clear and timely information. For this reason, we have a corporate website, available in Spanish and English, where we publish financial and non-financial information, details about the corporate structure, the composition of the governing bodies, information about our directors and main shareholders, the most relevant corporate documents, and topics related to sustainability, environmental, social and human capital management, among other information of interest.

Through the Shareholder Service Center, managed by Fiduciaria Bancolombia S.A., we answer the queries and requirements of our shareholders during the year. In 2024, we handled 24,205 shareholder requests, mainly related to tax certificates, dividend payment updates, general and historical certificates, blocking or unblocking, and certificates of deposit. We also attended a total of 351 calls and 71 visits.

Our Investor Relations Office offers a live streaming channel for quarterly earnings presentations, where participants have the opportunity to submit questions in real time. The recordings and presentations made in these spaces are available on the market on our corporate website. Additionally, our shareholders may request specialized audits on specific topics, on the terms provided for this purpose in our Good Governance Code. Likewise, our management team holds periodic meetings of an informative nature with investors, analysts, and risk rating agencies in Colombia and abroad, to present the progress and performance of the Bancolombia Group’s businesses. Thus, achieving enriching spaces for dialogue for all parties.

In compliance with current Colombian regulations and the guidelines established by the Securities and Exchange Commission (SEC), we disclose relevant information to the market through the mechanism established by the Financial Superintendency of Colombia (SFC) and through 6-K reports. Our relevant information is also available to the public on our corporate website in both Spanish and English at the following link:

www.grupobancolombia.com/relacion-inversionistas/informacion-interes/informacion-relevante

With the prior approval of the Disclosure Committee, a body that reports directly to the Audit Committee and is in charge of verifying that the information we publish is accurate, clear and timely, during 2024, Bancolombia S.A. published 47 relevant disclosures to the market. The rating agencies transmitted 3 additional relevant information announcing ratings of our issued securities and of our company as a securities issuer.

Shareholders' Meetings held during 2024

During 2024, we held three Shareholders' Meetings. In each of them, the Board of Directors established measures aimed at ensuring the equitable treatment of all our shareholders, addressed to the legal representatives, administrators and other employees of Bancolombia S.A. and Fiduciaria Bancolombia S.A. These measures included, among others, refraining from promoting the granting of blank proxies, receiving proxies where the name of the representative is not clearly defined, admitting as valid proxies without fulfilling the legal requirements, suggesting the name of proxies and recommending a vote in favor or against any proposal.

The fair treatment measures are published as relevant information and have been made available to our shareholders on our corporate website. In addition, we adopted actions to make it easier for our shareholders to evaluate the information concerning each Meeting.

The following is a detail of each of the meetings of the 2024 General Shareholders' Meeting:

1.Ordinary Meeting of the General Shareholders' Meeting:

It was held on March 15, and was convened on February 21, 22 common days in advance, a term that exceeded the term established in the bylaws and current regulations. The announcement was published in two widely circulated newspapers, and appeared as relevant information in both Colombia and the United States.

Within the legal term, that is, 15 business days before the meeting, the information pertinent to the General Meeting was made available to our shareholders and the general public on our corporate website. Likewise, within the same term, our shareholders had access to the documents pertaining to the right of inspection at our main domicile.

At the meeting, 474,105,073 shares of our common stock were duly represented, equivalent to 93% of our total common and outstanding shares.

At this meeting, the management report, the Audit Committee's report, the standalone and consolidated financial statements, the Statutory Auditor's reports, the Profit Distribution Project, the election of the Statutory Auditor for the period 2024 – 2026 and his fees, a proposal to amend the Company's bylaws and the update of the remuneration of the Board of Directors were presented to the shareholders for their consideration.

An alternative dividend distribution proposal was received from a shareholder, which was published on our website and read at the General Shareholders' Meeting. The proposal submitted by management, which was available to the shareholders during the term of the right of inspection, was voted on first. Likewise, it was informed that, in the event that the proposal did not obtain the required votes to be approved, the proposal presented by the shareholder would be submitted to a vote.

The proposal presented by the administration was approved by the Meeting with the legally and statutorily required majorities. Likewise, the General Shareholders' Meeting approved the payment of an annual dividend of COP 3,536 per common or preferred share, payable in 4 quarterly installments of COP 884 per share per quarter, on the following dates: April 1, July 2, October 1, 2024 and January 2, 2025.

The General Shareholders' Meeting reelected PwC Contadores y Auditores SAS as Statutory Auditor for the period April 2024 – March 2026. Annual fees were approved for eleven billion four hundred forty-five million five hundred seventy-two thousand twenty-five Colombian pesos (COP 11,445,572,025). By 2025 the value of fees and expenses will increase in accordance with the CPI.

Likewise, management was authorized, with the approval of the Audit Committee, to make payments for additional services associated with the statutory audit and SOX functions, for an amount not to exceed 10% of the total annual amount authorized by the Meeting.

In order to attract and retain members of the Board of Directors with the highest knowledge and competencies that contribute to the generation of value and the fulfillment of strategic objectives, for the benefit of shareholders, the 2024 General Shareholders' Meeting approved the update of the remuneration of the Board of Directors, in a global economic context of inflation.

The amount of the monthly fees for the Board of Directors and for participation in the Support Committees was set at thirteen million four hundred twenty-five thousand four hundred eighty-seven Colombian pesos (COP 13,425,487) for Directors residing in Colombia and three thousand three hundred thirty-six dollars (USD 3,336) for Directors residing abroad, plus a per diem of two hundred sixty-eight dollars (USD 268) per travel day to attend the Board or Committees in person. In accordance with the policy approved in previous sessions, 70% of the Board of Directors' fees are paid in cash. The remaining 30% is contributed to an Institutional Fund whose only investment is shares of the Bank and is subject to a two-year term of permanence, counted from each contribution.

Finally, the General Shareholders' Meeting approved a reform of the Company's bylaws that adopted best practices, provided greater clarity and updated the bylaws in line with current regulations. The proposed comprehensive amendment to the bylaws was made available to the shareholders during the term of the right of inspection and in the booklet delivered to them at the time of registration. The most relevant changes are described below:

•The company's term was extended for another 100 years, until the year 2144.

•Regarding the conflict resolution mechanism, the Arbitration and Conciliation Center was changed from the Chamber of Commerce of Bogotá to the Chamber of Commerce of Medellín, considering that the Bank's main domicile is Medellín. Also, for consistency purposes, the holders of political or economic rights of the shares issued by the Bank were included within the application of this article.

•Regarding the duties of the administrators, the obligation to maintain information confidentiality was reinforced under their responsibility. In addition, it was clarified how to proceed in the event of a conflict of interest, in accordance with current regulations.

•Regarding the election of the Board of Directors, the term for calling the meetings at which directors are elected was extended to 15 business days. Likewise, the presentation and evaluation of candidates and slates was regulated, ensuring sufficient time for national and international shareholders to examine the information and define the direction of their vote.

•Regarding the operation of the Board of Directors, the term of notice for extraordinary meetings of the Board of Directors was extended to 3 business days, so that the directors have sufficient time to evaluate the information. The procedure to be followed in the event of a possible conflict of interest was specified. In addition, in order to guarantee shareholders clear and accurate information in the event of a tender offer, the Board of Directors was authorized to hire advisors, if it so decides, to analyze the offer in a comprehensive manner. This will allow shareholders to have an external and expert perspective, as is the case in international markets.

•Finally, we defined limits to the powers of the System Managers, Branch Managers and Assistant Branch Managers, in their capacity as legal representatives, in order to adjust them to the responsibilities inherent to their role.

www.grupobancolombia.com/relacion-inversionistas/informacion-interes/asambleas-accionistas

2.Extraordinary General Shareholders' Meeting:

The second meeting of the 2024 Shareholders' Meeting was held on June 26, and was called on May 29, 27 common days in advance, a term that exceeded the term established in the bylaws for the Meetings at which the Board of Directors is elected, and in the current regulations. The announcement was published in a widely circulated newspaper, and as relevant information both in Colombia and in the United States. Shareholders had access to the information of the Meeting and to all management's proposals 15 common days in advance.

At the meeting, 460,622,076 shares of our common stock were duly represented, equivalent to 90.37% of our total common and outstanding shares.

At this meeting the shareholders elected the Board of Directors for the period July 2024 – March 2026, approved additional fees for the statutory auditors, approved the rules for the election of members of the Board of Directors, and approved an amendment to the bylaws.

The election of the Board of Directors took place following the resignation of Gonzalo Alberto Pérez Rojas, which was communicated to the market on May 03 through relevant information mechanisms and Form 6-K. The Meeting reelected the Directors who were already serving in the role, as listed in the Board of Directors section of this report. Additionally, the Meeting appointed Ricardo Jaramillo Mejía, President of Grupo Sura, as a new Director. We published on our corporate website, with the same advance notice as the call for applications, the schedule of dates for the application of candidates, as well as the instructions to carry it out. Both documents were aligned with the procedure established in Article 47 of our bylaws.

As part of the Board election process, only one slate was received from the shareholders Grupo de Inversiones Suramericana S.A. and Inversiones y Construcciones Estratégicas S.A.S. within the four business days following the publication of the notice of meeting. The Good Governance Committee, ten business days before the Extraordinary Meeting, assessed compliance with the selection criteria outlined in the Good Governance Code. It also evaluated each candidate’s qualifications, experience, and professional background, ensuring that no disqualifications or conflicts of interest existed.

In the evaluation carried out by the Good Governance Committee, the academic and professional career of the candidates, their personal qualities, their analytical and managerial skills, their competencies, their knowledge of the industry, financial, risk, legal, commercial, economic or strategic aspects, their contribution to the management of Bancolombia S.A., and their complementarity and diversity were taken into account. Likewise, the aptitude to take office before the Financial Superintendency of Colombia (SFC) and the availability of each candidate to attend at least 80% of the total number of meetings, to review the material in advance and to take part in the training offered by the Bank were also taken into account.

In general terms, the Good Governance Committee concluded that the candidates included in the list presented are upright professionals and have high ethical standards and good reputation. Additionally, they have top-level academic preparation, knowledge and a professional career that allow them to direct the Bancolombia Group to its purpose. They have experience in risk management and sustainability, as well as a global and strategic vision of business. None of them is immersed in causes of inability or incompatibility, and the independent members meet the conditions set forth in the Good Governance Code to be considered as such. Likewise, the candidates present a high degree of complementarity and diversity in technical strengths, academic and professional experience, both nationally and internationally, in fields relevant to the Group's management and the adequate management of its risks and business. The evaluation of the Good Governance Committee regarding each of the candidates can be consulted on our website at the following link:

www.grupobancolombia.com/wcm/connect/

www.grupobancolombia.com15880/44349919-2d9d-4b5a-b153-8740ac95e42b/Codigo-de-Buen-Gobierno-Bancolombia-27-agosto-2024.pdf?MOD=AJPERES&CVID=p9pGh3X

Additionally, the Meeting approved an additional amount for appropriations and fees for the statutory auditors of up to one billion six hundred ten million Colombian pesos (COP 1,610,000,000) payable in one or more installments between July 2024 and March 2025, to certify the financial situation of Bancolombia S.A. within the framework of the hybrid bond issuance process in the United States.

Likewise, with the purpose of advancing in the strengthening of corporate governance, the General Shareholders' Meeting approved a regulation for the election of members of the Board of Directors. This regulation incorporates the criteria of independence, as well as the disqualifications and conflicts of interest of the candidates for Board members in force in the Good Governance Code, in such a way that they have greater dissemination and are widely known by the shareholders. These criteria take into account the provisions applicable to commercial companies, issuers of securities, entities supervised by the SFC, as well as the recommendations of the Country Code. Additionally, considering that the Bank is an issuer of securities in the United States, these criteria also take into account the standards applicable to companies listed in the United States and those listed on the New York Stock Exchange (NYSE).

Finally, the General Shareholders' Meeting approved an amendment to the Company's bylaws, which was made available to shareholders 15 days in advance and in the booklet provided to them at the time of registration. The most relevant changes were:

•Articles 47 and 54 of the bylaws were amended to specify that the election of the Board of Directors must take into account the Regulations for the Election of Members of the Board of Directors approved by the Meeting.

•Article 95 was added to the bylaws, aimed at enhancing the protection of shareholders' rights by granting selling shareholders the right to receive the highest price paid during a 12-month period by a buyer intending to acquire a significant percentage of the company Specifically, Article 95 establishes that, if a purchaser achieves in successive purchases and during 12 months, shareholding percentages of more than 25% or 5% after a Public Share Offering, he/she will be obliged to match the price to the shareholders who have sold their shareholding to him/her during that period of time. The article also states that the buyer must establish a process that allows sellers to know if they are beneficiaries of the right of price equalization, and claim the respective payment.

www.grupobancolombia.com/relacion-inversionistas/informacion-interes/asambleas-accionistas

3.Extraordinary General Shareholders' Meeting:

The third Shareholders' Meeting was held on December 11, and was called on December 2, six business days in advance and eight common days in advance, thus complying with the legal and statutory term defined for Extraordinary Shareholders' Meetings. The announcement was published in a widely circulated newspaper, and as relevant information both in Colombia and in the United States. It was also published in Spanish and English on our corporate website.

At the meeting, 410,227,567 shares of our common stock were duly represented, equivalent to 80.48% of our total common and outstanding shares.

At said meeting, the shareholders authorized the Management, with the approval of the Audit Committee, to make payments for additional services rendered by PWC, associated with the process of evolution of the corporate structure of Bancolombia S.A. and its subordinates. These payments shall not exceed three billion six hundred million Colombian pesos (COP 3,600,000,000) and two hundred thousand dollars (USD 200,000) for the services required in Colombia, the United States or other jurisdictions in which the Bancolombia Group operates. The contracting and payment of the additional services may take place between 2024 and 2025. The dollar value will be paid at the TRM in effect on the date payment is made.

The details of the proposal submitted for consideration of the shareholders can be consulted at the following link:

www.grupobancolombia.com/relacion-inversionistas/información-interes/asambleas-accionistas

Our Board of Directors1

According to the information provided to the market by Grupo de Inversiones Suramericana S.A. on August 31, 2023, Gonzalo Alberto Pérez Rojas, former Chairman of said company and former member of the Board of Directors of Bancolombia S.A., tendered his resignation to the Board of Directors of Grupo de Inversiones Suramericana S.A., the day after he turned 65 years of age. The Board of Directors of Grupo de Inversiones Suramericana S.A. accepted his resignation and asked him to remain in office until April 30, 2024. On May 03, 2024, Bancolombia S.A. announced that Gonzalo Alberto Pérez Rojas resigned from his position as a member of the Bank's Board of Directors, effective May 01, 2024.

As explained above, the Extraordinary Shareholders' Meeting held on June 26 reelected the Directors who were already serving in the role and elected Ricardo Jaramillo Mejía, President of Grupo Sura, as the new Director. Prior to the appointment, the Good Governance Committee evaluated the candidates and concluded that they are suitable professionals, that none of them is immersed in any cause of inability or conflict of interest, and that the independent members meet the conditions set forth in the Good Governance Code to be considered as such.

Thus, our Board of Directors, appointed for the period from July 2024 to March 2026, has a diverse composition that integrates experience and innovative perspectives. This combination of skills, qualities and backgrounds guarantees the performance required by the governing body of a systemically important institution such as Bancolombia S.A.

Our Board of Directors is comprised of 71% independent directors, 29% foreign directors, and 29% female participation. 100% of our Directors are over 50 years of age. The average period of tenure of the Directors is five years, as follows:

•Ricardo Jaramillo Mejía: Equity member of the Board of Directors since 2024, he was appointed at the Extraordinary Shareholders' Meeting held on June 26.

•Juan David Escobar Franco: Equity member belonging to the Board of Directors since 2020. He was reelected in 2021, 2023 and 2024.

•Andrés Felipe Mejia Cardona: Independent member belonging to the Board of Directors since 2016. He was reelected in 2018, 2020, 2021, 2023 and 2024.

•Arturo Condo Tamayo: Independent member, of Ecuadorian nationality, belonging to the Board of Directors since 2016. Expert in cybersecurity issues. He was reelected in 2018, 2020, 2021, 2023 and 2024.

•Luis Fernando Restrepo Echavarría: Independent member belonging to the Board of Directors since 2016. He is currently the Chairman of the Board. He was reelected in 2018, 2020, 2021, 2023 and 2024.

•Silvina Vatnick Independent member, of Argentinian nationality, belonging to our Board of Directors since 2021. Expert in financial and ESG issues. She was reelected in 2023 and 2024.

•Sylvia Escovar Gómez: Independent member belonging to the Board of Directors since 2020. She was reelected in 2021, 2023 and 2024.

1 It is important to note that when we refer to independent or equity directors, we refer to the definitions set forth in current Colombian regulations and in the Good Governance Code.

•All of our Directors have a recognized reputation, decision-making capabilities, analytical skills and the necessary competencies to perform their duties and assume their responsibilities as Directors of a systemic entity such as Bancolombia S.A. Their knowledge and specialties allow them to measure and evaluate risks in a comprehensive manner, as well as to contribute to the financial, internal control, technological, commercial, economic and legal aspects of the Bancolombia Group. None of our Directors are employees of Bancolombia S.A. or its subsidiaries, nor are they members of the Boards of Directors of the latter.

The professional profiles of our Directors, together with their academic and professional trajectory, as well as their participation in administrative bodies of other organizations, are available on our institutional website. They can be consulted in the Board of Directors tab by clicking on the following link:

www.grupobancolombia.com/corporativo/gobierno-corporativo/junta-directiva-alta-gerencia

As reported earlier, the 2024 Annual General Meeting of Shareholders approved the update of the remuneration of the Board of Directors.

In accordance with our bylaws, the Board of Directors has broad powers to order the execution or performance of any act or contract within the Bank's corporate purpose and to adopt the necessary decisions in order for the Bank to fulfill its objectives. Among its main responsibilities, the Board of Directors is in charge of defining the general, financial and risk policies, as well as the strategic objectives of both the Bank and the Bancolombia Group, for which it evaluates its performance.

In addition, it has special powers, including, but not limited to:

•Set the general salary and extra-legal benefits system.

•Define the general structure of the Bank that it deems appropriate for the adequate management of the Bank and the Bancolombia Group.

•Approve the creation of Vice Presidencies and designate legal representatives.

•Oversee the effectiveness of the internal control system, risk management systems and legal compliance.

•Authorize the incorporation of subsidiaries and affiliates, as well as the acquisition, subscription or disposal of shares, quotas or rights in other companies or enterprises that comply with the conditions set forth in our bylaws.

•Appoint the members of the Board Support Committees.

•Approve the Code of Ethics and the Good Governance Code.

•Promote respect and equitable treatment of all shareholders and other securities investors.

•Carry out, under the terms established in the Good Governance Code, the evaluation of its own management and that of the Bank's President.

The duties of the Board of Directors are set forth in Article 61 of our bylaws. The Board of Directors Operating Regulations are included in the Good Governance Code. Both documents are available in Spanish and English on our corporate website:

www.grupobancolombia.com/corporativo/gobierno-corporativo/documentos-de-interes

Among other functions carried out during 2024, in its capacity as the highest management and administration body, the Board of Directors:

•Authorized the management to advance in the procedures and execute all the necessary acts to perfect the transactions leading to modify the corporate structure of the Bancolombia Group through the creation of a parent company to be called Grupo Cibest S.A. by means of: (i) the partial spin-off of Bancolombia (Panamá) S.A. for the benefit of the Beneficiary Company BC Panamá S.A.S.; (ii) the merger by absorption by Bancolombia S.A. of the Beneficiary Company BC Panamá S.A.S.; (iii) the partial spin-off of Banca de Inversión Bancolombia S.A. Corporación Financiera for the benefit of Bancolombia S.A.; and (iv) the partial spin-off of Bancolombia S.A. for the benefit of Grupo Cibest S.A. The procedures and actions referred to in this authorization include, but are not limited to, those aimed at calling the shareholders' meeting of Bancolombia S.A. once the necessary regulatory approvals are obtained in Colombia, Central America, and other countries where the Group operates, as well as the relevant procedures and registrations in Colombia and the U.S. related to the actions of Grupo Cibest S.A.

•Authorized the preparation, filing and registration of Form F-4 under the U.S. Exchange Act of 1933 with the Securities and Exchange Commission (SEC), pursuant to the Exchange Act of 1933. Form F-4 is related to the evolution of the corporate structure of Bancolombia and its subordinates indicated in the previous point.

•Approved the constitution of the new Technology and Cybersecurity Committee as a support committee to the Board of Directors, and its rules of procedure.

•Approved amendments to the regulations of the Audit, Risk and Good Governance Committees.

•Recommended to the General Shareholders' Meeting the appointment of the Statutory Auditor, after evaluation by the Audit Committee of the proposal submitted.

•Appointed the new Compliance Officer.

•Analyzed the strategic execution and performance of the businesses in the geographies in which the Group operates.

•Evaluated the reports from management, internal audit and the Statutory Auditor on the evolution of the different risk management systems.

•Through the Risk Committee, followed up on the different risks in the risk map.

•Monitored the proper functioning of the control, risk monitoring and compliance systems, making recommendations for their continuous strengthening.

•Approved the annual calendar of its ordinary sessions.

•Defined the company's annual budget.

•Approved modifications to the Good Governance Code, the SIAR Manual, and the Code of Ethics.

•Monitored the financial results of the Bank and Bancolombia Group.

•Authorized the capitalization of subsidiaries and affiliates.

•Carried out appointments of administrators and Senior Management members.

•Evaluated, among others, periodic reports on AMV (Colombian Securities Market Self-Regulator) certifications, cybersecurity reports, business continuity plan, stress test results, and information security policies.

On September 24, 2024, once the Directors elected at the Extraordinary Shareholders' Meeting held on June 26 were appointed by the SFC, the Board reelected Luis Fernando Restrepo Echavarría, independent director, as its Chairman and appointed Ricardo Jaramillo Mejía, equity director, as Vice Chairman. In addition the Board of Directors appointed the members of the Board Support Committees.

In compliance with the assigned duties, the Chairman of the Board ensured the efficiency and proper performance of the Board, and guided the discussions to ensure the participation of the Directors and the relevance and effectiveness of the debates. Likewise, together with the General Secretary and the Good Governance Committee, he managed the annual evaluation process of the Board of Directors and its Support Committees and the process of defining the annual thematic agenda of the Board of Directors. This agenda guides the activities of the Board of Directors, helping to plan, follow up and fulfill management and supervisory functions. This allows the Board to strategically address business, risks and adapt to the dynamics of the environment, the evolution of operations and the needs of the Bancolombia Group.

The Legal Vice President and General Secretary, in addition to the functions already mentioned, is responsible for making available to the Directors the information and documentation to be evaluated at the meetings of the Board of Directors and Support Committees. Additionally, she is responsible for reflecting in the minutes of the Board of Directors the development of the meetings and the decision-making processes, as well as to ensure compliance with the procedures and rules of corporate governance, in accordance with the provisions of the Bylaws and other corporate documents.

During 2024, 12 ordinary and 3 extraordinary meetings of the Board of Directors were held, with an average attendance rate of 92.8% The average attendance at Board meetings by each Director is as follows:

•Ricardo Jaramillo Mejía*: 83%

•Juan David Escobar Franco: 87%

•Andrés Felipe Mejía Cardona: 100%

•Arturo Condo Tamayo: 87%

•Luis Fernando Restrepo Echavarría: 93%

•Silvina Vatnick 100%

•Sylvia Escovar Gómez: 100%

*Ricardo Jaramillo Mejía was appointed Director at the Extraordinary Shareholders' Meeting held on June 26. Average attendance is calculated from his appointment.

** Gonzalo Alberto Pérez Rojas attended 83.3% of the meetings held up to the date of his resignation.

According to the Board of Directors' operating regulations outlined in Section 3.1 of the Good Governance Code, Directors must have sufficient time availability to take on responsibilities in service of Bancolombia S.A., which includes thoroughly reviewing materials and attending sessions. Availability also implies an attendance that must not be less than 80% of the total annual meetings of the Board and Committees, except in the case of justified force majeure.

The total amount paid to the Directors for their participation in the Board and in the different Support Committees held during 2024 amounted to two billion four hundred seventy-three million seven hundred ninety-six thousand five hundred fifty-three Colombian pesos (COP 2,473,796,553).

Per diems amounted to fifty-eight million five hundred thirty-six thousand seventy-two Colombian pesos (COP 58,536,072).

Our Board of Directors has five Support Committees. Each Committee has a President and an Internal Regulation that regulates its composition, the frequency of its meetings and its functions. At the meeting immediately following a Committee's session, the Chairman of the Committee reports to the full Board on the matters evaluated and the decisions made at the meeting, or the decisions recommended to the Board.

Technology and Cybersecurity Committee

In view of our responsibility to identify trends and manage risks, and taking into account the importance of technology in our strategy, the Board of Directors established the Technology and Cybersecurity Committee in September 2024. The main objective of this Committee is to support the Board of Directors in the strategic direction and oversight of technology and cybersecurity matters of Bancolombia S.A. To this end, the Committee is aware of technology trends that could affect our strategic plans and reports on the technology operations of Bancolombia S.A. The Committee also monitors the development of the strategic technology plan and the performance of significant investments in technology and cybersecurity. The creation of this Committee allows close monitoring by the Board of Directors of technology and cybersecurity issues, including the action plans implemented to close the gaps.

The Committee is comprised of four members of the Board of Directors, including three independent Directors, among them the Director with expertise in security matters. The Vice President of Corporate Services, the Vice President of Technology, the Corporate Cybersecurity Environment Leader and the Director of Non-Traditional Risks attend the Committee as permanent guests. Jorge Noguera, external advisor to the Board of Directors on technology and cybersecurity, also attends the meetings. Additionally, the Vice President of Internal Audit and the Vice President of Risk may attend as guests, as well as any other relevant employee in accordance with the topics to be discussed. The Manager of Special Initiatives of the Vice Presidency of Technology Services acts as Secretary of the Committee.

During 2024, the Committee received a leveling in the Bank's cybersecurity technology and management expertise. It also discussed in depth the ongoing action plans related to channel availability events, and followed up on their evolution. Additionally, it reviewed the findings from Internal Audit regarding technology, cybersecurity, and cloud matters, as well as the exposure to technology and cybersecurity risks.

The Committee met four times over the course of 2024, with an average attendance rate of 93.7%, as follows:

•Silvina Vatnick, independent director and Chairwoman of the Committee: 100%

•Arturo Condo Tamayo, independent director and cybersecurity expert: 100%

•Andrés Felipe Mejía Cardona, independent director: 100%

•Juan David Escobar Franco, equity director: 75%

Good Governance Committee

The Good Governance Committee is composed of three independent members of the Board of Directors, and is permanently attended by the President of Bancolombia S.A. The Legal Vice President and General Secretary of Bancolombia S.A. acts as Secretary of the Committee. The main purpose of this Committee is to support the Board of Directors in the fulfillment of its functions related to corporate governance, approve the ESG strategy and review its compliance.

During 2024, the Committee learned the results of the evaluation of the Board of Directors for the 2023 fiscal year and made suggestions to strengthen the Board's effectiveness. It also evaluated the thematic agenda of the Board of Directors for 2024. The Committee reviewed and recommended the statutory amendments proposed by management at the Ordinary Shareholders' Meeting held on March 15 and the Extraordinary Shareholders' Meeting held on June 26, as well as the proposed compensation for the Board of Directors. In addition, the Committee recommended the Board of Directors to adopt the modifications to the Good Governance Code, the Good Governance Committee regulations, and to implement the Orientation and Training Policy for members of the Board of Directors.

Additionally, as previously mentioned, for the election of the members of the Board of Directors carried out by the Extraordinary Shareholders' Meeting on June 26, 2024, the Committee conducted an assessment of compliance with the selection criteria defined in the Good Governance Code, and analyzed the suitability, experience, and professional profile of each candidate, as well as the absence of disqualifications and conflicts of interest regarding them.

In the area of sustainability, the Committee followed up on the ESG strategy and indicators, and learned about the ESG disclosure framework for the geographies in which we operate.

During 2024 the Committee met six times with an average attendance of 94.3%, as follows:

•Luis Fernando Restrepo Echavarría, independent director and President of the Committee: 100%

•Sylvia Escovar Gómez, independent director: 100%

•Arturo Condo Tamayo, independent director: 83%

Appointment, Compensation and Development Committee:

The Appointment, Compensation and Development Committee is made up of two independent members and one equity member of the Board of Directors. The Committee is attended by the President of the Bank, the Corporate Vice President of Talent and Culture, and the Compensation and Benefits Manager, who acts as Secretary of the Committee.

The main task of the Appointment, Compensation and Development Committee is to support the Board of Directors in determining the policies and provisions for the selection, appointment, hiring and remuneration of Senior Management and all matters related to the Bancolombia Group’s remuneration model.

During 2024, the Committee met twice, once by written vote. The Committee approved the executive team's Long Term variable compensation indicators, evaluated Banistmo's variable compensation model and had an average attendance rate of 100%, as follows:

•Sylvia Escovar Gómez, independent director and Chairwoman of the Committee: 100%

•Luis Fernando Restrepo Echavarría, independent director: 100%

•Ricardo Jaramillo Mejía, equity director*: Does not apply

*Ricardo Jaramillo Mejía was appointed Director at the Extraordinary Shareholders' Meeting held on June 26. The Committee met prior to that date, with the participation of Gonzalo Alberto Pérez Rojas, former equity director.

Risk Committee

The Risk Committee of Bancolombia S.A. is composed of two independent members and one equity member of the Board of Directors. This Committee is permanently attended by the President and the Vice President of Risks of Bancolombia S.A. Jorge Noguera, external advisor to the Board of Directors, attends as a guest when the topics to be discussed at the meeting include technological or cyber risk issues.

The Committee meets monthly, and its main objective is to support the Board of Directors in the approval, monitoring and control of policies, guidelines and strategies for risk management.

During 2024, the Committee supported the Board of Directors in the approval, follow-up and control of risk management policies, guidelines and strategies. It also conducted monthly monitoring of the different indicators and the behavior of the risks in the organization's risk map, including ESG and cybersecurity risks.

The Committee met 12 times during 2024, with an average attendance rate of 97.3%, as follows:

•Andrés Felipe Mejía Cardona, independent director and President of the Committee: 92%

•Silvina Vatnick, independent director: 100%

•Juan David Escobar Franco, equity director: 100%

Audit Committee

The Audit Committee of Bancolombia S.A. is composed of three independent members of the Board of Directors, one of them being the financial and ESG expert and the other the cybersecurity expert. This Committee is attended by the Vice President of Internal Audit of Bancolombia S.A., the Statutory Auditor, Dr. Luis Alberto Zuleta, external advisor to the Audit Committee, and when the issues to be discussed include technological or cybersecurity matters, Jorge Noguera, external advisor to the Board of Directors.

The Committee meets monthly, and its main objective is to serve as support to the Board of Directors in supervising the effectiveness of the internal control system of Bancolombia S.A., in particular, and of the Bancolombia Group, in general, as well as in its improvement. During 2024, the Committee supervised the integrity of the financial statements, the financial reporting process and the internal accounting and financial control systems. It also approved and monitored the execution of the Internal Audit and Statutory Auditor's work plan, guaranteeing their autonomy, objectivity and independence. It also monitored the different programs managed by the Compliance Vice Presidency including SARLAFT, Ethics, FATCA, Data Protection, Anti-Fraud, and Regulatory Compliance.

It also recommended to the Board the approval of the Information Security Policy and approved the 20F and the Internal Audit Charter.

The Audit Committee met 16 times during 2024, with an average attendance rate of 92%, as follows:

•Arturo Condo Tamayo, independent director and Chairman of the Committee: 88%

•Andrés Felipe Mejía Cardona, independent director: 88%

•Silvina Vatnick, independent director: 100%

The timely delivery of information is essential for our Directors to actively participate in sessions and make informed decisions. In this regard, we make use of a web-based tool with exclusive access for the Directors. Through this tool, we make available to them, at least four days in advance, the material to be presented to the Board Support Committees and the Board of Directors, for their prior evaluation and analysis. In addition to guaranteeing timely access to information for Directors, this tool protects the confidentiality of the information.

At the Ordinary Shareholders' Meeting held on March 15, 2024, an amendment to “Article 36. Duties of Directors” of the Company's bylaws was approved, in order to complement the obligation of reserve of the directors, pursuant to the regulations of the Company's Good Governance Code. Paragraph 4 of said article establishes that any person appointed as a member of the Board of Directors adheres to the Information Management Regulations set forth in the Good Governance Code and is required to sign the Agreement for Access and Use of Information. Said regulation, developed in paragraph 3.7 of the Good Governance Code, establishes that the Directors must keep and protect the confidentiality of the information to which they have access. It also states that their functions as Directors must be performed in the best interest of the Bank, considering the interests of its associates. Therefore, they must refrain from using confidential information for any purpose other than the performance of their duties.

In compliance with the provisions of the Good Governance Code, the Bank's Board of Directors carries out an annual evaluation of its management and that of its Support Committees. These evaluations alternate between internal and external. Thus, between December 2023 and February 2024, the external advisor Governance Consultants conducted an evaluation of the Board's management during 2023. Likewise, in January 2025, a self-assessment of the 2024 management was carried out.

The evaluation took into account the composition of the Board of Directors, the strategic role of this body, the interaction and dynamics of the Board, access to information and coordination of the agenda, the dynamics of the different Support Committees and Board meetings, and the performance of Senior Management.

The diversity of knowledge of the Directors was positively highlighted, as it allows for a holistic view of the Bank's sustainability on all fronts. In addition, the operation of the Committees, the evolution of the organization's corporate governance and the importance of the specialty of the Committees for the dynamics of the Board of Directors were highlighted. Likewise, the Directors highlighted as strengths of the Board the commitment, trust, respect, professionalism, experience, talent, independence and leadership of its members.

The Directors recommended continuing to work on the Board of Directors' agenda while maintaining a strategic focus in the discussions. Likewise, they requested to continue promoting the training offered to the Directors, especially in cybersecurity and digital transformation.

The results of the Board's self-assessment for 2024 were evaluated by the Good Governance Committee and the Board of Directors, and were taken into account for the construction of the annual thematic agenda and the improvement of the governing body.

The training received by the Directors enables them to perform their duties effectively.

The Good Governance Code, in section m of paragraph 3.1., documents the Orientation and Training Policy for Directors, which was incorporated into the Code in 2024. In line with this policy, and with the aim of ensuring that newly appointed Board members understand their responsibilities and the organization's operations, the General Secretary coordinates their orientation plan. This plan is tailored based on each Director’s experience, background, and profile, the Support Committees they will participate in, and their prior knowledge of the entity. Thus, Ricardo Jaramillo Mejía, once appointed Director, completed an orientation and training plan.

In addition, the Bank provides Directors with regular opportunities to update their knowledge and skills through training and education on academic, commercial and strategic topics related to the competencies of the Board and its Support Committees, and on the topics that the Board of Directors and Senior Management define as relevant and pertinent for each year. In addition, Directors are encouraged to attend seminars and events that allow them to be in contact with national and international organizations, entities and companies.

On April 02 and 03, 2024, the Directors received a certification on "ESG Factors as a Decision-Driver in the Banking Sector", given by the Barcelona School of Management. The certification was oriented to deepen the implications of the management function in the ESG field, decision-making that impacts the ESG strategy, and the identification of potential opportunities and risks from an ESG perspective.

The Board of Directors also received certification in Anti-Money Laundering (AML) trends from the Financial & International Business Association (FIBA). In this certification, the responsibilities and challenges faced by managers in this area were discussed in depth. In addition, a tour of best practices to ensure that AML programs work effectively and meet the highest regulatory standards was provided.

Likewise, the Directors that make up the Technology and Cybersecurity Committee participated in knowledge leveling sessions on the matters pertaining to said Committee.

Senior Management is responsible for implementing and executing the strategy, and for achieving the organization's medium- and long-term corporate objectives. Senior Management is composed of the President of Bancolombia S.A. and the Vice Presidents who report directly to him.

During 2024, the following people made up the Senior Management:

•Juan Carlos Mora Uribe, President. The direct governance and management of the Bank is the responsibility of the President, who has a vision of integral governance of all the Group's companies at national and international level and establishes clear reporting lines and assignment of responsibilities. The Bank's President, with the support of his Senior Management team, directs the goals and objectives and validates strategic execution and plans, ensuring that they are integrated within the context of the Group.

•Mauricio Rosillo Rojas, Vice President of Business. His main responsibility is to design, execute and supervise strategies aimed at generating value in the businesses of the Bank and its subsidiaries. He also defines value propositions aligned with the universal banking model, in order to consolidate and expand the Group's leadership.

•Julián Mora Gómez, Corporate Vice President. He is responsible for the implementation of a strategic model that leverages the business, from the coordination of areas with transversal impact such as Reputation and Communications, Human Resources, Compliance and Diversity, Equity and Inclusion.

•Jaime Alberto Villegas Gutiérrez, Vice President of Corporate Services. His main responsibility is the provision of corporate administrative, technology, operations and project support services required by the business units to fulfill the promises made to customers, ensuring the normal development of the Bancolombia Group's activities.

•Rodrigo Prieto Uribe, Vice President of Risks. His function is the design and proposal of the Risk Appetite Framework, the SIAR policies, the general exposure and concentration limits, the Risk Governance structure, and the strategies to manage risks, the capital and liquidity, to the Board of Directors. He also monitors that the policies established in the SIAR are effective and aligned with the organization's risk profile and appetite.

•Cipriano López González, Vice President of Innovation. He leads the formulation and implementation of innovation strategies, partnerships, digital transformation and analytical capabilities, seeking new sources of value generation for the organization's stakeholders.

•José Mauricio Rodríguez Ríos, Vice President of Audit. His main function is to evaluate the effectiveness of the internal control system, compliance with the accounting and financial policy, the quality of the systems established to guarantee compliance with applicable regulations, and the analysis of the organizational structure of the organization, proposing solutions to address identified improvement opportunities.

•Claudia Echavarría Uribe, Legal Vice President and General Secretary. In this position, she leads the general secretary and the legal strategy of Bancolombia Group, identifying, managing and mitigating the legal risk implicit in the development of the organization's activities, and creating innovative legal solutions to ensure the sustainability and purpose of the Group.

•Mauricio Botero Wolff, Corporate Vice President of Strategy and Finance. Appointed May 28, 2024. His mission is to direct and integrate the formulation and execution of strategy and financial management in the Group's companies and

businesses in all geographies, seeking to generate value for stakeholders, responsible growth and the Group's financial strength.

The professional profiles, academic background and professional experience of the members of Senior Management can be consulted on our corporate website at the following link, in the tab corresponding to Senior Management:

www.grupobancolombia.com/corporativo/gobierno-corporativo/junta-directiva-alta-gerencia

The Board of Directors is responsible for the appointment, remuneration and replacement of Senior Management, as well as the assignment of their main responsibilities and the supervision of their succession plan, for which it may rely on the Appointment, Compensation and Development Committee. In this way, the Board of Directors evaluated the performance of Senior Management, and through the Chairman of the Board and with the support of the Appointment, Compensation and Development Committee, annually evaluates the performance of the President of Bancolombia S.A.

The organization has a compensation strategy for the management team that is monitored on an ongoing basis. This compensation strategy is made up of fixed compensation, variable compensation and benefits. Variable compensation, with its short- and long-term components, seeks to stimulate the fulfillment of the company's goals, reward with the generation of value, align the interests of the management team with the interests of the shareholders, and recognize and encourage high performance of the management team in consistency with the organizational strategy.

The variable remuneration policy is based on the generation of added value. There is room for the payment of bonuses when organizational results in terms of profits exceed the value of the cost of capital. Besides, the model measures compliance with strategic planning goals, which must be aligned with the strategic direction defined by the Board of Directors. Long-term results are promoted. For this purpose, short- and long-term (triennial [3 years]) management measurement indicators are considered. The long-term component considers the financial indicator (SVA Holding), the sustainability indicator (Dow Jones Sustainability Index) and the loyalty indicator (competitive NPS). During 2024, the Board of Directors, through the Nomination, Compensation and Development Committee, comprehensively reviewed the challenges of the indicators associated with the long-term management of the variable component.

We have also established a remuneration cap: a maximum of eight salaries per year for the President and seven for the Corporate Vice Presidents as a bonus. The 30% of the remuneration is translated into participation in the Institutional Voluntary Pension Fund SVA, which is represented in shares of Bancolombia S.A. According to the fund's regulations, employees may only withdraw their contributions after a minimum permanence term of three years. The philosophy of this mechanism is that employees feel ownership of the organization and are committed to sustainable results.

Note 28 “Transactions with related parties” of the consolidated financial statements (note 27 of the standalone financial statements) contains details of labor payments made to Senior Management.

The withdrawal of resources from Fondo SVA by the Bank's administrators must undergo an authorization procedure before the Board of Directors. The authorization granted to the members of Senior Management is revealed to the market through the relevant information mechanism.

Finally, we have in place the Clawback Policy, which regulates the process of recovery by Bancolombia S.A. of excess incentive-based compensation recognized to executives in the event of a restatement of the financial statements due to a material failure to report financial information under the securities market law. The approved policy can be consulted on our corporate webpage at the following link:

www.grupobancolombia.com15880/44349919-2d9d-4b5a-b153-8740ac95e42b/Codigo-de-Buen-Gobierno-Bancolombia-27-agosto-2024.pdf?MOD=AJPERES&CVID=p9pGh3X

As a financial services provider, we offer our customers, including our related parties, the possibility of accessing the financial products and services we offer. In addition, according to the needs and evolution of the business, we enter into agreements and alliances.

Our commercial and business relationships with related parties are entered into at market prices and in Bancolombia Group's best interest. Although these operations are not inherently considered conflictive, there is a possibility that managers may face dilemmas when making decisions. The Group's employees and managers are expected to act with the utmost prudence when faced with a real or apparent conflict of interest, in accordance with the internal policies and guidelines contained in our Good Governance Code and our Ethics and Conduct Code, which can be consulted on our website.

When a Director (member of the Board of Directors) finds that in the performance of his or her duties he or she may be faced with a potential conflict of interest, the Director in conflict or any other Director who is aware of such potential conflict shall immediately inform the other members of the Board. The Director in a conflict of interest situation will refrain from participating in the discussion and decision of the matter that creates the conflict; and the Board will deliberate and decide without the participation of the Directors in conflict, unless their presence is needed to meet the quorum required for deliberation and decision-making. Otherwise, the conflict shall be submitted to the competent body in accordance with the applicable regulations, including the special rules for financial conglomerates.

Our Good Governance Code considers as related parties the companies subject to the control of Bancolombia S.A., our members of the Board of Directors and Senior Management, as well as their spouses and children, and the companies in which they have a shareholding of more than 10%, the entities that make up the Sura Bancolombia Financial Conglomerate, and other shareholders of Bancolombia S.A. with a shareholding in our share capital of more than 10%. In addition, the Good Governance Code contains policies by virtue of which transactions with related parties are classified according to their recurrence and materiality, so that adequate standards of identification, disclosure, evaluation and approval are applied.

During 2024, the transactions entered into with entities belonging to the Sura Bancolombia Financial Conglomerate were entered into under market conditions and under the premise of not jeopardizing the companies' ability to meet their obligations to third parties. Each party acted in its best interest.

On a monthly basis, the Board of Directors monitored the treasury operations carried out with our economic related parties, in accordance with the classification that exists for such purpose in terms of market and liquidity risks. These transactions were carried out under market conditions and in compliance with the procedures established for such purpose.

In addition, according to the Organic Statute of the Financial System, certain credit operations, including those entered into with shareholders owning 5% or more of the share capital and with the administrators and their relatives, require the approval of the Board of Directors, except for the vote of the respective Director, when applicable. Thus, during 2024, after verifying compliance with debt and risk concentration limits, three credit quotas were submitted to the consideration of the Board of Directors. The approval of these implied the abstention of the respective Directors, and they were unanimously authorized by the other members of the Board of Directors.

The Board of Directors also authorized certain Directors to liquidate their rights in the Institutional Fund managed by Protección, regarding contributions that met the required term of permanence. The Directors involved abstained from participating in the decision, and the operations were unanimously authorized by the other members of the Board of Directors. The authorizations were disclosed through the relevant information mechanism on January 23 and February 20, 2024.

Bancolombia S.A. disclosed its transactions with related parties in note 28 of the consolidated financial statements and in note 27 of the standalone financial statements.

In addition, at Bancolombia S.A. we promote the execution of agreements and contracts between the companies that make up the Bancolombia Group. Considering that consumer relationships of products and services reflect the parties' interest to obtain the best conditions for their own benefit, none of the transactions entered between Bancolombia S.A. and its affiliates or subsidiaries were performed under the exclusive interest of the parent company. In the ordinary course of our business, we enter into such active and passive operations, leasing contracts, correspondents’ office, network use and, in general, the provision of financial services, in accordance with the current legal provisions and the postulates contained in the Good Governance Code.

In compliance with the provisions of article 29 of Law 222 of 1995, the most important operations carried out during fiscal year 2024 are listed below, detailing their type of operation, conditions, and effects on the company: The figures below are expressed in millions of Colombian pesos.

At the end of the year, Bancolombia S.A.'s main active operations with this company corresponded to a credit portfolio of COP 35,576 million and fundraising through savings and checking accounts for COP 43,182 million.

The aforementioned transactions generated interest expense of COP 203 million and interest income of COP 13,363 million for Bancolombia S.A. In addition to the above, Bancolombia S.A. had commission expenses of COP 23,620 million and insurance recoveries of COP 22,428 million.

Bancolombia S.A. raised funds through checking and savings accounts with Investment Banking for COP 160,677 million at the end of the year. These liability transactions involved interest expenses of COP 8,166 million.

Bancolombia S.A. recorded active deposit transactions in correspondent banks for COP 259,433 million and liabilities transactions corresponding to deposits for COP 6,659 million at the end of the year. In 2024, Bancolombia S.A. made loans with Bancolombia Panamá S.A., which as of December 31 amounted to COP 4,996,655 million.

The above operations generated interest expenses for Bancolombia of COP 299,831 million.

At year-end 2024, Bancolombia S.A. recorded other interest income of COP 4,783 million and other income of COP 4,540 million. In addition, the company recorded a net income of COP 14 million in cash and derivative transactions.

At the end of the year, the main asset transactions with this company corresponded to deposits in correspondent banks for COP 57,289 million and the main liability transactions were due to financial obligations for COP 335,285 million and deposits for COP 59,435 million.

Liability transactions involved interest expenses of COP 25,952 million.

At the end of the year, Bancolombia S.A. made transactions with Inversiones CFNS for a credit portfolio for COP 20,052 million and fundraising through checking and savings accounts for COP 30,816 million.

These operations generated portfolio interest income of COP 4,683 million and interest expenses of COP 1,034 million.

As of December 2024, Bancolombia S.A. registered with Banistmo S.A. active operations in banks for COP 2,955 million and a credit portfolio for COP 231,477 million. It also recorded deposit liabilities transactions for COP 257 million and subordinated bond transactions for COP 3,189 million.

At the end of the year, Bancolombia S.A. presented interest income of COP 15,531 million and other income of COP 10,284 million. Derivatives operations generated income of COP 3,141 million and expenses of COP 2,362 million for Bancolombia S.A.

As of December 2024, Bancolombia S.A. had a credit portfolio for COP 688,107 million. In addition, it made fundraising operations through savings accounts for COP 51,501 million.

At the end of the year, Bancolombia S.A. recorded portfolio interest income of COP 76,342 million and leasing interest income of COP 9,834 million. The deposits generated an interest expense of COP 536 million for Bancolombia S.A.

As of December 2024, Bancolombia registered a credit portfolio of COP 91,701 million and deposits in checking accounts for COP 4,682 million with the Grupo Agromercantil Holding Conglomerate. As of the same date, Bancolombia S.A. presented portfolio interest income of COP 5,399 million.

At the end of the year, Bancolombia S.A. raised funds through checking accounts, term deposits and savings for COP 74,749 million. These liability transactions involved interest expenses for COP 5,176 million.

At the end of the year, Bancolombia S.A. raised funds through checking and savings accounts with Fiduciaria Bancolombia S.A. for COP 329,635 million, and with Valores Bancolombia S.A. Comisionista de Bolsa, for COP 25,720 million. These liability transactions with Fiduciaria and Valores implied interest and other expenses for Bancolombia S.A., which totaled COP 12,471 million and COP 1,397 million, respectively.

At the end of the year, Bancolombia S.A. recorded passive deposit operations with Wompi S.A.S. for COP 28,163 million. In addition, it generated interest expenses of COP 2,090 million, and a net expense for commissions of COP 6,714 million. With Banagrícola S.A., Bancolombia S.A. recorded active derivative transactions for COP 779 million and net income on derivative transactions for COP 1,228 million.

Company’s Legal Status

During 2024, our activities, business and operations were carried out within the legal framework applicable to a corporation and banking establishment supervised by the Financial Superintendency of Colombia (SFC). Likewise, we complied with the provisions applicable to issuers of securities in Colombia and the United States. We also adequately and fully complied with the legal requirements of bank reserve, own position, minimum capital, solvency ratio and mandatory investments.

The results of our businesses are duly reflected in the financial statements, and the relevant matters that occurred during the year were duly reported to the market through the information mechanisms enabled by the SFC and the Securities and Exchange Commission (SEC).

To date, we have not been notified nor are we aware of legal proceedings that could jeopardize our operations. However, the main contingencies arising from legal proceedings in progress are disclosed in note 22.2 to the standalone financial statements and note 21.2 to the consolidated financial statements.

During the year, we maintained constant communication with the supervisors, promptly responding to their requirements and requests. Likewise, we permanently followed up on regulatory modifications and regulatory projects in progress, in order to understand and anticipate their impact on our operations.

In addition, we complied with the provisions regarding the security and quality of transaction information established by the SFC in the Basic Legal Notice, as well as with our policies and procedures related to information management.

This is to guarantee the protection of consumer information, its integrity and availability through different channels.

In accordance with the provisions of Act 1676 of 2013, we have complied with the duties that we have for the receipt and payment of invoices issued to us. In this sense, and with the purpose of facilitating their free circulation and payment, we adopted, among others, measures aimed at guaranteeing that invoices are duly processed for timely payment and that invoice discounting operations are handled with due diligence.

Bancolombia complies with intellectual property and copyright regulations in carrying out its corporate purpose. The bank holds the rights mentioned or has the necessary authorizations and/or rights to exploit them through contracts signed with the rights holders or their authorized distributors of industrial property and/or copyright. As of December 31, 2024, and subsequent to the closing, we are not aware of any pending claims from authorities or third parties involving possible intellectual property violations.

Our Bancolombia brand (nominative, mixed and figurative) and other relevant brands are duly registered with the competent entity. Currently, the Bank has 208 registered trademarks in Colombia, 14 pending trademarks, 9 commercial slogans granted, 4 commercial signs in deposit and 6 commercial names granted. Abroad, it holds 300 registered trademarks, 73 trademarks pending, 4 granted commercial slogans, and 3 granted trade names. We highlight the following brands with strategic relevance for the company: Grupo Bancolombia, Grupo Bancolombia Capital, Bancolombia, Nequi, Wompi and Plink, as well as other relevant brands owned by other Bancolombia Group entities: Banistmo, Banco Agrícola and BAM.

In the execution of some of our mission processes, we leverage on third party software licenses under the On-Premise modality. Among the most relevant, we highlight the following:

•Core deposits, trade, mortgage, collections and Nequi.

•Transactional switch for electronic channels.

•Communication between branches and the Bank’s core application.

•Real-time transactions on financial instruments (currencies, derivatives, fixed income, and liquidity).

•Tax management for AFC (Housing Promotion Savings) accounts.

•Receipt of third-party payments by collection companies through bank channels.

•Suite of financial products oriented to treasury management.

•Endorsement and capture of check signatures.

•Dynamic key or two-factor authentication.

•Robotic automation of processes.

•CRM “Customer Relationship Management”.

In the use of these licenses, Bancolombia is exposed to the risks of internal and external fraud, cyber and information security, operational resilience, business continuity and technological failures, which are described in the Relevant Risks section. During 2024, we analyzed 66 suppliers, achieving a cumulative figure of more than 300 suppliers, whose total residual exposure is COP 712 billion. 86% of the risks are of a tolerable level, 10% of a moderate level and 4% of a critical or very critical level. As a result of this work, we have achieved a better control environment in the handling of sensitive data, strengthening process controls, access and vulnerability management.

On the other hand, Bancolombia has the following franchises in its payment methods business operation:

•Credit cards: Visa, Mastercard and American Express.

•Debit cards: Mastercard.

•Prepaid cards: Visa.

In the operation with the franchises, Bancolombia is exposed to risks of business interruption, external fraud due to information leakage, and errors in centralized compensation for franchises. For these risks, the entity has implemented the following controls: technology business continuity strategies, information encryption, secure connections, international card security certificate, accounting reconciliations and reasonableness of amounts payable. Additionally, it has the following certifications: MasterCard SOC1, Visa SSAE18 / ISAE3402 and American Express SOC1.

Corporate Evolution Project

On October 29, 2024, the market was informed of the authorization granted by the Board of Directors of Bancolombia S.A. to proceed with the steps aimed at modifying the corporate structure of Bancolombia Group and its subsidiaries. This modification will involve the creation of a parent company named Grupo Cibest S.A. and the completion of a series of corporate transactions to achieve this goal (the “Changes in the Corporate Structure”).

The Changes in the Corporate Structure include the following operations that will be submitted to the approval of the different Shareholders' Meetings of the entities involved, including an extraordinary meeting of Bancolombia's Shareholders' Meeting, in which the shareholders owning common shares and the shareholders owning shares with preferred dividend and without voting rights will participate:

a.The partial spin-off of Bancolombia (Panamá) S.A. for the benefit of the Beneficiary Company BC Panamá S.A.S. This company was incorporated by Bancolombia exclusively for the purpose of being the beneficiary of this spin-off, and subsequently to be absorbed by Bancolombia.

b.The merger by absorption by Bancolombia S.A. of the Beneficiary Company BC Panamá S.A.S.

c.The partial spin-off of Banca de Inversión Bancolombia S.A. Corporación Financiera to Bancolombia.

d.The partial spin-off of Bancolombia to Grupo Cibest.

Once the Changes in the Corporate Structure are completed, Grupo Cibest will be the parent company of Bancolombia and its subordinates. The shareholders of Bancolombia will become shareholders of Grupo Cibest, maintaining the same number of shares and the same percentage of their investment and under the same terms and conditions that they have in Bancolombia at the time of the completion of the transaction. Therefore, there will be no dilution or accretion for Bancolombia shareholders, nor transfer of value to third parties.

The notice of merger by absorption and partial spin-off of Bancolombia S.A. was published on January 13, 2025.

Anti-Money Laundering and Anti-Terrorist Financing Risk Management System (SARLAFT) Report

In 2024, we deployed actions to adequately manage the Anti-Money Laundering and Anti-Terrorist Financing (AML/ATF) risk and prevent the materialization of legal, operational, reputational and/or contagion risks associated with these behaviors, with a risk-based approach. The following are some of the most important activities carried out during the year:

•We continued to expand the scope of our analytical models and monitoring systems to identify in a timely manner the various warning signs associated with AML/ATF-related typologies and threats.

•We continued implementing, evolving and redesigning technological tools from the Compliance Vice Presidency, which allowed us to expand our capacity to identify, measure and mitigate the AML/ATF risk from different risk factors.

•We increased the monitoring of the initiatives of the different areas of the organization, ensuring adequate administration and management of the AML/ATF risk, consolidating our position as a strategic ally of the businesses.

•We managed and accompanied the implementation of controls for the mitigation of risks related to AML/ATF.

•We maintained a constant evolution in the AML/ATF risk methodology, applied to our models, matrices and tools for the identification, measurement, control and monitoring of risks, contributing to the efficiency and suitability of the program and aligning ourselves with the internal and external context of the Organization.

•We made progress in the strategy of promoting a culture of prevention against the risks of AML/ATF. To this end, we provided opportunities for close contact with the commercial team, making on-site visits to several branches throughout Colombia.

•During the year, we updated the SARLAFT manual, incorporating new elements that improve control over AML/ATF risks.

At Bancolombia, we promote the evolution of our AML/ATF Risk Management System, aimed at preventing and mitigating the materialization of these risks and enabling responsible and safe business for our customers and for the Organization.

Internal Control System Report

Based on the activities and evaluations performed by management, we conclude that the Internal Control System (hereinafter referred to as “ICS”) and the procedures for control and disclosure of Bancolombia's financial information as of December 31, 2024 operated satisfactorily.

Management continually evaluates and assesses the ICS so that when control issues with opportunities for improvement are identified, their relevance, root cause and action plans are determined. The latter are monitored to ensure continuous improvement of the ICS.

Bancolombia's ICS has policies and procedures in accordance with the size and complexity of the business and has been structured in accordance with the standards and best practices of the Committee of Sponsoring Organizations of the Treadway Commission (COSO) in its 2013 version. The following is a report on the work carried out during the year:

a.Control Environment

b.Bancolombia's Board of Directors leads the strategic planning process, which is based on a diagnosis of the competitive environment, trends and the company's capabilities to achieve its objectives. The latter seek to make our purpose, "to promote sustainable development for the well-being of all", a reality and to respond to the growing challenges that the environment brings us.

We are committed to promoting responsible and sustainable business. Therefore, we operate under the law and aspire to the highest standards of ethics, integrity and anti-corruption. We know that the existence of an adequate control environment derives not only from the implementation of the applicable regulations but also from the appropriation of our Movement B, as an expression of our culture, and of the six (6) traits that drive us: integrity, sustainable growth, human beings, clients, dynamism and extraordinary performance. These traits define our culture as a company, and motivate and guide our actions.

We continue focusing efforts on strengthening the culture of disclosure and ethical reasoning regarding conflicts of interest, related parties, participation in third-party boards and committees, access to insider information, external activities, gifts and invitations, sponsorships, and bailment agreements. We also aim to promote trust in the Ethics Line through the promotion of the Whistleblower Protection Policy via awareness activities targeted at the entire organization and prioritized groups.

During 2024, the following actions were taken to strengthen the ICS:

•The Compliance Vice Presidency continued to strengthen the compliance programs aimed at supervising and controlling the risks of ethics, anti-fraud, anti-corruption, money laundering, financing of terrorism and financing of the proliferation of weapons of mass destruction, protection of personal data and habeas data, financial consumer protection, sanctions, FATCA/CRS, risk of misconduct in trading desks, protection of free competition and regulatory compliance. The following activities were also conducted:

oUnder the role of SAC coordinator, we accompanied the proper implementation of the reporting of complaints and claims through the SmartSupervision tool.

oWe adopted the policy of protection of free competition and oriented management to the prevention of associated risks through the promotion of a corporate culture that respects free competition.

oWe developed an awareness and culture strategy through different campaigns and training activities to strengthen regulatory compliance.

oWe deployed the international economic sanctions program (OFAC, UK-HMT, EU. UN) and export controls on dual-use goods.

oWe strengthened our strategy and commitment to fiscal transparency, ensuring that the various processes associated with FATCA and CRS legal reporting comply with regulatory requirements.

oWe updated the Personal Data Protection Policy, incorporating regulatory changes in the area of Open Finance, adjustments in the purposes of processing for digital channels and the adoption of developments that incorporate Artificial Intelligence.

oWe worked to increase the ethical reasoning of all employees by providing them with tools to strengthen decision making, aligned with compliance with the zero tolerance to fraud and corruption statements.

•Strengthening the strategy of excellence in talent management and in connection with the Internal Control System, from the Vice Presidency of Talent and Culture we developed the following activities in 2024:

oWe continued with the dissemination of the value proposition focused on the three essential pillars of well-being: Development, Connection and Enjoyment, which are the basis for attracting and retaining talent through their work experience in the organization.

oAs part of the care for the well-being and mental health of employees, we conducted the Psychosocial Risk assessment at group level, with 97% coverage for Bancolombia, generating intervention plans for the prioritized population based on the results.

oWe made a significant investment in employee development and learning through multiple programs designed according to the strategic needs of the business and the best practices of the environment. The objective was to contribute to the evolution of the employees, helping them to reach their best version and meet the proposed goals. Regarding the mandatory annual training plan, we achieved a 99% completion rate among employees in 2024.

oAware of the importance of a healthy cultural environment, we updated our desired culture and leadership model statements for the entire Group, with the purpose of making them simpler and more contextual, connected to the evolution of the strategy and the challenges of the environment. To this end, we relied on the commitment of leaders and employees in their deployment and adoption in all countries.

oWe developed actions to maintain a solid and constantly evolving culture, articulated with the strategy and dynamics of the organizational ecosystem to promote good performance and well-being. This is how we incorporated the MIRROR methodology, a strategy designed to promote self-management of team well-being and performance. Through behavioral science, this program invites employees to reflect on their self-care habits, time management and conversational skills, promoting a healthy balance between personal well-being and work performance.

oTo enrich the employee experience, we renewed the employee voice model, which is based on putting people at the center of strategic decisions. This new model includes different instruments to measure perceptions about culture, well-being, key moments of the experience, ways of working and more, through relational (annual survey and pulses), transactional (selection, onboarding, learning, retirement, etc.) and qualitative (anthropological and experiential research) approaches. In addition, we launched the Talent Experience Artisans Community, composed of employees from various areas, whose objective is to implement more than 30 initiatives to improve the employee experience.

This community promotes people-centered design, reinforcing organizational culture and ensuring that actions have a positive impact on both the individual and collective level.

oWe accompanied the challenges of managing the organization's capacity, efficiency and productivity. Through transversal capabilities, we advanced in the development of analytical models applied to productivity, as a fundamental complement for decision-making. One of these models makes it possible to identify the habits of a productive person and the factors that influence the productivity of each employee.

oWe enabled the electronic signature through docusign for the documents of the talent processes in Conectados, improving the risk exposure and reducing the probability of fraud due to signature forgery.

oWe consolidated our position as a benchmark within the bank in information governance and employee data protection, by strengthening the policies, guidelines, roles, technology and practices of the Vice Presidency. These efforts have ensured a suitable environment for the development of analytical solutions, while guaranteeing the protection of employee data and compliance with the standards required by internal and external entities. We achieved this through initiatives such as the following:

1.We updated the manual and the data processing policy, incorporating new chapters focused on applicants, DEI (diversity, equity and inclusion) information, work tools, among others. In addition, we enabled a self-management channel for employees to make inquiries and requests related to the management of their information.

2.We developed and implemented internally the ENIGMA system, which encrypts sensitive employee data, such as health, salary, disability and personal contact information, in the sensitive tables of our official repository.

3.We updated the inventory of employee domain information, grouping it by families, assigning security ratings to each of the fields and implementing a data model of the vice presidency. Additionally, we assigned clear responsibilities for each information family.

c.Risk Assessment and Control Activities

The Bancolombia Group has a risk and control management framework that allows it to maintain the effectiveness, efficiency, and operational capacity of its management; prevent, avoid, or minimize the likelihood of events that could impact its operations or the achievement of its objectives; and prevent or minimize the costs or damage associated with the occurrence of these events.

During 2024, we continued to strengthen the Risk Governance model as a key element in comprehensive management. This framework includes the identification of the different risks to which the Organization is exposed, the definition of roles and responsibilities of each of the lines in relation to these risks and the association of the areas that each of the roles plays. The framework promotes the risk management culture through self-control, self-management and self-regulation, in line with the provisions of the SOX Act and Chapter IV of Title I of Part I of the Basic Legal Notice regarding the Internal Control System.

Adequate structuring in the three lines and their proper functioning avoids the existence of gaps, unnecessary duplication of efforts and provides greater possibilities to achieve adequate management through the interaction between the business and support units and the control and prevention units. In this way, it facilitates the achievement of organizational objectives and provides reasonable assurance to the various stakeholders about risk control and the sustainability of the organization.

The business and support units are constantly improving and implementing new controls. In this way, we seek to ensure that the controls in place maintain their effectiveness and efficiency in mitigating risks, as well as ensuring the achievement of operational, compliance and information objectives.

For those risks that generate significant exposure for the organization and for which management decides to mitigate, we undertake action or remediation plans that are executed within reasonable timeframes according to their complexity and scope.

Thus, from the different risk management or control systems, during 2024, we undertook measures aimed at improving the management and treatment of risks, as well as their prevention and control. Some of these measures are presented below:

•We aligned the method for monitoring losses from operational risk events with the appetite limits defined for the entity.

•We made improvements to the methods for valuing operational risks.

•We improved the third-party risk management processes by integrating different risks to have a comprehensive view of the risks generated by third parties.

•We implemented new functionalities in GRC (Governance, Risk, and Compliance) related to the analysis and verification of the correct application of controls from the second line.

•We improved the process for analyzing reputational impacts arising from operational risk.

•We adapted the risk management application to classify events arising from climate change.

•We implemented the measurement of conduct risks and the conduct analysis associated with new channels.

•We evolved the monitoring applied to End User Computing (EUC) in order to evaluate more criteria of the EUC policy.

•We evolved the cybersecurity risk management methodology, allowing each stage of technology risk management to be decoupled.

•We redesigned the method for analyzing the effectiveness of the controls operating over technology, strengthening the role of the second line.

In addition, the Bancolombia Group, aware of the importance of the role of its employees in the adequate management of risk, implemented permanent training and awareness-raising strategies to ensure that it has people who are aware and trained on the subject.

It is important to highlight the role of Senior Management and the Board of Directors, who throughout the year actively participated in the approval, follow-up and control of the organization's risk management policies, methodologies, tools, guidelines and strategies.

Finally, the SOX and Internal Control Division coordinated activities aimed at strengthening and consolidating the ICS, for example:

•It coordinated and executed the Self-Control and Process Certification (AYC) procedure, certifying 787 processes and 139 branch controls, and managing the closure of identified improvement commitments.

•It coordinated actions for the implementation of External Notice 008, issued by the SFC, which came into effect in the first half of 2024.

•It conducted periodic monitoring of the key internal control indicators of the organization.

•It enhanced the measurement mechanism for the maturity level of the ICS as a pillar for the evolution and strengthening of the ICS.

•It coordinated the update of the Anti-Fraud Policy in the financial report.

d.    Information and communication

Bancolombia has an Information Security Management System (ISMS) based on international reference frameworks. At the same time, from the cybersecurity and information security environment, we have defined a strategy whose main objective is to safeguard the confidentiality, integrity and availability of the information of customers, employees, shareholders, other stakeholders and strategic and business information.

Since 2018, every three years, an independent and recognized entity in the market assesses the organization's cybersecurity and information security maturity level. The purpose of this practice is to measure the evolution of these practices over time. In 2024, the firm Ernst & Young was in charge of carrying out this evaluation in Bancolombia Group. The result showed an evolution in the level of cybersecurity maturity, highlighting strengths in culture and awareness in management, knowledge of human talent, integration of cybersecurity from the design and maintenance of solutions, as well as innovation and technological capabilities.

In addition, we must highlight the following 2024 actions that maintained an appropriate control environment:

•Considering the advances made by cyber attackers worldwide and using new detection and reaction technologies, the Security Operation Center (SOC) has been transformed into an Intelligence and Cyber Defense Center, with cutting-edge capabilities in threat detection and intelligence, which, together with the adjustments made to processes, allow for improved proactivity, detection and response to emerging threats.

•We carried out different technological modernization projects on the cybersecurity and information security fronts, highlighting the evolution towards a zero trust strategy in remote access, strengthening protection against malware, and ensuring the development lifecycle of channels and services offered to customers, among others.

•Recognizing that identity protection is a central pillar of cybersecurity strategy in organizations, we modernized identity management, privileged access, authentication and authorization capabilities to mitigate risks of resource loss and/or information leakage, allowing only authorized individuals to access the appropriate resources while improving the Group's employee experience and productivity.

•Without ignoring the fact that the Bancolombia Group has a large number of strategic allies that support its operations, we have worked to broaden the scope of the evaluation of the allies to know their state of maturity in cybersecurity and define improvement plans in order to mitigate the risks they represent for the Group's cybersecurity.

Likewise, the following actions and results of the Compliance Vice Presidency can be highlighted in relation to the Integral Management System for the Protection of Personal Data (SIGPDP):

Promoting data protection

•Leadership for the implementation of personal data protection programs in key businesses and subsidiaries such as Nequi, Wompi, Negocios Digitales, Fundación Bancolombia, Wenia and Renting.

•Leadership in the evolution of customer, employee and supplier information sub-domains within the Integrated Personal Data Management System.

Risk management and privacy by design

•Reinforcement of the adoption of privacy by design methodology, offering self-management tools for projects, initiatives and strategic alliances.

•Consolidation of Privacy Impact Assessments (PIAs) to mitigate risks in high impact initiatives.

Strengthening governance and regulatory compliance

•Update of the personal data processing policy, incorporating regulatory changes in open finance, digital channels and artificial intelligence.

•Report and constant updating to the National Database Registry (RNBD), aligned with the requirements of the Superintendence of Industry and Commerce (SIC).

Organizational culture and training

•Implementation of training and awareness strategies for vice presidencies, and priority areas in personal data protection.

•Strategic direction of the working groups focused on consent management and regulatory developments in Open Banking, Open Finance and Open Data.

External recognition and best practices:

•Bancolombia was recognized by the Superintendence of Industry and Commerce as the private company with the best practices in personal data protection at the national level.

For the Habeas Data Program, from the Personal Data Protection and Habeas Data Knowledge Line, we continued to strengthen the program with key actions, such as:

•The creation, approval and publication of the Financial Habeas Data Policy as the backbone of the program.

•The strategic direction with teams responsible for reporting to risk centers to optimize processes and mitigate errors.

•The integration of the program into the Combined Regulatory Compliance Assurance Model, ensuring a holistic approach.

•The coordination of action plans in response to the requirements of the Financial Consumer Ombudsman, strengthening institutional trust and compliance.

With these actions, SIGPDP continues to position itself as a strategic enabler that ensures regulatory compliance, generates value in the management of personal data and reinforces the trust of customers, partners and regulatory bodies.

Finally, the Corporate SOX and Internal Control Division developed information and communication strategies to raise awareness and reinforce the importance of internal control among all employees. In this regard, we have published six corporate communications, which helped foster a culture of control, and raise awareness about the importance of each employee's role. This was done with the understanding that compliance with regulations is everyone's responsibility and is essential to achieving strategic objectives, thus promoting the long-term sustainability of the organization.

Regarding information disclosure to the market, the Disclosure Committee is responsible for supervising the timeliness, sufficiency and clarity of the information disclosed by Bancolombia to its investors.

e.    Monitoring

Bancolombia Group has a supervision and monitoring model to ensure that all components of the Internal Control System are present, functioning effectively and adapting to changes in the operating and regulatory environment.

Internal Audit Report

Internal Audit, as a third line, strengthens the organization's ability to create, protect and maintain its value by providing independent, objective and risk-based assurance and advice. Likewise, it has the necessary resources to develop its function without limitations or conflicts.

Internal Audit generates confidence in stakeholders by evaluating the internal control system, which allows the Board of Directors, the Audit, Technology and Cybersecurity Committees, and Senior Management to exercise their supervisory role and validate its proper functioning in the Organization.

For the development of the work during 2024, the Audit took into account the legal rules and regulations in force, the internal policies defined by the Board of Directors, the Audit Committee and other internal provisions of the companies, as well as the global internal audit standards defined by The Institute of Internal Auditors (IIA) who certified the area's processes.

The Internal Audit regularly informed the Board of Directors, the Audit Committee, the Technology and Cybersecurity Committee, and Senior Management about the results of the evaluations. These bodies formulated and implemented the necessary action plans to ensure proper risk management, and their implementation was monitored.

In line with the evolution and dynamics of the business, and supporting the achievement of the entity's strategic objectives, the Audit provided its services through an integral approach in the most relevant processes:

•Risk management systems and business continuity.

•Credit cycles and deterioration of the loan portfolio risk methodologies.

•The life cycle of technological solutions, cybersecurity, infrastructure and technology continuity.

•Processes for money laundering precaution, and customer knowledge and linkage.

•On-site visit to 84 branches, 293 banking correspondents and 3 business services offices with higher risk exposure.

•Virtual coverage of 100% of the branch network three times a year through 28 automated tests.

•Daily accounting monitoring of 35 relevant accounts associated with 100% of the branches.

•Remote camera monitoring for cash management in 61 branches.

•Support for the implementation of the new Mi Bancolombia app, the new Virtual Branch for Individuals, and the transition to the new QR 3.0 format.

•Treasury operations and investment area processes.

•Follow-up on the closing of the gaps identified by the different external control entities such as the SFC and the Statutory Auditor.

•Sustainability strategy with the execution of ESG risk management work, strategic indicator of purpose-driven business, process review and approvals of sustainable lines and disclosures made in Dow Jones. In addition, among the prioritized regulatory issues, the indicators of Notice 031 of 2022 and Scope 1 and 2 emissions were reviewed.

•NEQUI, Sufi, Factoring, Leasing, Rental and Use products, as well as the different mobility and ecosystem topics.

•Financial, accounting and tax management, strategic allies, fraud management, superior customer experience and mandatory compliance issues required by control entities.

•Strategies for managing employee well-being and ways of working.

•Timely attention to the requirements received from external control bodies.

Considering the requirements established by Notice 008 of 2023 of the SFC, the aspects evaluated to guarantee the effectiveness of the Internal Control System are detailed below:

•We evaluated the effectiveness of entity-level controls related to the five components and 17 principles of the COSO 2013 framework, general technology controls, and controls associated with critical and moderate risks of the material business cycles that help mitigate fraud in financial reporting, prevent corruption, detect asset misappropriation, and prevent money laundering and the financing of terrorism.

•Regarding the control environment, we evidenced from the Board of Directors the commitment to integrity and ethical values, which is reflected in the definition of clear structures, responsible oversight, a commitment to competence, and the assignment of authority and responsibility. Additionally, we have a three-lines-of-defense model that supports the functioning of the Internal Control System with roles and responsibilities established through the Internal Control policy.

•We defined objectives in risk evaluation, along with their respective identification, analysis, and assessment of potential impacts in case any risk materializes. The evaluation conducted on the risk management system included validation of the frameworks for managing operational, credit, liquidity, market, country, business continuity, and anti-money laundering and anti-terrorism financing (AML/ATF) risks. It also covered the stages of identification, measurement, control, and monitoring, their elements, policies and methodologies used, and the integrity and accuracy of the information, identifying some opportunities for improvement addressed by management, without compromising the proper functioning of the risk management systems.

•We have control activities deployed through documented, approved, and published policies and procedures, always framed within information and communication processes, with continuous monitoring from the Board of Directors, Senior Management, and Internal Audit.

•We accompanied the implementation and measurement of the Internal Control System maturity model.

Finally, based on the consolidation of the results of the evaluations based on the five components and the 17 principles of the COSO framework, the Audit can conclude that the functioning and effectiveness of the Internal Control System is Satisfactory, it operates reasonably, and no material deficiencies were found.

Audit Committee Report

During 2024, the Audit Committee supported the Board of Directors in overseeing the effectiveness and proper functioning of the internal control system of Bancolombia S.A. and the Bancolombia Group. It promoted the accountability process of the different areas or lines of defense and provided ongoing follow-up on the five components of the integrated internal control framework (COSO): control environment, risk management, control activities, information and communication, and monitoring and oversight.

Among the activities carried out by the Committee, the following stand out:

•It verified controls in the preparation of the financial and accounting information of Bancolombia S.A. on a separate and consolidated basis, as well as in its presentation and revelation, while ensuring the fulfillment of the current provisions and the achievement of financial performance goals defined by the entity.

•It evaluated the financial information disclosed to the market in 2024, including the 20F report submitted with the 2023 fiscal year, ensuring its transparency, reliability and integrity.

•It studied the reports presented by the Statutory Auditor and the Internal Audit on the evaluation of effectiveness of the internal control system, duly following up on the management of the Administration in the implementation of the action plans and the respective closing of gaps.

•It reviewed the management of risks by the administration, through an accountability process with key executives and by holding private meetings with the President, the Internal Auditor, and the Statutory Auditor.

•It approved and monitored the execution of the Internal Audit and External Audit work plan, ensuring their autonomy, objectivity, and independence.

•It approved the Internal Audit Statute and its budget and gave a satisfactory evaluation of the work performed by Internal Audit during 2024.

•It approved the methodology used in 2024 for the definition of the criticality of the findings of the Internal Audit and Statutory Auditor.

•It presented to the Shareholders’ Meeting, through the Board of Directors, the candidate to hold the position of statutory auditor for the period 2024-2026, after analyzing the alternatives in aspects such as services offered, costs and fees, experience and knowledge of the sector.

•It followed up on compliance with ESG commitments.

•It evaluated the operation, implementation and strengthening of the programs managed by the Compliance Vice Presidency, such as the Antifraud, Anticorruption, Ethics, SARLAFT, Protection of Free Competition, Protection of Personal Data and Financial Consumer Protection programs. In particular, in the area of ethics and integrity, it supervised the evolution of the program and the ethical culture in business, the zero-tolerance fraud program, and the functioning of the Ethics Line.

•It was informed of the findings related to the availability of channels.

•It evaluated the proposals for additional fees of the Statutory Auditor that were submitted to the consideration of the Shareholders’ Meeting.

•It approved the Policy for the Generation and Submission of Reports on the Internal Control System, which outlines the guidelines regarding the periodicity and content of the reports on the effectiveness of the Internal Control System addressed to the Board of Directors and the Shareholders' Meeting.

•It approved the guidelines for the approval of additional fees for the Statutory Auditors of Bancolombia's subordinates and the Managed Funds and Businesses.

Based on the results of the works carried out by the Committee and the results of the audits by the Statutory Auditor and Internal Auditor, the Committee declares that no material deficiencies were detected that could affect the internal control system, nor the financial statements and management report.

The Committee considers that Bancolombia Group has an adequate internal control system, in compliance with the policies and regulations in force for the correct preparation, presentation and disclosure of the financial statements for the consideration of the Shareholders' Meeting. Therefore, the Committee recommends that the consolidated financial statements and notes, as of December 31, 2024, be submitted to the shareholders for approval, being duly audited and without exceptions.

The economic and social development of countries and regions depends, to a large extent, on tax revenues (taxes, fees and contributions). Therefore, for the Bancolombia Group it is essential to have transparent tax policies, committed corporate governance and sustainable tax management in each country where it operates. All of this must be aligned with the macroeconomic strategy of the governments and should have an approach that generates positive impacts both for the company and for the region.

The Bancolombia Group, as a regional actor with presence in 11 countries and operations concentrated in 4 of them, complies with its tax obligations in a responsible and timely manner. The Group recognizes that taxes must be paid in the country where it operates, thus ensuring regulatory compliance and contributing to the economic development of each region in which it operates.

The Bancolombia Group promotes fiscal sustainability as a key pillar for the development and well-being of the communities in the countries where it operates. Therefore, fair and timely compliance with tax obligations is an essential policy, allowing resources to reach central and territorial governments in an efficient manner and contribute to the strengthening of the national tax system.

The Bancolombia Group continuously analyzes and evaluates the impact of current tax regulations (laws, decrees, doctrines, jurisprudence, among others) issued by national governments in each of the geographies where it operates. This ensures strict compliance with tax regulations and the proper management of its tax obligations.

Below is a graph detailing Bancolombia Group's contribution to public finances in the four countries where its operations are concentrated for fiscal year 2024:

In 2024, the global economy showed resilience following interest rate hikes aimed at curbing inflation. However, challenges remained significant. Climate-related events, trade pressures, ongoing geopolitical tensions in Eastern Europe, and the conflict in the Middle East added uncertainty to macroeconomic indicators and financial asset prices.

In addition, major elections in key economies led to shifts in political agendas for the coming years. These factors collectively created an environment of rising inflationary risks, prompting central banks—led by the U.S. Federal Reserve (FED)—to take a more cautious approach to interest rate cuts. At the same time, political stability influenced investor confidence, the ability to implement economic recovery policies, and overall growth prospects.

To navigate these challenges, in 2024, the Corporate Risk Vice Presidency launched several initiatives and projects aligned with the Organization’s strategy. Key highlights include:

•Enhancing risk management by optimizing processes and expanding our ecosystem of technology-driven tools, as follows:

oCredit Risk: We launched the first version of the Special Risk Management Tool (HERA) in the monitoring phase, improving how we manage affected clients and risk alerts within the Special Administration process for corporate clients.
We also made progress in redesigning and standardizing monitoring processes across our regional operations to ensure best practices are adopted throughout Bancolombia Group. Additionally, we advanced in implementing Decree 1533 of 2022, which regulates the management of large exposures and risk concentration. Our priority was to structure the key components required for compliance with this regulation as it takes effect.

oNon-Financial Risk Management: We integrated process, risk, and control certification—AYC (Self-Control Certification)—into our GRC (Governance, Risk, and Compliance) platform.

This strengthens our self-regulation culture, builds trust, and promotes best practices. It also ensures compliance with internal control requirements, in line with Notice 08 of 2024 from the Financial Superintendency of Colombia (SFC) and the COSO framework. Additionally, we continued implementing key programs such as Operational Risk (OR), SOX, and AML/ATF for non-financial risk management. The integration of these programs is essential to ensuring an efficient approach to identifying and mitigating risks, improving strategic decision-making, optimizing operations, and strengthening organizational resilience.

oInterest Rate and Liquidity Risk Management: In Colombia, we have implemented the necessary processes to comply with External Notice 025 of 2022 issued by the SFC as part of our Comprehensive Risk Management System (SIAR).

At the corporate level, we made significant progress in adopting the data model required to deploy the technological solution that will help optimize the processes for forecasting and managing liquidity and interest rate risks across the Group’s entities.

Additionally, we adjusted the non-maturity deposit (NMD) models for the Group’s banks in Central America to align them with regulatory requirements and estimated the impact of interest rate fluctuations in quetzales. Likewise, we developed and approved commitment models for Bancolombia, successfully completed the transmission processes for the test formats of Economic Value of Equity (EVE) and Net Interest Margin, and defined the interest rate stress methodology for the banking book.

•The credit risk strategy continued to evolve, focusing on sustainable and profitable growth. To achieve this, we made progress across all stages of the credit cycle—origination, monitoring, and recovery—by prioritizing innovation, leveraging data and analytics, implementing forward-looking strategies, and standardizing corporate guidelines for credit risk management at the corporate level. Throughout the year, we focused on strategies and tools aimed at optimizing portfolio profitability while enhancing efficiency and speed through process digitalization and improvements in the technology supporting credit risk management.

•In 2024, we transformed our collections approach by expanding digital solutions and self-service capabilities to enhance the customer experience, improve portfolio recovery effectiveness, and achieve cost efficiencies in collections operations.

•In addressing emerging risks, we developed the first version of the ESG risk management framework, conducted a large-scale assessment of clients’ and Bancolombia’s own assets’ vulnerability to physical risks, and completed the development of the target model for transition risks, which will allow us to strengthen climate change risk management.

•Regarding capital and profitability, we advanced in quantifying unexpected losses from Active Risk associated with leasing operations within the Leasing, Rental, and Usage businesses, with a particular focus on the Habitat and Vehicle portfolios. Additionally, we reviewed the methodologies used to quantify unexpected losses related to Credit Risk, Liquidity Risk, and Interest Rate Risk in the Banking Book, ensuring alignment with the Bank’s current financial landscape. We also enhanced

monitoring processes to track capital allocation and evaluate its impact on the profitability of different Bancolombia Group portfolios, reinforcing comprehensive and effective risk management.

We also continued the “Turn Risk Around” communication campaign as part of our strategy to strengthen risk culture. This year, we focused on operational and ESG risks, using analogies to help employees understand the risk management process—recognizing, identifying, managing, and monitoring risks. Inspired by rafting, these analogies illustrate how each individual, in their role, contributes to maintaining balance, anticipating challenges, and progressing toward shared goals, emphasizing the importance of preparedness in the face of economic, political, and social uncertainties.

Additionally, we reinforced the message of responsible risk-taking and maintaining a calculated risk appetite, underscoring how strategic decision-making supports business goals. Through this campaign, we continued promoting comprehensive risk management, highlighting collaboration across the first, second, and third lines of defense, and fostering a culture where every employee understands their role in risk management and the Bank’s long-term sustainability.

Aligned with the “Movimiento B” program, we continued implementing strategies to strengthen leadership and employee soft skills, emphasizing agility and high performance as core cultural traits within the Corporate Risk Vice Presidency. We also reinforced teams’ analytical capabilities and industry knowledge. The above is aligned with the strategy's fundamental pillars, and the objectives of developing human talent with skills for today and the future.

In the Corporate Risk Vice Presidency, we have highly qualified human talent to manage, in an integral and adequate manner, the different risks to which the Organization is exposed. Following the human talent development objectives, we met the training plan defined in accordance with the knowledge maps. In 2024, the mandatory training plan for the Corporate Risk Vice Presidency achieved a 99.66% completion rate.

Additionally, the Board of Directors reviewed and approved the resources outlined in External Notice 018 of 2021, issued by the SFC, along with the governance structure related to risk management. To fulfill its supervisory responsibilities, the Board was supported by the Risk Committee, which assists in approving, monitoring, and overseeing policies, guidelines, and strategies for identifying, measuring, controlling, and mitigating risks in compliance with regulatory requirements.

Below is a summary of risk management within Bancolombia Group in 2024:

Credit risk represents the probability that the Organization may incur losses due to a counterparty, issuer, or debtor failing to meet financial obligations; a deterioration in credit ratings; reductions in earnings and returns; losses from restructuring benefits granted; and recovery costs. As the primary and most significant risk in the banking business, credit risk must be managed at every stage of the credit cycle.

In 2024, Bancolombia Group’s loan portfolio reflected a modest and gradual economic recovery, influenced by macroeconomic factors such as lower inflation and interest rates, which stimulated domestic and external demand through increased investment and consumption. However, political and fiscal uncertainty, particularly in Colombia, along with geopolitical tensions in the Middle East impacting the global economy, created a challenging economic environment.

These factors affected investor risk perception and led to declining confidence among both consumers and businesses, impacting credit demand in the countries where Bancolombia Group operates.

Continuous monitoring and review of credit portfolios remained key in identifying and implementing strategies across the credit cycle. This led to the development of new processes, methodologies, and models leveraging traditional, alternative, and sector-specific data to enable more personalized and timely portfolio management. By utilizing both local and cross-border tools across the Group’s markets, these efforts contributed to overall improvements in portfolio risk indicators while also strengthening customer support.

Some of the initiatives aimed at further improving risk management across the entire credit cycle include:

With a more conservative risk appetite in response to the challenging economic conditions in 2024, we enhanced our origination models by incorporating new variables and analytical techniques. These improvements increased predictive accuracy, enabling a more targeted approach to loan disbursement, focusing on stronger credit profiles and higher-quality borrowers. We also improved efficiency, agility, and customer coverage in the credit process by expanding the number of pre-approved customers and reducing response times. Automation played a key role in optimizing processes for both individuals and businesses.

By integrating sector-specific components into our credit risk management approach, we gained deeper insights into credit cycles, allowing us to anticipate decision-making, manage and mitigate risk in both existing and potential portfolios, model future scenarios, and optimize risk models with a sectoral perspective. To support this, we relied on sector ratings, policies, and diagnostic methodologies, ensuring our origination efforts aligned with our risk appetite.

Throughout the year, monitoring remained central to the credit cycle. We focused on making proactive decisions that could be integrated into other stages of the cycle. To achieve this, we developed behavioral models and methodologies, alerts, and early estimations of key variables, incorporating traditional, alternative, and sector-specific data sources.

We also improved our monitoring processes and models, making them more agile and effective in managing portfolios, guarantees, covenants, and advances. As a result, we developed the Special Risk Management Tool (HERA), designed to enable comprehensive credit cycle management while providing a holistic view of both the portfolio and our clients.

Our predictive analytics models, using both traditional and alternative data, helped improve customer credit ratings and expand the pool of automatically rated clients. These enhancements eliminated subjective assessments and increased agility in the process. We also identified reliable data sources that enabled more informed and effective portfolio monitoring across all stages of the credit cycle. This provided a more forward-looking perspective, allowing for early action aligned with strategic decision-making.

Additionally, our early warning models helped detect potential deviations from portfolio composition forecasts, while sector analyses allowed us to manage portfolios affected by fluctuations in economic activity and macroeconomic conditions. This approach gave us a better understanding of the risk levels associated with our clients’ business activities, helping us identify the most affected economic sectors and evaluate the most representative companies within them.

We continuously monitored and updated these models to ensure ongoing improvement, incorporating new variables to enhance predictive capabilities and further segmenting them for increasingly specialized applications.

As part of our portfolio concentration risk management, we monitored exposure levels among the most significant economic groups. This allowed us to comply with applicable regulations while strategically managing these exposures. As of December 31, 2024, the total outstanding balance of the 20 largest economic groups within Bancolombia Group, on a consolidated basis, represented 115.7% of the Group’s CET1 capital and 14.3% of the loan portfolio. No individual exposure accounted for more than 1.5% of the total portfolio.

As our recovery strategy remained a key area of focus for managing past-due portfolios, we maintained a proactive approach and early-stage collections efforts across all portfolios. Our objective was to promptly recognize changes in clients’ risk situations across all segments and industries, considering their payment history, transactional profile, and macroeconomic conditions.

We continued strengthening our collections models and expanding the number of pre-approved cases, leveraging process digitalization and implementing new strategies. These strategies focused on offering tailored payment solutions, encouraging repayment, and personalizing the collections process by considering individual client characteristics. To achieve this, we applied behavioral economics principles, particularly in Colombia. Experimentation remained a key pillar of our collections strategy, allowing us to improve the acceptance rate of payment alternatives and develop new recovery mechanisms aimed at reintegrating clients into the banking financial system.

In our loan loss provisions estimates, we continued to factor in guarantees as collateral for operations, ensuring that their physical and market characteristics were reflected in their fair value. External, independent entities with the expertise and qualifications required by regulatory authorities conducted these valuations. They incorporated market, macroeconomic, environmental, and political factors, and for impaired loans, valuations were performed at least once per year.

Bancolombia Group’s gross loan portfolio in pesos recorded a 10.0% growth as of the end of December 2024, compared to the same month of the year 2023 year. This increase was primarily driven by higher disbursements in the corporate segment’s commercial loan portfolio and, to a lesser extent, by mortgage loans in the personal banking segment. These results reflect adjustments in monetary policy, which gradually reduced inflation and interest rates in the countries where the Group operates, enabling the recovery of certain economic sectors. Additionally, the depreciation of the peso against the dollar during the period contributed to portfolio growth due to the revaluation of the Group’s foreign currency loan portfolio in pesos.

The consolidated 30 day past-due loans, rate decreased to 5.20% in December 2024, compared to 5.39% in the same period of the previous year. This decrease was primarily due to improvements in the quality of the consumer loan portfolio. Throughout 2024, we developed and implemented various strategies across the credit cycle, enabling proactive and targeted actions aligned with customers’ financial realities and market conditions. These initiatives helped mitigate portfolio deterioration and strengthen risk profiles.

Meanwhile, the balance of 90-day past-due loans increased 14.9% over the same period, leading to a 4.4% increase 90-day PDL rate, which stood at 3.85% at the end of 2024, up from 3.69% a year earlier. This increase was mainly attributed to the deterioration of clients in the construction and agroindustrial sectors, as well as mortgage loans in personal banking.

The annual cost of credit at the end of 2024 was 2.0%, lower than the 2.8% recorded the previous year. This decrease was primarily due to lower credit expenses in personal banking portfolios, particularly in Colombia, resulting from risk management initiatives launched in 2023 that had a positive impact throughout 2024.

Bancolombia closed 2024 with a gross loan portfolio balance of COP 192 trillion, representing a 4.9% growth compared to the previous year. This growth was primarily driven by the Corporate segment and an increase in disbursements from the mortgage loans in personal banking.

The 30-day past-due loans rate stood at 4.8% in December 2024, down from 5.0% in the same period of 2023. This improvement was largely due to a decline in past-due loans in the Personal Banking, Business, and Independent segments.

The overdue portfolio coverage decreased during the period, ending at 123.9% in December 2024, compared to 130.9% in December 2023. Meanwhile, total loan loss provisions amounted to COP 4.1 trillion, reflecting a 36.9% decrease year-over-year. As a result, the annual cost of credit at the end of 2024 was 2.3%, down from 3.6% in 2023. This improvement was primarily driven by strong performance in the consumer loan portfolio throughout 2024, which resulted in lower deterioration compared to the previous year, as well as lower provisioning requirements influenced by macroeconomic conditions and credit risk parameters.

Other companies (2)

At the close of 2024, Banistmo recorded a 12.6% increase in its loan portfolio balance in pesos compared to the previous year. This variation was primarily driven by exchange rate effects, as the depreciation of the peso against the dollar offset the overall decline in the portfolio in its original currency (USD). The contraction was particularly evident in the commercial loan portfolio, due to early repayments in sectors such as real estate and construction, as well as adjustments to origination policies in personal banking, mainly in the mortgage segment.

The 30-day past-due loans rate stood at 8.8% at year-end 2024, up from 8.5% in 2023, while the total past-due loan coverage ratio closed at 62.5%, compared to 60.4% the previous year. The lower coverage ratio was mainly due to the deterioration of a major real estate sector client since 2023. However, this exposure is backed by a real estate guarantee, which reduces the required loan loss provisions. Additionally, the increase in the past-due loans ratio was largely attributed to the Corporate segment, where the principal balance declined at a faster rate than past-due loans. The consumer loan portfolio performed better, supported by various credit cycle strategies implemented throughout the year.

We implemented origination strategies focused on lower-risk individual borrowers, enhanced customer profiling using both internal and external data, introduced sector-based rating and alert systems, and activated new recovery strategies and tools. These initiatives helped us take a proactive approach to portfolio management, leading to improved portfolio quality.

At Banco Agrícola, the loan portfolio in pesos grew by 21.7% at year-end 2024, primarily due to the depreciation of the peso against the dollar and an increase in the local currency portfolio across commercial and consumer loans. The positive trend in the consumer portfolio was driven by an expansion strategy targeting lower-risk individual clients, leveraging the evolution of credit rating models and broader pre-approved loan coverage.

The 30-day past-due loans rate closed at 2.1%, down from 2.5% in 2023. For business clients, this improvement was mainly due to the recovery of a key textile sector client, while in personal banking, it resulted from credit cycle strategies that enabled sustained loan disbursements while maintaining appropriate risk levels. The coverage ratio closed at 153.6% in December 2024, up from 146.6% a year earlier.

Bam reported a 24.6% increase in its loan portfolio in pesos at year-end 2024 compared to 2023. This growth was driven by the depreciation of the peso against the dollar, alongside an overall expansion in local currency portfolios, particularly in the corporate segment’s commercial loan portfolio.

The 30-day past-due loans rate stood at 3.8%, up from 3.6% at year-end 2023, mainly due to the default of a specific agribusiness sector client and deterioration in the personal banking portfolio, which was impacted by social and economic challenges faced by the

(1) The information exposed for the Group companies, other than Bancolombia S.A., includes the restatement of figures from U.S. dollars to Colombian pesos under the IFRS standard. During the period from December 2023 to December 2024, the Colombian peso devalued 15.36% against the U.S. dollar.

country during the year. The 30-day past-due loan coverage ratio ended at 124.4% in December 2024, down from 145.6% in December 2023. Despite this decline, the coverage ratio remained at a solid level, reflecting reduced provisioning requirements due to adjustments in models and updates to macroeconomic indicators.

At Bancolombia Panamá, the loan portfolio balance in pesos grew by 45.9% year-over-year, driven by a 26.6% increase in the local currency (USD) portfolio and the impact of peso depreciation against the dollar during the reporting period. This growth was mainly attributed to significant disbursements to corporate clients in the trade sector, as well as a stronger portfolio dynamic, fueled by the benefits Colombian companies find in conducting foreign currency transactions through offshore financial institutions. The 30-day past-due loans rate closed at 0.33% in 2024, compared to 0.22% in 2023, with a coverage ratio of 292.4%.

Finally, at Bancolombia Puerto Rico, the loan portfolio balance in pesos increased by 31.56% year-over-year, driven by peso depreciation against the dollar and 14.04% growth in the portfolio in its original currency (USD), primarily in the government and international segments. The 30 day past-due loans ratio stood at 0.17% in December 2024, compared to 0.15% in December 2023, with a coverage ratio of 171.1%.

This risk refers to the possibility that an entity may incur losses due to financial operations abroad, as a result of a deterioration in the economic and/or socio-political conditions of the country receiving these operations, either due to limitations on currency transfers or factors not attributable to the commercial and financial condition of the receiving country. This definition includes the sovereign risk (SR) and transfer risk (TR), among others.

At Bancolombia Group, we have guidelines, processes, and methodologies that allow us to regularly assess the country risk exposure of our capital investments—defined as those made in jurisdictions outside Colombia that hold significant economic materiality, whether individually or in aggregate, and have long-term strategic intent.

The country risk management includes the risk identification, measurement, control, and monitoring stages to which the entity is exposed. In managing this risk, we consider not only the business plan but also the nature and materiality of operations, their current and future outlook, and the characteristics of the host country. Our approach is backed by policies and strategies developed by the Risk Vice Presidency and approved by the Board of Directors.

Our capital investment appetite is determined based on country risk assessments in accordance with the SIAR. We ensure compliance with solvency and liquidity indicators, maintaining alignment with the Bank’s financial strength and stability.

Throughout the year, we enhanced our methodology for calculating and managing country risk, enabling more precise monitoring and risk calculations that are better aligned with the Bank’s risk appetite and clients’ needs.

In 2024, we did not encounter any risk alerts in our investments, nor did we make impairment adjustments that could affect the Bank’s financial strength. Notable changes during the year included the transfer of Wenia Ltd.’s investment to Bancolombia Investment Banking and the addition of two new investments: Ozone Financial Technology Ltd., invested through Sistema de Inversiones y Negocios S.A., and Banagrícola S.A., invested through Inversiones CFNS S.A.S.

The total investment balance increased by 17%, primarily due to exchange rate fluctuations and operational performance.

Market risk refers to the potential for losses arising from fluctuations in stock prices, interest rates, exchange rates and other indicators whose values are determined in a public market. It also refers to the probability of unexpected changes in net interest income and economic equity value due to shifts a change in market interest rates.

At Bancolombia Group, we identify, measure, monitor, control, and report market risks to ensure timely decision-making and effective risk mitigation, ultimately enhancing greater value for our shareholders. Our market risk management policies and strategies are approved by the Board of Directors, ensuring consistency and alignment in risk appetite across all Bancolombia Group entities.

Bancolombia Group

a.Instruments for Trading Purposes

Instruments used for trading purposes in Bancolombia Group include fixed income, variable income, foreign currency and derivative products, whose management is aimed to maintain an investment portfolio to support liquidity and meet the needs of our customers, all while ensuring a controlled risk profile.

The relevant risk factors for instruments held for trading purposes are interest rate risk, exchange rate risk and share price risk.

•Interest rate risk arises from unexpected changes in interest rates that may adversely affect the value of a financial instrument. It mainly affects debt securities and derivatives.

•Exchange rate risk refers to changes in the exchange rate of one currency against another and affects foreign currency positions. A long position in a foreign currency other than the local currency may result in losses if that currency depreciates against the local currency.

•Finally, equity price risk arises from adverse movements in market prices or expectations of future dividends that affect positions in shares, equity indices or derivatives with equity underlyings.

All these market risks can be partially or fully mitigated with derivatives such as options, futures, forwards and swaps, relative value strategies and by taking non-directional positions.

To manage and control market risks in our trading activities, we employ two Value at Risk (VaR) methodologies: (1) The standard methodology established by the SFC, and (2) An internal methodology based on weighted historical simulation. These methodologies measure the maximum probable loss that a portfolio could have over a time horizon and with a level of confidence.

Our internal weighted historical simulation methodology applies a 99% confidence level, a 10-day holding period, and a one-year window (250 daily observations) based on historical data from the VaR calculation reference date. The standard methodology established by Chapter XXXI of the Basic Accounting and Financial Notice (CBCF) of the SFC follows the model recommended by the Basel Committee on Banking Supervision’s 2005 Amendment to the Capital Accord to Incorporate Market Risk.

This methodology is used to report market risk exposure to the SFC and to measure the capital requirements of Bancolombia Group.

Additionally, we conduct extreme scenario assessments and stress testing, estimating potential losses in low-frequency but plausible events. These tests replicate historical crises or simulate hypothetical market shocks. We also measure Expected Shortfall (ES), which estimates the average potential loss exceeding the VaR threshold. Unlike VaR, Expected Shortfall captures tail risk, reflecting the possibility of large but infrequent losses. Furthermore, we perform model validation through backtesting, comparing predicted losses against actual outcomes. When necessary, we adjust our VaR models based on backtesting results.

To ensure effective market risk management and control, Bancolombia Group maintains a hierarchical VaR limit structure, which prevents risk concentration in specific asset classes and maximizes portfolio diversification benefits. These limits are set at the company, product, or risk-responsibility level. Loss alerts, stop losses and sensitivity limits are also managed, especially in derivative portfolios. The limits are approved by the Board of Directors, taking into account the size of the assets, the complexity and volatility of the markets, as well as the group’s appetite. These are monitored daily, and their excesses or non-compliance are reported to the Board of Directors and the Risk Committee.

In 2024, market risk exposure measured under the SFC standard methodology ranged between COP 1.18 trillion and COP 1.73 trillion, with an average exposure of COP 1.44 trillion. The total year-end exposure increased, driven primarily by higher foreign exchange exposure, particularly to the U.S. dollar; increased interest rate exposure, due to greater investments in Colombian government debt securities, and growth in equity-related factors, including collective investment portfolios, mainly driven by valuations in Fondo Inmobiliario Colombia.

The overall market risk variation, along with changes in individual risk factors under the SFC standard methodology, is detailed below:

b.Instruments for Purposes Other Than Trading

At Bancolombia Group, we maintain non-trading instruments such as loans, term deposits, checking accounts, and savings accounts, which are recorded in the Banking Book. The market risk management of the Banking Book is focused on increasing the economic value of equity, contributing to the generation of recurring profits with a controlled risk profile.

The relevant risk factor of the Banking Book positions is interest rate risk, understood as the potential for of unexpected changes in net interest income due to fluctuations in market interest rates. Changes in interest rates affect the Bank's income due to differences in the repricing of assets and liabilities.

Another risk factor affecting Banking Book positions is equity price risk, which arises from investments held by Investment Banking as a Financial Corporation, either directly or through its affiliated companies, in strategic capital investments. Exchange rate exposures that arise in the Banking Book are transferred to the Treasury Book.

To manage and control market risks outside of trading activities, we employ a comprehensive approach that includes a short-term perspective, measuring the sensitivity of net interest margin over a one-year horizon, and a long-term perspective, estimating the impact on the economic value of equity (EVE) under various scenarios. Additionally, we define alert levels to monitor and control interest rate risk in the Banking Book, which are periodically reported to Senior Management.

Market risk management of positions in the Banking Book is carried out in a decentralized and independent manner in each of the Bancolombia Group’s banking entities. This management is carried out by the Asset and Liability Management areas, of the Financial Vice-Presidency, through derivative instruments such as exchange rate and interest rate swaps, mainly.

In general, Bancolombia Group has a positive sensitivity to increases in interest rates for the total financial margin. In relation to the sensitivity of the economic value (Market Value of Equity, MVE), the general positioning of the balance sheet was such that the average duration of assets was slightly lower than that of liabilities.

In 2024, we observed a COP 209.785 billion decrease in net interest margin sensitivity, primarily due to the higher sensitivity of deposit accounts. Meanwhile, foreign currency sensitivity increased by USD 7.084 billion, driven by growth in time deposits and deposit accounts.

Below is a comparison of interest rate risk sensitivity in local currency (pesos) for Bancolombia Group, between December 31, 2024, and December 31, 2023:

Likewise, the sensitivity to interest rate risk in foreign currency (dollars) for Bancolombia Group as of December 31, 2024 and December 31, 2023 is shown:

A positive net sensitivity indicates that assets are more sensitive than liabilities, meaning that an increase in interest rates will positively impact Bancolombia Group’s net interest margin. A negative sensitivity denotes a greater sensitivity of liabilities than assets and implies that an increase in interest rates will negatively affect the net interest margin. In case of a decrease in interest rates, the behavior of the net interest margin would be the opposite of that described above.

To calculate the sensitivity of the net interest margin based on the term at repricing, the following assumptions were taken into account: (a) only the contractual conditions of the current transactions were considered, (b) the sensitivity of the balance sheet at a fixed rate was based on amounts that mature in a period of less than one year under the assumption that these will be placed again at market rates; and (c) changes in the interest rate were presented immediately and in parallel in the asset and liability yield curves.

The price risk sensitivity of the structural shares is presented below:

The market value of these positions recorded a negative variation of 11.9%, decreasing from COP 41.096 billion at year-end 2023 to COP 36.226 billion at year-end 2024. This decline was primarily driven by the devaluation of ENKA’s shares.

Considering a 14.70% negative impact on the value of structural equity investments as of December 2024, we recorded a devaluation of COP 5.325 billion.

The management of market risk and interest rate risk for Bancolombia’s banking book follows the same approach detailed earlier, which is applied to Bancolombia Group.

The results of this risk metric for the Bank are described below:

During 2024, fundraising was concentrated on stable funding. In this way, the maturity mismatch between assets and liabilities did not present significant variations compared to the previous year.

As of December 2024, 60.77% of the Bank’s assets were indexed to variable interest rates, while 39.23% were indexed to fixed rates. In contrast, liabilities had a concentration of 86.88% in fixed rates and 13.12% in variable rates. The balance sheet was characterized by a significant increase in fixed-rate and IBR-indexed positions, in line with the Bank’s asset and liability management strategy, considering loan portfolio growth and interest rate trends in the market.

The fair value of each of Bancolombia's balance sheet positions is presented below:

a.Instruments for Trading Purposes

The instruments for trading purposes at Bancolombia include fixed income, variable income, foreign currency and derivative products, whose management is aimed at maintaining an investment portfolio to support liquidity and meet the needs of our clients, maintaining a profile of controlled risks.

For the management and control of market risks in Bancolombia, the same methodologies set out above for Bancolombia Group are considered and a hierarchical structure of own limits with which the Bank’s exposure is managed.

In 2024, market risk exposure measured under the SFC standard methodology ranged between COP 1.04 trillion and COP 1.50 trillion, with an average exposure of COP 1.24 trillion. The total exposure increased primarily due to higher exposure to exchange rate and interest rate risk factors. The increase in exchange rate risk was mainly driven by greater exposure to the U.S. dollar, while interest rate risk was influenced by an increase in holdings of Colombian government and private debt securities.

The increase in the collective investment portfolios factor resulted from the appreciation of investments.

The total variation in market risk, as well as that of its risk factors under the SFC’s standard methodology is shown below:

Between December 31, 2023, and December 31, 2024, the average total VaR was COP 1.24 trillion, with a maximum value of COP 1.50 trillion and a minimum value of COP 1.04 trillion.

b.Instruments for Purposes Other Than Trading

To manage and control market risks, Bancolombia adheres to the Interest Rate Risk of the Banking Book (IRRBB) guidelines set forth in Chapter XXXI of the SFC’s Basic Accounting and Financial Notice (CBCF in Spanish), Annex 15, Standard Methodology for Determining Interest Rate Risk of the Banking Book (IRRBB). These guidelines apply to assets, liabilities, and off-balance-sheet positions designated by the SFC and became effective on December 1, 2024.

The ΔNIM metric measures the impact of interest rate risk on the Bank’s financial income and expenses over a one-year horizon. This approach allows us to assess the effect of interest rate changes on projected interest income and expenses, providing insight into the immediate impact on the Bank’s profitability.

To evaluate changes in NIM, we apply two specific shock scenarios: an upward parallel shock and a downward parallel shock. These shocks involve uniform shifts in the interest rate curve, either up or down, to analyze how these variations affect the net interest margin over the one-year period.

Table 1. NIM Sensitivity

As of December 2024, the Delta NIM was COP 1.1 trillion under a parallel downward scenario, considering the positive mismatch of repricing and capital maturities under one year.

•The analysis assumes a constant balance sheet, meaning that cash flows maturing or being repriced are replaced by new cash flows under the current conditions of each product.

•The projection includes behavioral options such as prepayments of fixed-rate loans, deposit account maturities, and implicit or explicit options related to fixed-rate commitments and variable-rate prepayments in the wholesale loan portfolio segment.

The ΔEVE metric assesses changes in the net present value of cash flows from assets, liabilities, and off-balance-sheet items until their maturity under stress scenarios. The goal is to capture how interest rate variations impact the Bank’s economic value of equity.

This calculation incorporates interest rate shocks applied to the risk-free zero-coupon yield curve for each currency. We consider six scenarios to evaluate the impact of interest rate fluctuations under various market conditions on the present value of banking book cash flows, ultimately determining the Bank’s economic value.

The scenarios include:

1.Upward parallel shock.

2.Downward parallel shock.

3.Steepening shock (short-term rates decrease, long-term rates increase).

4.Flattening shock (short-term rates increase, long-term rates decrease).

5.Short-term upward shock.

6.Short-term downward shock.

Table 2. Economic Value of Equity Sensitivity (ΔEVE)

As of December 2024, Bancolombia’s Delta EVE was COP 1.9 trillion under a parallel upward market rate scenario.

The Delta EVE represents 6% of the sum of Common Equity Tier 1 capital and Additional Tier 1 capital. This remains within the outlier threshold established in Chapter XXXI of the SFC’s Basic Accounting and Financial Notice (CBCF), Annex 15, which sets the limit at 15% of Common Equity Tier 1 plus Additional Tier 1 capital.

•The analysis is conducted under a liquidation balance assumption, meaning that existing positions are amortized and not replaced by new business.

•The cash flow projections include behavioral options, such as prepayments of fixed-rate loans, the maturity of deposit accounts, and implicit or explicit options related to fixed-rate commitments and variable-rate prepayments in the wholesale loan portfolio segment.

Liquidity risk refers to the inability to fully and promptly meet payment obligations on their due dates due to insufficient liquid resources or the need to assume excessive funding costs. Situations such as a downgrade in the credit ratings of the Bank and its subsidiaries could increase funding costs and make it more difficult to attract deposits or refinance maturing debt.

For Bancolombia Group, liquidity prevails over any growth and profitability objective. Liquidity and capital management are fundamental pillars of our business strategy, ensuring the strength of our balance sheet. Bancolombia Group’s liquidity management model encourages the autonomy of subsidiaries, which must be self-sufficient in their financing structure. Each subsidiary is responsible for meeting its current and future liquidity needs within a corporate-level coordination framework. The metrics used to control liquidity risk are developed around common and homogeneous concepts, though the analysis and adaptation are carried out by each subsidiary.

Our liquidity risk management measures include maintaining an investment portfolio designed to serve as a liquidity reserve and defining early warning indicators and liquidity limits that allow us to proactively assess the Group’s exposure level.

We use liquidity gaps and stress scenarios as methodologies to control liquidity risk. Liquidity gaps measure cash flow mismatches of assets, liabilities and off-balance sheet positions, separately for legal and foreign currencies. We apply regulatory models, incorporating contractual maturities, as well as internal models, where cash flows are adjusted through the implementation of different indicators, in order to reflect a more realistic behavior of cash flows.

We also measure structural liquidity by monitoring the available stable funding and its coverage against required stable funding, using regulatory models and Basel Committee standards on the Net Stable Funding Ratio (NSFR). We adjust these models based on the stability characteristics of our deposits.

We periodically validate policies, limits, processes, methodologies, and tools used to assess liquidity risk exposure, ensuring their relevance and functionality, and making necessary adjustments. Our market and liquidity risk teams produce daily, weekly, and monthly reports for senior management, allowing us to track liquidity risk exposure levels, limits, and alerts, and support the decision-making process.

In 2024, Bancolombia Group maintained a strong liquidity position, with a 30-day liquidity coverage ratio of 176.99% in local currency and 507.43% in foreign currency at year-end. As of December 31, 2024, Bancolombia Group’s liquid assets totaled COP 31.9 trillion in local currency and USD 6.287 billion in foreign currency.

To estimate liquidity risk, we calculate a liquidity coverage ratio to ensure that liquid assets are sufficient to cover potential net cash outflows over a 30-day period. This indicator allows Bancolombia Group to meet its liquidity coverage for the next month. The results of Bancolombia Group’s liquidity coverage ratio are as follows:

*The minimum level of the liquidity ratio required by law is 100%.

30-day Liquidity Requirement: 30-day contractual maturities of assets (portfolio, liquidity transactions, non-liquid investments, derivatives) minus contractual maturities of liabilities (term deposits, liability liquidity transactions, bonds, liability portfolio, derivatives) minus non-contractual maturities of deposit accounts.

Liquid Assets: liquid assets are considered to be those that are easily realized and form part of the entity's portfolio or those that have been received as collateral in asset transactions in the money market, that have not been subsequently used in liability transactions in the money market and do not have any mobility restrictions. The following are considered liquid assets: cash, shares in open collective investment funds with no permanence agreement, shares registered in a stock exchange in Colombia that are eligible for repo or repurchase agreements, and marketable and available-for-sale investments in fixed-income securities.

Liquidity risk management continued to be carried out through an internal liquidity gap projection model for both real and stressed situations. Regulatory indicators, such as the Liquidity Risk Indicator (IRL), the Individual and Consolidated Short-Term Exposure Indicator (IECPI-IECPC), and the Net Stable Funding Ratio (NSFR - CFEN in Spanish regulations), showed results that confirmed comfortable liquidity levels, ensuring compliance with both internal and regulatory limits.

We conducted liquidity simulations under different scenarios to maintain adequate liquidity levels in line with loan portfolio growth dynamics and to ensure 100% compliance with the NSFR requirement. Liquidity levels remained stable, maintaining an optimal level of high-quality liquid assets.

To estimate short-term liquidity risk, we calculate the Liquidity Coverage Ratio (LCR), which measures the relationship between liquid assets and net liquidity requirements over a 30-day period. This indicator shows the liquidity coverage for the next month.

The net liquidity requirement is calculated based on the flow of contractual maturities of assets and the flow of contractual and non-contractual maturities of liabilities, as defined in current regulations.

The liquidity coverage result for the Bank is presented below:

At the end of December 2024, the liquidity coverage ratio stood at 187.80%, reflecting a 93.3% reduction compared to the previous year. This decline was driven by an increase in liquidity requirements, resulting from a decrease in active liquidity operations, a reduction in 30-day loan portfolio projections, and lower derivative operations.

The following table details the Bank’s liquid assets:

(1)The high liquidity characteristic is possessed by the available, in all cases, and those liquid assets received by the Colombian Central Bank for its monetary expansion and contraction operations. Liquid assets are adjusted for market liquidity and foreign exchange risk.

High-Quality Securities are considered as available and shares that are eligible for repo or repo transactions, for those entities that are in the group of OMOs Placement Agents (OPA), those securities received by the Colombian Central Bank for its monetary expansion and contraction operations described in paragraph 3.1.1 of the External Regulatory Notice DODM-142 of the Colombian Central Bank or otherwise (if it is not an OPA) only those securities that are mandatory listed in the market maker program.

Other Liquid Assets: liquid assets that do not meet the quality characteristic are included in this item.

The Net Stable Funding Ratio (NSFR) is designed to limit excessive reliance on unstable funding sources for strategic assets, which are often illiquid. It also ensures that entities maintain a stable funding profile in relation to their assets. The NSFR is the ratio of required stable funding to available stable funding.

Below are the NSFR results as of year-end 2024 and 2023:

The indicator has remained above the appropriate levels, complying with the established limits. Over the course of the year, the NSFR increased by 88 basis points, driven by the growth in Available Stable Funding due to an increase in technical equity and deposit accounts in both the Retail and Wholesale segments. This was partially offset by the rise in RSF, attributed to the active loan portfolio disbursements.

Our primary goal in managing operational risk at Bancolombia Group is to understand and capitalize on opportunities to generate benefits while reducing losses by identifying and mitigating threats. This management approach follows the key stages of risk administration—identification, measurement, control, and monitoring. We continuously identify and update the risks to which our operations are exposed. Additionally, we aim to enhance risk management by expanding its scope and timeliness through collaborative efforts across different areas and the development of our human talent.

Bancolombia closed 2024 with operational losses totaling COP 320.711 billion, reflecting a 17% increase in net accumulated economic losses compared to the previous year (COP 273.341 billion). This increase was mainly due to a rise in external fraud incidents, particularly cases of customer impersonation in payment methods and digital channels, which accounted for 82% of total fraud-related losses. Losses were also attributed to technological failures, which resulted in erroneous account balances in favor of customers that could not be recovered.

Our exposure to cybersecurity risks remained at appropriate levels, thanks to the controls, monitoring, and mitigation measures we implemented to address evolving threats. Additionally, we continued to monitor employee health and well-being, ensuring that all processes and products operated normally throughout the year.

As of year-end 2024, Bancolombia Group’s total operational risk profile was categorized by risk severity as follows:

•Tolerable assessment (low risks): 84%.

•Moderate rating (medium risks): 10%.

•Critical rating (high risks): 4%.

•Very critical rating (very high risks): 2%.

The last category represents risks that exceed individual risk appetite thresholds set for each entity within Bancolombia Group. At the corporate level, we conduct ongoing updates to risk assessments in response to business dynamics and process changes, which naturally lead to year-over-year variations in risk levels.

Residual risk exposure—meaning the exposure remaining after considering the mitigating effects of controls—was distributed as follows:

•Process failure risks: 41%.

•Internal and external fraud categories: 50%.

•Technological failures: 4%.

•Other categories: 5%.

Operational risk losses (materialization) increased by 13% compared to 2023, mainly due to the rise in external fraud incidents affecting digital channels and credit cards. Fraud-related events accounted for 76% of the losses, while 22% were due to process failures.

1.We maintained risk profile coverage above 98%, ensuring that changes in Bancolombia Group’s processes, products, channels, and services were evaluated and managed in a timely manner, enhancing the Organization’s ability to achieve its operational objectives.

2.We developed tools and solutions using artificial intelligence and analytics to advance the automation of processes required for SIAR compliance.

3.We progressed on the plan agreed upon with the Statutory Auditor and the Board of Directors regarding suppliers, conducting 66 risk assessments and bringing the total number of suppliers analyzed since 2022 to over 340. As a result, we improved the control environment for handling sensitive data and strengthened process controls, access management, and vulnerability management.

4.We achieved efficiencies in controls and processes that enhanced the customer experience, as evidenced by a reduction of 205,482 hours in waiting time.

5.We implemented key initiatives and action plans, addressing the main identified risks, which allowed us to reduce exposure by COP 93.585 billion and contain financial losses.

6.We participated in 100% of the key business transformation initiatives, conducting risk assessments and providing guidance on defining controls and action plans.

Cyber Risk Management

In 2024, we strengthened our technological and cyber risk management efforts to promote information security and support Bancolombia Group’s strategy.

We advanced in identifying, measuring, controlling, and monitoring this risk across technological components, processes, and suppliers. Additionally, we improved vulnerability management in both pre-production and production environments, implemented baseline security standards, and supported the business in cloud migration initiatives, the adoption of a secure development lifecycle, and the creation of inventories. We also conducted ongoing monitoring and assessments of risk management maturity and risk indicators.

At Bancolombia Group, we evaluated approximately 260 technological components and around 160 suppliers, focusing on cybersecurity and technology. Furthermore, through the implementation of various action plans, we significantly mitigated technological and cyber risk.

Below are the key achievements of 2024:

•We assessed ransomware attack risks and defined the implementation plan for the digital vault.

•We established role-based access and thresholds, enabling self-management of pre-production vulnerabilities, which resulted in a 98% reduction in risk assessment requests.

•We structured a target model to increase automation and coverage in risk assessments, expanding from 68% of applications evaluated to 100% of the official inventory.

•We strengthened the challenge and oversight functions of the risk team.

•We calibrated the technological and cyber risk profile in line with Bancolombia Group’s business dynamics.

Business Continuity Management

In 2024, we focused on enhancing operational resilience across Bancolombia Group. Below are the most significant achievements:

•Crisis Simulations: We conducted simulations to train the Crisis Management Team and validate response protocols. One of the key exercises was a high-impact reputational event simulation, which involved the participation of Vice Presidents from the Organization.

•Specialized Training: We developed a comprehensive training plan for both the Primary and Alternate Crisis Management Teams, as well as process owners. This included five self-study programs, six expert-led discussions, and a session with Ernst & Young on crisis management during a cyberattack.

•Continuity Exercises: We conducted various continuity exercises in line with the established schedule, covering all key areas: processes, suppliers, technology, infrastructure, and personnel. Additionally, we defined a maturity model to assess the effectiveness of our tests against potential disruption scenarios.

•New Contingency Measures: We implemented new contingency plans to ensure an effective response to interruptions.

•Crisis Information Management: We established a system to provide accurate and timely information to the Crisis Management Team regarding the real-time status of channels and services, allowing for proper customer guidance during crisis events.

As mentioned throughout this report, 2024 was a year of global economic adaptation following the rise in interest rates as a mechanism to control inflation. This adaptation process has been challenged by factors such as climate change, trade pressures, supply chain disruptions due to geopolitical tensions in Europe, and political shifts driven by electoral processes.

In this context, at Bancolombia Group, we continue working to adjust our policies and processes to effectively manage the most relevant risks. To achieve this, we rely on risk maps as a tool that enables the Organization to identify its most significant exposures and define action plans aimed at mitigating them. Additionally, risk maps allow us to detect key short-term risk sources early, providing a holistic perspective that integrates the local and international context, business development, and the Organization’s future objectives. This information is incorporated into strategic planning, capacity allocation, and the ongoing monitoring of the Group’s risk performance.

At the Corporate Vice Presidency of Risks, we update risk maps annually, and they are approved by Senior Management. The Risk Committee also conducts periodic monitoring of the risks identified in these maps. In 2024, the Corporate Vice Presidency of Risks implemented a new methodology for the construction of the risk map based on the MICMAC structural analysis. This methodology describes a system through a matrix that relates both financial and non-financial risks (including emerging risks), determining the level of influence and indirect dependence of each of them on the behavior of others.

The relationship between the horizontal axis (dependence) and the vertical axis (influence) in the matrix results in four quadrants, categorizing risks as follows: (i) Motor risks: These are the most relevant risks with high influence over others, but they are beyond the Organization’s control as they originate externally. (ii) Linking risks: These risks have both high influence and high dependence on others.

The Organization must define short- and medium-term strategies to control their impact. (iii) Resulting risks: These risks have high dependence on others but low influence. (iv) Autonomous risks: These risks have both low dependence and low influence on other risks. This classification helps prioritize the management of risks that have the greatest systemic impact.

The risk map process begins with an analysis of trends and megatrends over the medium term (three years), allowing us to identify and map the risk factors to which the Organization is exposed, ensuring their timely and effective management. This is followed by a collective reflection exercise with Senior Management, where we define the levels of direct influence each risk has on others. The MICMAC methodology is then applied to assess the influence and dependence levels within the risk system. Based on the results, we identify the risks with the highest influence to prioritize actions for their efficient management.

Below is Bancolombia’s 2024 risk map, which was updated to expand from 12 risks to 16. Additionally, we outline the key changes observed throughout the year.

Regulatory and Legal Risk

Regulatory and legal risk refers to the potential for economic losses due to changes in the legal and tax frameworks of the countries where Bancolombia Group operates, as well as new regulatory requirements that may impact the execution of the Organization’s strategy and business operations. We continuously analyze the opportunities and impacts these changes may have on Bancolombia Group.

At the legislative level, 2024 was marked by the approval of a pension reform, which, while creating business opportunities for the management of mandatory and voluntary pension funds, also poses risks to the capital markets, funding sources, long-term fiscal stability, and overall economic performance.

Throughout the year, significant regulatory changes were approved, including: (i) second-level regulations on large exposure management and counterparty risk concentration; (ii) new criteria for assessing related parties in credit institutions, along with mechanisms for identifying and managing transactions with these entities, replacing the previous system of individual credit limits, and (iii) regulations governing the management of public sector entities’ excess liquidity. Additionally, several regulatory proposals set to take effect in 2025 were introduced, which will impact the provision of financial services, particularly in the following areas: (i) the low-value instant payments ecosystem, including the Immediate Payment System of the Colombian Central Bank (Bre-B); (ii) the further expansion of Open Finance regulations in the country, and (iii) the revision of stress testing frameworks, alongside the implementation of Basel II Pillar II through Capital and Liquidity Adequacy Programs (PAC-PAL).

For 2025, challenges are expected in securing approval for the Government’s proposed labor market and healthcare system reforms.

In 2024, legislative activity in Panama was minimal due to the change in government during the first half of the year. The projects introduced in the first semester were discarded, while those presented in the second half were overshadowed by the debate over two major legislative initiatives: a reform of the Social Security Fund, which includes a revision of the pension system, and a proposal to reduce the 2025 public budget, which was ultimately approved. Financial sector regulators did not issue any significant agreements or regulations during the year.

In Guatemala, the Congress played a key role in approving new regulations and proposing legislative initiatives, though political dynamics required careful negotiations. Key legislative developments in 2024 included the reactivation of the General Law for Consumer Defense and Protection and the Cybersecurity Law, which establishes a framework for managing cyber incidents and creates an Interinstitutional Security Center to improve coordination among government entities in combating cybercrime.

In the financial sector, several key regulations were enacted, including the Credit Card Law, published in March 2024, regulating card-related services to enhance transparency and consumer protection; the Credit Card Regulation and Resolution JM-91-2024, which introduced security measures to prevent fraud in digital transaction, and the Competition Law, approved in December 2024, aimed at regulating competitive practices in Guatemalan markets to ensure a fair and transparent business environment. These reforms reflect Guatemala’s commitment to modernizing its regulatory framework.

At the international level, Guatemala continued strengthening bilateral relations and seeking support for strategic initiatives, including judicial reform and development project management. These diplomatic efforts are aimed at positioning the country as a key regional player, promoting stability, and attracting international cooperation.

Finally, in El Salvador, the legislative body maintained a strong majority (90%) under the Nuevas Ideas party, which is aligned with the current government (executive branch). This has facilitated the approval of key laws supporting the implementation of various executive branch policies.

A strong emphasis was placed on data protection, with the approval of the Personal Data Protection Law and the Cybersecurity and Information Security Law.

In the financial sector, efforts were directed toward stricter regulatory oversight, with legislative proposals covering Cooperative Banks Law; the Savings and Loan Societies Law; the Cooperative Federations of Savings and Credit Law, and the Financial System Stability and Deposit Guarantee Law, which aim to supervise previously unregulated financial entities and expand financial system guarantees in case of a financial institution crisis. This last initiative introduces a deposit guarantee mechanism managed by the Institute for Deposit Guarantee (IGD), which protects deposits up to USD 11,951 per depositor, regardless of the number of accounts held at the same institution.

Economic and Sectoral Environment

On the macroeconomic front, one of the main risks was linked to high uncertainty, driven by both external and local factors, which increased volatility in financial assets. The end of 2024 was marked by global investor risk aversion, as a combination of factors led to higher interest rates due to global inflation risks and the ongoing instability of the conflicts in Russia-Ukraine and the Middle East. On the local front, fiscal uncertainty added to the challenges, stemming from weak tax revenue performance and high public spending, which placed pressure on the fiscal balance.

While 2024 was a year in which the global economy demonstrated clear and strong signs of resilience, inflation has taken longer than expected to converge toward monetary policy targets. This led several central banks, including the U.S. Federal Reserve, to adopt less accommodative stances, ultimately slowing the pace of interest rate cuts.

In particular, climate shocks in the first part of the year and difficulties in international trade fueled supply-side inflationary pressures, which coincided with stronger household consumption, which contributed to inflation’s resistance to a faster decline.

Against this backdrop, the global economy began to show differences in the pace of monetary policy easing. Amid these divergences, capital flows have concentrated in countries with higher growth and greater fiscal certainty, strengthening the appeal of assets in advanced economies and certain emerging markets with strong institutional frameworks.

In the countries where Bancolombia has a significant presence, events in the last quarter of 2024 could potentially translate into the materialization of adverse risks in the near future.

Colombia’s public finances deteriorated due to the National Government’s overly optimistic expectations regarding tax revenues and ambitious spending plans. This pushed the fiscal deficit to the limits permitted under the fiscal rule, jeopardizing fiscal consolidation and increasing the likelihood of additional budget cuts or under-execution of primary spending. In 2024, a sharp decline in tax revenue coincided with a significant increase in public spending, narrowing the Government’s fiscal maneuvering space by year-end.

For 2025, following the issuance of the budget decree for COP 523 trillion, a reduction of COP 12 trillion is expected due to a financing gap following Congress’s failure to approve the Financing Law. However, even with this adjustment, a budget of COP 511 trillion remains high relative to this year’s projected tax revenues. The 2025 revenue estimates assume notably optimistic gains from the tax authority (DIAN) in terms of management and efficiency. If these assumptions do not materialize, further budget cuts and under-execution will be necessary. Additionally, fiscal risks and the resulting deterioration in the risk premium could also lead to a slower pace of repo rate cuts by the Colombian Central Bank. Further fiscal deterioration poses additional risks of currency depreciation, thereby reducing the scope for monetary easing.

Guatemala’s recent economic performance has been moderately better than expected, supported by strong U.S. production and remittances. The economy advanced amid a gradual stabilization of its macroeconomic dynamics, with no significant impacts from the El Niño phenomenon during the first half of 2024. Sound fiscal management and steady remittance inflows shielded the country from capital flow disruptions, while the Central Bank continued to ensure exchange rate stability.

Public finances remained the most pressing issue in El Salvador. Despite some debt prepayment actions by the Government and a preliminary agreement with the International Monetary Fund (IMF), which provided some fiscal relief and reduced sovereign default risks, rising public spending widened the fiscal deficit compared to 2023. As a result, the country continued to rely on funding from multilateral institutions, with only modest—though improving—access to capital markets. Meanwhile, economic activity weakened slightly due to a slowdown in migrant inflows, possibly linked to reduced incentives for Salvadorans emigrating as domestic security conditions improved.

Panama faced significant economic challenges due to the closure of the Cobre Panamá mine, which led to a substantial decline in goods exports and affected the mining sector’s production. Additionally, in the first half of 2024, restrictions on vessel transit through the Panama Canal persisted due to low water levels caused by El Niño. However, proper tariff management and the normalization of climatic conditions helped mitigate the financial impact on the Government, while canal traffic returned to usual levels by year-end. Fiscal challenges remain a key concern, as Government revenues were affected by these factors, while spending needs remained high. As a result, the fiscal deficit increased considerably, raising the risk of losing investment-grade status, as indicated by preliminary assessments from S&P and Moody’s in 2024.

Considering the various macroeconomic scenarios incorporated into our provisioning models, we remain committed to actively managing credit risk. We continuously analyze and monitor sectoral developments to identify clients who may be affected by these conditions. Through regular discussions across different forums, we assess the evolving financial situation of our clients and provide tailored solutions to support them in navigating these challenges while sustaining their business growth.

Political Risk

Political risk refers to the possibility of economic losses due to unfavorable political conditions, which may be influenced by social unrest, polarization, and distrust in governments, as well as the implementation of policies that particularly impact financial institutions and their business models.

After nearly two and a half years of government, the current administration continues to face challenges in coordinating and articulating the functioning of the Executive Branch. In particular, during 2024, the National Government encountered significant fiscal and budgetary challenges, as failure to meet revenue targets led to a COP 28.4 trillion budget cut. This resulted in a reduction in funding for various subsidy programs, most notably those supporting mortgage interest rates through the “Mi Casa Ya” program, potentially affecting the mortgage loan portfolio.

In Panama, the administration that took office on July 1, 2024, faces clear governance weaknesses, particularly in the Assembly. Despite the political capital of the governing party’s leader, the executive branch has struggled to secure sufficient support for key issues such as the 2025 budget and the Fiscal Responsibility Law.

In this context, future government reforms—including the reopening of the mining project, the reform of the Social Security Fund (which includes changes to the pension system), and a potential tax reform—face major obstacles. Additionally, it is expected that any reforms approved by the Assembly will differ significantly from the original proposals, complicating the government’s efforts to maintain the country’s investment-grade rating.

In Guatemala’s 2024 political landscape, the government has faced significant challenges in maintaining governance amid a complex political environment. Confrontation with the Public Prosecutor’s Office and a fragile relationship with Congress have defined the year, requiring negotiations and strategic alliances to approve the 2025 budget, though at times leading to tensions and gridlock. The Constitutional Court has played a key role in limiting the executive branch’s initiatives, while the Government has sought to maintain support from key stakeholders such as the Superintendency of Tax Administration and the U.S. Embassy. In a context of increasing social polarization and rising insecurity, the Government’s main challenges include navigating opposition from the Public Prosecutor’s Office, executing the budget, and addressing violence while preserving political stability in a polarized environment. Toward the end of 2024, the Government focused on consolidating institutional progress, fostering more inclusive political dialogue, and maintaining an emphasis on tangible results to strengthen public confidence and the country’s political stability. The Executive Branch’s ability to build consensus and overcome accumulated tensions will be crucial to entering the next year with a more optimistic outlook.

Finally, in El Salvador, in 2024, the President was sworn in for a new term set to conclude in 2029. The Government’s top priorities for this five-year period include economic reactivation and the continuation of public security measures. The state of emergency suspending constitutional guarantees, in effect since March 2022, has been extended 33 times and is expected to continue being extended beyond its current expiration in January 2025.

El Salvador has continued prioritizing infrastructure development with new projects such as the Pacific International Airport, currently under construction in the eastern region of the country, aiming to boost tourism in the area. Additionally, a 50-year license has been granted for the provision of port services at the ports of Acajutla and La Unión, starting in December 2024.

Environmental and Social Risk

At Bancolombia Group, we are committed to managing ESG risks and addressing climate change. We have strengthened our approach to environmental, social, and governance (ESG) risk management across our operations and activities. As part of this strategy, we have implemented the Corporate ESG Risk Circular3, which establishes guidelines and criteria for identifying, assessing, and comprehensively managing these risks, structured into three main areas:

•Environmental and Social Risk Analysis (ESRA).

•Management of controversial issues in business.

•Industries vulnerable to climate change.

3For more details on the notice, see the following link:

Politica_industrias_criticas_Nov_2022.pdf

In 2024, we updated this policy to reflect our commitment to advancing ESG standards in alignment with Bancolombia Group’s strategy. Additionally, we developed specific frameworks for managing environmental (including climate-related), social, and governance risks, supported by a governance structure that positions sustainability as a strategic pillar. These frameworks aim to integrate risk management across all dimensions of Bancolombia Group.

Within the climate context, we prioritize addressing economic sectors with high greenhouse gas emissions by supporting clients in their transition to renewable energy and the adoption of sustainable practices.

In our commercial portfolio, we have consolidated a methodology for measuring physical risks, enhancing its coverage and automation. This model incorporates new climate threats and extends its scope to a broader range of economic activities, with continuous updates based on data availability. At the same time, we are advancing the development of an objective transition risk model, designed to assess risk levels by sector, with a focus on those most vulnerable to energy transition. For more details on climate risk management, refer to the Task Force on Climate-Related Financial Disclosures (TCFD) section of this report.

At Bancolombia Group, we actively monitor climate vulnerabilities across our facilities and implement strategies to ensure business continuity across all our processes, products, and channels. This comprehensive approach includes preventive mechanisms, controls, training programs, and continuous improvements to our internal processes and policies, ensuring effective ESG risk management. Additionally, we conducted an initial assessment of biodiversity-related risks in line with the Taskforce on Nature-Related Financial Disclosures (TNFD) standard, in collaboration with the Inter-American Development Bank (IDB). This effort focused on the timber and African palm sectors due to their potential impact on biodiversity.

Furthermore, we developed an internal notice defining the minimum parameters for classifying a portfolio as ESG-compliant, detailing the related policies, controls, and monitoring processes. We also updated our internal thematic rating methodology to incorporate new emission types, such as blue emissions, biodiversity emissions, and sustainability-linked emissions. This update has expanded Bancolombia Group’s capabilities to evaluate and manage thematic emissions under ESG criteria.

In compliance with Notice 028 of 2024 from the Financial Superintendency of Colombia (SFC), we conducted climate change stress tests by assessing the deterioration of loan portfolio quality indicators. These tests evaluated potential increases in provisions, balance sheet impacts, effects on financial statements, and changes in profitability, solvency, and liquidity indicators. The climate stress test considered credit risk impact through probability of default (PD), which was affected by the financial impact of physical risks materializing through the following transmission channels: damage to clients’ cash-generating assets, which in turn affects their repayment capacity, and business interruptions due to extreme climate conditions.

Human Talent Risk

Creativity, innovation, and flexibility have been essential competencies for our workforce at Bancolombia Group, enabling us to drive continuous technological advancements, renew business models and strategies, and develop innovative products and services.

The quality and competitiveness of our talent, the intentional management of our corporate culture and work dynamics, and the evolution of labor relations have posed a critical challenge, given their direct impact on our long-term performance and stability. Our strategic objectives heavily rely on our human capital. As a result, a lack of essential skills—whether due to difficulties in attracting highly qualified professionals or the loss of key employees—could lead to reduced operational efficiency and a limited ability to swiftly adapt to market changes.

Financial institutions continue to face significant challenges in attracting and retaining specialized professionals for roles that require highly advanced and specific expertise. According to Bancolombia Group’s assessments, in 2024, key talent risk indicators—including turnover rates, benefits utilization, employer branding, and work models—remained within acceptable limits. Nevertheless, we implemented strategies aimed at strengthening strategic expertise in areas such as data analytics and artificial intelligence, cybersecurity, digital management, human-centered experience design, technical architecture, blockchain, and the management of emerging risks that are critical for Bancolombia Group to achieve its objectives.

Third Party Risk

Throughout 2024, at Bancolombia Group, we ensured effective third-party risk management by identifying those third parties or suppliers considered critical to the Group. These are entities whose non-compliance could negatively impact the provision of services and/or the offering of products to our clients and users. To mitigate this risk, we developed specific action plans and implemented a process to detect early warning signs in suppliers’ control environments before engaging in contractual agreements.

Additionally, we integrated multidisciplinary teams into the analysis of these third parties and suppliers. These teams consist of members from various areas of the Organization, including Sustainability, Data Protection, Cybersecurity, Talent and Culture, Business Continuity, and Operational Risk, among others. This approach ensures a comprehensive understanding of the third-party management lifecycle and guarantees that any event potentially affecting Bancolombia Group entities is properly monitored and managed throughout the contractual relationship. The formation of these multidisciplinary teams continues to be implemented at the corporate level.

Operational Resilience, Business Continuity, and Technology Failures

As Bancolombia Group’s businesses, services, and processes continuously evolve to stay aligned with market trends, we remain exposed to situations that could affect service delivery to our clients and users. These risks may arise from process failures, technological issues, or supplier-related incidents.

In 2024, we focused on strengthening our operational resilience by reinforcing crisis management team training and validating response protocols. As part of this initiative, we developed a comprehensive training program for both primary and alternate teams, as well as process owners. This program included self-study modules and expert-led discussions.

Additionally, we successfully carried out our business continuity testing program across all key areas, including processes, suppliers, technology, infrastructure, and personnel, along with the scheduled simulation exercises.

Model Risk

Analytical models are key tools for managing financial risks and other processes within Bancolombia Group. They enable an objective, automated, and efficient approach to decision-making. However, these models may also fail or not reflect reality, which is known as model risk. This occurs when analytical models used to measure, evaluate, or manage financial risks are inadequate, inaccurate, or unreliable, potentially leading to economic losses, reputational damage, or non-compliance with internal and external limits. To address this, we assess the impacts of these models across various processes and implement action plans to mitigate the associated risks.

At Bancolombia Group, we use internal models to quantify and manage credit, market, operational, and liquidity risks, among other processes. To ensure proper oversight, we have established a Model Risk Management Framework that covers model identification, classification, development, independent validation, approval, monitoring, and auditing. This framework aligns with regulatory and supervisory requirements.

In 2024, we advanced the maturity model and model risk management by creating data highways—corporate data sources containing historical information from the model risk management tool. This initiative enhanced our ability to generate reports and manage key indicators. We also introduced a new version of the corporate model risk policy, incorporating improvements related to findings management, action plans, and refinements in model approval and methodology frameworks. Additionally, we established new guidelines for the ethical development and use of analytical models, setting clear principles on transparency, fairness, and explainability in model design and application.

Moreover, we implemented generative artificial intelligence tools to support model risk management. This innovation significantly increased efficiency within the independent validation team, reducing qualitative model review times by 87% and assisting the analytical community in addressing model risk-related inquiries. We also developed automated tools for quantitative model validation, which reduced the evaluation time for complex models by 40%.

Cyber and Information Security

At Bancolombia Group, we base our information security approach on three key pillars: confidentiality, integrity, and availability. We strive to ensure their applicability through the three-line model, which includes a synchronized process for managing operational, technological, and cybersecurity risks.

Our risk management efforts encompass, among other aspects, the analysis of potential situations related to technological infrastructure; access to or use of technology that may impact business processes or risk management at Bancolombia Group; and the assessment of the impact that adverse events may have on the security attributes of information assets in cyberspace.

In 2024, to strengthen our cyber and information security management, we implemented controls such as enhanced access management, the configuration of alerts and monitoring from the Security Operations Center (SOC), and the analysis of code and vulnerabilities at different stages of development. We incorporated these measures into our technological components, applications, and cloud services.

Additionally, we conducted regular scans and proactively managed the remediation of vulnerabilities, while also implementing secure development practices for production releases.

Risk of Inadequate Response to Market Changes

In 2024, Bancolombia operated in a highly competitive environment, marked by a sharp increase in competition across the jurisdictions where we operate, as well as strategic decisions made by key industry players. This landscape also included the development and consolidation of financial products and services, both from emerging and traditional market participants.

The sharp rise in competition initially stemmed from a “rate war” aimed at securing market share and achieving customer growth. Additionally, the announcement by the Colombian Central Bank regarding the imminent phase-out of the Bre-B System created a shift within the industry, prompting various players to proactively raise awareness and position themselves early in anticipation of Colombia’s new immediate payment system set to launch in 2025.

Regarding the development and consolidation of financial products and services by both emerging and traditional players, Nubank stood out by rapidly expanding its portfolio in the country, achieving significant growth in its customer base and strengthening its brand presence. Additionally, companies like Tpaga, RappiPay, and DaviPlata deployed sustainable growth strategies tailored to their credit risk appetite and access to capital, aiming to capitalize on a potential rebound in credit demand.

To navigate the challenges of this dynamic competitive landscape, we at Bancolombia defined strategic priorities aligned with our vision and made decisions aimed at maintaining our leadership, customer preference, and long-term loyalty among our clients and other stakeholders.

Internal Fraud Risk

Internal fraud, particularly involving the misappropriation of assets, poses the risk of financial losses resulting from actions taken by employees or by personnel from our suppliers and partners. These actions are intended to obtain illegal benefits or advantages, either for personal gain or for third parties, through deception and at the expense of Bancolombia Group’s interests. Misappropriation, embezzlement, or improper use of resources includes the concealment of assets, misuse of confidential information or intellectual property, unauthorized access to or copying of digital assets, unauthorized expenses, or improper use of the internet.

Below are the key strategies we implemented in 2024 to prevent asset misappropriation:

•We strengthened controls in our branch network to prevent cash theft by employees, implementing measures such as dual control, credential segregation, and various high-risk monitoring mechanisms.

•We enhanced controls related to information leakage and access management in critical processes.

•We identified and intervened in processes where appropriate controls needed to be implemented to close internal fraud gaps, based on investigative findings.

•We established the fraud prevention alignment committee, aimed at coordinating strategies among different areas involved in internal fraud prevention, particularly in mitigating asset misappropriation risks.

•We updated and disseminated our zero-tolerance fraud policy and investigation protocol.

•We carried out large-scale training and awareness campaigns for employees in administrative areas and branches, supplier employees, and other stakeholders.

•We developed a behavioral model to address the various compliance challenges faced by Bancolombia, incorporating a behavioral risk approach.

Through these measures, we aim to enhance our control environment and mitigate asset misappropriation risks with increasing accuracy.

External Fraud Risk

The financial sector remains a prime target for fraudsters, who exploit various fraud techniques to breach the security of financial transactions. The complexity of financial processes—designed to ensure secure and reliable transactions—adds to the challenge of protecting customers and users from these threats. At Bancolombia Group, identifying and mitigating fraud risks are strategic priorities. To this end, we employ advanced operational risk analysis methodologies that enable continuous monitoring of processes, products, and channels. These tools enhance the ability of Bancolombia Group entities to protect customers and users across all points of interaction.

In 2024, there was a significant increase in external fraud cases involving social engineering techniques within the financial system. In response, we strengthened our preventive controls and intensified awareness campaigns on the safe use of digital products and channels, emphasizing financial education as a key defense against these threats.

Additionally, we implemented comprehensive strategies to reinforce authentication and identity validation, along with transaction monitoring systems. These initiatives, complemented by culture and education programs aimed at customers and users, reflect Bancolombia Group’s commitment to combating fraud in all its forms. Through these actions, we reaffirm our mission to provide secure, reliable financial services aligned with industry best practices, protecting our customers’ interests and ensuring operational sustainability.

AML/ATF and Corruption

The risks of money laundering, terrorism financing, and corruption stem from the potential for losses or damages that an entity within the Group may face due to its vulnerability to being directly or indirectly used—through its operations, businesses, products, services, or channels—to legitimize assets or funds derived from illegal activities (money laundering), finance terrorist activities, and/or conceal funds obtained from such criminal activities. Additionally, these illicit activities can have consequences in the countries or jurisdictions where we operate, as they pose significant obstacles to sustainable development and severely impact the most vulnerable populations.

Aligned with our purpose of promoting sustainable development for collective well-being, Bancolombia Group is committed to preventing and mitigating AML/ATF and corruption risks through a risk-based approach. In this regard, we continuously refine methodologies, models, and tools to identify, measure, control, and monitor risks, ensuring alignment with both internal and external contexts.

Below are the key initiatives we implemented in 2024 to ensure robust risk management and an adequate control environment regarding AML/ATF and corruption:

•We executed AML/ATF risk matrices for Bancolombia, Valores Bancolombia, Fiduciaria Bancolombia, and Bancolombia Investment Banking. We continued implementing, evolving, and redesigning various technological tools within the Compliance Vice Presidency, enhancing our ability to identify, measure, and mitigate money laundering and terrorism financing (AML/ATF) risks from multiple risk factors. This included identifying warning signs associated with AML/ATF typologies and threats that could impact Bancolombia Group. In collaboration with the SFC and other industry entities, we conducted an analysis of internal and external environments, gaining insights into emerging AML/ATF-related criminal schemes, particularly those involving offenses against public administration.

•We managed and supported the implementation of controls to mitigate risks arising from AML/ATF challenges faced by Bancolombia, ensuring continued effective risk management across the various risk factors to which we are exposed.

•We advanced our strategy to foster a culture of AML/ATF risk prevention, creating engagement opportunities with our commercial teams through in-person visits to multiple branches across the country.

•Additionally, we provided training sessions for commercial and business teams and developed communication materials and press articles to raise awareness about AML/ATF risks.

At Bancolombia Group, we remain committed to identifying and updating threats and vulnerabilities associated with AML/ATF and corruption risks. Our goal is to implement controls that mitigate these risks across key factors—customers, channels, products, employees, and jurisdictions—while maintaining continuous monitoring to detect emerging risks.

Profitability and sustainable growth are fundamental premises of Bancolombia Group’s risk-based capital management. For this reason, we have developed policies, procedures and methodologies to make decisions based on the risk-return relationship of each of the operations carried out in our business development. Thus, our risk assessment is present from the definition of prices, through profitability measurements, to our employees' variable remuneration.

From a regulatory standpoint, Bancolombia Group calculates its capital requirements in accordance with Decree 2555 of 2010 and Chapter 13-16 of the Basic Accounting and Financial Notice, which is aligned with the Basel III standard model.

Our allocated capital management efforts in 2024 aimed to ensure coverage of unexpected losses arising from the various risks affecting our balance sheet. We conducted continuous monitoring and management of allocated capital, aligning it with regulatory methodologies for each entity within the Group. As a result, we maintained a basic solvency ratio above 9.5% at the corporate level, exceeding the regulatory minimum of 8.5% (including capital buffers).

Among our capital requirements, the local systemically important financial institution (D-SIB) buffer stood out, requiring Bancolombia Group to hold an additional 1% of risk-weighted assets (RWA). This requirement was met with the highest quality capital (Common Equity Tier 1 or CET1). Notably, Bancolombia is the most systemically important financial institution in the local market, according to calculations by the Financial Superintendency of Colombia (SFC).

However, at the international level, we are not classified as a globally systemically important bank (G-SIB).

Aligned with our purpose of promoting sustainable development for collective well-being and our goal of fostering customer loyalty and preference, Bancolombia S.A. continuously implements actions to ensure the effective management and operation of the Consumer Service System (SAC).

To this end, the Compliance Vice Presidency, in its role as coordinator of the Financial Consumer Protection Program, supports various teams, Senior Management, and the Board of Directors by providing expertise and skills aimed at fostering an environment of proper service, fair treatment, protection, respect, and high-quality service delivery for customers and users.

In 2024, our SAC efforts focused on the following areas:

1.Properly implement complaint and claim reporting through the SmartSupervision tool.

2.Conduct risk management of behaviors based on the guidelines outlined in the External Guide issued by the SFC.

3.Coordinate engagement with the Financial Consumer Ombudsman.

4.Ensure compliance with all SAC system stages and components.

5.Align operations effectively with the regulatory framework.

6.Provide effective support for institutional requests and supervisory exercises conducted by the regulator.

Finally, Bancolombia considers it essential to understand, analyze, and implement improvement actions regarding SAC. For this reason, we work collaboratively with strategic external partners, including the Financial Consumer Ombudsman, Statutory Auditors, industry associations, and the SFC, to ensure that consumers receive correct, efficient, and timely service, ultimately enhancing their overall experience.

At Bancolombia Group, we are committed to sustainability in our processes and products. To reinforce this commitment, we adhere to the following agreements: (1) Equator Principles (World Bank), (2) United Nations Environment Programme (UNEP-FI), (3) Dow Jones Sustainability Index, Partnership for Carbon Accounting Financials (PCAF), International Finance Corporation (IFC) standards, and other applicable sustainability frameworks.

Through these initiatives, we aim to promote sustainable economic development and contribute, as a financial stakeholder, to mitigating climate change effects by supporting industries with high greenhouse gas emissions in transitioning to more sustainable practices.

Regarding Environmental and Social Risk Analysis (ESRA), our internal processes and policies are aligned with the fourth version of the Equator Principles and its full regulatory framework. These policies include the description of those activities that require Environmental and Social Risk Analysis, environmental risk studies for the receipt of guarantees, dations in payment and assets delivered via leasing, preventing risks associated with environmental liabilities in real estate where activities sensitive to environmental impacts are developed.

The ESRA process also complements the assessment of physical and transition risks associated with climate change, biodiversity, and human rights in project financing, corporate loans, bridge loans, and financial advisory services. These evaluations are conducted across various business segments, including Corporate Banking, Business Banking, SME Banking, Investment Banking, and Leasing Operations.

For each analysis, we apply risk classification criteria and environmental and social covenant structuring based on tools developed under the Equator Principles and IFC Performance Standards. These standards are adapted to local regulatory requirements, as well as country- and region-specific needs.

Bancolombia accounted for 58% of all studies, followed by BAM (23%), Banco Agrícola (12%), and Banistmo (6%).

Fifteen assessments were conducted under the Equator Principles framework, covering a total of USD 1.1 trillion.

A total of 97% of operations received favorable evaluations, either because they met all the required criteria and demonstrated—through their environmental and social management systems—that they have mechanisms in place to control, prevent, and mitigate the inherent risks of their activities, or because conditions were identified during the evaluation that must be met for approval. These conditions are subject to follow-up and monitoring to ensure compliance.

Conversely, 3% of operations were deemed unfavorable due to issues such as missing documentation, clients with ongoing environmental sanctioning processes, failure to meet legal requirements, lack of environmental permits and licenses, or non-compliance with the standards set by the Group.

A total of 49.5% of the operations evaluated in 2024 corresponded to the energy, agribusiness, and chemical sectors (107 operations).

The “Other Sectors” category includes sectors with a share of less than 4.6%.

Of the 216 operations conducted, 15 were evaluated under the Equator Principles or categorized as corporate loans. Below is a breakdown of the sector, purpose of the operation, and project risk level:

Dan Ariely, a renowned behavioral economist and psychologist, states that trust is fundamental to maintaining strong relationships and fostering better societal behavior. This principle is highly relevant to Bancolombia Group, and we have applied it for over a decade in our reputation management model. As an organization, we are fully committed to fulfilling our promises with transparency, honesty, and mutual understanding.

At Bancolombia, our employees start each day with the mission of building and strengthening trust with all our stakeholders. Our goal is clear: to maintain open dialogue, validate expectations regarding our value proposition, and act with a genuine commitment to fostering long-term relationships. We even proactively seek to engage with individuals who may be hesitant to interact with the financial sector, meeting them at their perspectives and reinforcing that our business is 100% based on trust.

For ten consecutive years, Bancolombia has been recognized as the company with the best reputation in Colombia, according to Business Monitor of Corporate Reputation (Merco). This recognition carries great responsibility and pride, reinforcing our commitment to a deeper awareness of our environment and supporting our purpose of promoting sustainable development for collective well-being. We rely on a proprietary management model developed in collaboration with KPMG Spain, experts in corporate reputation.

As a result of these efforts, in 2024, our stakeholders rated us with high levels of trust on a scale from 0% to 100%: Customers and general public (80%), opinion leaders (100%), SMEs (85%), social clients (99%), and employees (100%). These results further drive our commitment to building long-term relationships.

We understand that trust is shaped by multiple factors—both traditional and financial, as well as non-financial. These include market risks, liquidity, credit risk, disinformation, political risks, ethics, and transparency, among others. For this reason, we continuously evaluate, manage, and monitor the impact of these risks on our reputation through an exposure model that allows us to proactively make decisions and balance business profitability with reputational strength.

Through this integrated approach to reputation management, we recognize that being a trusted financial partner is a strategic asset that strengthens long-term relationships. Our goal is to foster integrity, empathy, and a positive outlook to help build a society guided by collective well-being.

This year, we took a strong stance against disinformation, guided by our understanding of risk and insights from the World Economic Forum’s Global Risks Report, which identified disinformation as the most critical risk for 2024.

At Bancolombia, we define disinformation risk as the spread of false or misleading news through media or social networks related to our brand and Organization. We monitor our exposure to this risk through two key approaches:

1.Public Perception Monitoring: We assess how customers and non-customers perceive our effectiveness in responding to and debunking false information in the media and on social networks.
If necessary, we implement corrective actions to bridge any perception gaps.

2.Proactive Initiatives to Counter Disinformation:
We systematically report fake accounts that misuse Bancolombia’s name and image on social media.
We issue corrections to publications containing inaccurate or misleading information.
We actively engage in communication efforts to educate stakeholders on detecting, verifying, and reporting disinformation—a widespread issue in today’s digital landscape.

Through these everyday actions, ongoing dialogue with our stakeholders, and awareness of emerging risks, we continue to build trust and shape the future.

Promoting sustainable development for the well-being of all means acting daily across three key areas: strengthening the production network of the countries where we operate, building sustainable cities and communities, and deepening financial inclusion. This is what we call Purpose-Driven Business.

As a financial institution that channels resources, we recognize the crucial role we play in driving the global United Nations Sustainable Development Goals (SDGs) agenda.

Acknowledging that all SDGs are interconnected, we have identified eight key objectives where we can make the greatest impact through our strategy.

In the countries where we operate, we are committed to mobilizing resources for Purpose-Driven Business to leverage our core financial activities in driving initiatives and best practices that bring our purpose to life and contribute to the United Nations Sustainable Development Goals (SDGs).

In Colombia, we have committed to mobilizing at least COP 500 trillion by 2030 through everyday financial services that promote the three previously mentioned areas of action. In 2024, we disbursed COP 45.9 trillion, bringing the cumulative total to COP 197.74 trillion, which represents 38.6% of our goal.

Key areas we aim to strengthen include agriculture, small and medium-sized enterprises (SMEs), technological transformation of businesses, startups, sustainable infrastructure in Colombia, low-carbon mobility, access to housing, decarbonization of the economy, financial inclusion, and women’s entrepreneurship.

This progress is made possible through specialized financial products that align with the key pillars of our purpose. We continue to take on the challenge of expanding our portfolio in this area.

In Panama, we have committed to mobilizing USD 17 billion, with USD 1.743 billion disbursed by the end of 2024. Of this amount, USD 1.315 billion was allocated to strengthening the production network, USD 272 million was directed toward sustainable cities and communities, and USD 156 million was designated for financial inclusion.

In Guatemala, through BAM, our ambition is to mobilize USD 16 billion. In 2024, we surpassed our target for the year, disbursing USD 1.5185 billion. Of this amount, USD 1.1489 billion was allocated to strengthening the production network, USD 320.8 million was directed toward sustainable cities and communities, and USD 48.8 million was designated for financial inclusion.

In El Salvador, Banco Agrícola has set an ambition of USD 18 billion. In 2024, we disbursed USD 1.5354 billion across the three pillars of our purpose: USD 860.7 million to strengthen the production network, USD 164.7 million toward sustainable cities and communities, and USD 510 million for financial inclusion.

The full details of our business ambitions aligned with the Sustainable Development Goals (SDGs) can be found here:

www.grupobancolombia.com15880/44349919-2d9d-4b5a-b153-8740ac95e42b/Codigo-de-Buen-Gobierno-Bancolombia-27-agosto-2024.pdf?MOD=AJPERES&CVID=p9pGh3X

While our Sustainable Finance Strategy serves as a key tool for driving Purpose-Driven Business, our ambition extends beyond sustainable finance products, incorporating a broader range of financial solutions.

Agricultural Sector

Yesterday, today, and always, agribusiness has been a source of development opportunities for our countries. Its growth is essential for food security, reducing social inequalities, combating climate change, and driving economic activity.

At Bancolombia, we are committed to being the bank for the agricultural sector. We support more than 270,000 clients, to whom we disbursed over COP 13.5 trillion in 2024 alone, including Finagro-backed loans. As a result, 31 out of every 100 pesos in agricultural credit in Colombia comes from Bancolombia.

Recognizing that small businesses make up the majority of the sector’s production chains, we have designed tailored solutions to expand financial services to all.

Through our productive chain initiatives, we drive transformation and development by providing information and support to 167 anchor companies in the agricultural sector, contributing to increased productivity in key industries such as coffee, cocoa, beef and dairy cattle, corn, African palm, avocado, rice, and plantains. We disbursed more than COP 192 billion in working capital and investment project loans and granted credit lines worth nearly COP 862 billion to over 8,000 small and medium-sized producers.

Additionally, through our integrative financing model, we provided over COP 343 billion to more than 3,500 small and medium-sized primary producers, including technical assistance.

Through our Sustainable Agribusiness credit line, we financed over COP 1.19 trillion for projects focused on circular economy, energy efficiency, working capital, renewable energy, cleaner production, and sustainable livestock farming.

We also launched the Sustainable Poultry credit line, supporting the poultry sector’s transition toward a more efficient and environmentally friendly industry. This initiative finances assets that generate measurable environmental benefits in areas such as cleaner production, circular economy, energy efficiency, renewable energy, nature-based solutions, and workforce well-being programs. It also facilitates investments needed to obtain the Icontec Poultry Sustainability Seal.

Our value proposition for the poultry industry includes foreign currency financing to support international trade operations for producers holding the Diamond Category Poultry Sustainability Seal. In 2024, disbursements under this line totaled COP 31.442 billion and USD 49.4 million.

Another key initiative is our Parametric Agricultural Insurance, through which we issued 2,257 policies to producers. By the end of the year, we had insured over COP 81 billion in assets and supported 113 clients in claims totaling COP 349 million.

SMEs and Independent Workers

Small and medium-sized enterprises (SMEs) form the backbone of Latin America’s production network, representing 99% of businesses and over 60% of employment, according to the OECD.

We serve more than 650,000 SMEs in Colombia, 16,800 in Panama, 17,900 in Guatemala, and 13,700 in El Salvador, offering comprehensive solutions tailored to their business cycles. These include payment alternatives, sales reconciliation, savings and investment options, and both short- and long-term financing in local currency and U.S. dollars.

To put this into perspective, we disbursed COP 18 trillion in credit to Colombian SMEs throughout the year, addressing their diverse business needs.

We also work to recognize SMEs that adopt environmental, social, and governance (ESG) best practices, helping them access the benefits of sustainable financing. This involves enhanced training for our commercial teams and stronger relationships with industry associations, chambers of commerce, and competitiveness councils.

Additionally, we provide knowledge and tools to help SMEs strengthen their businesses and integrate sustainability into their strategies. In 2024, we helped over 200 SMEs develop sustainability frameworks by conducting materiality analyses to identify key ESG topics.

Colombia has the highest percentage of independent workers among OECD countries, with 42% of the labor force classified as self-employed. At Bancolombia, we support more than 2.2 million independent workers, offering a specialized service model that efficiently addresses their needs.

We provided over COP 503 billion in productive credit to more than 29,000 clients, leading to a 28% increase in our loan portfolio, which surpassed COP 604 billion. Nearly 13,000 micro-entrepreneurs accessed our Elévate financial education program at no cost, receiving six months of personalized guidance. Upon completing the program, participants benefited from reduced interest rates on their loans.

To further support this segment, we collaborated with Fondo Nacional de Garantías to expand coverage, reduce costs for clients, and increase pre-approved credit lines.

In Guatemala, we continued offering tailored solutions for SMEs, including PyME Comercio, Fiduciario Microcrédito, and Fiduciario Pequeña y Mediana Empresa products. We also streamlined pre-approval processes for business credit cards for SMEs and promoted technology adoption within this segment. Beyond financial services, we partnered with Tributax Guatemala to provide specialized tax management solutions, helping our clients optimize their tax obligations and meet legal requirements more efficiently.

Sustainable Financing

To drive the adoption of ESG criteria in businesses, we have designed differentiated sustainable financing products to support our clients in the development and transition to more sustainable models. This is achieved through projects that create efficiencies in resource use, improve operational models, and generate measurable environmental benefits.

Our value proposition includes technical support for identifying and implementing business opportunities related to sustainability, as well as a broad portfolio of sustainable credit lines that offer our clients better rates and terms for developing investment projects in assets and working capital needs.

The goal is to promote the use of clean technologies, renewable energies, circular economy practices, efficient energy use, clean fuels, waste reduction, emissions, and discharges, sustainable construction, projects related to the blue economy, sustainable road infrastructure, among others. This also helps us drive purposeful business.

The business lines through which we finance these areas include banking (ordinary portfolio), factoring, Sufi, foreign currency, and leasing.

In total, through our sustainable lines, we disbursed COP 9.22 trillion in local currency and USD 289 million in foreign currency during 2024, funding projects across various economic sectors to fulfill our organizational purpose.

The projects we have financed under these lines have contributed to the transition of various industries and generated efficiencies. Below are the environmental impacts of the investments made by the companies: