Risk management of VP Bank Group

Effective capital, liquidity and risk management is an elementary prerequisite for the success and stability of a bank. VP Bank understands this to mean the systematic process of identifying, evaluating, managing and monitoring relevant risks as well as the steering of capital resources and liquidity necessary to assume risks and to guarantee risk-bearing capacity. The binding framework for action in this context is provided by the regulations defined by the Board of Directors of VP Bank Group, consisting of the risk appetite statement, risk policy and risk strategies.

The risk appetite statement defines the overall risk tolerance along the risk taxonomy, forming the basis for operationalising limits and targets in the risk policy. As an overall framework, the risk policy, together with the risk strategies per risk group (strategic and business risks, financial risks as well as non-financial risks), regulates the specific objectives and principles, organisational structures and processes, methods and tools of risk management.

In Liechtenstein, the regulatory requirements governing risk management are set out primarily in the Banking Act (BankA) and the Banking Ordinance (BankO). In addition, the Capital Requirements Regulation (CRR) together with the Capital Requirements Directive (CRD) apply in Liechtenstein. In Liechtenstein, the CRD was enacted in the BankA and in the BankO. VP Bank was classified as a locally systemically relevant banking institution by the Financial Market Authority Liechtenstein and must hold in aggregate capital amounting to at least 12.5 per cent of its risk-weighted assets. Thanks to its solid capital basis, balance sheet structure and comfortable liquidity position, VP Bank constantly outperformed the minimum regulatory requirements over the course of 2024.

Capital and balance sheet structure management

The minimum capital ratio of VP Bank of 12.5 per cent of risk-weighted assets consists of the regulatory minimum requirement of 8 per cent, a capital conservation buffer of 2.5 per cent and a buffer for other system-relevant banks of 2 per cent. Basel IV also provides for an anti-cyclical capital buffer that was set at 0 per cent for 2025 by the Financial Market Authority Liechtenstein.

VP Bank complied with the minimum capital requirements for 2025 at all times. Thanks to an exceedingly robust tier 1 ratio of 26.1 per cent as of the end of 2025, it continues to guarantee sufficient room for manoeuvre. This enables VP Bank to continue to assume risks associated with the conduct of banking operations.

As of the end of 2025, the leverage ratio of VP Bank was 10.4 per cent. VP Bank has published further information as to the leverage ratio in the disclosure report.

Capital and balance sheet structure management involves ongoing monitoring of compliance with regulatory requirements and coverage of business requirements. As part of the internal processes for assessing adequate capital and liquidity (Internal Capital Adequacy Assessment Process (ICAAP) and Internal Liquidity Adequacy Assessment Process (ILAAP)), potential negative effects on the capital and liquidity base in stress situations are simulated and analysed. The Financial Market Authority imposes specific requirements on internal strategies and procedures for determining, managing and monitoring capital risks through the ICAAP, which are collected and assessed annually by the Liechtenstein Financial Market Authority using an ICAAP questionnaire.

Liquidity risk management

Liquidity risks are monitored and managed in accordance with the statutory liquidity standards and regulations of the Banking Ordinance, CRR and CRD, as well as internal guidelines and limits for interbank and credit business. The maintenance of liquidity within the VP Bank Group at all times is a top priority and is ensured by a high level of cash and cash equivalents and highly liquid assets (high quality liquid assets, HQLA). VP Bank complied with the minimum liquidity requirements for 2025 at all times.

In this context, compliance with the liquidity coverage ratio (LCR) of 100 per cent is required by law, which was clearly exceeded with a value of 180 per cent. The requirement for the net stable funding ratio (NSFR) of 100 per cent was also met and significantly exceeded at 154 per cent at the end of 2025.

With the ILAAP, the Financial Market Authority imposes specific requirements regarding internal strategies and procedures for determining, managing and monitoring liquidity risks, which are collected and assessed annually by the Liechtenstein Financial Market Authority using an ILAAP questionnaire.

As part of its liquidity management, VP Bank has a liquidity contingency plan in place to ensure that it has sufficient liquidity even in the event of a liquidity crisis. Regular monitoring of early warning indicators allows any deterioration in the liquidity situation to be identified at an early stage.

As part of liquidity management, compliance with regulatory requirements and the coverage of business needs are monitored on an ongoing basis. Stress tests are used to simulate possible negative scenarios and analyse the impact on liquidity in stress situations.

Credit risk

The management and monitoring of credit risk plays a key role, particularly given the importance of client lending (CHF 5.9 billion as at 31 December 2025, or 55 per cent of total assets). In addition to lending, VP Bank is also exposed to credit risks arising from securities held for liquidity purposes in the banking book (predominantly high-quality liquid assets) and from interbank investments with banks with good credit ratings.

Credit risk management in the client lending business is governed by the credit regulations. The volume of client loans decreased by approximately CHF 15 million in 2025.

At CHF 747 million, the volume of claims against banks is approximately CHF 104 million lower than in the previous year. To strengthen interest income, free liquid funds continue to be invested with banks with good credit ratings, predominantly Swiss cantonal and regional banks.

The securities portfolio consists mainly of investment-grade securities and had a nominal value of approximately CHF 2.0 billion as of 31 December 2025. Detailed guidelines (including volume and risk limits, duration ranges) for the management of securities have been established in the risk management process.

Market risk

Market risk comprises interest rate, credit spread, currency and share price risks. Due to the significance of the interest-bearing business, the management and monitoring of market risk across the entire balance sheet is of particular importance. In 2025, the trend of falling key interest rates continued, albeit not to the same extent as in the previous year. As a result, market interest rates at the short end fell. In the CHF and EUR currencies, the initially inverted yield curves, where long-term interest rates are below short-term interest rates, normalised. The interest rate level in CHF reached zero. Exchange rates fluctuated significantly over the course of the year, with a downward trend against the CHF; the USD in particular lost over 12 per cent.

Operational risk

VP Bank defines operational risk as potential losses or loss of profit that may occur as a consequence of the inappropriateness or failure of internal processes, individuals or systems or as a result of external events. Possible risk scenarios are identified, described and assessed using top-down and bottom-up risk assessments. The identified risks are limited or mitigated by controls as specified in the risk appetite. The controls are an integral part of the business processes and are documented in the internal control system. Controls are periodically assessed for adequacy and effectiveness. The current non-financial risk situation is reported to the Executive Board and the Board of Directors on a quarterly basis.

The geopolitical situation continues to have a major impact on the assessment of risks arising from sanctions and embargoes. Accordingly, processes for the early detection and prevention of potential compliance violations have been further improved. At the same time, it is assumed that regulatory density in the financial sector will continue to increase.

On 17 January 2025, the requirements of Regulation (EU) 2022/2554 on digital operational resilience in the financial sector (DORA) came into force with the aim of strengthening the digital resilience of financial service providers and ensuring the stability of the financial system. It thus sets new standards for the protection of critical IT systems and the management of cyber attacks in the financial sector. On this basis, tests to review digital operational resilience were carried out for the first time in 2025 as an extension of the existing business continuity tests.

VP Bank has taken measures to further improve IT risk management, IT processes, cyber resilience and the monitoring of external service providers.

Increasing dependence on external service providers and the growing complexity of supply chains are increasing operational risk. By optimising our third-party management, we have strengthened our resilience to default risks, cyber threats and compliance violations.

In this way, VP Bank protects its clients and their assets, the security of its services and the stability of its business processes in the long term.

Further risks

In addition to the risks mentioned above, VP Bank Group's risk management also covers strategy and business risks, compliance risks, ESG risks and climate-related financial risks, as well as reputational risk. Based on VP Bank's business model and range of services, these risks are systematically analysed and continuously assessed.

Risk management at VP Bank Group is predicated on the following principles:

Harmonisation of risk-bearing capacity and risk tolerance

The concept of risk-bearing capacity is intended to enable a bank to continue its business operations or to fully meet the claims of depositors and creditors despite losses from risks that become effective. Risk tolerance indicates the potential loss which the bank is prepared to bear without jeopardising the bank’s ability to continue as a going concern. As a strategic success factor, risk-bearing capacity is to be maintained and enhanced at all times by employing a suitable process to ensure an appropriate capital and liquidity base.

Clearly defined powers of authority and responsibilities

Risk tolerance is operationalised using a comprehensive limit system and implemented effectively with a clear definition of the duties, powers of authority and responsibilities of all bodies, organisational units and committees involved in the risk, capital and liquidity management process.

Conscientious handling of risks

Strategic and operational decisions are taken based on risk-return considerations and, in this way, aligned with the interests of the stakeholders.

Subject to compliance with statutory and regulatory requirements as well as corporate policy and ethical principles, VP Bank consciously assumes risks provided that the extent of these are known, the system requirements for recording them are in place and the bank will be adequately compensated for them. Transactions with an imbalanced risk-return ratio are avoided, as are major risks and extreme risk concentrations, which could endanger the risk-bearing capacity and therefore also the future existence of the Group.

Segregation of functions

Risk control and reporting to Group Executive Management and the Board of Directors are carried out by units that are independent of the risk-managing departments and report to the Chief Risk Officer.

Transparency

The foundation of risk monitoring is comprehensive, objective, timely and transparent disclosure of risks to Group Executive Management and the Board of Directors.

Risk taxonomy

The prerequisite for risk management and the management of equity resources of VP Bank is the identification of all significant risks and their aggregation to an overall bank risk exposure.

Significant risks are identified based on the business model and related offerings of financial products and services of VP Bank.

The following chart provides an overview of the risks to which VP Bank is exposed in the context of its business activities. These are allocated to the risk groups of strategic and business risks, financial risks, non-financial risks (operational risks, compliance risks and information security risks) and reputational risks.

Strategic and business risks encompass the risk of a potential decline in profitability as a result of an inadequate corporate orientation in relation to the market environment (political, economic, social, technological, ecological, legal) and can arise from unsuitable strategic positioning or the absence of effective countermeasures in case of changes. This includes the risk that the attractiveness of location-related factors recedes or the significance and/or weighting of individual business areas undergo change by virtue of external framework conditions. It also includes the risk that the launch of new products, the distribution of existing products, market access or the conduct of business will be rendered difficult or impossible by regulations or will entail disproportionately high costs or be unprofitable. Finally, adverse developments may arise in connection with target markets as a result of political or geopolitical influences.

Financial risks (liquidity risk, market risk, non-traditional asset risk and credit risk) are deliberately entered into in order to generate income or to safeguard business policy interests.

Liquidity risks comprise market liquidity risk and idiosyncratic liquidity risk. In the case of market liquidity risk, the risk lies in the fact that the bank may be unable to procure the required liquidity due to market distortions on the money or capital markets or can do so only on inadequate terms and conditions. For example, the market for securities, which can normally be sold at market value, might not be sufficiently liquid, or the interbank market might not be available, or only to a limited extent, for short-term liquidity procurement. Idiosyncratic liquidity risk, on the other hand, represents the risk that the bank may not be able to procure liquidity for VP Bank-specific reasons or can do so only on inadequate terms and conditions.

Market risk refers to the risk of potential present value losses in the banking and trading book that emerge due to unfavourable changes in market prices (interest rates, foreign exchange rates, share prices, commodity prices, credit spreads) or other price-influencing parameters such as volatility.

Credit risk includes default/creditworthiness, liquidation, counterparty, country and idiosyncratic risks. Default risk refers to the risk of a financial loss which may occur following the default of a debtor or loan collateral. Liquidation risks include potential losses incurred by the bank not due to the debtors themselves, but due to a lack of opportunities to liquidate collateral. Counterparty risk refers to the risk of financial loss resulting from the default of a counterparty in a derivative transaction or from non-performance by a counterparty (settlement risk). Country risk is a result of uncertain political, economic or social conditions as well as payment transaction restrictions in the risk domicile (so-called transfer risks). Idiosyncratic risks include potential losses incurred by the bank from a lack of diversification in the loan portfolio (concentrations in debtors and/or collateral).

Non-traditional asset risks result from alternative investments that cannot be allocated to traditional asset classes, such as equities, bonds or money market products, and are subject to other risk drivers. This category includes, for example, investments in private debt, private equity, real estate (securitised), infrastructure projects and other investment opportunities outside the traditional investment spectrum.

Operational risk is the risk of incurring losses or loss of profit arising from the inappropriateness or failure of internal procedures, individuals or systems, or as a result of external events. These are to be avoided by appropriate controls and measures before they materialise or, if that is not possible, be reduced to a level set by the bank. Operational risk can also arise in all organisational units of the bank, whereas financial risk can only arise in risk-taking units.

Compliance risk is understood to be breaches of statutory and regulatory provisions that can cause significant damage to VP Bank’s reputation or result in sanctions, fines or even in the bank’s licence being withdrawn. VP Bank's compliance risks consist in particular of the fact that VP Bank does not or does not sufficiently recognise the compliance risks of its clients and counterparties, such as money laundering or other illegal client activities, and has not established suitable monitoring and control processes for identifying, managing and limiting cross-border compliance risks as well as tax and investment compliance risks.

Information security risk (including cyber risk) refers to the circumstances in which inappropriate infrastructure design or infrastructure failure results in losses, or to the risk, in an information technology context, of sophisticated and targeted attacks that are difficult to detect and defend against. From the perspective of data security, there is a risk for VP Bank that failure to adhere to national and international data protection requirements will result in financial and reputational losses, as well as having legal consequences.

ESG and climate-related financial risks represent the risk of negative economic impacts for VP Bank that may arise from environmental, social or governance factors. Climate-related financial risks are part of environmental risks and arise from the effects of climate change and measures to decarbonise the economy.

Reputational risk describes the risk that the confidence of employees, clients, shareholders, regulatory authorities or the public is weakened and the public image and/or reputation of the bank is impaired as a result of other types of risk or through various events. It can exhibit itself in the bank suffering monetary losses, a decline in earnings or liquidity shortages.

Duties, powers and responsibilities

The chart (→ above graphic) shows the key duties, powers and responsibilities of the bodies, organisational units and committees involved in the risk management process. The roles and structures of risk steering and risk monitoring are separated, which avoids conflicts of interest between the risk-taking and monitoring units. Management, monitoring and verification of risks takes place over three lines of defence:

1. First line of defence: risk steering
2. Second line of defence: risk monitoring
3. Third line of defence: internal audit

The Board of Directors bears overall responsibility for capital, liquidity and risk management within the Group. Its remit is to establish and maintain an appropriate structure of business processes and organisation as well as an internal control system (ICS) for an effective and efficient management of capital, liquidity and risk, thereby ensuring the risk-bearing capacity of the bank on a sustainable basis. The Board of Directors defines and approves the risk tolerance, the risk policy and the risk strategies. It monitors their implementation, sets the risk tolerance at Group level and establishes the target values and limits for the management of equity resources, liquidity and risk. In assuming these tasks, the Board of Directors is assisted by the Risk Committee.

In addition, the Board of Directors receives reports from the internal auditors and the external auditors on all exceptional and material incidents, including significant losses or serious disciplinary errors. In assuming this task, the Board of Directors is supported by the Audit Committee.

Group Internal Audit is responsible for the internal audit function within VP Bank Group. Organisationally, it forms an autonomous organisational unit which is independent of operations and is responsible for the periodic audit of structures and processes of relevance in connection with the risk policy as well as compliance with applicable requirements.

Group Executive Management is responsible for the implementation of and compliance with the risk policy approved by the Board of Directors. One of its central tasks is to ensure the functional capability of the risk management process and the internal control system (ICS). Furthermore, it is responsible for the composition and assignment of duties, responsibilities and competencies of the Asset & Liability Committee, the allocation of objectives and limits set by the Board of Directors to the individual subsidiary companies as well as the group-wide management of strategy, business, financial, compliance, operational and reputational risk.

The Asset Liability Committee (ALCO) is responsible for risk- and return-oriented balance sheet management as well as for the management of financial risks in compliance with the relevant statutory and regulatory provisions. It assesses the Group’s situation with respect to financial risks and initiates remedial steering measures whenever necessary.

The Group Operational Risk Committee (ORC) manages all operational risks and information security risks (including cyber risks). The Group Opreational Risk Committee is responsible for the identification, assessment, management, monitoring and reporting of operational risks and information security risks (including cyber risks) of VP Bank Group.

The Group Credit Committee (GCC) is responsible for the management of credit risks. This includes in particular the assessment and approval of credit applications within the scope of delegated powers.

The Group Reputational Risk Committee (GRRC) decides on client relationships which could represent a material reputational risk for VP Bank Group.

Group Treasury & Execution bears the responsibility for the steering and management of financial risks within the objectives and limits laid down by the Board of Directors and Group Executive Management. This is done while also taking into account the Group’s risk-bearing capacity, as well as its compliance with statutory and regulatory provisions.

Group Credit Consulting is responsible as the first line of defence for credit risk structuring and assessment of all credit applications at group level, as well as for the monitoring process of credit exposure on the individual loan level with regard to cover and limits. Group Credit Consulting is represented by units in all Group locations. For non-standard credit applications, Group Credit Risk reviews the risk analysis initially prepared by Group Risk Consulting. In addition, the unit approves loans on its own authority or forwards them to the relevant competence centres for assessment.

The Chief Risk Officer heads the risk management function and is responsible within Group Executive Management for the independent risk monitoring of VP Bank Group and the individual group companies. The Chief Risk Officer ensures that existing legal, regulatory and internal bank regulations on risk management are complied with and that new regulations on risk management are implemented.

Group Credit Risk is responsible as the second line of defence for assessing the credit risk of the Group's largest individual credit exposures. This applies to all credit exposures that exceed the authority of Group Credit Consulting and, based on defined risk criteria, trigger an additional credit assessment by the second line of defence. The unit is also responsible for all material credit risk standards of the VP Bank Group and their IT implementation. These include all guidelines, risk concepts, the lending methodology and its underlying lending parameters. Furthermore, Group Credit Risk, in close cooperation with Group Financial Risk, regularly prepares credit risk reports for the attention of Group Executive Management and the Board of Directors. Group Credit Consulting and Group Credit Risk also initiate and support all development projects related to VP Bank Group's lending business, including regulatory projects.

Group Financial Risk is responsible as the second line of defence for the independent monitoring of financial risks (market risks, risks from non-traditional investments, liquidity risks and credit risks from a portfolio perspective). It is responsible for defining and assessing risk methods and models for financial risks, reporting on these risks, and monitoring economic risk-bearing capacity.

Group Compliance & Operational Risk is responsible as the second line of defence for the independent monitoring of operational and compliance risks. In addition, risk inventory and related risk reporting fall within its area of responsibility.

Group Information Security is responsible as the second line of defence for the independent monitoring of cyber and information security risks. Its tasks include defining security guidelines, conducting IT risk analyses, monitoring IT and cyber security incidents, and reporting on risks within its area of responsibility.

The responsible departments are regularly informed by the Chief Risk Officer's office about the risk situation, developments and compliance with limits through risk reports.

Process monitoring / Group Internal Audit

Process to ensure risk-bearing capacity

The primary objective of the ICAAP and ILAAP is to comply with the regulatory requirements in order to assure continuation of the bank as a going concern. The risks of banking operations are to be borne by the available risk coverage potential. The components of the risk management process established at VP Bank for all material risks are explained below:

• Determination of the risk strategies: The risk strategies for each risk group (strategic and business risks, financial risk as well as non-financial risks) are derived from the business strategy of VP Bank and provide the framework conditions for risk management of the respective types of risk. The risk policy represents the basic framework for the individual risk strategies.
• Determining the risk coverage potential and setting the risk tolerance: In the risk-bearing capacity calculation, a distinction must be made between a regulatory and a value-oriented perspective. With both perspectives, the identification of the risk-bearing capacity is based on consideration of appropriate risk buffers. On the basis of the risk-bearing capacity calculation, the Board of Directors determines the limits and objectives for a rolling risk horizon of one year. All significant risks and the available risk coverage potential are compared with each other (risk-bearing capacity).
• Risk identification (risk inventory): With the annual risk inventory to be undertaken as part of the review of the framework and risk strategies, it is ensured that all significant risks of the Group (quantifiable, not quantifiable or difficult to quantify) are identified. The analysis is carried out on a top-down and/or bottom-up basis using both quantitative and qualitative criteria. Significant risks are integrated fully into the risk management process and backed by risk capital. Insignificant risks are reviewed and monitored at least annually within the scope of the risk inventory. As part of the risk inventory, potential risk concentrations in all significant risk types are evaluated.
• Risk measurement: From a regulatory perspective, risk-bearing capacity is assessed on the basis of eligible capital and regulatory capital. From a value-oriented perspective, risk-bearing capacity is determined by the present value of equity, taking into account operating costs, a buffer for other risks and the economic capital requirement. To determine the economic capital requirement , all risk types classified as material in VP Bank's annual risk inventory are taken into account and possible unexpected losses in value are considered. To determine the economic capital requirement, all material risks are aggregated into an overall risk assessment.
• Assessment of risk-bearing capacity: Risk-bearing capacity is given when the existing risk coverage potential is greater than the risks incurred at any given time. Early warning levels enable early course correction to ensure that the bank's continued existence is not jeopardised.
• Risk steering encompasses all measures on all organisational levels to actively influence the bank’s risks identified as being significant. In this respect, the objective is the optimisation of the risk return ratio within the limits and objectives set by the Board of Directors and Group Executive Management to ensure the risk-bearing capacity of the Group while also complying with statutory and legal supervisory provisions. Risk management is performed at strategic as well as operating levels. Based upon the juxtaposition of risks and limits on the one hand, as well as of regulatory and economically required capital and risk coverage potential on the other, countermeasures are taken in case of a negative variance.
• Independent risk monitoring (control and reporting to Group Executive Management and the Board of Directors): Risk steering is accompanied by comprehensive risk monitoring, which is functionally and organisationally independent of risk steering. Risk monitoring covers control and reporting. As part of the monitoring of financial risks, steering impulses can be derived from a routine target-to-actual comparison. The target is derived from the limits and objectives set, as well as from legal and supervisory-law provisions. For review of the extent to which limits are used (actual), early-warning stages are also deployed in order to take timely steering measures for any risks before they materialise.

As non-financial risks can also arise as a result of internal control gaps in the course of ongoing business activities, key controls for significant risks are audited by the respective manager in all organisational units of  VP Bank.

From a risk-monitoring perspective, risk-based checks for compliance and operational risks are carried out on an ongoing basis by Group Compliance & Operational Risk, while the respective business units are responsible for management of compliance and operational risks.

Reputational risks can result from financial risks, non-financial risks (operational risks, compliance risks, information security risks (including cyber)), ESG risks, and strategy and business risks. Strategy and business risks, as well as any reputational risks, are handled by Group Executive Management.

The results of the controls are regularly prepared in a transparent manner as part of the reporting process. The preparation takes place ex ante for decision-making purposes, ex post for control purposes – in particular to analyse any deviations from the planned figures – and ad hoc in the event of sudden and unexpected risks.

The process of ensuring the risk-bearing capacity of VP Bank Group is presented in the figure on the previous page.

The required qualitative and quantitative information on capital adequacy, risk management strategies and procedures, and VP Bank's risk situation is disclosed in the risk report and in the notes to the consolidated financial statements. In addition, VP Bank Group is preparing a disclosure report for the 2025 financial year. The Bank thus fulfils the regulatory requirements under the Banking Ordinance (BankV) and Banking Act (BankG) as well as the Capital Requirements Regulation (CRR) and Capital Requirements Directive (CRD).

VP Bank computes its required equity in accordance with the provisions of the CRR. In this connection, the following approaches are applied:

• Standardised approach for credit risks in accordance with Part 3, Title II, Chapter 2 of the CRR
• Standardised measurement approach (SMA) for operational risks in accordance with Part 3, Title III, Chapter 2 of the CRR
• Simplified standardised approach for market risks in accordance with Part 3, Title IV, Chapters 2–4 of the CRR
• Basic approach for credit valuation adjustment (CVA) risks in accordance with Article 384 CRR
• Comprehensive method for taking financial collateral into account in accordance with Article 223 CRR

In regard to strategy, business and reputational risk, no explicit regulatory capital adequacy requirements are stipulated in the CRR.

The following table shows the capital adequacy situation of the Group as of 31 December 2025.

Capital adequacy computation (Basel IV)

While engaged in complying with the relevant statutory and regulatory provisions, the monitoring and management of financial risks is based on internal bank objectives and limits relating to volumes, sensitivities and risk metrics. Scenario analyses and stress tests also demonstrate the effect of events which can not or not sufficiently be taken into consideration within the scope of ordinary risk evaluation. In this respect, the Board of Directors sets strategic guard rails within which risk management is undertaken.

Group Executive Management is responsible for the implementation and observance of the risk strategy for financial risks as approved by the Board of Directors. At the operational level, the identification, assessment and monitoring of all relevant risks is carried out by functions of the area of the Chief Risk Officer, which are independent of the risk management units. The risk management units are responsible for risk management and first-instance compliance with the targets and limits relevant to them.

Market risks

Market risks arise from taking positions in financial assets (debt instruments, equities and other securities), foreign currencies, precious metals and corresponding derivatives, as well as from client business, interbank business and from consolidated subsidiary companies whose functional currency is a foreign currency.

Interest rate risk is a significant component of market risk. It arises mainly due to divergent maturities between positions on the asset and liability sides of the balance sheet. The table on the maturity structure shows the assets and liabilities of VP Bank broken down into positions at sight, callable positions and positions with specific maturities (→ cf. note 35).

Asset and liability positions of VP Bank denominated in foreign currencies are of importance to determine the currency risk. An overview, analysed by currency, is to be found in the balance sheet by currencies (→ cf. note 34).

The bank employs a comprehensive set of methods and key figures for the monitoring and management of market risks. In this respect, the value-at-risk (VaR) approach has established itself as the standard method to measure market risk. The VaR for market risks quantifies the potential loss in market value of all market risk positions on the evaluation date, expressed in CHF. The value-at-risk is computed on a Group-wide basis with the methodology of historic simulation. In this process, the historical movements in market data over a period of at least five years are used in order to evaluate all positions subject to market risk.

The projected loss refers to an investment horizon of 250 trading days and will not be exceeded with a probability of 99 per cent. The calculation of interest rate risk generally takes into account the contractual fixing period of interest-bearing positions. For non-maturing positions, an internal replication model is applied.

The market value at risk (99 per cent / 250 days) of VP Bank Group amounted to CHF 107 million on 31 December 2025 (previous year: CHF 118 million). This figure includes interest rate, currency and equity risks as well as credit spread risks of the bond portfolio. During 2025, the market VaR fluctuated between CHF 102 million and CHF 122 million, mainly due to fluctuations in interest rate positioning. The observable decline in market VaR over the course of 2025 is mainly determined by interest rate risk and results from the ageing and volume reduction of fixed-income asset positions. The increase in foreign currency and equity risks, on the other hand, is hardly reflected in the combined market VaR. The increase was due to the expansion of exposures and the good equity performance in 2025. No material changes were recorded in credit spread risks.

The following table shows the VaR analysed by types of risk and the total market VaR.

Market value-at-risk (end-of-month values)

As the maximum losses arising from extreme market situations cannot be determined with the VaR approach, the market risk analysis is supplemented by stress tests that allow an assessment of the effects of extreme market fluctuations on the present value of equity and on net interest income. In this manner, the fluctuations in net present value of all balance sheet items and derivatives in the area of market risks are computed with the aid of sensitivity indicators based on simulated market movements (parallel shift, rotation or inclination of interest rate curves, exchange rate fluctuations by a multiple of their implicit volatility, slump in stock prices). In addition, the development of interest income is simulated for selected market scenarios (rising interest rates, falling interest rates, falling exchange rates).

The following table exemplifies the results of the key rate duration. For this, first of all, the present values of all asset and liability items as well as derivative financial instruments are calculated. Then, the interest rates of the relevant interest rate curves are increased by 1 basis point and the resulting change of present value is scaled to 1 per cent (100 basis points) in each maturity band and per currency. The respective movements represent the gain or loss of the net present value resulting from the shift in the interest rate curve. Negative values point to an excess of assets, while positive values indicate an excess of liabilities over the relevant term.

Key rate duration profile per 100 basis points increase

The following table sets out the effects of a negative movement in the principal foreign currencies on group net income and shareholders’ equity. The variance applied to determine this effect represents the implicit volatility of the respective exchange rates as of 31 December 2025 and 31 December 2024.

Movement in significant foreign currencies

The following table illustrates the impact of a possible downturn in equity markets of 10, 20 and 30 per cent, respectively, on group net income and equity capital.

Movement in relevant equity share markets

For risk management purposes, derivative financial instruments are entered into exclusively in the banking book and serve to hedge equity, interest rate and currency risks as well as to manage the banking book. The risk strategy for financial risks defines the derivatives approved for this purpose.

VP Bank refinances its medium- and long-term client loans and its nostro positions in interest-bearing debt securities primarily with short-term client deposits and is therefore subject to interest rate risk. Rising interest rates have an adverse impact on the net present value of fixed income business activities, and they also increase refinancing costs. As part of asset and liability management, interest rate swaps can be used to hedge this risk and are recognised at fair value. VP Bank applies fair-value hedge accounting under IFRS in order to record the offsetting effect of changes in the value of the hedged item on the balance sheet. For this purpose, a portion of the underlying transactions (fixed interest loans) are linked to the hedging transactions (payer swaps) through hedging relationships. In the event of fair-value changes caused by interest rate changes, the carrying values of the underlying transactions concerned are adjusted and the gains/losses taken to income.

Fixed rate positions are transformed into variable interest rate positions through the conclusion of payer swaps, thus establishing a close economic relationship between the hedge item (loan) and the hedge instrument (swap). Therefore, the hedge ratio between the designated amount of the hedge item and the designated amount of the hedge instruments is one. A hedge relationship is efficient and/or effective whenever the movements in the value of the hedge item and the hedging transactions induced by interest rate changes offset each other. Ineffectiveness mainly results from variations in duration, such as those which arise from different maturities, interest payment dates or different interest rates.

The initial efficiency of a hedge relationship is proven by a prospective effectiveness test. For this purpose, future changes in the fair value of the hedge item and hedge instrument are simulated on the basis of scenarios and are subject to a regression analysis. Effectiveness is assessed on the basis of the results of the analysis. Repeated reviews take place during the duration of the hedge relationship.

By entering into foreign exchange transactions, VP Bank has hedged its own financial investments against exchange rate fluctuations in the principal currencies. Currency risks from the client business generally may not arise, and currency positions that remain open are closed via the foreign exchange market. Group Treasury & Execution is responsible for the management of foreign currency risks from the client business.

Liquidity risks

Liquidity risks may arise through contractual mismatches between the inflows and outflows of liquidity in the individual maturity bands. Any differences arising demonstrate how much liquidity the bank must eventually procure in each maturity band in the event of an outflow of all volumes at the earliest possible time. Furthermore, there may be refinancing concentrations that are so significant that a withdrawal of the corresponding funds may cause liquidity problems.

Liquidity risks are monitored and managed using internal targets and limits for the interbank and lending business and other balance-sheet-related key figures – while also complying with statutory liquidity norms and provisions.

The decline in exchange rates against the CHF, particularly the USD, led to a decline in client deposits in 2025. On the assets side, this resulted in a decline in interbank deposits and the financial investment portfolio, while at the same time the cash and cash equivalents position was significantly higher at the end of the year.

With a liquidity coverage ratio (LCR) of 180 per cent and a net stable funding ratio (NSFR) of 154 per cent at the end of 2025, VP Bank continues to enjoy a comfortable liquidity situation.

In the short-term maturity range, the Bank refinances itself primarily through sight, call and term deposits. The following table shows the maturity structure of liabilities by maturity bands. At the end of the year, cash flows (undiscounted capital and interest payments) were broken down as follows:

Cash flows on the liabilities' side

VP Bank can obtain liquidity on a covered basis if necessary via access to the Eurex Repo market. Stress tests are used to assess the risk of unusual but plausible events, enabling VP Bank to take any necessary countermeasures in good time.

Credit risks

Credit risks arise from all transactions for which payment obligations of third parties in favour of VP Bank exist or can arise. Credit risks accrue to VP Bank from client lending activities, the money market business including bank guarantees, correspondent and metals accounts, the reverse repo business, the bank’s own portfolio of securities, securities lending and borrowing, collateral management and OTC derivative trades.

Risk concentrations can arise through large exposures (cluster risks) or inadequate diversification of the loan or collateral portfolio. Such concentrations can constitute exposures from borrowers which are domiciled in the same countries or regions, are active in the same industry segment or possess the same collateral. Concentrations can lead to the creditworthiness of borrowers or the recoverability of collateral being impacted by the same economic, political or other factors. Risk concentrations are closely monitored by VP Bank as well as being controlled with corresponding limits and operational checks.

On 31 December 2025, total credit exposure, excluding collateral, amounted to CHF 8.9 billion (as at 31 December 2024: CHF 9.3 billion). The following table shows the composition of on-balance sheet and off-balance sheet items.

Credit exposures

Compared with the previous year, the total volume of credit commitments decreased by CHF 395 million. This decline is mainly attributable to the bank's own bond portfolio (financial instruments measured at amortised cost: CHF –200 million), interbank investments (claims against banks: CHF –104 million) and derivative financial instruments (CHF –62 million). The lending business (claims against customers) remained relatively stable with a volume of CHF 5.9 billion, representing a very moderate decline of CHF 15 million.

Loans to clients are granted on a secured basis as standard. This area primarily includes mortgage business in Switzerland and Liechtenstein as well as in other selected countries, Lombard lending and a small number of special loans.

In the mortgage business, collateral is primarily provided by residential properties, mixed-use or commercial properties in Switzerland and Liechtenstein, as well as in other selected countries. The guidelines and procedures for the valuation and management of mortgage collateral are governed by the provisions of the Capital Adequacy Ordinance in Liechtenstein. Lombard loans are generally granted against the pledging of predominantly liquid and diversified securities portfolios. Life insurance policies may also be used as collateral. Predefined minimum requirements apply to the issuers of the relevant policies. Each issuer must be approved in advance.

The qualitative requirements for eligible collateral and permissible loan-to-value ratios are defined internally. In 2025, further methodological improvements for the quantitative derivation of loan-to-value ratios in margin lending transactions were developed and successfully introduced. Risk concentrations within the collateral are to be avoided through a prudent credit policy.

Within the scope of the client loan business, loans are granted on a regional and international basis to private and commercial clients. The focus remains on the private client business with a volume of CHF 3.7 billion of mortgage credits (31 December 2024: CHF 3.7 billion). From a regional perspective, VP Bank conducts the lion’s share of this business in the Principality of Liechtenstein and in the eastern part of Switzerland.

The ten largest single exposures encompass 13 per cent of total credit exposures (31 December 2024: 12.5 per cent).

The credit regulations form the binding framework for credit risk management and client lending business. In addition to the general guidelines and framework conditions for lending business, they also define the decision-making powers and related ranges for the approval of loans (rules on powers of authority).

In principle, exposures in both private and commercial lending must be covered by the mortgage lending value of the collateral (collateral after hair cut). Counterparty risks are regulated by limits that restrict the amount of an exposure depending on the credit rating, industry, coverage and risk domicile of the clients. VP Bank uses an internal risk classification procedure to assess creditworthiness. Deviations from credit principles (exceptions to policy) are treated in the credit risk management process in accordance with their risk content.

VP Bank enters into both secured and unsecured positions in the interbank business. Unsecured positions result from money market activities (including bank guarantees, correspondent and precious metals accounts), secured positions arising from reverse repo transactions, securities lending and borrowing, collateral management and OTC derivative transactions. Repo deposits are fully secured, and the collateral received serves as a reliable source of liquidity in a crisis. Hence, counterparty risk and liquidity risk can be reduced with reverse repo transactions.

Counterparty risks in the interbank business may only be entered into in approved countries and with approved counterparties. Exposures to banks relate to institutions with a good credit rating (investment grade rating) and registered office in an OECD country. A comprehensive system of limits contains the level of exposure depending on the term, rating, risk domicile and collateral of the counterparty. In this regard, VP Bank relies on the rating by the two rating agencies Standard & Poor’s and Moody’s. OTC derivative transactions may be concluded exclusively with counterparties with whom a netting agreement has been signed.

Credit risks are managed and monitored not only on an individual transaction level but also on a portfolio level. On the portfolio level, VP Bank uses expected and unexpected credit loss estimates to monitor and measure credit risk. The expected credit loss represents the average loss that can be expected within one year. Unexpected credit loss represents a scenario-based unexpected loss from a stressed loss framework that is the difference between the potential loss in a stressed scenario (stressed loss) and the loss to be expected in a normal market environment (expected loss) over one year. In particular, the stressed loss framework takes account of idiosyncratic credit risks. The unexpected loss is limited and monitored by a corresponding credit risk limit, both overall and per loan portfolio.

Credit derivatives (contract volume)

No transactions in credit derivatives were carried out in the past financial year.

Country risk

Country risks arise whenever political or economic conditions specific to a country impinge on the value of an exposure abroad. The monitoring and management of country risk is undertaken using volume limits which restrict the respective aggregate exposures per country rating (Standard & Poor’s and Moody’s). All receivables on the balance sheet are considered in this process; positions in the Principality of Liechtenstein and Switzerland do not fall under this country limit rule.

The risk domicile of an exposure is the basis for recognising country risk. With secured exposures, consideration is usually given to the country in which the collateral is located.

The following table shows the distribution of credit exposures by country rating. Non-rated country exposures are mostly exposures from local business activities (receivables secured by mortgage) of VP Bank (BVI) Ltd.

Country exposure by rating

IFRS 9 Impairment

The additional tables to be disclosed from IFRS 9 Impairment can be seen below.

Credit exposures by rating classes

Expected credit losses according to IFRS 9 Impairment

The following table shows the biggest changes in valuation adjustments by stage.

The following table provides disclosures on assets which were modified and at the same time have a stage 2 and 3 valuation adjustment.

While financial risks are deliberately assumed in order to earn income, operational risks should be avoided by suitable controls and measures or, if this is impossible, should be reduced to a level set by the bank.

There is a wide variety of causes for operational risks. People make mistakes, third parties fail to provide the agreed service, external risks affect the bank or business processes do not work. It is therefore necessary to determine the factors which trigger important risk events and their impact in order to avoid or at least contain them with suitable preventive measures.

The management of operational risks is understood at VP Bank to be an integral cross-divisional function which is to be implemented across all business units and processes on a uniform group-wide basis. The following methods are used:

• The internal control system of VP Bank encompasses all process-integrated and process-independent measures, functions and controls which assure the orderly conduct of business operations.
• Early-warning indicators are used to recognise potential losses in a timely manner and to ensure that enough time still remains for the planning and realisation of countermeasures.
• Significant loss occurrences are recorded systematically and are then evaluated centrally. The findings from the collection of loss data are integrated directly into the risk management process.
• Operational risks are assessed on a top-down and bottom-up basis within the framework of annual group-wide non-financial risk assessments. Based on these assessments, Group Executive Management decides how to deal with the identified risks and, if necessary, determines proactive risk-reducing measures.

The Group Operational Risk & Methodology unit, as a part of Group Compliance & Operational Risk, is responsible for the group-wide implementation, monitoring and further development of the methods and tools used to manage operational risks.

Each person in a management position is responsible for identification and evaluation of operational risks as well as for definition and performance of key controls and measures to contain risks.

Controls are periodically assessed for adequacy and effectiveness. The current operational risk situation is reported to the Executive Board and the Board of Directors on a quarterly basis.

Operational resilience and business continuity management (BCM) are a further important sub-area of operational risk management. Operational resilience refers to the ability of the institution to hedge its critical functions against potential attacks, failures and impairments and to be able to restore them in the event of interruptions. BCM refers to a management method that uses a life cycle model to ensure the continuation of business activities under crisis conditions or at least under unpredictably difficult conditions. The objective of BCM is to systematically prepare for and test the management of extraordinary loss events, so that even in critical situations and emergencies, important processes are not interrupted or only temporarily interrupted and the economic existence of the business remains secure in spite of a loss event. For this purpose, the Board of Directors of VP Bank has clearly defined the duties, powers and responsibilities in connection with operational resilience and BCM.  The group-wide crisis organisation is an integral part of VP Bank and becomes operative as soon as a business-critical loss event occurs or a corresponding situation is threatened. The members of the crisis organisation are regularly trained.

Protection against cyber threats remains a top priority for VP Bank. This protection is ensured by modern IT systems, robust processes and trained and sensitised employees. The requirements for information and cyber security are set out in a company-wide policy approved by the Board of Directors, which defines clear governance structures and responsibilities and follows a risk-based, holistic approach based on internationally recognised standards such as the ISO 27000 series and NIST. VP Bank places particular emphasis on the prevention and identification of vulnerabilities, continuous trend and risk analyses, strengthening cyber resilience and effective incident, crisis and disaster recovery management. Cyber threats are subject to ongoing analysis and appropriate defensive measures are taken depending on the risk. The bank ensures a high level of security through targeted vulnerability management and regular penetration tests. In addition, all employees complete mandatory annual cyber security training to ensure uniform security awareness and consistent compliance with guidelines.

Business risk on the one hand results from unexpected changes in market and underlying conditions with an adverse effect on profitability or equity. On the other hand, it indicates the danger of unexpected losses that may result from management decisions regarding the business policy orientation of the Group (strategic risk). Group Executive Management is responsible for managing business risk. Taking into account the banking environment and the internal corporate situation, this risk is analysed by Group Executive Management, top-risk scenarios are derived and appropriate measures are worked out, the implementation of which is entrusted to the responsible body or organisational unit (top-down process).

Compliance risk is understood to be breaches of statutory and regulatory provisions that can cause significant damage to VP Bank’s reputation or result in sanctions, fines or even in the bank’s licence being withdrawn. The compliance risk of VP Bank consists in particular in the possibility that VP Bank does not or does not sufficiently recognise financial crime compliance risks of its clients and counterparties – such as money laundering, financing of terrorism, violations of sanctions and embargoes, as well as fraud and corruption activities – and has not established appropriate surveillance and monitoring processes/measures for identification, management and limitation of cross-border compliance risks as well as tax and investment compliance risks.

All relevant compliance risks which are of significance for the business and service activities of VP Bank Group are recorded and assessed within the scope of a group-wide, annual non-financial risk assessment. In this regard, all relevant, risk-based compliance controls as well as processes and systems within the overall organisation of VP Bank Group are assessed in order to determine whether they are up to date, appropriate and effective. In this context, the risk-based compliance controls must be proportionate to the respective risk, the management effort and the intended control objectives. VP Bank Group also ensures through regular compliance training that all employees of VP Bank Group are familiar with and adhere to the relevant compliance regulations.

ESG risks and climate-related financial risks (hereinafter: ‘ESG risks’) represent the risk of negative economic impacts for VP Bank that may arise from environmental, social and corporate governance factors. VP Bank does not consider ESG risks to be a separate risk category, but rather a risk driver that can manifest itself in other risk groups or risk categories. VP Bank records, evaluates and takes ESG risks into account in its business activities and when assessing its counterparties and client relationships.

In the lending area, ESG risk monitoring and reporting has been established to manage ESG-related credit risks in the Lombard lending business. Risk monitoring and reporting is based on VP Bank sustainability scores (VPSS) and the compliance standards of the UN Global Compact (UNGC), the UN Guiding Principles on Business and Human Rights (UNGP) and the International Labour Organization (ILO).

Similarly, ESG risk monitoring and reporting has been established in the area of financial investments on the basis of VP Bank sustainability scores (VPSS) in order to manage ESG-related risks in its own investments by specifying a target value for the portfolio.

Reputational risk represents the risk of negative economic effects that could arise as a result of damage to the public image or reputation of VP Bank. Strategic and business risks, operational and compliance risks, financial risks as well as ESG risks can lead to reputational risks and weaken the confidence of employees, clients, shareholders, regulators or the public in general in the bank.

This may result in asset losses or a decline in earnings, for instance due to deteriorating or terminated client relationships, rating downgrades, higher refinancing costs or more difficult access to the interbank market.

Reputational risks are monitored by Group Executive Management.