Risk management in the Company is an ongoing, continuous process. A strategic risk management system is provided to ensure effective risk management and the process of implementing the Development Plan and achieving the set goals.

In order to implement the Company's Development Plan for 2025, the following risk mitigation measures were implemented in 2025.

Regarding the increase in the NPL level:

On a regular basis, the Company conducts activities on problematic projects, including work with current overdue debts, timely recognition of projects as "problematic" and transfer to debt collection units in accordance with procedures and deadlines. Work is underway to increase the loan portfolio by attracting bona fide borrowers. As of 31.12.2025, the NPL level was 5.56%. The efficiency of "NPL90+" for 2026 in the Development Strategy of Kazagrofinance JSC is set at no more than 9.5%.

Regarding reputational risk:

On an ongoing basis , the Society conducts preventive measures to prevent corruption crimes committed by the Company's employees. On an annual basis, the Company purchases services for daily monitoring of electronic and print media, as well as the Internet, and produces an annual content analysis. According to the report "Analysis of mentions in Kaznet", the population of Kazakhstan mentions KazAgroFinance JSC mainly in a positive way. way.

Regarding the risk of loss of collateral and leasing items:

As part of the work carried out with suppliers of leased items, the reliability of suppliers is assessed on an ongoing basis at the selection stage in order to prevent the risks of late delivery of leased items, followed by work on early notification of suppliers of the due dates.

Regarding HR risks (Staff turnover) (Non-fulfillment of GNI/incompetence of employees):

On a regular basis, the Company conducts professional development activities for employees at the expense of the employer. Every year, business processes are improved (automated) in order to create an effective, consistent business process.

Regarding risks in administrative and economic activities:

On an ongoing basis, the Company carries out business continuity measures, which ensures timely and holistic responses in cases of interruptions in the functioning of the Company, restoration of activities and minimization of losses. The Company periodically conducts business continuity testing.

Regarding IT risks

The Company provides external data backup. A data processing center (DPC), which is a geographically distributed cluster (duplicate) configuration of existing servers connected to a common storage network. The nodes of a distributed cluster are placed on a backup site, forming a single system. This ensures continuous availability of services even in the event of loss of the main data center. The Company has also developed an Information Systems Continuity Plan.

Regarding compliance risks

Compliance risk management in the Company is an integral part of the Company's risk management system. The main purpose of compliance risk management is to minimize and/or maintain compliance risks at an acceptable level, such as incurring financial losses from the Company and applying legal sanctions to it due to non-compliance with the requirements of the legislation of the Republic of Kazakhstan, regulatory legal acts of the authorized body, internal documents and procedures of the Company, as well as legislation of foreign countries that affect activities of the Company and recognized by the Republic of Kazakhstan.

Other risk management issues

Risk management work is carried out on an ongoing basis, including an analysis of seized machinery and equipment for the period 2019-2025, an analysis of the loan portfolio of branches in order to determine the rating of the branch, insurance of leasing items and collateral of the Company is monitored and monitored.

Also in 2025, key risk indicators were approved in order to detect the likelihood of risks early. The Risk Map and register were approved, which made it possible to determine the level of each identified risk for subsequent decision-making on risk reduction. Following the results of the year, the Company's structural divisions implemented the items stipulated in the Action Plan for Critical Risk Management, the Action Plan for Improving the Corporate Risk Management System and the Action Plan for Increasing the Risk culture, which allowed minimizing the Company's risks.

In 2026, the Company will continue to work on improving the corporate risk management system in accordance with the best international risk management practices