Compliance report

No significant environmental, social and/or governance-related incidents occurred during FY26. These include incidents of legal non-compliance (whether under investigation, pending finalisation or finalised), directives, compliance notices, warnings, investigations and any public controversies.

No fines, settlements, penalties, or other monetary losses were suffered concerning ESG incidents during FY26.

REGULATORY COMPLIANCE REPORT

The IRCC oversees regulatory compliance responsibilities. The Committee monitors, assesses, researches and reports on the regulatory environment in which Blu Label operates. The IRCC reports to the Audit, Risk and Compliance Committee ("ARCC").

Compliance risk – We ensure that we have appropriate controls in place to comply with ongoing regulatory requirements and we have no appetite for material non-compliance.

The process of compliance management encompasses:

identifying and prioritising all Acts and regulations at a national level applicable to Blu Label;
incorporating regulatory requirements into control measures such as standard operating procedures, processes, manuals and policies;
ensuring an independent and adequately resourced compliance function;
supporting the compliance function so that it is innovative and agile while adhering to legal and regulatory requirements;
effectively support risk and compliance objectives across the Company;
recommending corrective measures or steps to ensure compliance; and
monitoring compliance through the adequacy and effectiveness of control measures.

The risk of non-compliance is being managed through:

the bi-annual review and update of the Blu Label regulatory universe;
the compilation of compliance risk management plans for high-risk legislation utilising an external service provider; and
the continuous monitoring of the regulatory environment.

The regulatory environment changes constantly. We proactively contribute to and manage our regulatory environment by considering the interests of all our stakeholders and clients.

The Board is satisfied that Blu Label has complied with all relevant provisions of the Companies Act 71 of 2008 of South Africa and the JSE Listings Requirements and has complied with Blu Label's MOI during the financial year.

No substantial complaints have been received concerning breaches of customer privacy, categorised by complaints from data subjects and complaints from the Information Regulator (IR). A request for information was received from the IR with respect to one of our subsidiaries during FY26. The information requested was provided to the IR within the stipulated time period. A response was obtained from the IR, which included certain immaterial remediation issues which have been put in place. No further correspondence has been received regarding this matter from the IR.

TAXATION COMPLIANCE

Taxation is managed as part of the regulatory compliance process managed under the IRCC and overseen by the ARCC. There were no significant penalties or disputes with the South African Revenue Service during the year under review. Expert advice is obtained in managing compliance with any complex areas of tax legislation. Blu Label does not have any significant foreign subsidiaries.

The total tax incurred by Blu Label in the current year amounted to R1.1 billion. The total amount consists of the following categories of taxes:

Category	2026 R'000	2025 R'000
Income taxes	76 777	330 818
Property taxes	7 805	2 680
Net non-creditable/(creditable) VAT	655 572	449 875
Employer-paid payroll tax	356 482	268 081
Other taxes	147	–

The information below summarises how Blu Label has managed the requirements of two pieces of significant South African legislation:

PROTECTION OF PERSONAL INFORMATION ACT, 2013

The Protection of Personal Information Act, 2013 ("POPIA") gives effect to section 14 of the Constitution, which provides everyone the right to privacy. The Act protects personal information processed by public and private bodies and balances the right to privacy against other rights such as access to information.

The following POPIA initiatives have been embedded to ensure compliance at 31 May 2026:

POPIA information update sessions have been presented to the various subsidiaries.

POPIA-related policy documents continued to be updated.

Promotion of Access to Information Act, No 2 of 2000 ("PAIA") manuals have been updated.

Record of Processing Activities ("RoPAs") and POPIA Impact Assessments ("PIAs") have continued to be updated to identify and mitigate POPIA gaps. These RoPAs and PIAs are ongoing based on new products or initiatives being introduced throughout Blu Label.

CYBERCRIMES ACT, 19 OF 2020

Blu Label operations rely heavily on technology platforms to facilitate service delivery, which increases the risk of cybercrime. Therefore, it is critical to maintain the integrity and stability of key IT systems to protect stakeholder interests against increasingly sophisticated targeted attempts at digitally assisted fraud, one of the main objectives of the Cybercrimes Act, 19 of 2020.

Cybersecurity threats remain a critical ongoing risk and as a result makes up a significant part of our technology investments.

Stringent standards for information and infrastructure security controls are constantly being reviewed and reinforced to ensure our efforts continue strengthening our cybersecurity posture. We proactively assess our vulnerabilities and risk of exposure on an ongoing basis while driving cyber risk prevention, assessment and education programmes to maintain vigilance. Blu Label is embedding security as a core component within the platform delivery via governed development mechanisms and implementing detection capabilities and response processes in our environment.

Significant progress has been made in the implementation of our National Institute of Standards and Technology ("NIST") Cybersecurity Framework, in accordance with our approved cybersecurity strategy. The Group has implemented a substantial number of the applicable NIST controls across the NIST control domains. Maturity assessments have been performed to measure the effectiveness of implemented controls and to identify areas requiring further enhancement. The outcomes of these assessments have been independently reviewed through internal audit to provide assurance over the effectiveness of the Group's cybersecurity programme and to support continuous improvement of the overall cyber control environment.

As cybersecurity threats continue to evolve, Blu Label remains focused on strengthening its cyber defence capabilities, improving operational resilience and ensuring ongoing compliance with applicable regulatory and legislative requirements. This includes continued investment in preventative, detective and responsive security capabilities to support sustainable and secure business operations.

The following has been accomplished to date:

	INITIATIVES		DESCRIPTION
	Implementation of Security Operations Centre ("SOC") services.		Our SOC has been fully implemented and is currently operational, which provides 24/7 cybersecurity monitoring for our environment.


	Security awareness training campaigns through Meta 1st, our security training platform.		Regular security awareness training campaigns are rolled out to staff, covering various security domains.


	Designed and implemented cybercrimes and incident management processes.		Cybercrimes and incident management processes have been implemented. Processes are updated periodically based on our continuous improvement initiatives from our cybersecurity programme.


	An annual review of our cyber-related processes was conducted.		Internal audit performed reviews of processes supporting compliance with the Cyber Crimes Act 19 of 2020.


	Developed incident response and incident response testing as well as scenario planning.		Incident response processes are still in place and scenario testing will be performed during FY27.


	Developed and implemented an ISMS (Information Security Management System) aligned to ISO 27001.		Cybercrimes and incident management processes are still in effect. Processes are updated periodically based on our continuous improvement initiatives from our cybersecurity programme. We are certified on ISO 27001:2022 for our ISMS. Our core trading platform and environment operate stringent security controls to safeguard our customer and employee data. Maintenance and continuous improvement activities of our ISMS are ongoing. As part of this programme, we invest heavily in our continuous improvement initiatives which actively contribute to our security position and the maturity thereof. Regular surveillance audits are conducted to ensure the continued compliance and maintenance of the certification.