Exxaro Resources Limited
Environmental, social and governance report for the year ended 31 December 2025 
Prioritising good governance

Risk and business resilience committee report

Dear shareholders,

I am pleased to present the RBR committee report for the year ended 31 December 2025. During the year, the committee focused on enhancing Exxaro’s ability to achieve our strategic objectives, maintain our reputation as a good corporate citizen and strengthen the resilience to adapt appropriately in a changing environment.

Peet Snyders

RBR committee chairperson

Committee overview
Composition

The committee has five standing members, the majority of whom are independent non-executive directors.

The board is satisfied that the members have a suitably balanced mix of skills and experience to enable the RBR committee to discharge its mandated functions.

Following Ben Magara’s appointment as CEO on 1 April 2025, he stepped down as a committee member but has a standing invitation to all meetings as the new CEO. To ensure adequate succession and continuity of knowledge, Isaac Malevu was appointed as a member of the committee on 5 June 2025.

Standing invitees to committee meetings include the CEO, FD, executive head: strategy and business development and group manager: risk. Other individuals, including members of management, external consultants and service providers are invited to attend the committee’s meetings from time to time in consultation with the committee chairperson.

Gender and racial diversity

Gender and racial diversity
Meetings

The committee held four scheduled meetings as determined by its terms of reference. The meeting attendance illustrates a high level of commitment from its members. The table below provides an overview of meeting attendance in 2025.

Members   Designation   Attendance at quarterly meetings
Peet Snyders*   Independent non-executive director and RBR committee chairperson   4/4
Karin Ireton   Independent non-executive director   4/4
Ben Magara**   Independent non-executive director   1/1
Nondumiso Ketwa   Independent non-executive director   4/4
Mandlesilo Msimang***   Non-executive director   3/3
Chanda Nxumalo   Independent non-executive director   3/4
Isaac Malevu****   Non-executive director   3/4
* Classified as independent until 31 December 2025.
** Stepped down as member of the committee following his appointment as CEO on 1 April 2025.
*** Resigned on 15 September 2025.
**** Appointed on 5 June 2025.

Role and purpose

The committee is a board committee in terms of section 72 of the Companies Act, the company’s MoI and King IV.

Risk management

The committee’s primary role is to implement an effective risk management policy and plan to enhance the group’s ability to achieve its strategic objectives, ensuring that risk disclosure is comprehensive, timely and relevant.

Risk management is effected by the board, management and other personnel. It is applied in strategy setting and across the group to identify potential events that may affect the organisation, manage risks within our risk appetite and provide reasonable assurance regarding the achievement of the organisation’s objectives. Risk governance involves the structures and mechanisms within the organisation that guide decision making and implementation of risk management.

The committee is responsible for reviewing the ERM process, including key risks facing Exxaro and the responses to address these risks. It focuses on:

  • Strategic risks
  • Financial risks (technical debates on managing financial risk take place in audit committee meetings, but financial risks are part of the overall enterprise risk register, over which this committee has oversight)
  • Information management risks
  • Operational risks
  • Regulatory compliance risks
Business resilience

Business resilience is an organisation’s ability to adapt to a changing environment to achieve its objectives, survive and prosper. Risk, incident, crisis and business continuity management are the four key elements of business resilience.

The committee’s role is to oversee the appropriateness of Exxaro’s crisis response plans and frameworks.

Terms of reference

The committee’s terms of reference are reviewed and approved annually by the board. The November 2025 review ensured alignment with the current status of the business.

King V was implemented on 31 October 2025. Any changes required to align the terms of reference with King V will be presented to the committee following a gap analysis.

Performance evaluation

While there is no regulatory requirement to conduct annual external independent performance assessments, King IV emphasises the board’s responsibility to regularly evaluate its effectiveness and that of its committees. In support of effective governance outcomes, Exxaro conducts external independent board and committee performance assessments every third year.

The internal evaluation of the committee’s performance and effectiveness was finalised in the first quarter of 2026. The results indicate a committee that provides effective oversight to ensure the risk management framework remains robust, current and aligned with the organisational strategy and external developments. Areas for increased focus include people risk, IT risk, ESG risk and the ongoing impact of extreme weather on operations and affected communities.

The committee fulfilled its mandate during 2025, and it remains an effectively functioning and contributing arm of the board.

2025 focus areas

  • Considered the strategic risk register, emerging risks and the interconnectedness of risks and their influence on the business
  • Reviewed Exxaro’s delegation of authority framework, policies, and finance and banking arrangements framework to ensure efficiency in business execution and collaboration
  • Considered the group’s risk appetite and risk metrics to enable early detection and response to potential threats
  • Oversaw a rolling cybersecurity programme and noted the efforts to advance cybersecurity resilience through strategic initiatives designed to safeguard critical assets and mitigate emerging threats
  • Oversaw material litigation matters
  • Considered Exxaro’s sustainability RBR report, including health performance, climate change and water security
  • Remained informed of Exxaro’s initiatives to reduce scope 3 emissions through the decarbonisation roadmap
  • Reviewed the crisis management policy for recommendation to the board
  • Reviewed Exxaro’s regulation and compliance universe and level of compliance
  • Confirmed the annual insurance renewal was effected on favourable terms
  • Reviewed the efficiency of Exxaro’s occupational health programme and compliance with legislation and industry best practice
Enterprise risk management

The committee tests the robustness of Exxaro’s risk process and its effectiveness in identifying and assessing risks that may affect the company’s ability to achieve its strategic objectives. The risk register is continually assessed for alignment with the theme of positioning Exxaro to win. The key risk areas were themed in line with the strategic focus areas, and the energy business strategic risk profile was included. In addition, our benchmarking exercise confirmed that Exxaro’s risk landscape aligns with the global context.

Emerging risks are uncertain and not fully predictable and are therefore closely monitored to enable the company to respond early, adapt strategy and avoid being caught off guard when these risks mature.

The committee is satisfied that the company’s strategic risk profile is robust, reflects relevant risks that apply to Exxaro’s industry peers and adequately covers the group’s material risks.

The committee reviewed and recommended to the board the group ERM framework. The purpose of the review was to:

  • 1

    Ensure alignment with current business objectives and the operating context

  • 2

    Benchmark against key governance best practices

  • 3

    Update roles and responsibilities concerning the risk governance structure

  • 4

    Review key components within the framework, including the updated risk appetite framework and the new risk principle regarding the interconnectivity of risk

Strategic policies guide operational policies. A revised group policy framework was developed and is being enhanced to provide an overarching structure for the arrangement, development and review of the group’s statements, frameworks, policies, procedures, standard operating procedures and guidelines.

Key compliance risks related to Exxaro’s licence to operate
Regulatory compliance

The group legal and compliance department conducted compliance workshops across the organisation and developed an initial overview of the consolidated regulatory universe. This overview outlines the top 10 pieces of legislation that apply to the group and assesses them using the approved risk ranking matrix.

During the period under review, Exxaro timeously submitted comments to the DMPR in respect of the Mineral Resources Development Bill, following inputs received from the group.

Management of environmental impacts

The committee considers Exxaro’s sustainable impact targets and the KPI assessment report.

The LSP, a key project toward achieving the short-term goal of reducing emissions by 40% by 2030, was monitored through Cennergi.

In October 2025, the DWS approved the renewal of Matla’s WUL. This renewal confirmed that all mining operations and associated water use at Matla were fully licensed and in compliance with the provisions of the National Water Act, 1998. It reinforced the mine’s commitment to responsible water management and regulatory adherence.

The group GHG policy is being finalised and will guide Exxaro’s approach to carbon emissions accounting, reporting and management in line with global trends and national climate policies.

Other licence to operate compliance matters

On 24 June 2025, Exxaro received the renewal of the waste management licence for the Matla brine ponds. This licence ensures that the Matla water treatment plant and brine ponds are operational for 10 years.

Predictive and proactive reporting and engagement with key stakeholders based on key risks

We apply predictive and proactive reporting in Exxaro’s analysis and reporting. Coal Resources and Reserves are estimated on an operational or project basis, in line with the SAMREC Code and SANS (10320):2020 edition codes for South African assets, and the JORC code (2012) for the Australian coal property.

Exxaro’s annual estimation and reporting process is managed through Exxaro geosciences, LoM policies and associated reporting and estimation procedures, which are reviewed annually and updated if required. The committee reviews and recommends the Coal Resource and Reserve statement annually.

Information technology governance to ensure the incorporation of relevant risks in enabling strategy delivery and business resilience

Management provides the committee with in-depth reports on information management strategy, operational excellence, information management governance, the information management portfolio and enterprise architecture, information management risk management and the ERP journey.

Exxaro adopted the National Institute of Standards and Technology cybersecurity framework to guide our approach to cybersecurity risk affecting systems, people, assets, data and capabilities. The framework is supported by the ISO 27001 standard, which outlines the controls and procedures needed to drive a robust cybersecurity programme.

Cybersecurity training is ongoing, and consequence management is enforced when users are in breach. The company continues to advance its cybersecurity resilience through a series of strategic initiatives designed to safeguard critical assets and mitigate emerging threats. Furthermore, the professional in training process was implemented to address information management gaps and create future talent pipelines.

Intellectual capital (integrated report)

Business resilience and business strategy compliance

The ESG policy was reviewed and approved by the relevant governance structures. The policy sets out the principles that inform our approach to ESG matters and describes our commitment to sustainability and maintaining sound governance procedures.

The committee was briefed on the decarbonisation roadmap, which is undergoing an external peer review to ensure credibility, feasibility of assumptions, gap analysis, risk management and the correct application of decarbonisation roadmap development principles.

The committee was satisfied with updates on the implementation and enforcement of the insider dealing policy, which was approved by the board.

The committee oversaw the directors’ and officers’ liability programme and reviewed the insurance renewal programme. This included stress testing for worst case scenarios by the International Mining Industry Underwriters and assessment of the maximum foreseeable loss at Grootegeluk.

The committee was thoroughly updated regarding the class action.

Other key matters in review
Strategic security

The committee receives reports detailing the crime landscape, causative factors and impacts on the company and the country.

B-BBEE

Exxaro achieved a B-BBEE level 2 rating, against a target of level 3.

South African National Aids Council

In response to the rise in occupational disease cases, Exxaro partnered with the SANAC Private Sector Forum to implement a communitywide HIV and TB screening programme across host communities in Mpumalanga.

Safety

Exxaro’s safety improvement initiatives, monitored by and reported to the committee, included the following:

The sustainability summit held on 11 April 2025 aimed to bring together stakeholders to demonstrate Exxaro’s commitment to employee health, safety and wellbeing.

Any HPI places Exxaro’s strategic goal of zero fatalities at risk and impacts the achievement of zero harm. All HPIs are presented to the committee, investigated by management, and solutions are shared across the group for implementation and to test their effectiveness in eliminating repeat incidents.

As part of empowering Exxaro’s health and safety representatives to be key safety, health and environmental drivers in their lines of work, the mines ran several training programmes, which included coaching and mentoring.

Leadership interventions included executive committee members communicating risk awareness messages to the broader workforce on the identified safety risks as part of demonstrating incredible leadership.

Key actions

2026
focus areas

  • Monitor the class action served on Exxaro in November 2023 and its impacts on the group as a responsible corporate citizen, while ensuring preventive measures regarding occupational diseases are properly implemented
  • Oversee the implementation of the water management plan at all Exxaro mines, including closed mines, and any plans to mitigate these, including an update to the groundwater analysis model to include climate change impact on operations and water sources
  • Ensure effective plans are in place based on the impact of business disruption (plans are up to date and no significant incidents occurred that led to business disruption)
  • Review Exxaro’s risk appetite
  • Review Exxaro’s key compliance risks related to licence to operate
  • Recommend appropriate predictive and proactive reporting and engagement with stakeholders (including the integrated report) based on key risks
  • Oversee the implementation of the revised governance of technology and information plan, ensuring technology and information risks are appropriately incorporated to support strategy delivery and business resilience
  • Oversee digital transformation, including artificial intelligence
  • Review business resilience key elements to ensure business strategy compliance
  • Oversee implementation of the decarbonisation plan
  • Oversee the risks related to acquisitions and diversification
Confirmation

The committee is satisfied that it has discharged its responsibilities and fulfilled its mandate in accordance with its terms of reference, the Companies Act and King IV.

On behalf of the RBR committee

Peet Snyders
RBR committee chairperson

29 April 2026