Citycon Oyj

Governance Information • Feb 6, 2020

CORPORATE

GOVERNANCE

STATEMENT 2019

I. INTRODUCTION

I I . D E SC R I P T I O N S CO N C E R N I N G CORPORATE GOVERNANCE

1. Citycon's corporate governance structure 3
2. General Meeting of Shareholders 4
3. Board of Directors 4
4. Board Committees	8
5. Chief Executive Officer (CEO)	9
6. Corporate Management Committee	9
7. Remuneration 10

I I I . D E SC R I P T I O N S O F I N T E R N A L CO N T RO L P ROC E D U R E S A N D T H E M A I N F E AT U R E S OF RISK MANAGEMENT SYSTEMS

1. General description of risk management 11
2. General description of internal control	12
3. International COSO framework as the foundation for internal control	12
4. Control activities	13
5. Information and communication	13
6. Monitoring activities	13

IV. OTHER INFORMATION

1. Description of the organisation of the company's internal audit and of the main principles followed
in the internal audit	14
2. Related party transactions	14
3. Main procedures relating to insider administration	15
4. Auditor and remuneration paid to the auditor	15

CONTENTS HOW TO READ CITYCON'S 2019 REPORTS

Our reporting in 2019 consists of the Sustainability Accounts, the Financial Review and the Corporate Governance Statement. More information on Citycon, our strategy and value creation can be found on our renewed 'Citycon Strategy Review' section on our website.

To make the report more reader-friendly, this report, as well as supplementary information and additional case examples, can be found on our webpage. You can recognise the links to this material through this symbol:

SUSTAINABILITY ACCOUNTS

Describes Citycon's environmental and social performance, as well as sustainability highlights in 2019.

FINANCIAL REVIEW

Covers Citycon's financial performance in 2019, operational key figures, the report by the Board of Directors and the risk management review.

CORPORATE GOVERNANCE STATEMENT Explains Citycon's structure of governance and the Board of Directors' activities in 2019.

CITYCON GROUP'S CORPORATE GOVERNANCE STATEMENT FOR THE FINANCIAL YEAR 2019

I. INTRODUCTION

Citycon Oyj (Citycon or company) is a Finnish public limited liability company listed on the Nasdaq Helsinki Ltd (the Helsinki Stock Exchange). Citycon Oyj and its subsidiaries constitute the Citycon group.

Citycon's corporate governance principles are based on legislation in force in Finland, the rules and regulations issued for listed companies by the Helsinki Stock Exchange and the Finnish Financial Supervisory Authority as well as Citycon's Articles of Association. Corporate governance in Citycon's subsidiaries is also governed by the laws of the country in which the subsidiary is domiciled, and by each subsidiary's Articles of Association. In addition, Citycon applies the Finnish Corporate Governance Code 2015 and as of 1.1.2020 Finnish Corporate Governance Code 2020 published by the Finnish Securities Market Association and Citycon's own Code of Conduct and Corporate Governance Guidelines.

This corporate governance statement (CG Statement) has been prepared in accordance with the recommendations of the Corporate Governance Code 2020 (Corporate Governance Code).

In 2019, Citycon followed the recommendations of the Corporate Governance Code without deviation.

This CG Statement has been prepared as a separate report, distinct from the Report by the Board of Directors. The Audit and Governance Committee of the Board of Directors has reviewed the CG Statement on 4 February 2020. Ernst & Young Oy, the company's auditor, has verified that the CG Statement has been issued and that the descriptions of the internal control procedures and the main features risk management systems related to the financial reporting process is consistent with the company's Financial Statements.

This CG Statement was published on 6 February 2020 simultaneously with Citycon's Financial Statements and the Report by the Board of Directors for 2019.

II. DESCRIPTIONS CONCERNING CORPORATE GOVERNANCE

Citycon's statutory bodies are the General Meeting of Shareholders, the Board of Directors and the CEO. The General Meeting of Shareholders elect members to the company's Board of Directors, and the Board of Directors appoints the CEO. The Board of Directors' work is enhanced by three Board committees whose members are elected by the Board of Directors among its members. In managing the company's business operations, the CEO is assisted by the Corporate

Management Committee whose members are appointed, upon the CEO's proposal, by the Board of Directors. Additionally, the CEO is assisted by the Extended Management Committee, which aims to serve as a channel of communication without decision-making power.

The work of the Board of Directors and its committees, the CEO and the Corporate Management Committee is governed by the Corporate Governance Guidelines approved by the Board of Directors. These guidelines contain charters for the Board and its com-

1. CITYCON'S CORPORATE GOVERNANCE STRUCTURE

CORPORATE GOVERNANCE STRUCTURE 2019

The Corporate Governance Code is available on the Securities Market Association's website at cgfinland.fi. This CG Statement and the same statements for previous years since 2010 are available on the company website at citycon.com/corporate-governance.

mittees, guidelines for the division of duties between the decision-making bodies, and guidelines for the arrangement of internal control and risk management.

2. GENERAL MEETING OF SHAREHOLDERS

Citycon's shareholders exercise their decision-making power at the General Meeting. According to the company's Articles of Association, Citycon's Annual General Meeting is held annually within six (6) months of the expiration of the financial period. Extraordinary General Meetings are convened whenever deemed necessary for decision-making purposes or when required by law.

The company publishes the notice of a General Meeting which includes a proposal for the meeting's agenda, the documents to be presented to the General Meeting and the Board of Directors' resolution proposals on the company's website, no later than three weeks prior to the General Meeting. The notice of the General Meeting is also published as a stock exchange release. If new persons are proposed for the Board of Directors, information about the candidates is presented on the company website.

A shareholder is entitled to demand a matter for discussion at a General Meeting if such a matter belongs to the General Meeting according to the Finnish Limited Liability Companies Act and a demand is made by giving notice to the company well in advance so that the matter can be included in the notice of a General Meeting.

Citycon strives to facilitate the participation of its shareholders in General Meetings by arranging such meetings in a manner that enables both Finnish and international shareholders to participate in the meeting and to exercise their right to vote, ask questions and speak at the meeting.

Citycon's Annual General Meeting (AGM) 2019 was held on 13 March 2019. Citycon published the decisions made by the AGM 2019 in a stock exchange release and on its website.

3. BOARD OF DIRECTORS

3.1 The composition of the Board of Directors

According to Citycon's Articles of Association, the company's Board of Directors consists of a minimum of five and a maximum of ten members. The Articles of Association do not contain any regulations on a specific procedure according to which the Board members are to be appointed.

The General Meeting of shareholders decides on the number of members of the Board of Directors and elects them at the Annual General Meeting and, when necessary, Extraordinary General Meetings.

According to the Corporate Governance Code, the majority of the members of the Board of Directors must be independent of the company. In addition, a minimum of two of these independent members must also be independent of the company's significant shareholders. The Board of Directors evaluates its members' independence annually.

The Board of Directors' proposal to the General Meeting on the composition of Citycon's Board of Directors is prepared by the Nomination and Remuneration Committee of the Board of Directors. The company's strategy and the requirements set by its operations, the company's development stage and the diversity principles specified by the company for the Board (described in 3.4 Diversity of the Board of Directors) shall be taken into account when planning the composition of the Board of Directors.

The Board of Directors elects the Chairman and one or more Deputy Chairmen from among its members.

Citycon's AGM 2019 set the number of Board members at nine. The following Board members were re-elected: Chaim Katzman, Bernd Knobloch, Arnold de Haan, David Lukes, Andrea Orlandi, Per-Anders Ovin, Ofer Stark and Ariella Zochovitzky,

and a new member of the Board, Alexandre (Sandy) Koifman. The members of the Board of Directors were elected for a term of one year that ends at the close of the first AGM following their election.

The Board of Directors evaluated its members' independence in its formative meeting on 13 March 2019. The Board of Directors concluded that all Board members, with exception of Ofer Stark, are independent of the company. Citycon engaged Starkitect Studio Inc., a company acting through Ofer Stark as consultant, to provide consultancy services during the six months' period of 7 February—7 August 2019 and therefore Ofer Stark is not evaluated independent of the company.

Arnold de Haan, Bernd Knobloch, Alexandre (Sandy) Koifman, David Lukes, Per-Anders Ovin and Ariella Zochovitzky were evaluated independent of the company's significant shareholders. Chaim Katzman and Ofer Stark are, or have recently been, in the service of or Board members of Citycon's main shareholder, Gazit-Globe Ltd., or its affiliated companies, and Andrea Orlandi is in the employ of Canada Pension Plan Investment Board, the parent company of CPP Investment Board European Holdings S.àr.l, which is a significant shareholder in the company, and therefore the three are not evaluated independent of the company's significant shareholders.

The Board Chairman in 2019 was Chaim Katzman with Bernd Knobloch serving as Deputy Chairman.

Minutes of the General Meetings, General Meeting documents and summaries of the resolutions of each General Meeting since 2010 are available in Citycon's GM archive at citycon.com/agm-archive. Further information on General Meetings and shareholder rights can be found at citycon.com/general-meeting.

3.2 Information about Board members, 31 December 2019

Board Chairman CHAIM KATZMAN

Member and Chairman of the Board of Directors since 2010

LL.B., Israeli and US citizen, born 1949

Main occupation: Norstar

Holdings Inc., Founder, Controlling Shareholder and Board Chairman since 1991 and CEO since 2017; Gazit-Globe Ltd., Executive Chairman of the Board of Directors since 1998 and CEO since 2018; Regency Centers Corporation, Vice Chairman of the Board since 2017; Atrium European Real Estate Ltd, Board Chairman since 2008

The Board's assessment of independence: Independent of the company

Citycon shares*: 35,771

Membership in Citycon's Board committees:

Nomination and Remuneration Committee, Chairman

Deputy Chairman of the Board BERND KNOBLOCH

Member of the Board of Directors since 2012, Deputy Chairman since 2013

University degrees in Law and Business Administration, German citizen, born 1951

Main occupation: Professional non-executive director

The Board's assessment of independence: Independent of the company and significant shareholders

Citycon shares*: 21,737

Membership in Citycon's Board committees:

Audit and Governance Committee Strategy and Investment Committee

ARNOLD DE HAAN

Member of the Board of Directors since 2014

LL.M, Dutch citizen, born 1954

Main occupation: Boishaen B.V., Founder and Managing Director since 2008

The Board's assessment of independence: Independent of the company and significant shareholders

Citycon shares*: 81,493

Membership in Citycon's Board committees:

Audit and Governance Committee Nomination and Remuneration Committee

Strategy and Investment Committee

ALEXANDRE (SANDY) KOIFMAN

Member of the Board of Directors since 2019 M.Sc. (Mathematics & Economics),

French and Swiss citizen, born 1953

Main occupation: Efficient Frontiers Investing SA, Managing Director

The Board's assessment of independence: Independent of the company and significant shareholders

Citycon shares*: -

Membership in Citycon's Board committees:

Audit and Governance Committee Nomination and Remuneration Committee

DAVID LUKES

Member of the Board of Directors since 2017

M.Sc. (real estate development), Architect, US citizen, born 1970

Main occupation: Site Centers Corp. (former DDR Corp.), CEO and President since 2017

The Board's assessment of independence: Independent of the company and significant shareholders

Citycon shares*: 1,760 Membership in Citycon's Board committees:

Strategy and Investment Committee, Chairman

* Includes the shares and share-based rights in the company and companies belonging to the same group held by the director and corporations over which he or she exercises control

ANDREA ORLANDI

Member of the Board of Directors since 2014 MBA (INSEAD), Italian citizen, born 1971

Main occupation: Canada Pension Plan Investment Board (CPPIB), London, Managing Director, Head of Real Estate Investments Europe since 2014

The Board's assessment of independence: Independent of the company

Citycon shares*: -

Membership in Citycon's Board committees:

Nomination and Remuneration Committee

Strategy and Investment Committee

OFER STARK

Member of the Board of Directors since 2018

M.Arch, Israeli and US citizen, born 1972

Main occupation: Starkitect Studio, Founder and Principal since 2008; PrimeMed Realty LLC, Co-Founder and Principal since 2017

The Board's assessment of independence: Not independent of the company or significant shareholders

Citycon shares*: -

Membership in Citycon's Board committees:

Strategy and Investment Committee

PER-ANDERS OVIN

Member of the Board of Directors since 2013

M.Sc (Economics), Swedish citizen, born 1956

Main occupation: Mengus Stockholm AB, Board Chairman, Partner and Owner since 2005; Marrakech Design/Ovin Consulting AB, Owner since 2003

The Board's assessment of independence: Independent of the company and significant shareholders

Citycon shares*: 7,400

Membership in Citycon's Board committees:

Audit and Governance Committee Nomination and Remuneration Committee

ARIELLA ZOCHOVITZKY

Member of the Board of Directors since 2009

B.A. (Economics and Accounting), CPA (Israel), MBA, Israeli citizen, born 1957

Main occupation: C.I.G. Consultants Ltd., General Manager and Partner since 2001; C.I.G.

Zochovitzky Ltd., General Manager and Partner since 2012

The Board's assessment of independence: Independent of the company and significant shareholders

Citycon shares*: 2,340

Membership in Citycon's Board committees:

Audit and Governance Committee, Chairman

Nomination and Remuneration Committee

* Includes the shares and share-based rights in the company and companies belonging to the same group held by the director and corporations over which he or she exercises control

Board members' personal details can also be found on the company's website at citycon.com/board-directors and information on their personal shareholdings in Citycon at citycon.com/managers-holdings-shares.

3.3 Description of the charter and operations of the Board of Directors The duties of the Board, as set out in the charter of the Board of Directors included in company's Corporate Governance Guidelines, are described on the company's website at citycon.com/corporate-governance/board-of-directors.

The Board of Directors' meeting schedule is based on the company's year clock shown on the right. Additional meetings are held when deemed necessary.

The Board of Directors constitutes a quorum if more than half of its members are present. Considering the Board of Directors' international composition, the use of telephone or video conferencing for meetings is possible.

The Board of Directors evaluates its operations and working methods annually. In 2019, the evaluation was conducted as self-evaluation.

In 2019, Citycon's Board of Directors convened a total of 16 times during the year. The average attendance rate at Board meetings was 94%.

BOARD OF DIRECTORS' YEAR CLOCK

* Subject to an authorisation granted by the General Meeting of Shareholders

3.4 Diversity of the Board of Directors

Citycon's Corporate Governance Guidelines states the principles of diversity for the Board of Directors. According to the principles, when planning the composition of the Board, the Nomination and Remuneration Committee shall take into account the candidates' background, independence, age, gender, skills and experience, the suitable number of candidates and their opportunity to devote a sufficient amount of time to their work. In addition, the company's strategy, the requirements set by the company's operations and the company's stage of development shall be taken into account. The Nomination and Remuneration Committee shall take account of proposing both genders as members of the Board of Directors.

In 2019, the composition of Citycon's Board of Directors was balanced with regard to the diversity principles. The members of the Board had extensive and diverse expertise and an international background. The members' competence, education, experience and seniority complemented each other. The directors represented eight nationalities. Both genders were represented on Citycon's Board of Directors in accordance with the objectives specified by the company.

GENDER*

INDEPENDENCE OF SIGNIFICANT SHAREHOLDERS*

DURATION OF BOARD MEMBERSHIP

4.1 Composition and operations of the committees

4. BOARD COMMITTEES

Citycon's Board of Directors is assisted by three committees set up by the Board of Directors: the Audit and Governance Committee, the Nomination and Remuneration Committee and the Strategy and Investment Committee. Each committee's main duties and working principles are established in writing by the committee charters included in Citycon's Corporate Governance Guidelines.

The Board of Directors elects the Board committee members and chairmen from among its members. The committee members shall have the expertise and experience required for the duties of the committee. A committee always has at least three members. The CEO does not belong to any of the committees.

The committees' chairmen report on issues discussed by the committees to the Board of Directors.

The members of Board committees in 2019 are listed under 3.2 Information about Board members.

4.2 Descriptions of committee charters and operations

Audit and Governance Committee

The Audit and Governance Committee has a central role in the company's financial reporting process and the development of corporate governance practices. The duties of the Audit and Governance Committee are

Good collaboration with the auditor and internal audit

described in detail in the committee charter described on the company website at citycon.com/board-committees.

Members of the Audit and Governance Committee must be independent of the company and at least one committee member must be independent of the company's significant shareholders. At least one committee member must be a financial expert with sufficient knowledge and experience in the fields of accounting or auditing and in the accounting principles applicable to the company.

Citycon's responsible auditor attends the Audit and Governance Committee meeting in which the company's annual financial statements are reviewed, and reports on audit findings. The responsible auditor also attends other Audit and Governance Committee meetings upon the committee's request.

The Audit and Governance Committee meets at least four times a year in accordance with the company's financial reporting schedule in order to review the interim and half-yearly reports and annual financial statements of the company.

* Situation on 31 December 2019

The Audit and Governance Committee convened nine times in 2019. The average attendance rate at the meetings stood at 97%. The graph below indicates attendance rates by member.

Nomination and Remuneration Committee

The Nomination and Remuneration Committee prepares proposals for the election of the Board of Directors and their remuneration, as well as the preparation of the remuneration policy and remuneration report. Furthermore, the duties of Nomination and Remuneration Committee includes matters regarding the appointment and remuneration of the CEO and other senior executives, and employee remuneration schemes. The duties of the Nomination and Remuneration Committee are described in the committee charter described at citycon. com/board-committees.

The members of the Nomination and Remuneration Committee must be independent of the company.

When seeking potential Board members, the Nomination and Remuneration Committee shall take account of the requirements

of the company's strategy and operations, the diversity principles of the Board and the company's stage of development. The Nomination and Remuneration Committee may consult significant shareholders of the company in this matter.

The Nomination and Remuneration Committee meets at least twice a year. In 2019, the Nomination and Remuneration Committee convened three times with an average attendance rate of 100%. The graph below indicates attendance rates by member.

Chaim Katzman, Chairman	100%
Arnold de Haan	100%
Alexandre (Sandy) Koifman (as of 13 March 2019)	100%
Andrea Orlandi	100%
Per-Anders Ovin (until 13 March 2019)	100%
Ariella Zochovitzky	100%

Strategy and Investment Committee

The Strategy and Investment Committee supports the Board of Directors in defining and monitoring the company's strategic direction, and monitors the company's property development projects and optimisation of the property portfolio. The duties of the Strategy and Investment Committee are set out in the committee charter described at citycon.com/board-committees.

The majority of the members of the Strategy and Investment Committee must be independent of the company.

The Strategy and Investment Committee meets as necessary but at least twice a year. In 2019, the Strategy and Investment Committee convened five times with an average attendance rate of 96%. The graph below indicates attendance rates by member.

David Lukes, Chairman	100%
Arnold de Haan	100%
Bernd Knobloch	100%
Ofer Stark	100%
Andrea Orlandi	80%

5. CHIEF EXECUTIVE OFFICER (CEO)

Citycon's Board of Directors appoints the company's CEO and decides on the terms and conditions of his/her service agreement. The service terms of the CEO are stipulated in a written service agreement approved by the Board of Directors.

The CEO manages the company's day-today operations in accordance with the guidelines by the Board of Directors. The CEO is responsible for ensuring that the company's accounts are in compliance with the law and that its financial affairs have been arranged in a reliable manner.

F. Scott Ball has been the company's CEO since 1.1.2019

6. CORPORATE MANAGEMENT COMMITTEE

In managing the company's business operations, Citycon's CEO is assisted by the Corporate Management Committee, comprising at least three members.

As an expert body, the Corporate Management Committee's main duties include assisting the CEO in the management of the company's operative business, and in preparing matters to the Board. Among other duties, the Corporate Management Committee prepares company's strategy, annual planning and budget, and monitors and supervises their implementation.

As a general rule, the Corporate Management Committee convenes once a month. In 2019, the Corporate Management Committee convened 12 times.

More information of CEO's service terms can be found from company's website at

citycon.com/remuneration.

Information about the CEO and other members of the Corporate Management Committee

Chairman of the Corporate Management Committee

F. SCOTT BALL

Member of the Corporate Management Committee since 2019

B.Sc. (Business management), US citizen, born 1961

Citycon shares*: 33,842

Executive Vice President and Chief Financial Officer

EERO SIHVONEN

Member of the Corporate Management Committee since 2005

M. Sc. (Econ.), Finnish citizen, born 1957 Area of responsibility: finance, treasury, investor relations, IT Citycon shares*: 44,538

Chief Operating Officer HENRICA GINSTRÖM

Member of the Corporate Management Committee since 2019

M.Sc (Technology), M.Sc (Economics) Finnish citizen, born 1983

Area of responsibility: operational business, marketing

Citycon shares*: 151

Chief Development Officer ERIK LENNHAMMAR

Member of the Corporate Management Committee since August 2019

B.Sc. In Engineering (Constructional Engineering), Swedish citizen, born 1974

Area of responsibility: property investments and development Citycon shares*: -

7. REMUNERATION

Citycon's Remuneration Statement is provided as a separate report, distinct from this CG Statement. The Remuneration Statement includes the description of the decision-making procedure concerning the remuneration of the directors, the CEO and any other executives and of the main principles of remuneration, as well as the remuneration report which discloses the remuneration paid during the previous reporting period.

From 2020 onwards, Citycon will provide a Remuneration Policy that defines the principles for the remuneration of the company's governing bodies, i.e. the board of directors, the managing director and possible deputy managing director. The Remuneration Policy will be presented to the Annual General Meeting of Shareholders for the first time in spring 2020. Consequently, the Remuneration Policy will be presented to the Annual General Meeting of Shareholders at least every four years or whenever substantial changes are made to it. From 2021 onwards, the Remuneration

Statement will be replaced by a Remuneration Report, that will describe the implementation of the company's remuneration policy. The remuneration report provides information on the remuneration of the members of the company's board of directors and possible supervisory board, as well as of the managing director and possible deputy managing director, during the preceding financial year.

Citycon's Remuneration Statement is available on the company's website at citycon.com/remuneration.

* Includes the shares and share-based rights in the company and companies belonging to the same group held by the CEO or CMC member and corporations over which he or she exercises control.

Information on Corporate Management Committee members' career histories and positions of trust is available on the company's website at citycon.com/ corporate-management-committee.

III. DESCRIPTIONS OF INTERNAL CONTROL PROCEDURES AND THE MAIN FEATURES OF RISK MANAGEMENT SYSTEMS

The purpose of Citycon's risk management and internal control is to ensure that the Group's operations are both efficient and effective, that reporting is consistent and reliable and that the applicable laws and regulations as well as the Citycon group's operating principles are observed. Internal control of financial reporting aims to ensure that any interim and half-yearly reports and

MAIN FEATURES OF THE RISK MANAGEMENT PROCESS AND ITS RELATION TO INTERNAL CONTROL

Identification of risks

Each function has a designated person who is the owner of the risks in that function and is responsible for the reporting of risks, the limitation plans and the monitoring of the implementation of the plans

Reporting to the Group Treasurer

The Group Treasurer prepares the risk report

Development of the process

The CEO and the rest of the Corporate Management Committee develop and maintain processes in accordance with the risk management principles approved by the Board of Directors

financial statements to be published are reliable and are prepared in compliance with the accounting policies and reporting principles applied by Citycon and give materially correct information about the company's

On 31 December 2019 Citycon had a total of 90 subsidiaries and 22 joint ventures and

financial position.

associated companies.

1. GENERAL DESCRIPTION OF RISK MANAGEMENT

Citycon is exposed to various risks through the normal course of its business operations. Expected gains are to be assessed against the involved risks.

Citycon's risks are managed in the various functions as a part of operational management. Risk management constitutes part of the company's internal control.

The risk management and reporting process involves:

• identifying the existing risks
• assessing the risk management measures
• making new risk limitation plans if the current measures are not deemed sufficient for the management of the identified risks.

The risk reporting process gathers data on risk analysis, risk management plans and risk owners into one group-wide risk register, for annual reporting to Citycon's Board of Directors. This is done in conjunction with the budgeting process so that the risks are linked to the annual targets. In order to evaluate the importance of each risk, an estimate of the potential future loss associated with the realisation of the risk is determined together with the probability of the realisation of the risk, whenever possible. This also improves the comparability of risks between business units and functions. In addition, the

The objective of Citycon's risk management is to ensure that the business targets are achieved by identifying, assessing and monitoring key risks as well as to extent possible, avoid, transfer or mitigate these risks.

realised risks during the previous year are assessed and reported.

Each function in the company has a designated person who is the owner of risk management in that area and is also responsible for the reporting of risks, limitation plans and monitoring the implementation of the plans. Key risks are reported to the Group Treasurer, who prepares the risk report for the Board of Directors. The CEO and the Corporate Management Committee are responsible for developing and maintaining the processes in accordance with the risk management principles approved by the Board of Directors. The Board of Directors monitors the company's business risks and uncertainties on a regular basis and reports

them as required by law and the regulations and guidelines issued by the Finnish Financial Supervisory Authority.

Each year, Citycon assesses risks related to processes deemed significant to financial reporting, to serve as a basis for internal control over external financial reporting. In addition to the group's finance function, the business units' financial management participates in the risk assessment process.

The company's key risks and uncertainties and the most important risk management measures and principles are covered more extensively annually in connection with Citycon's Financial Statements.

2. GENERAL DESCRIPTION OF INTERNAL CONTROL

Citycon's internal control system is based on the international COSO 2013* framework. It includes the key principles related to the control environment, risk assessment, control activities, information, communication and monitoring activities. The cornerstones of Citycon's control environment include group-level operating policies and guidelines, harmonised controls in the operating processes and assessment of controls and deviations during the reporting period.

Audit

3. INTERNATIONAL COSO FRAMEWORK AS THE FOUNDATION FOR INTERNAL CONTROL

Control environment

At Citycon, the Board of Directors is responsible for arranging and maintaining adequate and effective internal control. The division of duties included in Citycon's Corporate Governance Guidelines and the group's organisational structure ensure that the areas of responsibility and division of authority are clear for all functions and the management and employees.

In accordance with the Board of Directors' and its committees' written charters, the Board's Audit and Governance Committee assesses the company's financial reporting process and the appropriateness of the internal control system and reviews

the internal control reports. The duties of the Board of Directors and the Audit and Governance Committee are presented in more detail in the section regarding the Board of Directors and its committees.

CEO's duty is to attend to the implementation of practical actions regarding internal control and to maintain an organisational structure in which responsibility, authority and reporting relationships are clearly and comprehensively defined in writing. At Citycon an authorisation matrix is in use where the division of authority for each organisational role is specified through approval limits.

Citycon's ethical principles and business norms are specified in Citycon's Code of Conduct. Compliance with the principles is promoted through internal communication and training. Citycon strives to ensure that its key business partners also comply with the same or similar principles.

The group's personnel and business partners can report suspected violations of Citycon's Code of Conduct on Citycon's website at https://report.whistleb.com/en/citycon.

CEO and

other members

of the CMC

ROLES IN INTERNAL CONTROL AND RISK MANAGEMENT

First defence line

Second defence line

Third defence line Internal audit

Overall responsibility Board of Directors

Business processes and support functions

Audit and Governance Committee

Three defence lines

Risk management, internal control environment, group guidance

Independent reporting line

4. CONTROL ACTIVITIES

The company's accounting and reporting manuals define the standards, processes and responsibilities for financial reporting. These manuals facilitate the achievement of Citycon's objectives regarding the reliability of financial reporting. The Board of Directors approves group-level policies as determined in company's Corporate Governance Guidelines. Meetings are held on a regular basis in which the manuals are discussed with all personnel involved in the financial reporting process.

Descriptions of processes that are significant to Citycon's business and reporting have been documented. The process descriptions have been supplemented by defining control points in each process, based on the risk assessment of reporting. These control points include, for example, approvals, reconciling sub-ledgers and accounts, analytical reviews, limitations of access rights and segregation of duties. The defined control points are designed to prevent, detect and correct material errors and deviations in financial reporting.

5. INFORMATION AND COMMUNICATION

All external communication is carried out in accordance with Citycon's Disclosure Policy. The Board of Directors approves all financial reports issued by the company, before they are published as stock exchange releases. The company's external communications are carried out in several events and in different channels.

THE COMPANY'S EXTERNAL COMMUNI-CATIONS ARE CARRIED OUT IN SEVERAL EVENTS AND IN DIFFERENT CHANNELS:

Analyst events

Reports and releases

Company visits

Website

6. MONITORING ACTIVITIES

Citycon's business unit executives are responsible for ensuring that the relevant laws and regulations are adhered to in their respective functions of responsibility. The Corporate Management Committee also monitors compliance with laws and regulations as part of regular supervisory activities. The financial performance of the group and business units is monitored monthly through the group's business review processes.

In Citycon group, monitoring of internal control includes both ongoing and separate evaluations and audits. The objective of the monthly analysis of reported figures at various levels (e.g. shopping centre, cluster, business unit, group) is to detect whether the reported figures deviate from budgeted or forecast figures. The purpose of monitoring and testing of internal controls is to detect control deviations in each significant process for financial reporting that might affect the accuracy of Citycon's financial reporting if the deviation in question would not be corrected.

In 2019, testing of internal controls continued with regard to the main processes of the group management and business units. These tests were conducted by assessors who are independent of the business unit's daily operations and were steered by the group management. The significance and impacts of deviations detected in these tests were evaluated by the group management, and the necessary corrective measures were initiated. On the basis of the resulting summary drawn up by the group management, there are no indications that these control deviations would lead to material errors in Citycon's financial statements.

IV. OTHER INFORMATION

1. DESCRIPTION OF THE ORGANISATION OF THE COMPANY'S INTERNAL AUDIT AND OF THE MAIN PRINCIPLES FOLLOWED IN THE INTERNAL AUDIT

Citycon has a separate internal audit function. The duties of internal audit include independent and objective auditing activities, as well as value-adding consulting activities that improve operations. Internal audit contributes to the achievement of the company's objectives through systematic assessment and development of the company's risk management, internal control and corporate governance processes. The internal audit function reports directly to the Board's Audit and Governance Committee and, administratively, to the CEO. The internal audit reporting relationships are also described in section II. Descriptions concerning corporate governance of this statement (see the figure under Citycon's corporate governance structure). A representative from Citycon's organisation co-ordinates the internal audit services, which were purchased from an external service provider in 2019.

The internal audit work is based on the Internal Audit Charter, as approved by the Audit and Governance Committee. According to the charter, the duties of internal audit include, among others, assisting the Board of Directors, its committees and the corporate management with the assessment of processes related to the identification and

management of risks, supervision of financial reporting, efficiency of operations and compliance with law. Within the scope of the authorisation granted through the Internal Audit Charter, the internal audit function has unlimited access to Citycon's functions, processes, documents and personnel in order to perform audits.

The internal audit function assists the Board's Audit and Governance Committee in assessing and monitoring the adequacy and effectiveness of Citycon's internal controls and risk management, by performing audits in group legal entities and processes in accordance with the annual plan approved by the Board's Audit and Governance Committee. The annual plan is approved by the Audit and Governance Committee at its meeting each year. The progress of audits under the internal audit annual plan is reported to the Board's Audit and Governance Committee each quarter. In addition, the Board's Audit and Governance Committee deals with each internal audit report at its meeting, including observations, recommendations and action plans. Observations from the previous year and the progress of implementing the action plans are reported to the Audit and Governance Committee.

In accordance with Citycon's audit plan, internal audits in 2019 focused on a selected property development project, risk management process and risk reporting, shopping centre cluster audits, lease administration system audit, and follow-up of previous years' audit observation.

2. RELATED PARTY TRANSACTIONS

The related parties of the Company mean the related parties of a listed company in accordance with IAS 24. The company has based on IAS 24 determined that its related parties comprise of at least Citycon Oyj's subsidiaries, associated companies and joint ventures; Board members; CEO and other Corporate Management Committee members; and the company's largest shareholder Gazit-Globe Ltd. that held 48.6% of the company's shares and votes on 31 December 2019.

The Group Finance shall report all Company's transactions with the related parties to the Chief Financial Officer and Legal Affairs on a quarterly basis. The Group Finance shall immediately inform the Legal Affairs of any contemplated transaction, which would be entered into with a related party and not be (i) entered into in the ordinary course of business; or (ii) concluded on normal market terms. The Board of Directors decides upon entering into these related party transactions.

The Board of Directors shall handle related party transaction monitoring and evaluation in its meetings where the financial statements are approved, and in other meetings if needed. The company evaluates and monitors transactions concluded between the company and its related parties and reports on them, as required by the Finnish Limited Liability Companies Act and regulations concerning the preparation of financial statements, in the Company's Report by the Board of Directors and in the notes to the financial statements and interim and half-yearly reports. In addition, the Company's Chief Financial Officer reports quarterly on the Company's related party transactions to the Audit and Governance Committee and to the members of the Board of Directors who are independent of significant shareholders.

The nature of a related party transaction and its terms are evaluated, in particular, with respect to the Company's ordinary course of business and arms-length terms. Standard agreements that are offered to customers and personnel in general are typically part of the ordinary course of business, which means that they do not require special monitoring or assessment measures.

Related party transactions which are part of the ordinary course of business and are implemented under arms-length terms do not require a decision of the Board of Directors independent of the Company.

In decision-making pertaining to related party transactions, the company ensures that potential conflicts of interests are appropriately taken into account and related parties or their representatives do not participate in the decision-making.

In 2019, the company had no related party transactions deviating from the company's normal business operations or not made on market or market equivalent terms.

3. MAIN PROCEDURES RELATING TO INSIDER ADMINISTRATION

In its insider administration, Citycon applies the EU's Market Abuse Regulation (MAR) and the Insider Guidelines issued by Helsinki Stock Exchange. The company's own Insider Guidelines approved by the company's Board of Directors supplement the applied insider regulation and specify the company's insider administration procedures. The company's Head of Legal Affairs is in charge of Citycon's insider issues.

3.1 Persons discharging managerial responsibilities and insider lists

The company has specified the members of the Board of Directors, the CEO and other members of the Corporate Management Committee as its managers referred to in the MAR. Citycon maintains a list of managers and their closely associated persons. The persons on the list are obligated to report their business transactions in Citycon's financial instruments to the company and the Finnish Financial Supervisory Authority. Citycon publishes such transactions in stock exchange releases.

At the beginning of insider projects, the company sets up project- or event-based

insider lists. The lists include information of persons participating in projects, such as capital market events or significant company or property business transactions. During insider projects, they are not allowed to trade in financial instruments related to the company.

Managers' and their closely associated persons' transactions in Citycon financial instruments are published in the Managers' Transactions section in the Citycon Newsroom at citycon.com/newsroom.

3.2 Closed period and trading restrictions Citycon applies a closed period of 30 calendar days prior to announcing its financial statements, half-yearly reports and interim reports. The closed period concerns persons discharging managerial responsibilities in the company and other company employees who participate in the preparation of financial statements, half-yearly reports and interim reports. During that period, they are not allowed to trade in securities issued by Citycon, or other securities or financial instruments targeting Citycon shares or securities entitling to Citycon shares. In addition, persons discharging managerial responsibilities are at all times obligated to consult Citycon's insider administration prior to a planned transaction in Citycon's financial instruments.

œ

Closed window periods are shown in the investor calendar which is available at citycon.com/investor-calendar.

4. AUDITOR AND REMUNERATION PAID TO THE AUDITOR

On 13 March 2019, Citycon's Annual General Meeting re-elected audit firm Ernst & Young Oy the company's auditor, with Mikko Rytilahti (Authorised Public Accountant) acting as the responsible auditor appointed by the firm since 2014.

In 2019, Citycon paid EUR 0.9 million in remuneration to its auditor, related to its general audit. In addition, Citycon purchased advisory services from the auditor by EUR 0.0 million.