Citycon Oyj

Governance Information • Feb 26, 2025

Contents

3

Descriptions concerning corporate governance	4
Citycon's corporate governance structure4
1. General Meeting of Shareholders5
2. Board of Directors5
3. Board Committees9
4. Chief Executive Officer (CEO)10
5. Corporate Management Committee 10
6. Remuneration11

Descriptions of internal control procedures and

the main features of risk management systems 12
1. General description of risk management12
2. General description of internal control13
3. International COSO framework as the foundation
for internal control14
4. Control activities14
5. Information and communication14
6. Monitoring activities 14

Other information 15
1. Description of the organisation of the company's
internal audit and the main principles followed in
the internal audit15
2. Related party transactions 15
3. Main procedures relating to insider administration 16
4. Auditor and remuneration paid to the auditor16

Financial Review

Covers Citycon's financial performance in 2024, operational key figures, the report by the Board of Directors and the risk management review.

Sustainability Accounts

Describes Citycon's environmental and social performance, as well as sustainability highlights in 2024.

Corporate Governance Statement

Explains Citycon's structure of governance and the Board of Directors' activities in 2024.

Remuneration Report

Provides information on the remuneration of the Board of Directors and the CEO, and it also describes how the Remuneration Policy for Governing Bodies has been implemented.

How to read Citycon's 2024 reports

Our reporting in 2024 consists of the Financial Review, the Sustainability Accounts, the Corporate Governance Statement and the Remuneration Report. More information on Citycon, our strategy and value creation can be found on company website.

To make the report more reader-friendly, this report, as well as supplementary information and additional case examples, can be found on our webpage. You can recognise the links to this material through this symbol: Read more

Citycon Group's Corporate Governance Statement for the Financial Year 2024

Introduction

Citycon Oyj (Citycon or company) is a Finnish public limited liability company listed on the Nasdaq Helsinki Ltd (the Helsinki Stock Exchange). Citycon and its subsidiaries constitute the Citycon group.

Citycon's corporate governance principles are based on legislation in force in Finland, the rules and regulations issued for listed companies by the Helsinki Stock Exchange and the Finnish Financial Supervisory Authority (FIN-FSA) as well as Citycon's Articles of Association. Corporate governance in Citycon's subsidiaries is also governed by the laws of the country of their domicile, and by each subsidiary's Articles of Association. In addition, Citycon applies the Finnish Corporate Governance Code 2025 published by the Finnish Securities Market Association as well as Citycon's Code of Conduct and Corporate Governance Guidelines.

This corporate governance statement (CG Statement) has been prepared in accordance with the recommendations of the Corporate Governance Code 2025 (Corporate Governance Code) with due consideration to the transition rule of the Corporate Governance Code recommendation 8.

In 2024, Citycon complied with the recommendations of the Corporate Governance Code with one exception. As provided by the comply or explain principle of the Corporate Governance Code, Citycon departs from the Corporate Governance Code's recommendation concerning the restriction concerning the CEO (recommendation 21) whereby the CEO shall not be elected chair of the Board of Directors. The Board of Directors, at its organizational meeting on March 19, 2024, appointed Citycon's CEO, F. Scott Ball, as deputy chairman of the Board. As previously announced, F. Scott Ball continued in his role as CEO until March 31, 2024. In a Board meeting held on October 8, 2024, F. Scott Ball, who had been serving as deputy chairman of the Board, was appointed as Citycon's interim CEO during the transition period until a new CEO is selected and assumes the position. Mr. Oleg Zaslavsky starts his role as the new CEO on 1 March 2025. The Board determined that F. Scott Ball's dual role as CEO and deputy chairman of the Board enhances interaction between the Board and operational management during this period of change and ensures a smooth CEO transition and it does not compromise the duty of the Board of Directors to supervise the CEO. Citycon's Board

of Directors has two deputy chairmen to minimise the risk for any conflict of interest.

This CG Statement has been prepared as a separate report, distinct from the Report by the Board of Directors. The Audit and Governance Committee of the Board of Directors has reviewed the CG Statement on 26 February 2025. Deloitte Oy, the company's auditor, has verified that the CG Statement has been issued and that the descriptions of the internal control procedures and the main features of risk management systems related to the financial reporting process are consistent with the company's Financial Statements.

This CG Statement was published on 26 February 2025 simultaneously with Citycon's Financial Statements and the Report by the Board of Directors for 2024.

Read more

The Corporate Governance Code is available on the Securities Market Association's website at cgfinland.fi. This CG Statement and the same statements for previous years since 2010 are available on the company's website at citycon.com/corporate-governance.

Descriptions concerning Corporate Governance

Citycon's statutory bodies are the General Meeting of Shareholders, the Board of Directors and the CEO. The General Meeting of Shareholders elects members to the Board of Directors, and the Board of Directors appoints the CEO. The Board of Directors' work is enhanced by four Board committees whose members are elected by the Board of Directors among its members. In managing the company's business operations, the CEO is assisted by the Corporate Management Committee whose members are appointed, upon the CEO's proposal, by the Board of Directors. Additionally, the CEO is assisted by the Extended Management Committee, which aims to serve as a channel of communication without decision-making power.

The work of the Board of Directors and its committees, the CEO and the Corporate Management Committee is governed by the Corporate Governance Guidelines approved by the Board of Directors. These guidelines contain charters for the Board and its committees, guidelines for the division of duties between the decision-making bodies, and guidelines for the arrangement of internal control and risk management.

Citycon's corporate governance structure 2024

1. General Meeting of Shareholders

Citycon's shareholders exercise their decision-making power at the General Meeting. According to the company's Articles of Association, Citycon's Annual General Meeting is held annually within six months of the expiration of the financial period. Extraordinary General Meetings are convened whenever deemed necessary for decision-making purposes or when required by law.

The company publishes the notice of a General Meeting including a proposal for the meeting's agenda, the documents to be presented to the General Meeting and the Board of Directors' resolution proposals on the company's website, no later than three weeks prior to the General Meeting. The notice of the General Meeting is also published as a stock exchange release. If new persons are proposed to the Board of Directors, information about the candidates is presented on the company's website.

A shareholder is entitled to demand a matter for discussion at a General Meeting if such a matter belongs to the General Meeting according to the Finnish Limited Liability Companies Act and a demand is made by giving notice to the company well in advance so that the matter can be included in the notice of a General Meeting.

Citycon strives to facilitate the participation of its shareholders in General Meetings by arranging the meetings in a manner that enables both Finnish and international shareholders to participate in the meeting and to exercise their right to vote and ask questions. Citycon organized its general meetings for the year 2024 virtually, without a meeting venue using remote connection in real time. Hosting virtual meeting allows individuals to connect from anywhere and gives every shareholder chance to attend and have their say in real time.

In 2024, Citycon held three General Meetings. The Annual General Meeting (AGM) 2024 was held on 19 March 2024. The first Extraordinary General Meeting (EGM) was held on 18 June 2024 and it was resolved that the net amount of the annual fees of the members of the Board of Directors and the Chairmen of the Board of Directors' Committees after deduction of taxes and charges, resolved upon at the Annual General Meeting 2024, shall be paid in Citycon Oyj shares, which are either new shares or treasury shares held by the Company. The second EMG was held on 12 November 2024 and it was resolved to increase the number of members of the board to ten (10) until the close of the next Annual General Meeting. Further, Mr Eero Sihvonen was elected as a new member of the Board of Directors. Citycon published the decisions made by the General Meetings in stock exchange releases and on its website.

2. Board of Directors 2.1 The composition of the Board of Directors

According to Citycon's Articles of Association, the Board of Directors consists of a minimum of five and a maximum of ten members. The Articles of Association do not contain any regulations on a specific procedure according to which the Board members are to be appointed.

The General Meeting of shareholders decides on the number of members of the Board of Directors and elects them at the AGM and, when necessary, at the EGM.

According to the Corporate Governance Code, the majority of the members of the Board of Directors must be independent of the company. In addition, a minimum of two of these independent members must also be independent of the company's significant shareholders. The Board of Directors evaluates its members' independence annually.

The Board's Nomination and Remuneration Committee prepares the Board's proposal to the General Meeting on the Board composition. The company's strategy and the requirements set by its operations, the company's development stage and the diversity principles specified by the company for the Board (described in 3.4 Diversity of the Board of Directors) shall be taken into account when planning the composition of the Board of Directors.

The Board of Directors elects the Chairman and one or more Deputy Chairmen from among its members.

Citycon's AGM 2024 set the number of Board members at nine. The following Board members were re-elected: Chaim Katzman, Yehuda (Judah) L. Angster, F. Scott Ball, Zvi Gordon, Adi Jemini, Alexandre (Sandy) Koifman, David Lukes, Per-Anders Ovin and Ljudmila Popova.

Citycon's EGM 2024 set the number of Board members at ten. Mr Eero Sihvonen was elected as a new member of the Board of Directors.

The members of the Board of Directors were elected for a term that ends at the close of the first AGM following their election.

The Board of Directors evaluated its members' independence in its meetings on 19 February 2024 and 17 October 2024. The Board of Directors concluded that all Board members, with exception of F. Scott Ball as the CEO and Eero Sihvonen as the CFO of the company, are independent of the company.

Yehuda (Judah) L. Angster, F. Scott Ball, Alexandre (Sandy) Koifman, David Lukes, Eero Sihvonen, Per-Anders Ovin and Ljudmila Popova were evaluated independent of the company's significant shareholders. Chaim Katzman, Zvi Gordon and Adi Jemini are, or have recently been,

"Citycon strives to facilitate the participation of its shareholders in General Meetings by arranging the meetings in a manner that enables both Finnish and international shareholders to participate in the meeting and to exercise their right to vote and ask questions."

in the service of or Board members of Citycon's main shareholder, G City Ltd (former Gazit-Globe Ltd.), or its affiliated companies and therefore they are not evaluated independent of the company's significant shareholders.

The Board Chairman in 2024 was Chaim Katzman with Sandy Koifman and F. Scott Ball serving as Deputy Chairmen.

Read more

Minutes of the General Meetings, General Meeting documents and summaries of the resolutions of each General Meeting since 2010 are available in Citycon's GM archive at citycon.com/agm-archive.

Further information on General Meetings and shareholder rights can be found at citycon.com/general-meeting.

2.2 Information on Board members per 31 December 2024

Board Chairman Chaim Katzman Member and Chairman of the Board of Directors since 2010 LL.B., Israeli and US citizen, male, born 1949

Main occupation: Norstar Holdings Inc., Founder, Controlling Shareholder and Board Chairman since 1991 and CEO since 2017; G City Ltd., Executive Chairman of the Board of Directors since 1998 and CEO since 2018; Regency Centers Corporation, Vice Chairman of the Board since 2017; Atrium European Real Estate Ltd, Board Chairman since 2008

The Board's assessment of independence: Independent of the company

Citycon shares1 : 106,934

Membership in Citycon's Board committees: Nomination and Remuneration Committee, Chairman, Strategy and Investment Committee

Yehuda (Judah) L. Angster Member of the Board of Directors since 2020 Juris Doctor (Pace University), Bachelor of Talmudic Law, US citizen, male, born 1982

Main occupation: Dwight City Group LLC, CEO, Principal and Founder since 2018; NYU Schack Institute of Real Estate, Adjunct Professor of Real Estate Law since 2017

The Board's assessment of independence: Independent of the company and significant shareholders

Citycon shares1 : 13,303

Membership in Citycon's Board committees: Cyber Committee, Nomination and Remuneration Committee, Strategy and Investment Committee

F. Scott Ball Member of the Board of Directors since 2021, Deputy Chairman since 2022 B.Sc. (Business Management), US citizen, male, born 1961

Main occupation: Citycon, Interim CEO

The Board's assessment of independence: Independent of significant shareholders

Citycon shares1 : 488,414

Membership in Citycon's Board committees: Nomination and Remuneration Committee, Strategy and Investment Committee

Zvi Gordon Member of the Board of Directors since 2020 MBA (MIT Sloan), B.A., Israeli and US citizen, male, born 1985

Main occupation: G City Ltd., Vice President of Investments 2017; Norstar Holdings Inc., Chief Investment Officer since 2016

The Board's assessment of independence: Independent of the company

Citycon shares1 : 14,601

Membership in Citycon's Board committees: Cyber Committee, Chairman, Strategy and Investment Committee

Adi Jemini Member of the Board of Directors since 2023 B.Sc. (Accounting and Information System), US citizen, male, born 1978

Main occupation: Gazit Group USA, Chief Executive Officer since 2023

The Board's assessment of independence: Independent of the company

Citycon shares1 : 13,920

Membership in Citycon's Board committees: Audit and Governance Committee, Chairman, Cyber Committee

¹ Includes the shares and share-based rights in the company and companies belonging to the same group held by the director and corporations over which he or she exercises control.

Alexandre (Sandy) Koifman Member of the Board of Directors since 2019, Deputy Chairman since 2021 M.Sc. (Mathematics & Economics), French and Swiss citizen, male, born 1953

Main occupation: Efficient Frontiers Investing SA, Managing Director

The Board's assessment of independence: Independent of the company and significant shareholders

Citycon shares1 : 12,379

Membership in Citycon's Board committees: Audit and Governance Committee, Nomination and Remuneration Committee

David Lukes Member of the Board of Directors since 2017 M.Sc. (Real estate development), Architect, US citizen, male, born 1970

Main occupation: Curbline Properties, CEO and President since 2023, Site Centers Corp. CEO and President since 2017

The Board's assessment of independence: Independent of the company and significant shareholders

Citycon shares1 : 15,858

Membership in Citycon's Board committees: Strategy and Investment Committee, Chairman, Cyber Committee

Per-Anders Ovin Member of the Board of Directors since 2013 M.Sc. (Economics), Swedish citizen, male, born 1956

Main occupation: Mengus Stockholm AB, Board Chairman, Partner and Owner since 2005; Marrakech Design/Ovin Consulting AB, Owner since 2003

The Board's assessment of independence: Independent of the company and significant shareholders

Citycon shares1 : 26,742

Membership in Citycon's Board committees: Audit and Governance Committee, Nomination and Remuneration Committee

Ljudmila Popova Member of the Board of Directors since 2021 M.Sc. (Econometric Sciences), Executive MBA, Dutch and Kyrgyz citizen, female, born 1980

Main occupation: Director Digital Infrastructure at NIBC since 2021

The Board's assessment of independence: Independent of the company and significant shareholders

Citycon shares1 : 8,842

Membership in Citycon's Board committees: Audit and Governance Committee, Cyber Committee

Eero Sihvonen Member of the Board of Directors since 2024 Master of Science, Helsinki School of Economics, Finnish citizen, male, born 1957

Main occupation: Citycon, CFO

The Board's assessment of independence: Independent of significant shareholders

Citycon shares1 : 60,328

Membership in Citycon's Board committees: -

Read more

Board members' personal details can also be found on the company's website at citycon.com/board-directors and information on their personal shareholdings in Citycon at citycon.com/managers-holdings-shares.

¹ Includes the shares and share-based rights in the company and companies belonging to the same group held by the director and corporations over which he or she exercises control.

operations of the Board of Directors

The duties of the Board, as set out in the charter of the Board of Directors included in company's Corporate Governance Guidelines, are described on the company's website at citycon.com/board-of-directors.

The Board of Directors' meeting schedule is based on the company's year clock shown on the right. Additional meetings are held when deemed necessary.

The Board of Directors constitutes a quorum if more than half of its members are present. Considering the Board of Directors' international composition, the meetings may be held as telephone or video meetings as well as per capsulam.

The Board of Directors evaluates its operations and working methods annually. Typically, the evaluation is conducted as self-evaluation.

In 2024, Citycon's Board of Directors convened a total of 27 times during the year. The average attendance rate at Board meetings was 96%.

2.3 Description of the charter and Board of Directors' year clock Board meeting attendance in 2024

%

10%

%

Introduction Corporate governance Internal control and risk management Other information Corporate Governance Statement 2024 9

2.4 Diversity of the Board of Directors

Citycon's Corporate Governance Guidelines states the principles of diversity for the Board of Directors. According to the principles, when planning the composition of the Board, the Nomination and Remuneration Committee shall take into account the candidates' background, independence, age, gender, skills and experience, the suitable number of candidates and their opportunity to devote a sufficient amount of time to their work. In addition, the company's strategy, the requirements set by the company's operations and the company's stage of development shall be taken into account. The Nomination and Remuneration Committee shall take account of proposing both genders as members of the Board of Directors.

In 2024, the composition of Citycon's Board of Directors was balanced with regard to the diversity principles. The members of the Board had extensive and diverse expertise and an international background. The members' competence, education, experience and seniority complemented each other. The directors represented eight nationalities. Both genders were represented on Citycon's Board of Directors in accordance with the objectives specified by the company.

Gender1

90%

1

Situation on 31 December 2024

Independence of significant shareholders1

Duration of board membership1

3. Board Committees

3.1 Composition and operations of the committees Citycon's Board of Directors is assisted by four committees set up by the Board of Directors: the Audit and Governance Committee, the Cyber Committee, the Nomination and Remuneration Committee, and the Strategy and Investment Committee. Each committee's main duties and working principles are established in writing by the committee charters included in Citycon's

Corporate Governance Guidelines. The Board may also resolve on a separate sub-committee to prepare or decide certain matter, as necessary.

The Board of Directors elects the Board committee members and chairmen from among its members. The committee members shall have the expertise and experience required for the duties of the committee. A committee always has at least three members.

The committees' chairmen report on issues discussed by the committees to the Board of Directors.

The members of the Board committees in 2024 are listed under 3.2 Information about Board members.

3.2 Descriptions of committee charters and operations

Audit and Governance Committee

The Audit and Governance Committee has a central role in the company's financial reporting process and the development of corporate governance practices. The duties of the Audit and Governance Committee are described in detail in the committee charter described on the company's website.

Members of the Audit and Governance Committee must be independent of the company and at least one committee member must be independent of the company's significant shareholders. At least one committee member must be a financial expert with sufficient knowledge and experience in the fields of accounting or auditing and in the accounting principles applicable to the company.

Citycon's responsible auditor attends the Audit and Governance Committee meeting in which the company's annual financial statements are reviewed, and reports

on audit findings. The responsible auditor also attends other Audit and Governance Committee meetings upon the committee's request.

The Audit and Governance Committee meets at least four times a year in accordance with the company's financial reporting schedule to review the interim and half-yearly reports and annual financial statements of the company. The Audit and Governance Committee convened seven times in 2024. The average attendance rate at the meetings stood at 100%. The graph below indicates attendance rates by member.

Adi Jemini, Chairman	100%
Sandy Koifman	100%
Per-Anders Ovin	100%
Ljudmila Popova	100%

Cyber Committee

The Cyber Committee supports the Board of Directors in overseeing the company's cyber security activities and risks as well as the practices in safeguarding the company's assets, sensitive information, maintaining the trust of stakeholders and business continuity. The duties of the Cyber Committee are described in the committee charter described on the company's website.

The majority of the members of the Cyber Committee must be independent of the company.

The Cyber Committee meets as necessary but at least twice a year. In 2024, the Cyber Committee convened four times with an attendance rate of 100%. The graph below indicates attendance rates by member.

Nomination and Remuneration Committee

The Nomination and Remuneration Committee prepares proposals for the election of the Board of Directors and their remuneration, as well as prepares the remuneration policy and the remuneration report. Furthermore, the duties of the Nomination and Remuneration Committee include matters regarding the appointment and remuneration of the CEO and other senior executives. The duties of the Nomination and Remuneration Committee are described in the committee charter described on the company's website.

Majority of the members of the Nomination and Remuneration Committee must be independent of the company.

When seeking potential Board members, the Nomination and Remuneration Committee shall take into account the requirements of the company's strategy and operations, the diversity principles of the Board and the company's stage of development. The Nomination and Remuneration Committee may consult significant shareholders of the company in this matter.

The Nomination and Remuneration Committee meets at least twice a year. In 2024, the Nomination and Remuneration Committee convened six times with an attendance rate of 93%. The graph below indicates attendance rates by member.

Chaim Katzman, Chairman	100%
Judah Angster	83%
Sandy Koifman	100%
Per-Anders Ovin	83%
F. Scott Ball1	100%
(since 19 March 2024)

Strategy and Investment Committee

The Strategy and Investment Committee supports the Board of Directors in defining and monitoring the company's strategic direction and monitors the company's property development projects and optimisation of the property portfolio. The duties of the

¹ After F. Scott Ball began serving as interim CEO in October 2024, he attended the nomination and remuneration committee meetings in this role. The intention was for F. Scott Ball to assist in his interim CEO role in the search for the company's new CEO.

Strategy and Investment Committee are set out in the committee charter described on the company's website.

The majority of the members of the Strategy and Investment Committee must be independent of the company.

The Strategy and Investment Committee meets as necessary but at least twice a year. In 2024, the Strategy and Investment Committee convened four times with an attendance rate of 93%. The graph below indicates attendance rates by member.

David Lukes, Chairman	100%
Zvi Gordon	100%
Judah Angster	100%
Chaim Katzman (since 19 March 2024)	67%
F. Scott Ball (since 19 March 2024)	100%

Read more

More information of the duties of the Committees and of committee charter at citycon.com/investors/corporategovernance/board-of-directors/board-committees.

4. Chief Executive Officer (CEO)

Citycon's Board of Directors appoints the company's CEO and decides on the terms and conditions of his/ her service agreement. The service terms of the CEO are stipulated in a written service agreement approved by the Board of Directors.

The CEO manages the company's day-to-day operations in accordance with the guidelines by the Board of Directors. The CEO is responsible for ensuring that the company's accounts are in compliance with the law and that its financial affairs have been arranged in a reliable manner.

F. Scott Ball served as the company's CEO from January 1, 2019, to March 31, 2024, and is a member of Citycon's Board of Directors. Henrica Ginström assumed the role of CEO on April 1, 2024, and held the position until October 7, 2024. On November 15, 2024, Citycon's Board of Directors appointed Oleg Zaslavsky as the new CEO, with his term set to begin no later than April 2025. During this transitional period, F. Scott Ball has been serving as interim CEO from October 8, 2024, until Zaslavsky officially assumes the role.

5. Corporate Management Committee

The CEO is assisted by the Corporate Management Committee, an expert body comprising at least three members.

The Corporate Management Committee's main duties include assisting the CEO in the management of the company's operative business and preparing matters to the Board. Among other duties, the Corporate Management Committee prepares company's strategy, annual planning and budget, and monitors and supervises their implementation.

During 2024, the Corporate Management Committee convened generally once a week.

Read more

More information of CEO's service terms can be found from company's website at citycon.com/remuneration.

Information about the CEO and other members of the Corporate Management Committee per 31 December 2024

F. Scott Ball Interim Chief Executive Officer (Interim CEO)

Chairman of the Corporate Management Committee

F. Scott Ball served as the company's CEO from January 1, 2019, to March 31, 2024. Ball has been acting as the company's interim CEO since October 8, 2024, until the new CEO assumes the role no later than April 2025.

B.Sc. (Business management), US citizen, male, born 1961

Citycon shares1 : 488,414

Eero Sihvonen Chief Financial Officer

Member of the Corporate Management Committee since 2024. Mr. Sihvonen has previously served as Citycon's CFO during the years 2005–2021

Master of Science, Helsinki School of Economics, Finnish citizen, male, born 1957

Area of responsibility: finance, treasury, investor relations, communications, sustainability and corporate governance

Citycon shares1 : 60,328

Read more

Information on Corporate Management Committee members' career histories and positions of trust is also available on the company's website at citycon.com/corporate-management-committee.

Helen Metsvaht Chief Operating Officer

Member of the Corporate Management Committee since 2024

B.Sc (Real Estate), Estonian citizen, female, born 1982

Area of responsibility: operational business, marketing and legal

1. Remuneration

Citycon's Remuneration Report sets out how Citycon has implemented its Remuneration Policy in 2024. The Remuneration Report provides information on the remuneration and other financial benefits paid to the Board of Directors and the CEO during the previous

Citycon shares1 : 2,000

Erik Lennhammar Chief Development Officer

Member of the Corporate Management Committee since 2019

B.Sc. In Engineering (Constructional Engineering), Swedish citizen, male, born 1974

Area of responsibility: property investments and development

Citycon shares1 : 23,197

Jussi Vyyryläinen Senior Vice President, Leasing (until 31 December 2024)

Member of the Corporate Management Committee since 2024

Master of Hospitality Management, Finnish citizen, male, born 1977

Area of responsibility: Leasing

Citycon shares1 : 9,411

financial period. The Remuneration Report is issued as a separate report, distinct from this CG Statement.

Read more

Citycon's Remuneration Statement is available on the company's website at citycon.com/remuneration.

¹ Includes the shares and share-based rights in the company and companies belonging to the same group held by the CEO or CMC member and corporations over which he or she exercises control.

Descriptions of internal control procedures and the main features of risk management systems

Main features of the risk management process and its regulation to internal control

The purpose of Citycon's risk management and internal control is to ensure that the group's operations are both efficient and effective, that reporting is consistent and reliable and that the applicable laws and regulations as well as the Citycon group's operating principles are observed. Internal control of financial reporting aims to ensure that any interim and half-yearly reports and financial statements to be published are reliable and are prepared in compliance with the accounting policies and reporting principles applied by Citycon and give materially correct information about the company's financial position.

On 31 December 2024 Citycon had a total of 62 subsidiaries and 5 joint ventures and associated companies.

"The objective of Citycon's risk management is to ensure that the business targets are achieved by identifying, assessing and monitoring key risks as well as to extent possible, avoid, transfer or mitigate these risks."

1. General description of risk management

Citycon is exposed to various risks through the normal course of its business operations. No business can be conducted without accepting a certain risk level, and expected gains are to be assessed against the involved risks.

Citycon's risks are managed in the various functions as a part of operational management. Risk management constitutes part of the company's internal control.

The risk management and reporting process involves:

• identifying new and existing risks
• assessing the risk management measures
• making new risk limitation plans if the current measures are not deemed sufficient for the management of the identified risks.

The risk reporting process gathers data on risk analysis, risk management plans and risk owners into one groupwide risk register, for annual reporting to Citycon's Board of Directors. This is done in conjunction with the budgeting process so that the risks are linked to the annual targets. To evaluate the importance of each risk, an estimate of the potential future loss associated with the realisation of the risk is determined together with the probability of the realisation of the risk, whenever possible. This also improves the comparability of risks between business units and functions. In addition, the realised risks during the previous year are assessed and reported.

CEO and other

members of the CMC

Audit

Each function in the company has a designated person who is the owner of risk management in that area and is also responsible for the reporting of risks, limitation plans and monitoring the implementation of the plans. Key risks are reported to the Risk Steering Committee, that evaluates the risks and prepares a report of the Group's key risks for the Board of Directors. The CEO and the Corporate Management Committee are responsible for developing and maintaining the processes in accordance with the risk management principles approved by the Board of Directors. The Board of Directors monitors the company's business risks and uncertainties on a regular basis and reports them as required by law and the regulations and guidelines issued by the FIN-FSA.

Each year, Citycon assesses risks related to processes deemed significant to financial reporting, to serve as a basis for internal control over external financial reporting. In addition to the group's finance function, the business units' financial management participates in the risk assessment process.

The company's key risks and uncertainties and the most important risk management measures and principles are covered more extensively in Citycon's Financial Statements.

2. General description of internal controls

Citycon's internal control system is based on the international COSO 20131 framework. It includes the key principles related to the control environment, risk assessment, control activities, information, communication and monitoring activities. The cornerstones of Citycon's control environment include group-level operating policies and guidelines, harmonised controls in the operating processes and assessment of controls and deviations during the reporting period.

"Each year, Citycon assesses risks related to processes deemed significant to financial reporting, to serve as a basis for internal control over external financial reporting."

Main features of the risk management process and its relation to internal control

First defence line Business processes and support functions

Second defence line Risk management, internal control environment, group guidance

Third defence line Internal audit

Independent reporting line

Audit and Governance Committee

Overall responsibility Board of Directors

3. International COSO framework as the foundation for internal control

Control environment

At Citycon, the Board of Directors is responsible for arranging and maintaining adequate and effective internal control. The division of duties included in Citycon's Corporate Governance Guidelines and the group's organisational structure ensure that the areas of responsibility and division of authority are clear for all functions and the management and employees.

In accordance with the Board of Directors' and its committees' written charters, the Board's Audit and Governance Committee assesses the company's financial reporting process and the appropriateness of the internal control system and reviews the internal control reports. The duties of the Board of Directors and the Audit and Governance Committee are presented in more detail in the section regarding the Board of Directors and its committees.

CEO's duty is to attend to the implementation of practical actions regarding internal control and to maintain an organisational structure in which responsibility, authority and reporting relationships are clearly and comprehensively defined in writing. At Citycon an authorisation matrix is in use where the division of authority for each organisational role is specified through approval limits.

Citycon's ethical principles and business norms are specified in Citycon's Code of Conduct. Compliance with the principles is promoted through internal communication and training. Citycon strives to ensure that its key business partners also comply with the same or similar principles.

4. Control activities

The company's accounting and reporting manuals define the standards, processes and responsibilities for financial reporting. These manuals facilitate the achievement of Citycon's objectives regarding the reliability of financial reporting. The Board of Directors approves group-level policies as determined in company's Corporate Governance Guidelines. Meetings are held on a regular basis in which the manuals are discussed with all personnel involved in the financial reporting process.

Descriptions of processes that are significant to Citycon's business and reporting have been documented. The process descriptions have been supplemented by defining control points in each process, based on the risk assessment of reporting. These control points include, for example, approvals, reconciling sub-ledgers and accounts, analytical reviews, limitations of access rights and segregation of duties. The defined control points are designed to prevent, detect and correct material errors and deviations in financial reporting.

Read more

The group's personnel and business partners can report suspected violations of Citycon's Code of Conduct on Citycon's website at citycon.com/investors/corporategovernance/code-of-conduct/report-a-violation.

5. Information and communication

All external communication is carried out in accordance with Citycon's Disclosure Policy. The Board of Directors approves all financial reports issued by the company, before they are published as stock exchange releases. The company's external communications are carried out in several events and in different channels.

The company's external communications are carried out in several events and in different channels:

6. Monitoring activities

Citycon's business unit executives are responsible for ensuring that the relevant laws and regulations are adhered to in their respective functions of responsibility. The Corporate Management Committee also monitors compliance with laws and regulations as part of regular supervisory activities. The financial performance of the group and business units is monitored monthly through the group's business review processes.

In Citycon group, monitoring of internal control includes both ongoing and separate evaluations and audits. The objective of the monthly analysis of reported figures at various levels (e.g. shopping centre, cluster, business unit, group) is to detect whether the reported figures deviate from budgeted or forecast figures. The purpose of monitoring and testing of internal controls is to detect control deviations in each significant process for financial reporting that might affect the accuracy of Citycon's financial reporting if the deviation in question would not be corrected.

In 2024, testing of internal controls continued with regard to the main processes of the group management and business units. Citycon's internal control framework was reviewed and updated to be in line with current roles, responsibilities and structures. Internal controls testing was conducted by assessors who are independent of the business unit's daily operations and were steered by the group management. The significance and impacts of deviations detected in these tests were evaluated by the group management, and the necessary corrective measures were initiated. On the basis of the resulting summary drawn up by the group management, there are no indications that these control deviations would lead to material errors in Citycon's financial statements.

Other information

1. Description of the internal audit organisation and the main principles followed in the internal audit

Citycon has a separate internal audit function. The duties of internal audit include independent and objective auditing activities, as well as value-adding consulting activities that improve operations. Internal audit contributes to the achievement of company's objectives through systematic assessment and development of the company's risk management, internal control and corporate governance processes. The internal audit function reports directly to the Board's Audit and Governance Committee and, administratively, to the CEO. The internal audit reporting relationships are also described in section Descriptions concerning corporate governance of this statement (see the figure under Citycon's corporate governance structure). A representative from Citycon's organisation coordinates the internal audit services, which were purchased from an external service provider in 2024.

The internal audit work is based on the Internal Audit Charter, as approved by the Audit and Governance Committee. According to the charter, the duties of internal audit include, among others, assisting the Board of Directors, its committees and the corporate management with the assessment of processes related to the identification and management of risks, supervision of financial reporting, efficiency of operations and compliance with law. Within the scope of the authorisation granted through the Internal Audit Charter, the internal audit function has unlimited access to Citycon's functions, processes, documents and information regarding personnel to perform audits.

The internal audit function assists the Board's Audit and Governance Committee in assessing and monitoring the adequacy and effectiveness of Citycon's internal controls and risk management, by performing audits in group legal entities and processes in accordance with the annual plan approved by the Board's Audit and Governance Committee. The internal audit plan is approved by the Audit and Governance Committee at its meeting each year. The progress of audits under the internal audit annual plan is reported to the Board's Audit and Governance Committee each quarter. In addition, the Board's Audit and Governance Committee deals with each internal audit report at its meeting, including observations, recommendations and action plans. The progress of implementing the action plans is reported to the Audit and Governance Committee.

Citycon's internal audit plan for the year 2024 focused on follow-up of previous years' audits and status of recommendations implementation, IT and information security risks. Furthermore, the internal audit plan focused on billing process and billing accuracy and benefits of harmonized common IT-system Workday (ERP).

2. Related party transactions

The related parties of the company mean the related parties of a listed company in accordance with IAS 24. The company has determined that its related parties comprise Citycon and its subsidiaries, associated companies, and joint ventures; Board members; CEO and other Corporate Management Committee members; and the company's largest shareholder G City Ltd. that held 49.54%1 of the company's shares and votes on 31 December 2024.

The Group Finance shall report all company's transactions with the related parties to the Chief Financial Officer and Legal Affairs on a quarterly basis. The Group Finance shall immediately inform the Legal Affairs of any contemplated transaction, which would be entered into with a related party and not be (i) entered into in the ordinary course of business; or (ii) concluded on normal market terms.

The Board of Directors shall handle related party transaction monitoring and evaluation in its meetings where the financial statements are approved, and in other meetings if needed. The company evaluates and monitors transactions concluded between the company and its related parties and reports them, as required by the Finnish Limited Liability Companies Act and regulations concerning the preparation of financial statements, in the Company's Report by the Board of Directors and in the notes to the financial statements and interim and half-yearly reports.

The Directors independent of the company's significant shareholder G City Ltd. have in 2023 resolved to approve the reoccurring related party transactions between Citycon and G City Ltd. The reoccurring related party transactions include the reporting cost expenses charged by Citycon from G City. The approval decision is valid until further notice or until there are significant changes in reporting costs. In addition, the Company´s Chief Financial Officer reports quarterly on the Company´s other related party transactions, if any, to the Audit and Governance Committee and to the members of the Board of Directors who are independent of significant shareholders.

The nature of a related party transaction and its terms are evaluated, in particular, with respect to the Company's ordinary course of business and armslength terms. Standard agreements that are offered to customers and personnel in general are typically part of the ordinary course of business, which means they do not require special monitoring or assessment measures.

Related party transactions which are part of the ordinary course of business and implemented under arms-length terms, do not require a decision of the Board of Directors independent of the Company.

In decision-making pertaining to related party transactions, the company ensures that potential conflicts of interests are appropriately taken into account and related parties or their representatives do not participate in the decision-making.

In 2024, the company did not engage in business transactions with related parties deviating from the company's normal business operations or under unordinary market terms.

¹ In total, G City Ltd. and its wholly owned subsidiary Gazit Europe Netherlands BV own 49.54% of the total shares and votes in the company (91,259,016 shares as of 31 December 2024). G City Ltd. owns 29.84% and its wholly owned subsidiary Gazit Europe Netherlands BV 19.70% of the company's shares and votes.

3. Main procedures relating to insider administration

In its insider administration, Citycon applies the EU's Market Abuse Regulation (MAR) and the Insider Guidelines issued by Helsinki Stock Exchange. The company's own Insider Guidelines approved by the company's Board of Directors supplement the applied insider regulation and specify the company's insider administration procedures. The company's Group Legal Counsel is in charge of Citycon's insider matters.

3.1 Persons discharging managerial responsibilities and insider lists

The company has specified the members of the Board of Directors, the CEO and members of the Corporate Management Committee as its managers as referred to in the MAR. Citycon maintains a list of managers and their closely associated persons. The persons on the list are obligated to report their business transactions in Citycon's financial instruments to the company and the FIN-FSA. Citycon publishes such transactions in stock exchange releases.

At the beginning of insider projects, the company sets up project- or event-based insider lists. The lists include information of persons participating in projects, such as capital market events or significant company or property transactions. During an insider project, listed persons are not allowed to trade in financial instruments related to the company.

3.2 Closed period and trading restrictions

Citycon applies a closed period of 30 calendar days prior to announcing its financial statements, half-yearly reports and interim reports. The closed period concerns persons discharging managerial responsibilities in the company and other company employees who participate in the preparation of financial statements, half-yearly reports and interim reports. During that period, they are not allowed to trade in securities issued by Citycon, or other securities or financial instruments targeting Citycon shares or securities entitling to Citycon shares. In addition, persons discharging managerial responsibilities are at all times obligated to consult Citycon's insider administration prior to a planned transaction in Citycon's financial instruments.

4. Auditor and remuneration paid to the auditor

On 19 March 2024, Citycon's AGM elected audit firm Deloitte Oy as the company's auditor, with Anu Servo (Authorised Public Accountant) acting as the responsible auditor appointed.

In 2024, Citycon paid EUR 1.4 million in remuneration to its auditor, related to its general audit. In addition, Citycon purchased advisory services from the auditor for EUR 0.0 million.

Read more

Managers' and their closely associated persons' transactions in Citycon financial instruments are published in the Managers' Transactions section in the Citycon Newsroom at citycon.com/newsroom.

Read more

Closed window periods are shown in the investor calendar which is available at citycon.com/investor-calendar.