Lehto Group Oyj

Governance Information • Apr 30, 2025

Corporate Governance Statement 2024

1.	INTRODUCTION 2
2.	DESCRIPTIONS CONCERNING CORPORATE GOVERNANCE 2
	General Meeting of Shareholders 2
	Shareholders' Nomination Committee 3
	Board of Directors 4
	Board committees 8
	Group Management 9
3.	MAIN FEATURES OF THE INTERNAL CONTROL AND RISK MANAGEMENT SYSTEMS RELATED TO THE FINANCIAL REPORTING PROCESS 11
	Risk management 11
	Internal control 12
	Internal controls over financial reporting 13
	Risk management and internal control roles and responsibilities 14
4.	OTHER INFORMATION TO BE PROVIDED 15
	Insider Administration 15
	Related party administration 16
	Internal auditing 16
	Auditing 16

1. Introduction

The governance of Lehto Group Plc (hereinafter referred to as the "Company" or "Lehto") is determined by the Company's Articles of Association, Finnish laws (such as the Limited Liability Companies Act and the Securities Markets Act) and the Company's Corporate Governance Guidelines. The Company complies with the Corporate Governance Code 2025 (the "Corporate Governance Code") prepared by the Securities Market Association, which entered into force on 1 January 2025. The Corporate Governance Code can be viewed in its entirety on the Securities Market Association's website at www.cgifinland.fi.

This report has been issued separately from the Board of Directors' Report. The Company's Board of Directors approved this report on 25 April 2025 and the Company's auditor has reviewed this report. The Company's statutory governing bodies are the Annual General Meeting, the Board of Directors, the CEO and the auditor. The Company's registered office is in Kempele. This corporate governance statement is publicly available on the Company's website at www.lehto.fi/en/investors/corporate-governance.

2.Descriptions concerning corporate governance

The responsibility for Lehto Group's corporate governance has been divided in accordance with the Limited Liability Companies Act between its General Meeting of Shareholders, the Board of Directors and the CEO. Shareholders exercise their rights mainly in the General Meeting of Shareholders, which is normally convened by the Company's Board of Directors. Furthermore, a General Meeting of Shareholders must be held if so required in writing by the Company's auditor or shareholders representing at least one tenth of all shares issued by the Company.

General Meeting of Shareholders

The General Meeting of Shareholders is Lehto Group's highest decision-making body. According to the Limited Liability Companies Act, the shareholders exercise their power of decision in matters related to the Company at the General Meeting of Shareholders. The General Meeting of Shareholders decides on matters required by the Limited Liability Companies Act and the Company's Articles of Association. The shareholders participate in the General Meeting of Shareholders either personally or through a representative. Each share entitles its holder to one vote.

The Annual General Meeting is held annually on the date determined by the Board of Directors, within six (6) months from the termination of the financial year. In accordance with the Limited Liability Companies Act and the Articles of Association, the Annual General Meeting decides on matters that fall within its competence, such as adoption of the financial statements, the use of the profit shown on the balance sheet, and the appointment of the members of the Board of Directors and the auditor and their remuneration. The Annual General Meeting also decides on the discharge of the Members of the Board of Directors and the Chief Executive Officer from liability. An Extraordinary General Meeting shall be held if the Board of Directors considers it necessary or if the Company's auditor or shareholders whose sharesrepresent at least one tenth of all shares issued by the Company so demand in writing in order for a given matter to be dealt with.

In accordance with the Company's Articles of Association, a written notice of a General Meeting of Shareholders shall be given to shareholders no earlier than three (3) months and no later than three (3) weeks prior to the shareholders' meeting, however, no later than nine (9) days prior to the record date

of the General Meeting of Shareholders. A notice of a General Meeting of Shareholders shall be given by publishing it on the Company's website or in some other verifiable written form.

Shareholders' Nomination Committee

On 11 April 2017, the General Meeting of Lehto Group Plc decided to establish a Shareholders' Nomination Committee to prepare proposals regarding the members of the Board of Directors and Board remuneration for the Annual General Meeting. The main task of the Nomination Committee is to ensure that the Board of Directors is sufficiently diverse and that its members have sufficient expertise, competence and experience to meet the needs of the Company. In its operations, the Nomination Committee complies with applicable legislation, the Corporate Governance Code and other rules and regulations concerning the Company. The Nomination Committee's charter can be viewed at https://lehto.fi/en/shareholders-nomination-committee/.

The members of the Nomination Committee shall be representatives of the three (3) largest shareholders who have received the assignment. The largest shareholders are determined annually on the last trading day of September for public trading organized by Nasdaq Helsinki Ltd, based on the Company's shareholder register maintained by Euroclear Finland Ltd. Each of the three largest shareholders shall appoint one (1) representative to the Nomination Committee. If someone does not exercise their right to appoint, the right shall be transferred to the next shareholder in order of size who would otherwise not have the right to appoint. The Chairman of the Company's Board of Directors shall act as an expert member of the Nomination Committee without voting rights. The members of the Nomination Committee shall not receive any remuneration for their membership of the Committee.

The Nomination Committee has a quorum when more than half of its members with voting rights are present. The Nomination Committee may not make a decision unless all its members have been given the opportunity to participate in the consideration of the matter and the meeting.

The term of office of a member of the Nomination Committee is valid until the last trading day of public trading organized by Nasdaq Helsinki Ltd in October following the election.

The Nomination Committee prepares a proposal for the composition of the Board of Directors for the Annual General Meeting, where the matter will be decided. When making the proposal, the Nomination Committee takes into account the requirements of the Corporate Governance Code and the annual assessment of the Board of Directors. If necessary, the Nomination Committee may also consult external experts.

During the term of office until the end of October 2024, the Nomination Committee consisted of the following members: Hannu Lehto (appointed by Lehto Invest Oy), Jouni Hämäläinen (appointed by J&K Hämäläinen Oy) and Markku Tuuli. All members of the Nomination Committee are men.

Board of Directors

The General Meeting of Shareholders elects the members of the Board of Directors. By virtue of the Company's Articles of Association, the Company has a Board of Directors which consists of three to eight (3–8) ordinary members. The Board members' term of office shall expire at the end of the next Annual General Meeting following their election. The Board of Directors elects a chairman from among its members.

Composition and operations of the Board of Directors

The Board of Directors has drawn up a charter of the Board of Directors, which defines the Board's key duties and operating principles.

The Board of Directors shall see to the administration of the Company and the appropriate organisation of its operations and is responsible for the appropriate arrangement of the control of the Company's accounts and finances. The Board of Directors, among its other duties, controls and supervises the Company's operative management, appoints and discharges the CEO, determines the duties and conditions of employment of the CEO, approves the strategic objectives and the principles of risk management for the Company and its businesses and ensures the proper operation of the management system. Furthermore, the Board of Directors shall prepare together with the Shareholders' Nomination Committee a Remuneration Policy of the Company and presents it to the Annual General Meeting for discussion as well as prepares and presents the Remuneration Report for the Annual General Meeting.

The Board of Directors also ensures that the Company has defined the operating principles for internal control and that the Company monitors the functioning of the internal control. The Boardof Directors approves the policies and guidelines for internal control, risk management and corporate governance, as well as the Company's information dissemination policy. Based on the Company's strategy, the Board of Directors approves the action plan and budget and supervises their implementation. Furthermore, the Board of Directors annually approves the total amount and priorities of investments in the Company's business operations and decides on major and strategically important investments, acquisitions and divestments. The Board of Directors confirms the Company's ethical values and working methods and monitors their implementation. The Board of Directors also defines the Company's dividend policy on the basis of which it submits a dividend proposal to the Annual General Meeting for consideration.

The Board of Directors or a member of the Board of Directors shall not comply with a decision of the General Meeting of Shareholders or the Board of Directors where it is invalid owing to being contrary to the Limited Liability Companies Act or the Company's Articles of Association.

The Company aims to ensure that its Board of Directors has, as a whole, and taking into account its duties, sufficient and versatile expertise and experience. In the preparation of the proposal of the Shareholders' Nomination Committee for the composition of the Board of Directors, particular attention shall be paid to the requirements set by the company's operations and development stage, and furthermore it shall be ensured that the Board of Directors and its members have sufficient expertise, know-how and experience to meet the requirements of the company. A person elected as a Board member must have the competence required by the position and the possibility to devote a sufficient amount of time to attending to the duties. The number of Board members and the composition of the board of directors shall be such that they enable the Board of Directors to see to its duties efficiently. For the evaluation of the diversity and composition of the Board of Directors, individuals who have been proposed as members shall, in confidence and as instructed by the Company, provide the information required to evaluate their competence and the amount of time they can devote to the task to the Shareholders' Nomination Committee.

The Board of Directors shall also evaluate the independence of its members. The majority of the Board members shall be independent of the Company. Furthermore, at least two (2) members who are independent of the Company shall also be independent of the significant shareholders of the Company. Board members' independence shall be evaluated on an annual basis.

Until the 2024 Annual General Meeting (June 19, 2024), the members of the Board of Directors have been Eero Sihvonen (Chairman), Jani Nokkanen and Hannu Lehto. Since the date of the Annual General Meeting, the members of the Board of Directors have been Timo Okkonen (Chairman), Tarja Teppo, Jani Nokkanen and Hannu Lehto.

In 2024, the Company's Board of Directors held a total of 27 meetings and the average attendance rate of the Board members was 99 %.

Basic information on the members of the Board of Directors, their independence, remuneration, shareholdings and participation in Board meetings is presented in the following tables.

Members of the Board of Directors 2024
Name	Gender	Year of birth	Education	Position	Independence of the Company	Independence of significant shareholders
Until 19 June 2024
Eero Sihvonen	Male	1957	M.Sc. (Econ.)	Chairman	Yes	Yes
Jani Nokkanen	Male	1977	M.Sc. (Econ.)	Member	Yes	Yes
			Construction
Hannu Lehto	Male	1963	engineer	Member	No	No
From 19 June 2024
Timo Okkonen	Male	1965	Dr.Sc (Tech.)	Chairman	Yes	Yes
Tarja Teppo	Female	1972	Dr.Sc (Tech.)	Member	Yes	Yes
Jani Nokkanen	Male	1977	M.Sc. (Econ.)	Member	Yes	Yes
			Construction
Hannu Lehto	Male	1963	engineer	Member	No	No

Remuneration of the members of the Board (incl. Audit committee fees) and attendance in meetings 2024
Name	Remuneration paid as cash, eur	Remuneration paid as shares, eur	Board and Committee meeting fees, eur	Attendance in Board meetings
Eero Sihvonen (until 19 June 2024)	10 350	0	3 000	18/18
Timo Okkonen (from 19 June 2024)	9 000	0	0	9/9
Tarja Teppo (from 19 June 2024)	6 000	0	0	9/9
Jani Nokkanen	11 175	0	1 500	26/27
Hannu Lehto	5 175	0	1 500	27/27
Board of Directors in total	41 700	0	6 000	99 %

Board members direct and indirect holdings of shares, 31 December 2024*)
Name	Number of shares held	Shareholding ratio
Timo Okkonen	0	0,00 %
Tarja Teppo	0	0,00 %
Jani Nokkanen	96 771	0,06 %
Hannu Lehto	191 745	0,12 %
Lehto Invest Oy, a company controlled by Hannu Lehto* (status 28 Feb
2025)	80 914 760	49,84 %
Board of Directors in total	81 203 276	50,02 %

* Lehto Invest Oy's shareholding increased as a result of the conversion of the convertible bond carried out on 31 December 2024. The new shares resulting from the conversion were registered in the Trade Register on 31 January 2025, when Lehto Invest Oy's shareholding increased to 51.63 %. At that time, Lehto Invest Oy announced that it would use the exception provided for in Chapter 11, Section 21, Subsection 5 of the Securities Markets Act, and that it would relinquish its voting rights exceeding the tender obligation limit within one month of the tender obligation arising, i.e. by 28 February 2025.

On February 28, 2025, Lehto Invest Oy announced that it had transferred 2,900,000 shares, as a result of which Lehto Invest Oy's ownership of all shares in Lehto Group Oyj decreased to 49.84%.

Presentation of the board members

Timo Okkonen has served as a member of the Board of Directors and Chairman since the 2024 Annual General Meeting. Previously, he has served as Chief Operating Officer at Fennovoima Oy and CEO at Inspecta Oy. Currently, Okkonen works as an entrepreneur and management advisor in many nuclear energy projects in Sweden and Finland. Timo Okkonen's strengths are in business strategy, change management and digital solutions. Okkonen is well-versed in the development prospects of the energy sector and the regulatory environment. Okkonen holds a Doctor of Science (Technology) degree.

Tarja Teppo has served as a member of the Board of Directors since the 2024 Annual General Meeting. Teppo has over 20 years of experience working with growth companies in the energy and clean technology sectors. She is one of the founders of Cleantech Invest (Nasdaq First North Helsinki listing in 2014). Teppo is now developing Action Energy Finance, a company she founded in 2021 that focuses on project financing for energy and resource efficiency projects. Tarja Teppo's strengths are in the development of growth companies in energy technology, financial arrangements and fundraising. Teppo holds a Doctor of Science (Technology) degree.

Jani Nokkanen has been a member of the Board of Directors since Annual General Meeting 2021. Currently Nokkanen is working as the CIO and Partner and member of the Board of Directors of NREP Oy where he has worked since 2008 in different key roles of development and financing. Before NREP he worked in management consulting and strategy related roles. Nokkanen holds the degree of M.Sc. (Econ.).

Hannu Lehto has served as a member of the Board of Directors since the 2021 Annual General Meeting and as Chairman since the 2021 Annual General Meeting until 5 December 2022. He has strong experience in both entrepreneurship in the construction industry and in management positions at Lehto Group in various stages of the company. Hannu Lehto is the company's founding shareholder and has served as the company's CEO first in 2008–2013, from 2014 until May 2021 and again from May 2024 onwards. In addition, he has served as both a member of the Board of Directors and Chairman in previous years. Hannu Lehto has been involved in the operations of Lehto Group and its subsidiaries for a total of over 35 years. Lehto is a civil engineer (Construction) by education.

Expired board memberships

Eero Sihvonen served as a member of the Board of Directors since the 2022 Annual General Meeting. Sihvonen also served as Chairman of the Board from December 2023 to June 2024, when he stepped down from the Board of Directors.

Statement on the implementation of the Board Diversity Policy 2024

In 2017, the Board of Directors confirmed that the Company's Board Diversity Policy shall be followed in the selection of the persons proposed as Board members. The implementation of the diversity policy will be monitored on an annual basis in connection with the Corporate Governance Statement.

In order to be able to comprehensively support and develop the Company's business, the composition of the Board of Directors shall be sufficiently diverse. When selecting the persons to be proposed as Board members a balance with regard to the educational background, professional skills, experience, nationality as well age and gender distribution of its members shall be considered. As a whole, the composition of the Board of Directors shall be such that the directors have sufficiently comprehensive competence, skills and experience. The Shareholders' Nomination Committee shall take into consideration the sufficient diversity of the Board when preparing the suggestion for the composition of the Board.

The Board of Directors elected by the Annual General Meeting on 19 June 2024 has four members, three of whom are men and one woman. The proportion of women among the Board members is therefore 25%. The Board consists of individuals with both commercial and technical expertise. The Board is made up of people of different ages and educational backgrounds and has strong expertise in energy markets, finance and growth companies. The Board members also have experience in megatrends identified by the Company, international assignments, the ability to develop the Company's operations and also assess the views of parties using the Company's services.

According to the self-assessment conducted by the Board of Directors, diversity is well implemented in the Company's Board of Directors and the Board members have been able to devote sufficient time to Board work to ensure the Board's operating conditions.

Board committees

The preparation of matters falling within the responsibility of the Board of Directors can be made more efficient by establishing Board committees, where matters can be studied more extensively. The Board of Directors decides on the establishment of committees, unless otherwise provided for in the Articles of Association. The establishment of committees may be necessary, in particular, for the supervision of the company's reporting and control systems and the appointment of management personnel, as well as for the development of the company's remuneration systems. The committees assist the Board of Directors by preparing matters falling within the responsibility of the Board of Directors. The Board of Directors is responsible for carrying out the tasks assigned to the committees. The committees do not have independent decision-making power, but the Board of Directors makes the decisions incumbent upon it collectively.

Audit committee

The Corporate Governance Code states that an audit committee must be established in a company whose scope of business requires the preparation of financial reporting and control matters in a smaller composition than the entire board. The members of the audit committee must have sufficient expertise and experience, taking into account the scope of the committee and the mandatory tasks related to auditing. The majority of the members of the audit committee must be independent of the company and at least one member must be independent of the company's significant shareholders. However, an audit committee need not be established in companies where it is not justified, for example, due to the

company's business operations, its stage of development or the size of the company or the composition of the board of directors.

According to the Corporate Governance Code, a company must either have an audit committee or the entire board of directors must perform the mandatory tasks of the audit committee or they must be assigned to another committee.

Lehto Group Plc has had an Audit Committee until 19 June 2024, but due to a significant reduction in the Company's business, the new Board of Directors elected at the Annual General Meeting decided to abolish the Audit Committee and transfer its duties to the entire Board of Directors.

In 2024, the Audit Committee did not have separate meetings, but the Committee's duties were performed by the Board of Directors, which met very frequently. The Company's Board of Directors is responsible for performing the following basic tasks, which are normally assigned to the Audit Committee, among others:

• monitoring the financial reporting process
• monitoring the effectiveness of the Company's internal control, any internal audit and risk management systems
• reviewing the description of the main features of the Company's internal control and risk management systems related to the financial reporting process
• monitoring the statutory audit of the financial statements and consolidated financial statements
• monitoring the independence of the statutory auditor or audit firm and the criteria for providing outsourced services
• preparing a proposal for a decision on the selection of the auditor.

During 2024, the Board of Directors has dealt with, among other things, the following matters that are normally the responsibility of the Audit Committee:

• assessment and implementation of structural arrangement options
• preparation and implementation of the company's restructuring program
• launching the new energy construction business and verifying the operating conditions of the business
• management of the company's liquidity and acquisition of financing..

Group Management

CEO

The CEO is in charge of the day-to-day management of the company in accordance with the instructions and orders issued by the Board of Directors. The CEO is responsible for ensuring that the Company's accounting practices are in compliance with the law and that the financial matters are organised in a reliable manner. The CEO has a duty to provide the Board of Directors and its member(s) with any information that the Board of Directors may need in order to see to its duties.

The CEO may undertake measures that are unusual or extensive, considering the scope and nature of the Company's operations, only with the authorisation of the Board of Directors or if it is not possible to wait for a decision of the Board of Directors without causing essential harm to the Company's operations. In the latter case, the Board of Directors shall be notified of the measures as soon as possible.

Juuso Hietanen, born 1977, has been the Company's CEO from May 2021. Hietanen was Bonava Finland's CEO prior to joining the Company. Prior to that, he held management positions in housing

production at NCC since 2004 in Finland, Russia, and the Baltic countries. Juuso Hietanen holds the degree of M.Sc. (Eng.).

At the end of the financial period 2024 Juuso Hietanen owned directly or indirectly 230,890 shares of the Company which represeented 0.26 % of all shares in the Company at that time.

Hannu Lehto, born 1963, has served as the Company's CEO since the beginning of May 2024. He has strong experience in both construction entrepreneurship and Lehto Group's management positions in various phases of the company. Hannu Lehto is the company's founding shareholder and has served as the company's CEO previously, first in 2008–2013 and from 2014 until May 2021. In addition, he has served as both a member of the Board of Directors and Chairman in previous years. Hannu Lehto has been involved in the operations of Lehto Group and its subsidiaries for a total of over 35 years. Lehto is a civil engineer by education.

At the end of the financial year 2024, Hannu Lehto directly or indirectly owned 34,106,505 shares in the Company, which represented a total of 39.1 % of all shares in the Company at that time. On the closing date of the financial year, 31 December 2024, the EUR 9.98 million investment in the Company's convertible bond by Lehto Invest Oy, a company controlled by Hannu Lehto, was converted into shares. The new shares resulting from the conversion were registered in the Trade Register on 31 January 2025, at which time Lehto Invest Oy's ownership increased to 51.63 %. At that time, Lehto Invest Oy announced that it would use the exception provided for in Chapter 11, Section 21, Subsection 5 of the Securities Markets Act, and that it would relinquish its voting rights exceeding the tender obligation threshold within one month of the tender obligation arising, i.e. by 28 February 2025

On 28.2.2025, Lehto Invest Oy announced that it had transferred 2,900,000 shares, as a result of which Lehto Invest Oy's holding of all shares in Lehto Group Oyj decreased to 49.84 %.

On 28.2.2025, the combined holding of Hannu Lehto and Lehto Invest Oy of all shares in the Company was 49.96 %

Group's management team and other management

In 2016-2023, the Group had a Group management team, which supported the CEO in the tasks within the CEO's competence, their implementation and monitoring, especially in terms of business development, financing, asset management, internal control and risk management.

The company decided to dissolve the Group management team in February 2024 because the company's operations were significantly reduced as a result of the bankruptcies of its subsidiaries engaged in the construction business, and the company no longer has operations that would require management team work.

Veli-Pekka Paloranta, born 1972, has served as Lehto's CFO since November 2015. In 2000–2015, Paloranta worked in financial administration positions at JOT Automation, Rohwedder and Elektrobit groups. In 2010–2015, he served as Bittium Corporation's (formerly Elektrobit Corporation) Group CFO, and since 2020, he has served as a member of Bittium Corporation's Board of Directors and Audit Committee. In addition, since 2014, Paloranta has served as the Chairman of the Board of Directors of Paloranta Oy. Paloranta holds a Master of Science (Econ.) in Economics.

At the end of the 2024 financial year, Paloranta directly or indirectly owned 501,653 shares in the Company, representing 0.57 % of all shares in the Company at that time.

3.Main features of the internal control and risk management systems related to the financial reporting process

Risk management

The purpose of risk management is to secure positive development of earnings of the Company and the continuation of the business by implementing risk management cost-effectively and systematically throughout the different businesses. Risk management is part of the Company's strategic and operative planning, daily decision-making process and internal control system. Business objectives, risks and risk management operations are combined through risk management as one chain of events.

The Company adheres to the risk management policy approved by the Board of Directors. Risk management contains all actions, which are connected to setting up targets, identification of risks, measurement, review, handling, reporting, follow-up, monitoring and reacting to risks.

In connection with the strategy process and annual planning, the CEOs of the Company and the EVP's of business areas review business risks which could prevent or endanger the achievement of the Group's strategic or profit targets. The service areas produce risk assessment reports for each business to support the strategy process. Strategic and operative risks are monitored through reporting by the businesses and considered by service area-specific steering groups that convene monthly. The service areas must produce assessments of risks in their own units and provide action plans to manage risks as well as to report on measures taken including the stage and effectiveness of such measures.

The Company's CEO reports the identified risks concerning the Group as well as all planned and effected measures to control such risks to the Board of Directors.

The aim of risk management is to:

• systematically and thoroughly identify and assess all major risks, which threaten the achievement of objectives, including risks related to business operations, property, agreements, competence, currencies, financing and strategy;
• optimise business opportunities and secure continuation of business;
• recognise and identify uncertainties and subsequently develop the prediction of risks and measures needed to manage risks;
• take only calculated and carefully assessed risks with respect to e.g. expanding the business, increasing market share and creating new businesses;
• avoid or minimise liability risks;
• ensure the safety of products, solutions and services;
• establish a safe working environment for the employees;
• minimise possibilities for unhealthy occurrences, crimes or misconduct by operating procedures by various systems, control, and immediate response;
• inform interest groups of risks and risk management; and
• be cost-effective in risk management.

The aim of risk management is not to:

• remove all risks in their entirety;
• adapt unnecessary controlling mechanisms; or
• create unnecessary administrational burden.

Internal control

Internal control is a process performed by the Board of Directors, management and all Group personnel to ensure that there is a reasonable assurance that

• operations are effective, efficient and aligned with strategy;
• financial reporting and management information is reliable, complete and timely made; and
• the Company is in compliance with applicable laws and regulations as well as the Company's internal policies and ethical values.

The first category addresses the basic business objectives, including performance and profitability goals, strategy, implementation of objectives and actions and safeguarding resources.

The second category relates to the preparation of reliable published financial statements, including interim reports and condensed financial statements and selected financial data derived from such statements, such as earnings releases, reported publicly.

The third deals with complying with those laws, regulations, and internal procedures to which the Company is subject to.

Lehto Group's internal control framework consists of:

• the internal control, risk management and corporate governance policies and principles set by the Company's Board of Directors;
• management overseeing the implementation and application of the policies and principles;
• the Finance department monitoring the efficiency and effectiveness of the operations and reliability of the financial and management reporting;
• the Company's risk management process identifying, assessing and mitigating risks threatening the realization of the Company's objectives;
• compliance procedures making sure that all applicable laws, regulations, internal policies and ethical values are adhered to;
• effective control environment at all organisational levels including control activities tailored for defined processes and creating minimum requirements for the Group's business segments and geographical areas;
• shared ethical values and strong internal control culture among all employees; and
• internal audit assignments reviewing the effectiveness of the internal controls as needed.

Risk management procedures are in place for business processes in the form of defined control points:

• relevant process risks are identified;
• common control points/Group's minimum requirement control points are identified;
• common control points are implemented in business processes;
• additional control points can be determined as needed at business or functional levels.

Control activities are the policies and procedures that help ensure that management directives are carried out. They help ensure that necessary actions are taken to address risks in order to achieve the Company's objectives. Control activities are set throughout the organisation, at all levels and in all functions. They include a wide range of activities, such as approvals, authorisations, verifications, reviews of operating performance, security of assets and segregation of duties.

Internal controls over financial reporting

The purpose of internal controls over financial reporting is to ensure the accuracy, reliability, timeliness and appropriateness of financial information.

Financial reporting organisation and duties

The Group's financial administration is centralized in the Group's parent company. During 2024, the accounting of all Group companies was outsourced to an accounting firm, which handles the receipt, recording, payment transactions and general ledger accounting. The Company can continuously monitor the situation of sales invoicing, purchase invoices and cash transactions from the information systems maintained by the accounting firm. The accounting firm produces a monthly accounting summary for each Group company in accordance with the cost center and project allocation defined by the Company.

The Company's own financial administration consists of a CFO and one administrative employee. The financial administration directs and cooperates with the accounting firm to produce correct, up-to-date and reliable financial information to support decision-making. The financial administration is also responsible for handling several corporate law matters.

Financial reporting systems

The Group's main financial information system is the Talenom Online system provided by the accounting firm Talenom Oyj, which registers accounting transactions and allows the Company's management to monitor the financial situation of sales invoicing, expenses and cash, as well as cost centers and projects in real time. Talenom Oyj also handles the company's payroll and payments.

In addition to the Talenom Online system, the Company uses the Monday enterprise resource planning system. This system manages all project-related matters, mainly technical and contractual matters, but also project financial forecasts. The Company is also building an interface from the Talenom Online system to the Monday system, so that actual financial data can also be displayed in the Monday system.

Supervision of financial reporting

The accuracy of financial reporting is ensured by internal guidelines, job descriptions, process descriptions, authorization matrices, and operating models agreed with the accounting firm. The company regularly discusses the basics of business operations and business transactions with the accounting firm.

Financial administration produces a monthly summary of key financial information for the Group's Board of Directors. During 2024, the main focus of financial reporting has been on assessing cash adequacy.

The level of financial administration expertise is maintained through training provided as necessary. Auditors assess the accuracy of reporting, among other things, in connection with the preparation of half-yearly reports and in connection with the audit work performed during the financial year.

Risk management and internal control roles and responsibilities

The key roles and responsibilities regarding the Company's internal control and risk management are defined as follows:

Board of Directors

The Board of Directors is ultimately responsible for the administration of the Company and for the proper organization of its operations. According to good corporate governance, the Board also ensures that the company has duly endorsed the corporate values applied to its operations. The Board of Directors approves the policies and guidelines concerning internal control, risk management and corporate governance. The Board establishes the risk-taking level and risk bearing capacity of the Company and re-evaluates them on a regular basis as part of the strategy and goal setting of the Company. The Board reports to the shareholders of the Company.

The Board of Directors is also responsible for the internal control tasks normally assigned to the Audit Committee, which include:

• monitor the reporting process of financial statements;
• supervise the financial reporting process;
• monitor the efficiency of the Company's internal control, internal audit if applicable, and risk management systems;
• process the descriptions included in the Corporate Governance statement's chapter Main features of the internal control and risk management systems related to the financial reporting process; and
• monitor the statutory audit of the financial statements and consolidated financial statements

CEO

The CEO is in charge of the day-to-day management of the Company in accordance with the instructions and orders issued by the Board of Directors. The CEO sets the ground of the internal control environment by providing leadership and direction to senior managers and reviewing the way they are controlling the business. The CEO is in charge of the Company's risk management process and its continuous development, allocation of resources to the work, review of risk management policies as well as defining the principles of operation and overall process. The CEO reports to the Board on risk management as part of the monthly reporting. The CEO as well as the subordinates to the CEO of the Lehto Group, are in charge of risk management in their own areas of responsibility

CFO and financial administration

The CFO ensures and controls that the Group's accounting and financial reporting practices comply with the law and that both internal and external financial reporting is reliable.

The financial administration:

• ensures a setup of adequate control activities for service areas in cooperation with their management;
• follows the adequacy and effectiveness of control activities; and
• ensures that external reporting is correct, timely and in compliance with regulations

The CFO is also responsible for ensuring and monitoring that the Group's payroll administration and employment-related management practices are in compliance with the law and are managed in an appropriate manner.

4.Other information to be provided

Insider Administration

The Company complies with the insider guidelines for listed companies prepared by Nasdaq Helsinki Ltd, the Central Chamber of Commerce and the Confederation of Finnish Industries. The Company has supplemented the guidelines with its own internal insider guidelines. The insider and trading guidelines approved by the Company include provisions on insiders, the disclosure and postponement of insider information, the prohibited use of insider information, insider lists, the reporting obligation regarding transactions of executives and their close associates, and personnel's own transactions in the company's financial instruments. The purpose of the guidelines is to explain the content of the guidelines published by Nasdaq Helsinki Ltd and other related regulations and restrictions, and to standardize and streamline the handling of insider and trading matters in the Company.

Lehto Group's insiders are divided into two groups. Persons obliged to declare insider holdings are members of the Board, CEO and other senior management of the company, who have regular access to inside information and are in the position to make decisions about the company and its future development.

Project-specific insiders are persons who have access to specified inside information. Project-specific insiders may also include persons acting on behalf of the company, such as lawyers and consultants. The company maintains a projectspecific insider's register of any such confidential project that can be described as projects as defined by Nasdaq Helsinki and that can have a material effect on the value of the company's financial instruments.

Lehto Group complies with the EU Regulation on Market Abuse (MAR), which declares that managers under the obligation to report insider holdings may not trade the company's financial instruments during the 30 days prior to the publication of a Lehto Group half year financial report, interim reviews on financial position and development or financial statements release (so called "closed period").

In accordance with the Lehto Group's regulation, the closed period ends the second day from the publication of a Lehto Group half year financial report, interim reviews on financial position and development or financial statements release. In addition Lehto recommends that trading with the company's financial instruments takes place after the end of the closed window, i.e. on the 2nd to 32nd day after the release of financial information.

According to Nasdaq Helsinki's insider guidelines the closed window shall be applied to persons that take part in the company's half year financial reports and financial statements and to other persons defined by the company, i.e. extended closed window. The extended closed window implies that trading with the company's financial instruments is prohibited of persons subject to the extended closed window in the 30 days prior to publication of quartal financial information and financial statements including information concerning the financial development of the company. These trading restrictions end on the second day following the publication of financial information. In addition, Lehto recommends for extended closed window that trading with the company's financial instruments takes place after the end of the closed window, i.e. on the 2nd to 32nd day after the release of financial information.

Related party administration

In addition to the members of the Board of Directors, the CEO and the Group management of the Group companies, the related parties of Lehto Group include family members of related parties and those entities in which the related party or their family members have influence either through ownership or management. Related parties also include associated companies and joint ventures.

On 17 June 2020, the company's Board of Directors approved the related party guidelines, which define the principles to be followed in Lehto Group in transactions with related parties. The guidelines apply to all Lehto Group personnel more broadly than the related parties defined above. According to the guidelines, all related party transactions must take place at market prices and other terms, i.e. on the same principles as with independent parties.

The purpose of the Company's related party guidelines is to ensure the independence and arm's length nature of transactions in transactions involving parties related to the Company or that may otherwise raise doubts about the arm's length nature of the transaction. The Company assesses and monitors that related party transactions are in line with the purpose and interest of the Company's operations, have a business justification, and conflict of interest issues are appropriately taken into account when deciding on a related party transaction.

The Company maintains a related party register of significant transactions between the Company and its related parties, their parties, and key terms. Information on related parties is collected annually from the Company's related parties and employees. The Company monitors potential related party transactions as part of its internal control.

The Company's related party register is not public and the information contained therein is not disclosed to third parties, except for any authorities and auditors who may be entitled to access the information. The Company's Board of Directors always decides on significant transactions with the Company's management and its related parties.

The Company discloses related party transactions that are material to shareholders no later than when the transaction binds the Company.

Internal audit

The Company has no separate internal audit organisation. This is taken into account in the content and scope of the annual audit plan. On the one hand, external auditing focuses on specific areas in turn to be audited, and on the other hand, on separately agreed priority areas.

Auditing

According to Section 6 of the Company's Articles of Association, an audit firm whose chief auditor is a Chartered Accountant shall be elected as the company's auditor. The auditor's term of office shall expire at the end of the next Annual General Meeting following their election.

In 2024, KMPG Oy Ab, a firm of authorised public accountants, acted as the Company's auditor, with APA Pekka Alatalo as the principal auditor. The fees for audit services in 2024 totalled approximately EUR 150,000. Furthermore, the Company paid the auditor approximately EUR 10,000 for services not related to auditing