mBank S.A.

Governance Information • Mar 1, 2025

Enclosure 1 to Supervisory Board Resolution 334/23 Dated 21 September 2023

RULES of the Audit Committee of the Supervisory Board of mBank S.A.

§ 1

• 1. The essential tasks of the Audit Committee ensue from the Act dated 11 May 2017 on statutory auditors, audit firms and public supervision, Recommendation H on internal control system in banks, Recommendation L on statutory auditors' role in the banking supervision process and Recommendation R on credit risk management principles and recognition of expected credit losses, adopted by the Polish Financial Supervision Authority (KNF), rules included in "Best Practice of GPW Listed Companies" as adopted by the Warsaw Stock Exchange S.A., good practices regarding the functioning of the Audit Committee as adopted by the Office of the KNF. Accordingly, the authority of the Audit Committee includes, among others, the following:
  2. 1) formulating and presenting the Supervisory Board with recommendations regarding election of the audit firm by the General Meeting;
  3. 2) obtaining information regarding quarterly and half-year standalone financial statements of mBank S.A. and consolidated financial statements of mBank Group (hereafter the "quarterly and half-year standalone and consolidated financial statements") before their publication and recommending approval or rejection of annual standalone and consolidated financial statements by the Supervisory Board;
  4. 3) recommending to the Supervisory Board acceptance or refusal of acceptance for appointment and dismissal of a person managing Internal Audit Department and Compliance Department;
  5. 4) recommending approval to the Supervisory Board of:
     • a) disclosure policy of the mBank S.A. regarding capital adequacy
     • b) compliance policy of the mBank S.A.
     • c) conflict of interest management policy
     • d) policy regarding material transactions with affiliates
     • e) annual action plan of Compliance Department, strategic and annual plan of internal audits, proposed changes to those plans and strategy of Internal Audit Department
     • f) annual report on effectiveness of the control function
     • g) annual compliance report

• h) annual report of the supervisor exercising internal oversight over activities conducted by mBank S.A. under Article 70 section 2 of the Act on Trading in Financial Instruments
• i) annual report of the supervisor exercising internal oversight over fiduciary activities by mBank S.A.
• j) the assessment if significant transactions with affiliates have been concluded at arm's length
• k) annual report on the implementation of the Compliance Department's action plan and annual report on the activities of the Internal Audit Department
• l) annual report on compliance within the Brokerage Bureau of mBank S.A.
• m) annual report on adequacy and effectiveness of the internal control system and the risk management system
• n) anti-money laundering and counter-terrorist financing strategy
• o) other reports and documents that require such recommendation in accordance with regulatory requirements.
• 5) providing the Supervisory Board with opinions regarding:
  • a) annual evaluation of adequacy and effectiveness of whistleblowing procedure as executed by the employees,
  • b) annual evaluation of adequacy and effectiveness of the internal control system and the risk management system, including the evaluation of the adequacy and effectiveness of the control function and the evaluation of the Compliance Department and the Internal Audit Department; effectiveness of the anti-money laundering and counter-terrorist financing compliance unit.
• 6) Ongoing supervision and monitoring of adequacy and effectiveness of policies and procedures for the anti-money laundering and counterterrorist financing, including at least once a year, review the activity report of the AML/CFT compliance officer and obtain interim updates for activities that expose the financial institution to higher ML/TF risks in case of their occurrence.
• 1. Tasks of the Audit Committee also include:
  2. 1) monitoring of:
     • a) the financial reporting process, including planned changes in the Bank's accounting policy and their impact on the future financial performance of the Bank and significant changes in IFRS 9 models,
     • b) the process of the sustainability reporting,
     • c) effectiveness the internal control system and the risk management system, as well as internal audit,
     • d) performing financial audit, particularly audit by the audit firm, including any motions and conclusions of the Audit Supervision

Commission (Polish Audit Supervision Agency) resulting from a control conducted in an audit firm;

• 2) controlling and monitoring of independence of the statutory auditor and the audit firm, particularly in case where other permitted services than audit of annual standalone and consolidated financial statements and reviews of quarterly and half-year standalone and consolidated financial statements are provided by the audit firm;
• 3) providing the Supervisory Board of the Bank with results of audits of annual standalone and consolidated financial statements and reviews of quarterly and half-year standalone and consolidated financial statements;
• 4) evaluation of independence of statutory auditor and consenting to performing of permitted services other than audit in the Bank;
• 5) preparing a policy of selection of audit firm;
• 6) specifying procedure of election of audit firm by the Bank;
• 7) issuing statements on the selection of the audit firm to conduct the audit of the financial statements;
• 8) preparing a policy of rendering by an audit firm conducting an audit, by entities related to this audit firm, as well as by a member of structure of the audit firm of permitted, non-audit services;
• 9) development of rules of conduct regarding the process of disclosure and exchange of data and information between the Bank, the KNF, the audit firm and the key statutory auditor;
• 10) providing recommendations aiming at ensuring reliability of financial reporting process in the Bank,
• 11) approving quarterly and half-year disclosures regarding capital adequacy of mBank S.A. Group to be made public in accordance with binding provisions of law.
• 1. In relation to audit of annual standalone and consolidated financial statements and reviews of quarterly and half-year standalone and consolidated financial statements, the Audit Committee is also competent for risk management to the extent not restricted for Risk Committee of the Supervisory Board.

• 1. In order to perform the monitoring of effectiveness of internal control system, the risk management system and internal audit, the Audit Committee receives in particular the following documents and information:
  2. 1) periodic reports on significant findings from audits, including information on significant and critical irregularities, KNF inspections and status of implementation of recommendations from audits, KNF inspections and recommendations from the statutory auditor,
  3. 2) reports from planned and ad hoc audits;
  4. 3) periodic compliance reports,
  5. 4) ad hoc reports on identified significant or critical compliance risks;
  6. 5) periodic lists of significant and critical irregularities, excluding irregularities concerning compliance risk, together with an information on status of implementation of remedies and disciplinary measures;
  7. 6) semi-annual report on significant changes to IFRS models;
  8. 7) periodic reports on supervision of processes of handling complaints and claims;
  9. 8) information about planned changes to the Bank's accounting policies and their impact on the Bank's future financial results;
  10. 9) Organizational units of the Bank of the second line of defence and Internal Audit Department immediately inform the Audit Committee about identification of critical irregularities in accordance with applicable internal regulations;
  11. 10) Internal Audit Department informs the Audit Committee about any exceptional incidents which took place in the Bank in case such information is not provided by the Management Board or in case of involvement of members of the Management Board in the incident.

The Audit Committee may, without the mediation of the Supervisory Board, demand information, explanations and delivery of documents necessary to perform the tasks referred to in § 1.

§ 3

• 1. The Audit Committee shall consist of at least three members, including the Chairperson.
• 1. The majority of Audit Committee members, including the Chairperson, shall be independent.

• 1. At least one member of the Audit Committee shall have knowledge and skills in accounting or audits of financial statements. This condition is deemed to be fulfilled particularly if at least one member of the Audit Committee:
  2. 1) is a certified statutory auditor, possesses an ACCA (Association of Chartered Certified Accountants) certificate, a CIMA (Chartered Institute of Management Accountants) certificate or other professional national or international titles or certificates confirming knowledge in accounting or audits of financial statements; or
  3. 2) has at least two year professional experience at a position connected directly with financial accounting, management accounting or auditing financial statements in an entity having a scale of operations comparable to the operations of the Bank.
• 1. Members of the Audit Committee shall have knowledge and skills in the scope of banking industry. This condition shall be deemed fulfilled, if at least one member of the Audit Committee has knowledge and skills in the scope of this industry, or particular members have knowledge and skills in specific areas of the banking industry. Professional career or education of the member of the Audit Committee may, in particular, serve as confirmation of having knowledge and skills in the scope of banking industry, especially if it includes:
  2. 1) employment at independent or management-level positions or performing functions in corporate bodies of entities from banking or financial sectors, public (listed) companies or advisory firms providing advisory services to entities from banking or financial sectors;
  3. 2) conducting research or teaching at universities in fields connected with banking, finance, economy, management or law;
  4. 3) holding a higher education degree in banking, finance, economy, management or law.
• 1. The Chairperson of the Audit Committee shall convene the meetings of the Audit Committee by his own initiative, at the motion of a Member of the Audit Committee or the Chairperson of the Supervisory Board. He shall coordinate work in the Audit Committee and is authorised to issue and receive statements for the Audit Committee. If he is unable to attend, the Member of the Audit Committee who is eldest in years shall act in his place.
• 1. Other persons with relevant expertise or whose opinions are relevant to the issue in question may also be invited to attend Audit Committee meetings or the Audit Committee's preparatory work.
• 1. The Audit Committee shall adopt decisions at its meetings with the majority of the votes of the attending Members, provided that at least half of the Members of the Audit Committee are present at the meeting and that notification concerning the meeting has been sent to all Members. In the event of an equal number of opposing votes, the vote of the Chairperson of the Audit Committee shall prevail.

• 1. The Audit Committee may adopt decisions under written procedure or by using means of direct remote communication. The decision shall be effective if all Members of the Committee have been informed of the contents of the draft decision and at least half of the Members of the Committee have taken part in the decision. When putting a matter to a vote by written procedure, the Chairperson sets a time limit for the vote.
• 1. Decisions of the Audit Committee are signed by the Chairperson of the Committee.
• 1. Should any member of the Audit Committee cease to hold his or her function in the Audit Committee, he/she shall immediately provide his or her successor with a written protocol describing all ongoing matters which belonged to his or her competence, so that any such change shall not negatively affect the works of the Audit Committee.
• 1. The Audit Committee shall hold at least four meetings a year, which shall take place regularly before the Supervisory Board meetings. One of these meetings shall be held after presentation of the documents concerning the annual financial statements before the Supervisory Board meeting at which these documents are examined before their presentation to the General Meeting. The Chairperson of the Supervisory Board shall regularly attend this meeting of the Audit Committee as a guest, if he is not in any case a Member of the Audit Committee. The Audit Committee Members may also attend meetings using means of direct remote communication, ensuring communication in real time between all the participants as well as the possibility to identify all participants of the meeting, while maintaining safety rules adopted in the Bank; such a fact should be recorded in the minutes of the Committee meeting.
• 1. The Chairperson of the Board of Managing Directors and the Vice-president of the Management Board, Chief Financial Officer, as well as a representative of the audit firm, shall attend the meetings of the Audit Committee at the invitation of the Chairperson of the Audit Committee. Furthermore, the Chairperson of the Audit Committee shall decide whether any other persons are to be permitted to attend a meeting of the Audit Committee in individual cases.
• 1. Director of Internal Audit Department and Director of Compliance Department, or their deputies, attend meetings of the Audit Committee in cases where the subject matter of the meeting involves issues related to internal control system, including ensuring compliance, internal audit or risk management.

• 1. The course of the Audit Committee meeting may be recorded (only sound or sound and video). The recording shall exclusively be used to prepare the minutes of the Audit Committee meeting and shall be permanently deleted after its approval by the Members of the Audit Committee.
• 1. Minutes are taken at every meeting of the Committee in writing or in a form equivalent to writing. The minutes should include at least full names of the Committee members present and persons attending the meeting, a clear description of items on the agenda, course of the discussion, findings, agreed actions and decisions made, number of votes for each decision and any comments or dissenting opinions. The minutes are signed by the Chairperson of the Committee and by the employee of the relevant unit providing support to the Audit Committee present at the meeting.
• 1. The minutes shall be subject to approval by the members of the Audit Committee taking part in the meeting.
• 1. Members of the Committee shall be given the opportunity to examine and comment on the minutes documenting the meeting before their approval. Comments not taken into account and dissenting opinions shall be noted together with the reasons for not taking them into account.
• 1. The minutes of the Audit Committee meeting are submitted to the Supervisory Board.
• 1. Representatives of the audit firm and the Internal Audit Department have a possibility to meet with the Audit Committee without the presence of any members of the Bank's management. The meeting may relate to assessment made by the audit firm on the tangible and financial situation of the Bank and accounting principles used by the Bank, as well as the internal audit personnel, management and the course of cooperation between the audit firm and the employees of the Bank during the audit.
• 1. The Audit Committee shall report to the Supervisory Board with annual activity reports. The Bank shall make the report available to the shareholders before the General Meeting. At least once in each quarter of the financial year, the Audit Committee shall provide the Supervisory Board with information on the supervisory activities undertaken and their results.

§ 6

1. The Audit Committee shall each time approve any order for audit firm, entities related to this audit firm, as well as members of the structure of the audit firm, for performing services other than financial audit, not being services forbidden by generally binding provisions of law.

These regulation shall become effective on the date of approval by the Supervisory Board.