Alior Bank S.A.

Governance Information • Mar 8, 2024

Regulation Specification: Previous amendment: Resolution of the Supervisory Board No 146/2021 Effective date: 19/09/2022 Organisational Cell of the regulation owner: Audit Department

Regulations of the Audit Committee of the Supervisory Board of Alior Bank S.A. ("Regulations")

§ 1

General provisions

• 1. The legal grounds for the appointment of the Audit Committee of the Supervisory Board of Alior Bank S.A. (hereinafter: "Committee") are:
  2. a. Act on Statutory Auditors, Audit Firms and Public Oversight of 11 May 2017 (hereinafter: "Act on Statutory Auditors").
  3. b. Regulation (EU) No 537/2014 of the European Parliament and of the Council of 16 April 2014.
  4. c. Best practices for public interest entities regarding the rules for appointing, composition, and functioning of the audit committee issued by the Office of the Polish Financial Supervision Authority.
• 1. As regards the roles and functioning of the Committee and the independence criteria for members of the Committee, Alior Bank S.A. (hereinafter: "Bank") adheres to the obligations arising from the Best Practices of WSE Listed Companies (hereinafter: "Best Practices") and the related Recommendation of the European Commission of 15 February 2005 on the role of executive directors or members of the supervisory board of listed companies and committees of the council (hereinafter: "Commission Recommendation").
• 1. The Committee is appointed by virtue of a resolution of the Supervisory Board of the Bank.
• 1. The Committee operates on the basis of the Regulations adopted by virtue of a resolution of the Supervisory Board of the Bank.

§ 2

Composition of the Audit Committee

• 1. The Committee comprises at least 3 members, including the Chairperson, appointed and dismissed by the Supervisory Board of the Bank. Members of the Committee are elected from among the members of the Supervisory Board of the Bank.
• 1. Most members of the Committee, including the Chairperson, are independent.
• 1. The criteria for assessing and selecting members of the Committee in terms of experience and knowledge in the field of accounting, financial management, risk management and internal control are indicated on the basis of the "Policy of Selection and Assessment of the Members of the Management Board and the Supervisory Board of Alior Bank S.A.". The Supervisory

Board of the Bank, having carried out the suitability assessment, shall confirm that the requirements laid down in the Policy of Selection and Assessment, regarding the possession of the necessary competencies by the members of the Committee, have been met.

• 1. Members of the Committee should feature knowledge and experience to enable the financial statements to be interpreted and assessed independently, and correctly. This fact is confirmed by the assessment of the collective suitability of the members of the Committee.
• 1. The Supervisory Board of the Bank, giving account of the results of the assessment of individual suitability of candidates for members of the Committee, shall assess the collective suitability of the Committee, in particular ensuring that:
  2. a) the appropriate number of members meet the independence criteria,
  3. b) the appropriate number of members feature the required knowledge and skills in accounting or auditing financial statements,
  4. c) the appropriate number of members feature the required knowledge and skills in the field of the financial sector.
• 1. At least one member of the Committee shall feature knowledge and skills in accounting or auditing financial statements. This fact shall be confirmed by the knowledge and skills in the area of accounting or auditing the financial statements.
• 1. At least one member of the Committee shall have knowledge and skills in the sector in which the Bank operates. This fact shall be confirmed by the knowledge and skills in the field of the financial sector.
• 1. The Supervisory Board shall elect and dismiss the Chairperson of the Committee who features organisational and communication skills.

§ 3

Rules of operation of the Audit Committee

• 1. At the beginning of each year, the Committee shall establish a framework work plan.
• 1. The Chairperson of the Committee shall coordinate the work of the Committee.
• 1. The Chairperson of the Committee shall convene meetings of the Committee on their own initiative, upon request of a member of the Committee or the Chairperson of the Supervisory Board.
• 1. Meetings of the Committee shall be convened on the basis of a predetermined plan, as well as taking into account unscheduled meetings or raising previously unscheduled issues during meetings, whenever necessary. Members of the Committee may participate in the meeting either in person or via means of direct distance communication.
• 1. At the beginning of the term of office, the Committee (and a new member of the Committee, if appointed) receives a package of key information, documents and internal regulations of the Bank related to the function performed. The responsibility for the distribution of the aforementioned documents shall rest with the Audit Department of the Bank.
• 1. In accordance with the "Development Policy for Members of the Management Board and Supervisory Board", members of the Committee have the opportunity to participate in training, conferences or events and projects aimed at improving knowledge and skills related to their function and position.
• 1. The Committee receives information on the status of implementation of recommendations issued by the Supervisory Board. The report is distributed by the Audit Department on a semiannual basis.
• 1. The statutory auditor, the Director of the Audit Department or the Director of the Bank's Compliance Department may request that a meeting be convened, if they deemed it necessary.
• 1. The Committee shall hold at least four meetings during a calendar year. One of these meetings is held after the Management Board of the Bank presents documents and motions regarding the Supervisory Board's assessment of the annual financial statements, before the Supervisory Board meeting at which such assessment is to be made.
• 1. The Committee shall meet with the statutory auditor, the Director of the Audit Department, and the Director of the Compliance Department at least once a year, at a closed meeting without the participation of members of the management of the Bank.
• 1. Committee meetings shall be chaired by the Chairperson or another member of the Committee appointed by the Chairperson.
• 1. The Committee shall adopt resolutions at its meetings by simple majority of votes. In the case of an equal number of votes for and against, the vote of the Chairperson of the Committee shall prevail.
• 1. The quorum at the meeting shall be formed by the presence of at least half of the members of the Committee.
• 1. Resolutions of the Committee may be adopted in the standard mode at the meeting of the Committee, by circulation or by means of direct distance communication.
• 1. Resolutions adopted by the Committee by circulation or by means of direct distance communication shall be listed (title, number, date of adoption, result of vote) in the minutes of the first meeting of the Committee following the date of adoption of the resolutions in question and the content of those resolutions shall be included in the relevant minutes.
• 1. Each member of the Committee may participate in the meeting using a conference device or other telecommunication devices which enable all persons participating in the meeting to hear each other and conduct a conversation, whereby such participation in the meeting is tantamount to the presence of a person at the meeting.
• 1. Other persons featuring relevant expertise or whose views are relevant to a given issue may also be invited to attend Committee meetings.
• 1. The Chairperson of the Committee may appoint the Secretary of the Committee. The Secretary shall be responsible for preparing and distributing the minutes of the Committee meeting, after approval thereof by the Chairperson of the Committee.
• 1. Minutes from the meeting of the Committee, drawn up in writing, should include: date of the meeting, agenda, names and surnames of persons present at the meeting, content of decisions, recommendations, resolutions, arrangements, number of votes cast for individual resolutions as well as other matters requiring inclusion in the minutes.
• 1. The course of the Committee meeting may be recorded by magnetic or electronic means for the purpose of drawing up the minutes thereof. As soon as the minutes are accepted, the record of the Committee meeting shall be destroyed.
• 1. Members of the Committee shall be given the opportunity to inspect, submit any comments or give dissenting opinions regarding the content of the minutes before final approval. The fact

of submitting comments and dissenting opinions shall be recorded in the minutes. The minutes shall be signed by the members of the Committee present at the meeting.

• 1. Minutes of the meetings shall be stored at the registered office of the Bank.
• 1. Approved minutes of the meetings of the Committee shall be submitted to the Supervisory Board in accordance with the assumptions of the "Principles of the Management Information System".
• 1. The Committee shall draw up an annual report on its activities, giving account of an assessment of risk and areas subject to the Committee's supervision, as well as the actions taken and effects thereof. The report shall be submitted to the Supervisory Board. Furthermore, it may also be made available to the statutory auditor.
• 1. The Director of the Audit Department and the Director of the Compliance Department shall participate in the meetings of the Committee.

§ 4

Audit Committee's roles

• 1. The Committee shall support the Supervisory Board of the Bank in the performance of its statutory duties as well as shall discuss issues raised at meetings with the Supervisory Board.
• 1. The Audit Committee's roles include but are not limited to:
  2. 1) Monitoring the financial reporting process by:
     • a) reviewing amendments to the accounting policy, compliance of the applied principles with applicable regulations, criteria for the consolidation of financial statements, as well as issuing opinions for the Supervisory Board,
     • b) discussing with the Member of the Management Board supervising the Finance Division significant changes in the IT systems used for accounting and reporting purposes, which may affect the timeliness, accuracy and smoothness of the processes performed,
     • c) monitoring the financial situation in reliance on quarterly/semi-annual and annual data, including analysis and verification of all significant risk-generating items before their approval,
     • d) monitoring the methods used in the settlement of significant and unusual transactions and getting acquainted with the list of "critical accounting principles",
     • e) reviewing the management accounting system and analysing human resources in the finance and accounting department, especially as regards key staff involved in financial reporting.

The results of the review shall be presented at the same meeting as the audit plan for the following year, no later than at the last meeting of the Committee,

• f) controlling the timeliness of individual stages of the financial reporting process and the effectiveness of the implemented key controlling procedures related to financial reporting,
• g) getting acquainted with the financial statements and current reports well in advance of their publication as well as confirming with the Member of the Management Board supervising the Finance Division that there were no material errors, frauds or abuses resulting in distortion of the information disclosed in the financial statements.
• 2) Monitoring the effectiveness of the internal control system and the risk management system and internal audit by:
  • a) presenting to the Supervisory Board recommendations on introducing new or amending existing internal regulations required in the areas of the internal control system, internal audit and ensuring compliance. Initiating the processing of the above resolutions shall rest with the responsibility of the Management Board Department, the Compliance Department and the Audit Department,
  • b) giving opinions on the proposed audit plan for the following year, taking into account the risk analysis and the resources at hand necessary to implement that plan, including the possibility of conducting ad-hoc audits,
  • c) reviewing the internal audit function at least once every 5 years by an independent auditor selected with the participation of the Committee,
  • d) conducting discussions at least once a year, and these discussions shall concern the need for an independent assessment of the internal audit function by an external advisor.

The results of the analysis shall be presented on the date of the meeting during which the Annual Report of the Audit Department is presented,

• e) giving opinions on the strategy of the Audit Department,
• f) reviewing the results of the operation of the internal control and internal audit system, taking into account the comments and recommendations of the independent auditor,
• g) receiving periodically, at least four times a year at the meeting, a summary of the findings made during internal audits and information on actions taken to implement the recommendations issued, the progress of implementing the recommendations as well as the timeliness of their implementation,
• h) supporting internal audit in situations where irregularities are identified and where it is not possible to obtain appropriate explanations from the audited entities, in particular the financial department or accounting department,
• i) at least once a year, carrying out a periodic assessment of the entity's internal audit function, taking into account its independence and the importance of the materiality of its reports,
• j) analysing significant deviations from the agreed-upon audit plan as well as analysing proposals for improving the audit process,
• k) providing the Director of the Audit Department with free access to the Committee and the possibility to participate in the meeting of the Committee without the participation of the Management Board of the Bank,
• l) participating, together with the Supervisory Board, in the election of the person managing the Audit Department and the Compliance Department, in particular in giving opinions on candidates, supporting the Management Board in electing the right person and determining the amount of their remuneration, as well as expressing consent to the termination of employment with the person who has thus far managed the Audit Department,
• m) in the event of dismissal of the Director of the Audit Department and the Compliance Department, the Committee must consent to the dismissal after hearing the parties,
• n) consenting to changes in terms and conditions of employment, approving the amount of remuneration (including variable remuneration) for the Director of the Audit Department and the Compliance Department
• o) receiving information on the amount of remuneration in the event of employment or change of terms and conditions of the manager of the Internal Audit Team in the Bank's Brokerage House,
• p) as for Directors of the Audit and Compliance Departments, in the event of termination of a fixed-term contract after the expiry of the period for which it was concluded, approving the decision of the Supervisory Board whether the employee retains the right to the payment of the previously unpaid deferred remuneration,
• q) monitoring the independence and activities of the internal audit unit to ensure that it operates in accordance with generally accepted and applicable laws and internal audit standards,
• r) receiving periodic reports on all reported cases that may be related to significant abuses,
• s) receiving from the Director of the Audit Department the results of the annual review of internal regulations owned by the Audit Department, competences and development plans of the employees of the Audit Department. The results shall be presented at the meeting during which the audit plan for the

following year is presented,

• t) providing opinions to the Supervisory Board on the annual assessment of the adequacy and effectiveness of the internal control system, including the adequacy and effectiveness of the control function, the compliance risk management system and the activities of the Audit Department,
• u) the Committee is informed at least quarterly in reports of the Audit Department about the progress in implementing the plans, identified weaknesses of processes, issued recommendations and progress in their implementation, as well as about actions taken by the Polish Financial Supervision Authority in relation to the Bank.
• 3) Monitoring the effectiveness of the internal control system and the risk management system in estimating allowances for expected credit losses through:

a) analysing the effectiveness of the functioning of the internal control system and the credit risk management system in terms of the correct determination of allowances for expected credit losses,

b) receiving information on planned amendments to the accounting policy, their impact on future financial results and material changes in IFRS 9 models,

c) Issuing assurance that external companies involved in the development of IFRS 9 models and processes for estimating allowances for expected credit losses have complied with all requirements regarding the independence of the statutory auditor.

Information enabling the implementation of the above-mentioned tasks shall be communicated to the Committee through the Audit Department.

• 4) Monitoring the performance of financial audit activities by:
  • a) obtaining a statement from the audit firm on compliance with the relevant legal and ethical requirements regarding its independence and information on the safeguards applied to counteract the threat to this independence,
  • b) obtaining, from the Member of the Management Board supervising the Finance Division and the audit firm, information about the additional services provided by the audit firm and the remuneration for these services,
  • c) confirming with the Management Board, the Audit Department and the Regulatory Compliance Department that no information was identified that would indicate the lack of independence of the audit firm, key statutory auditor, and persons participating in the audit,
  • d) the Committee has the right to obtain legal or other independent advice at the Bank's expense. The Supervisory Board and the Management Board of the Bank shall be informed of any costs to be incurred in this respect,
  • e) holding meetings with the statutory auditor and persons managing the financial reporting process in order to review the proposed scope of the audit for the current year,
  • f) holding meetings with the Director of the Audit Department and the statutory auditor without the presence of members of management. The said meetings should discuss the issue of the statutory auditor's assessment of the property and financial situation and the accounting principles applied, as well as the course of cooperation between the statutory auditor and employees during the audit,
  • g) conducting a review of the effectiveness of the financial review process and monitoring the status of implementation of recommendations issued by the statutory auditor in a letter to the Management Board of the Bank,
  • h) communication between the statutory auditor, the Director of the Audit Department, the Member of the Management Board supervising the Finance Division and the Supervisory Board,
  • i) supervising areas indicated by the statutory auditor as particularly exposed to risk during the audit,
  • j) discussing with the statutory auditor significant issues related to the recognition of disclosures in the ledgers and presentation in the financial statements of unusual economic events, difficulties encountered and unjustified delays in the process and providing the necessary information,
  • k) Members of the Committee shall have full access to the ledgers, registers and documents of the Bank. The Committee has the right to meet with employees of the Bank selected by it.
• 5) Controlling and monitoring the independence of the statutory auditor and the audit firm by:
  • a) developing a policy and procedure for selecting an audit firm to conduct the audit,
  • b) developing a policy for the provision of permitted non-audit services by the audit firm performing the audit, entities related to that audit firm and by a member of that audit firm's network,
• c) actively participating in the process of selecting the audit firm, in particular the analysis of statements and submitted documents confirming that the audit firm has the required experience,
• d) giving opinions on the reasons for terminating a contract with an entity authorised to audit financial statements,
• e) recommending to the Supervisory Board at least two choices along with a justified preference to choose one audit firm to audit the financial statements,
• f) assessing the independence of the statutory auditor and consenting to the provision of permitted services which are not auditing the financial statements, assessing the independence of the statutory auditor and the audit firm,
• g) verifying whether the provision of additional services is possible in the light of applicable legal requirements, including, in particular, whether the services provided are not subject to the prohibition set out in Article 136.1 of the Act on Statutory Auditors and whether the services provided are included in the catalogue of permitted services referred to Article 136.2 of the Act on Statutory Auditors,
• h) defining spending limits for services provided by audit firms, the possibility of which requires the consent of the audit committee, as well as ensuring periodic reporting on services provided by audit firms and other entities belonging to the so-called network,
• i) developing rules of conduct regarding the process of disclosing and exchanging data and information between the PFSA, the audit film, the key statutory auditor, and the bank's unit responsible for control mechanisms as part of the internal control system,
• j) informing the Supervisory Board of the results of the audit of the financial statements and an explanation of how the audit contributed to the reliability of financial reporting at the Bank, as well as what was the role of the Committee in the audit process,
• k) informing the Committee about the plan to audit the Bank's financial statements by a statutory auditor,
• l) informing the Committee (by the statutory auditor) of significant issues related to financial audit activities, including, in particular, significant irregularities of the internal control system in relation to the financial reporting process, submission by the statutory auditor of a declaration of independence within the meaning of the Act on Statutory Auditors and written notification of threats to independence by the entity auditing the financial statements,
• m) The Committee may request that the key statutory auditor discuss with the Committee, the Management Board of the Bank or the Supervisory Board the key issues arising from the audit, which are listed in the additional report for the Committee,
• n) The Committee may make the Auditor's Additional Report available to the General Meeting and the Bank's shareholders.
• o) The statutory auditor shall be invited to a joint meeting of the Committee and the Supervisory Board in the following cycles:
  • semi-annual on the dates of publication of semi-annual financial results
  • annual on the date of publication of annual financial results
• during which they shall present the results of the audit of the financial statements.

§ 5

Final provisions

• 1. Any matters not governed by these Regulations shall be regulated by the applicable provisions of Polish law.
• 1. The Audit Department, at least once a year, shall review and assess the Rules of the Committee in terms of their adequacy. The results of the review shall be presented to the Committee by the Secretary of the Committee during the meeting in which the Committee's Activity Report is discussed.
• 1. Any amendments to the Regulations require a resolution of the Supervisory Board of the Bank.