Cecabank has an internal reporting system in place that complies with the legal requirements. An essential piece of the above-mentioned system is the Service channel of CorporateConduct.

The Corporate Code of Conduct is open to the following people:

a) all company employees.

b) self-employed workers who have obtained information on actions or omissions that may constitute corporate fraud.

c) stakeholders, Board of Directors and the Management Committee.

d) any person working for or under the supervision and management of the entity's contractors, subcontractors and suppliers.

e) whistleblowers who publicly disclose information on actions or omissions that may constitute a breach of law, obtained within the framework of an already terminated working relationship or statutory framework, volunteers, interns, paid or non-paid trainee workers, as well as those whose work relationship has not yet started, in cases where the information on professional breaches of law has been obtained during the selection or pre-contractual negotiation process.

f) the bank's customers.

The Corporate Code of Conduct is a comprehensive and unique channel that receives communications relating to the following subjects:

a) Any actions or omissions that may constitute breach of European Union law, provided that:

1.th Enter within the field of application of the acts of the European Union enumerated in the annexe of the Directive (EU) 2019/1937 of the European Parliament and of the Board, of 23 October 2019, regarding the protection of people that give information on offences of the Law of the Union, regardless of the rating that of the same carries out the internal legal system;

2.th Affect to the European Union's financial interests just as are contemplated in the article 325 of the Tried European Functioning of the Union (TFUE); o

3.th Stress the domestic market, just as is contemplated in the article 26, section 2 of the TFUE, included offences of the standards of the European Union with regard to awarded responsibility and aids for the States, as well as the offences regarding the domestic market in relation to the acts that they breach standards of the corporation tax or with work experience programs whose aim is obtain a tax advantage that distorts the object or the aim of the applicable law to the corporation tax.

b) Actions or omissions that may constitute a serious or very serious criminal or administrative infringement. In any case, all serious or very serious criminal or administrative offences that involve economic losses for the Public Treasury and for the Social Security Institute shall be understood as being included.

c) Significant events, events or situations relating to non-compliance with the Money Laundering Prevention Act and the financing of terrorism, except for reporting suspicious transactions carried out by employees.

d) Actions or omissions that may constitute administrative offences other than those indicated in the above letters.

e) Non-compliance with the Corporate Code of Conduct not covered by the circumstances provided for in the above letters.

For the presentation of communications, the bank provides Cecabank staff and third parties with five different channels:

- Online: CECABANK's online enquiry form and claims/complaints form on the CECABANK website

• • • Corporate Code of Conduct – Claim/complaint form
    • Corporate code of conduct – Enquiry form

- Corporate intranet (employees only)

- Email: Form to scan and send by email to canal@cecabank.es.

– Postal mail: Form to be sent by post to c/Caballero de Gracia, 28-30, 4ª planta. 28013 – Madrid, for the attention of the Director of Talent, Culture and Service Generals.

- Physical mailbox: Form to deposit in the mailbox located on the first floor of c/Caballero de Gracia 28-30 (only for people with access to Cecabank's facilities).

• • • Corporate Code of Conduct – Claim/complaint form
    • Corporate Code of Conduct – Enquiry form

At the request of the person reporting, the communication may also be submitted in a face-to-face meeting within seven days of the request.

All communications shall be treated as strictly confidential both with regard to the reporter and the reported, as well as with regard to their content.

Anonymous communications relating to the subjects provided for in points (a), (b) and (c) above may be submitted and processed. These communications must be submitted via the physical inbox or postal address provided above. Employees may also submit those relating to point c) through the corporate intranet.

In accordance with internal regulations, with regard to communications by persons on the aforementioned activities, senior management guarantees that there will be no reprisals, discrimination or sanctions for disclosures made in good faith or for actions aimed at preventing criminal behaviour. Consequently, the entity's senior management, in compliance with the internal regulations, assures all persons that any disclosure they make will not lead to any kind of reprisal, discrimination or sanction.

The company informs of the existence of external reporting channels with the competent authorities, such as the Independent Authority for the Protection of the Informant and, where applicable, with the institutions, bodies or bodies of the European Union.