Rule for changing the entity authorised to audit financial statements:

Selecting the entity authorised to audit financial statements of Bank Millennium S.A. as well as Bank Millennium Capital Group the Bank follows rules defined in the Act of 11 May 2017 on Statutory Auditors, Audit Firms and Public Supervision, Regulation (EU) No 537/2014 of the European Parliament and of the Council of 16 April 2014 on specific requirements regarding statutory audit of public-interest entities as well as provisions of the Bank’s Articles of Association. The Bank has a Policy of Selecting and Cooperation with Audit Firms approved by the Supervisory Board’s Audit Committee on 26.10.2017, which describes in detail the procedure and principles of selecting and cooperation with audit firms. The entity authorised to select the entity authorised to audit financial statements is selected by the Bank’s Supervisory Board at least every 5 years, after considering a relevant recommendation presented by the Supervisory Board’s Audit Committee.

Entity authorised to audit financial statements:

The entity authorized to audit the Bank's financial statements and the consolidated financial statements of the Bank's Group for the years 2025-2026 and other reports for the periods falling in these years is KPMG Audyt Spółka z ograniczoną odpowiedzialnością sp.k., with its registered office in Warsaw, 4A Inflancka Street, 00-189 Warsaw. KPMG Audyt Spółka z ograniczoną odpowiedzialnością sp.k. is entered into the list of entities authorized to audit financial statements kept by the Polish Agency for Audit Oversight under number 3546.

In order to meet the requirements described in Article 24(6) of the Whistleblower Protection Act of 14 June 2024 (the Act), Bank Millennium S.A. has a procedure for reporting Information on breaches of law (the Procedure).

• A whistleblower is a natural person who reports or discloses to the public a notice of a breach of law obtained in a work-related context, including before the establishment of an employment relationship or other legal relationship constituting the basis for the provision of work or services at or for a bank.
• Information on a breach of the law is information about a breach or a justified suspicion of an existing or potential breach of the law, which has occurred or is likely to occur at the bank or in another entity with which the Whistleblower has maintained or is maintaining contact in the context related to work at the bank, participated in the recruitment process or other negotiations preceding the conclusion of the contract, as well as information about an attempt to conceal the breach of law.
• Public disclosure is the disclosure of the Information on the infringement of the right to the public.

An infringement of the law is an act or omission that is unlawful or aimed at circumventing the law indicated in Article 3(1) of the Act, in particular concerning:

1. corruption,
2. procurement,
3. financial services, products and markets,
4. counteracting money laundering and terrorist financing,
5. product safety and compliance,
6. environmental protection,
7. consumer protection,
8. protection of privacy and personal data,
9. security of networks and ICT systems,
10. the financial interests of the State Treasury of the Republic of Poland, local government units and the European Union,
11. internal market of the European Union, including public competition and state aid rules and corporate taxation.

A whistleblower may report to the bank Information about a breach of law:

1. via external e-mail boxes to naruszenia@bankmillennium.pl address or internal e-mail boxes to *Violations,
2. via post, in a closed envelope delivered by external mail with the words "notification of infringement" and "in person", placed in another closed envelope, addressed to the head of the bank's Compliance Department, to the address of the bank's registered office (2A Stanisława Żaryna Street, 02-593 Warsaw),
3. via phone at 22 598 18 00,
4. during a direct meeting organized at the request of the Whistleblower forwarded to the address of naruszenia@bankmillennium.pl,
5. via dedicated system available at the link: https://app.sygnanet.pl/bankmillennium/pl

If you have any questions – please contact us by e-mail via the naruszenia@bankmillennium.pl mailbox.

Information on the procedure for reporting information on breaches of the law in Bank Millennium S.A. is available at: Information for whistleblowers

Information on the processing of personal data in Bank Millennium SA is available at: Data protection - Bank Millennium