Independent Assurance Letter

Deloitte Audyt Spółka z ograniczoną odpowiedzialnością Sp. k.

al. Jana Pawła II 22 00-133 Warszawa Polska Tel.: +48 22 511 08 11 Fax.: +48 22 511 08 13 www.deloitte.com/pl

Independent Limited Assurance Report on Independent Limited Assurance Engagement on selected indicators Presented in the ESG Report of Millennium Bank S.A. and Bank Millennium Group for the period from 1 January 2023 to 31 December 2023

To the Management Board and Supervisory Board of Bank Millennium S.A.

Ul. Stanisława Żaryna 2A

02-593 Warszawa

Scope of work performed and applicable criteria

We have undertaken a limited assurance engagement on the selected indicators presented in the ESG Report of Millennium Bank S.A. and Bank Millennium Group for the period from 1 January 2023 to 31 December 2023 (the “The ESG Report”), developed by Bank Millennium S.A. (the “Company”).

The scope of our work covered 10 selected General Disclosures (2‑2, 2‑7, 2‑12, 2‑14, 2‑23, 2‑26, 2‑28, 2‑29, 2‑30, 3‑3) and 20 selected Topic Specific Disclosures (202‑1, 205‑2, 205‑3, 206‑1, 301‑1, 302‑1, 305‑1, 305‑3, 306‑3, 401‑1, 401‑2, 404‑3, 405‑1, 405‑2, 406‑1, 413‑1, 418‑1, FS13, FS14, FS15) presented in the GRI index. The indicators included in the GRI index presented in the ESG Report have been reported in the manner defined in the GRI Standards ‑ Sustainability Reporting Guidelines, issued by the Global Reporting Initiative (GRI).

Our limited assurance engagement was limited to the indicators presented in the ESG Report listed above and marked "YES" in the GRI index and did not address the other information included in this report or this report understood as a whole. Accordingly, our conclusion below applies only the GRI indicators within the scope of our work and not all data presented, or any other information included in the ESG Report.

Responsibility of the Management Board of the Company

The Management Board of the Company is responsible for the preparation and presentation of the indicators presented in the ESG Report in accordance with Sustainability Reporting Guidelines GRI Standards, as issued by Global Reporting Initiative (GRI). This responsibility includes establishing and maintaining appropriate performance management and internal control systems from which the reported information is derived. The Management Board of the Company is also responsible for the provision of reliable, correct, and fair information, and for the correct preparation of the documentation provided to us.

Our Independence and Quality Control

In performing the service, we have complied with the independence and other ethical requirements set out in the International Code of Ethics for Professional Accountants (including International Standards of Independence) developed and approved by the International Ethics Standards Board for Accountants, which includes independence requirements and other requirements based on integrity, objectivity, professional competence and due care, confidentiality and professional conduct.

In accordance with the International Auditing and Assurance Standards Board's (IAASB) International Quality Management Standard 1, we maintain and apply a comprehensive quality management system that operates continuously and iteratively and responds to changes in the nature and circumstances of the company and its recommendations.

This Report is an English version of the original Polish version. In case of any discrepancies between the Polish and English version, the Polish one shall prevail.

Deloitte refers to one or more of Deloitte Touche Tohmatsu Limited, a UK private company limited by guarantee, and its network of member firms, each of which is a legally separate and independent entity. Please see www.deloitte.com/pl/onas for a more detailed description of DTTL and its member firms.

Member of Deloitte Touche Tohmatsu Limited

District Court for the capital city of Warsaw, 12th Commercial Division of the National Court Register, KRS No. 0000446833, Tax Identification Number (NIP): 527-020-07-86, REGON: 010076870

Our Responsibility

Our responsibility is to express a limited assurance conclusion on the selected indicators as marked in the GRI index presented in the ESG Report based on the procedures we have performed and the evidence we have obtained. We conducted our limited assurance engagement in accordance with International Standards on Assurance Engagements 3000 (Revised), Assurance Engagements Other than Audits or Reviews of Historical Financial Information, issued by the International Auditing and Assurance Standards Board. This standard requires that we plan and perform this engagement to obtain limited assurance about whether the selected GRI indicators presented in the ESG Report are not inconsistent with the GRI Standards Guidelines for Sustainability Reporting.

The procedures performed under the limited assurance engagement are different in nature and limited in scope both in terms of risk assessment procedures, including an understanding of internal control, and in terms of the procedures performed in response to the risks assessed compared to the reasonable assurance engagement. As a result, the level of assurance obtained through an assurance service providing limited assurance is significantly lower than the level of assurance that could be obtained through an assurance service providing reasonable assurance.

The procedures we performed were based on our professional judgement, our assessment of the risk of material misstatement of the indicators due to intentional actions or misstatements, and included interviews, observations of the processes performed, examination of documents, analytical procedures, assessments of the appropriateness of calculation methods and reporting policies and reconciling with underlying records.

In order to perform our conclusion on the selected indicators as marked in the GRI index presented in the ESG Report, we undertook in the period 1st - 28th February 2024 the following procedures:

Through inquiries, obtained an understanding of the control environment and information systems relevant to reporting the indicators under review, but did not evaluate the design of particular control activities, obtain evidence about their implementation or test their operating effectiveness.
Obtained through inquiries, analytical procedures, observation and other applicable evidence gathering procedures on a sample basis, an understanding of the key structures, systems, processes, procedures and internal controls relating to collation, aggregation, validation and reporting of data for the indicators under review.
Compared the information contained in the ESG Report with the GRI Standards guidelines for the indicators under review.
Compared the information included in the ESG Report to internal documentation of the Company.

Inherent limitations

The process the organization adopts to define, gather, and report data on its non-financial performance is not subject to the formal processes adopted for financial reporting. Therefore, data of this nature is subject to variations in definitions, collection, and reporting methodology with no consistent, accepted standard. This may result in non- comparable information between organizations and from year to year within the organization as methodologies develop. The accuracy and completeness of the information disclosed in the ESG Report is subject to inherent limitations given its nature and the methods for determining, calculating, or estimating such information.

Conclusion

Based on the work we have done and the procedures we have performed, nothing has come to our attention that causes us to believe that the indicators in the scope of our work, presented in the ESG Report and marked “YES” in the GRI index, for the period from 1 January 2023 to 31 December 2023 prepared by Bank Millennium S.A., have not been prepared, or compiled, in all material respects, in accordance with the GRI Standards issued by the Global Reporting Initiative.

Deloitte Audyt spółka z ograniczoną odpowiedzialnością sp.k.

Warsaw, 28th February 2024