Banco Santander SA

2023 ICFR monitoring activities and results

The board of directors approved an internal audit framework that details the function and how it should conduct its work.

The Internal Audit function reports to the audit committee and periodically, at least twice a year, to the board of directors. As an independent unit, it also has direct access to the board when required.

Internal Audit assesses:

•the efficiency and effectiveness of the ICFR;

•compliance with applicable regulations and supervisory requirements;

•the reliability and integrity of financial and operational information; and

•asset integrity.

Its scope of action includes:

•all entities over which the Group exercises effective control;

•separated assets (for example, mutual funds) managed by the entities mentioned in the previous section; and

•any entity (or separated assets) not included in the above points with which the Group has entered into an agreement to provide internal audit functions.

This subjective scope includes, our activities, businesses and processes (performed internally or through outsourcing), the organization and, where applicable, branch networks. Internal Audit may also conduct audits for other investees that are not included in the preceding points when the Group has reserved this right as a shareholder, as well as on outsourced activities in accordance with the established agreements.

The audit committee supervises the Group's Internal Audit function. See section 4.5 'Audit committee activities in 2023'.

As at 2023 year-end, Internal Audit had 1,227 employees, all exclusively dedicated to this service. Of these, 274 were based at the Corporate Centre and 953 in the local units located in the Group´s core markets, all with exclusive dedication.

Every year, Internal Audit prepares an audit plan based on a risk self-assessment and is solely responsible for executing the plan. Reviews may lead to recommendations, which are

prioritized in accordance with their relative importance and are continuously monitored until full implementation.

At its meeting on 17 February 2023, the audit committee reviewed the 2023 audit plan, which was reported to, and approved by, the board at its meeting on 23 February 2023.

The internal audit report on the ICFR review aimed to:

•verify compliance with the provisions contained in sections 302, 404, 406, 407 and 806 of the SOx Act;

•check corporate governance with regard to information relating to the internal control system for financial reporting, including risk culture;

•review the functions performed by the internal control departments and by other departments, areas and divisions that work to ensure compliance with the SOx Act;

•make sure the supporting documentation relating to the SOx Act is up to date;

•confirm the effectiveness of a sample of controls based on an internal audit risk assessment methodology;

•assess the accuracy of the unit's certifications, especially their consistency with respect to the observations and recommendations made by Internal Audit, the external auditors of the annual accounts and supervisors; and

•ratify the implementation of recommendations made in the audit plan.

In 2023, the audit committee and the board of directors were informed of the Internal Audit function's work in accordance with its annual plan, as well as and of other related matters. See section 4.5 'Audit committee activities in 2023'.

Detection and management of deficiencies

The audit committee oversees to supervise the financial reporting process and the internal control systems. It is responsible for discussing any significant weaknesses detected in the audit with the external auditor.

The audit committee also assesses the results of the work of the Internal audit unit and may take the necessary measures to correct any deficiencies identified in the financial information, that may impact on the reliability and accuracy of the financial statements. It may ask other areas of the Group involved in the process for vital information and clarification. The committee also assesses the potential impact of any errors detected in the financial information.

In 2023, the audit committee was informed of the ICS assessment and certification for the 2022 financial year. See section 4.5 'Audit committee activities in 2023'.

[Page intentionally left blank] 1 of 2

[Page intentionally left blank] 2 of 2