Banco Santander SA

2024 ICFR monitoring activities and results

The board of directors approved an internal audit framework that details the function and how it should conduct its work.

Internal audit function reports to the audit committee and, at least twice a year, to the board of directors. As an independent unit, it also has direct access to the board when required.

Internal audit assesses:

•the efficiency and effectiveness of the ICFR;

•compliance with applicable regulations and supervisory requirements;

•the reliability and integrity of financial and operational information; and

•asset integrity.

Its scope of action includes:

•all entities over which the Group exercises effective control;

•separated assets (for example, mutual funds) managed by the entities mentioned in the previous section; and

•any entity (or separated assets) not included in the above points with which the Group has entered into an agreement to provide internal audit function.

This subjective scope includes, our activities, businesses and processes (performed internally or through outsourcing), the organization and, where applicable, branch networks. Internal audit function may also conduct audits for other investees that are not included in the preceding points when the Group has reserved this right as a shareholder, as well as on outsourced activities in accordance with the established agreements.

The audit committee supervises the Group's Internal Audit function. For more details, see section 4.5 'Audit committee activities in 2024'.

As at 2024 year-end, Internal Audit division had 1,230 employees, all exclusively dedicated to this service. Of these, 281 were based at the Corporate Centre and 949 in the local units located in the Group´s core markets, all with exclusive dedication.

Every year, the internal audit function prepares an audit plan based on a risk self-assessment and is solely responsible for executing the plan. Reviews may lead to recommendations, which are prioritized in accordance with their relative importance and are continuously monitored until full implementation.

In its meeting on 13 February 2024, the audit committee gave the green light to the internal audit plan for 2024, which the board of directors subsequently approved at its meeting on 26 February 2024.

The internal audit function report on the ICFR review aimed to:

•verify compliance with the provisions contained in sections 302, 404, 406, 407 and 806 of the SOx Act;

Annual report 2024342

•check corporate governance with regard to information relating to the ICFR, including risk culture;

•review the functions performed by the internal control departments and by other departments, areas and divisions that work to ensure compliance with the SOx Act;

•make sure the supporting documentation relating to the SOx Act is up to date;

•confirm the effectiveness of a sample of controls based on an internal audit risk assessment methodology;

•assess the accuracy of the unit's certifications, especially their consistency with respect to the observations and recommendations made by Internal Audit, the external auditors of the annual accounts and supervisors; and

•ratify the implementation of recommendations made in the audit plan.

In 2024, the audit committee and the board of directors were regularly informed of the internal audit function's work in accordance with its annual plan, as well as of other related

matters. For more details, see section 4.5 'Audit committee activities in 2024'.

Detection and management of deficiencies

As part of its to supervise financial reporting and internal control systems, the audit committee is responsible for maintaining continuous dialogue with the external auditor regarding any significant weaknesses detected in the audit.

The audit committee also assesses the results of the work of the internal audit function and may take the necessary measures to correct any deficiencies identified in the financial information, that may impact on the reliability and accuracy of the financial statements. It may ask other areas of the Group involved in the process for vital information and clarification. The committee also assesses the potential impact of any errors detected in the financial information.

In 2024, the audit committee was informed of the ICS assessment and certification for the 2023 financial year. For more details, see section 4.5 'Audit committee activities in 2024'.

Annual report 2024343

[Page intentionally left blank]1 of 2

Annual report 2024344

[Page intentionally left blank] 2 of 2

Annual report 2024345