Audit Committee Activities Report (23. COL Informe funcionamiento CAC 2025 EN%5BTR%5D 0)

1. INTRODUCTION

   The Audit and Control Committee of Colonial SFL, SOCIMI, S.A. (the "Company" and, together with its subsidiaries, the "Group") has issued this report on its composition, performance, powers and main activities carried out in 2025, as well as on the improvements made to its operation during the course of the year (the "Report").

   For the purposes of this Report, the members of the Audit and Control Committee (the "Committee") received a questionnaire, which was answered by all members of the Committee. Notwithstanding the foregoing, although the Committee's performance is examined by the Committee itself, 80% of the members of the Board of Directors rated the Committee's performance as excellent, and the remaining 20% as very good or good, in the questionnaire on the performance of the Company's governing bodies drawn up by the external expert Georgeson.

   The Report will be submitted to the Company's Board of Directors, who will be in charge of assessing the performance of the Committee pursuant to Article 529 nonies of Royal Legislative Decree 1/2010 of 2 July approving the consolidated text of the Spanish Limited Liability Companies Law.

2. COMPOSITION, PERFORMANCE, POWERS AND MAIN ACTIVITIES
   1. Committee Composition

      In accordance with Article 2 of its Regulations, the Committee must be composed of a minimum of three and a maximum of six directors, all of whom must be non-executive Directors. All members of the Committee, especially the Chairperson, must possess the necessary knowledge, professional experience and commitment to perform their duties within the Audit and Control Committee effectively. Specifically, all members of the Committee as a whole, and particularly the Chairperson, are appointed based on their knowledge and expertise in accounting, auditing, verification, internal control systems and risk management (both financial and in relation to sustainability). Moreover, in general, all members of the Committee must have an understanding of the business sector in which the Company operates.

      The Committee must appoint a Chair from among its own members, who must be an independent Director in any case. In addition to their duties within the Committee, the Chairperson shall act as the spokesperson in all dealings with the Board of Directors and during the General Meeting. The Chairperson of the Committee must be replaced every four years and may be re-elected one year after leaving such office.

      The Committee is currently composed of four members, all of whom are non-executive Directors classified as independent Directors, except for Ms Begoña Orgambide García, who is a proprietary Director. The Committee is chaired by an independent Director in compliance with Article 35 of the Regulations of the Board of Directors.

      The current members of the Company Committee are as follows:

      Name		Position		Capacity
      Ms Miriam González-Amézqueta López...........................................		Chairwoman		Independent
      Ms Ana Bolado Valle ........................................................................		Member		Independent
      Ms Ana Peralta Moreno ...................................................................		Member		Independent
      Ms Begoña Orgambide García..........................................................		Member		Proprietary

      Committee members have the knowledge, skills and experience necessary for the performance of the Committee's duties. In this regard, the directors' academic and professional profiles, as well as information on the amount of time served as directors of the Company, are available on the Company website (link).

      The Secretary to the Committee is Mr Francisco Palá Laguna, as he is the Secretary to the Company's Board of Directors. The Vice-secretary is Ms Nuria Oferil Coll, as the Vice-secretary of the Company's Board of Directors.

   2. Committee Functioning

      The Committee held twelve meetings in 2025, all of which were held via video conference using computer software, in accordance with Article 7 of the Regulations of the Board of Directors. At each of the aforementioned meetings, the Secretary acknowledged the identity of all present members of the Committee. In addition, the Committee held two joint meetings with the Sustainability Committee. The Committee has therefore fulfilled its duty to meet with the frequency required to carry out its functions in an effective manner. Regarding the preparation and progress of meetings, the Chairwoman of the Committee called meetings with sufficient notice.

      Directors must attend such meetings regularly. Without prejudice to the foregoing, any Committee members who are unable to attend for justified reasons may delegate their vote to another director, providing such proxy with specific instructions. However, in 2025, all Committee members attended 100

      % of meetings in person.

      In addition, the members of the Committee were provided with information on the items on the agenda prior to each meeting, thereby encouraging them to participate in the meetings and adopt informed resolutions.

      In addition to by its own members, Committee meetings were attended by the Vice-Secretary to the Board in her capacity as such; and, whenever this was necessary or desirable in order to address specific matters within their remit, and following an invitation by the Chairwoman of the Committee to attend parts of the meeting other than deliberation and voting, the following people attended one or more meetings: (i) the Chairwoman of the Sustainability Committee; (ii) the Corporate General Manager; (iii) the Chief Financial Officer; (iv) the Internal Audit Director; and (v) the Chief Compliance Officer.

      Furthermore, two meetings were attended by representatives of PricewaterhouseCoopers (PwC), in their capacity as the external auditor for the Group's 2024 financial statements; and three were attended by representatives of Deloitte as the Group's newly appointed external auditor for 2025. Furthermore, one meeting was attended by representatives of Morgan Stanley and of the independent expert appointed in connection with the merger between the Company and Société Foncière Lyonnaise ("SFL") to examine matters relating to the exchange ratio and the right of withdrawal in connection with

      the transaction. Finally, one meeting was attended by representatives of BDO to conduct an in-depth

      analysis of the Company's compliance with the Global Internal Audit Standards.

      Finally, it must be stipulated that the Secretary recorded the minutes of all the meetings held, setting out the proceedings, contents, deliberations and agreements adopted. The minutes of Committee meetings were given to all members of the Committee and are available to all directors.

   3. Scope of powers of the Committee

      The Committee efficiently fulfils the duties it has been entrusted with in accordance with Article 35 of the Regulations of the Board of Directors. The Board of Directors thus has the following duties:

      • Report, through its Chairman, to the General Meeting of Shareholders, if required, on matters within the powers of the Committee.

      • Supervise the effectiveness of the Company's internal control, internal audit and risk management systems; and discuss with the auditor any significant weaknesses identified, if any, in the internal control system and any notable modifications or adjustments detected by them, ensuring that their independence is not thereby compromised. To this end, the Committee may submit recommendations or proposals to the Board of Directors and the corresponding time frame for subsequent follow-up and remedy.

      • Directly supervise the internal risk management and control function and submit to the Board for approval a report on the risk management and control policy under the terms determined by the regulations applicable from time to time. This policy must outline at least: (i) the different types of risks the Company faces, including emerging, financial and sustainability risks, with a particular focus on financial or economic risks such as contingent liabilities and other off-balance sheet risks;

        (ii) a risk management and control model. The committee shall also monitor the level of risk deemed acceptable by the Company and the measures envisaged to mitigate, eliminate or manage any risks, should they materialise, as well as the information and internal control systems to be used to control and manage such risks.

      • Supervise, considering the various information sources available, the preparation and presentation of mandatory financial information, as well as of the sustainability information required by the applicable regulations as appropriate, and make recommendations or proposals to the Board of Directors.

      • Oversee that the unit responsible for the internal audit function ensures the effectiveness of the information, internal control and risk management systems and reports functionally to the Chairperson of the Committee. The head of the unit assuming the role of internal auditor shall attend the meetings of the Committee and submit the annual work plan for approval by the Committee or, if applicable, by the Board of Directors. This individual must report directly on the execution of this plan, including any issues and scope limitations encountered and the outcomes and follow-up actions on the recommendations made, and provide an annual report on the activities carried out.

      • Regarding the information and internal control systems: (i) supervise and assess the process of preparing and integrity of financial and sustainability information, as well as financial and sustainability risk management and control systems relating to the Company and, where applicable, to the Group (including political, strategic, legal, reputational, and cybersecurity-related risks), reviewing compliance with current regulatory requirements, the proper delimitation of its scope of consolidation and the correct application of accounting standards; (ii) ensure the independence and effectiveness of the internal audit processes, proposing the election, appointment and, as the case may be, reasoned removal of the head of the internal audit unit. In this respect, the Committee shall assess the conditions of the internal audit team members to ensure they have no direct or indirect interests that could compromise their required independence; (iii) approve the responsibilities, annual work plan and resources of the internal audit function, ensuring that its activities primarily focus on significant risks; (iv) receive regular updates on their activities and ensure that senior management takes on board the conclusions and recommendations from audit reports; and (v) generally ensure that the policies and systems established for internal control are effectively implemented in practice.

      • Act as a two-way communication channel between the Board of Directors and the Company's external auditor, assessing the results of each audit. Also, with respect to the external auditor it shall: (i) submit proposals to the Board of Directors to elect, appoint, reelect and remove auditor;

        (ii) define the selection process pursuant to current legislation and internal procedures, as well as the terms of their contract; (iii) regularly obtain information from the auditor on the audit strategy and plans and their execution; and (iv) preserve the independence of the external auditor in the performance of their duties.

      • Review with the external auditor the significant findings and incidents arising from their work, as well as the content of the audit report, and propose, if appropriate, to the Board of Directors the adoption of all appropriate measures to seek to eliminate the causes of such issues.

      • Analyse, propose and, if appropriate, decide on any issues that may arise between the Board of Directors and the external auditor, in particular: (i) in the event of resignation of the external auditor, examine the circumstances giving rise thereto; (ii) ensure that the remuneration of the external auditor for their work does not compromise their integrity or independence; (iii) approve the procedure for authorisation of the provision by the external auditor of services other than auditing; (iv) oversee that the Company notifies the change of auditor through the Spanish Securities Market Commission and that attached to it is a statement citing any disagreements the Company may have had with the outgoing auditor and, if any, the content thereof; and (v) ensure that the Company and the external auditor comply with current regulations on the provision of non-audit services, the limits on the concentration of the auditor's business and, in general, other rules on auditor independence.

      • Establish the necessary relations with the external auditor in order to receive information on any matters that might jeopardise the auditors' independence, for examination by the Committee, and any other matters related to the accounts audit process; and, when appropriate, authorise non-prohibited services on the terms provided in the current legislation relating to independence and to communicate with the auditors as provided for in the applicable regulations. In any case, each year, the external auditors shall be required to furnish a statement of their independence with respect to the Company or entities related directly or indirectly thereto, as well as detailed and separate information on any manner of additional services of any kind provided and the related fees received from these entities by the external auditor or entities related thereto in accordance with the law governing accounts audits.

      • Issue on an annual basis, prior to the issuance of the accounts audit report, a report stating an opinion as to whether the independence of the auditors or audit firms has been compromised. This report shall, in any case, contain the reasoned assessment of the provision of each and every additional service referred to in the preceding section, considered separately and as a whole, other than legal audit services and in relation to the rules on independence or in accordance with the audit regulations.

      • Report on related transactions to be approved by the General Meeting of Shareholders or the Board of Directors and supervising the Company's internal procedure for transactions whose approval has been delegated.

      • Report to the Board of Directors in advance on all matters envisaged by law, the Company Bylaws and the Regulations of the Board of Directors, in particular in relation to the following matters: a) the financial information that must be publicly reported by the Company on a regular basis; and

        b) the creation or acquisition of holdings in special purpose vehicles or entities based in countries or territories considered to be tax havens.

      • Ensure compliance with the Company's sustainability policies and rules in accordance with the regulations applicable at any given time and its internal codes of conduct. For these purposes, the Committee shall be specifically assigned the following minimum functions: (i) supervising compliance with the Company's internal codes of conduct; and (ii) supervising the implementation of the general policy regarding the reporting of mandatory financial information and sustainability information.

      • Receive information about the Company's planned structural and corporate modifications and analyse and report to the Board of Directors on their economic conditions, associated risks, accounting impact and particularly, where applicable, the proposed swap equation, before their implementation.

      • Issue reports and proposals within its authority as required of it under the regulations applicable at any given time and as requested by the Board of Directors or its Chairperson or as deemed appropriate to enhance the performance of its duties.

      • Independently evaluate the performance of the Committee and report the findings to the Board of Directors.

      • Prepare an annual report detailing the activities of the Committee, indicating any significant changes in internal organisation and procedures resulting from the evaluation.

      • Propose to the Board of Directors any other matters within its remit that it may deem appropriate.

   4. Main Activities Performed in 2025

      Below are the main activities carried out by the Committee in 2025:

      • Economic and Financial and Sustainability Information

        In 2025, the Committee analysed, before presenting its findings to the Board of Directors, the process involved in preparing: (i) the annual financial information for the year ended 31 December 2024, which includes, among other documents, the individual and consolidated annual financial statements and the management reports; (ii) the financial information for Q1 and Q3 of 2025; (iii) the half-yearly financial report for the first half of 2025; and (iv) the sustainability information appearing in the Integrated Annual Report.

        In this process, the Committee was assisted by the Corporate General Manager, the Chief Financial Officer, the Internal Audit Director and the representatives of the external auditor at any given time.

        The Committee carried out the financial oversight by means of a constant process throughout the year, monitoring the performance of the main milestones and salient figures of the balance sheet, the income statement and the financial reports. The Committee oversaw the processes of drawing up the relevant financial information, always in accordance with the pre-established accounting criteria, the applicable laws and regulations and any additional information that was deemed to be necessary or desirable.

        The Committee also acknowledged the renewal, by reason of their maturity, of the derivatives used to

        hedge the interest rates applicable to the Group's debt.

        In addition, regarding sustainability information, the Committee oversaw the preparation of the Integrated Annual Report for 2024, as well as the updating of: (i) the Environmental Policy; (ii) the Wellbeing Policy; (iii) the Biodiversity Policy; (iv) the Climate Change Policy; and (v) the Policy on Renewable Energy and Nearly-Zero Energy Buildings. The following were thus approved at one of the meetings held jointly with the Sustainability Committee: (i) the Integrated Annual Report, including submitting it to the Board of Directors for approval prior to its publication and announcement to the market; and (ii) the policies mentioned above.

        Furthermore, the Committee deemed the conclusions received from the internal auditor in relation to the financial and sustainability information to be favourable as per the requirements of the applicable regulations, and the Committee therefore helped ensure that the financial and sustainability information had been properly drawn up in accordance with the necessary controls and procedures. The Committee submitted its reports with its favourable opinion to the Board of Directors.

      • Internal Control Systems

        The Committee, in the course of its duties, oversaw that the internal control systems established and introduced by the Company's Internal Audit Director were successfully implemented and operative, as well as the risk management systems for the financial reporting process, including tax risks. The analysis focused on several aspects, including the control of both financial and sustainability information.

        Regarding the above, the Committee was duly informed about the Internal Control over Financial Reporting (ICFR) and Internal Control over Sustainability Reporting (ICSR) systems, as well as about the respective reports drawn up for these purposes. In relation to this, no incidents or weaknesses were identified in the appropriate checks run, leading to the conclusion that the Internal Control over Financial Reporting and Internal Control over Sustainability Reporting systems were working successfully.

        Additionally, in 2025 the Committee oversaw the updating of the corporate risk map introduced by the Internal Audit Director, as well as the trends in various risks and the control measures taken to mitigate them. In addition, the Committee acknowledged the report on the risk management and control policy.

        In addition, during 2025 the Committee was duly informed by the Internal Audit Director of the most significant events, updates and recommendations revealed through their work, especially in relation to the results provided by the new tools to monitor and track the most significant controls.

      • Relations with the External Auditor

        The Committee established the necessary relations with the Company's external auditor (PricewaterhouseCoopers (PwC) in relation to the 2024 financial statements and Deloitte for 2025) to ensure the quality and integrity of the financial information. Pursuant to its duties, the Committee acted as a communications channel between the Board of Directors and the Company's external auditor at any given time, assessing the conclusions of their respective audits.

        For these purposes, the representatives of PwC attended two Committee meetings and Deloitte attended three, and the Committee had access to direct information on their work plan, the progress of their work and their significant findings at all times.

        The Committee oversaw and approved the updating of the procedure to authorise the auditor to perform non-audit services. Furthermore, the Committee approved the non-audit services provided by Deloitte in 2025, as well as the resulting fees, in accordance with the aforementioned internal procedure.

        The Committee also confirmed PwC's independence as the external auditor of the Company's and the Group's financial statements for 2024 based on the relevant favourable report on the independence of the external auditor prepared by the internal audit team and the statement of independence signed by the external auditor.

      • Internal Audit

        The Committee approved the "Internal Audit Plan" envisaged for 2025 and oversaw its progress and

        degree of compliance, and it was updated on a regular basis on the adjustments being made to the plan.

        Furthermore, the Committee had the opportunity to acknowledge the content of the working report on the internal audit for 2024 and examine the results of the most significant tasks carried out by the Internal Audit Director. These included, among others, monitoring the System for Internal Control of Financial Information; monitoring the System for Internal Control of Sustainability Information; auditing the rental property marketing process; auditing the licence application and management process; auditing the provision of security by tenants; auditing the third-party management of information systems; and drawing up the risk chapter to be included in the 2025 Integrated Annual Report.

        In addition, the Committee examined, with advice from BDO, the internal auditors' degree of compliance and implementation of the requirements of the Global Internal Audit Standards issued by the Institute of Internal Auditors (IIA). In relation to this, the Committee approved a new set of internal audit regulations as part of the process and action plan being carried out to comply with the aforementioned Global Internal Audit Standards, and it monitored the degree of compliance with the recommendations made by the internal auditors in their other work.

        Furthermore, prior to the completion of the merger of SFL into the Company, the Committee oversaw the coordination between the two companies' internal auditors, as well as the integration of their work after the merger.

        Lastly, the Internal Audit Director provided the Committee with several reports on the external auditor's independence in connection with the auditing and non-auditing services rendered by Deloitte to the Group in 2025.

      • Tax Risks

        During 2025, the Committee monitored the main tax risk-related matters on an ongoing basis. For the purposes of this analysis, the Company's Financial Department presented the Committee members with the tax report for 2024, which included (among other information) a breakdown of all the Group's tax contributions for the year, information on the taxes paid and withheld by geographic area and for each type of tax, and the level of compliance with the requirements applicable under the special tax system for SOCIMIs.

        In addition, the Committee issued a favourable opinion on the changes to the Tax Policy for approval by the Board of Directors.

        Related-party transactions

        The Committee is responsible for reporting on related-party transactions to be approved by the General Meeting of Shareholders or the Board of Directors, as well as for overseeing the Company's internal procedure for transactions whose approval has been delegated.

        Over the course of 2025, the Committee was duly informed about potential related-party transactions. After examining them in accordance with the applicable corporate regulations, the Committee issued a favourable opinion to the Board of Directors on the transactions considered to be related-party transactions. These operations required the approval of the Board of Directors of the Company, and there were no related-party transactions that, due to their value or amount, had to be approved by the General Meeting of Shareholders.

        A report with details of the Company's related-party transactions in 2024 was also drawn up.

      • Corporate Governance

        Ahead of the Board of Directors' approval, the Committee issued a favourable opinion on the Annual

        Corporate Governance Report for 2024.

        Furthermore, the Committee oversaw compliance with the Company's internal policies, promoting and driving a culture of compliance with the laws and regulations applicable to the Company, as well as its corporate texts, among all members of the organisation. In relation to this, the Committee approved updates to the following policies or internal regulations: (i) the Code of Ethics; (ii) the Anti-Corruption Policy; (iii) the Treasury Share Policy; (iv) the Policy on Economic-Financial, Non-Financial and Corporate Reporting with Shareholders, Institutional Investors and Proxy Advisors; (v) the Risk Management and Control Policy; (vi) the General Whistleblowing Channel Policy; (vii) the Policy on the Treatment and Disclosure of Inside Information and Other Significant Information; and (viii) the Selection and Diversity Policy. The Committee also issued favourable opinions in relation to the Diversity and Non-Discrimination Policy and the Human Rights Policy for approval by the Board of Directors.

        In addition, the Committee led and monitored the amendments to the Regulations of the Board of Directors and the Regulations of the Committee with the main purpose of incorporating the provisions of the Spanish Securities Market Commission's Technical Guide 1/2024 on Audit Committees and the new provisions of the Spanish Limited Liability Companies Law on equal representation of men and women and gender-balanced participation and the minimum duties of the Sustainability Committee, as applicable. In addition, in December 2025 the Board of Directors approved new amendments to the

        Regulations of the Board of Directors and the Regulations of the Committee to adapt their terminology to the merger by absorption of SFL by the Company.

      • Regulatory Compliance

        The Committee kept in constant contact with the Compliance Unit, whose functions include monitoring legislative changes, assessing the applicable regulations and ensuring that the Company's internal regulations are suitable and effective. The Compliance Unit is also responsible for monitoring the Company's obligations in matters relating to privacy, criminal risk prevention, the prevention of money laundering and the management of the Internal Reporting System (the Whistleblowing Channel).

        In particular, during 2025 the Committee was informed about the Annual Report on the Company's compliance activities in 2024. The Committee also examined the main actions carried out by the Compliance Unit, took note of the external expert's report on the internal control procedures relating to the prevention of money laundering, and oversaw and monitored matters relating to criminal risk prevention, privacy and data protection and the Whistleblowing Channel, as well as compliance with the multi-annual training plan and the tax policy.

        The Committee also oversaw the Company's coordination with SFL (until its absorption by the Company)

        in the Group's best interests.

      • Corporate Transactions

        Having received information on the merger between the Company and SFL, the Committee, with advice from Morgan Stanley, analysed its financial terms and accounting impact, as well as the legal documentation of the transaction. In relation to this, the Committee issued a favourable opinion to the Board of Directors on the exchange ratio, the share price under the right of withdrawal and the merger transaction itself, specifically regarding the content of the Common Draft Terms of the Merger.

        The Committee also acknowledged, analysed and issued a favourable opinion to the Board of Directors on the financial conditions and accounting impact of the conversion of certain subsidiaries of SFL to the SIIC (Société d'Investissement Immobilier Cotée) regime.

        Treasury shares

        Over the course of the year, the Committee was kept abreast of the number of treasury shares.

        The Committee oversaw and issued a favourable opinion on the purchase of treasury shares to facilitate the exchange of shares in connection with the merger between the Company and SFL. The Committee also acknowledged the resignation of the Chief of Treasury shares and the proposal to make a new appointment.

3. ASSESSMENT OF THE PERFORMANCE OF THE COMMITTEE AND IMPROVEMENTS

   The Committee's assessment of its performance has led to positive conclusions, both in relation to its

   members and internal organisation and in the performance of the duties bestowed upon it.

   In relation to this, the following improvements (among others) were made in 2025 compared to 2024:

   • More comprehensive training on sustainability and regulatory matters;

   • Greater coordination with the Sustainability Committee; and

   • Planning meetings and reducing the length of speeches during meetings.

4. CONCLUSIONS

   In view of the above, it can be concluded that the Committee:

   • is duly organised and made up of directors who have the skills and qualifications required to fulfil its purposes;

   • complies with the Operating Rules established by the Company Bylaws, the Regulations of the Board of Directors and the Regulations of the Committee, and is organised correctly and efficiently to perform its duties and achieve its purposes;

   • efficiently assumes and fulfils the responsibilities assigned to it by the applicable regulations and various corporate texts.

5. FORMULATION OF THE REPORT

This report was drawn up by the Committee on 21 January 2026 and is expected to be approved by the Board of Directors on 22 January 2026.