Merlin Properties SOCIMI S A : Report on the activities of the Audit and Control Committee in 2025 (CAC Activity Report 2025 EN)

About this update from Merlin Properties Socimi, S.a.

Audit and Control Committee December 2025 2025 Activity report of the Audit and Control Committee of MERLIN Properties, SOCIMI, S.A. 1.- PRESENTATION 3 2.- COMPOSITION, OPERATION AND POWERS 4 2.1.- Composition 4 2.2.- Operation 6 2.3.- Competences 6 3.- MAIN ACTIONS IN THE 2025 FINANCIAL YEAR 13 3.1.- Meetings 13 3.2.- General actions 13 3.3.- Specific actions 15 3.3.1.- Financial Information 15 3.3.2.- Sustainability Information 16 3.3.3.- External auditors and verifiers 17 3.3.4.- Valuation of real estate assets 21 3.3.5.- Risk management 21 3.3.6. Tax policy and legal risks 22 3.3.7. Internal Audit 23 3.3.8.- Regulatory Compliance 24 3.3.8.1.- Prevention of criminal risks (Criminal Compliance) 25 3.3.8.2.- Prevention of money laundering and terrorist financing 25 3.3.8.3.- Protection of personal data 26 3.3.8.4.- Internal information system - Ethics Channel 26 3.3.8.5.- Corporate operations 27 3.3.8.6.- Related-party transactions 27 3.3.8.7.- Treasury stock 27 3.3.8.8.- Improvement of policies and procedures 27 4.- CONCLUSIONS 27 5.- WORK PLAN FOR 2026 29 ‌1.- PRESENTATION‌ For the purposes of the Board of Directors carrying out the annual evaluation of the Audit and Control Committee (hereinafter, the Committee) of MERLIN PROPERTIES SOCIMI, S.A. (hereinafter, MERLIN) in accordance with the provisions of article 529 nonies of the Consolidated Text of the Capital Companies Act, this Committee prepares an annual report on its operation, highlighting the main activities carried out in relation to its functions, which is made public in the terms provided for by the applicable regulations in force. In accordance with the aforementioned regulation, as well as with Recommendation 6 of the Code of Good Governance for listed companies, Section 79 of Technical Guide 1/2024 of the National Securities Market Commission and the provisions of article 25.2 of the Regulations of the Audit and Control Committee itself, this 2O25 AcĒiviĒD ½gporĒ financial year is prepared, which will be available to investors, shareholders and any other interested party, through the corporate website from the call of the Ordinary General Shareholders' Meeting. ( https://ir.merlinproperties.com/en/corporate-governance/annual-reports/ ) The regulation of the Committee, in addition to that established by current legislation, is set out in the Bylaws, in the Regulations of the Board of Directors of the Company and, more specifically, in the Regulations of the Audit and Control Committee, which was revised in 2024, to include the recommendations of the CNMV , regarding the supervision of sustainability information and relations between Commissions, as well as with the verifier of sustainability information. This regulation was approved by the Board on 19 December 2024, following a proposal by the Audit and Control Committee itself. In this regard, said Commission Regulations incorporate all the aspects included in the recommendations of Technical Guidg 1/2O2V of Ēhg NaĒional SgcuriĒigs MarfigĒ Commission (CNMV) on AudiĒ CommiĒĒggs of ™ublic-InĒgrgsĒ «nĒiĒigs , as well as the updates to the recommendations included in the New Code of Good Governance approved by the CNMV in June 2020. All of MERLIN's internal regulations (Articles of Association, Regulations of the Board of Directors and Regulations of the Audit and Control Committee) are available to any interested party on the corporate website: ( https://ir.merlinproperties.com/en/corporate-governance/corporate-governance-normative/ ). During the year, the Commission's activity, in its ten meetings , has complied with the Annual Work Plan for 2025, included in the " Worfi Calgndar for Ēhg 2O25 financial Dgar ", approved by the Commission in December 2024 and which reflected the planned content of its meetings and reports to be submitted to the Board of Directors. the appearances of the external auditor, as well as a training plan for the Commission. Thus, and as reflected in this Activity Report, the Committee during the 2025 financial year has addressed the analysis and examination of all issues and aspects of its competence, promptly reporting on the most relevant issues to the Board of Directors of the Company, among which the review of financial ‌and non-financial information may be highlighted. the supervision of the relationships and independence of the Auditor and the External Verifier, the supervision of the Internal Audit, the supervision of the control and risk management systems, including tax and technological systems, the supervision of related-party transactions, the supervision of the regulatory compliance system and associated control structures, as well as recommendations for the continuous improvement of the Company's Internal Control and Corporate Governance Systems.‌ 2.- COMPOSITION, OPERATION AND POWERS The composition and powers of the Audit and Control Committee of MERLIN are regulated in Chapters II and III of the Regulations of the Audit and Control Committee in accordance with the provisions of article 529 quarter of the Capital Companies Act. These provisions establish, in summary, the following main aspects in relation to the Commission: ‌2.1.- Composition With regard to its composition, and in accordance with the provisions of Chapter III of the Regulations of the Audit and Control Committee, the Committee shall be composed of a minimum of three (3) and a maximum of six (6) members, who shall be all non-executive directors and mostly independent; such members shall be appointed by the Board of Directors, at the proposal of the Appointments and Remuneration Committee. In the nomination and appointment of its members, diversity in its composition will be sought, regarding gender, professional experience, sectoral skills and knowledge. The members of the Commission, as members of the Board of Directors, must have the experience and knowledge in management, economic, financial and business areas necessary for any good director. In addition, the Commission must have the relevant technical knowledge in relation to the sector of activity to which the Company belongs; and at least one of the members of the Commission should be appointed considering equally his or her knowledge and experience in accounting, auditing, or both. In addition to the above, in the proposal and appointment of members and positions, the Committee itself, the Appointments and Remuneration Committee and the Board of Directors will ensure that the Chairman of the Committee has the knowledge, skills and experience appropriate to the functions that he or she is called upon to perform in the field of accounting. audit or risk management; the members of the Commission as a whole have financial and internal control skills; and that at least one of the members of the Commission has experience in information technology (IT), inter alia, in order to facilitate efficient oversight of internal risk control and management systems, which generally use complex IT applications, and to be able to adequately assess new emerging risks, such as cybersecurity. The Chairman of the Audit and Control Committee, a position that in any case shall be held by an Independent Director, shall be appointed from among its members and shall be replaced every four (4), and may be re-elected once a period of one (1) year has elapsed since his or her dismissal, without prejudice to his or her continuity or re-election as a member of the Committee. The Commission's membership, powers and operating rules meet the objective of promoting the independence of its functioning. During the 2025 financial year, the composition of the Committee has undergone changes, with the departure of Ms. Ana García Fau in 2025, the Board of Directors of MERLIN accepted the resignation of Ms. Ana García Fau as an independent director of the company with effect from April 1, 2025. Likewise, in May 2025, Mr. Juan Antonio Alcaraz, proprietary director, joined the Committee until November 2025, at which time the Board of Directors accepted his resignation and approved the appointment by co-optation, following a favourable report from the Appointments and Remuneration Committee, of Mr. Fernando López Muñoz, with the qualification of proprietary director, representing the shareholder Nortia Capital Investment Holding, S.L., as well as his appointment as a member of the Audit and Control Committee of MERLIN. As of the date of this report, the composition of the Commission is as follows: CHARGE MEMBER CATEGORY AS A DIRECTOR ACCOUNTING/FINANCIAL/TECHNOLOGY MANAGEMENT EXPERIENCE President Mr. Donald Johnston Independent ✓ Member Mr. Juan María Aguirre Gonzalo Independent ✓ Member Ms. María Luisa Jordá Castro Independent ✓ Member Ms. Francisca Ortega Hernández- Agero Shareholder Related ✓ Member D. Fernando López Muñoz Shareholder Related ✓ The profiles of each member of the Commission, including information on their training, work and management experience, dates of appointment and subsequent re-elections, can be consulted on the corporate website. ( https://ir.merlinproperties.com/en/corporate-governance/members-of-the-board-of-directors/ ) By virtue of the provisions of Article 14 of the Commission's Regulations, the Secretary, not a member of the Commission, is Mr. Ildefonso Polo del Mármol, who is also Deputy Secretary of the Board of Directors. ‌2.2.- Operation The Audit and Control Committee, in accordance with the provisions of Article 18 of its Regulations, before the beginning of each financial year, approves an annual work plan that includes the specific objectives in relation to each of the functions entrusted to it, the organisation of information and the agenda of meetings or other means of periodic communication with the Company's executives. with the head of the internal audit department and with the external auditor and the training considered appropriate for the proper performance of the Commission's functions. In this regard, the Commission has carried out its functions during the year in accordance with the " Worfi Calgndar for Ēhg financial Dgar 2O25 ", approved by the Commission on 18 December 2024 and has approved the " Worfi Calgndar for Ēhg financial Dgar 2O26" at its meeting on 15 December 2025. In any case, the Committee will convene and meet, at least, on a quarterly basis, in order to review the periodic financial information that, in accordance with the Company's internal procedures and, where applicable, the regulations in force, the Board of Directors must submit to the stock exchange authorities, and other periodic obligations (AML/CFT, Compliance, risks, etc.), as well as the information that the Board of Directors must approve and include in its annual public documentation. The Director of Internal Audit and/or the Auditor of Accounts and the Auditor of the Sustainability Information may be present at these meetings. At least part of these meetings will take place without the presence of the Society's management, so that the specific issues arising from the revisions carried out can be discussed exclusively with them. Likewise, the Committee may rely on the collaboration and contracting of external services and advice and obtain any type of information or documentation available to the Company relating to matters within the competence of the Committee and that it is considered necessary for the performance of its functions. ‌2.3.- Competences The functions of the Committee are detailed in Chapter II (Articles 5 to 11) of the Specific Regulations of the Audit and Control Committee. Its main competencies are summarized below: To approve the Policy that determines the procedure for selection and hiring and the relations with the external auditor and the verifier, as well as the circumstances that could affect their independence and the instruments to provide such relationships with due transparency. Within the framework of this competence, the Committee must take into account, among others, factors such as the scope of the audit, knowledge of the sectors in which the Company's economic activities are framed, including their associated risks and the specific regulations, the training, experience and resources of the auditor or audit firm, the fees, as well as their independence and the effectiveness and quality of the audit services to be provided. The same criteria shall apply to the appointment or re-election of the verifier of sustainability information, for which the Commission may consult and/or involve the Sustainability Committee. To submit to the Board of Directors, for submission to the General Shareholders' Meeting, the proposal for the selection, appointment, re-election and replacement of the external auditor and the auditor, as well as their conditions of employment and, where appropriate, their revocation or non-renewal. To authorise in advance the services other than auditing of accounts that the external auditor (or the auditing firm to which he or she belongs) or the persons or entities related to them (in accordance with the provisions of the legislation on auditing of accounts) are going to provide to the companies of the group, under the terms provided for in the law. To receive annually from the external auditor and the auditor the declaration of their independence, as well as the information of the additional services of any kind provided and the corresponding fees received by them or by the persons or entities related to them, in accordance with the provisions of the legislation on auditing of accounts. Issue annually, prior to the issuance of the audit report, a report in which an opinion will be expressed on whether the independence of the auditor and the external auditor is compromised. Review with the external auditor and the auditor the main incidents detected during the audit and the verification work, respectively, contrast them with the opinion of the management, verifying that they have been solved and, failing that, understand why they have not, and follow up on the recommendations of the external auditor and the auditor. Analyse with the external auditor and the auditor the significant weaknesses of the internal control system detected in the development of the audit and the verification work and present recommendations or proposals to the Board of Directors and the corresponding deadline for their follow-up. Ask the auditor about the procedures established in order to provide reasonable assurance that the annual accounts are free of material errors or omissions and whether, in practice, any signs or indications have been identified that the Committee should be aware of and in respect of which it should take any action. Discuss with the auditor and the verifier: (i) the adequacy of the criteria and parameters used to determine materiality, or double materiality in the case of the sustainability report, as well as whether they have set, based on qualitative parameters, lower figures in the analysis of certain transactions or sensitive areas of financial or sustainability information, such as relationships with related parties; and (ii) the methods and assumptions used by management in the significant estimates, as well as the effect of the consideration of alternative methods or assumptions, and the auditor's or verifier's consideration of information, hypotheses, methodologies or data that may be contradictory to those used by management. To supervise the correct application of generally accepted accounting principles and applicable international financial reporting standards and to supervise the process of preparing and presenting the Company's annual accounts and the periodic financial information that, in accordance with the regulations in force, the Company must provide to the markets and its supervisory bodies, as well as its preparation and publication process, informing the Board of Directors of this prior to its approval and presenting recommendations or proposals aimed at safeguarding its integrity. Supervise the process of preparing and presenting the Company's annual accounts, the financial and non-financial information that the entity makes public in its annual or interim financial reports, including the presentation of results, the management report, the information on sustainability, the communication of transactions with related parties, the reports on the internal risk management and control systems, of corporate governance, remuneration of directors, etc., informing the Board of Directors of this matter prior to its approval, assessing in which cases it makes sense and may involve the auditors or the auditors of sustainability information in the review of any of the previous reports and presenting recommendations or proposals aimed at safeguarding their integrity. Supervise the process of preparing and the integrity of financial and non-financial information, as well as the control and management systems of financial and non-financial risks relating to the Company, including (a) operational, (b) technological, social, environmental, (c) governance and talent management risks, (d) legal, (e) political, and (f) reputational or corruption-related, the foregoing subject to a report and recommendation from the Sustainability and Innovation Committee and the Appointments and Remuneration Committee in the matters within their competence. However, and without prejudice to the necessary coordination between committees, the ultimate supervision of the effectiveness of the financial and nonfinancial risk control and management systems, including sustainability systems, will be attributed to this Committee. Review the clarity and completeness of all financial and nonfinancial information that the entity makes public in its annual or interim financial reports, including the presentation of results, the management report, the information on sustainability, the communication of transactions with related parties, the reports on the internal risk management and control systems - including the latter, in turn, the annual corporate governance reports (IAGC) and directors' remuneration reports (IARC), as well as information on sustainability-prior, where appropriate, to their approval by the Board, without prejudice to the prior verifications that may be carried out by other committees due to the matter, such as the review of the remuneration report by the Appointments and Remuneration Committee, ensuring that the half-yearly Financial Reports and quarterly management statements are formulated with the same accounting criteria as the Annual Financial Reports and, to this end, consider the appropriateness of a limited review of the half-yearly Financial Reports by the statutory auditor. Supervise the content of the audit reports, the reports of the limited review of intermediate accounts, the reports of the review of the statement of non-financial information and other mandatory reports of the external auditor, before their issuance, in order to avoid qualifications. Ensure, with the collaboration of the internal authoring department, that the financial and non-financial information published on the Company's website is permanently updated and coincides with that which has been formulated by the Company's directors and published, where appropriate, when required to do so on the CNMV website. Approve the guidance and work plans of the internal audit directorate and receive periodic information on its activities. In monitoring the work plan, the Commission shall verify that the plan has considered the main risk areas, financial and non-financial, of the business, and that their responsibilities are clearly identified and delimited for the purposes of appropriate coordination with other assurance functions that may exist, such as risk management and control units, management control, regulatory compliance and external auditing. To evaluate continuously, and at least annually, the functioning of the internal audit department, its action plans and resources and the performance of its director or manager. In this evaluation, the Commission will take into account: that in practice the main areas of business risk identified in the plan are adequately covered. This will include monitoring internal controls over the methodology for calculating the sustainability alternative performance measures (APMs) and key performance indicators (KPIs) that the entity uses in its regular reports; whereas there is adequate coordination with other assurance functions such as risk management and control or regulatory compliance, as well as with the external auditor and the sustainability information verifier; that the initially approved resources are available, both personal and technological and financial, including the hiring or use of experts for those audits in which special qualifications are required, when deemed necessary or convenient; whereas the head of the internal audit directorate has effective direct access to the Commission; that reports are submitted at the scheduled intervals on the progress and conclusions of their work, drawn up as a result of annual planning or other specific requests that may have been made or approved by the Commission. These conclusions must include both the weaknesses or irregularities detected and the action plans for their resolution and the monitoring of their implementation; whereas all significant changes in the practical execution and implementation of the plan are properly communicated to the Commission and where such changes entail the need to update the plan itself, the update is approved by the same procedure as the initial plan; that an activity report is submitted annually which must contain, at least, a summary of the activities carried out and the reports prepared during the year, explaining the work that was foreseen in the annual plan but has not been carried out or that which was not foreseen in the initial plan, and an inventory of weaknesses, recommendations and action plans contained in the various reports. Supervise all matters relating to the different types of risk faced by the Company, including financial or economic risks, contingent liabilities, other (a) off-balance sheet, (b) operational, (c) social, environmental and technological risks, (d) governance and talent management risks, (e) legal, and (f) political and reputational risks, in collaboration with the Sustainability and Innovation Committee and the Appointments and Remuneration Committee, in matters of competence. Evaluate, at least annually, the list of the most significant financial and non-financial risks and the level of tolerance established for each one based on the information provided by the management, the head of the internal audit department and, where appropriate, the risk management and control unit, taking into account that setting the risk levels that the Company considers acceptable is an executive function of the Board of Directors. Obtain information on whether the most relevant risks are managed, controlled and maintained within the tolerance values set by the Board of Directors, based on the information provided by the management, the head of internal audit and, where appropriate, the head of the risk management and control unit; reassess, at least annually, the list of the most significant financial and non-financial risks, and assess the different levels of risk tolerance established in order to, where appropriate, propose their adjustment. Hold, at least annually, a meeting with the heads of the business units in which they explain the trends in the business and the associated risks, and reinforce the idea that it is the heads of the business units who are directly responsible for effectively managing the risks and that there must be an assigned manager for each identified risk. Review the Company's internal control and risk management systems and, in particular, the correct design of the internal control and financial reporting management system (ICFR) and sustainability information system (ICISS), so that the main risks are identified, managed and disclosed appropriately. To approve the internal audit plan for the evaluation of the ICFR and ICSS, and its amendments, and to receive periodic information on the results of its work, as well as the action plan to correct the deficiencies observed. To report at the General Shareholders' Meeting on the issues that arise in relation to those matters that fall within the competence of the Committee, and, in particular, on the outcome of the audit, explaining how it has contributed to the integrity of financial information, sustainability information and the role that the Committee has played in this process. Supervise the recruitment process of external real estate asset appraisers, proposed by the Management, ensuring the application of the rotation policy and the identification of possible conflicts of interest and threats to independence that may call into question their suitability. To review that the methodology applied and the significant assumptions and assumptions used are in accordance with International Accounting Standards (IFRS) as well as the Valuation and Valuation Standards published by the Royal Institute of Chartered Surveyors (RICS) of Great Britain and in accordance with the International Valuation Standards (IVS) published by the International Valuation Standards Committee (IVSC). To know and evaluate the result of the work carried out by the external auditor in relation to the valuations of the Company's assets. To collect and analyse all the information and documentation necessary to be able to inform the Board of Directors of all related-party transactions to be approved by the General Shareholders' Meeting or the Board itself, under the terms established by law. To this end, the Committee may request expert reports when it deems it appropriate, for example, because it must rule to assess whether a transaction, with sufficient complexity, is fair and reasonable from the point of view of the Company and the shareholders who are not related parties. Ensure that the announcement of related-party transactions to be reported to the CNMV for public dissemination contains the necessary information required by law and, in particular, to assess whether the transaction is fair and reasonable from the point of view of the Company and shareholders who are not related parties. Establish control mechanisms over related-party transactions whose approval has been delegated by the board of directors, so as to allow it to verify that the legal criteria that protect such delegation are met. To this end, the Audit Committee will propose to the board the internal procedure for periodic information and control, which will be aimed at verifying compliance with the legally established criteria, as well as the fairness and transparency of the operations whose approval was delegated, and that it periodically review their suitability. To inform the Board of Directors about the creation or acquisition of shares in special purpose entities or entities domiciled in countries or territories that are considered tax havens, the economic conditions and accounting impact and, where appropriate, the exchange ratio of the structural and corporate modification operations that the Company plans to carry out and of the operations with related parties. To review the annual plan of activities of the Criminal Enforcement Body, as well as the six-monthly report of its activities for subsequent submission to the Board of Directors. Receive information from the Criminal Enforcement Authority regarding any relevant issue relating to regulatory compliance and the prevention and correction of illegal or fraudulent conduct. Review, through the Internal Control Body, the Company's internal policies and procedures to verify their effectiveness in preventing money laundering and terrorist financing and identify any policies or procedures that are more effective in promoting the highest ethical standards, for submission to the Board of Directors. ‌3.- MAIN ACTIONS IN THE 2025 FINANCIAL YEAR‌ ‌3.1.- Meetings The Committee performs its functions with total independence and full operational autonomy, being directed by its Chairman, who is responsible for convening meetings, proposing the order of matters to be dealt with and requiring the attendance of any director, officer or employee of the Company or the external auditor or any other external auditor that may be necessary for the performance of its functions. The Commission, during the financial year 2025, has met on ten (10) occasions (in particular, on 20 January, 18 February, 24 February, 24 April, 12 May, 21 July, 28 July, 17 September, 12 November and 15 December). The meetings held during the year have all been held in person at the Company's headquarters. In addition to its members, the meetings of the Audit and Control Committee have been attended by employees and executives of the Company, such as the Executive Director and Corporate General Manager, the Director of Legal Advice, the Director of Accounting and Consolidation, the Head of the Tax Department, the Coordinator of Asset Valuations, the Director of Systems, the Head of SAP, CISO, DPO and the Director of Internal Audit, among others, to deal with the items on the agenda to which they had been summoned. Likewise, the External Auditors have attended 6 meetings of the Committee to report on the review of the valuation of assets at the end of 2024, the Audit carried out during the 2024 financial year, the six-monthly review of the asset valuations of 2025 and the Limited Review of the first half of 2025. and the preliminary conclusions of the review for the end of the 2025 financial year. ‌3.2.- General actions By way of general information, at its meetings during the financial year 2025 and in the exercise of the functions attributed to it, the Commission has: submitted to the Board of Directors the reports in relation to the presentation of the individual and consolidated financial statements, as well as their review by the external auditor, for the year ended December 31, 2024, as well as on the quarterly and half-yearly financial and non-financial information, required (during the 2025 financial year) from the Company, as a listed company, by the applicable regulations; presented to the Board of Directors all the work entrusted to the external auditor during the current year and its prior analysis of the contract in terms of independence and compatibility in accordance with the Law on Auditing of Accounts; supervised the annual recruitment process of external real estate asset appraisers, proposed by the Management, ensuring the application of the rotation policy and the identification of possible conflicts of interest and threats to independence that may question their suitability. reviewed the methodology applied by the external valuators of real estate assets and the significant assumptions used, being in accordance with International Accounting Standards (IFRS); supervised the outcome of the work carried out by the external auditor in relation to the valuations of the Company's assets; analysed all the information and documentation necessary to be able to inform the Board of Directors of related-party transactions under the terms established by law, analysing the need to announce related-party transactions to the CNMV for public dissemination and, in particular, to assess whether the transaction is fair and reasonable from the point of view of the Company and shareholders who are not related parties; taken cognizance of and reported favorably, where appropriate, to the Board of Directors regarding accounting, tax, and corporate operations; updated the 2025 Risk Map in accordance with the COSO-ERM 2017 methodology, with the periodic monitoring of the main business risks through the appearance of the heads of the business units together with their explanation of business trends and associated risks; assessed the level of tolerance established for each of the risks identified based on the information provided by management and the head of the internal audit department; analysed the risks that affect the Company in terms of technological and cybersecurity risks, supervising the IT Department's action plans in this area; reviewed the tax policies followed during the year, before formulating the annual accounts and filing Corporation Tax, in compliance with MERLIN's Tax Policy; supervised the execution of the Internal Audit work within the framework of the internal control systems and in accordance with the 2025 Annual Plan of Activities approved at the meeting of December 18, 2024, monitoring the compliance of the Company's management with its recommendations; reviewed the activities of the various control bodies established in the Company for the supervision and management of criminal risks (Criminal Control Body) and in the field of prevention of money laundering and terrorist financing (Internal Control Body); supervised the operation of the Internal Control Systems implemented (ICFR and ICRIS) and, in turn, reviewed the internal audit reports on them, reviewing their respective manuals, the Group's Accounting Policy Manual and the Non-Financial Information Statement (NFIS); verified the work carried out by the Company's management with respect to Data Protection regulations, ensuring, at all times, the implementation of control systems that minimise the risk of vulnerability of the rights of users of the Company's assets; promoted an improvement in policies and procedures, within the competence of the Commission. ‌3.3.- Specific actions Within the particular framework of its powers, the Commission, during the financial year 2025, has carried out the following actions: ‌3.3.1.- Financial Information Thg CommiĒĒgg, wiĒhin iĒs powgrs, is rgsponsiblg for supgrvising Ēhg procgss of prgparing and prgsgnĒing Ēhg mandaĒorD financial informaĒion rglaĒing Ēo Ēhg CompanD and Ēhg submission of rgcommgndaĒions or proposals Ēo Ēhg managgmgnĒ bodD, aimgd aĒ safgguarding iĒs inĒggriĒD, as wgll as Ēhg supgrvision of compliancg wiĒh rggulaĒorD rgquirgmgnĒs, Ēhg appropriaĒg dglimiĒaĒion of Ēhg consolidaĒion pgrimgĒgr and Ēhg corrgcĒ applicaĒion of accounĒing criĒgria. In relation to the process of preparing and presenting the mandatory financial information of the Company and its group, the Commission has analysed and supervised, during 2025 and prior to its presentation to the Board of Directors, in order to review its reliability, correctness, sufficiency and clarity, the following information that the Board of Directors must provide to the market and submit to the National Commission (CNMV) by virtue of its status Listed company: The Individual and Consolidated Annual Accounts and Management Reports for the financial year 2024 of MERLIN and its consolidated group, having analysed the process of preparing the aforementioned information and the existing guarantees within the Company's Internal Control Model, as well as the appropriate delimitation of the consolidation perimeter and the correct application of the accounting principles used (IFRS and PGC). The Quarterly and Half-Yearly Periodic Financial Information for the 2025 financial year of MERLIN and its consolidated group, verifying the adequate delimitation of the consolidation perimeter, the homogeneity of accounting criteria and the identification of accounting risks that could jeopardize the audit opinion on the 2025 Annual Accounts. In this regard, it should be noted that the Audit and Control Committee, at its meeting held on February 24, 2025, submitted a report to the Board of Directors of MERLIN, with the proposal for the formulation of the Annual Accounts and Management Reports for the financial year 2024, individual and consolidated, in the same terms that are put to the vote at the General Shareholders' Meeting and that were accompanied by an audit report of the firm PriceWhaterhouseCoopers Auditores, S.L. (hereinafter "PWC") with a favorable opinion and without qualifications. Likewise, and with respect to the Quarterly and Half-Yearly Periodic Financial Information for the 2025 financial year, the Commission at its meetings on May 12, July 28 and November 12, submitted to the Board of Directors of MERLIN, favorable reports on the aforementioned periodic financial information, verifying at the July meeting, that the Limited Review report of the firm PWC on the half-yearly financial statements for 2025, it contained a favorable and unqualified conclusion. Finally, during the 2025 financial year, the Committee has reviewed that the financial information published on the Company's website is permanently updated and coincides with that, where appropriate, that which has been formulated by the Company's directors and published on the CNMV website. Lifigwisg, Ēhg Commission is rgsponsiblg for approving Ēhg inĒgrnal audiĒ plan for Ēhg gvaluaĒion of Ēhg ICF½, and iĒs modificaĒions, and rgcgiving pgriodic informaĒion on Ēhg rgsulĒ of iĒs worfi, as wgll as Ēhg acĒion plan Ēo corrgcĒ Ēhg dgficigncigs obsgrvgd. In this regard, the Commission has worked during this year on: To review the Internal Control Policy that regulates the process of preparing and supervising financial and non-financial information, applicable to all the companies of the Group. To review and approve the materiality levels of the accounting headings of the financial statements of the MERLIN group, in order to identify the key controls within the Internal Control Model, as well as to review the ICFR Functions and Supervision Manual, as well as the Company's Accounting Policies Manual. Supervise the review of the ICFR controls within the framework of the 2025 Annual Internal Audit Plan and follow up on the weaknesses and proposals for improvement highlighted. ‌3.3.2.- Sustainability Information Thg Commission, wiĒhin iĒs powgrs, is rgsponsiblg for assgssing Ēhg procgss of prgparing and Ēhg inĒggriĒD of financial and susĒainabiliĒD informaĒion, as wgll as Ēhg conĒrol and managgmgnĒ sDsĒgms for financial and non-financial risfis rglaĒing Ēo Ēhg CompanD, including opgraĒional, Ēgchnological, lggal, social, gnvironmgnĒal, poliĒical and rgpuĒaĒional or corrupĒion-rglaĒgd risfis. In relation to the process of preparing the sustainability information and with special emphasis on the preparation of the Non-Financial Information Statement (NFIS), the Committee has continued to monitor, together with the Sustainability and Innovation Committee and the Appointments and Remuneration Committee, the progress of the following work: Preparation of an analysis of the dual materiality of issues relevant to MERLIN for its report during the 2025 financial year. Supervise the preparation of the different manuals of the Internal Control System for Sustainability Information (SCIIS) for each of the GRI indicators that respond to the scope of Law 11/2018. The review of the implementation and execution of the different ICSIS controls of the different processes and areas involved that have been documented in the Group's internal control tool. The review of the process of preparing the NFIS, with the collaboration, each in its areas of responsibility, of the Sustainability and Innovation Committee and the Appointments and Remuneration Committee. ‌3.3.3.- External auditors and verifiers Thg Commission is rgsponsiblg for rggularlD collgcĒing informaĒion from Ēhg audiĒors and Ēhg audiĒor on Ēhg audiĒ plan and iĒs implgmgnĒaĒion, as wgll as prgsgrving Ēhgir indgpgndgncg in Ēhg gюgrcisg of Ēhgir funcĒions. IĒ musĒ also gnsurg ĒhaĒ Ēhg CompanD, Ēhg audiĒor and Ēhg vgrifigr rgspgcĒ Ēhg rulgs on Ēhg provision of sgrvicgs oĒhgr Ēhan audiĒing and, in ggngral, Ēhg rulgs on Ēhg indgpgndgncg of audiĒors. In accordance with the "Procurement Policy and Framework for Relations with the Auditor", approved on 13 November 2017 and in accordance with the provisions of the " 2025 Work Plan with the External Auditor " set out on 18 December 2024, the Commission, during the financial year 2025, established appropriate relations with the Auditor of Accounts (PWC). With the aim of supervising the progress of the audit work, knowing its significant findings, supervising its fees and work assignments and ensuring that the opinion on the annual accounts and the main contents of the audit report, as well as the special report, were written in a clear and precise manner. Thus, during the 2025 financial year, the Company's external auditors and with respect to the evolution of their work, have attended to the Committee, on 6 occasions, having the opportunity in all of them to present their conclusions without the presence of the management team, at its meetings of (i) 18 and 24 February; (ii) May 12; (iii) July 21 and 28; and (iii) December 15, all of 2025. The following aspects should be highlighted as the main aspects of the work carried out by the Commission in relation to the External Auditor: In rglaĒion Ēo M«½LIN's Financial SĒaĒgmgnĒs and SusĒainabiliĒD InformaĒion During Ēhg 2O25 financial Dgar, Ēhg CommiĒĒgg has bggn awarg of and moniĒorgd Ēhg gvoluĒion of Ēhg gюĒgrnal audiĒ worfi, including planning, Ēhg scopg of Ēhg ĒgsĒs carrigd ouĒ, Ēhg worfi schgdulg, fggs, Ēhg risfis idgnĒifigd in Ēhg audiĒ, Ēhg judgmgnĒs on Ēhg applicabiliĒD of accounĒing criĒgria and principlgs, Ēhg opinion on Ēhg accounĒing ĒrgaĒmgnĒ of rglgvanĒ corporaĒg ĒransacĒions and Ēhg conclusions of Ēhg diffgrgnĒ worfis rgflgcĒgd in iĒs rgporĒs submiĒĒgd Ēo Ēhg Commission during Ēhg financial Dgar. In this regard, the representatives of the auditor, PWC, presented to the Commission, at its meeting on 24 February 2025, the main conclusions of: The work carried out in relation to the Audit of the Individual and Consolidated Annual Accounts of MERLIN, and its consolidated group, corresponding to the financial year 2024, presenting the Draft Audit Opinion and Additional Report on the individual and consolidated annual financial statements as of December 31, 2024, with a favorable opinion, without qualifications. The work carried out in relation to the Verification of the Statement of Non-Financial Information (NFIS) corresponding to the financial year 2024, presenting the Draft Review Report with a favourable opinion, without qualifications. Subsequently, at the meeting of 28 July 2025, the representatives of the auditor, PWC, presented the main conclusions of the work carried out in relation to the Limited Review of the Half-Year Interim Financial Statements of MERLIN and its consolidated group, corresponding to the first half of the financial year 2025, with a favourable conclusion and without qualifications, detailing the main relevant events of the period, as well as the main audit risks. Finally, at the meeting of 15 December 2025, the auditor presented the work carried out in the preliminary review as of 30 September 2025 with a view to the review of the accounts for the 2025 financial year, the significant audit matters detected in the course of his work. In rglaĒion Ēo Ēhg analDsis of iĒs Indgpgndgncg Thg AudiĒ and ConĒrol CommiĒĒgg rgcgivgs annuallD from Ēhg CompanD's audiĒor wriĒĒgn confirmaĒion of iĒs indgpgndgncg from Ēhg CompanD or gnĒiĒigs dirgcĒlD or indirgcĒlD linfigd Ēo iĒ, as wgll as dgĒailgd and individualizgd informaĒion on Ēhg sgrvicgs, oĒhgr Ēhan audiĒing, providgd bD Ēhg audiĒor, or bD pgrsons or gnĒiĒigs rglaĒgd Ēo iĒ in accordancg wiĒh Ēhg provisions of currgnĒ lggislaĒion on audiĒing of accounĒs. In this regard, on 24 February 2025, the Company's Statutory Auditor submitted to the Commission his declaration of independence with respect to the audit of the annual accounts for the financial year 2024. Said communication contained detailed and individualized information on the fees related to account auditing services and others related to the same, as well as any other additional services, provided to MERLIN Properties SOCIMI S.A. and the Companies of its Consolidated Group during the 2024 financial year. Likewise, on that same date, the Auditor submitted to the Audit and Control Committee the Additional Report to the Audit Committee in which the auditor confirmed that he had complied with the applicable independence requirements in accordance with the provisions of the regulations in force. To guarantee the independence of the external auditor, the Audit and Control Committee has supervised compliance by both the Company and the external auditor with the rules in force on the provision of services other than auditing accounts. In this regard, the Commission has analysed, among other aspects: Compliance with the " Contracting Policy and Framework for Relations with the Auditor ", by which the Audit and Control Committee have pre-authorized the contracting of all services other than auditing. The express statement of the Auditor of Accounts, confirming its independence, with an individualized and detailed detail of the services provided and fees accrued. The Auditor's express confirmation of the establishment of internal procedures aimed at identifying and assessing threats that may arise from circumstances related to audited entities and, where appropriate, the application of safeguard measures. An individualised analysis of the services provided to MERLIN Properties SOCIMI S.A. and the companies in its consolidated group. The Committee, in the course of the audit for the 2025 financial year, has not identified situations that could have posed a threat to the independence of the auditor, and for all these reasons the Committee concluded its analysis of the auditor's independence, stating that the auditor has acted in accordance with the independence standards that apply in accordance with the auditing regulations in force. In this regard, on February 24, 2025, the Audit and Control Committee submitted to the Board of Directors its Annual Report on the Independence of the Auditor. This report is available to anyone interested on the corporate website. ( https://ir.merlinproperties.com/en/corporate-governance/annual-reports/ ) In addition, and with respect to the 2025 financial year, periodically in the attendances of the external auditor in the Audit and Control Committee, the work carried out by the auditor has been periodically monitored, as well as the amounts paid for it, in order to assess the independence of the auditor. In this regard, in the various attendances to the Audit and Control Committee during the 2025 financial year, the auditor reported negatively on the identification of situations that could jeopardize its independence. In rglaĒion Ēo Ēhg supgrvision of Dour fggs and commissiongd worfi M«½LIN's CorporaĒg Govgrnancg SDsĒgm gnsurgs ĒhaĒ Ēhg ngcgssarD rglaĒions arg gsĒablishgd bgĒwggn Ēhg AudiĒ and ConĒrol CommiĒĒgg and Ēhg audiĒor so ĒhaĒ Ēhg laĒĒgr rgcgivgs ĒimglD informaĒion on maĒĒgrs ĒhaĒ maD posg ĒhrgaĒs Ēo iĒs indgpgndgncg. In 2022, the Audit and Control Committee held a competition for the election of a new Auditor for the period 2024-2026. In this competition, the technical capabilities, the methodology for reviewing the valuation of assets, the human capital and the economic conditions of each participant were assessed. The General Shareholders' Meeting held on April 27, 2023, approved the appointment of the auditing firm PWC for the financial years 2024-2026. In this regard, during the 2025 financial year, the Audit and Control Committee has ensured that the Company's auditor is independent, and this is evident in the relations between the latter and the Company. MERLIN has a pre-authorisation policy whereby the Audit and Control Committee must authorise, prior to its formalisation, any contract that it intends to enter into with the auditor (or member of its network) for the provision of services other than auditing to the Company or to any of the companies in its Group. in order to be able to analyse individually and globally the threats to independence that may arise from such contracts. In rglaĒion Ēo Ēhg InĒgrnal ConĒrol ½gcommgndaĒions At the meeting of 24 February 2025, the auditor (PWC) informed the Audit and Control Committee of the absence of deficiencies in the Group's internal control. Finally, and with a view to the next financial year, at the session of 15 December 2025, the Commission has established a 2026 Work Plan with the External Auditor, with the content foreseen for each of them and the reports required by the Commission. ‌3.3.4.- Valuation of real estate assets Thg Commission, wiĒhin iĒs powgrs, is gnĒrusĒgd wiĒh supgrvising Ēhg conĒracĒing procgss, rgvigwing Ēhg mgĒhodologD appligd bD Ēhg gюĒgrnal appraisgrs and finowing and gvaluaĒing Ēhg worfi carrigd ouĒ bD Ēhg gюĒgrnal audiĒor in rglaĒion Ēo Ēhgsg valuaĒions. During the 2025 financial year, the Audit and Control Committee has supervised, on a six-monthly basis, the valuation process of the Company's assets, ensuring that the process has been carried out in accordance with international valuation standards (IVS) and accounting standards (IFRS). In this regard, the Audit and Control Committee has held biannual meetings with the firms in charge of the valuation of assets (Savills, CBRE and JLL), submitting to the Board of Directors the corresponding reports on the asset valuation process for the year-end of the 2024 financial year, dated 18 February 2025. and to the six-month closing process of June 30, 2025, dated July 21, 2025. In these reports, the Audit Committee has reviewed, among other issues, the following: Rotation and hiring : The Commission, at its meeting on April 24, 2025, oversaw the annual hiring and rotation process proposed by the Management. Independence and absence of conflicts of interest : Valuation firms are multinational firms of recognized prestige, without economic dependence on the fees of the MERLIN Group and that have expressed in writing to the Commission their independent status with respect to the company and its fees, as well as the absence of conflicts of interest in the provision of services. Methodology and Assumptions Used : The Commission has reviewed the adequacy of the valuation methodology used to International Accounting Standards (IFRS). ‌3.3.5.- Risk management Thg Commission, wiĒhin iĒs powgrs, is gnĒrusĒgd wiĒh supgrvising Ēhg gffgcĒivgngss of Ēhg CompanD's inĒgrnal conĒrol and risfi managgmgnĒ sDsĒgms. To Ēhis gnd, iĒ assgssgs all maĒĒgrs rglaĒing Ēo Ēhg CompanD's non-financial risfis, including opgraĒional, gnvironmgnĒal, Ēgchnological, lggal, social, poliĒical and rgpuĒaĒional risfis. The Company has a corporate risk management model supervised by the Commission, through which potential events that may affect the organization are identified, their risks are managed and reasonable assurance is provided regarding the achievement of objectives. The Commission (with the support of the Internal Audit Department) supervises the model, based on the application of risk management methodology through the supervision of the identification and assessment of risks (probability and impact) that affect the objectives of each of the areas. Through the development of the plan, it evaluates and concludes on the sufficiency and effectiveness of the controls implemented by the Company, issuing, where appropriate, recommendations. During this period, the Committee, in collaboration with the Director of Internal Audit, continued the work undertaken in the previous year on: Update of the Risk Map in January for subsequent presentation to the Board of Directors and six-monthly review in September 2025. Annual review of the Risk Control and Management Policy, analysing its compliance, validity and suitability of its update in terms of nonfinancial risks and/or sustainability, approving a new version dated April 2025. Analysis of the Spanish economic and real estate context and identification of early risk indicators (KRIs). Six-monthly monitoring of the main indicators (KPIs) of the risks considered to be key, as well as the different actions established for their mitigation. Evaluation of the level of tolerance established for each of the risks identified based on the information provided by the management and the head of the internal audit department. Analysis of the risks that affect the Company in terms of technological and cybersecurity risks, supervising the IT Department's action plans in this area. Review of tax risks, compliance with the Tax Policy and compliance with the SOCIMI Regime. Review of the operational, technological and security risks of the business segment of Offices, Logistics, Shopping Centers and Data Centers. ‌3.3.6. Tax policy and legal risks Thg Commission, wiĒhin iĒs powgrs, is gnĒrusĒgd wiĒh supgrvising Ēhg gffgcĒivgngss of Ēhg CompanD's inĒgrnal conĒrol and risfi managgmgnĒ sDsĒgms. To Ēhis gnd, iĒ assgssgs all maĒĒgrs rglaĒing Ēo Ēhg CompanD's non-financial risfis, including opgraĒional, gnvironmgnĒal, Ēgchnological, lggal, social, poliĒical and rgpuĒaĒional risfis. In compliance with the MERLIN group's Tax Policy and Strategy, the Commission has supervised and monitored, during the 2025 financial year, the main tax risks, as well as the tax policies applied during the year, having been informed of them, prior to the preparation of the annual accounts and the presentation of Corporation Tax. In this regard, the Head of the Group's tax area attended the Commission on 18 February, 28 July and 12 November to present the tax policies and risks, the provision of corporate tax, its subsequent filing, as well as the declaration of related-party transactions and transfer pricing. The Committee has also regularly monitored the group's main legal risks, mainly arising from ongoing litigation, analyzing, where appropriate, their potential impact on the financial statements and the need for their breakdown in the notes to the MERLIN group's financial statements. To this end, the Group's Head of Legal Advice has attended to the Commission in the sessions held on 12 May, 28 July and 12 November to present and detail the ongoing litigation. ‌3.3.7. Internal Audit Thg Commission, wiĒhin iĒs powgrs and among oĒhgr aspgcĒs, gnsurgs Ēhg indgpgndgncg and gffgcĒivgngss of Ēhg funcĒion of Ēhg inĒgrnal audiĒ dirgcĒoraĒg, supgrvising, among oĒhgr aspgcĒs, Ēhg annual worfi plan, iĒs budggĒ and iĒs rgmungraĒion, vgrifDing ĒhaĒ Ēhg mgmbgrs of Ēhg managgmgnĒ Ēgam considgr Ēhg conclusions and rgcommgndaĒions of iĒs rgporĒs. Thus, in the context of the responsibility attributed to the Commission during the financial year 2025: has reviewed the execution of the 2025 Annual Internal Audit Plan, approved on December 18, 2024. has reviewed the monitoring of progress made during the 2025 financial year in terms of Digitalization of the Internal Audit function. has overseen the alignment of Internal Audit management with the New Global Internal Auditing Standards. To this end, it has had external advice for the gap analysis and the establishment of an action plan. As a result of this analysis, the Commission has approved during the 2025 financial year, the following documents that are the backbone of the Internal Audit department: New Statute of the Function New Procedures Manual Strategic Plan 2025-2027 Competency Model and Professional Development Plan Training Plan 2025 Quality Assurance and Improvement Program has reviewed the Internal Audit team's formal certification of acceptance of the Statute and the annual certification of the director of Internal Audit regarding its independence and objectivity. has carried out the review of the reports issued by the Internal Audit Department, reviewing the recommendations included and verifying that the Company's management complied with the action plans included. in all its meetings, the Director of Internal Audit has appeared and presented the developments and advances in the area of his responsibility, with special emphasis on the different review work on the control models and processes that were being carried out in this regard (mainly business process auditing, review of the ICFR and SCIIS, Data Protection, Criminal Compliance and Risk Management System). oversaw internal controls on the methodology for calculating alternative performance measures (APMs), in particular those relating to EPRA reporting and sustainability key performance indicators (KPIs). has reviewed and approved the Internal Audit Budget and Annual Plan 2026, at its session of 15 December 2025, ensuring that the necessary human, technological and financial resources are available, including the hiring or use of experts for those audits in which special qualifications are required, when deemed necessary or appropriate. ‌3.3.8.- Regulatory Compliance Thg Commission's rgsponsibiliĒigs includg: To rgvigw Ēhg annual plan of acĒiviĒigs of Ēhg Criminal «nforcgmgnĒ ÐodD, as wgll as Ēhg siю-monĒhlD rgporĒ of iĒs acĒiviĒigs for subsgqugnĒ submission Ēo Ēhg Ðoard of DirgcĒors. ½gvigw, Ēhrough Ēhg InĒgrnal ConĒrol ÐodD, Ēhg CompanD's inĒgrnal policigs and procgdurgs Ēo vgrifD Ēhgir gffgcĒivgngss in prgvgnĒing mongD laundgring and ĒgrrorisĒ financing. To supgrvisg compliancg wiĒh rggulaĒorD rgquirgmgnĒs, as wgll as Ēo gsĒablish and supgrvisg a mgchanism ĒhaĒ allows gmploDggs Ēo rgporĒ, confidgnĒiallD and, if considgrgd appropriaĒg, anonDmouslD, anD poĒgnĒiallD significanĒ irrggulariĒigs, gspgciallD financial and accounĒing, ĒhaĒ ĒhgD noĒicg wiĒhin Ēhg companD. To inform Ēhg Ðoard of DirgcĒors, prior Ēo Ēhg adopĒion bD Ēhg Ðoard of DirgcĒors of Ēhg corrgsponding dgcision, on (i) Ēhg crgaĒion or acquisiĒion of shargs in spgcial purposg gnĒiĒigs or gnĒiĒigs domicilgd in counĒrigs or ĒgrriĒorigs ĒhaĒ arg considgrgd Ēaю havgns; (ii) ĒransacĒions wiĒh rglaĒgd parĒigs; (iii) Ēhg gconomic condiĒions and accounĒing impacĒ and, whgrg applicablg, on Ēhg gюchangg raĒio of Ēhg sĒrucĒural and corporaĒg modificaĒion opgraĒions ĒhaĒ Ēhg CompanD plans Ēo carrD ouĒ. ‌3.3.8.1.- Prevention of criminal risks (Criminal Compliance) During the 2025 financial year, the Commission supervised MERLIN's Crime Prevention Model, verifying its permanent updating and the maintenance of the quality certification under the UNE 19.601 Criminal Compliance Management Systems standard, obtained in 2019 and ISO 37.001 Anti-Bribery Management Systems, obtained in 2021. Likewise, the most relevant actions were the following: Update of the Criminal Risk Map, on the assessment, in terms of impact and probability, of business activities sensitive to the occurrence of a conduct typified by the Criminal Code. Supervision of the review by the Internal Audit of the specific controls implemented in the Crime Prevention Model, as well as of the action plans established and the monitoring of their evolution. Supervision of the activity of the Criminal Compliance Body (OCP), through annual and six-monthly activity reports, as well as through the attendances to the Commission. Supervision of the OCP training plan, in which the communications and training given on Compliance issues to all MERLIN workers stand out. To this end, the head of Regulatory Compliance has attended the Commission in the sessions of 17 September, 12 November and 15 December. ‌3.3.8.2.- Prevention of money laundering and terrorist financing Over the financial year 2025, the Commission has carried out various actions in the field of prevention of money laundering and terrorist financing: Review of compliance with the Anti-Money Laundering and Terrorist Financing (AML/CFT) Policy, approved by the Board of Directors in July 2019 Review and approval of the new version of the Manual for the Prevention of Money Laundering and Terrorist Financing (AML/CFT). Supervision of the actions carried out by the Company in Portugal, analysing the action plans and their implementation, for compliance with the regulations relating to AML/CFT. Review and approval of the Risk Self-Assessment Report, in accordance with RDL 11/2018, for subsequent submission to the Board of Directors for approval. Review and Approval of the Internal Control Body (OCI) Activity Report for the 2025 financial year. Analysis and review of the Half-Yearly Internal Audit Reports regarding compliance with internal procedures on the prevention of money laundering and terrorist financing, both in Spain and Portugal, and follow-up on the recommendations issued in this regard. The head of the Internal Control body attended the Commission on 20 January and 15 December 2025. ‌3.3.8.3.- Protection of personal data During the 2025 financial year, the Audit and Control Committee supervised compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council, of 27 April 2016, on the protection of natural persons with regard to the processing of their personal data. At the meeting of 20 January 2025, the Commission monitored the annual activity report of the Data Protection Officer. Subsequently, on September 17, 2025, the Commission carried out a general review of the personal data protection system, together with its advisors in the matter (KPMG Abogados, S.L.) referring, among others, to the general control framework, regulatory framework (Compliance Policy on Personal Data Protection and Privacy) and risks and controls. ‌3.3.8.4.- Internal information system - Ethics Channel MERLIN's Ethics Channel is a tool whose objective is to provide a safe, anonymous and confidential means for anyone to report any irregularity or non-compliance related to bad practices within the organization, committed in relation to the requirements that emanate from both the Code of Conduct, the responsibilities of the Company's Criminal Risk Prevention Model, and the responsibilities of the Company's Criminal Risk Prevention Model. of the values and principles of its Code of Conduct and of the legislation in force on the Criminal Liability of Legal Entities, as well as in the field of workplace harassment. MERLIN wants to be diligent in protecting whistleblowers. In this regard, MERLIN, already in 2023, outsourced the management of the Ethics Channel to BDO, S.L. to guarantee maximum confidentiality regarding the identity of the informant, as well as compliance with current legislation in the processing of communications received. Any third party that is related to MERLIN and that has reasonable indications of any Irregularity may report it to MERLIN through this Channel. MERLIN Professionals will be, in any case, obliged to report any reasonable indication of any Irregularity. During the 2025 financial year, 5 complaints have been received through the Ethics Channel, although none of them have resulted in the application of the Disciplinary System against any employee of the Group. ‌3.3.8.5.- Corporate operations In relation to the proposals for operations and operations of structural and corporate modifications and in compliance with recommendation 44 of the Code of Good Governance of listed companies, the Committee has previously taken cognizance of and has reported on these proposals, as well as, where appropriate, on the operations and corresponding documentation carried out by the Company during the year. ‌3.3.8.6.- Related-party transactions During the 2025 financial year, the Committee reviewed compliance with the provisions of current legislation and has reported on transactions that may have involved conflicts of interest and, in general, on the matters contemplated in Article 35 of the Regulations of the Board of Directors. In this regard, the Commission has analysed the outstanding balances and related-party transactions that have been submitted for pre-approval during the year, to verify that they were carried out under market conditions and with equal treatment between shareholders, submitting, where appropriate, those reported favorably, for subsequent approval. ‌3.3.8.7.- Treasury stock The Audit and Control Committee, during the 2025 financial year, as the body responsible determined by the Board of Directors, monitored treasury stock transactions, verifying compliance with MERLIN's Treasury Stock Policy, as well as the daily and global holding limits, transparency and communication of transactions in order to avoid potential risks and conflicts of interest. ‌3.3.8.8.- Improvement of policies and procedures During the 2025 financial year, the Audit and Control Committee has continued with the review of MERLIN's policies and procedures with reference to current national and international recommendations and best practices. The Commission's work during the 2025 financial year in the design and implementation of the governance of AI-based solutions is highlighted, through the Policy on the Responsible Use of Artificial Intelligence , approved by the Board of Directors on 18 December 2025. ‌4.- CONCLUSIONS‌ As reflected in this Activity Report, during the 2025 financial year the Audit and Control Committee has satisfactorily addressed the analysis of the main issues within its competence, reporting on a timely, recurring and periodic basis to the Board of Directors of MERLIN. In this regard, the Commission, during the financial year 2025, has: Reviewed the clarity and completeness of all the Financial Information and Sustainability Information , as well as supervised its preparation process, which the Company has published during the year, such as the annual and quarterly financial statements, the Statement of Non-Financial Information, the management reports and the annual corporate governance report. Reported to the Board of Directors on the Audit of Accounts and Verification of Sustainability Information carried out in relation to the year ended December 31, 2024, as well as the limited and preliminary reviews carried out by the external auditor in relation to the financial information for the first half of the year and preliminary to the end required of the Company during the 2025 financial year. Supervised the application of the Internal Control Policy , reviewing the Company's internal control and risk management systems and, in particular, the correct design and operation of the internal control and financial information management system (ICFRS) and sustainability information (ICIS), so that the main risks are identified. manage and make themselves known properly. Supervised the recruitment and rotation process of external valuers , carried out by the Company's management, ensuring the application of the rotation policy and the identification of possible conflicts of interest and threats to independence that may question their suitability. Reviewed that the methodology and assumptions used by the external valuers are in accordance with International Accounting Standards (IFRS). Supervised the result of the work carried out by the external auditor in relation to the valuations of the Company's assets. Supervised the implementation of the Risk Control and Management Policy , analysing the different types of risk faced by the Company, including financial or economic risks, operational, environmental, technological, legal, fiscal, social, political and reputational risks, as well as contingent liabilities and other off-balance sheet risks. Assessed the list of the most significant financial and non-financial risks and the level of tolerance established for each one, based on information provided by management and the head of the internal audit department. Supervised compliance with the Tax Policy , reviewing the tax policies applied during the year, before formulating the annual accounts and filing the Corporate Income Tax. Supervised the application of the Criminal Compliance Policy , reviewing the annual plan of activities of the Criminal Compliance Body, as well as the half-yearly reports of its activities, including the Company's Criminal Risk Map, being permanently informed of any relevant issue related to regulatory compliance and the prevention and correction of illegal or fraudulent conduct. As well as, supervising the process of renewal of the quality certification under the UNE 19.601 and ISO 37.001 standards. Supervised the implementation of the Policy for the Prevention of Money Laundering and Terrorist Financing , reviewing, through the Internal Control Body, the Company's internal policies and procedures to verify their effectiveness in the prevention of money laundering and terrorist financing, ensuring that the policies and procedures applied are effective in strict compliance with current legislation and in the promotion of the highest ethical standards. Promoted the improvement of the corporate governance system, through the supervision of the governance model for the use of Artificial Intelligence systems, through the Policy for the Responsible Use of Artificial Intelligence , approved by the Board of Directors in December 2025. Supervised the execution of the Internal Audit work within the framework of the internal control systems and in accordance with the 2025 Annual Plan of Activities approved at the meeting of December 18, 2024, monitoring the compliance of the Company's management with its recommendations. It is for all these reasons that the Audit and Control Committee concludes that during the 2025 financial year, it has carried out its activities in a satisfactory manner in compliance with current legislation, the functions established in its regulations and in accordance with the best Corporate Governance practices in the market. ‌5.- WORK PLAN FOR 2026‌ The Commission's action plan for the financial year 2026 will have an impact on continuing with the functions and powers of the Commission, set out in the regulations in force and in the specific Regulations of the Audit and Control Committee, and mentioned in section 2 of this report. Therefore, the Commission has approved a work plan in which it has included the specific actions that it proposes to undertake at each of the time periods of the year; To report, where appropriate, to the General Shareholders' Meeting on the issues that arise in relation to those matters that are within their competence and, in particular, on how its actions have contributed to safeguarding the integrity of the financial and sustainability information of the MERLIN Group. To continue and strengthen the practice followed by the Commission in the fulfilment of its functions of supervision of the financial and sustainability reporting process, the risk control and management systems, with particular attention to the ICFR and the ICRIS , legal and regulatory compliance, as well as the supervision of the external audit of accounts, the property valuation services and the Internal Audit department. Supervise compliance with sustainability information reporting under a robust and effective internal control framework, in accordance with the best market practices. Continue with the supervision of activities and advances in the topics of Artificial Intelligence, Cybersecurity and Information Technology Controls . Maintain the training of the members of the Commission , including a plan with training sessions throughout the year with the participation of external specialists in the aspects deemed necessary. ****** This Activity Report has been approved by the Audit and Control Committee at its meeting on 15 December 2025, and by the Board of Directors at its meeting in February 2026.

View stock analysis, news, and events for Merlin Properties Socimi, S.a.