Annex 6: Independent Assurance Reports

Independent Assurance Report to the Directors of Commercial Bank of Ceylon PLC

We have been engaged by the Directors of Commercial Bank of Ceylon PLC (“the Bank”) to provide reasonable assurance and limited assurance in respect of the Sustainability Indicators as identified below for the year ended December 31, 2024. The Sustainability Indicators are included in the Commercial Bank of Ceylon PLC Integrated Annual Report for the year ended December 31, 2024 (the “Report”).

The Reasonable Assurance Sustainability Indicators covered by our reasonable assurance engagement are:

The Limited Assurance Sustainability Indicators covered by our limited assurance engagement are:

Our conclusions

Our conclusion has been formed on the basis of, and is subject to, the matters outlined in this report. We believe that the evidence we have obtained is sufficient and appropriate to provide a basis for our conclusions.

Reasonable Assurance Sustainability Indicators

In our opinion, in all material respects, the Reasonable Assurance Sustainability Indicators, as defined above, for the year ended December 31, 2024, in all material respects, has been prepared and presented by the management of Commercial Bank of Ceylon PLC in accordance with the Consolidated Set of Global Reporting Initiative Sustainability Reporting Standards.

Limited Assurance Sustainability Indicators

Based on the evidence we obtained from the assurance procedures performed, as described below we are not aware of any material misstatements that causes us to believe that the Limited Assurance Sustainability Indicators, as defined above, for the year ended December 31, 2024, have not in all material respects, been prepared and presented by the management of Commercial Bank of Ceylon PLC in accordance with the Consolidated Set of Global Reporting Initiative Sustainability Reporting Standards.

Management's Responsibility

Management is responsible for the preparation and presentation of the Reasonable Assurance Sustainability Indicators and the Limited Assurance Sustainability Indicators in accordance with the Consolidated Set of Global Reporting Initiative Sustainability Reporting Standards.

These responsibilities include establishing such internal controls as management determines are necessary to enable the preparation of the Reasonable Assurance Sustainability Indicators and the Limited Assurance Sustainability Indicators that are free from material misstatement whether due to fraud or error.

Management is responsible for preventing and detecting fraud and for identifying and ensuring that the Bank complies with laws and regulations applicable to its activities.

Management is also responsible for ensuring that staff involved with the preparation and presentation of the description and Report are properly trained, information systems are properly updated and that any changes in reporting encompass all significant business units.

Our responsibility

Our responsibility is to express a reasonable assurance conclusion on the Bank’s preparation and presentation of the Reasonable Assurance Sustainability Indicators and a limited assurance conclusion on the preparation and presentation of the Limited Assurance Sustainability Indicators included in the Report, as defined above.

We conducted our assurance engagement in accordance with Sri Lanka Standard on Assurance Engagements SLSAE 3000: Assurance Engagements other than Audits or Reviews of Historical Financial Information (SLSAE 3000) issued by the Institute of Chartered Accountants of Sri Lanka.

We have complied with the independence and other ethical requirements of the Code of Ethics for professional Accountants issued by CA Sri Lanka (Code of Ethics).

SLSAE 3000 requires that we plan and perform the engagement to obtain reasonable assurance about whether the Reasonable Assurance Sustainability Indicators are free from material misstatement and limited assurance about whether the Limited Assurance Sustainability Indicators are free from material misstatement.

Our firm applies Sri Lanka Standard on Quality Control (SLSQC) 1, which requires the firm to design, implement and operate a system of quality management including policies or procedures regarding compliance with ethical requirements, professional standards and applicable legal and regulatory requirements.

Reasonable assurance over Reasonable Assurance Sustainability Indicators

The procedures selected in our reasonable assurance engagement depend on our judgment, including the assessment of the risks of material misstatement of the Reasonable Assurance Sustainability Indicators whether due to fraud or error.

In making those risk assessments, we have considered internal controls relevant to the preparation and presentation of the Reasonable Assurance Sustainability Indicators in order to design assurance procedures that are appropriate in the circumstances, but not for the purposes of expressing a conclusion as to the effectiveness of the Bank's internal controls over the preparation and presentation of the Report.

Our engagement also included assessing the appropriateness of the Reasonable Assurance Sustainability Indicators, the suitability of the criteria, being the Consolidated Set of Global Reporting Initiative Sustainability Reporting Standards, used by the Bank in preparing and presenting the Reasonable Assurance Sustainability Indicators within the Report, obtaining an understanding of the compilation of the financial information to the sources from which it was obtained, evaluating the reasonableness of estimates made by the Bank, and re-computation of the calculations of the Reasonable Assurance Sustainability Indicators.

Limited assurance on the Sustainability Indicators

Our limited assurance engagement on the Limited Assurance Sustainability Indicators consisted of making enquiries, primarily of persons responsible for the preparation of the Limited Assurance Sustainability Indicators, and applying analytical and other procedures, as appropriate. These procedures included:

• interviews with senior management and relevant staff at corporate and selected site level concerning sustainability strategy and policies for material issues, and the implementation of these across the business;
• enquiries of management to gain an understanding of the Bank’s processes for determining material issues for the Bank’s key stakeholder groups;
• enquiries of relevant staff at corporate and selected site level responsible for the preparation of the Limited Assurance Sustainability Indicators;
• enquiries about the design and implementation of the systems and methods used to collect and report the Limited Assurance Sustainability Indicators, including the aggregation of the reported information;
• comparing the Limited Assurance Sustainability Indicators to relevant underlying sources on a sample basis to determine whether all the relevant information has been appropriately included in the Report;
• reading the Limited Assurance Sustainability Indicators presented in the Report to determine whether they are in line with our overall knowledge of, and experience with, the sustainability performance of the Bank;
• reading the remainder of the Report to determine whether there are any material misstatements of fact or material inconsistencies based on our understanding obtained as part of our assurance engagement.

The procedures performed in a limited assurance engagement vary in nature and timing from, and are less in extent than for, a reasonable assurance engagement, and consequently the level of assurance obtained in a limited assurance engagement is substantially lower than the assurance that would have been obtained had a reasonable assurance engagement been performed. Accordingly, we do not express a reasonable assurance conclusion on the Limited Assurance Sustainability Indicators.

Purpose of our report

In accordance with the terms of our engagement, this assurance report has been prepared for the Bank for the purpose of assisting the Directors in determining whether the Bank's Reasonable and Limited Assurance Sustainability Indicators are prepared and presented in accordance with the Consolidated Set of Global Reporting Initiative Sustainability Reporting Standards and for no other purpose or in any other context.

Restriction of use of our report

This report has been prepared for the Directors of Commercial Bank of Ceylon PLC for the purpose of providing an assurance conclusion on the Reasonable Assurance Sustainability Indicators and the Limited Assurance Sustainability Indicators included in the Commercial Bank of Ceylon PLC Integrated Annual Report for the year ended December 31, 2024 and may not be suitable for another purpose. We disclaim any assumption of responsibility for any reliance on this report, to any person other than the Directors of Commercial Bank of Ceylon PLC, or for any other purpose than that for which it was prepared.

Chartered Accountants
March 04, 2025

Colombo

Independent Limited Assurance Report to the Directors Of Commercial Bank of Ceylon PLC

We have been engaged by the Directors of Commercial Bank of Ceylon (“the Bank”) to provide limited assurance in respect of the Integrated Report for the year ended Commercial Bank of Ceylon (the "Integrated Report"). The criteria used as a basis of reporting is the content elements of the IFRS Foundation's International <IR> Framework as disclosed in this Integrated Report.

Basis for Conclusion

We conducted our work in accordance with the Sri Lankan Standard on Assurance Engagements SLSAE 3000 (Standard). In accordance with the Standard, we have:

• used our professional judgement to plan and perform the engagement to obtain limited assurance that we are not aware
  of any material misstatements in the Bank’s Integrated Report, whether due to fraud
  or error;
• considered relevant internal controls when designing our assurance procedures, however we do not express a conclusion on their effectiveness; and
• Ensured that the engagement team possess the appropriate knowledge, skills and professional competencies.

Our Conclusion

Our conclusion has been formed on the basis of, and is subject to, the matters outlined in this report. We believe that the evidence we have obtained is sufficient and appropriate to provide a basis for our conclusions.

We have not been engaged to provide an assurance conclusion on the fitness for purpose or the operating effectiveness of the Bank’s strategy or how the Bank creates value, including the governance, strategic management and other key business processes. The procedures we have performed in relation to the Bank’s strategy and how the Bank creates value are outlined below.

Limited Assurance Integrated Report

Based on the evidence we obtained from the assurance procedures performed, as described below, we are not aware of any material misstatements causes us to believe that the Integrated Report, as defined above, for the year ended December 31, 2024, has not in all material respects, been prepared in accordance with the Content Elements of the IFRS Foundation's International <IR> Framework.

Board of Directors and Management's responsibility

The Board of Directors and Management are responsible for:

• Determining that the criteria is appropriate to meet the needs of intended users, being the Bank’s members and any other intended users.
• Preparing and presenting of the Report in accordance with the criteria set out in the IFRS Foundation's International <IR> Framework. This includes disclosing the criteria, including any significant inherent limitations.
• Ensuring the Bank’s strategy is well­ presented in the Bank’s Integrated Report and reflects how the Bank creates value as they operate in practice
• Identifying stakeholders and stakeholder requirements;
• Identifying material issues and reflecting those in the Bank’s Integrated Report; and
• Preparation and fair presentation of the Integrated reporting information; Design and implementation of internal controls that the Bank determines necessary to enable the preparation and presentation of the Integrated Report that is free from material misstatement, whether due to fraud or error.
• Informing us of any known and/or contentious issues relating to the Integrated Report.
• Preventing and detecting of fraud and for identifying and ensuring that the Bank complies with laws and regulations applicable to its activities;
• Process to ensure that the Bank personnel involved with the preparation and presentation of the integrated reporting information are properly trained, systems are properly updated and that any changes in reporting is relevant to the integrated report information encompass all significant business units. This responsibility also includes informing us of any changes in the Bank’s operations.
• The responsibility also includes informing changes in the Bank’s Operations since the date of our most recent assurance report on the Integrated reporting information.

Our responsibility

Our responsibility is to perform an external assurance engagement in relation to the Integrated Report and to issue an assurance report that includes our conclusions.

We conducted our assurance engagement in accordance with Sri Lanka Standard on Assurance Engagements SLSAE 3000: Assurance Engagements other than Audits or Reviews of Historical Financial Information (SLSAE 3000) issued by the Institute of Chartered Accountants of Sri Lanka.

We have complied with the independence and other ethical requirements of the Code of Ethics issued by the Institute of Chartered Accountants of Sri Lanka.

SLSAE 3000 requires that we plan and perform the engagement to obtain limited assurance about whether the Integrated Report is free from material misstatement.

Our firm applies Sri Lanka Standard on Quality Management (SLSQM) 1, which requires the firm to design, implement and operate a system of quality management including policies or procedures regarding compliance with ethical requirements, professional standards and applicable legal and regulatory requirements.

Limited assurance on the Integrated Report

Our limited assurance engagement on the Integrated Report consisted of making enquiries, primarily of persons responsible for the preparation of the Integrated Report, and applying analytical and other procedures, as appropriate. These procedures included:

• Interviews with executives, senior management and relevant staff to understand the internal controls, governance structure and reporting process relevant to the Report;
• Reviewing of the relevant internal policies and procedures developed by the Bank, including those relevant to determining what matters most to the Bank’s stakeholders, how the Bank creates value, the Bank’s external environment, strategy, governance and reporting.
• Reviewing the description of the Bank’s strategy and how the Bank creates value in the Report and enquiring of management as to whether the description accurately reflects their understanding;
• Assessing of the suitability and application of the Content Elements of the IFRS Foundation's International <IR> Framework in the Report;
• Assessing of the alignment between the Bank’s strategy, the disclosures on how the Bank creates value and what matters most to the Bank’s stakeholders.
• Reviewing Board minutes to ensure consistency with the content of the Report.
• Reviewing the Report in its entirety to ensure it is consistent with our overall knowledge obtained during the assurance engagement.
• Obtaining a letter of representation from management dated March 04, 2025 on the content of the Bank’s Integrated Report.

The procedures performed in a limited assurance engagement vary in nature and timing from, and are less in extent than for, a reasonable assurance engagement, and consequently the level of assurance obtained in a limited assurance engagement is substantially lower than the assurance that would have been obtained had a reasonable assurance engagement been performed. Accordingly, we do not express a reasonable assurance conclusion on the Integrated Report.

Misstatements, including omissions, are considered material if, individually or in the aggregate, they could reasonably be expected to influence relevant decisions of the Bank.

Limitations of our review

The Integrated Report includes prospective information. Inherent to prospective information, the actual future results are uncertain. We do not provide any assurance on the assumptions and achievability of prospective information in the Integrated Report.

Purpose of our report

In accordance with the terms of our engagement, this assurance report has been prepared for the Bank for the purpose of assisting the Directors in determining whether the Bank's Integrated Report is prepared in accordance with the IFRS Foundation's International <IR> Framework and for no other purpose or in any other context.

Restriction of use of our report

This report has been prepared for the Bank for the purpose of providing an assurance conclusion on the Integrated Report and may not be suitable for another purpose. We disclaim any assumption of responsibility for any reliance on this report, to any person other than the Bank, or for any other purpose than that for which it was prepared.

Our report should not be regarded as suitable to be used or relied on by any party wishing to acquire rights against us other than the Bank, for any purpose or in any other context. Any party other than the Bank who obtains access to our report or a copy thereof and chooses to rely on our report (or any part thereof) will do so at its own risk. To the fullest extent permitted by law, we accept or assume no responsibility and deny any liability to any party other than the Bank for our work, for this independent assurance report, or for the conclusions we have reached.

Chartered Accountants
March 04, 2025

Colombo