Independent practitioner’s assurance report to the Board of Directors of Commercial Bank of Ceylon PLC on the SLFRS Sustainability-related Financial Disclosures presented in the Integrated Annual Report 2025

Scope

We have been engaged by Commercial Bank of Ceylon PLC to perform a ‘limited assurance engagement,’ as defined by Sri Lanka Standards on Assurance Engagements, here after referred to as the engagement, to report on Commercial Bank of Ceylon PLC’s SLFRS Sustainability-related Financial Disclosures (the “Subject Matter”) contained in Commercial Bank of Ceylon PLC’s (the “Company’s”) Integrated Annual Report in SLFRS Sustainability-related Financial Disclosures for the year ended December 31, 2025 (the “Report”).

Other than as described in the preceding paragraph, which sets out the scope of our engagement, we did not perform assurance procedures on the remaining information included in the Report, and accordingly, we do not express a conclusion on this information.

Criteria applied by Commercial Bank of Ceylon PLC

In preparing the SLFRS Sustainability-related Financial Information, Commercial Bank of Ceylon PLC applied the Sri Lanka Sustainability Disclosure Standards, SLFRS S1 – General Requirements for Disclosure of Sustainability-related Financial Information and SLFRS S2 – Climate-related Disclosures (Criteria). Such Criteria were specifically designed for the disclosure of material information on climate-related risks and opportunities that is useful to primary users of general-purpose financial reports in making decisions relating to providing resources to the entity; As a result, the subject matter information may not be suitable for another purpose.

Commercial Bank of Ceylon PLC’s responsibilities

Commercial Bank of Ceylon PLC’s management is responsible for selecting the Criteria, and for presenting the SLFRS Sustainability-related Financial Disclosures in accordance with that Criteria, in all material respects. This responsibility includes establishing and maintaining internal controls, maintaining adequate records and making estimates that are relevant to the preparation of the subject matter, such that it is free from material misstatement, whether due to fraud or error.

Ernst & Young’s responsibilities

Our responsibility is to express a conclusion on the presentation of the Subject Matter based on the evidence we have obtained.

We conducted our engagement in accordance with the Sri Lanka Standard for Assurance Engagements Other Than Audits or Reviews of Historical Financial Information [SLSAE 3000 (Revised)], and the terms of reference for this engagement as agreed with Commercial Bank of Ceylon PLC December 18, 2025. Those standards require that we plan and perform our engagement to express a conclusion on whether we are aware of any material modifications that need to be made to the Subject Matter in order for it to be in accordance with the Criteria, and to issue a report. The nature, timing, and extent of the procedures selected depend on our judgment, including an assessment of the risk of material misstatement, whether due to fraud or error.

We believe that the evidence obtained is sufficient and appropriate to provide a basis for our limited assurance conclusions.

Our independence and quality management

We have maintained our independence and confirm that we have met the requirements of the Code of Ethics for Professional Accountants issued by the Institute of Chartered Accountants of Sri Lanka (CA Sri Lanka) and have the required competencies and experience to conduct this assurance engagement.

EY also applies quality management standards which require that we design, implement and operate a system of quality management including policies or procedures regarding compliance with ethical requirements, professional standards and applicable legal and regulatory requirements.

Description of procedures performed

Procedures performed in a limited assurance engagement vary in nature and timing from and are less in extent than for a reasonable assurance engagement. Consequently, the

level of assurance obtained in a limited assurance engagement is substantially lower than the assurance that would have been obtained had a reasonable assurance engagement been performed. Our procedures were designed to obtain a limited level of assurance on which to base our conclusion and do not provide all the evidence that would be required to provide a reasonable level of assurance.

Although we considered the effectiveness of management’s internal controls when determining the nature and extent of our procedures, our assurance engagement was not designed to provide assurance on internal controls. Our procedures did not include testing controls or performing procedures relating to checking aggregation or calculation of data within IT systems.

A limited assurance engagement consists of making enquiries, primarily of people responsible for preparing the Subject Matter and related information and applying analytical and other appropriate procedures.

Our procedures included:

• Conducted interviews with selected key management personnel and relevant staff to understand the business, value chain and sustainability reporting process of the Company.
• Undertook analytical procedures of the data and made inquiries of management to obtain explanations for any significant differences we identified.
• Performed procedures to understand the Company’s disclosures in relation to the Conceptual Foundation of SLFRS S1, including fair presentation, materiality, reporting entity, and connected information.
• Conducted procedures to understand the governance processes, controls and procedures employed by the Company to monitor, manage and oversee climate-related risks and opportunities, supported by relevant evidence.
• Perused the minutes of the Board of Directors and Board Audit Committee meetings from the financial year to ensure alignment with the content of governance-related disclosures.
• Conducted procedures to comprehend the Company’s strategy for managing identified climate-related risks and opportunities, supported by relevant evidence and calculations.
• Performed analytical procedures to obtain explanations and supporting evidence regarding the Company’s processes for identifying, assessing, prioritising, and monitoring climate-related risks and opportunities, including their integration into the overall risk management framework.
• Conducted analytical procedures to gather explanations and supporting evidence to evaluate the Company’s performance in relation to its identified climate-related risks and opportunities, including progress towards any targets the Company has set.
• Performed procedures to assess the Company’s disclosures and compliance with the General Requirements of SLFRS S1.
• Conducted procedures to evaluate the disclosures regarding judgments and uncertainties in the process of preparing the Company’s sustainability-related financial disclosures.

We also performed such other procedures as we considered necessary in the circumstances.

Emphasis of matter

There are inherent limitations in the identification, measurement and disclosure of underlying Subject Matter against the applicable Criteria due to forward looking information, uncertainties and management judgements. For clarity, our engagement does not extend to providing assurance on the accuracy or achievability of these forward-looking information, uncertainties and management judgements.

Conclusion

Based on our procedures and the evidence obtained, we are not aware of any material modifications that should be made to SLFRS Sustainability-related Financial Disclosures for the year ended December 31, 2025, in order for it to be in accordance with the Criteria.

Restricted use

This report is intended solely for the information and use of Commercial Bank of Ceylon PLC for the purpose of providing an assurance conclusion on the Subject Matter based on the Criteria and is not intended to be and should not be used by anyone other than those specified parties.

Chartered Accountants
February 27, 2026

Colombo