Annex 7: Independent Assurance Reports

Conclusion

We have performed a limited assurance engagement on whether the Content Elements (“Subject matter Information” or “SMI”) in Commercial Bank of Ceylon PLC’s (“the Bank”) Integrated annual report for the year ended December 31, 2025 have been prepared in accordance to the IFRS Foundation’s International<IR> Framework (“Criteria”).

Based on the procedures performed and evidence obtained, nothing has come to our attention to cause us to believe that the Content Elements in the Integrated Report of Commercial Bank of Ceylon PLC for the year ended December 31, 2025 are not prepared, in all material respects, in accordance with the Criteria.

Our conclusion on the SMI as mentioned above does not extend to other information that accompanies or contains the SMI and our assurance report.

Basis for conclusion

We conducted our engagement in accordance with Sri Lanka Standard on Assurance Engagements (SLSAE) 3000 (Revised), Assurance Engagements Other Than Audits or Reviews of Historical Financial Information issued by the Institute of Chartered Accountants of Sri Lanka. Our responsibilities under this standard are further described in the “Our responsibilities” section of our report.

We have complied with the independence and other ethical requirements of the Code of Ethics for professional Accountants issued by CA Sri Lanka (Code of Ethics).

Our firm applies Sri Lanka Standard on Quality Management (SLSQM) 1, which requires the firm to design, implement and operate a system of quality management including policies or procedures regarding compliance with ethical requirements, professional standards and applicable legal and regulatory requirements.

We believe that the evidence we have obtained is sufficient and appropriate to provide a basis for limited assurance conclusion.

Intended use or purpose

We have been engaged by the Board of Directors of Commercial Bank of Ceylon PLC to provide limited assurance on whether the SMI have been prepared in accordance with the Criteria.

Restriction on use or distribution

This report has been prepared for the Board of Directors of Commercial Bank of Ceylon PLC for the purpose of providing an assurance conclusion on whether the SMI in the Commercial Bank of Ceylon PLC’s Integrated Annual Report for the Year ended December 31, 2025 has been prepared in accordance with the Criteria and may not be suitable for another purpose. We disclaim any assumption of responsibility for any reliance on this report, to any person other than Commercial Bank of Ceylon PLC, or for any other purpose than that for which it was prepared.

Our report should not be regarded as suitable to be used or relied on by any party wishing to acquire rights against us other than Commercial Bank of Ceylon PLC, for any purpose or in any other context. Any party other than Commercial Bank of Ceylon PLC who obtains access to our report or a copy thereof and chooses to rely on our report (or any part thereof) will do so at its own risk. To the fullest extent permitted by law, we accept or assume no responsibility and deny any liability to any party other than Commercial Bank of Ceylon PLC for our work, for this independent assurance report, or for the conclusions we have reached.

Our conclusion is not modified in respect of this matter.

Responsibilities of Management for the SMI.

• Selecting or developing suitable criteria for preparing the Subject Matter Information and appropriately referring to or describing the criteria
• Determining that the criteria is appropriate to meet the needs of intended users, being the Bank’s Board Directors and any other intended users.
• Preparing and presenting the SMI in accordance with the criteria set out in the IFRS Foundation’s International<IR> Framework. This includes disclosing the criteria, including any significant inherent limitations.
• Design and implementation of internal controls that the Bank determines necessary to enable the preparation and presentation of the SMI that is free from material misstatement, whether due to fraud or error.
• Ensuring the Bank’s strategy is well- presented in the SMI and reflects how the Bank creates value as they operate in practice
• Identifying stakeholders and stakeholder requirements;
• Identifying material issues and reflecting those in the SMI; and
• Preparation and fair presentation of the SMI;
• Informing us of any known and/or contentious issues relating to the SMI.
• Preventing and detecting of fraud and ensuring that the Bank complies with laws and regulations applicable to its activities;
• Process to ensure that the Bank’s personnel involved with the preparation and presentation of the SMI are properly trained, systems are properly updated and that any changes in reporting is relevant to SMI encompass all significant business units.
• The responsibility also includes informing changes in the Bank’s Operations since the date of our most recent assurance report on the SMI.
• The maintenance and integrity of Commercial Bank of Ceylon PLC’s website, including the presentation of our independent limited assurance report on the website is the responsibility of the Commercial Bank of Ceylon PLC’s management. Management is responsible for any changes to either the information in the Report or our independent limited assurance report that may have occurred since the initial date of its presentation on Commercial Bank of Ceylon PLC’s website.

Those charged with governance are responsible for overseeing the reporting process for the Bank’s SMI.

Inherent limitations
The preparation of SMI is subject to inherent limitations arising from the nature of non-financial data, including the use of estimates, assumptions, and third-party information. In addition, due to the inherent limitations of any internal control system, errors or irregularities may occur and not be detected. Our engagement was not designed to detect internal control weaknesses because the procedures were performed on a test basis and not continuously throughout the period. We do not provide any assurance on the assumptions and achievability of prospective information in the Integrated Report

Our responsibilities

We are responsible for:

• planning and performing the engagement to obtain limited assurance about whether the SMI is free from material misstatement, whether due to fraud or error;
• forming an independent conclusion, based on the procedures we have performed and the evidence we have obtained; and
• reporting our conclusion to the Board of Directors of Commercial Bank of Ceylon PLC.

Summary of the work we performed as the basis for our conclusion

We exercised professional judgment and maintained professional skepticism throughout the engagement. We designed and performed our procedures to obtain evidence about the SMI that is sufficient and appropriate to provide a basis for our limited assurance conclusion.

Our procedures selected depended on our understanding of the SMI , other engagement circumstances, and our consideration of areas where material misstatements are likely to arise. In carrying out our engagement, the procedures we performed primarily consisted of:

• Assessing the suitability of the criteria used by the Bank in preparing SMI;
• Through inquiries, obtained an understanding of the Bank’s control environment, processes and information systems relevant to the preparation of the Information subject to Limited Assurance, but did not evaluate the design of particular control activities, obtain evidence about their implementation or test their operating effectiveness;
• Obtaining an understanding of the relevant internal policies and procedures developed by the Bank, including those relevant to determining what matters most to the Bank’s stakeholders, how the Bank creates value, the Bank’s external environment, strategy, governance and reporting.
• Obtaining an understanding of the description of the Bank’s strategy and how the Bank creates value in the SMI and enquiring of management as to whether the description accurately reflects their understanding;
• Assessing of the alignment between the Bank’s strategy, the disclosures on how the Bank creates value and what matters most to the Bank’s stakeholders.
• Checking Board minutes to ensure consistency with the SMI.
• Evaluated the overall presentation of the Information subject to Limited Assurance to determine whether it is consistent with the criteria and in line with our overall knowledge of, and experience with, the Bank’s processes.

The procedures performed in a limited assurance engagement vary in nature and timing from, and are less in extent than for, a reasonable assurance engagement. Consequently, the level of assurance obtained in a limited assurance engagement is substantially lower than the assurance that would have been obtained had a reasonable assurance engagement been performed.

Chartered Accountants
February 26, 2026
Colombo

Conclusion

We have performed a limited assurance engagement on whether the selected sustainability related indicators as defined in annexure A (“Subject matter Information” or “SMI”) in Commercial Bank of Ceylon PLC’s (“the Bank”) Integrated annual report for the year ended December 31, 2025 have been prepared with reference to the selected Global Reporting Initiative Standards 2021 as mentioned in Annexure A (“Criteria”).

Based on the procedures performed and evidence obtained, nothing has come to our attention to cause us to believe that the selected sustainability related indicators as defined in annexure A of Commercial Bank of Ceylon PLC for the year ended December 31, 2025 are not prepared, in all material respects, with reference to the Criteria.

The SMI subject to our limited assurance engagement are listed in Annexure A. The assured sustainability information is underlined and marked with “LA” in the Integrated Annual Report, and the corresponding GRI indicators are also provided in Annexure A. Our conclusion on the SMI as defined in annexure A does not extend to other information that accompanies or contains the SMI as defined in annexure A and our assurance report.

Basis for conclusion

We conducted our engagement in accordance with Sri Lanka Standard on Assurance Engagements (SLSAE) 3000 (Revised), Assurance Engagements Other Than Audits or Reviews of Historical Financial Information issued by the Institute of Chartered Accountants of Sri Lanka. Our responsibilities under this standard are further described in the “Our responsibilities” section of our report.

We have complied with the independence and other ethical requirements of the Code of Ethics for professional Accountants issued by CA Sri Lanka (Code of Ethics).

Our firm applies Sri Lanka Standard on Quality Management (SLSQM) 1, which requires the firm to design, implement and operate a system of quality management including policies or procedures regarding compliance with ethical requirements, professional standards and applicable legal and regulatory requirements.

We believe that the evidence we have obtained is sufficient and appropriate to provide a basis for limited assurance conclusion.

Intended use or purpose

We have been engaged by the Management of Commercial Bank of Ceylon PLC to provide limited assurance on whether the selected SMI as defined in annexure A have been prepared with reference to the Criteria

Restriction on use or distribution

This report has been prepared for the Board of Directors of Commercial Bank of Ceylon PLC for the purpose of providing an assurance conclusion on whether the selected SMI in the Commercial Bank of Ceylon PLC’s Integrated Annual Report for the Year ended December 31, 2025 has been prepared with reference to the Criteria and may not be suitable for another purpose. We disclaim any assumption of responsibility for any reliance on this report, to any person other than Commercial Bank of Ceylon PLC, or for any other purpose than that for which it was prepared.

Our report should not be regarded as suitable to be used or relied on by any party wishing to acquire rights against us other than the Commercial Bank of Ceylon PLC, for any purpose or in any other context. Any party other than Commercial Bank of Ceylon PLC who obtains access to our report or a copy thereof and chooses to rely on our report (or any part thereof) will do so at its own risk. To the fullest extent permitted by law, we accept or assume no responsibility and deny any liability to any party other than Commercial Bank of Ceylon PLC for our work, for this independent assurance report, or for the conclusions we have reached.

Our conclusion is not modified in respect of this matter.

Responsibilities of Management for the SMI.

• Designing, implementing and maintaining internal control relevant to the preparation of the Subject Matter Information that is free from material misstatement, whether due to fraud or error.
• Selecting or developing suitable criteria for preparing the Subject Matter Information and appropriately referring to or describing the criteria
• Preventing and detecting fraud and ensuring the Bank’s compliance with applicable laws and regulations to its activities.
• Ensuring that staff involved in preparation and presentation of the description and Report are properly trained, information systems are properly updated and that any changes in reporting encompass all significant business units; and
• Preparing the Subject Matter Information with reference to the criteria
• The maintenance and integrity of Commercial Bank of Ceylon PLC’s website, including the presentation of our independent limited assurance report on the website is the responsibility of the Commercial Bank of Ceylon PLC’s management. Management is responsible for any changes to either the information in the Report or our independent limited assurance report that may have occurred since the initial date of its presentation on Commercial Bank of Ceylon PLC’s website.

Those charged with governance are responsible for overseeing the reporting process for the Bank’s SMI.

Inherent limitations

The preparation of SMI is subject to inherent limitations arising from the nature of non-financial data, including the use of estimates, assumptions, and third-party information. In addition, due to the inherent limitations of any internal control system, errors or irregularities may occur and not be detected. Our engagement was not designed to detect internal control weaknesses because the procedures were performed on a test basis and not continuously throughout the period.

Our responsibilities

We are responsible for:

• planning and performing the engagement to obtain limited assurance about whether the SMI is free from material misstatement, whether due to fraud or error;
• forming an independent conclusion, based on the procedures we have performed and the evidence we have obtained;
• reporting our conclusion to the Board of Directors of Commercial Bank of Ceylon PLC.

Summary of the work we performed as the basis for our conclusion

We exercised professional judgment and maintained professional skepticism throughout the engagement. We designed and performed our procedures to obtain evidence about the SMI that is sufficient and appropriate to provide a basis for our limited assurance conclusion.

Our procedures selected depended on our understanding of the SMI, other engagement circumstances, and our consideration of areas where material misstatements are likely to arise. In carrying out our engagement, the procedures we performed primarily consisted of:

• interviewed senior management and relevant staff at corporate and selected site level concerning sustainability strategy and policies for material issues, and the implementation of these across the business;
• enquired management to gain an understanding of the Bank’s processes for determining material issues for the Bank’s key stakeholder groups;
• enquired relevant staff at corporate and selected site level responsible for the preparation of the SMI in the Integrated Annual Report of Commercial Bank of Ceylon PLC for the year ended December 31, 2025;
• enquired about the design and implementation of the systems and methods used to collect and report the SMI in the Integrated Annual Report of the Commercial Bank of Ceylon PLC for the year ended December 31, 2025, including the aggregation of the reported information;
• applied analytical procedures, as appropriate;
• compared the SMI in the Integrated Annual Report of Commercial Bank of Ceylon PLC for the year ended December 31, 2025 to relevant underlying sources on a sample basis to determine whether all the relevant information has been appropriately included in the Report;
• recalculated the Information subject to Limited Assurance based on the criteria;
• read the SMI in the Integrated Annual Report of Commercial Bank of Ceylon PLC for the year ended December 31, 2025 presented in the Report to determine whether they are in line with our overall knowledge of, and experience with, the sustainability performance of the Bank; and
• read the remainder of the Report to determine whether there are any material misstatements of fact or material inconsistencies based on our understanding obtained as part of our assurance engagement.

The procedures performed in a limited assurance engagement vary in nature and timing from, and are less in extent than for, a reasonable assurance engagement. Consequently, the level of assurance obtained in a limited assurance engagement is substantially lower than the assurance that would have been obtained had a reasonable assurance engagement been performed.

Chartered Accountants
February 26, 2026
Colombo