During 2022, there were seven sessions: January 24, February 23, March 28, April 25, June 13, July 18 and September 1.

Some of its core functions include:

• Proposing internal and external auditors.
• Ensuring the Chief Executive Officer complies with the agreements reached at the Meetings.
• Supporting the Board in the drafting of the annual report to be presented at the Meeting.
• Providing opinions to the Board of Directors regarding requests for information required for the decision-making process.
• Informing the Board of any relevant irregularities that have been detected, and, if necessary, inform the Board of any corrective measures employed, ensuring that the management implements said measures.
• Reviewing the annual budget and proposing it be presented to the Board for its subsequent approval.
• Implementing measures based on the conclusions and recommendations of Internal and External Auditing.

During 2022, there were seven sessions: January 20, April 7, May 19, June 2, July 13, September 8, and December 13.

Some of its core functions include:

• Providing opinions to the Board about the proper management, handling and execution of business strategies.
• Providing oversight to ensure the correct management, handling and execution of the strategies of the Group and its Financial Entities.
• Supporting the Board in the drafting of reports that are to be presented to the Shareholders Meetings.
• Nominating or removing the Chief Executive Officer.
• Presenting a report to the Board based on the reports of the activities of the Executive President and Internal Committees.
• Submitting proposals to the Board to begin legal proceedings against officers who do not meet the principles of loyalty and diligence.
• Proposing and reviewing internal criteria and procedures to be followed to determine the structure of the Board of Directors and select proposals for directorial appointments.
• Proposing and reviewing internal criteria and procedures to be followed for the selection and on-going assessment of the Chief Executive Officer (CEO), Senior Executive Vice-President and other employees responsible for internal control or those who hold key positions in the Bank’s day-to-day activities, providing information about their appointment and removal from office, in addition to their on-going assessment.
• Undertaking an annual assessment process of the Board and Board Members.

During 2022, there was one session per month.

Some of its core functions include:

Proposing, for the approval of the Board of Directors:

• Comprehensive Risk Management objectives, guidelines and policies, in addition to any eventual modifications to them.
• Global Risk Exposure Limits and Specific Risk Exposure Limits, taking into consideration Consolidated Risk, itemized by Business Unit or Risk Factor, cause or origin.
• Mechanisms for the implementation of corrective measures.
• The exceptional circumstances or cases under which both the Global Risk Exposure Limits and the Specific Risk Exposure Limits can be surpassed.
• At least once a year, the Capital Adequacy Assessment, including capital estimations and, if applicable, the capitalization plan.
• The Contingency Plan and its modifications.
• Proposals relating to the sale or purchase of portfolios/ businesses; the Group’s most significant models and the corresponding documentation; any and all actions or operations that expose the Group to a significant risk or a risk that has increased from a lower scale.
• The nomination or removal of the chair of the Committee, who is ratified by the Board of Directors.

Adjusting or authorizing extensions to the Specific Risk Exposure Limits:

• Under exceptional circumstances.
• With the prior approval of the Board.
• In accordance with the Comprehensive Risk Management objectives, guidelines and policies.
• When the conditions and situation of the Institution require.

Approving:

• Specific Risk Appetite Limits and Risk Tolerance Levels, if and when they have the faculties delegated by the Board, as well as indicators on liquidity risks.
• Methodology and procedures to identify, measure, monitor, limit, control, report and disclose the diverse types of risks to which the Institution is exposed, in addition to any subsequent modifications.
• Models, parameters, scenarios and suppositions, including those relating to stress tests (Appendix 12-B of the CUB), which are used to assess Capital Adequacy and should be used to assess, measure and control the risks proposed by the Comprehensive Risk Management Unit (UAIR), which must be consistent with the Institution’s technology.
• Methodologies to identify, assess, measure and control the risks of new operations, products and services to be offered to the market.
• Corrective measures proposed by the CEO.
• Technical Comprehensive Risk Management assessment referred to in Article 77 of the CUB for its subsequent presentation to the Board and to the National Banking and Securities Commission (CNBV).
• Risk Management Manuals, based on the objectives, guidelines and policies established by the Board, as referred to in the last paragraph of Article 78 of the CUB.
• The report referred to in Article 77 of the CUB.
• The approval of the methodologies used to estimate the quantitative and qualitative impacts of operational uncertainty.
• The creation, modification and elimination of other subordinate governance bodies relating to the risks and their corresponding regulations.

Informing the Board, at least once a quarter, of:

• The Institution’s Risk Profile and its compliance with capital estimates outlined in the Capital Adequacy Assessment.
• The negative effects that this could have on the Institution’s operations.
• Non-compliance with established Desired Risk Profiles, Risk Exposure Limits and Risk Tolerance Levels, in addition to, if applicable, the Capitalization Plan.
• The corrective measures implemented, including those covering the Capital Forecast Plan and, if applicable, the Capitalization Plan.

Ensuring all employees involved in risk taking are, at all times, aware of:

• Desired Risk Profiles.
• Risk Exposure Limits.
• Risk Tolerance Levels.
• Capital Forecast Plan.
• Capitalization Plan.
• Informing the Board, at least once a year, of the results of the effectiveness testing of the Business Continuity Plan.