Terms ofReference
Audit and Risk
Committee
Version Date: January 2024

Contents
Contents .............................................................................................................................................................................. 2
Introduction......................................................................................................................................................................... 2
1
Composition .............................................................................................................................................................. 2
2
Duties and Powers .................................................................................................................................................... 2
3
Duties regarding the External Auditor and the Internal Auditor .............................................................................. 4
4
Meetings .................................................................................................................................................................... 55
Reporting to the Supervisory Board ......................................................................................................................... 5
6
Miscellaneous ........................................................................................................................................................... 6
Annex 1 – List of Definitions ............................................................................................................................................... 7
Annex 3 – Supervision of Financial Reporting and Publications ....................................................................................... 9Annex 4 – Supervision of Compliance with Legislation and Regulations ....................................................................... 10
Annex 5 – Financing and Finance-related Strategies...................................................................................................... 11
Annex 6 – List of Information to be included in the Report of the External Auditor ........................................................ 12

Introduction(1.)

These Terms of Reference have been drawn up by the Supervisory Board pursuant to clause 5 of the By-Lawsof the Supervisory Board and clause 20.12 of the Articles of Association.

(2.)

Capitalized terms that are used in these Terms of Reference shall have the meaning given to them in the list of
definitions included as Annex 1 (List of definitions).

1

Composition

1.1

The Audit and Risk Committee shall consist of three or more members of the Supervisory Board as determinedby the Supervisory Board.

1.2

More than half of the members of the Audit and Risk Committee shall be independent within the meaning ofclause 1.5 of the By-Laws of the Supervisory Board. 1

1.3

At least one member of the Audit and Risk Committee shall be a financial expert, in the sense that he or she has
relevant knowledge and experience of financial administration and accounting for listed companies or other large
legal entities.

1.4

The members of the Audit and Risk Committee shall be appointed and may be replaced at any time by theSupervisory Board. The Supervisory Board shall appoint one of the members of the Audit and Risk Committee
as chair of the Audit and Risk Committee that is independent within the meaning of clause 1.5 of the By-Laws of
the Supervisory Board. The Audit and Risk Committee shall be chaired by a member of the Supervisory Board.
The Audit and Risk Committee shall not be chaired by the chair of the Supervisory Board or by a former memberof the Management Board of the Company.2

1.5

The secretary of the Audit and Risk Committee shall be appointed by the chair.

1.6

In line with the EBA Guidelines on Internal Governance (EBA-GL-2017-11), the Audit and Risk Committee
functions as a combined Audit and Risk Committee.

2
2.1

Duties and Powers
The Audit and Risk Committee undertakes preparatory work for the Supervisory Board’s decision making
regarding the supervision of the integrity and quality of the Company’s financial and sustainability reporting andthe effectiveness of the Company’s internal risk management and control systems.3 The identification andanalysis of the risk should cover (i) strategic, (ii) operational, (iii) compliance, and (iv) reporting risks. Working
within the Supervisory Board, the Audit and Risk Committee is charged in particular with the following tasks:

1

Dutch Corporate Governance Code, best practice provision 2.3.4.
Dutch Corporate Governance Code, best practice provision 2.3.4.
3Dutch Corporate Governance Code, best practice provision 1.5.1.
2

Page 2 | Adyen N.V. 2024

2.1.1the supervision and monitoring of as well as advising the Management Board and eachManagement Board member in relation to:(a) the functioning of the internal risk management and control systems (risk policies, risk appetite,
integrity), including the Internal Audit Function;(b)financial reporting, including the timely and properly publishing of the periodical external financial
reports;(c)statutory audit of the (consolidated) Annual Accounts and ensuring independence of the External
Auditor;(d)the Company’s tax planning and corporate finance;(e)

IT and communication technology;(f)

the financing of the Company; and(g)relations with, and compliance with, recommendations and follow-up of comments by the internaland external auditors and any other external party involved in auditing the sustainability reporting.4

2.1.2

advising the Supervisory Board on the nomination by the Supervisory Board to the General Meetingof Shareholders for the (re)appointment or dismissal of the External Auditor5 and submitting a
proposal to the Supervisory Board for the External Auditor’s engagement to audit the annual
accounts. The Supervisory Board should resolve on the engagement;6

2.1.3

where necessary, to advise the Supervisory Board on the independence of the External Auditor andpossible (potential) conflicts of interest between the External Auditor and the Company;

2.1.4

recommending to the Supervisory Board in relation to the proposed appointment or dismissal of the
Head of Internal Audit by the Management Board;72.1.5

giving advice to the Supervisory Board with regard to the Internal Audit Function with respect to thematters listed in Annex 2;

2.1.6

giving preliminary advice to the Supervisory Board regarding the approval of the Annual Accounts
and the annual budget and major capital expenditures;

2.1.7

discussing with the Management Board the effectiveness of the design and operation of the internalrisk management and control systems observing the following:8(a) the Management Board should identify and analyze the risks associated with the strategy andactivities of the Company and its affiliated enterprise. It is responsible for establishing the risk
appetite, and also the measures that are put in place in order to counter the risks being taken;9

2.2

(b)

the Management Board should monitor the operation of the internal risk management andcontrol systems and should carry out a systematic assessment of their design and effectivenessat least once a year. This monitoring should cover all material control measures relating tostrategic, operational, compliance and reporting risks. Attention should be given to observed
weaknesses, instances of misconduct and irregularities, indications from whistle blowers,
lessons learned and findings from the Internal Audit Function and the External Auditor. Where
necessary, improvements should be made to internal risk management and control systems;10
and

(c)

examining whether incentives provided by the remuneration system take into consideration risk,
capital, liquidity and the likelihood and timing of earnings.

The following annexes to these Terms of Reference contain further details on some of the duties of the Audit andRisk Committee described in clause 2.1:
Annex 2 - Supervision of External Auditor and Internal Audit Function;

4

Dutch Corporate Governance Code, best practice provision 1.5.1.
Dutch Corporate Governance Code, best practice provision 1.6.1.
6Dutch Corporate Governance Code, best practice provision 1.6.3.
7Dutch Corporate Governance Code, best practice provision 1.3.1.
8Dutch Corporate Governance Code, best practice provision 1.4.1.
9Dutch Corporate Governance Code, best practice provision 1.2.1.
10Dutch Corporate Governance Code, best practice provision 1.2.3.
5Page 3 | Adyen N.V. 2024

Annex 3 - Supervision of financial reporting and publications;Annex 4 - Supervision of compliance with legislation and regulations;Annex 5 - Financing and finance-related strategies; andAnnex 6 - List of information to be included in the report of the External Auditor.
2.3

Each member of the Audit and Risk Committee has access to all relevant books, records and offices of theCompany and the authority to interview officers and employees of the Company to the extent necessary or
useful for the proper performance of his duties. Members of the Audit and Risk Committee shall exercise thisright in consultation with the chair of the Audit and Risk Committee.

2.4

When performing its duties, the Audit and Risk Committee may seek assistance or information from one ormore experts appointed by it and in consultation with either the CEO or the CFO of the Company, which will be
paid by the Company, provided that these experts do not jeopardize the independence of the Company's
auditor.

2.5

While the Audit and Risk Committee has the responsibilities and powers set forth in these Terms of Reference, it
is not the duty of the Audit and Risk Committee to plan or conduct audits or to determine that the Company's
annual accounts and disclosures are complete and accurate and are in accordance with generally accepted
accounting principles and applicable rules and regulations.

2.6

The Audit and Risk Committee may only exercise such powers as are explicitly attributed or delegated to it by
the Supervisory Board and may never exercise powers beyond those exercisable by the Supervisory Board as awhole.

3
3.1

Duties regarding the External Auditor and the Internal Auditor
The chair of the Audit and Risk Committee shall act as the principal contact for the External Auditor. The chair of
the Audit and Risk Committee and the Management Board are the first contact for the External Auditor if any
irregularities in the contents of the financial reports, or suspected misconduct are discovered. If the actual orsuspected misconduct or irregularity pertains to the functioning of a Management Board member, then theExternal Auditor should report this directly to the chair of the Supervisory Board.11
The internal audit function shall inform the Management Board and the chair of the Audit and Risk Committee
without delay if, during the performance of his duties, he discovers or suspects an instance of material
misconduct or irregularity. If the actual or suspected material misconduct or irregularity pertains to thefunctioning of one or more Management Board members, the internal audit function should report this to thechair of the Supervisory Board.12

3.2

The remuneration of the External Auditor,13 and instructions to the External Auditor to provide non-audit services,shall be approved by the Supervisory Board on the recommendation of the Audit and Risk Committee, and after
consultation with the Management Board.

3.3

The Audit and Risk Committee shall determine whether, and if so, how the External Auditor should be involved in
the content and publication of financial reports of the Company other than the Annual Accounts.14

3.4

The Audit and Risk Committee shall request that the External Auditor include in his report the matters which theExternal Auditor wishes to bring to the attention of the Management Board and the Supervisory Board in relation
to his audit of the Annual Accounts and the related audits, which in any event will include the matters listed in
Annex 6.

3.5

Supplementary to the Management Board's assessment thereof, the Audit and Risk Committee should reportannually to the Supervisory Board on the functioning of, and the developments in, the relationship with theExternal Auditor. The Audit and Risk Committee should advise the Supervisory Board regarding the External
Auditor’s nomination for appointment/reappointment or dismissal and should prepare the selection of theExternal Auditor. The Audit and Risk Committee should give due consideration to the Management Board’s
observations during the aforementioned work. Also, on this basis, the Supervisory Board should determine its
nomination for the appointment of the External Auditor to the General Meeting of Shareholders.15

3.6

The Audit and Risk Committee should annually discuss with the External Auditor:

11

Dutch Corporate Governance Code, best practice provision 2.6.3.
Dutch Corporate Governance Code, best practice provision 2.6.4.
13Dutch Corporate Governance Code, best practice provision 1.6.3.
14Dutch Corporate Governance Code, best practice provision 1.7.3.
15Dutch Corporate Governance Code, best practice provision 1.6.1.
12Page 4 | Adyen N.V. 2024

3.6.1.

the scope and materiality of the audit plan and the principal risks of the annual reporting identified
by the External Auditor in the audit plan;16 and3.6.2

based also on the documents from which the audit plan was developed, the findings and outcomesof the audit work on the annual accounts and the management letter.17

3.7

The Audit and Risk Committee shall form an opinion on the way in which the Internal Audit Function fulfills its
responsibilities at least annually in order for the Management Board to take this into account when assessing
the same.18

3.8

Internal Audit should draw up an audit plan, involving the Management Board, Audit and Risk Committee andthe External Auditor. The audit plan should be submitted to the Management Board, and then to the Supervisory
Board, for approval. In this Internal Audit Plan, attention should be paid to the cooperation with the External
Auditor.19

3.9

The Internal Audit Function should have sufficient resources to execute the Internal Audit Plan and have accessto information that is important for the performance of its work. The Internal Audit Function should have directaccess to the Audit and Risk Committee and the External Auditor. Records should be kept of how the Audit andRisk Committee is informed by the Internal Audit Function.20

3.10

The Internal Audit Function should report its audit results to the Management Board and the Audit and Risk
Committee and should inform the External Auditor.

3.11

The Company shall publish a press release in the event of the early termination of the relationship with theexternal audit firm. The press release shall explain the reasons for this early termination. 21

4

Meetings

4.1

The Audit and Risk Committee shall meet as often as required for a proper functioning of the Audit and Risk
Committee. The Audit and Risk Committee shall meet at least four times a year. The Audit and Risk Committee
shall meet at least once a year with the External Auditor without the Management Board being present.22 The
meetings are as much as possible scheduled annually in advance and are held as far as possible shortly before
the meetings of the Supervisory Board. The Audit and Risk Committee shall meet earlier if this is deemednecessary by the chair of the Audit and Risk Committee or by two other members of the Audit and Risk
Committee.

4.2

Meetings of the Audit and Risk Committee are in principle called by the secretary of the Audit and Risk
Committee on behalf of the chair, in consultation with the chair of the Audit and Risk Committee. Save in urgent
cases, to be determined by the chair of the Audit and Risk Committee, the agenda for the meeting shall be sent
at least seven calendar days before the meeting to all members of the Audit and Risk Committee.

4.3

The CFO, the Head of Internal Audit and the External Auditor shall be invited to Audit and Risk Committee
meetings, unless the Audit and Risk Committee determines otherwise.23 In addition, the chair of the Audit andRisk Committee may invite or require any other person to attend meetings of the Audit and Risk Committee,
including any officer or employee of the Company, or external experts. The secretary of the Audit and Risk
Committee or any other person designated for such purpose by the chair of the meeting shall draw up minutesof the meetings of the Audit and Risk Committee.

5

Reporting to the Supervisory Board

5.1

The Audit and Risk Committee must inform the Supervisory Board in a clear and timely manner about the way it
has used delegated powers and of major developments in the area of its responsibilities.

5.2

The Audit and Risk Committee shall report annually and earlier if required, to the Supervisory Board on its
interaction with the External Auditor, in particular on the Audit and Risk Committee's views of the External
Auditor's independence.

16

Dutch Corporate Governance Code, Principle 1.7. and best practice provision 1.7.2.
Dutch Corporate Governance Code, best practice provision 1.7.2.
18Dutch Corporate Governance Code, best practice provision 1.3.2.
19Dutch Corporate Governance Code, best practice provision 1.3.3.
20
Dutch Corporate Governance Code, best practice provision 1.3.4.
21Dutch Corporate Governance Code, best practice provision 1.6.5.
22Dutch Corporate Governance Code, best practice provision 1.7.4.
23
Dutch Corporate Governance Code, best practice provision 1.5.2.
17Page 5 | Adyen N.V. 2024

5.3

The Audit and Risk Committee shall report to the Supervisory Board its deliberations and findings. This reportmust, at least, include the following information:24(a)the methods used to assess the effectiveness of the design and operation of the internal risk
management and control systems referred to in article 2.1.1 under (a) of these Terms of Reference;(b)

the methods used to assess the effectiveness of the internal and external audit processes;(c)material considerations regarding financial reporting; and(d)the way material risks and uncertainties referred to in the Management Report have been analyzed
and discussed, along with a description of the most important findings of the Audit and Risk
Committee.

The reports of meetings of the Audit and Risk Committee are distributed among all members of the Supervisory
Board.
5.4

If requested, the chair of the Audit and Risk Committee shall at meetings of the Supervisory Board provide theSupervisory Board with further information on the outcome of the discussions of the Audit and Risk Committee.

5.5Every Supervisory Board member has unrestricted access to all records of the Audit and Risk Committee. A
member of the Supervisory Board shall exercise this right in consultation with the chair of the Audit and Risk
Committee.

6

Miscellaneous

6.1

The chair of the Audit and Risk Committee (or one of the other Audit and Risk Committee members) shall beavailable to answer questions regarding the Audit and Risk Committee's activities at the annual General Meetingof Shareholders.

6.2

The Audit and Risk Committee may occasionally decide at its sole discretion not to comply with these Terms ofReference, subject to applicable law and regulations and, where applicable, adequate disclosure in theManagement Report. The Supervisory Board can at all times amend these Terms of Reference and/or revoke
any powers granted by it to the Audit and Risk Committee.

6.3

These Terms of Reference and the composition of the Audit and Risk Committee are posted on the Company's
website.25

24
25

Dutch Corporate Governance Code, best practice provision 1.5.3.
Dutch Corporate Governance Code, best practice provision 2.3.3.

Page 6 | Adyen N.V. 2024

Annex 1 – List of Definitions
In these Terms of Reference the following terms have the following meanings:"Annual Accounts" means the annual accounts of the Company as referred to in section 2:101 of the Dutch Civil Code.
"Articles of Association" means the articles of association (statuten) of the Company.
"Audit and Risk Committee" means the Audit and Risk Committee of the Company.
"By-Laws" means the by-laws of the Supervisory Board, including the annexes belonging thereto.
"CEO" means the chief executive officer of the Company.
"CFO" means the chief financial officer of the Company.
"Company" means Adyen N.V., and, where appropriate, the Subsidiaries and possible other group companies of theCompany, whose financial information is incorporated in the consolidated Annual Accounts of the Company.
"External Auditor" means the firm of auditors charged with the auditing of the Company's annual accounts as referred
to in section 2:393 of the Dutch Civil Code.
"General Meeting of Shareholders" means the general meeting of shareholders (algemene vergadering van
aandeelhouders) of the Company.
"Head of Internal Audit" means the senior internal auditor appointed in accordance with clause 16.2 of the By-Laws of
the Management Board.
"Internal Audit Function" means the internal audit function of the Company.
''Internal Audit Plan'' means the internal audit plan of the Company as determined by the Management Board inaccordance with clause 16.4 of the By-Laws of the Company.

"Management Board" means the management board (bestuur) of the Company.
"Management Report" means the management report of the Company drawn up by the Management Board, as
referred to in section 2:101 of the Dutch Civil Code.
"Subsidiary" has the meaning attributed to it in section 2:24a of the Dutch Civil Code.
"Supervisory Board" means the supervisory board (raad van commissarissen) of the Company.
"Terms of Reference" means the terms of reference of the Audit and Risk Committee, as established by theSupervisory Board.

Page 7 | Adyen N.V. 2024

Annex 2 – Supervision of External Auditor and Internal Audit Function
1.

Assess and evaluate the External Auditor and the lead partner of the audit team of the External Auditor.

2.

Obtain and review a report from the External Auditor (at least annually) regarding (i) the External Auditor’s internal
quality control procedures, (ii) any material issues raised by the most recent internal quality control review, or peer
review, of the firm, or by any inquiry or investigation by governmental or professional authorities within thepreceding five months with respect to one or more independent audits carried out by the firm, (iii) any steps taken
to deal with any such issues and (iv) all relationships between the External Auditor and the Company. Evaluate thequalifications, performance and independence of the External Auditor, including considering whether the External
Auditor’s quality controls are adequate, and taking into account the opinions of the Management Board.

3.

Ensure the rotation of the lead (or coordinating) audit partner having primary responsibility for the audit and theaudit partner responsible for reviewing the audit as well as the other members of the External Auditor, as requiredby law, regulation and/or the Supervisory Board By-Laws.

4.

Meet with the External Auditor prior to the audit to discuss the planning, scope and staffing of the audit.

5.

Discuss the Internal Audit Function’s audit plan. Attention should be paid to the interaction with the External
Auditor.

6.

Discuss the essence of Internal Audit Function’s reports on its audit results. The research findings of the Internal
Audit Function should, at least, include the following:(a)

any flaws in the effectiveness of the internal risk management and control systems;(b)

any findings and observations with a material impact on the risk profile of the Company and its affiliatedenterprise; and(c)any failings in the follow-up of recommendations made by the Internal Audit Function.

Page 8 | Adyen N.V. 2024

Annex 3 – Supervision of Financial Reporting and Publications
1.

Discuss whether and, if so, how the External Auditor should be involved in the content and publication of financial
reports other than the annual accounts.26 Review and discuss with the Management Board and the External Auditor
the annual audited annual accounts, including disclosures made in management interviews, and analyses.

2.

Review and discuss with the Management Board and the External Auditor the interim annual accounts prior to theirrelease, including the results of any review by the External Auditors of the interim annual accounts.

3.

Discuss with the Management Board and the External Auditor significant financial reporting issues and judgments
made in connection with the preparation of the Company's annual accounts, including the quality of earnings, any
significant changes in the Company's selection or application of accounting principles, any issues as to theadequacy of the Company's internal controls and any special steps adopted in light of control deficiencies.

4.

Review and discuss reports of the External Auditor on:(a)

all major elements of the accounting policies and the methods used;(b)

all alternative treatments of financial information within generally accepted accounting principles thathave been discussed with the Management Board or any member thereof, ramifications of the use of suchalternative disclosures and treatments, and the treatment preferred by the External Auditor; and(c)other important written communications between the External Auditor and the Management Board or
one of its members.

5.

Discuss with the Management Board the Company's (i) earnings press releases, including the use of non-GAAP
information and (ii) plans and policies of the Company with respect to comments on financial information andearnings guidance given by analysts and rating agencies.

6.

Discuss with the Management Board and the External Auditor the consequences of legislative or regulatory
initiatives as well as off-balance structures for the financial reporting by the Company.

7.

Discuss with the Risk Committee, the Credit Risk Committee and the Management Board the Company's major
financial risk exposures and the steps the Management Board has taken to monitor and control such exposures,
including the Company's risk assessment and risk management policies.

26

Dutch Corporate Governance Code, provision 1.7.3

Page 9 | Adyen N.V. 2024

Annex 4 – Supervision of Compliance with Legislation andRegulations
1.

Obtain reports from the Management Board, the Internal Audit Function and the External Auditor to the effect that
the Company and its Subsidiaries comply with the applicable legislation and regulations and the internal rules of
the Company. Review reports on intended disclosures on insider and affiliated party transactions. Advise theSupervisory Board on policy and procedures of the Company for compliance with applicable legislation andregulations.

2.

Discuss with the Management Board and the External Auditor any correspondence with supervisory authorities,
market authorities or governmental agencies and any published reports which raise material issues regarding theCompany's annual accounts or accounting policies.

3.

Discuss with the relevant persons of the legal and compliance department of the Company, the legal or compliancerelated issues that may materially affect the financial reports or the policy of the Company regarding its compliancewith legislation and regulations.

Page 10 | Adyen N.V. 2024

Annex 5 – Financing and Finance-related Strategies
1.

Review and discuss with the Management Board at least once a year the general financial strategy of theCompany.

2.

Review and discuss with the Management Board the financial policy and financial procedures of the Company,
including its currency, policies and procedures.

3.

The discussions between the Audit and Risk Committee and the Management Board on the above issues shalltake place prior to the discussions on these issues between the Supervisory Board and the Management Board.

Page 11 | Adyen N.V. 2024

Annex 6 – List of Information to be included in the Report of theExternal Auditor
Pursuant to section 2:393, subsection 4 of the Dutch Civil Code, the report of the External Auditor shall contain thematters which the External Auditor wishes to bring to the attention of the Management Board and the Supervisory
Board in relation to its audit of the Annual Accounts and the related audits.
The following examples can be given:(a)With regard to the audit:•

information about matters of importance to the assessment of the independence of the External
Auditor; and•information about the course of events during the audit and cooperation with External Auditors,
matters for discussion with the Management Board, a list of corrections that have not been made,
etc.

(b)

With regard to the financial figures:•

analyses of changes in shareholders' equity and results which do not appear in the information to be
published and which, in the view of the External Auditor, contribute to an understanding of thefinancial position and results of the Company; and•comments regarding the processing of one-off items, the effects of estimates and the manner inwhich they have been arrived at, the choice of accounting policies when other choices were possible,
and particular effects of such policies.

(c)With regard to the operation of the internal risk management and control systems (including thereliability and continuity of automated data processing) and the quality of the internal provision of
information:•

points for improvement, gaps and quality assessments;•

comments about threats and risks to the Company and the manner in which they should bereported; and•compliance with Articles of Association, instructions, regulations, loan covenants, requirements ofexternal supervisors, etc.

Page 12 | Adyen N.V. 2024

Page 13 | Adyen N.V. 2024