# EDGAR Filing Document

**Accession Number:** 0001504764
**File Stem:** 0000950103-23-001640
**Filing Date:** 2023-2
**Character Count:** 626225
**Document Hash:** f5aff22e314aef250420467e0efa3bb4
**Contains OCR:** False
**Source Format:** 

## Filing Content

## Filing Summary
**0000950103-23-001640.hdr.sgml**: 20230201

**ACCESSION NUMBER**: 0000950103-23-001640

**CONFORMED SUBMISSION TYPE**: 6-K

**PUBLIC DOCUMENT COUNT**: 2

**CONFORMED PERIOD OF REPORT**: 20230201

**FILED AS OF DATE**: 20230201

**DATE AS OF CHANGE**: 20230201

**FILER**: 

**COMPANY DATA:**
- **COMPANY CONFORMED NAME:** Grupo Aval Acciones Y Valores S.A.
- **CENTRAL INDEX KEY:** 0001504764
- **STANDARD INDUSTRIAL CLASSIFICATION:** COMMERCIAL BANKS, NEC [6029]
- **IRS NUMBER:** 000000000
- **FISCAL YEAR END:** 1231

**FILING VALUES:**
- **FORM TYPE:** 6-K
- **SEC ACT:** 1934 Act
- **SEC FILE NUMBER:** 001-36631
- **FILM NUMBER:** 23577122

**BUSINESS ADDRESS:**
- **STREET 1:** CARRERA 13 NO. 26A - 47
- **CITY:** Bogota D.C.
- **STATE:** F8
- **ZIP:** 00000
- **BUSINESS PHONE:** 57 1 241-9700

**MAIL ADDRESS:**
- **STREET 1:** CARRERA 13 NO. 26A - 47
- **CITY:** Bogota D.C.
- **STATE:** F8
- **ZIP:** 00000

**UNITED STATES**

**SECURITIES AND EXCHANGE COMMISSION**

**Washington, D.C. 20549**

**FORM 6-K**

<br> **Report Of Foreign Private Issuer**

**Pursuant To Rule 13a-16 Or 15d-16 Of**

**The Securities Exchange Act Of 1934**

For the month of February 2023

------

**Commission File Number: 000-54290**

**Grupo Aval Acciones y Valores S.A.**

**(Exact name of registrant as specified in its charter)**

**Carrera 13 No. 26A - 47**

**Bogotá D.C., Colombia**

**(Address of principal executive office)**

Indicate by check mark whether the registrant files or will file annual reports under cover of Form 20-F or Form 40-F:

Form 20-F X Form 40-F

Indicate by check mark if the registrant is submitting the Form 6-K in paper as permitted by Regulation S-T Rule 101(b)(1):

---

| | | |
|:---|:---|:---|
| Yes | No | X  |

---

Indicate by check mark if the registrant is submitting the Form 6-K in paper as permitted by Regulation S-T Rule 101(b)(7):

---

| | | |
|:---|:---|:---|
| Yes | No | X  |

---

**GRUPO AVAL ACCIONES Y VALORES S.A.**

**TABLE OF CONTENTS**

---

| | |
|:---|:---|
| **ITEM** |  |
| 1. | Implementation of Best Corporate Practices Report (year 2022). |

---

**Item 1**

**IMPLEMENTATION OF BEST CORPORATE PRACTICES REPORT**

**GRUPO AVAL ACCIONES Y VALORES S.A.**

**PRINCIPAL LEGAL REPRESENTATIVE:**

Luis Carlos Sarmiento-Gutierrez

**LEGAL REPRESENTATIVE DESIGNATED FOR DELIVERY OF THE IMPLEMENTATION REPORT:** 

Jorge Adrián Rincón Plata

**PERIOD OF THE REPORT:**

Year 2022

**DATE OF THE REPORT:** 

January 31, 2023

**FINANCIAL SUPERINTENDENCE OF COLOMBIA**

***This translation from the original Spanish version is provided for convenience purposes only. No representation is made as to the accuracy of this document and the company does not assume any liability based upon it. Should any doubt or contradiction arise between the Spanish and English versions, the Spanish version shall prevail.***

**INTRODUCTION**

The implementation of recommendations of the new Code for Best Corporate Practices in Colombia, shall be reported by issuers to the Financial Superintendence of Colombia (SFC) through the herein Report on Implementation of Best Corporate Practices.

The objective of this report is to inform the stock exchange about the implementation, or not, of the recommendations included in the Code for each issuer. For such purposes, each recommendation has three boxes corresponding to the answers YES, NO, and N.A, as well as a space to complement the answer as follows:

If answer is affirmative, issuer shall briefly describe the manner in which it has carried out the implementation. If answer is negative, issuer shall explain the reason for not implementing such recommendation.

Answer N.A., shall only be provided by the issuer in cases where it has not been possible to adopt a recommendation due to legal reasons. In such event, issuer shall fully describe the regulation that prevents the adoption of a particular recommendation.

Since some recommendations include a series of detailed aspects, it is important to note that these shall be understood as implemented if all aspects are complied with, except if the reason for not implementing some of them has a legal basis, this fact shall be pointed out.

Each recommendation includes a box to indicate the implementation date for the first time. There is an additional box in order to register modification dates.

Finally, when due to its nature, issuer does not have a specific body referred to under the recommendation, it shall be understood that such recommendation refers to an equivalent body within the entity or to a body performing similar tasks.

**FINANCIAL SUPERINTENDENCE OF COLOMBIA**

***This translation from the original Spanish version is provided for convenience purposes only. No representation is made as to the accuracy of this document and the company does not assume any liability based upon it. Should any doubt or contradiction arise between the Spanish and English versions, the Spanish version shall prevail.***

&nbsp;&nbsp;&nbsp;&nbsp;**I.** **RIGHTS AND EQUAL TREATMENT TO SHAREHOLDERS.** 

**Measure No. 1. Equal Treatment Principle.** 

**1.1.** The corporation gives equal treatment to all the shareholders who have similar shares and conditions, without granting access to privileged information to some shareholders above others.

---

| | | | | |
|:---|:---|:---|:---|:---|
| &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;**1.1. Measure implementation** | **YES** | **X** | **NO** | **N/A** |
| **YES. Briefly Indicate:** The corporation has issued Ordinary Shares and Shares with Preferential Dividend that grant equal treatment to all shareholders according to the legal and statutory rights that these types of shares grant their holders. Any information of the Corporation that is relevant by its nature and pursuant to applicable regulations is informed to the market through the Integral Information System of the Stock Market (SIMEV, in Spanish), the Relevant Information System, the Electronic Data Gathering, Analysis, and Retrieval System (EDGAR) managed by the U.S. Securities and Exchange Commission and the Corporation's Internet web site. Additionally, article 42 of the By laws sets forth the duty of the Company of giving the same treatment to petitions, claims and information to its shareholders regardless of the amount of their shares as well as to its investors regardless of the amount of their investments, establishing specific mechanisms ensuring equitable treatment to shareholders and investors. Likewise, article 42 of the By laws is further developed by the Company's Corporate Governance Code that states, among other rights of the shareholders, the right to equitable treatment and to be provided with the same information, with the same amount of detail and within the same time frame and timeliness with the purpose of protecting their rights. | **YES. Briefly Indicate:** The corporation has issued Ordinary Shares and Shares with Preferential Dividend that grant equal treatment to all shareholders according to the legal and statutory rights that these types of shares grant their holders. Any information of the Corporation that is relevant by its nature and pursuant to applicable regulations is informed to the market through the Integral Information System of the Stock Market (SIMEV, in Spanish), the Relevant Information System, the Electronic Data Gathering, Analysis, and Retrieval System (EDGAR) managed by the U.S. Securities and Exchange Commission and the Corporation's Internet web site. Additionally, article 42 of the By laws sets forth the duty of the Company of giving the same treatment to petitions, claims and information to its shareholders regardless of the amount of their shares as well as to its investors regardless of the amount of their investments, establishing specific mechanisms ensuring equitable treatment to shareholders and investors. Likewise, article 42 of the By laws is further developed by the Company's Corporate Governance Code that states, among other rights of the shareholders, the right to equitable treatment and to be provided with the same information, with the same amount of detail and within the same time frame and timeliness with the purpose of protecting their rights. | **YES. Briefly Indicate:** The corporation has issued Ordinary Shares and Shares with Preferential Dividend that grant equal treatment to all shareholders according to the legal and statutory rights that these types of shares grant their holders. Any information of the Corporation that is relevant by its nature and pursuant to applicable regulations is informed to the market through the Integral Information System of the Stock Market (SIMEV, in Spanish), the Relevant Information System, the Electronic Data Gathering, Analysis, and Retrieval System (EDGAR) managed by the U.S. Securities and Exchange Commission and the Corporation's Internet web site. Additionally, article 42 of the By laws sets forth the duty of the Company of giving the same treatment to petitions, claims and information to its shareholders regardless of the amount of their shares as well as to its investors regardless of the amount of their investments, establishing specific mechanisms ensuring equitable treatment to shareholders and investors. Likewise, article 42 of the By laws is further developed by the Company's Corporate Governance Code that states, among other rights of the shareholders, the right to equitable treatment and to be provided with the same information, with the same amount of detail and within the same time frame and timeliness with the purpose of protecting their rights. | **YES. Briefly Indicate:** The corporation has issued Ordinary Shares and Shares with Preferential Dividend that grant equal treatment to all shareholders according to the legal and statutory rights that these types of shares grant their holders. Any information of the Corporation that is relevant by its nature and pursuant to applicable regulations is informed to the market through the Integral Information System of the Stock Market (SIMEV, in Spanish), the Relevant Information System, the Electronic Data Gathering, Analysis, and Retrieval System (EDGAR) managed by the U.S. Securities and Exchange Commission and the Corporation's Internet web site. Additionally, article 42 of the By laws sets forth the duty of the Company of giving the same treatment to petitions, claims and information to its shareholders regardless of the amount of their shares as well as to its investors regardless of the amount of their investments, establishing specific mechanisms ensuring equitable treatment to shareholders and investors. Likewise, article 42 of the By laws is further developed by the Company's Corporate Governance Code that states, among other rights of the shareholders, the right to equitable treatment and to be provided with the same information, with the same amount of detail and within the same time frame and timeliness with the purpose of protecting their rights. | **YES. Briefly Indicate:** The corporation has issued Ordinary Shares and Shares with Preferential Dividend that grant equal treatment to all shareholders according to the legal and statutory rights that these types of shares grant their holders. Any information of the Corporation that is relevant by its nature and pursuant to applicable regulations is informed to the market through the Integral Information System of the Stock Market (SIMEV, in Spanish), the Relevant Information System, the Electronic Data Gathering, Analysis, and Retrieval System (EDGAR) managed by the U.S. Securities and Exchange Commission and the Corporation's Internet web site. Additionally, article 42 of the By laws sets forth the duty of the Company of giving the same treatment to petitions, claims and information to its shareholders regardless of the amount of their shares as well as to its investors regardless of the amount of their investments, establishing specific mechanisms ensuring equitable treatment to shareholders and investors. Likewise, article 42 of the By laws is further developed by the Company's Corporate Governance Code that states, among other rights of the shareholders, the right to equitable treatment and to be provided with the same information, with the same amount of detail and within the same time frame and timeliness with the purpose of protecting their rights. |
| **NO. Explain** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** | | |
| **Implementation Date** | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. (External Circular) 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. (External Circular) 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. (External Circular) 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. (External Circular) 028 of 2014. |
| **Modification Date** |  |  |  |  |

---

**1.2.** The Board of Directors has approved concrete procedures to determine the corporation's ways to relate to the different types of shareholders, regarding matters such as: access to information; answer to information requests; communication channels; interaction between the shareholders and the corporation, its Board of Directors, and the remaining managers.

**FINANCIAL SUPERINTENDENCE OF COLOMBIA**

***This translation from the original Spanish version is provided for convenience purposes only. No representation is made as to the accuracy of this document and the company does not assume any liability based upon it. Should any doubt or contradiction arise between the Spanish and English versions, the Spanish version shall prevail.***

---

| | | | | |
|:---|:---|:---|:---|:---|
| &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;**1.2. Measure implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** Grupo Aval has a specific procedure (Modelo Atención al Accionista e Inversionista") approved by its Board of Directors defining the practices of the Corporation for its relationships with the investors of the corporation (shareholders and investors in fixed income securities), and regarding to access to information, resolution of information requests and communication channels, among other issues. Communication channels arranged to attend investors are disclosed at the company's website: www.grupoaval.com .<br>The document´s name is :"*Política de Modelo de servicio y Atención al Accionista e Inversionista"*." | **YES. Briefly Indicate:** Grupo Aval has a specific procedure (Modelo Atención al Accionista e Inversionista") approved by its Board of Directors defining the practices of the Corporation for its relationships with the investors of the corporation (shareholders and investors in fixed income securities), and regarding to access to information, resolution of information requests and communication channels, among other issues. Communication channels arranged to attend investors are disclosed at the company's website: www.grupoaval.com .<br>The document´s name is :"*Política de Modelo de servicio y Atención al Accionista e Inversionista"*." | **YES. Briefly Indicate:** Grupo Aval has a specific procedure (Modelo Atención al Accionista e Inversionista") approved by its Board of Directors defining the practices of the Corporation for its relationships with the investors of the corporation (shareholders and investors in fixed income securities), and regarding to access to information, resolution of information requests and communication channels, among other issues. Communication channels arranged to attend investors are disclosed at the company's website: www.grupoaval.com .<br>The document´s name is :"*Política de Modelo de servicio y Atención al Accionista e Inversionista"*." | **YES. Briefly Indicate:** Grupo Aval has a specific procedure (Modelo Atención al Accionista e Inversionista") approved by its Board of Directors defining the practices of the Corporation for its relationships with the investors of the corporation (shareholders and investors in fixed income securities), and regarding to access to information, resolution of information requests and communication channels, among other issues. Communication channels arranged to attend investors are disclosed at the company's website: www.grupoaval.com .<br>The document´s name is :"*Política de Modelo de servicio y Atención al Accionista e Inversionista"*." | **YES. Briefly Indicate:** Grupo Aval has a specific procedure (Modelo Atención al Accionista e Inversionista") approved by its Board of Directors defining the practices of the Corporation for its relationships with the investors of the corporation (shareholders and investors in fixed income securities), and regarding to access to information, resolution of information requests and communication channels, among other issues. Communication channels arranged to attend investors are disclosed at the company's website: www.grupoaval.com .<br>The document´s name is :"*Política de Modelo de servicio y Atención al Accionista e Inversionista"*." |
| **NO. Explain** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** | | |
| **Implementation Date** | The Corporation has a procedure to provide attention to shareholders and investors prior to September 30, 2014 date in which the E.C. 028 of 2014 was issued. However, to address the recommendation of the New Country Code, such procedure was subject to the approval of the Board of Directors after such date. | The Corporation has a procedure to provide attention to shareholders and investors prior to September 30, 2014 date in which the E.C. 028 of 2014 was issued. However, to address the recommendation of the New Country Code, such procedure was subject to the approval of the Board of Directors after such date. | The Corporation has a procedure to provide attention to shareholders and investors prior to September 30, 2014 date in which the E.C. 028 of 2014 was issued. However, to address the recommendation of the New Country Code, such procedure was subject to the approval of the Board of Directors after such date. | The Corporation has a procedure to provide attention to shareholders and investors prior to September 30, 2014 date in which the E.C. 028 of 2014 was issued. However, to address the recommendation of the New Country Code, such procedure was subject to the approval of the Board of Directors after such date. |
| **Modification Date** |  |  |  |  |

---

**Measure No. 2. Information about Shares**

**2.1.** Through its web site, the corporation informs the public, in a clear, precise, and comprehensive way, the different types of shares issued by the corporation, the quantity issued per type, and the quantity of shares reserved, as well as the rights and obligations inherent to each type of share.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **2.1. Measure implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate**: The web page of the Corporation, in its investor section, indicates the different of class's shares issued by the Corporation, the amount of shares for each class and the amount of shares, as well as the rights and obligations inherent for each class of shares through documents such as issuance offering memorandums, By laws and regulations of the Corporation. | **YES. Briefly Indicate**: The web page of the Corporation, in its investor section, indicates the different of class's shares issued by the Corporation, the amount of shares for each class and the amount of shares, as well as the rights and obligations inherent for each class of shares through documents such as issuance offering memorandums, By laws and regulations of the Corporation. | **YES. Briefly Indicate**: The web page of the Corporation, in its investor section, indicates the different of class's shares issued by the Corporation, the amount of shares for each class and the amount of shares, as well as the rights and obligations inherent for each class of shares through documents such as issuance offering memorandums, By laws and regulations of the Corporation. | **YES. Briefly Indicate**: The web page of the Corporation, in its investor section, indicates the different of class's shares issued by the Corporation, the amount of shares for each class and the amount of shares, as well as the rights and obligations inherent for each class of shares through documents such as issuance offering memorandums, By laws and regulations of the Corporation. | **YES. Briefly Indicate**: The web page of the Corporation, in its investor section, indicates the different of class's shares issued by the Corporation, the amount of shares for each class and the amount of shares, as well as the rights and obligations inherent for each class of shares through documents such as issuance offering memorandums, By laws and regulations of the Corporation. |
| **NO. Explain** |  |  | | |
| **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** | | |
| **Implementation Date** | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. |
| **Modification Date** |  |  |  |  |

---

**FINANCIAL SUPERINTENDENCE OF COLOMBIA**

***This translation from the original Spanish version is provided for convenience purposes only. No representation is made as to the accuracy of this document and the company does not assume any liability based upon it. Should any doubt or contradiction arise between the Spanish and English versions, the Spanish version shall prevail.***

**Measure No. 3. Non dilution of Equity.** 

**3.1.** In transactions that may cause the dilution of the capital of minority shareholders (i.e. a capital increase with a waiver of preemptive rights in the subscription of shares, a merger, a segregation (spinoffs), among others), the corporation will explain them to the shareholders in detail through a previous report of the Board of Directors. Such a report will contain the opinion, about the terms of the transaction, of a renowned external independent advisor appointed by the Board of Directors (fairness opinion). These reports will be made available to the shareholders before the Assembly, within the terms for the exercise of inspection rights.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **3.1. Measure implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** In the events where the issuance of shares of the Corporation has been decided without being subject to preferential rights, the Corporation has submitted that decision for the consideration of the General Shareholders Meeting providing the information required for such purpose. In addition, in the past, on situations when operations such as those mentioned in the measure the Shareholders Meeting of Grupo Aval has supported its decision in the expert opinion of an independent external consultant, furthermore, the inform was available to the Shareholders to exercise their right of inspection within the terms of the law. In addition, the Company added a procedure to solve these particular cases in the Good Governance Code, subsection 3.1.7.3 "To be assisted and informed" | **YES. Briefly Indicate:** In the events where the issuance of shares of the Corporation has been decided without being subject to preferential rights, the Corporation has submitted that decision for the consideration of the General Shareholders Meeting providing the information required for such purpose. In addition, in the past, on situations when operations such as those mentioned in the measure the Shareholders Meeting of Grupo Aval has supported its decision in the expert opinion of an independent external consultant, furthermore, the inform was available to the Shareholders to exercise their right of inspection within the terms of the law. In addition, the Company added a procedure to solve these particular cases in the Good Governance Code, subsection 3.1.7.3 "To be assisted and informed" | **YES. Briefly Indicate:** In the events where the issuance of shares of the Corporation has been decided without being subject to preferential rights, the Corporation has submitted that decision for the consideration of the General Shareholders Meeting providing the information required for such purpose. In addition, in the past, on situations when operations such as those mentioned in the measure the Shareholders Meeting of Grupo Aval has supported its decision in the expert opinion of an independent external consultant, furthermore, the inform was available to the Shareholders to exercise their right of inspection within the terms of the law. In addition, the Company added a procedure to solve these particular cases in the Good Governance Code, subsection 3.1.7.3 "To be assisted and informed" | **YES. Briefly Indicate:** In the events where the issuance of shares of the Corporation has been decided without being subject to preferential rights, the Corporation has submitted that decision for the consideration of the General Shareholders Meeting providing the information required for such purpose. In addition, in the past, on situations when operations such as those mentioned in the measure the Shareholders Meeting of Grupo Aval has supported its decision in the expert opinion of an independent external consultant, furthermore, the inform was available to the Shareholders to exercise their right of inspection within the terms of the law. In addition, the Company added a procedure to solve these particular cases in the Good Governance Code, subsection 3.1.7.3 "To be assisted and informed" | **YES. Briefly Indicate:** In the events where the issuance of shares of the Corporation has been decided without being subject to preferential rights, the Corporation has submitted that decision for the consideration of the General Shareholders Meeting providing the information required for such purpose. In addition, in the past, on situations when operations such as those mentioned in the measure the Shareholders Meeting of Grupo Aval has supported its decision in the expert opinion of an independent external consultant, furthermore, the inform was available to the Shareholders to exercise their right of inspection within the terms of the law. In addition, the Company added a procedure to solve these particular cases in the Good Governance Code, subsection 3.1.7.3 "To be assisted and informed" |
| **NO. Explain** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** | | |
| **Implementation Date** | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. |
| **Modification Date** | December 9, 2020 | December 9, 2020 | December 9, 2020 | December 9, 2020 |

---

**Measure No. 4. Information and Communication with Shareholders.** 

**4.1.** The corporation has a corporate web site in Spanish and English, with a link of Corporate Governance, or of relations with shareholders and investors, or equivalent. It will include financial and non-financial information in the terms proposed by recommendations 32.3 and 33.3. Furthermore, under no circumstance, it will include the corporation's confidential information, or that relative to company secrets, or any other whose disclosure could be used against the corporation.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **4.1. Measure implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** The corporation has a corporate Web page in Spanish and English languages containing, among other things, links to issues of corporate governance and relationships with shareholders and investors that substantially include financial and nonfinancial information to which such recommendations refer, including the terms proposed by 32.3 and 33.3. | **YES. Briefly Indicate:** The corporation has a corporate Web page in Spanish and English languages containing, among other things, links to issues of corporate governance and relationships with shareholders and investors that substantially include financial and nonfinancial information to which such recommendations refer, including the terms proposed by 32.3 and 33.3. | **YES. Briefly Indicate:** The corporation has a corporate Web page in Spanish and English languages containing, among other things, links to issues of corporate governance and relationships with shareholders and investors that substantially include financial and nonfinancial information to which such recommendations refer, including the terms proposed by 32.3 and 33.3. | **YES. Briefly Indicate:** The corporation has a corporate Web page in Spanish and English languages containing, among other things, links to issues of corporate governance and relationships with shareholders and investors that substantially include financial and nonfinancial information to which such recommendations refer, including the terms proposed by 32.3 and 33.3. | **YES. Briefly Indicate:** The corporation has a corporate Web page in Spanish and English languages containing, among other things, links to issues of corporate governance and relationships with shareholders and investors that substantially include financial and nonfinancial information to which such recommendations refer, including the terms proposed by 32.3 and 33.3. |
| **NO. Explain** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** | | |
| **Implementation Date** | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and supplemented in 2015 as the result of the implementation of some recommendations of the New Country Code.  | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and supplemented in 2015 as the result of the implementation of some recommendations of the New Country Code.  | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and supplemented in 2015 as the result of the implementation of some recommendations of the New Country Code.  | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and supplemented in 2015 as the result of the implementation of some recommendations of the New Country Code.  |
| **Modification Date** |  |  |  |  |

---

**FINANCIAL SUPERINTENDENCE OF COLOMBIA**

***This translation from the original Spanish version is provided for convenience purposes only. No representation is made as to the accuracy of this document and the company does not assume any liability based upon it. Should any doubt or contradiction arise between the Spanish and English versions, the Spanish version shall prevail.***

**4.2.** The corporation has permanent-access mechanisms targeted exclusively to shareholders, such as a web link (only for them), or an office devoted to the relations with shareholders and investors, periodical information sessions, among others. These spaces should permit them state their opinions, concerns or suggestions on the corporation's development, or about their condition as shareholders.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **4.2. Measure implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** The Corporation offers permanent access mechanisms to its shareholders and investors in fixed income securities. The Company's Web page has a link to information referring to different modalities under which the shareholders may contact the Corporation through the Department of Relations with Investors that addresses the queries or suggestions received from its shareholders about the development of the Corporation or regarding their condition as shareholders and carries out quarterly performance presentations (via webcasts) to which its shareholders, investors and stakeholders have access. | **YES. Briefly Indicate:** The Corporation offers permanent access mechanisms to its shareholders and investors in fixed income securities. The Company's Web page has a link to information referring to different modalities under which the shareholders may contact the Corporation through the Department of Relations with Investors that addresses the queries or suggestions received from its shareholders about the development of the Corporation or regarding their condition as shareholders and carries out quarterly performance presentations (via webcasts) to which its shareholders, investors and stakeholders have access. | **YES. Briefly Indicate:** The Corporation offers permanent access mechanisms to its shareholders and investors in fixed income securities. The Company's Web page has a link to information referring to different modalities under which the shareholders may contact the Corporation through the Department of Relations with Investors that addresses the queries or suggestions received from its shareholders about the development of the Corporation or regarding their condition as shareholders and carries out quarterly performance presentations (via webcasts) to which its shareholders, investors and stakeholders have access. | **YES. Briefly Indicate:** The Corporation offers permanent access mechanisms to its shareholders and investors in fixed income securities. The Company's Web page has a link to information referring to different modalities under which the shareholders may contact the Corporation through the Department of Relations with Investors that addresses the queries or suggestions received from its shareholders about the development of the Corporation or regarding their condition as shareholders and carries out quarterly performance presentations (via webcasts) to which its shareholders, investors and stakeholders have access. | **YES. Briefly Indicate:** The Corporation offers permanent access mechanisms to its shareholders and investors in fixed income securities. The Company's Web page has a link to information referring to different modalities under which the shareholders may contact the Corporation through the Department of Relations with Investors that addresses the queries or suggestions received from its shareholders about the development of the Corporation or regarding their condition as shareholders and carries out quarterly performance presentations (via webcasts) to which its shareholders, investors and stakeholders have access. |
| **NO. Explain** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** | | |
| **Implementation Date** | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. |
| **Modification Date** |  |  |  |  |

---

**4.3.** The corporation organizes events to present quarterly results to its shareholders and to market analysts. These may be in person or through distant-communication media (conference, video conference, etc.).

---

| | | | | |
|:---|:---|:---|:---|:---|
| **4.3. Measure implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** Annually, the Corporation prepares a calendar of events including quarterly presentations of results with access to which any interested party has access (via webcasts), including shareholders, investors and analysts. The calendar of events may be consulted at the Corporation's Web page. For the case of periodic calls of results, the sane are announced through the Corporation's Web page together with instructions to participate therein. | **YES. Briefly Indicate:** Annually, the Corporation prepares a calendar of events including quarterly presentations of results with access to which any interested party has access (via webcasts), including shareholders, investors and analysts. The calendar of events may be consulted at the Corporation's Web page. For the case of periodic calls of results, the sane are announced through the Corporation's Web page together with instructions to participate therein. | **YES. Briefly Indicate:** Annually, the Corporation prepares a calendar of events including quarterly presentations of results with access to which any interested party has access (via webcasts), including shareholders, investors and analysts. The calendar of events may be consulted at the Corporation's Web page. For the case of periodic calls of results, the sane are announced through the Corporation's Web page together with instructions to participate therein. | **YES. Briefly Indicate:** Annually, the Corporation prepares a calendar of events including quarterly presentations of results with access to which any interested party has access (via webcasts), including shareholders, investors and analysts. The calendar of events may be consulted at the Corporation's Web page. For the case of periodic calls of results, the sane are announced through the Corporation's Web page together with instructions to participate therein. | **YES. Briefly Indicate:** Annually, the Corporation prepares a calendar of events including quarterly presentations of results with access to which any interested party has access (via webcasts), including shareholders, investors and analysts. The calendar of events may be consulted at the Corporation's Web page. For the case of periodic calls of results, the sane are announced through the Corporation's Web page together with instructions to participate therein. |
| <br> **NO. Explain** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** | | |
| **Implementation Date** | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. |
| **Modification Date** |  |  |  |  |

---

**FINANCIAL SUPERINTENDENCE OF COLOMBIA**

***This translation from the original Spanish version is provided for convenience purposes only. No representation is made as to the accuracy of this document and the company does not assume any liability based upon it. Should any doubt or contradiction arise between the Spanish and English versions, the Spanish version shall prevail.***

**4.4.** The corporation organizes or takes part in presentations, events, or fora on fixed-yield instruments, mostly addressed to debt-security investors and market analysts. These events offer updates on the issuer's business indicators, the management of its liabilities, its financial policy, its ratings, its behavior concerning covenants, etc.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **4.4. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** The Corporation attends a number of events of this nature on an annual basis. As part of the dynamics of such events, meetings are held with debt securities investors (one-on-one meetings) and with market analysts wherein information on the developments at the Corporation is updated. The calendar is available in the following link https://www.grupoaval.com/investor-relations/presentations | **YES. Briefly Indicate:** The Corporation attends a number of events of this nature on an annual basis. As part of the dynamics of such events, meetings are held with debt securities investors (one-on-one meetings) and with market analysts wherein information on the developments at the Corporation is updated. The calendar is available in the following link https://www.grupoaval.com/investor-relations/presentations | **YES. Briefly Indicate:** The Corporation attends a number of events of this nature on an annual basis. As part of the dynamics of such events, meetings are held with debt securities investors (one-on-one meetings) and with market analysts wherein information on the developments at the Corporation is updated. The calendar is available in the following link https://www.grupoaval.com/investor-relations/presentations | **YES. Briefly Indicate:** The Corporation attends a number of events of this nature on an annual basis. As part of the dynamics of such events, meetings are held with debt securities investors (one-on-one meetings) and with market analysts wherein information on the developments at the Corporation is updated. The calendar is available in the following link https://www.grupoaval.com/investor-relations/presentations | **YES. Briefly Indicate:** The Corporation attends a number of events of this nature on an annual basis. As part of the dynamics of such events, meetings are held with debt securities investors (one-on-one meetings) and with market analysts wherein information on the developments at the Corporation is updated. The calendar is available in the following link https://www.grupoaval.com/investor-relations/presentations |
| **NO. Explain** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** | |
| **Implementation Date** | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. |
| **Modification Date** |  |  |  |  |

---

**4.5.** The corporation's bylaws provide that a shareholder or group of shareholders, representing at least five percent (5%) of the capital, may request the performance of Specialized Audits on matters other than those pertaining to the audits carried out by the corporation's Statutory Auditor (Revisor Fiscal). Depending on its capital structure, the corporation may determine a proportion below five percent (5%).

---

| | | | | |
|:---|:---|:---|:---|:---|
| **4.5. Measure Implementation** | **YES** | **NO** | **X** | **NA** |
| **YES. Briefly Indicate:**<br>| | | | |
| **NO. Explain:** The Corporate Governance Code states that shareholders representing at least fifteen percent (15%) of the company's outstanding shares, as well as investors in debt securities owning at least twenty-five percent (25%) of the total of commercial securities issued by the Corporation, may hire at their own cost and under their responsibility, specialized audits when they have grounded doubts regarding the quality, reliability and legality of the financial statements disclosed by the company to the authorities and to the general public, about the company's internal control or on the control exercised by the Auditor. | **NO. Explain:** The Corporate Governance Code states that shareholders representing at least fifteen percent (15%) of the company's outstanding shares, as well as investors in debt securities owning at least twenty-five percent (25%) of the total of commercial securities issued by the Corporation, may hire at their own cost and under their responsibility, specialized audits when they have grounded doubts regarding the quality, reliability and legality of the financial statements disclosed by the company to the authorities and to the general public, about the company's internal control or on the control exercised by the Auditor. | **NO. Explain:** The Corporate Governance Code states that shareholders representing at least fifteen percent (15%) of the company's outstanding shares, as well as investors in debt securities owning at least twenty-five percent (25%) of the total of commercial securities issued by the Corporation, may hire at their own cost and under their responsibility, specialized audits when they have grounded doubts regarding the quality, reliability and legality of the financial statements disclosed by the company to the authorities and to the general public, about the company's internal control or on the control exercised by the Auditor. | **NO. Explain:** The Corporate Governance Code states that shareholders representing at least fifteen percent (15%) of the company's outstanding shares, as well as investors in debt securities owning at least twenty-five percent (25%) of the total of commercial securities issued by the Corporation, may hire at their own cost and under their responsibility, specialized audits when they have grounded doubts regarding the quality, reliability and legality of the financial statements disclosed by the company to the authorities and to the general public, about the company's internal control or on the control exercised by the Auditor. | **NO. Explain:** The Corporate Governance Code states that shareholders representing at least fifteen percent (15%) of the company's outstanding shares, as well as investors in debt securities owning at least twenty-five percent (25%) of the total of commercial securities issued by the Corporation, may hire at their own cost and under their responsibility, specialized audits when they have grounded doubts regarding the quality, reliability and legality of the financial statements disclosed by the company to the authorities and to the general public, about the company's internal control or on the control exercised by the Auditor. |
| **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** | | |
| **Implementation Date** | The possibility of requesting specialized audits under the terms established by the Corporation exists prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | The possibility of requesting specialized audits under the terms established by the Corporation exists prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | The possibility of requesting specialized audits under the terms established by the Corporation exists prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | The possibility of requesting specialized audits under the terms established by the Corporation exists prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. |
| **Modification Date** |  |  |  |  |

---

**FINANCIAL SUPERINTENDENCE OF COLOMBIA**

***This translation from the original Spanish version is provided for convenience purposes only. No representation is made as to the accuracy of this document and the company does not assume any liability based upon it. Should any doubt or contradiction arise between the Spanish and English versions, the Spanish version shall prevail.***

**4.6.** For the exercise of this right, the corporation has a written procedure that specifies:

---

| | | | | |
|:---|:---|:---|:---|:---|
| **4.6. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** The Corporation's Corporate Governance Code has a clear procedure that states the requirements for requesting a Specialized Audit, the manner of designating who is going to perform it and who should assume the cost of such Audit. Likewise, it states the specific time periods for the legal representative of the Corporation to answer the request in writing within the 15 business days following the receipt of the latter. In the event that the Legal Representative rejects the request, it will correspond to the Board of Directors to make a final decision on the request, for which purpose it shall have a term of 15 business days. | **YES. Briefly Indicate:** The Corporation's Corporate Governance Code has a clear procedure that states the requirements for requesting a Specialized Audit, the manner of designating who is going to perform it and who should assume the cost of such Audit. Likewise, it states the specific time periods for the legal representative of the Corporation to answer the request in writing within the 15 business days following the receipt of the latter. In the event that the Legal Representative rejects the request, it will correspond to the Board of Directors to make a final decision on the request, for which purpose it shall have a term of 15 business days. | **YES. Briefly Indicate:** The Corporation's Corporate Governance Code has a clear procedure that states the requirements for requesting a Specialized Audit, the manner of designating who is going to perform it and who should assume the cost of such Audit. Likewise, it states the specific time periods for the legal representative of the Corporation to answer the request in writing within the 15 business days following the receipt of the latter. In the event that the Legal Representative rejects the request, it will correspond to the Board of Directors to make a final decision on the request, for which purpose it shall have a term of 15 business days. | **YES. Briefly Indicate:** The Corporation's Corporate Governance Code has a clear procedure that states the requirements for requesting a Specialized Audit, the manner of designating who is going to perform it and who should assume the cost of such Audit. Likewise, it states the specific time periods for the legal representative of the Corporation to answer the request in writing within the 15 business days following the receipt of the latter. In the event that the Legal Representative rejects the request, it will correspond to the Board of Directors to make a final decision on the request, for which purpose it shall have a term of 15 business days. | **YES. Briefly Indicate:** The Corporation's Corporate Governance Code has a clear procedure that states the requirements for requesting a Specialized Audit, the manner of designating who is going to perform it and who should assume the cost of such Audit. Likewise, it states the specific time periods for the legal representative of the Corporation to answer the request in writing within the 15 business days following the receipt of the latter. In the event that the Legal Representative rejects the request, it will correspond to the Board of Directors to make a final decision on the request, for which purpose it shall have a term of 15 business days. |
| **NO. Explain:** | | | | |
| **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** | |
| **Implementation Date** | The possibility of requesting specialized audits under the terms established by the Corporation exists prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | The possibility of requesting specialized audits under the terms established by the Corporation exists prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | The possibility of requesting specialized audits under the terms established by the Corporation exists prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | The possibility of requesting specialized audits under the terms established by the Corporation exists prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. |
| **Modification Date** |  |  |  |  |

---

**Measure No. 5. Management acts before change of control transactions**

**5.1.** The members of the Board of Directors and of the senior management have agreed expressly, in their letters of acceptance or contracts, that as soon as they learn of a take-over bid or other relevant transactions, such as mergers or segregation (spinoffs), there will be periods during which they will not negotiate, directly or indirectly through a third party, any shares of the corporation.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **5.1. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** Each member of the Board of Directors and of the Senior Management of the Corporation has executed a letter of commitment reminding them the main applicable restrictions that regulate the stock market, particularly on the use of confidential and privileged information and establishes the commitment of not negotiating securities issued by the Corporation, directly or indirectly, making use of the confidential or privileged information of the Corporation known during the performance of their duties or carrying out any other activity or behavior breaching the regulations of the stock market, as well as committing themselves not to negotiate directly or indirectly any securities issued by the corporation during the terms defined by the Board of Directors with respect to carrying out or participating in operations that require so due to their significance relevance. | **YES. Briefly Indicate:** Each member of the Board of Directors and of the Senior Management of the Corporation has executed a letter of commitment reminding them the main applicable restrictions that regulate the stock market, particularly on the use of confidential and privileged information and establishes the commitment of not negotiating securities issued by the Corporation, directly or indirectly, making use of the confidential or privileged information of the Corporation known during the performance of their duties or carrying out any other activity or behavior breaching the regulations of the stock market, as well as committing themselves not to negotiate directly or indirectly any securities issued by the corporation during the terms defined by the Board of Directors with respect to carrying out or participating in operations that require so due to their significance relevance. | **YES. Briefly Indicate:** Each member of the Board of Directors and of the Senior Management of the Corporation has executed a letter of commitment reminding them the main applicable restrictions that regulate the stock market, particularly on the use of confidential and privileged information and establishes the commitment of not negotiating securities issued by the Corporation, directly or indirectly, making use of the confidential or privileged information of the Corporation known during the performance of their duties or carrying out any other activity or behavior breaching the regulations of the stock market, as well as committing themselves not to negotiate directly or indirectly any securities issued by the corporation during the terms defined by the Board of Directors with respect to carrying out or participating in operations that require so due to their significance relevance. | **YES. Briefly Indicate:** Each member of the Board of Directors and of the Senior Management of the Corporation has executed a letter of commitment reminding them the main applicable restrictions that regulate the stock market, particularly on the use of confidential and privileged information and establishes the commitment of not negotiating securities issued by the Corporation, directly or indirectly, making use of the confidential or privileged information of the Corporation known during the performance of their duties or carrying out any other activity or behavior breaching the regulations of the stock market, as well as committing themselves not to negotiate directly or indirectly any securities issued by the corporation during the terms defined by the Board of Directors with respect to carrying out or participating in operations that require so due to their significance relevance. | **YES. Briefly Indicate:** Each member of the Board of Directors and of the Senior Management of the Corporation has executed a letter of commitment reminding them the main applicable restrictions that regulate the stock market, particularly on the use of confidential and privileged information and establishes the commitment of not negotiating securities issued by the Corporation, directly or indirectly, making use of the confidential or privileged information of the Corporation known during the performance of their duties or carrying out any other activity or behavior breaching the regulations of the stock market, as well as committing themselves not to negotiate directly or indirectly any securities issued by the corporation during the terms defined by the Board of Directors with respect to carrying out or participating in operations that require so due to their significance relevance. |
| **NO. Explain:** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** |  |
| **Implementation Date** | The execution of the Letter of Commitment was implemented in year 2015 adopting the recommendation proposed by the New Country Code. | The execution of the Letter of Commitment was implemented in year 2015 adopting the recommendation proposed by the New Country Code. | The execution of the Letter of Commitment was implemented in year 2015 adopting the recommendation proposed by the New Country Code. | The execution of the Letter of Commitment was implemented in year 2015 adopting the recommendation proposed by the New Country Code. |
| **Modification Date** |  |  |  |  |

---

**Measure No. 6. Relationships between the corporations belonging to the Conglomerate** 

**6.1.** Without prejudice to the independence of every single company of the conglomerate and to the responsibilities of its management bodies, the conglomerate has an organizational structure that defines for the three (3) governance levels (Shareholders Assembly, Board of Directors, and senior management), the key bodies and individual positions and the relations between them. Such a structure is public, evident, and transparent; it determines clear responsibility and communication channels; it facilitates the conglomerate's strategic direction, and its effective supervision, control, and management.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **6.1. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** In addition to its Code of Corporate Governance, Grupo Aval has a Reference Framework of Institutional Relations approved by its Board of Directors, establishing an organizational structure defining the key bodies and job positions for the Corporation and for its main subordinate institutions; the criteria applicable to their relationships, lines of responsibility and communication, with the objective, among others, of facilitating the effective strategic orientation, supervision, control and effective management of the Corporation and its subordinates. Such document has a public nature and is available at the Corporation's web site. | **YES. Briefly Indicate:** In addition to its Code of Corporate Governance, Grupo Aval has a Reference Framework of Institutional Relations approved by its Board of Directors, establishing an organizational structure defining the key bodies and job positions for the Corporation and for its main subordinate institutions; the criteria applicable to their relationships, lines of responsibility and communication, with the objective, among others, of facilitating the effective strategic orientation, supervision, control and effective management of the Corporation and its subordinates. Such document has a public nature and is available at the Corporation's web site. | **YES. Briefly Indicate:** In addition to its Code of Corporate Governance, Grupo Aval has a Reference Framework of Institutional Relations approved by its Board of Directors, establishing an organizational structure defining the key bodies and job positions for the Corporation and for its main subordinate institutions; the criteria applicable to their relationships, lines of responsibility and communication, with the objective, among others, of facilitating the effective strategic orientation, supervision, control and effective management of the Corporation and its subordinates. Such document has a public nature and is available at the Corporation's web site. | **YES. Briefly Indicate:** In addition to its Code of Corporate Governance, Grupo Aval has a Reference Framework of Institutional Relations approved by its Board of Directors, establishing an organizational structure defining the key bodies and job positions for the Corporation and for its main subordinate institutions; the criteria applicable to their relationships, lines of responsibility and communication, with the objective, among others, of facilitating the effective strategic orientation, supervision, control and effective management of the Corporation and its subordinates. Such document has a public nature and is available at the Corporation's web site. | **YES. Briefly Indicate:** In addition to its Code of Corporate Governance, Grupo Aval has a Reference Framework of Institutional Relations approved by its Board of Directors, establishing an organizational structure defining the key bodies and job positions for the Corporation and for its main subordinate institutions; the criteria applicable to their relationships, lines of responsibility and communication, with the objective, among others, of facilitating the effective strategic orientation, supervision, control and effective management of the Corporation and its subordinates. Such document has a public nature and is available at the Corporation's web site. |
| **NO. Explain:** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** |  |
| **Implementation Date** | Implemented in the Code of Corporate Governance prior to year 2015 and complemented adopting the recommendation proposed by the New Country Code. | Implemented in the Code of Corporate Governance prior to year 2015 and complemented adopting the recommendation proposed by the New Country Code. | Implemented in the Code of Corporate Governance prior to year 2015 and complemented adopting the recommendation proposed by the New Country Code. | Implemented in the Code of Corporate Governance prior to year 2015 and complemented adopting the recommendation proposed by the New Country Code. |
| **Modification Date** |  |  |  |  |

---

**6.2.** Under the previous provision, the holding company and its most important subordinates have defined a framework for institutional relations through the subscription of an agreement. Such an agreement is public, has been approved by the Board of Directors of each of the companies, and regulates the issues mention on recommendation 6.2.

**FINANCIAL SUPERINTENDENCE OF COLOMBIA**

***This translation from the original Spanish version is provided for convenience purposes only. No representation is made as to the accuracy of this document and the company does not assume any liability based upon it. Should any doubt or contradiction arise between the Spanish and English versions, the Spanish version shall prevail.***

---

| | | | | |
|:---|:---|:---|:---|:---|
| **6.2. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** In addition to its Corporate Governance Code, the Company defined a Reference Framework of Institutional Relations approved by its Board of Directors regulating the issues stated under recommendation 6.2. Such document has a public nature and is available at the Corporation's web site. | **YES. Briefly Indicate:** In addition to its Corporate Governance Code, the Company defined a Reference Framework of Institutional Relations approved by its Board of Directors regulating the issues stated under recommendation 6.2. Such document has a public nature and is available at the Corporation's web site. | **YES. Briefly Indicate:** In addition to its Corporate Governance Code, the Company defined a Reference Framework of Institutional Relations approved by its Board of Directors regulating the issues stated under recommendation 6.2. Such document has a public nature and is available at the Corporation's web site. | **YES. Briefly Indicate:** In addition to its Corporate Governance Code, the Company defined a Reference Framework of Institutional Relations approved by its Board of Directors regulating the issues stated under recommendation 6.2. Such document has a public nature and is available at the Corporation's web site. | **YES. Briefly Indicate:** In addition to its Corporate Governance Code, the Company defined a Reference Framework of Institutional Relations approved by its Board of Directors regulating the issues stated under recommendation 6.2. Such document has a public nature and is available at the Corporation's web site. |
| **NO. Explain:** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** |  |
| **Implementation Date** | Implemented in 2015 adopting the recommendation proposed by the New Country Code. | Implemented in 2015 adopting the recommendation proposed by the New Country Code. | Implemented in 2015 adopting the recommendation proposed by the New Country Code. | Implemented in 2015 adopting the recommendation proposed by the New Country Code. |
| **Modification Date** |  |  |  |  |

---

**Measure No. 7. Conflict Resolution.** 

**7.1.** Except for the disputes between shareholders, or between shareholders and the corporation or its Board of Directors that by explicit legal mandate must be settled necessarily before the ordinary jurisdiction, the corporation's bylaws include conflict-resolution mechanisms such as direct agreements, amicable composition, settlement, or arbitration.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **7.1. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** The Bylaws of the Corporation (Art. 40) contain an arbitration clause for purposes of solving any differences that may arise between shareholders or between the same and the Corporation, deriving from the performance of its Bylaws or its liquidation. | **YES. Briefly Indicate:** The Bylaws of the Corporation (Art. 40) contain an arbitration clause for purposes of solving any differences that may arise between shareholders or between the same and the Corporation, deriving from the performance of its Bylaws or its liquidation. | **YES. Briefly Indicate:** The Bylaws of the Corporation (Art. 40) contain an arbitration clause for purposes of solving any differences that may arise between shareholders or between the same and the Corporation, deriving from the performance of its Bylaws or its liquidation. | **YES. Briefly Indicate:** The Bylaws of the Corporation (Art. 40) contain an arbitration clause for purposes of solving any differences that may arise between shareholders or between the same and the Corporation, deriving from the performance of its Bylaws or its liquidation. | **YES. Briefly Indicate:** The Bylaws of the Corporation (Art. 40) contain an arbitration clause for purposes of solving any differences that may arise between shareholders or between the same and the Corporation, deriving from the performance of its Bylaws or its liquidation. |
| **NO. Explain:** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** |  |
| **Implementation Date** | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. |
| **Modification Date** |  |  |  |  |

---

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;**II. GENERAL SHAREHOLDERS MEETING**

**Measure No. 8. Functions and Competence.** 

**FINANCIAL SUPERINTENDENCE OF COLOMBIA**

***This translation from the original Spanish version is provided for convenience purposes only. No representation is made as to the accuracy of this document and the company does not assume any liability based upon it. Should any doubt or contradiction arise between the Spanish and English versions, the Spanish version shall prevail.***

**8.1.** Besides other functions assigned to the General Assembly of Shareholders by the legal framework, the bylaws explicitly confer the functions of the General Shareholders Meeting mentioned on recommendation 8.1. and emphasize their exclusive and non-delegable nature

---

| | | | | |
|:---|:---|:---|:---|:---|
| **8.1. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** In an extraordinary meeting of the shareholders effected on December 21, 2015, the Company modified its by-laws to include as part of the specific responsibilities of the Shareholders' Meeting the one referred to in Recommendation 8.1.<br>As a result of the foregoing, the Corporate By laws (Art. 19) establish as a duty of the Shareholders' Meeting: To approve the general policy of appointments and remuneration of the Board of Directors and to approve the acquisition, sale or encumbrances of assets and the segregation operations, also known as segregation, whose amount exceeds twenty-five percent (25%) of the total assets of the Corporation, calculated with respect to its separate financial statements of the immediately preceding fiscal year.<br>By adding these responsibilities as part of the duties of the Shareholders' Meeting without any possibility for the shareholders to delegate these to any other corporate body, such responsibilities are considered exclusive and non-delegable duty of the Shareholders' meeting.<br>Regarding the Succession Policy of the Board of Directors; Article 19 numerals 2, 4 and 16 of the Company's Bylaws established the criteria applicable to the nomination, election, re-election or replacement of the members of the Company's Board of Directors. According to this, the General Policy of Appointment and Remuneration of the Board of Directors is applicable when the need arises to replace (succeed) one or more members of the Board. | **YES. Briefly Indicate:** In an extraordinary meeting of the shareholders effected on December 21, 2015, the Company modified its by-laws to include as part of the specific responsibilities of the Shareholders' Meeting the one referred to in Recommendation 8.1.<br>As a result of the foregoing, the Corporate By laws (Art. 19) establish as a duty of the Shareholders' Meeting: To approve the general policy of appointments and remuneration of the Board of Directors and to approve the acquisition, sale or encumbrances of assets and the segregation operations, also known as segregation, whose amount exceeds twenty-five percent (25%) of the total assets of the Corporation, calculated with respect to its separate financial statements of the immediately preceding fiscal year.<br>By adding these responsibilities as part of the duties of the Shareholders' Meeting without any possibility for the shareholders to delegate these to any other corporate body, such responsibilities are considered exclusive and non-delegable duty of the Shareholders' meeting.<br>Regarding the Succession Policy of the Board of Directors; Article 19 numerals 2, 4 and 16 of the Company's Bylaws established the criteria applicable to the nomination, election, re-election or replacement of the members of the Company's Board of Directors. According to this, the General Policy of Appointment and Remuneration of the Board of Directors is applicable when the need arises to replace (succeed) one or more members of the Board. | **YES. Briefly Indicate:** In an extraordinary meeting of the shareholders effected on December 21, 2015, the Company modified its by-laws to include as part of the specific responsibilities of the Shareholders' Meeting the one referred to in Recommendation 8.1.<br>As a result of the foregoing, the Corporate By laws (Art. 19) establish as a duty of the Shareholders' Meeting: To approve the general policy of appointments and remuneration of the Board of Directors and to approve the acquisition, sale or encumbrances of assets and the segregation operations, also known as segregation, whose amount exceeds twenty-five percent (25%) of the total assets of the Corporation, calculated with respect to its separate financial statements of the immediately preceding fiscal year.<br>By adding these responsibilities as part of the duties of the Shareholders' Meeting without any possibility for the shareholders to delegate these to any other corporate body, such responsibilities are considered exclusive and non-delegable duty of the Shareholders' meeting.<br>Regarding the Succession Policy of the Board of Directors; Article 19 numerals 2, 4 and 16 of the Company's Bylaws established the criteria applicable to the nomination, election, re-election or replacement of the members of the Company's Board of Directors. According to this, the General Policy of Appointment and Remuneration of the Board of Directors is applicable when the need arises to replace (succeed) one or more members of the Board. | **YES. Briefly Indicate:** In an extraordinary meeting of the shareholders effected on December 21, 2015, the Company modified its by-laws to include as part of the specific responsibilities of the Shareholders' Meeting the one referred to in Recommendation 8.1.<br>As a result of the foregoing, the Corporate By laws (Art. 19) establish as a duty of the Shareholders' Meeting: To approve the general policy of appointments and remuneration of the Board of Directors and to approve the acquisition, sale or encumbrances of assets and the segregation operations, also known as segregation, whose amount exceeds twenty-five percent (25%) of the total assets of the Corporation, calculated with respect to its separate financial statements of the immediately preceding fiscal year.<br>By adding these responsibilities as part of the duties of the Shareholders' Meeting without any possibility for the shareholders to delegate these to any other corporate body, such responsibilities are considered exclusive and non-delegable duty of the Shareholders' meeting.<br>Regarding the Succession Policy of the Board of Directors; Article 19 numerals 2, 4 and 16 of the Company's Bylaws established the criteria applicable to the nomination, election, re-election or replacement of the members of the Company's Board of Directors. According to this, the General Policy of Appointment and Remuneration of the Board of Directors is applicable when the need arises to replace (succeed) one or more members of the Board. | **YES. Briefly Indicate:** In an extraordinary meeting of the shareholders effected on December 21, 2015, the Company modified its by-laws to include as part of the specific responsibilities of the Shareholders' Meeting the one referred to in Recommendation 8.1.<br>As a result of the foregoing, the Corporate By laws (Art. 19) establish as a duty of the Shareholders' Meeting: To approve the general policy of appointments and remuneration of the Board of Directors and to approve the acquisition, sale or encumbrances of assets and the segregation operations, also known as segregation, whose amount exceeds twenty-five percent (25%) of the total assets of the Corporation, calculated with respect to its separate financial statements of the immediately preceding fiscal year.<br>By adding these responsibilities as part of the duties of the Shareholders' Meeting without any possibility for the shareholders to delegate these to any other corporate body, such responsibilities are considered exclusive and non-delegable duty of the Shareholders' meeting.<br>Regarding the Succession Policy of the Board of Directors; Article 19 numerals 2, 4 and 16 of the Company's Bylaws established the criteria applicable to the nomination, election, re-election or replacement of the members of the Company's Board of Directors. According to this, the General Policy of Appointment and Remuneration of the Board of Directors is applicable when the need arises to replace (succeed) one or more members of the Board. |
| **NO. Explain:** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** |  |
| **Implementation Date** | Implemented in 2015 adopting the recommendation proposed by the New Country Code. | Implemented in 2015 adopting the recommendation proposed by the New Country Code. | Implemented in 2015 adopting the recommendation proposed by the New Country Code. | Implemented in 2015 adopting the recommendation proposed by the New Country Code. |
| **Modification Date** |  |  |  |  |

---

**Measure No. 9. General Shareholders Meeting Regulations**

**9.1.** The corporation has a regulation for the General Assembly of Shareholders, which set up any tasks within its competence. They range from its meeting calls, to the preparation of the information intended for shareholders, their attendance, the development and exercise of their political rights, so that they are fully aware about the regime that governs the Assembly's sessions.

**FINANCIAL SUPERINTENDENCE OF COLOMBIA**

***This translation from the original Spanish version is provided for convenience purposes only. No representation is made as to the accuracy of this document and the company does not assume any liability based upon it. Should any doubt or contradiction arise between the Spanish and English versions, the Spanish version shall prevail.***

---

| | | | | |
|:---|:---|:---|:---|:---|
| **9.1. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** The Corporation has a Regulation of the General Shareholders Meeting regarding the matters pertaining thereto, including references to calls, information that the shareholders should receive, attendance, development and exercise of the political rights of the shareholders. Such Regulation is published in the Corporation's web site. | **YES. Briefly Indicate:** The Corporation has a Regulation of the General Shareholders Meeting regarding the matters pertaining thereto, including references to calls, information that the shareholders should receive, attendance, development and exercise of the political rights of the shareholders. Such Regulation is published in the Corporation's web site. | **YES. Briefly Indicate:** The Corporation has a Regulation of the General Shareholders Meeting regarding the matters pertaining thereto, including references to calls, information that the shareholders should receive, attendance, development and exercise of the political rights of the shareholders. Such Regulation is published in the Corporation's web site. | **YES. Briefly Indicate:** The Corporation has a Regulation of the General Shareholders Meeting regarding the matters pertaining thereto, including references to calls, information that the shareholders should receive, attendance, development and exercise of the political rights of the shareholders. Such Regulation is published in the Corporation's web site. | **YES. Briefly Indicate:** The Corporation has a Regulation of the General Shareholders Meeting regarding the matters pertaining thereto, including references to calls, information that the shareholders should receive, attendance, development and exercise of the political rights of the shareholders. Such Regulation is published in the Corporation's web site. |
| **NO. Explain:** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** |  |
| **Implementation Date** | Implemented in 2015 adopting the recommendation proposed by the New Country Code. | Implemented in 2015 adopting the recommendation proposed by the New Country Code. | Implemented in 2015 adopting the recommendation proposed by the New Country Code. | Implemented in 2015 adopting the recommendation proposed by the New Country Code. |
| **Modification Date** |  |  |  |  |

---

**Measure No. 10. Meeting Summons**

**10.1.** To ease the shareholders' exercise of their information rights, the bylaws provide that the meeting call for the ordinary General Assembly of Shareholders must take place no less than thirty (30) common days in advance; in the case of the extraordinary meetings, the call will take place with at least fifteen (15) common days of anticipation. This will be without prejudice to the legal terms set forth for company restructuring (e.g. mergers, segregation (spinoffs), or transformations).

---

| | | | | |
|:---|:---|:---|:---|:---|
| **10.1. Measure Implementation** | **YES** | **NO** | **X** | **NA** |
| **YES. Briefly Indicate:** | **YES. Briefly Indicate:** | **YES. Briefly Indicate:** | **YES. Briefly Indicate:** | **YES. Briefly Indicate:** |
| **NO. Explain:** The Corporation deems that it has adequate mechanisms for applying the law, the By laws and its Corporate Governance architecture which offer an adequate disclosure of the calls to General Shareholders Meetings, facilitating and promoting the exercise of the right to information of its shareholders and that in development of the same it attends the information requests submitted and relating to the matters subject matter of the call. | **NO. Explain:** The Corporation deems that it has adequate mechanisms for applying the law, the By laws and its Corporate Governance architecture which offer an adequate disclosure of the calls to General Shareholders Meetings, facilitating and promoting the exercise of the right to information of its shareholders and that in development of the same it attends the information requests submitted and relating to the matters subject matter of the call. | **NO. Explain:** The Corporation deems that it has adequate mechanisms for applying the law, the By laws and its Corporate Governance architecture which offer an adequate disclosure of the calls to General Shareholders Meetings, facilitating and promoting the exercise of the right to information of its shareholders and that in development of the same it attends the information requests submitted and relating to the matters subject matter of the call. | **NO. Explain:** The Corporation deems that it has adequate mechanisms for applying the law, the By laws and its Corporate Governance architecture which offer an adequate disclosure of the calls to General Shareholders Meetings, facilitating and promoting the exercise of the right to information of its shareholders and that in development of the same it attends the information requests submitted and relating to the matters subject matter of the call. | **NO. Explain:** The Corporation deems that it has adequate mechanisms for applying the law, the By laws and its Corporate Governance architecture which offer an adequate disclosure of the calls to General Shareholders Meetings, facilitating and promoting the exercise of the right to information of its shareholders and that in development of the same it attends the information requests submitted and relating to the matters subject matter of the call. |
| **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** |  |  |
| **Implementation Date** | Does Not Apply. | Does Not Apply. | Does Not Apply. | Does Not Apply. |
| **Modification Date** |  |  |  |  |

---

**FINANCIAL SUPERINTENDENCE OF COLOMBIA**

***This translation from the original Spanish version is provided for convenience purposes only. No representation is made as to the accuracy of this document and the company does not assume any liability based upon it. Should any doubt or contradiction arise between the Spanish and English versions, the Spanish version shall prevail.***

**10.2.** Besides the traditional and obligatory media set forth within the legal framework, the corporation ensures the widest communication and publicity for the meeting call. This will be done by using e-media, such as the corporate web site, individual alerting e-mails, and even the social networks if deemed appropriate.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **10.2. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** The Corporation makes use of its corporate web for disclosing the calls to General Shareholders Meetings. The information is available for consulting in https://www.grupoaval.com/investor-relations/information-for-shareholders-and-bondholders-meetings | **YES. Briefly Indicate:** The Corporation makes use of its corporate web for disclosing the calls to General Shareholders Meetings. The information is available for consulting in https://www.grupoaval.com/investor-relations/information-for-shareholders-and-bondholders-meetings | **YES. Briefly Indicate:** The Corporation makes use of its corporate web for disclosing the calls to General Shareholders Meetings. The information is available for consulting in https://www.grupoaval.com/investor-relations/information-for-shareholders-and-bondholders-meetings | **YES. Briefly Indicate:** The Corporation makes use of its corporate web for disclosing the calls to General Shareholders Meetings. The information is available for consulting in https://www.grupoaval.com/investor-relations/information-for-shareholders-and-bondholders-meetings | **YES. Briefly Indicate:** The Corporation makes use of its corporate web for disclosing the calls to General Shareholders Meetings. The information is available for consulting in https://www.grupoaval.com/investor-relations/information-for-shareholders-and-bondholders-meetings |
| **NO. Explain:** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** |  |
| **Implementation Date** | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. |
| **Modification Date** |  |  |  |  |

---

**10.3.** For increased transparency during the decision-making process of the General Assembly, besides its Agenda, stating point by point the subjects for discussion, the corporation ensures that simultaneously with the meeting call, or at least fifteen (15) common days before the meeting, the shareholders receive the Agreement Proposals that the Board of Directors will submit to the General Assembly of Shareholders concerning each of those points.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **10.3. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate.** The Company's Code of Good Governance describes the process to make available to shareholders, through its website, the proposals that the Board of Directors must submit for consideration of the Shareholders. Also, the company complies with all applicable regulations for exercising the right of inspection. Additionally, it makes available for its shareholders **within** 15 business days prior to the annual meeting, the following information in its web page: **(i)** Summons to Shareholders Meeting and detailed agenda, **(ii)** Financial information and relevant documentation for making decisions by the General Shareholders Meeting, including when applicable, the Project for the distribution of profits, **(iii)** When the election of the Board of Directors forms part of the agenda, list of candidates proposed by the shareholders to form part of such body, in the event that such information is known prior to the Meeting and, **(iv)** Any other relevant information for purposes of the Meeting, provided that the same is available. | **YES. Briefly Indicate.** The Company's Code of Good Governance describes the process to make available to shareholders, through its website, the proposals that the Board of Directors must submit for consideration of the Shareholders. Also, the company complies with all applicable regulations for exercising the right of inspection. Additionally, it makes available for its shareholders **within** 15 business days prior to the annual meeting, the following information in its web page: **(i)** Summons to Shareholders Meeting and detailed agenda, **(ii)** Financial information and relevant documentation for making decisions by the General Shareholders Meeting, including when applicable, the Project for the distribution of profits, **(iii)** When the election of the Board of Directors forms part of the agenda, list of candidates proposed by the shareholders to form part of such body, in the event that such information is known prior to the Meeting and, **(iv)** Any other relevant information for purposes of the Meeting, provided that the same is available. | **YES. Briefly Indicate.** The Company's Code of Good Governance describes the process to make available to shareholders, through its website, the proposals that the Board of Directors must submit for consideration of the Shareholders. Also, the company complies with all applicable regulations for exercising the right of inspection. Additionally, it makes available for its shareholders **within** 15 business days prior to the annual meeting, the following information in its web page: **(i)** Summons to Shareholders Meeting and detailed agenda, **(ii)** Financial information and relevant documentation for making decisions by the General Shareholders Meeting, including when applicable, the Project for the distribution of profits, **(iii)** When the election of the Board of Directors forms part of the agenda, list of candidates proposed by the shareholders to form part of such body, in the event that such information is known prior to the Meeting and, **(iv)** Any other relevant information for purposes of the Meeting, provided that the same is available. | **YES. Briefly Indicate.** The Company's Code of Good Governance describes the process to make available to shareholders, through its website, the proposals that the Board of Directors must submit for consideration of the Shareholders. Also, the company complies with all applicable regulations for exercising the right of inspection. Additionally, it makes available for its shareholders **within** 15 business days prior to the annual meeting, the following information in its web page: **(i)** Summons to Shareholders Meeting and detailed agenda, **(ii)** Financial information and relevant documentation for making decisions by the General Shareholders Meeting, including when applicable, the Project for the distribution of profits, **(iii)** When the election of the Board of Directors forms part of the agenda, list of candidates proposed by the shareholders to form part of such body, in the event that such information is known prior to the Meeting and, **(iv)** Any other relevant information for purposes of the Meeting, provided that the same is available. | **YES. Briefly Indicate.** The Company's Code of Good Governance describes the process to make available to shareholders, through its website, the proposals that the Board of Directors must submit for consideration of the Shareholders. Also, the company complies with all applicable regulations for exercising the right of inspection. Additionally, it makes available for its shareholders **within** 15 business days prior to the annual meeting, the following information in its web page: **(i)** Summons to Shareholders Meeting and detailed agenda, **(ii)** Financial information and relevant documentation for making decisions by the General Shareholders Meeting, including when applicable, the Project for the distribution of profits, **(iii)** When the election of the Board of Directors forms part of the agenda, list of candidates proposed by the shareholders to form part of such body, in the event that such information is known prior to the Meeting and, **(iv)** Any other relevant information for purposes of the Meeting, provided that the same is available. |
| **NO. Explain:** | **NO. Explain:** | **NO. Explain:** | **NO. Explain:** | **NO. Explain:** |
| **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** | |
| **Implementation Date** | Does Not Apply. | Does Not Apply. | Does Not Apply. | Does Not Apply. |
| **Modification Date** |  |  |  |  |

---

**FINANCIAL SUPERINTENDENCE OF COLOMBIA**

***This translation from the original Spanish version is provided for convenience purposes only. No representation is made as to the accuracy of this document and the company does not assume any liability based upon it. Should any doubt or contradiction arise between the Spanish and English versions, the Spanish version shall prevail.***

**10.4.** The General Assembly of Shareholders will analyze and approve the corporation's segregation (spinoffs) (*escisión impropia*) only when this subject had been included explicitly in the respective meeting call.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **10.4. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** The Regulation of the General Shareholders Meeting of the Corporation states that the segregation, may only be considered an approved by the Meeting when such issue has been expressly included in the Summons Notice for the respective meeting. | **YES. Briefly Indicate:** The Regulation of the General Shareholders Meeting of the Corporation states that the segregation, may only be considered an approved by the Meeting when such issue has been expressly included in the Summons Notice for the respective meeting. | **YES. Briefly Indicate:** The Regulation of the General Shareholders Meeting of the Corporation states that the segregation, may only be considered an approved by the Meeting when such issue has been expressly included in the Summons Notice for the respective meeting. | **YES. Briefly Indicate:** The Regulation of the General Shareholders Meeting of the Corporation states that the segregation, may only be considered an approved by the Meeting when such issue has been expressly included in the Summons Notice for the respective meeting. | **YES. Briefly Indicate:** The Regulation of the General Shareholders Meeting of the Corporation states that the segregation, may only be considered an approved by the Meeting when such issue has been expressly included in the Summons Notice for the respective meeting. |
| **NO. Explain.** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** |  |
| **Implementation Date** | Implemented in 2015 adopting the recommendation proposed by the New Country Code. | Implemented in 2015 adopting the recommendation proposed by the New Country Code. | Implemented in 2015 adopting the recommendation proposed by the New Country Code. | Implemented in 2015 adopting the recommendation proposed by the New Country Code. |
| **Modification Date** |  |  |  |  |

---

**10.5.** The Agenda that the Board of Directors is proposing features the subjects for discussion accurately. It does not permit that any significant issues become obscured under imprecise, nonspecific, overly general, or very wide expressions such as "others" or "proposals and miscellaneous."

---

| | | | | |
|:---|:---|:---|:---|:---|
| **10.5. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** The Agenda proposed by the Board of Directors contains the content of the issues to be addressed accurately. | **YES. Briefly Indicate:** The Agenda proposed by the Board of Directors contains the content of the issues to be addressed accurately. | **YES. Briefly Indicate:** The Agenda proposed by the Board of Directors contains the content of the issues to be addressed accurately. | **YES. Briefly Indicate:** The Agenda proposed by the Board of Directors contains the content of the issues to be addressed accurately. | **YES. Briefly Indicate:** The Agenda proposed by the Board of Directors contains the content of the issues to be addressed accurately. |
| **NO. Explain.** |  |  |  | |
| **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** | |
| **Implementation Date** | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. |
| **Modification Date** |  |  |  |  |

---

**10.6.** In the case of amendments to the bylaws, each article or group of articles substantially different will be voted separately. In any case, an article will be voted separately if any shareholder or group of shareholders, representing at least five percent (5%) of the corporate capital, request it during the Assembly. The shareholders will be informed of this right beforehand.

**FINANCIAL SUPERINTENDENCE OF COLOMBIA**

***This translation from the original Spanish version is provided for convenience purposes only. No representation is made as to the accuracy of this document and the company does not assume any liability based upon it. Should any doubt or contradiction arise between the Spanish and English versions, the Spanish version shall prevail.***

---

| | | | | |
|:---|:---|:---|:---|:---|
| **10.6. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** The Regulation of the General Shareholders Meeting of the Corporation states that in the event of modification of the By laws each article will be voted on separately or in groups of articles when the same refer to substantially independent matters. Additionally, an article will be voted upon separately if a shareholder or group of shareholders, representing at least five percent of the capital stock requests so to the Meeting. | **YES. Briefly Indicate:** The Regulation of the General Shareholders Meeting of the Corporation states that in the event of modification of the By laws each article will be voted on separately or in groups of articles when the same refer to substantially independent matters. Additionally, an article will be voted upon separately if a shareholder or group of shareholders, representing at least five percent of the capital stock requests so to the Meeting. | **YES. Briefly Indicate:** The Regulation of the General Shareholders Meeting of the Corporation states that in the event of modification of the By laws each article will be voted on separately or in groups of articles when the same refer to substantially independent matters. Additionally, an article will be voted upon separately if a shareholder or group of shareholders, representing at least five percent of the capital stock requests so to the Meeting. | **YES. Briefly Indicate:** The Regulation of the General Shareholders Meeting of the Corporation states that in the event of modification of the By laws each article will be voted on separately or in groups of articles when the same refer to substantially independent matters. Additionally, an article will be voted upon separately if a shareholder or group of shareholders, representing at least five percent of the capital stock requests so to the Meeting. | **YES. Briefly Indicate:** The Regulation of the General Shareholders Meeting of the Corporation states that in the event of modification of the By laws each article will be voted on separately or in groups of articles when the same refer to substantially independent matters. Additionally, an article will be voted upon separately if a shareholder or group of shareholders, representing at least five percent of the capital stock requests so to the Meeting. |
| **NO. Explain.** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** |  |
| **Implementation Date** | Implemented in 2015 adopting the recommendation proposed by the New Country Code. | Implemented in 2015 adopting the recommendation proposed by the New Country Code. | Implemented in 2015 adopting the recommendation proposed by the New Country Code. | Implemented in 2015 adopting the recommendation proposed by the New Country Code. |
| **Modification Date** |  |  |  |  |

---

**10.7** Without prejudice to the article 182 of the Code of Commerce, to strengthen and ensure the shareholders' rights of inspection and information before the Assembly, the bylaws recognize their right to propose the inclusion of one or more points for discussion within the Agenda of the General Assembly of Shareholders, regardless of the size of their stock participation. This will take place within reasonable period of time and provided that their request includes a justification. The shareholders will make such a request within five (5) common days following the publication of the meeting call.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **10.7. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** The Regulation of the General Shareholders Meeting of the Corporation states that without prejudice to what is set forth under articles 182 and 425 of the Colombian Code of Commerce, regarding the issues that the Meeting can address, any stockholder, independently of the size of its share interest may propose the inclusion of issues additional to those for which the Meeting was called, subject to compliance of the requirements established by such Regulation, including, the filing of a written request within five calendar days following the publication of the Summons Notice. | **YES. Briefly Indicate:** The Regulation of the General Shareholders Meeting of the Corporation states that without prejudice to what is set forth under articles 182 and 425 of the Colombian Code of Commerce, regarding the issues that the Meeting can address, any stockholder, independently of the size of its share interest may propose the inclusion of issues additional to those for which the Meeting was called, subject to compliance of the requirements established by such Regulation, including, the filing of a written request within five calendar days following the publication of the Summons Notice. | **YES. Briefly Indicate:** The Regulation of the General Shareholders Meeting of the Corporation states that without prejudice to what is set forth under articles 182 and 425 of the Colombian Code of Commerce, regarding the issues that the Meeting can address, any stockholder, independently of the size of its share interest may propose the inclusion of issues additional to those for which the Meeting was called, subject to compliance of the requirements established by such Regulation, including, the filing of a written request within five calendar days following the publication of the Summons Notice. | **YES. Briefly Indicate:** The Regulation of the General Shareholders Meeting of the Corporation states that without prejudice to what is set forth under articles 182 and 425 of the Colombian Code of Commerce, regarding the issues that the Meeting can address, any stockholder, independently of the size of its share interest may propose the inclusion of issues additional to those for which the Meeting was called, subject to compliance of the requirements established by such Regulation, including, the filing of a written request within five calendar days following the publication of the Summons Notice. | **YES. Briefly Indicate:** The Regulation of the General Shareholders Meeting of the Corporation states that without prejudice to what is set forth under articles 182 and 425 of the Colombian Code of Commerce, regarding the issues that the Meeting can address, any stockholder, independently of the size of its share interest may propose the inclusion of issues additional to those for which the Meeting was called, subject to compliance of the requirements established by such Regulation, including, the filing of a written request within five calendar days following the publication of the Summons Notice. |
| **NO. Explain.** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** |  |
| **Implementation Date** | Implemented in 2015 adopting the recommendation proposed by the New Country Code. | Implemented in 2015 adopting the recommendation proposed by the New Country Code. | Implemented in 2015 adopting the recommendation proposed by the New Country Code. | Implemented in 2015 adopting the recommendation proposed by the New Country Code. |
| **Modification Date** |  |  |  |  |

---

**FINANCIAL SUPERINTENDENCE OF COLOMBIA**

***This translation from the original Spanish version is provided for convenience purposes only. No representation is made as to the accuracy of this document and the company does not assume any liability based upon it. Should any doubt or contradiction arise between the Spanish and English versions, the Spanish version shall prevail.***

**10.8.** If the Board of Director refuses the request, it must reply in writing to those requests supported by at least five percent (5%) of the corporate capital, or a lower proportion as provided by the company based on its degree of ownership concentration. In such a reply, it will explain the reasons for its decision, and inform the shareholders of their right to make proposals during the Assembly, under the provisions of the abovementioned article 182 of the Code of Commerce.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **10.8. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** The Regulation of the General Shareholders Meeting of the Corporation states that once the request has been received and upon verification of compliance with the conditions for the introduction of inclusion of more items in the agenda, regarding the events where the request is supported by shareholders representing five percent or more of the capital stock, the Board of Directors shall deal with such request and provide an answer to the requesting party in the event that the same is dismissed. | **YES. Briefly Indicate:** The Regulation of the General Shareholders Meeting of the Corporation states that once the request has been received and upon verification of compliance with the conditions for the introduction of inclusion of more items in the agenda, regarding the events where the request is supported by shareholders representing five percent or more of the capital stock, the Board of Directors shall deal with such request and provide an answer to the requesting party in the event that the same is dismissed. | **YES. Briefly Indicate:** The Regulation of the General Shareholders Meeting of the Corporation states that once the request has been received and upon verification of compliance with the conditions for the introduction of inclusion of more items in the agenda, regarding the events where the request is supported by shareholders representing five percent or more of the capital stock, the Board of Directors shall deal with such request and provide an answer to the requesting party in the event that the same is dismissed. | **YES. Briefly Indicate:** The Regulation of the General Shareholders Meeting of the Corporation states that once the request has been received and upon verification of compliance with the conditions for the introduction of inclusion of more items in the agenda, regarding the events where the request is supported by shareholders representing five percent or more of the capital stock, the Board of Directors shall deal with such request and provide an answer to the requesting party in the event that the same is dismissed. | **YES. Briefly Indicate:** The Regulation of the General Shareholders Meeting of the Corporation states that once the request has been received and upon verification of compliance with the conditions for the introduction of inclusion of more items in the agenda, regarding the events where the request is supported by shareholders representing five percent or more of the capital stock, the Board of Directors shall deal with such request and provide an answer to the requesting party in the event that the same is dismissed. |
| **NO. Explain.** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** |  |
| **Implementation Date** | Implemented in 2015 adopting the recommendation proposed by the New Country Code. | Implemented in 2015 adopting the recommendation proposed by the New Country Code. | Implemented in 2015 adopting the recommendation proposed by the New Country Code. | Implemented in 2015 adopting the recommendation proposed by the New Country Code. |
| **Modification Date** |  |  |  |  |

---

**10.9.** If the Board of Directors accepts the request, once expired the shareholders' term to propose subjects –as set forth in the preceding recommendations, a complement to the meeting call for the General Assembly of Shareholders will be published at least fifteen (15) common days before the meeting.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **10.9 Measure Implementation** | **YES** | **NO** | **X** | **NA** |
| **YES. Briefly Indicate:** |  |  |  |  |
| **NO. Explain:** The Corporation considers that there is no legal figure to publish the complement to the meeting call once it has been carried out in accordance with the law. | **NO. Explain:** The Corporation considers that there is no legal figure to publish the complement to the meeting call once it has been carried out in accordance with the law. | **NO. Explain:** The Corporation considers that there is no legal figure to publish the complement to the meeting call once it has been carried out in accordance with the law. | **NO. Explain:** The Corporation considers that there is no legal figure to publish the complement to the meeting call once it has been carried out in accordance with the law. | **NO. Explain:** The Corporation considers that there is no legal figure to publish the complement to the meeting call once it has been carried out in accordance with the law. |
| **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** |  |  |
| **Implementation Date** | Does Not Apply. | Does Not Apply. | Does Not Apply. | Does Not Apply. |
| **Modification Date** |  |  |  |  |

---

**FINANCIAL SUPERINTENDENCE OF COLOMBIA**

***This translation from the original Spanish version is provided for convenience purposes only. No representation is made as to the accuracy of this document and the company does not assume any liability based upon it. Should any doubt or contradiction arise between the Spanish and English versions, the Spanish version shall prevail.***

**10.10.** Within the same term provided in the paragraph 10.7, the shareholders may submit new and well-grounded Agreement Proposals to matters previously included on the Agenda. For these requests, the Board of Directors will act according to the provisions of the paragraphs 10.8 and 10.9 above.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **10.10. Measure Implementation** | **YES** | **NO** | **X** | **NA** |
| **YES. Briefly Indicate:** |  |  |  |  |
| **NO. Explain:**. For the moment, the Corporation is not contemplating to adopt this recommendation. | **NO. Explain:**. For the moment, the Corporation is not contemplating to adopt this recommendation. | **NO. Explain:**. For the moment, the Corporation is not contemplating to adopt this recommendation. | **NO. Explain:**. For the moment, the Corporation is not contemplating to adopt this recommendation. | **NO. Explain:**. For the moment, the Corporation is not contemplating to adopt this recommendation. |
| **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** |  |  |
| **Implementation Date** | Does Not Apply. | Does Not Apply. | Does Not Apply. | Does Not Apply. |
| **Modification Date** |  |  |  |  |

---

**10.11.** The corporation will use e-media, and particularly the institutional web site available only to shareholders, to convey to them the documents and information related to each of the points of the Agenda for the meeting.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **10.11. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** The Company's Website has provided an access link for shareholders, where they can find out the proposed resolutions that will be presented at the General Shareholders' Meeting. In any case, these proposals are to be published as soon the company receives them and they are available to share**.** | **YES. Briefly Indicate:** The Company's Website has provided an access link for shareholders, where they can find out the proposed resolutions that will be presented at the General Shareholders' Meeting. In any case, these proposals are to be published as soon the company receives them and they are available to share**.** | **YES. Briefly Indicate:** The Company's Website has provided an access link for shareholders, where they can find out the proposed resolutions that will be presented at the General Shareholders' Meeting. In any case, these proposals are to be published as soon the company receives them and they are available to share**.** | **YES. Briefly Indicate:** The Company's Website has provided an access link for shareholders, where they can find out the proposed resolutions that will be presented at the General Shareholders' Meeting. In any case, these proposals are to be published as soon the company receives them and they are available to share**.** | **YES. Briefly Indicate:** The Company's Website has provided an access link for shareholders, where they can find out the proposed resolutions that will be presented at the General Shareholders' Meeting. In any case, these proposals are to be published as soon the company receives them and they are available to share**.** |
| **NO. Explain:**. | **NO. Explain:**. | **NO. Explain:**. | **NO. Explain:**. | **NO. Explain:**. |
| **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** |  |
| **Implementation Date** | . March 20, 2020 | . March 20, 2020 | . March 20, 2020 | . March 20, 2020 |
| **Modification Date** |  |  |  |  |

---

**FINANCIAL SUPERINTENDENCE OF COLOMBIA**

***This translation from the original Spanish version is provided for convenience purposes only. No representation is made as to the accuracy of this document and the company does not assume any liability based upon it. Should any doubt or contradiction arise between the Spanish and English versions, the Spanish version shall prevail.***

**10.12** The corporation bylaws recognize the shareholders' right to request the information or clarification that they deem appropriate with enough anticipation, either through traditional channels and/or, if suitable, through new technologies, or to express in writing their questions on the subjects of the Agenda, the documentation received, or the public information issued by the corporation. Depending on the term of the corporation to call for a General Assembly of Shareholders, it will determine the period within which the shareholders will exercise this right.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **10.12. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** The By laws of the Corporation state (Article 4, Item 6) the right of inspecting the books and papers of the Corporation within 15 business days prior to the General Meeting wherein the balance sheets of the end of the fiscal period are examined. Likewise, within the mechanisms of the By laws (Article 42) to ensure equitable treatment to shareholders, equal treatment is established regarding petitions, claims and information of its shareholders, regardless of the amount of their shares, as well as to its investors, regardless of the amount of their investments. The specific mechanisms ensuring equitable treatment to shareholders and investors include, among others: the right to demand compliance of the Corporate Governance Code and to be attended and informed with the same amount of detail and during the same period and timeliness with the purpose of protecting their rights. Likewise, during the development of the above, the Code of Corporate Governance of the Company establishes as part of the rights of the shareholders, the right to be attended and informed as well as the mechanisms established for such purpose (Office of Attention to Shareholders). | **YES. Briefly Indicate:** The By laws of the Corporation state (Article 4, Item 6) the right of inspecting the books and papers of the Corporation within 15 business days prior to the General Meeting wherein the balance sheets of the end of the fiscal period are examined. Likewise, within the mechanisms of the By laws (Article 42) to ensure equitable treatment to shareholders, equal treatment is established regarding petitions, claims and information of its shareholders, regardless of the amount of their shares, as well as to its investors, regardless of the amount of their investments. The specific mechanisms ensuring equitable treatment to shareholders and investors include, among others: the right to demand compliance of the Corporate Governance Code and to be attended and informed with the same amount of detail and during the same period and timeliness with the purpose of protecting their rights. Likewise, during the development of the above, the Code of Corporate Governance of the Company establishes as part of the rights of the shareholders, the right to be attended and informed as well as the mechanisms established for such purpose (Office of Attention to Shareholders). | **YES. Briefly Indicate:** The By laws of the Corporation state (Article 4, Item 6) the right of inspecting the books and papers of the Corporation within 15 business days prior to the General Meeting wherein the balance sheets of the end of the fiscal period are examined. Likewise, within the mechanisms of the By laws (Article 42) to ensure equitable treatment to shareholders, equal treatment is established regarding petitions, claims and information of its shareholders, regardless of the amount of their shares, as well as to its investors, regardless of the amount of their investments. The specific mechanisms ensuring equitable treatment to shareholders and investors include, among others: the right to demand compliance of the Corporate Governance Code and to be attended and informed with the same amount of detail and during the same period and timeliness with the purpose of protecting their rights. Likewise, during the development of the above, the Code of Corporate Governance of the Company establishes as part of the rights of the shareholders, the right to be attended and informed as well as the mechanisms established for such purpose (Office of Attention to Shareholders). | **YES. Briefly Indicate:** The By laws of the Corporation state (Article 4, Item 6) the right of inspecting the books and papers of the Corporation within 15 business days prior to the General Meeting wherein the balance sheets of the end of the fiscal period are examined. Likewise, within the mechanisms of the By laws (Article 42) to ensure equitable treatment to shareholders, equal treatment is established regarding petitions, claims and information of its shareholders, regardless of the amount of their shares, as well as to its investors, regardless of the amount of their investments. The specific mechanisms ensuring equitable treatment to shareholders and investors include, among others: the right to demand compliance of the Corporate Governance Code and to be attended and informed with the same amount of detail and during the same period and timeliness with the purpose of protecting their rights. Likewise, during the development of the above, the Code of Corporate Governance of the Company establishes as part of the rights of the shareholders, the right to be attended and informed as well as the mechanisms established for such purpose (Office of Attention to Shareholders). | **YES. Briefly Indicate:** The By laws of the Corporation state (Article 4, Item 6) the right of inspecting the books and papers of the Corporation within 15 business days prior to the General Meeting wherein the balance sheets of the end of the fiscal period are examined. Likewise, within the mechanisms of the By laws (Article 42) to ensure equitable treatment to shareholders, equal treatment is established regarding petitions, claims and information of its shareholders, regardless of the amount of their shares, as well as to its investors, regardless of the amount of their investments. The specific mechanisms ensuring equitable treatment to shareholders and investors include, among others: the right to demand compliance of the Corporate Governance Code and to be attended and informed with the same amount of detail and during the same period and timeliness with the purpose of protecting their rights. Likewise, during the development of the above, the Code of Corporate Governance of the Company establishes as part of the rights of the shareholders, the right to be attended and informed as well as the mechanisms established for such purpose (Office of Attention to Shareholders). |
| **No. Explain.** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** |  |
| **Implementation Date** | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. |
| **Modification Date** |  |  |  |  |

---

**10.13.** The corporation foresees that the requested information may be denied if, based on internal procedures, it may be considered: i) non-reasonable; ii) irrelevant to learn about the corporation's progress or interests; iii) confidential, which will include reserved information within the securities market; business secrets; and transactions in progress, whose success for the company will be contingent upon their secrecy; iv) any other information that if disclosed will compromise imminently and seriously the competitiveness of the company.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **10.3. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** The procedure to provide attention to shareholders and investors establishes that without prejudice to their statutory and legal rights applicable to the requests filed by Shareholders and Investors of the Corporation, in the event of requests to provide information, the same may be denied if upon the analysis of the request pursuant with internal procedures, the same could be deemed unreasonable; irrelevant for knowing the progress or interests of the Corporation; confidential or privileged within the environment of the stock market, industrial secrets, ongoing operations whose successful completion for the Corporation substantially depends on the secrecy of the negotiation; and others, whose disclosure may jeopardize the competitiveness of the Corporation.<br>This procedure is incorporated into the Policy "Modelo de Servicio y Atención al Accionista e Inversionista" | **YES. Briefly Indicate:** The procedure to provide attention to shareholders and investors establishes that without prejudice to their statutory and legal rights applicable to the requests filed by Shareholders and Investors of the Corporation, in the event of requests to provide information, the same may be denied if upon the analysis of the request pursuant with internal procedures, the same could be deemed unreasonable; irrelevant for knowing the progress or interests of the Corporation; confidential or privileged within the environment of the stock market, industrial secrets, ongoing operations whose successful completion for the Corporation substantially depends on the secrecy of the negotiation; and others, whose disclosure may jeopardize the competitiveness of the Corporation.<br>This procedure is incorporated into the Policy "Modelo de Servicio y Atención al Accionista e Inversionista" | **YES. Briefly Indicate:** The procedure to provide attention to shareholders and investors establishes that without prejudice to their statutory and legal rights applicable to the requests filed by Shareholders and Investors of the Corporation, in the event of requests to provide information, the same may be denied if upon the analysis of the request pursuant with internal procedures, the same could be deemed unreasonable; irrelevant for knowing the progress or interests of the Corporation; confidential or privileged within the environment of the stock market, industrial secrets, ongoing operations whose successful completion for the Corporation substantially depends on the secrecy of the negotiation; and others, whose disclosure may jeopardize the competitiveness of the Corporation.<br>This procedure is incorporated into the Policy "Modelo de Servicio y Atención al Accionista e Inversionista" | **YES. Briefly Indicate:** The procedure to provide attention to shareholders and investors establishes that without prejudice to their statutory and legal rights applicable to the requests filed by Shareholders and Investors of the Corporation, in the event of requests to provide information, the same may be denied if upon the analysis of the request pursuant with internal procedures, the same could be deemed unreasonable; irrelevant for knowing the progress or interests of the Corporation; confidential or privileged within the environment of the stock market, industrial secrets, ongoing operations whose successful completion for the Corporation substantially depends on the secrecy of the negotiation; and others, whose disclosure may jeopardize the competitiveness of the Corporation.<br>This procedure is incorporated into the Policy "Modelo de Servicio y Atención al Accionista e Inversionista" | **YES. Briefly Indicate:** The procedure to provide attention to shareholders and investors establishes that without prejudice to their statutory and legal rights applicable to the requests filed by Shareholders and Investors of the Corporation, in the event of requests to provide information, the same may be denied if upon the analysis of the request pursuant with internal procedures, the same could be deemed unreasonable; irrelevant for knowing the progress or interests of the Corporation; confidential or privileged within the environment of the stock market, industrial secrets, ongoing operations whose successful completion for the Corporation substantially depends on the secrecy of the negotiation; and others, whose disclosure may jeopardize the competitiveness of the Corporation.<br>This procedure is incorporated into the Policy "Modelo de Servicio y Atención al Accionista e Inversionista" |
| **NO. Explain;** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** |  |
| **Implementation Date** | Implemented in 2015 adopting the recommendation proposed by the Code of Best Practices. | Implemented in 2015 adopting the recommendation proposed by the Code of Best Practices. | Implemented in 2015 adopting the recommendation proposed by the Code of Best Practices. | Implemented in 2015 adopting the recommendation proposed by the Code of Best Practices. |
| **Modification Date** |  |  |  |  |

---

**FINANCIAL SUPERINTENDENCE OF COLOMBIA**

***This translation from the original Spanish version is provided for convenience purposes only. No representation is made as to the accuracy of this document and the company does not assume any liability based upon it. Should any doubt or contradiction arise between the Spanish and English versions, the Spanish version shall prevail.***

**10.14.** When an answer provided to a shareholder may grant him some advantage, the corporation guarantees the access to that answer to the other shareholders, on a concomitant basis, according to the mechanisms set forth for that purpose, and under the same conditions.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **10.4. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** The Corporation complies with the information mechanisms for its shareholders and investors framed within the regulation of periodic and relevant disclosure of information established pursuant Decree 2555 of 2010, by virtue of which all information of the Corporation and of its outstanding securities, relevant in connection with such securities or with the exercise of political rights inherent to the same, is published through the SIMEV. Particularly, Article 5.2.4.1.5 of Decree 2555 of 2010 mentions that issuer shall disclose as relevant information, all situations related to the issuer or its issuance, that could have been taken into account by a diligent and expert individual at the moment of buying, selling or maintaining securities of the issuer or at the moment of exercising its political rights. <br>Likewise, the Corporate Governance Code of the Company states that it is the right of its shareholders to receive attention and being informed with the same level of detail and during the same time and timeliness with the purpose of protecting their rights. | **YES. Briefly Indicate:** The Corporation complies with the information mechanisms for its shareholders and investors framed within the regulation of periodic and relevant disclosure of information established pursuant Decree 2555 of 2010, by virtue of which all information of the Corporation and of its outstanding securities, relevant in connection with such securities or with the exercise of political rights inherent to the same, is published through the SIMEV. Particularly, Article 5.2.4.1.5 of Decree 2555 of 2010 mentions that issuer shall disclose as relevant information, all situations related to the issuer or its issuance, that could have been taken into account by a diligent and expert individual at the moment of buying, selling or maintaining securities of the issuer or at the moment of exercising its political rights. <br>Likewise, the Corporate Governance Code of the Company states that it is the right of its shareholders to receive attention and being informed with the same level of detail and during the same time and timeliness with the purpose of protecting their rights. | **YES. Briefly Indicate:** The Corporation complies with the information mechanisms for its shareholders and investors framed within the regulation of periodic and relevant disclosure of information established pursuant Decree 2555 of 2010, by virtue of which all information of the Corporation and of its outstanding securities, relevant in connection with such securities or with the exercise of political rights inherent to the same, is published through the SIMEV. Particularly, Article 5.2.4.1.5 of Decree 2555 of 2010 mentions that issuer shall disclose as relevant information, all situations related to the issuer or its issuance, that could have been taken into account by a diligent and expert individual at the moment of buying, selling or maintaining securities of the issuer or at the moment of exercising its political rights. <br>Likewise, the Corporate Governance Code of the Company states that it is the right of its shareholders to receive attention and being informed with the same level of detail and during the same time and timeliness with the purpose of protecting their rights. | **YES. Briefly Indicate:** The Corporation complies with the information mechanisms for its shareholders and investors framed within the regulation of periodic and relevant disclosure of information established pursuant Decree 2555 of 2010, by virtue of which all information of the Corporation and of its outstanding securities, relevant in connection with such securities or with the exercise of political rights inherent to the same, is published through the SIMEV. Particularly, Article 5.2.4.1.5 of Decree 2555 of 2010 mentions that issuer shall disclose as relevant information, all situations related to the issuer or its issuance, that could have been taken into account by a diligent and expert individual at the moment of buying, selling or maintaining securities of the issuer or at the moment of exercising its political rights. <br>Likewise, the Corporate Governance Code of the Company states that it is the right of its shareholders to receive attention and being informed with the same level of detail and during the same time and timeliness with the purpose of protecting their rights. | **YES. Briefly Indicate:** The Corporation complies with the information mechanisms for its shareholders and investors framed within the regulation of periodic and relevant disclosure of information established pursuant Decree 2555 of 2010, by virtue of which all information of the Corporation and of its outstanding securities, relevant in connection with such securities or with the exercise of political rights inherent to the same, is published through the SIMEV. Particularly, Article 5.2.4.1.5 of Decree 2555 of 2010 mentions that issuer shall disclose as relevant information, all situations related to the issuer or its issuance, that could have been taken into account by a diligent and expert individual at the moment of buying, selling or maintaining securities of the issuer or at the moment of exercising its political rights. <br>Likewise, the Corporate Governance Code of the Company states that it is the right of its shareholders to receive attention and being informed with the same level of detail and during the same time and timeliness with the purpose of protecting their rights. |
| **NO. Explain.** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** |  |
| **Implementation Date** | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. |
| **Modification Date** |  |  |  |  |

---

**Measure No. 11: Regulation of Representation**

**11.1** Without prejudice to the limits set forth in the article 185 of the Code of Commerce, the External Circular 24 of 2010, and the regulations which may amend, supplement, or substitute them, the corporation does not limit the shareholder's right to be represented at the General Assembly of Shareholders, including the delegation of his vote to any other person, whether it is a shareholder or not.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **11.1. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** The corporation does not limit the right of shareholders to be represented at the General Shareholders Meeting, thus being able to delegate their vote upon any person, regardless of whether the same is a shareholder or not. According to the Bylaws of the Corporation (Art. 12), the shareholders may be represented through a proxy granted in writing providing the name or names of the proxy or proxies, the person or persons who may substitute such proxy and the date of the meeting for which the proxy is granted. | **YES. Briefly Indicate:** The corporation does not limit the right of shareholders to be represented at the General Shareholders Meeting, thus being able to delegate their vote upon any person, regardless of whether the same is a shareholder or not. According to the Bylaws of the Corporation (Art. 12), the shareholders may be represented through a proxy granted in writing providing the name or names of the proxy or proxies, the person or persons who may substitute such proxy and the date of the meeting for which the proxy is granted. | **YES. Briefly Indicate:** The corporation does not limit the right of shareholders to be represented at the General Shareholders Meeting, thus being able to delegate their vote upon any person, regardless of whether the same is a shareholder or not. According to the Bylaws of the Corporation (Art. 12), the shareholders may be represented through a proxy granted in writing providing the name or names of the proxy or proxies, the person or persons who may substitute such proxy and the date of the meeting for which the proxy is granted. | **YES. Briefly Indicate:** The corporation does not limit the right of shareholders to be represented at the General Shareholders Meeting, thus being able to delegate their vote upon any person, regardless of whether the same is a shareholder or not. According to the Bylaws of the Corporation (Art. 12), the shareholders may be represented through a proxy granted in writing providing the name or names of the proxy or proxies, the person or persons who may substitute such proxy and the date of the meeting for which the proxy is granted. | **YES. Briefly Indicate:** The corporation does not limit the right of shareholders to be represented at the General Shareholders Meeting, thus being able to delegate their vote upon any person, regardless of whether the same is a shareholder or not. According to the Bylaws of the Corporation (Art. 12), the shareholders may be represented through a proxy granted in writing providing the name or names of the proxy or proxies, the person or persons who may substitute such proxy and the date of the meeting for which the proxy is granted. |
| **NO. Explain.** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** |  |
| **Implementation Date** | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. |
| **Modification Date** |  |  |  |  |

---

**FINANCIAL SUPERINTENDENCE OF COLOMBIA**

***This translation from the original Spanish version is provided for convenience purposes only. No representation is made as to the accuracy of this document and the company does not assume any liability based upon it. Should any doubt or contradiction arise between the Spanish and English versions, the Spanish version shall prevail.***

**11.2.** The corporation minimizes the use of blank-voting representatives or those without voting instructions by promoting actively the use of a standard letter of representation that the company conveys to the shareholders or publishes on its web site. The model features the points of the Agenda and the respective Agreement Proposals, determined under the procedures previously set forth, which will be submitted to the shareholders for consideration. The purpose is that shareholders, as they deem appropriate, may instruct their representatives about their voting on each case.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **11.2. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** The Corporation has a document with instructions for the representation of shareholders during the sessions of the General Meeting, including standard templates of proxies together with the instructions manual for the sense of the vote, which purpose is to serve as a tool for shareholders of the Corporation for providing instructions to their proxies as to how they should vote, refrain from voting or submitting substitute propositions regarding the different items of the agenda and the propositions relating to such items, when the same are available. | **YES. Briefly Indicate:** The Corporation has a document with instructions for the representation of shareholders during the sessions of the General Meeting, including standard templates of proxies together with the instructions manual for the sense of the vote, which purpose is to serve as a tool for shareholders of the Corporation for providing instructions to their proxies as to how they should vote, refrain from voting or submitting substitute propositions regarding the different items of the agenda and the propositions relating to such items, when the same are available. | **YES. Briefly Indicate:** The Corporation has a document with instructions for the representation of shareholders during the sessions of the General Meeting, including standard templates of proxies together with the instructions manual for the sense of the vote, which purpose is to serve as a tool for shareholders of the Corporation for providing instructions to their proxies as to how they should vote, refrain from voting or submitting substitute propositions regarding the different items of the agenda and the propositions relating to such items, when the same are available. | **YES. Briefly Indicate:** The Corporation has a document with instructions for the representation of shareholders during the sessions of the General Meeting, including standard templates of proxies together with the instructions manual for the sense of the vote, which purpose is to serve as a tool for shareholders of the Corporation for providing instructions to their proxies as to how they should vote, refrain from voting or submitting substitute propositions regarding the different items of the agenda and the propositions relating to such items, when the same are available. | **YES. Briefly Indicate:** The Corporation has a document with instructions for the representation of shareholders during the sessions of the General Meeting, including standard templates of proxies together with the instructions manual for the sense of the vote, which purpose is to serve as a tool for shareholders of the Corporation for providing instructions to their proxies as to how they should vote, refrain from voting or submitting substitute propositions regarding the different items of the agenda and the propositions relating to such items, when the same are available. |
| **NO. Explain.** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** |  |
| **Implementation Date** | Implemented in 2015 adopting the recommendation proposed by the Code of Best Practices.. | Implemented in 2015 adopting the recommendation proposed by the Code of Best Practices.. | Implemented in 2015 adopting the recommendation proposed by the Code of Best Practices.. | Implemented in 2015 adopting the recommendation proposed by the Code of Best Practices.. |
| **Modification Date** |  |  |  |  |

---

**Measure No. 12. Attendance of other individuals different from shareholders:**

**12.1.** To revitalize the General Assembly's role in defining the corporate will, and to turn it into a much more participatory body, its regulation require that the members of the Board of Directors and particularly the presidents of the Board committees and the President of the corporation attend the Assembly to address the shareholders' concerns.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **12.1. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** The Regulation of the General Shareholders Meeting of the Corporation states that the President of the Corporation and remaining members of the Board of Directors, including the chairmen of its Support Committees shall attend the Meetings to address any queries of the shareholders that may arise relating to the affairs under their responsibility or to report on specific aspects of their work, when requested by the Chairman of the Meeting when deemed pertinent. In the event that any of them are not be able to attend, other members of the Board of Directors, of the respective committee or of the Senior Management, as the case may be, may address the queries submitted regarding the matters in charge of such management bodies, in such a way that in no event their absence may constitute an impediment for carrying out the Meeting. | **YES. Briefly Indicate:** The Regulation of the General Shareholders Meeting of the Corporation states that the President of the Corporation and remaining members of the Board of Directors, including the chairmen of its Support Committees shall attend the Meetings to address any queries of the shareholders that may arise relating to the affairs under their responsibility or to report on specific aspects of their work, when requested by the Chairman of the Meeting when deemed pertinent. In the event that any of them are not be able to attend, other members of the Board of Directors, of the respective committee or of the Senior Management, as the case may be, may address the queries submitted regarding the matters in charge of such management bodies, in such a way that in no event their absence may constitute an impediment for carrying out the Meeting. | **YES. Briefly Indicate:** The Regulation of the General Shareholders Meeting of the Corporation states that the President of the Corporation and remaining members of the Board of Directors, including the chairmen of its Support Committees shall attend the Meetings to address any queries of the shareholders that may arise relating to the affairs under their responsibility or to report on specific aspects of their work, when requested by the Chairman of the Meeting when deemed pertinent. In the event that any of them are not be able to attend, other members of the Board of Directors, of the respective committee or of the Senior Management, as the case may be, may address the queries submitted regarding the matters in charge of such management bodies, in such a way that in no event their absence may constitute an impediment for carrying out the Meeting. | **YES. Briefly Indicate:** The Regulation of the General Shareholders Meeting of the Corporation states that the President of the Corporation and remaining members of the Board of Directors, including the chairmen of its Support Committees shall attend the Meetings to address any queries of the shareholders that may arise relating to the affairs under their responsibility or to report on specific aspects of their work, when requested by the Chairman of the Meeting when deemed pertinent. In the event that any of them are not be able to attend, other members of the Board of Directors, of the respective committee or of the Senior Management, as the case may be, may address the queries submitted regarding the matters in charge of such management bodies, in such a way that in no event their absence may constitute an impediment for carrying out the Meeting. | **YES. Briefly Indicate:** The Regulation of the General Shareholders Meeting of the Corporation states that the President of the Corporation and remaining members of the Board of Directors, including the chairmen of its Support Committees shall attend the Meetings to address any queries of the shareholders that may arise relating to the affairs under their responsibility or to report on specific aspects of their work, when requested by the Chairman of the Meeting when deemed pertinent. In the event that any of them are not be able to attend, other members of the Board of Directors, of the respective committee or of the Senior Management, as the case may be, may address the queries submitted regarding the matters in charge of such management bodies, in such a way that in no event their absence may constitute an impediment for carrying out the Meeting. |
| **NO. Explain.** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** |  |
| **Implementation Date** | Implemented in 2015 adopting the recommendation proposed by the Code of Best Practices.. | Implemented in 2015 adopting the recommendation proposed by the Code of Best Practices.. | Implemented in 2015 adopting the recommendation proposed by the Code of Best Practices.. | Implemented in 2015 adopting the recommendation proposed by the Code of Best Practices.. |
| **Modification Date** |  |  |  |  |

---

**FINANCIAL SUPERINTENDENCE OF COLOMBIA**

***This translation from the original Spanish version is provided for convenience purposes only. No representation is made as to the accuracy of this document and the company does not assume any liability based upon it. Should any doubt or contradiction arise between the Spanish and English versions, the Spanish version shall prevail.***

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;**III. BOARD OF DIRECTORS**

**Measure No. 13: Functions of the Board of Directors**

**13.1.** The bylaws specify explicitly the functions that will not be delegated to the senior management, including the functions mentioned of recommendation 13.1.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **13.1. Measure Implementation** | **YES** | **NO** | **X** | **NA** |
| **YES. Briefly Indicate** | **YES. Briefly Indicate** | **YES. Briefly Indicate** | **YES. Briefly Indicate** | **YES. Briefly Indicate** |
| **NO. Explain:** The Bylaws of the Corporation establish duties proposed by recommendation 13.1 as non-delegable of the Board of Directors. However, such recommendation sets forth the need to carry out an amendment of the Bylaws so that the same <u>expressly</u> point out the 33 duties contained therein. In this respect, the Corporation does not share the scope of the recommendation 13.1 regarding the need to amend the By laws so that the duties of the Board of Directors expressly state what is recommended by recommendation 13.1. | **NO. Explain:** The Bylaws of the Corporation establish duties proposed by recommendation 13.1 as non-delegable of the Board of Directors. However, such recommendation sets forth the need to carry out an amendment of the Bylaws so that the same <u>expressly</u> point out the 33 duties contained therein. In this respect, the Corporation does not share the scope of the recommendation 13.1 regarding the need to amend the By laws so that the duties of the Board of Directors expressly state what is recommended by recommendation 13.1. | **NO. Explain:** The Bylaws of the Corporation establish duties proposed by recommendation 13.1 as non-delegable of the Board of Directors. However, such recommendation sets forth the need to carry out an amendment of the Bylaws so that the same <u>expressly</u> point out the 33 duties contained therein. In this respect, the Corporation does not share the scope of the recommendation 13.1 regarding the need to amend the By laws so that the duties of the Board of Directors expressly state what is recommended by recommendation 13.1. | **NO. Explain:** The Bylaws of the Corporation establish duties proposed by recommendation 13.1 as non-delegable of the Board of Directors. However, such recommendation sets forth the need to carry out an amendment of the Bylaws so that the same <u>expressly</u> point out the 33 duties contained therein. In this respect, the Corporation does not share the scope of the recommendation 13.1 regarding the need to amend the By laws so that the duties of the Board of Directors expressly state what is recommended by recommendation 13.1. | **NO. Explain:** The Bylaws of the Corporation establish duties proposed by recommendation 13.1 as non-delegable of the Board of Directors. However, such recommendation sets forth the need to carry out an amendment of the Bylaws so that the same <u>expressly</u> point out the 33 duties contained therein. In this respect, the Corporation does not share the scope of the recommendation 13.1 regarding the need to amend the By laws so that the duties of the Board of Directors expressly state what is recommended by recommendation 13.1. |
| **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** |  |  |
| **Implementation Date** | Does Not Apply | Does Not Apply | Does Not Apply | Does Not Apply |
| **Modification Date** |  |  |  |  |

---

**13.2.** Without prejudice to the autonomy of the governance bodies of the subordinated companies, when the corporation acts as the holding company of a conglomerate, these functions of the Board of Directors keep a group perspective and are implemented through general policies, guidelines, or information requests that respect the balance between the interests of the holding company, those of the subordinates, and those of the conglomerate as a whole.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **13.2. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** The Regulations of the Board of Directors establishes that in the events where it is applicable and deemed necessary, the Board of Directors of Grupo Aval, in its capacity as parent company of other corporations shall perform its duties through general policies, guidelines or requests for information seeking the balance between the interests of the Corporation and those of its subordinate entities as a whole. The above, without prejudice of the autonomy of the governing bodies of the subordinate institutions of the Corporation and of the responsibility of the members of the senior management and the administrators with regards to the ordinary course of business. | **YES. Briefly Indicate:** The Regulations of the Board of Directors establishes that in the events where it is applicable and deemed necessary, the Board of Directors of Grupo Aval, in its capacity as parent company of other corporations shall perform its duties through general policies, guidelines or requests for information seeking the balance between the interests of the Corporation and those of its subordinate entities as a whole. The above, without prejudice of the autonomy of the governing bodies of the subordinate institutions of the Corporation and of the responsibility of the members of the senior management and the administrators with regards to the ordinary course of business. | **YES. Briefly Indicate:** The Regulations of the Board of Directors establishes that in the events where it is applicable and deemed necessary, the Board of Directors of Grupo Aval, in its capacity as parent company of other corporations shall perform its duties through general policies, guidelines or requests for information seeking the balance between the interests of the Corporation and those of its subordinate entities as a whole. The above, without prejudice of the autonomy of the governing bodies of the subordinate institutions of the Corporation and of the responsibility of the members of the senior management and the administrators with regards to the ordinary course of business. | **YES. Briefly Indicate:** The Regulations of the Board of Directors establishes that in the events where it is applicable and deemed necessary, the Board of Directors of Grupo Aval, in its capacity as parent company of other corporations shall perform its duties through general policies, guidelines or requests for information seeking the balance between the interests of the Corporation and those of its subordinate entities as a whole. The above, without prejudice of the autonomy of the governing bodies of the subordinate institutions of the Corporation and of the responsibility of the members of the senior management and the administrators with regards to the ordinary course of business. | **YES. Briefly Indicate:** The Regulations of the Board of Directors establishes that in the events where it is applicable and deemed necessary, the Board of Directors of Grupo Aval, in its capacity as parent company of other corporations shall perform its duties through general policies, guidelines or requests for information seeking the balance between the interests of the Corporation and those of its subordinate entities as a whole. The above, without prejudice of the autonomy of the governing bodies of the subordinate institutions of the Corporation and of the responsibility of the members of the senior management and the administrators with regards to the ordinary course of business. |
| **NO. Explain.** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** |  |
| **Implementation Date** | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in 2015 as a result of the implementation of some recommendations from the Code of Best Practices. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in 2015 as a result of the implementation of some recommendations from the Code of Best Practices. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in 2015 as a result of the implementation of some recommendations from the Code of Best Practices. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in 2015 as a result of the implementation of some recommendations from the Code of Best Practices. |
| **Modification Date** |  |  |  |  |

---

**FINANCIAL SUPERINTENDENCE OF COLOMBIA**

***This translation from the original Spanish version is provided for convenience purposes only. No representation is made as to the accuracy of this document and the company does not assume any liability based upon it. Should any doubt or contradiction arise between the Spanish and English versions, the Spanish version shall prevail.***

**Measure No. 14. Regulations of the Board of Directors.** 

**14.1.** The Board of Directors has approved internal regulation for its organization, operation, the rights and duties of its members, its President, and its Secretary. This regulation is informed to the shareholders, and they are binding upon the members of the Board.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **14.1. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** The Board Of Directors has an internal regulation for operation under the terms proposed by Recommendation 14.1, with binding and public nature. | **YES. Briefly Indicate:** The Board Of Directors has an internal regulation for operation under the terms proposed by Recommendation 14.1, with binding and public nature. | **YES. Briefly Indicate:** The Board Of Directors has an internal regulation for operation under the terms proposed by Recommendation 14.1, with binding and public nature. | **YES. Briefly Indicate:** The Board Of Directors has an internal regulation for operation under the terms proposed by Recommendation 14.1, with binding and public nature. | **YES. Briefly Indicate:** The Board Of Directors has an internal regulation for operation under the terms proposed by Recommendation 14.1, with binding and public nature. |
| **NO. Explain.** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** | **NA. Describe the regulations that prevent the adoption of the recommendation.** |  |
| **Implementation Date** | Implemented in 2015 adopting the recommendation proposed by the Code of Best Practices. | Implemented in 2015 adopting the recommendation proposed by the Code of Best Practices. | Implemented in 2015 adopting the recommendation proposed by the Code of Best Practices. | Implemented in 2015 adopting the recommendation proposed by the Code of Best Practices. |
| **Modification Date** |  |  |  |  |

---

**Measure No. 15. Size of the Board of Directors**

**15.1.** In its bylaws, the corporation has decided not to have alternate members in its Board of Directors.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **15.1. Measure Implementation** | **YES** | **NO** | **X** | **NA** |
| **YES. Briefly Indicate:** |  |  |  |  |
| **NO. Explain:** Alternate members of the Board of Directors may attend the meetings of the Board of Directors even when they are not acting as substitute of its respective principal member. The Corporation deems that the figure of alternate members contributes to the good operation of the Board of Directors. | **NO. Explain:** Alternate members of the Board of Directors may attend the meetings of the Board of Directors even when they are not acting as substitute of its respective principal member. The Corporation deems that the figure of alternate members contributes to the good operation of the Board of Directors. | **NO. Explain:** Alternate members of the Board of Directors may attend the meetings of the Board of Directors even when they are not acting as substitute of its respective principal member. The Corporation deems that the figure of alternate members contributes to the good operation of the Board of Directors. | **NO. Explain:** Alternate members of the Board of Directors may attend the meetings of the Board of Directors even when they are not acting as substitute of its respective principal member. The Corporation deems that the figure of alternate members contributes to the good operation of the Board of Directors. | **NO. Explain:** Alternate members of the Board of Directors may attend the meetings of the Board of Directors even when they are not acting as substitute of its respective principal member. The Corporation deems that the figure of alternate members contributes to the good operation of the Board of Directors. |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |  |
| **Implementation Date** | Does Not Apply | Does Not Apply | Does Not Apply | Does Not Apply |
| **Modification Date** |  |  |  |  |

---

**FINANCIAL SUPERINTENDENCE OF COLOMBIA**

***This translation from the original Spanish version is provided for convenience purposes only. No representation is made as to the accuracy of this document and the company does not assume any liability based upon it. Should any doubt or contradiction arise between the Spanish and English versions, the Spanish version shall prevail.***

**Measure No. 16. Integration of the Board of Directors**

**16.1.** Departing from the premise that, once elected all the members of the Board of Directors act in the corporation's best interest, the corporation, enforcing the highest transparency, identifies the origin of the different members of the Board, based on the structure defined in Recommendation 16.1.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **16.1. Implementation Date** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** The Corporation identifies the origin of the different members of the Board of Directors in accordance with the scheme defined under recommendation 16.1. Such differentiation is established in the Regulations of the Board of Directors and it can be identified on its Internet web page. | **YES. Briefly Indicate:** The Corporation identifies the origin of the different members of the Board of Directors in accordance with the scheme defined under recommendation 16.1. Such differentiation is established in the Regulations of the Board of Directors and it can be identified on its Internet web page. | **YES. Briefly Indicate:** The Corporation identifies the origin of the different members of the Board of Directors in accordance with the scheme defined under recommendation 16.1. Such differentiation is established in the Regulations of the Board of Directors and it can be identified on its Internet web page. | **YES. Briefly Indicate:** The Corporation identifies the origin of the different members of the Board of Directors in accordance with the scheme defined under recommendation 16.1. Such differentiation is established in the Regulations of the Board of Directors and it can be identified on its Internet web page. | **YES. Briefly Indicate:** The Corporation identifies the origin of the different members of the Board of Directors in accordance with the scheme defined under recommendation 16.1. Such differentiation is established in the Regulations of the Board of Directors and it can be identified on its Internet web page. |
| **NO. Explain** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | Implemented in 2015 adopting the recommendation proposed by the New Country Code. | Implemented in 2015 adopting the recommendation proposed by the New Country Code. | Implemented in 2015 adopting the recommendation proposed by the New Country Code. | Implemented in 2015 adopting the recommendation proposed by the New Country Code. |
| **Modification Date** |  |  |  |  |

---

**16.2.** The corporation has procedures, implemented through the Nomination and Compensation Committee, or some other with similar functions, which enable the Board of Directors, based on its own dynamics and the findings of the annual assessments, reach the objectives mentioned on Recommendation 16.2.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **16.2. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** For purposes of reaching the objectives pointed out under Recommendation 16.2 the Corporation established the Policy of Appointment and Remuneration of the Board of Directors approved by its General Shareholders Meeting. | **YES. Briefly Indicate:** For purposes of reaching the objectives pointed out under Recommendation 16.2 the Corporation established the Policy of Appointment and Remuneration of the Board of Directors approved by its General Shareholders Meeting. | **YES. Briefly Indicate:** For purposes of reaching the objectives pointed out under Recommendation 16.2 the Corporation established the Policy of Appointment and Remuneration of the Board of Directors approved by its General Shareholders Meeting. | **YES. Briefly Indicate:** For purposes of reaching the objectives pointed out under Recommendation 16.2 the Corporation established the Policy of Appointment and Remuneration of the Board of Directors approved by its General Shareholders Meeting. | **YES. Briefly Indicate:** For purposes of reaching the objectives pointed out under Recommendation 16.2 the Corporation established the Policy of Appointment and Remuneration of the Board of Directors approved by its General Shareholders Meeting. |
| **NO. Explain** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | Implemented in 2015 adopting the recommendation proposed by the Code of Best Practices. | Implemented in 2015 adopting the recommendation proposed by the Code of Best Practices. | Implemented in 2015 adopting the recommendation proposed by the Code of Best Practices. | Implemented in 2015 adopting the recommendation proposed by the Code of Best Practices. |
| **Modification Date** |  |  |  |  |

---

**FINANCIAL SUPERINTENDENCE OF COLOMBIA**

***This translation from the original Spanish version is provided for convenience purposes only. No representation is made as to the accuracy of this document and the company does not assume any liability based upon it. Should any doubt or contradiction arise between the Spanish and English versions, the Spanish version shall prevail.***

**16.3.** The Board of Directors informs the shareholders about the professional profiles deemed necessary so that the different stakeholders (mainly any controlling, significant, or institutional shareholders, any groups of shareholders or families, if there are any, and the Board itself) may identify the most appropriate candidates.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **16.3. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** For purposes of implementing Recommendation 16.3, the Corporation established the Policy of Appointment and Remuneration of the Board of Directors approved by its General Shareholders Meeting. Such policy, published in the Internet web page of the Corporation establishes the profiles necessary for structuring the Board of Directors and the procedures for nomination of candidates to form part of the Board of Directors. | **YES. Briefly Indicate:** For purposes of implementing Recommendation 16.3, the Corporation established the Policy of Appointment and Remuneration of the Board of Directors approved by its General Shareholders Meeting. Such policy, published in the Internet web page of the Corporation establishes the profiles necessary for structuring the Board of Directors and the procedures for nomination of candidates to form part of the Board of Directors. | **YES. Briefly Indicate:** For purposes of implementing Recommendation 16.3, the Corporation established the Policy of Appointment and Remuneration of the Board of Directors approved by its General Shareholders Meeting. Such policy, published in the Internet web page of the Corporation establishes the profiles necessary for structuring the Board of Directors and the procedures for nomination of candidates to form part of the Board of Directors. | **YES. Briefly Indicate:** For purposes of implementing Recommendation 16.3, the Corporation established the Policy of Appointment and Remuneration of the Board of Directors approved by its General Shareholders Meeting. Such policy, published in the Internet web page of the Corporation establishes the profiles necessary for structuring the Board of Directors and the procedures for nomination of candidates to form part of the Board of Directors. | **YES. Briefly Indicate:** For purposes of implementing Recommendation 16.3, the Corporation established the Policy of Appointment and Remuneration of the Board of Directors approved by its General Shareholders Meeting. Such policy, published in the Internet web page of the Corporation establishes the profiles necessary for structuring the Board of Directors and the procedures for nomination of candidates to form part of the Board of Directors. |
| **NO. Explain** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | Implemented in 2015 adopting the recommendation proposed by the New Country Code. | Implemented in 2015 adopting the recommendation proposed by the New Country Code. | Implemented in 2015 adopting the recommendation proposed by the New Country Code. | Implemented in 2015 adopting the recommendation proposed by the New Country Code. |
| **Modification Date** |  |  |  |  |

---

**16.4.** The corporation considers that the mere review of the résumés by the shareholders is not enough to decide on the candidates' fitness. Consequently, it has internal procedures to assess any legal incompatibilities and inabilities, as well as a candidate's appropriateness to the needs of the Board of Directors. These procedures evaluate a set of criteria that the candidates' functional and personal profiles must meet, and verify their compliance with some objective requirements to become a member of the Board of Directors, and some additional requisites to become an independent member.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **16.4. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** For purposes of implementing Recommendation 16.4, the Corporation established a Policy of Appointment and Remuneration of the Board of Directors approved by its General Shareholders Meeting. Such a policy published in the Corporation's web page establishes the profiles necessary for structuring the Board of Directors and the procedures for nominating candidates to form part of the Board of Directors.  | **YES. Briefly Indicate:** For purposes of implementing Recommendation 16.4, the Corporation established a Policy of Appointment and Remuneration of the Board of Directors approved by its General Shareholders Meeting. Such a policy published in the Corporation's web page establishes the profiles necessary for structuring the Board of Directors and the procedures for nominating candidates to form part of the Board of Directors.  | **YES. Briefly Indicate:** For purposes of implementing Recommendation 16.4, the Corporation established a Policy of Appointment and Remuneration of the Board of Directors approved by its General Shareholders Meeting. Such a policy published in the Corporation's web page establishes the profiles necessary for structuring the Board of Directors and the procedures for nominating candidates to form part of the Board of Directors.  | **YES. Briefly Indicate:** For purposes of implementing Recommendation 16.4, the Corporation established a Policy of Appointment and Remuneration of the Board of Directors approved by its General Shareholders Meeting. Such a policy published in the Corporation's web page establishes the profiles necessary for structuring the Board of Directors and the procedures for nominating candidates to form part of the Board of Directors.  | **YES. Briefly Indicate:** For purposes of implementing Recommendation 16.4, the Corporation established a Policy of Appointment and Remuneration of the Board of Directors approved by its General Shareholders Meeting. Such a policy published in the Corporation's web page establishes the profiles necessary for structuring the Board of Directors and the procedures for nominating candidates to form part of the Board of Directors.  |
| **NO. Explain:** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | Implemented in 2015 adopting the recommendation proposed by the New Country Code. | Implemented in 2015 adopting the recommendation proposed by the New Country Code. | Implemented in 2015 adopting the recommendation proposed by the New Country Code. | Implemented in 2015 adopting the recommendation proposed by the New Country Code. |
| **Modification Date** |  |  |  |  |

---

**FINANCIAL SUPERINTENDENCE OF COLOMBIA**

***This translation from the original Spanish version is provided for convenience purposes only. No representation is made as to the accuracy of this document and the company does not assume any liability based upon it. Should any doubt or contradiction arise between the Spanish and English versions, the Spanish version shall prevail.***

**16.5.** Besides the independence requirements set forth by the Law 964 of 2005, the corporation has voluntarily adopted a more rigorous definition for this concept than that of the said law. Such definition has been accepted as a reference framework through the regulation of the Board of Directors; it includes, among other requirements to be assessed, that of the relationships or links of any kind of a candidate to become an independent member with any controlling or significant shareholders or their related parties, either domestically or abroad. Furthermore, it requires a double statement of independence: (i) that of the candidate before the corporation, its shareholders, and senior-management members, expressed in his letter of acceptance, and (ii) that of the Board of Directors with respect to the candidate's independence.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **16.5. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** For purposes of complying with the recommendation 16.5, the Company's independent Directors have signed a Letter of Acceptance and Independence in which they acknowledge their status as independent under additional criteria determined by the Company | **YES. Briefly Indicate:** For purposes of complying with the recommendation 16.5, the Company's independent Directors have signed a Letter of Acceptance and Independence in which they acknowledge their status as independent under additional criteria determined by the Company | **YES. Briefly Indicate:** For purposes of complying with the recommendation 16.5, the Company's independent Directors have signed a Letter of Acceptance and Independence in which they acknowledge their status as independent under additional criteria determined by the Company | **YES. Briefly Indicate:** For purposes of complying with the recommendation 16.5, the Company's independent Directors have signed a Letter of Acceptance and Independence in which they acknowledge their status as independent under additional criteria determined by the Company | **YES. Briefly Indicate:** For purposes of complying with the recommendation 16.5, the Company's independent Directors have signed a Letter of Acceptance and Independence in which they acknowledge their status as independent under additional criteria determined by the Company |
| **NO. Explain:** | **NO. Explain:** | **NO. Explain:** | **NO. Explain:** | **NO. Explain:** |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | December 9<sup>th</sup> 2020 | December 9<sup>th</sup> 2020 | December 9<sup>th</sup> 2020 | December 9<sup>th</sup> 2020 |
| **Modification Date** |  |  |  |  |

---

**16.6.** Based on its internal regulations, the corporation considers that the Board of Directors, through its President and with the support of the Nomination and Compensation Committee, or that which fulfill its duties, is the most appropriate body to centralize and coordinate the process to appoint the Board before the General Assembly. In this way, the shareholders that wish to become Board members based on their stock participation, may learn about the Board's needs, express their aspirations, and negotiate any stock-based balances and distribution among the different types of members. Moreover, they may present their candidates and agree that the Nomination and Compensation Committee assess their fitness before the vote during the General Assembly of Shareholders.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **16.6. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** For purposes of implementing Recommendation 16.6, the Corporation established a Policy of Appointment and Remuneration of the Board of Directors approved by its General Shareholders Meeting. Such a policy published in the Corporation's web site establishes that the Chairman of the Board of Directors, with the assistance of the President of the Corporation and the Secretary of the Board shall assess the proposals received within the five (5) calendar days following the respective summons to the Shareholders Meeting. Such assessments shall verify the absence of incompatibilities and disqualifications of legal nature and the suitability of the candidates to the needs of the Board of Directors through the validation of the professional and personal criteria applicable. | **YES. Briefly Indicate:** For purposes of implementing Recommendation 16.6, the Corporation established a Policy of Appointment and Remuneration of the Board of Directors approved by its General Shareholders Meeting. Such a policy published in the Corporation's web site establishes that the Chairman of the Board of Directors, with the assistance of the President of the Corporation and the Secretary of the Board shall assess the proposals received within the five (5) calendar days following the respective summons to the Shareholders Meeting. Such assessments shall verify the absence of incompatibilities and disqualifications of legal nature and the suitability of the candidates to the needs of the Board of Directors through the validation of the professional and personal criteria applicable. | **YES. Briefly Indicate:** For purposes of implementing Recommendation 16.6, the Corporation established a Policy of Appointment and Remuneration of the Board of Directors approved by its General Shareholders Meeting. Such a policy published in the Corporation's web site establishes that the Chairman of the Board of Directors, with the assistance of the President of the Corporation and the Secretary of the Board shall assess the proposals received within the five (5) calendar days following the respective summons to the Shareholders Meeting. Such assessments shall verify the absence of incompatibilities and disqualifications of legal nature and the suitability of the candidates to the needs of the Board of Directors through the validation of the professional and personal criteria applicable. | **YES. Briefly Indicate:** For purposes of implementing Recommendation 16.6, the Corporation established a Policy of Appointment and Remuneration of the Board of Directors approved by its General Shareholders Meeting. Such a policy published in the Corporation's web site establishes that the Chairman of the Board of Directors, with the assistance of the President of the Corporation and the Secretary of the Board shall assess the proposals received within the five (5) calendar days following the respective summons to the Shareholders Meeting. Such assessments shall verify the absence of incompatibilities and disqualifications of legal nature and the suitability of the candidates to the needs of the Board of Directors through the validation of the professional and personal criteria applicable. | **YES. Briefly Indicate:** For purposes of implementing Recommendation 16.6, the Corporation established a Policy of Appointment and Remuneration of the Board of Directors approved by its General Shareholders Meeting. Such a policy published in the Corporation's web site establishes that the Chairman of the Board of Directors, with the assistance of the President of the Corporation and the Secretary of the Board shall assess the proposals received within the five (5) calendar days following the respective summons to the Shareholders Meeting. Such assessments shall verify the absence of incompatibilities and disqualifications of legal nature and the suitability of the candidates to the needs of the Board of Directors through the validation of the professional and personal criteria applicable. |
| **NO. Explain:** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | Implemented in 2015 adopting the recommendation proposed by the Code of Best Practices. | Implemented in 2015 adopting the recommendation proposed by the Code of Best Practices. | Implemented in 2015 adopting the recommendation proposed by the Code of Best Practices. | Implemented in 2015 adopting the recommendation proposed by the Code of Best Practices. |
| **Modification Date** |  |  |  |  |

---

**FINANCIAL SUPERINTENDENCE OF COLOMBIA**

***This translation from the original Spanish version is provided for convenience purposes only. No representation is made as to the accuracy of this document and the company does not assume any liability based upon it. Should any doubt or contradiction arise between the Spanish and English versions, the Spanish version shall prevail.***

**16.7.** Regulation of the Board of Directors foresees that the assessment of the candidates' suitability must take place before the General Assembly of Shareholders. Consequently, the shareholders will have, with enough anticipation, sufficient information on the proposed candidates (personal qualities, suitability, background, experience, integrity, etc.) to evaluate them well.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **16.7. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** For purposes of implementing Recommendation 16.7, the Corporation established a Policy of Appointment and Remuneration of the Board of Directors approved by its General Shareholders Meeting. Such a policy published in the Corporation's web site establishes that the Chairman of the Board of Directors with the assistance of the President of the Corporation and the Secretary of the board, shall assess the proposals received within the five (5) calendar days following the respective summons to the Shareholders Meeting. Such assessments shall verify the absence of incompatibilities and disqualifications of legal nature and the suitability of the candidates to the needs of the Board of Directors through the validation of the applicable professional and personal criteria. Likewise, it points out that the CVs of the candidates proposed that met the applicable election criteria shall be previously informed to the respective Meeting through the Corporation's web page, provided that the same had been received within the term established for receiving such proposals. | **YES. Briefly Indicate:** For purposes of implementing Recommendation 16.7, the Corporation established a Policy of Appointment and Remuneration of the Board of Directors approved by its General Shareholders Meeting. Such a policy published in the Corporation's web site establishes that the Chairman of the Board of Directors with the assistance of the President of the Corporation and the Secretary of the board, shall assess the proposals received within the five (5) calendar days following the respective summons to the Shareholders Meeting. Such assessments shall verify the absence of incompatibilities and disqualifications of legal nature and the suitability of the candidates to the needs of the Board of Directors through the validation of the applicable professional and personal criteria. Likewise, it points out that the CVs of the candidates proposed that met the applicable election criteria shall be previously informed to the respective Meeting through the Corporation's web page, provided that the same had been received within the term established for receiving such proposals. | **YES. Briefly Indicate:** For purposes of implementing Recommendation 16.7, the Corporation established a Policy of Appointment and Remuneration of the Board of Directors approved by its General Shareholders Meeting. Such a policy published in the Corporation's web site establishes that the Chairman of the Board of Directors with the assistance of the President of the Corporation and the Secretary of the board, shall assess the proposals received within the five (5) calendar days following the respective summons to the Shareholders Meeting. Such assessments shall verify the absence of incompatibilities and disqualifications of legal nature and the suitability of the candidates to the needs of the Board of Directors through the validation of the applicable professional and personal criteria. Likewise, it points out that the CVs of the candidates proposed that met the applicable election criteria shall be previously informed to the respective Meeting through the Corporation's web page, provided that the same had been received within the term established for receiving such proposals. | **YES. Briefly Indicate:** For purposes of implementing Recommendation 16.7, the Corporation established a Policy of Appointment and Remuneration of the Board of Directors approved by its General Shareholders Meeting. Such a policy published in the Corporation's web site establishes that the Chairman of the Board of Directors with the assistance of the President of the Corporation and the Secretary of the board, shall assess the proposals received within the five (5) calendar days following the respective summons to the Shareholders Meeting. Such assessments shall verify the absence of incompatibilities and disqualifications of legal nature and the suitability of the candidates to the needs of the Board of Directors through the validation of the applicable professional and personal criteria. Likewise, it points out that the CVs of the candidates proposed that met the applicable election criteria shall be previously informed to the respective Meeting through the Corporation's web page, provided that the same had been received within the term established for receiving such proposals. | **YES. Briefly Indicate:** For purposes of implementing Recommendation 16.7, the Corporation established a Policy of Appointment and Remuneration of the Board of Directors approved by its General Shareholders Meeting. Such a policy published in the Corporation's web site establishes that the Chairman of the Board of Directors with the assistance of the President of the Corporation and the Secretary of the board, shall assess the proposals received within the five (5) calendar days following the respective summons to the Shareholders Meeting. Such assessments shall verify the absence of incompatibilities and disqualifications of legal nature and the suitability of the candidates to the needs of the Board of Directors through the validation of the applicable professional and personal criteria. Likewise, it points out that the CVs of the candidates proposed that met the applicable election criteria shall be previously informed to the respective Meeting through the Corporation's web page, provided that the same had been received within the term established for receiving such proposals. |
| **NO. Explain:** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | Implemented in 2015 adopting the recommendation proposed by the New Country Code. | Implemented in 2015 adopting the recommendation proposed by the New Country Code. | Implemented in 2015 adopting the recommendation proposed by the New Country Code. | Implemented in 2015 adopting the recommendation proposed by the New Country Code. |
| **Modification Date** |  |  |  |  |

---

**Measure No. 17. Structure of the Board of Directors**

**17.1.** Regulation of the Board of Directors provides that the independent and proprietary members are always a majority with respect to the executive members whose number, if they are included in the Board of Directors, will be the minimum necessary to meet the information and coordination requirements that exist between the Board of Directors and the corporation's senior management.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **17.1. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** The Regulation of the Board Of Directors of the Corporation states that in the event that the Board of Directors would have the participation of Executive Members, their number shall be the minimum required to address the information and coordination needs of the Board of Directors and the senior management of the Corporation, and in no event their number may be greater than the sum of Independent and Equity Members forming part of the same. | **YES. Briefly Indicate:** The Regulation of the Board Of Directors of the Corporation states that in the event that the Board of Directors would have the participation of Executive Members, their number shall be the minimum required to address the information and coordination needs of the Board of Directors and the senior management of the Corporation, and in no event their number may be greater than the sum of Independent and Equity Members forming part of the same. | **YES. Briefly Indicate:** The Regulation of the Board Of Directors of the Corporation states that in the event that the Board of Directors would have the participation of Executive Members, their number shall be the minimum required to address the information and coordination needs of the Board of Directors and the senior management of the Corporation, and in no event their number may be greater than the sum of Independent and Equity Members forming part of the same. | **YES. Briefly Indicate:** The Regulation of the Board Of Directors of the Corporation states that in the event that the Board of Directors would have the participation of Executive Members, their number shall be the minimum required to address the information and coordination needs of the Board of Directors and the senior management of the Corporation, and in no event their number may be greater than the sum of Independent and Equity Members forming part of the same. | **YES. Briefly Indicate:** The Regulation of the Board Of Directors of the Corporation states that in the event that the Board of Directors would have the participation of Executive Members, their number shall be the minimum required to address the information and coordination needs of the Board of Directors and the senior management of the Corporation, and in no event their number may be greater than the sum of Independent and Equity Members forming part of the same. |
| **NO. Explain:** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | Implemented in 2015 adopting the recommendation proposed by the Code of Best Practices. | Implemented in 2015 adopting the recommendation proposed by the Code of Best Practices. | Implemented in 2015 adopting the recommendation proposed by the Code of Best Practices. | Implemented in 2015 adopting the recommendation proposed by the Code of Best Practices. |
| **Modification Date** |  |  |  |  |

---

**FINANCIAL SUPERINTENDENCE OF COLOMBIA**

***This translation from the original Spanish version is provided for convenience purposes only. No representation is made as to the accuracy of this document and the company does not assume any liability based upon it. Should any doubt or contradiction arise between the Spanish and English versions, the Spanish version shall prevail.***

**17.2.** Beyond the minimum rate of twenty-five percent (25%) of independent members set forth by the Law 964 of 2005, the corporation analyzes and adjusts upwardly their number on a voluntary basis. Not being a fixed rule, this occurs in a way that the proportion of proprietary and independent members within the Board of Directors is comparable with the stock participation of the controlling and significant shareholders, and that of the floating capital, where the minority shareholders are.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **17.2. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:**<br>As of December 31, 2022, the Board of Directors of the Company had 2 independent members out of 7. This situation is equivalent to approximately 28% of Independent Directors.<br>It is also specified that the number of common shares held by non-controlling shareholders is related to the percentage of independent members and the float capital under the terms of recommendation | **YES. Briefly Indicate:**<br>As of December 31, 2022, the Board of Directors of the Company had 2 independent members out of 7. This situation is equivalent to approximately 28% of Independent Directors.<br>It is also specified that the number of common shares held by non-controlling shareholders is related to the percentage of independent members and the float capital under the terms of recommendation | **YES. Briefly Indicate:**<br>As of December 31, 2022, the Board of Directors of the Company had 2 independent members out of 7. This situation is equivalent to approximately 28% of Independent Directors.<br>It is also specified that the number of common shares held by non-controlling shareholders is related to the percentage of independent members and the float capital under the terms of recommendation | **YES. Briefly Indicate:**<br>As of December 31, 2022, the Board of Directors of the Company had 2 independent members out of 7. This situation is equivalent to approximately 28% of Independent Directors.<br>It is also specified that the number of common shares held by non-controlling shareholders is related to the percentage of independent members and the float capital under the terms of recommendation | **YES. Briefly Indicate:**<br>As of December 31, 2022, the Board of Directors of the Company had 2 independent members out of 7. This situation is equivalent to approximately 28% of Independent Directors.<br>It is also specified that the number of common shares held by non-controlling shareholders is related to the percentage of independent members and the float capital under the terms of recommendation |
| **NO. Explain:** | **NO. Explain:** | **NO. Explain:** | **NO. Explain:** | **NO. Explain:** |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | September 30<sup>th</sup> 2014 | September 30<sup>th</sup> 2014 | September 30<sup>th</sup> 2014 | September 30<sup>th</sup> 2014 |
| **Modification Date** |  |  |  |  |

---

**Measure No. 18: Board of Directors Organization**

**18.1** The bylaws specify the functions of the President of the Board of Directors, and his leading responsibilities are the ones mentioned on Recommendation 18.1.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **18.1. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** the Regulation of the Board of Directors, of mandatory compliance for the operation of such body includes these duties substantially, as part of the duties of the Chairman of the Board of Directors. | **YES. Briefly Indicate:** the Regulation of the Board of Directors, of mandatory compliance for the operation of such body includes these duties substantially, as part of the duties of the Chairman of the Board of Directors. | **YES. Briefly Indicate:** the Regulation of the Board of Directors, of mandatory compliance for the operation of such body includes these duties substantially, as part of the duties of the Chairman of the Board of Directors. | **YES. Briefly Indicate:** the Regulation of the Board of Directors, of mandatory compliance for the operation of such body includes these duties substantially, as part of the duties of the Chairman of the Board of Directors. | **YES. Briefly Indicate:** the Regulation of the Board of Directors, of mandatory compliance for the operation of such body includes these duties substantially, as part of the duties of the Chairman of the Board of Directors. |
| **NO. Explain:** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | Implemented in 2015 adopting the recommendation proposed by the Code of Best Practices | Implemented in 2015 adopting the recommendation proposed by the Code of Best Practices | Implemented in 2015 adopting the recommendation proposed by the Code of Best Practices | Implemented in 2015 adopting the recommendation proposed by the Code of Best Practices |
| **Modification Date** |  |  |  |  |

---

**FINANCIAL SUPERINTENDENCE OF COLOMBIA**

***This translation from the original Spanish version is provided for convenience purposes only. No representation is made as to the accuracy of this document and the company does not assume any liability based upon it. Should any doubt or contradiction arise between the Spanish and English versions, the Spanish version shall prevail.***

**18.2.** The corporation's internal regulations foresee the possibility that the President of the Board of Directors may have a different treatment than that of the other members, both in his obligations and his remuneration, because of the scope of his specific functions and his increased time commitment.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **18.2. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Explain:** The Internal Regulations for the operation of the Board of Directors, includes the possibility of having a differentiated treatment to the Chairman with respect to the other members, as a consequence of the scope of their specific functions and their greater dedication of time to these functions | **YES. Briefly Explain:** The Internal Regulations for the operation of the Board of Directors, includes the possibility of having a differentiated treatment to the Chairman with respect to the other members, as a consequence of the scope of their specific functions and their greater dedication of time to these functions | **YES. Briefly Explain:** The Internal Regulations for the operation of the Board of Directors, includes the possibility of having a differentiated treatment to the Chairman with respect to the other members, as a consequence of the scope of their specific functions and their greater dedication of time to these functions | **YES. Briefly Explain:** The Internal Regulations for the operation of the Board of Directors, includes the possibility of having a differentiated treatment to the Chairman with respect to the other members, as a consequence of the scope of their specific functions and their greater dedication of time to these functions | **YES. Briefly Explain:** The Internal Regulations for the operation of the Board of Directors, includes the possibility of having a differentiated treatment to the Chairman with respect to the other members, as a consequence of the scope of their specific functions and their greater dedication of time to these functions |
| **NO. Explain:** | **NO. Explain:** | **NO. Explain:** | **NO. Explain:** | **NO. Explain:** |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | December 9<sup>th</sup> 2020 | December 9<sup>th</sup> 2020 | December 9<sup>th</sup> 2020 | December 9<sup>th</sup> 2020 |
| **Modification Date** |  |  |  |  |

---

**18.3.** The bylaws specify the norms for the appointment of the Secretary of the Board of Directors, including the rules mentioned on Recommendation 18.3.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **18.3. Measure Implementation:** | **YES** | **NO** | **X** | **NA** |
| **YES. Briefly Explain:** |  |  |  |  |
| **NO. Explain:** Pursuant to the Bylaws of the Corporation, the Board of Directors elects its Secretary, who can be one of the directors or another person. The Secretary of the Board of Directors of the Corporation acts exclusively as Secretary of such body and its position does not coincide with other executive positions within the corporation, and it does not correspond to the president of the Corporation to propose the secretary of such body. | **NO. Explain:** Pursuant to the Bylaws of the Corporation, the Board of Directors elects its Secretary, who can be one of the directors or another person. The Secretary of the Board of Directors of the Corporation acts exclusively as Secretary of such body and its position does not coincide with other executive positions within the corporation, and it does not correspond to the president of the Corporation to propose the secretary of such body. | **NO. Explain:** Pursuant to the Bylaws of the Corporation, the Board of Directors elects its Secretary, who can be one of the directors or another person. The Secretary of the Board of Directors of the Corporation acts exclusively as Secretary of such body and its position does not coincide with other executive positions within the corporation, and it does not correspond to the president of the Corporation to propose the secretary of such body. | **NO. Explain:** Pursuant to the Bylaws of the Corporation, the Board of Directors elects its Secretary, who can be one of the directors or another person. The Secretary of the Board of Directors of the Corporation acts exclusively as Secretary of such body and its position does not coincide with other executive positions within the corporation, and it does not correspond to the president of the Corporation to propose the secretary of such body. | **NO. Explain:** Pursuant to the Bylaws of the Corporation, the Board of Directors elects its Secretary, who can be one of the directors or another person. The Secretary of the Board of Directors of the Corporation acts exclusively as Secretary of such body and its position does not coincide with other executive positions within the corporation, and it does not correspond to the president of the Corporation to propose the secretary of such body. |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |  |
| **Implementation Date** | Does Not Apply | Does Not Apply | Does Not Apply | Does Not Apply |
| **Modification Date** |  |  |  |  |

---

**FINANCIAL SUPERINTENDENCE OF COLOMBIA**

***This translation from the original Spanish version is provided for convenience purposes only. No representation is made as to the accuracy of this document and the company does not assume any liability based upon it. Should any doubt or contradiction arise between the Spanish and English versions, the Spanish version shall prevail.***

**18.4.** Regulation of the Board of Directors set forth the Secretary's functions, including the functions mentioned on Recommendation 18.4.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **18.4. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** The duties of the Secretary are established in the Regulations of the Board of Directors, including those pointed out under recommendation 18.4. | **YES. Briefly Indicate:** The duties of the Secretary are established in the Regulations of the Board of Directors, including those pointed out under recommendation 18.4. | **YES. Briefly Indicate:** The duties of the Secretary are established in the Regulations of the Board of Directors, including those pointed out under recommendation 18.4. | **YES. Briefly Indicate:** The duties of the Secretary are established in the Regulations of the Board of Directors, including those pointed out under recommendation 18.4. | **YES. Briefly Indicate:** The duties of the Secretary are established in the Regulations of the Board of Directors, including those pointed out under recommendation 18.4. |
| **NO. Explain:** | | | | |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | |
| **Implementation Date** | Implemented in 2015 adopting the recommendation proposed by the New Country Code. | Implemented in 2015 adopting the recommendation proposed by the New Country Code. | Implemented in 2015 adopting the recommendation proposed by the New Country Code. | Implemented in 2015 adopting the recommendation proposed by the New Country Code. |
| **Modification Date** |  |  |  |  |

---

**18.5.** The Board of Directors has created a Nomination and Compensation Committee.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **18.5. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** In year 2010 the Board of Directors approved the creation of the Compensation Committee of the corporation which is in charge of fixing the remuneration of the President of the company, as well as defining the parameters for the latter to establish the remuneration of senior executives and employees of the company. Although the denomination that the Company gave to the Compensation Committee, is not identical to the one proposed on Recommendation 18.5, its essence, objective and faculties are consistent with the purpose of the recommendation, with respect to the fact that the Company should have a specialized committee joined by members of the Board of Directors, that manage these issues. | **YES. Briefly Indicate:** In year 2010 the Board of Directors approved the creation of the Compensation Committee of the corporation which is in charge of fixing the remuneration of the President of the company, as well as defining the parameters for the latter to establish the remuneration of senior executives and employees of the company. Although the denomination that the Company gave to the Compensation Committee, is not identical to the one proposed on Recommendation 18.5, its essence, objective and faculties are consistent with the purpose of the recommendation, with respect to the fact that the Company should have a specialized committee joined by members of the Board of Directors, that manage these issues. | **YES. Briefly Indicate:** In year 2010 the Board of Directors approved the creation of the Compensation Committee of the corporation which is in charge of fixing the remuneration of the President of the company, as well as defining the parameters for the latter to establish the remuneration of senior executives and employees of the company. Although the denomination that the Company gave to the Compensation Committee, is not identical to the one proposed on Recommendation 18.5, its essence, objective and faculties are consistent with the purpose of the recommendation, with respect to the fact that the Company should have a specialized committee joined by members of the Board of Directors, that manage these issues. | **YES. Briefly Indicate:** In year 2010 the Board of Directors approved the creation of the Compensation Committee of the corporation which is in charge of fixing the remuneration of the President of the company, as well as defining the parameters for the latter to establish the remuneration of senior executives and employees of the company. Although the denomination that the Company gave to the Compensation Committee, is not identical to the one proposed on Recommendation 18.5, its essence, objective and faculties are consistent with the purpose of the recommendation, with respect to the fact that the Company should have a specialized committee joined by members of the Board of Directors, that manage these issues. | **YES. Briefly Indicate:** In year 2010 the Board of Directors approved the creation of the Compensation Committee of the corporation which is in charge of fixing the remuneration of the President of the company, as well as defining the parameters for the latter to establish the remuneration of senior executives and employees of the company. Although the denomination that the Company gave to the Compensation Committee, is not identical to the one proposed on Recommendation 18.5, its essence, objective and faculties are consistent with the purpose of the recommendation, with respect to the fact that the Company should have a specialized committee joined by members of the Board of Directors, that manage these issues. |
| **NO. Explain:** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. |
| **Modification Date** |  |  |  |  |

---

**18.6.** The Board of Directors has created a Risk Committee.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **18.6. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** In 2021, the Board of Directors approved the creation of the company's Risk Committee, which is responsible for assisting it in the fulfilling of its supervisory responsibilities in relation to the Conglomerate's risk management. | **YES. Briefly Indicate:** In 2021, the Board of Directors approved the creation of the company's Risk Committee, which is responsible for assisting it in the fulfilling of its supervisory responsibilities in relation to the Conglomerate's risk management. | **YES. Briefly Indicate:** In 2021, the Board of Directors approved the creation of the company's Risk Committee, which is responsible for assisting it in the fulfilling of its supervisory responsibilities in relation to the Conglomerate's risk management. | **YES. Briefly Indicate:** In 2021, the Board of Directors approved the creation of the company's Risk Committee, which is responsible for assisting it in the fulfilling of its supervisory responsibilities in relation to the Conglomerate's risk management. | **YES. Briefly Indicate:** In 2021, the Board of Directors approved the creation of the company's Risk Committee, which is responsible for assisting it in the fulfilling of its supervisory responsibilities in relation to the Conglomerate's risk management. |
| NO. Explain: | NO. Explain: | NO. Explain: | NO. Explain: | NO. Explain: |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | June 9, 2021 | June 9, 2021 | June 9, 2021 | June 9, 2021 |
| **Modification Date** |  |  |  |  |

---

**FINANCIAL SUPERINTENDENCE OF COLOMBIA**

***This translation from the original Spanish version is provided for convenience purposes only. No representation is made as to the accuracy of this document and the company does not assume any liability based upon it. Should any doubt or contradiction arise between the Spanish and English versions, the Spanish version shall prevail.***

**18.7.** The Board of Directors has created a Corporate Governance Committee.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **18.7. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Explain** The Board of Director´s meeting held on August 26, 2020 approved the creation of the Corporate Governance Committee for the company. | **YES. Briefly Explain** The Board of Director´s meeting held on August 26, 2020 approved the creation of the Corporate Governance Committee for the company. | **YES. Briefly Explain** The Board of Director´s meeting held on August 26, 2020 approved the creation of the Corporate Governance Committee for the company. | **YES. Briefly Explain** The Board of Director´s meeting held on August 26, 2020 approved the creation of the Corporate Governance Committee for the company. | **YES. Briefly Explain** The Board of Director´s meeting held on August 26, 2020 approved the creation of the Corporate Governance Committee for the company. |
| **NO. Explain:** | **NO. Explain:** | **NO. Explain:** | **NO. Explain:** | **NO. Explain:** |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | August 26<sup>th</sup> 2020 | August 26<sup>th</sup> 2020 | August 26<sup>th</sup> 2020 | August 26<sup>th</sup> 2020 |
| **Modification Date** |  |  |  |  |

---

**18.8.** If the corporation considers that it is unnecessary to create all these committees, their functions are distributed among the committees that do exist, or they are performed by the Board of Directors at large.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **18.8. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Explain:** The Corporation has implemented all the Committees suggested by the Code for Best Corporate Practices. | **YES. Briefly Explain:** The Corporation has implemented all the Committees suggested by the Code for Best Corporate Practices. | **YES. Briefly Explain:** The Corporation has implemented all the Committees suggested by the Code for Best Corporate Practices. | **YES. Briefly Explain:** The Corporation has implemented all the Committees suggested by the Code for Best Corporate Practices. | **YES. Briefly Explain:** The Corporation has implemented all the Committees suggested by the Code for Best Corporate Practices. |
| **NO. Explain:** | **NO. Explain:** | **NO. Explain:** | **NO. Explain:** | **NO. Explain:** |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | August 26<sup>th</sup>, 2020. | August 26<sup>th</sup>, 2020. | August 26<sup>th</sup>, 2020. | August 26<sup>th</sup>, 2020. |
| **Modification Date** |  |  |  |  |

---

**18.9.** Each of the committees of the Board of Directors has its internal regulation for its creation, its functions, the subjects in which the committee must work, and its operation. They pay special attention to the channels of communication between the committees and the Board of Directors; and in the case of conglomerates, to the tools for the interaction and coordination between the committees of the Board of Directors of the holding company and those of the subordinate companies, if they exist.

---

| | | | | | |
|:---|:---|:---|:---|:---|:---|
|  | | **YES** | **NO** | **X** | **NA** |
| **YES. Briefly Explain:** | **YES. Briefly Explain:** | **YES. Briefly Explain:** | **YES. Briefly Explain:** | **YES. Briefly Explain:** | **YES. Briefly Explain:** |
| **NO. Explain:** the Corporation has a regulation for the Audit Committee, Corporate Governance Committee and Risk Committee with guidelines such as the Reference Framework for Institutional Relations for the coordination of Committees of the Board of Directors of the Parent Company and those of the Subordinate companies. The Corporation will consider the possibility of establishing regulations for its other support committees for a subsequent term. | **NO. Explain:** the Corporation has a regulation for the Audit Committee, Corporate Governance Committee and Risk Committee with guidelines such as the Reference Framework for Institutional Relations for the coordination of Committees of the Board of Directors of the Parent Company and those of the Subordinate companies. The Corporation will consider the possibility of establishing regulations for its other support committees for a subsequent term. | **NO. Explain:** the Corporation has a regulation for the Audit Committee, Corporate Governance Committee and Risk Committee with guidelines such as the Reference Framework for Institutional Relations for the coordination of Committees of the Board of Directors of the Parent Company and those of the Subordinate companies. The Corporation will consider the possibility of establishing regulations for its other support committees for a subsequent term. | **NO. Explain:** the Corporation has a regulation for the Audit Committee, Corporate Governance Committee and Risk Committee with guidelines such as the Reference Framework for Institutional Relations for the coordination of Committees of the Board of Directors of the Parent Company and those of the Subordinate companies. The Corporation will consider the possibility of establishing regulations for its other support committees for a subsequent term. | **NO. Explain:** the Corporation has a regulation for the Audit Committee, Corporate Governance Committee and Risk Committee with guidelines such as the Reference Framework for Institutional Relations for the coordination of Committees of the Board of Directors of the Parent Company and those of the Subordinate companies. The Corporation will consider the possibility of establishing regulations for its other support committees for a subsequent term. | **NO. Explain:** the Corporation has a regulation for the Audit Committee, Corporate Governance Committee and Risk Committee with guidelines such as the Reference Framework for Institutional Relations for the coordination of Committees of the Board of Directors of the Parent Company and those of the Subordinate companies. The Corporation will consider the possibility of establishing regulations for its other support committees for a subsequent term. |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | | |
| **Implementation Date** | Does Not Apply | Does Not Apply | Does Not Apply | Does Not Apply | Does Not Apply |
| **Modification Date** | | | | | |

---

**FINANCIAL SUPERINTENDENCE OF COLOMBIA**

***This translation from the original Spanish version is provided for convenience purposes only. No representation is made as to the accuracy of this document and the company does not assume any liability based upon it. Should any doubt or contradiction arise between the Spanish and English versions, the Spanish version shall prevail.***

**18.10.** The committees of the Board of Directors are comprised exclusively by independent or proprietary members exclusively; they have a minimum of three (3) members, and are chaired by an independent member. In the case of the Nomination and Compensation Committee, the independent members are always a majority.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **18.10. Measure Implementation** | **YES** | **NO** | **X** | **NA** |
| **YES. Briefly Explain** |  |  |  |  |
| **NO. Explain:** the corporation will consider the possibility of adopting this recommendation for a subsequent term. | **NO. Explain:** the corporation will consider the possibility of adopting this recommendation for a subsequent term. | **NO. Explain:** the corporation will consider the possibility of adopting this recommendation for a subsequent term. | **NO. Explain:** the corporation will consider the possibility of adopting this recommendation for a subsequent term. | **NO. Explain:** the corporation will consider the possibility of adopting this recommendation for a subsequent term. |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |  |
| **Implementation Date** | Does Not Apply | Does Not Apply | Does Not Apply | Does Not Apply |
| **Modification Date** |  |  |  |  |

---

**18.11.** The committees of the Board of Directors may have the support, specific or permanent, of senior management members, with experience in the matters of the committee's competence, and/or that of external experts.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **18.11. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** Pursuant to the Regulations of the Board of Directors of the Corporation, the Committees of the Board of Directors may have the support of members of the senior management and/or external advisors when deemed as convenient or necessary for performing the tasks of their competence. | **YES. Briefly Indicate:** Pursuant to the Regulations of the Board of Directors of the Corporation, the Committees of the Board of Directors may have the support of members of the senior management and/or external advisors when deemed as convenient or necessary for performing the tasks of their competence. | **YES. Briefly Indicate:** Pursuant to the Regulations of the Board of Directors of the Corporation, the Committees of the Board of Directors may have the support of members of the senior management and/or external advisors when deemed as convenient or necessary for performing the tasks of their competence. | **YES. Briefly Indicate:** Pursuant to the Regulations of the Board of Directors of the Corporation, the Committees of the Board of Directors may have the support of members of the senior management and/or external advisors when deemed as convenient or necessary for performing the tasks of their competence. | **YES. Briefly Indicate:** Pursuant to the Regulations of the Board of Directors of the Corporation, the Committees of the Board of Directors may have the support of members of the senior management and/or external advisors when deemed as convenient or necessary for performing the tasks of their competence. |
| **NO. Explain:** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the New Country Code. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the New Country Code. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the New Country Code. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the New Country Code. |
| **Modification Date** |  |  |  |  |

---

**FINANCIAL SUPERINTENDENCE OF COLOMBIA**

***This translation from the original Spanish version is provided for convenience purposes only. No representation is made as to the accuracy of this document and the company does not assume any liability based upon it. Should any doubt or contradiction arise between the Spanish and English versions, the Spanish version shall prevail.***

**18.12.** In the creation of its committees, the Board of Directors takes into account the profiles, knowledge, and professional experience of their members, with regard to the committee's subject matter.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **18.12. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** Pursuant to the Regulations of the Board of Directors, for the integration of its Committees, the Board of Directors will consider, among other factors, the profiles, knowledge and professional expertise of the members designated to form part of them, relating to the subject matter addressed by the Committee. | **YES. Briefly Indicate:** Pursuant to the Regulations of the Board of Directors, for the integration of its Committees, the Board of Directors will consider, among other factors, the profiles, knowledge and professional expertise of the members designated to form part of them, relating to the subject matter addressed by the Committee. | **YES. Briefly Indicate:** Pursuant to the Regulations of the Board of Directors, for the integration of its Committees, the Board of Directors will consider, among other factors, the profiles, knowledge and professional expertise of the members designated to form part of them, relating to the subject matter addressed by the Committee. | **YES. Briefly Indicate:** Pursuant to the Regulations of the Board of Directors, for the integration of its Committees, the Board of Directors will consider, among other factors, the profiles, knowledge and professional expertise of the members designated to form part of them, relating to the subject matter addressed by the Committee. | **YES. Briefly Indicate:** Pursuant to the Regulations of the Board of Directors, for the integration of its Committees, the Board of Directors will consider, among other factors, the profiles, knowledge and professional expertise of the members designated to form part of them, relating to the subject matter addressed by the Committee. |
| **NO. Explain:** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the New Country Code. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the New Country Code. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the New Country Code. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the New Country Code. |
| **Modification Date** |  |  |  |  |

---

**18.13.** The committees draft minutes of their meetings and send a copy of them to all the members of the corporation's Board of Directors. If the committees have delegated functions that enable them to take decisions, the minutes will comply with the requirements of the articles 189 and 431 of the Code of Commerce.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **18.13. Measure Implementation** | **YES** | **NO** | **X** | **NA** |
| **YES. Briefly Indicate:** |  |  |  |  |
| **NO. Explain:** the Corporation will consider the possibility of adopting this recommendation for a subsequent term for all its support committees. | **NO. Explain:** the Corporation will consider the possibility of adopting this recommendation for a subsequent term for all its support committees. | **NO. Explain:** the Corporation will consider the possibility of adopting this recommendation for a subsequent term for all its support committees. | **NO. Explain:** the Corporation will consider the possibility of adopting this recommendation for a subsequent term for all its support committees. | **NO. Explain:** the Corporation will consider the possibility of adopting this recommendation for a subsequent term for all its support committees. |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |  |
| **Implementation Date** | Does Not Apply | Does Not Apply | Does Not Apply | Does Not Apply |
| **Modification Date** |  |  |  |  |

---

**FINANCIAL SUPERINTENDENCE OF COLOMBIA**

***This translation from the original Spanish version is provided for convenience purposes only. No representation is made as to the accuracy of this document and the company does not assume any liability based upon it. Should any doubt or contradiction arise between the Spanish and English versions, the Spanish version shall prevail.***

**18.14.** Except if the applicable legal or regulatory framework demands their creation, in the case of conglomerates, the internal regulations foresee that the Boards of Directors of the subordinate companies may decide not to create specific committees to deal with certain matters, and those matters may be assumed by the committees of the Board of Directors of the holding company. However, this will not imply a transfer of the responsibilities of the Boards of Directors of the subordinate companies to the holding company.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **18.14. Measure Implementation:** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** Grupo Aval acting as Holding of the Aval Financial Conglomerate has implemented a Reference Framework for Institutional Relations and in numeral 4.2 and 4.3 it delegates the total administrative independence in the composition of its Board of Directors of its subordinated companies, maintaining the general guidelines for the directors. Those Board of Directors of subordinated companies that have to comply with the Code of Best Practices Survey having implemented the support Committees that they consider pertinent for their operation, complying with the current legal framework and the best corporate governance practices.<br>It is also established that: "In the case of Grupo Aval, as a Holding entity, the support Committees will serve to facilitate corporate strategic orientation, and the supervision, control an effective administration of the Organization's governance and control architecture, acting as a channel of dialogue with the support Committees of the Subordinated entities or before the Board of Directors of such entities if there is not support committee with functions similar to those of the Holding." | **YES. Briefly Indicate:** Grupo Aval acting as Holding of the Aval Financial Conglomerate has implemented a Reference Framework for Institutional Relations and in numeral 4.2 and 4.3 it delegates the total administrative independence in the composition of its Board of Directors of its subordinated companies, maintaining the general guidelines for the directors. Those Board of Directors of subordinated companies that have to comply with the Code of Best Practices Survey having implemented the support Committees that they consider pertinent for their operation, complying with the current legal framework and the best corporate governance practices.<br>It is also established that: "In the case of Grupo Aval, as a Holding entity, the support Committees will serve to facilitate corporate strategic orientation, and the supervision, control an effective administration of the Organization's governance and control architecture, acting as a channel of dialogue with the support Committees of the Subordinated entities or before the Board of Directors of such entities if there is not support committee with functions similar to those of the Holding." | **YES. Briefly Indicate:** Grupo Aval acting as Holding of the Aval Financial Conglomerate has implemented a Reference Framework for Institutional Relations and in numeral 4.2 and 4.3 it delegates the total administrative independence in the composition of its Board of Directors of its subordinated companies, maintaining the general guidelines for the directors. Those Board of Directors of subordinated companies that have to comply with the Code of Best Practices Survey having implemented the support Committees that they consider pertinent for their operation, complying with the current legal framework and the best corporate governance practices.<br>It is also established that: "In the case of Grupo Aval, as a Holding entity, the support Committees will serve to facilitate corporate strategic orientation, and the supervision, control an effective administration of the Organization's governance and control architecture, acting as a channel of dialogue with the support Committees of the Subordinated entities or before the Board of Directors of such entities if there is not support committee with functions similar to those of the Holding." | **YES. Briefly Indicate:** Grupo Aval acting as Holding of the Aval Financial Conglomerate has implemented a Reference Framework for Institutional Relations and in numeral 4.2 and 4.3 it delegates the total administrative independence in the composition of its Board of Directors of its subordinated companies, maintaining the general guidelines for the directors. Those Board of Directors of subordinated companies that have to comply with the Code of Best Practices Survey having implemented the support Committees that they consider pertinent for their operation, complying with the current legal framework and the best corporate governance practices.<br>It is also established that: "In the case of Grupo Aval, as a Holding entity, the support Committees will serve to facilitate corporate strategic orientation, and the supervision, control an effective administration of the Organization's governance and control architecture, acting as a channel of dialogue with the support Committees of the Subordinated entities or before the Board of Directors of such entities if there is not support committee with functions similar to those of the Holding." | **YES. Briefly Indicate:** Grupo Aval acting as Holding of the Aval Financial Conglomerate has implemented a Reference Framework for Institutional Relations and in numeral 4.2 and 4.3 it delegates the total administrative independence in the composition of its Board of Directors of its subordinated companies, maintaining the general guidelines for the directors. Those Board of Directors of subordinated companies that have to comply with the Code of Best Practices Survey having implemented the support Committees that they consider pertinent for their operation, complying with the current legal framework and the best corporate governance practices.<br>It is also established that: "In the case of Grupo Aval, as a Holding entity, the support Committees will serve to facilitate corporate strategic orientation, and the supervision, control an effective administration of the Organization's governance and control architecture, acting as a channel of dialogue with the support Committees of the Subordinated entities or before the Board of Directors of such entities if there is not support committee with functions similar to those of the Holding." |
| **NO. Explain:** | **NO. Explain:** | **NO. Explain:** | **NO. Explain:** | **NO. Explain:** |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | October 28<sup>th</sup>, 2015. | October 28<sup>th</sup>, 2015. | October 28<sup>th</sup>, 2015. | October 28<sup>th</sup>, 2015. |
| **Modification Date** |  |  |  |  |

---

**18.15.** The main duty of the Audit Committee is to assist the Board of Directors in its supervisory functions through the assessment of the accounting procedures, the interaction with the Statutory Auditor and, in general, the monitoring of the corporation's Control Architecture, including its risk management system.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **18.15. Measure Implementation:** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** Pursuant to the corporate By laws (Art 29), the following are duties of the Committee are: 1. Providing support to the Board of Directors in decision making regarding internal control and its improvement, 2. Supervising the company's internal control structure, with the purpose of establishing whether the procedures designed reasonably protect the assets of the corporation 3. Overseeing the transparency in the drafting, presentation and disclosure of the financial information prepared by the corporation, 4. Assessing the Financial Statements of the Corporation before they are submitted to the Board of Directors and to the General Shareholders Meeting, 5. Constantly assess the procedures established for determining the sufficiency of internal control, 7. Reviewing and discussing the financial statements, the quarterly reports and other financial reports prepared by the Corporation with the managers and the Statutory Auditor of the Corporation, 8. Recommend the General Meeting the appointment and compensation of the Statutory Auditor of the Corporation, 9. Approving the tasks performed by the Statutory Auditor in favor of the Corporation whether or not they imply auditing labor, and 10. Discussing the risk management policies with the Management. | **YES. Briefly Indicate:** Pursuant to the corporate By laws (Art 29), the following are duties of the Committee are: 1. Providing support to the Board of Directors in decision making regarding internal control and its improvement, 2. Supervising the company's internal control structure, with the purpose of establishing whether the procedures designed reasonably protect the assets of the corporation 3. Overseeing the transparency in the drafting, presentation and disclosure of the financial information prepared by the corporation, 4. Assessing the Financial Statements of the Corporation before they are submitted to the Board of Directors and to the General Shareholders Meeting, 5. Constantly assess the procedures established for determining the sufficiency of internal control, 7. Reviewing and discussing the financial statements, the quarterly reports and other financial reports prepared by the Corporation with the managers and the Statutory Auditor of the Corporation, 8. Recommend the General Meeting the appointment and compensation of the Statutory Auditor of the Corporation, 9. Approving the tasks performed by the Statutory Auditor in favor of the Corporation whether or not they imply auditing labor, and 10. Discussing the risk management policies with the Management. | **YES. Briefly Indicate:** Pursuant to the corporate By laws (Art 29), the following are duties of the Committee are: 1. Providing support to the Board of Directors in decision making regarding internal control and its improvement, 2. Supervising the company's internal control structure, with the purpose of establishing whether the procedures designed reasonably protect the assets of the corporation 3. Overseeing the transparency in the drafting, presentation and disclosure of the financial information prepared by the corporation, 4. Assessing the Financial Statements of the Corporation before they are submitted to the Board of Directors and to the General Shareholders Meeting, 5. Constantly assess the procedures established for determining the sufficiency of internal control, 7. Reviewing and discussing the financial statements, the quarterly reports and other financial reports prepared by the Corporation with the managers and the Statutory Auditor of the Corporation, 8. Recommend the General Meeting the appointment and compensation of the Statutory Auditor of the Corporation, 9. Approving the tasks performed by the Statutory Auditor in favor of the Corporation whether or not they imply auditing labor, and 10. Discussing the risk management policies with the Management. | **YES. Briefly Indicate:** Pursuant to the corporate By laws (Art 29), the following are duties of the Committee are: 1. Providing support to the Board of Directors in decision making regarding internal control and its improvement, 2. Supervising the company's internal control structure, with the purpose of establishing whether the procedures designed reasonably protect the assets of the corporation 3. Overseeing the transparency in the drafting, presentation and disclosure of the financial information prepared by the corporation, 4. Assessing the Financial Statements of the Corporation before they are submitted to the Board of Directors and to the General Shareholders Meeting, 5. Constantly assess the procedures established for determining the sufficiency of internal control, 7. Reviewing and discussing the financial statements, the quarterly reports and other financial reports prepared by the Corporation with the managers and the Statutory Auditor of the Corporation, 8. Recommend the General Meeting the appointment and compensation of the Statutory Auditor of the Corporation, 9. Approving the tasks performed by the Statutory Auditor in favor of the Corporation whether or not they imply auditing labor, and 10. Discussing the risk management policies with the Management. | **YES. Briefly Indicate:** Pursuant to the corporate By laws (Art 29), the following are duties of the Committee are: 1. Providing support to the Board of Directors in decision making regarding internal control and its improvement, 2. Supervising the company's internal control structure, with the purpose of establishing whether the procedures designed reasonably protect the assets of the corporation 3. Overseeing the transparency in the drafting, presentation and disclosure of the financial information prepared by the corporation, 4. Assessing the Financial Statements of the Corporation before they are submitted to the Board of Directors and to the General Shareholders Meeting, 5. Constantly assess the procedures established for determining the sufficiency of internal control, 7. Reviewing and discussing the financial statements, the quarterly reports and other financial reports prepared by the Corporation with the managers and the Statutory Auditor of the Corporation, 8. Recommend the General Meeting the appointment and compensation of the Statutory Auditor of the Corporation, 9. Approving the tasks performed by the Statutory Auditor in favor of the Corporation whether or not they imply auditing labor, and 10. Discussing the risk management policies with the Management. |
| **NO. Explain:** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. |
| **Modification Date** |  |  |  |  |

---

**FINANCIAL SUPERINTENDENCE OF COLOMBIA**

***This translation from the original Spanish version is provided for convenience purposes only. No representation is made as to the accuracy of this document and the company does not assume any liability based upon it. Should any doubt or contradiction arise between the Spanish and English versions, the Spanish version shall prevail.***

**18.16.** The members of the Audit Committee are knowledgeable in accounting, finance, and other related matters. This enables them to treat the committee's subject matters with accuracy, and with an adequate understanding of their scope and complexity.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **18.16. Measure Implementation:** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** The members of the Audit Committee have enough accounting and financial knowledge and expertise and in general, the required capacities to provide their opinions on topics of their competence. | **YES. Briefly Indicate:** The members of the Audit Committee have enough accounting and financial knowledge and expertise and in general, the required capacities to provide their opinions on topics of their competence. | **YES. Briefly Indicate:** The members of the Audit Committee have enough accounting and financial knowledge and expertise and in general, the required capacities to provide their opinions on topics of their competence. | **YES. Briefly Indicate:** The members of the Audit Committee have enough accounting and financial knowledge and expertise and in general, the required capacities to provide their opinions on topics of their competence. | **YES. Briefly Indicate:** The members of the Audit Committee have enough accounting and financial knowledge and expertise and in general, the required capacities to provide their opinions on topics of their competence. |
| **NO. Explain:** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. |
| **Modification Date** |  |  |  |  |

---

**18.17.** Upon request of the President of the Assembly, the President of the Audit Committee informs the General Assembly of Shareholders of concrete aspects of the committee's work, for instance, the analysis of the scope and contents of the Report of the Statutory Auditor.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **18.17. Measure Implementation:** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** Pursuant to the Regulations of the General Shareholders Meeting, the President of the Corporation and the remaining members of the Board of Directors, including the chairmen of the Support Committees shall attend the Meetings to address the queries that the shareholders may submit relating to the matters under their care or for reporting specific aspects of their work, when requested to do so by the Chairman of the Meeting when deemed as pertinent. In the event that any of them are not be able to attend, other members of the Board of Directors, of the respective committee or of the Senior Management, as the case may be, may address the queries arising regarding the affairs under the care of such management bodies, in such a way that their absences may not constitute an impediment to carry out the Meeting. | **YES. Briefly Indicate:** Pursuant to the Regulations of the General Shareholders Meeting, the President of the Corporation and the remaining members of the Board of Directors, including the chairmen of the Support Committees shall attend the Meetings to address the queries that the shareholders may submit relating to the matters under their care or for reporting specific aspects of their work, when requested to do so by the Chairman of the Meeting when deemed as pertinent. In the event that any of them are not be able to attend, other members of the Board of Directors, of the respective committee or of the Senior Management, as the case may be, may address the queries arising regarding the affairs under the care of such management bodies, in such a way that their absences may not constitute an impediment to carry out the Meeting. | **YES. Briefly Indicate:** Pursuant to the Regulations of the General Shareholders Meeting, the President of the Corporation and the remaining members of the Board of Directors, including the chairmen of the Support Committees shall attend the Meetings to address the queries that the shareholders may submit relating to the matters under their care or for reporting specific aspects of their work, when requested to do so by the Chairman of the Meeting when deemed as pertinent. In the event that any of them are not be able to attend, other members of the Board of Directors, of the respective committee or of the Senior Management, as the case may be, may address the queries arising regarding the affairs under the care of such management bodies, in such a way that their absences may not constitute an impediment to carry out the Meeting. | **YES. Briefly Indicate:** Pursuant to the Regulations of the General Shareholders Meeting, the President of the Corporation and the remaining members of the Board of Directors, including the chairmen of the Support Committees shall attend the Meetings to address the queries that the shareholders may submit relating to the matters under their care or for reporting specific aspects of their work, when requested to do so by the Chairman of the Meeting when deemed as pertinent. In the event that any of them are not be able to attend, other members of the Board of Directors, of the respective committee or of the Senior Management, as the case may be, may address the queries arising regarding the affairs under the care of such management bodies, in such a way that their absences may not constitute an impediment to carry out the Meeting. | **YES. Briefly Indicate:** Pursuant to the Regulations of the General Shareholders Meeting, the President of the Corporation and the remaining members of the Board of Directors, including the chairmen of the Support Committees shall attend the Meetings to address the queries that the shareholders may submit relating to the matters under their care or for reporting specific aspects of their work, when requested to do so by the Chairman of the Meeting when deemed as pertinent. In the event that any of them are not be able to attend, other members of the Board of Directors, of the respective committee or of the Senior Management, as the case may be, may address the queries arising regarding the affairs under the care of such management bodies, in such a way that their absences may not constitute an impediment to carry out the Meeting. |
| **NO. Explain:** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | Implemented in 2015 adopting the recommendation proposed by the New Country Code. | Implemented in 2015 adopting the recommendation proposed by the New Country Code. | Implemented in 2015 adopting the recommendation proposed by the New Country Code. | Implemented in 2015 adopting the recommendation proposed by the New Country Code. |
| **Modification Date** |  |  |  |  |

---

**FINANCIAL SUPERINTENDENCE OF COLOMBIA**

***This translation from the original Spanish version is provided for convenience purposes only. No representation is made as to the accuracy of this document and the company does not assume any liability based upon it. Should any doubt or contradiction arise between the Spanish and English versions, the Spanish version shall prevail.***

**18.18.** The committee's internal regulation assigns the functions mentioned on Recommendation 18.18.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **18.18. Measure Implementation:** | **YES** | **NO** | **X** | **NA** |
| **YES. Briefly Indicate** |  |  |  |  |
| **NO. Explain:** The Bylaws of the Corporation, the Regulations of the Audit Committee and certain other documents of corporate governance of the Company established several functions as those proposed by recommendation 18.18 as non-delegable of the Audit Committee. The Corporation shall consider the possibility of adopting this recommendation as a whole for a subsequent term. | **NO. Explain:** The Bylaws of the Corporation, the Regulations of the Audit Committee and certain other documents of corporate governance of the Company established several functions as those proposed by recommendation 18.18 as non-delegable of the Audit Committee. The Corporation shall consider the possibility of adopting this recommendation as a whole for a subsequent term. | **NO. Explain:** The Bylaws of the Corporation, the Regulations of the Audit Committee and certain other documents of corporate governance of the Company established several functions as those proposed by recommendation 18.18 as non-delegable of the Audit Committee. The Corporation shall consider the possibility of adopting this recommendation as a whole for a subsequent term. | **NO. Explain:** The Bylaws of the Corporation, the Regulations of the Audit Committee and certain other documents of corporate governance of the Company established several functions as those proposed by recommendation 18.18 as non-delegable of the Audit Committee. The Corporation shall consider the possibility of adopting this recommendation as a whole for a subsequent term. | **NO. Explain:** The Bylaws of the Corporation, the Regulations of the Audit Committee and certain other documents of corporate governance of the Company established several functions as those proposed by recommendation 18.18 as non-delegable of the Audit Committee. The Corporation shall consider the possibility of adopting this recommendation as a whole for a subsequent term. |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |  |
| **Implementation Date** | Does Not Apply | Does Not Apply | Does Not Apply | Does Not Apply |
| **Modification Date** |  |  |  |  |

---

**18.19.** The main goal of the Nomination and Compensation Committee is to support the Board of Directors in its advising and decision-making duties relative to the appointment and compensation of Board members and senior managers. In addition, it must monitor regularly the observance of Corporate Governance norms, recommendations, and principles (in those cases when this function is not assigned explicitly to another corporate committee).

---

| | | | | |
|:---|:---|:---|:---|:---|
| **18.19. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** The Compensation Committee of the Corporation is responsible for fixing the remuneration of the President of the company, as well as for defining the criteria to establishes the remuneration of the senior executives and employees of the Company. The Board of Directors maintains the function of appointing the Senior Management and the General Assembly of Shareholders is in charge of appointment and remuneration of the members of the Board of Directors. | **YES. Briefly Indicate:** The Compensation Committee of the Corporation is responsible for fixing the remuneration of the President of the company, as well as for defining the criteria to establishes the remuneration of the senior executives and employees of the Company. The Board of Directors maintains the function of appointing the Senior Management and the General Assembly of Shareholders is in charge of appointment and remuneration of the members of the Board of Directors. | **YES. Briefly Indicate:** The Compensation Committee of the Corporation is responsible for fixing the remuneration of the President of the company, as well as for defining the criteria to establishes the remuneration of the senior executives and employees of the Company. The Board of Directors maintains the function of appointing the Senior Management and the General Assembly of Shareholders is in charge of appointment and remuneration of the members of the Board of Directors. | **YES. Briefly Indicate:** The Compensation Committee of the Corporation is responsible for fixing the remuneration of the President of the company, as well as for defining the criteria to establishes the remuneration of the senior executives and employees of the Company. The Board of Directors maintains the function of appointing the Senior Management and the General Assembly of Shareholders is in charge of appointment and remuneration of the members of the Board of Directors. | **YES. Briefly Indicate:** The Compensation Committee of the Corporation is responsible for fixing the remuneration of the President of the company, as well as for defining the criteria to establishes the remuneration of the senior executives and employees of the Company. The Board of Directors maintains the function of appointing the Senior Management and the General Assembly of Shareholders is in charge of appointment and remuneration of the members of the Board of Directors. |
| **NO. Explain:** | **NO. Explain:** | **NO. Explain:** | **NO. Explain:** | **NO. Explain:** |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | September 30<sup>th</sup>, 2014. | September 30<sup>th</sup>, 2014. | September 30<sup>th</sup>, 2014. | September 30<sup>th</sup>, 2014. |
| **Modification Date** |  |  |  |  |

---

**FINANCIAL SUPERINTENDENCE OF COLOMBIA**

***This translation from the original Spanish version is provided for convenience purposes only. No representation is made as to the accuracy of this document and the company does not assume any liability based upon it. Should any doubt or contradiction arise between the Spanish and English versions, the Spanish version shall prevail.***

**18.20.** Some members of the Nomination and Compensation Committee are knowledgeable in strategy and human resources (selection, recruitment, hiring, training, staff management), compensation policies and related matters, so that they understand their scope and complexity within the corporation.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **18.20. Measure Implementation:** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** Members of the Compensation Committee have the required experience in strategy, human resources, salary policies and related subjects with enough capacity to understand the scope and complexity that these matters represent for the Corporation.<br>In effect, the Company considers that the outstanding experience of the directors that joined the Compensation Committee of Grupo Aval and particularly their directive role in companies of considerable size and relevant activities in different sectors of the economy, are enough criteria to argue their suitability and knowledge in the areas of strategy, human resources, wage policies and similar matters. | **YES. Briefly Indicate:** Members of the Compensation Committee have the required experience in strategy, human resources, salary policies and related subjects with enough capacity to understand the scope and complexity that these matters represent for the Corporation.<br>In effect, the Company considers that the outstanding experience of the directors that joined the Compensation Committee of Grupo Aval and particularly their directive role in companies of considerable size and relevant activities in different sectors of the economy, are enough criteria to argue their suitability and knowledge in the areas of strategy, human resources, wage policies and similar matters. | **YES. Briefly Indicate:** Members of the Compensation Committee have the required experience in strategy, human resources, salary policies and related subjects with enough capacity to understand the scope and complexity that these matters represent for the Corporation.<br>In effect, the Company considers that the outstanding experience of the directors that joined the Compensation Committee of Grupo Aval and particularly their directive role in companies of considerable size and relevant activities in different sectors of the economy, are enough criteria to argue their suitability and knowledge in the areas of strategy, human resources, wage policies and similar matters. | **YES. Briefly Indicate:** Members of the Compensation Committee have the required experience in strategy, human resources, salary policies and related subjects with enough capacity to understand the scope and complexity that these matters represent for the Corporation.<br>In effect, the Company considers that the outstanding experience of the directors that joined the Compensation Committee of Grupo Aval and particularly their directive role in companies of considerable size and relevant activities in different sectors of the economy, are enough criteria to argue their suitability and knowledge in the areas of strategy, human resources, wage policies and similar matters. | **YES. Briefly Indicate:** Members of the Compensation Committee have the required experience in strategy, human resources, salary policies and related subjects with enough capacity to understand the scope and complexity that these matters represent for the Corporation.<br>In effect, the Company considers that the outstanding experience of the directors that joined the Compensation Committee of Grupo Aval and particularly their directive role in companies of considerable size and relevant activities in different sectors of the economy, are enough criteria to argue their suitability and knowledge in the areas of strategy, human resources, wage policies and similar matters. |
| **NO. Explain:** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. |
| **Modification Date** |  |  |  |  |

---

**18.21.** Upon request of the President of the Assembly, the President of the Nomination and Compensation Committee may inform the General Assembly of Shareholders on the concrete tasks that the committee has performed, such as monitoring the compensation policies for the Board of Directors and senior managers.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **18.21. Measure Implementation:** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** Pursuant to the Regulations of the General Shareholders Meeting, the President of the Corporation and the remaining members of the Board of Directors, including the chairmen of their Support Committees shall attend the Meetings to address the queries that the shareholders may submit relating to the matters under their care or for reporting specific aspects of their work, when requested to do so by the Chairman of the Meeting deemed as appropriate. In the event that any of them are not be able to attend, other members of the Board of Directors of the respective committee or of the Senior Management as the case may be, may address the queries that may arise regarding the issues under the care of such management bodies, in such a way that their absences may not constitute an impediment for carrying out the Meeting. | **YES. Briefly Indicate:** Pursuant to the Regulations of the General Shareholders Meeting, the President of the Corporation and the remaining members of the Board of Directors, including the chairmen of their Support Committees shall attend the Meetings to address the queries that the shareholders may submit relating to the matters under their care or for reporting specific aspects of their work, when requested to do so by the Chairman of the Meeting deemed as appropriate. In the event that any of them are not be able to attend, other members of the Board of Directors of the respective committee or of the Senior Management as the case may be, may address the queries that may arise regarding the issues under the care of such management bodies, in such a way that their absences may not constitute an impediment for carrying out the Meeting. | **YES. Briefly Indicate:** Pursuant to the Regulations of the General Shareholders Meeting, the President of the Corporation and the remaining members of the Board of Directors, including the chairmen of their Support Committees shall attend the Meetings to address the queries that the shareholders may submit relating to the matters under their care or for reporting specific aspects of their work, when requested to do so by the Chairman of the Meeting deemed as appropriate. In the event that any of them are not be able to attend, other members of the Board of Directors of the respective committee or of the Senior Management as the case may be, may address the queries that may arise regarding the issues under the care of such management bodies, in such a way that their absences may not constitute an impediment for carrying out the Meeting. | **YES. Briefly Indicate:** Pursuant to the Regulations of the General Shareholders Meeting, the President of the Corporation and the remaining members of the Board of Directors, including the chairmen of their Support Committees shall attend the Meetings to address the queries that the shareholders may submit relating to the matters under their care or for reporting specific aspects of their work, when requested to do so by the Chairman of the Meeting deemed as appropriate. In the event that any of them are not be able to attend, other members of the Board of Directors of the respective committee or of the Senior Management as the case may be, may address the queries that may arise regarding the issues under the care of such management bodies, in such a way that their absences may not constitute an impediment for carrying out the Meeting. | **YES. Briefly Indicate:** Pursuant to the Regulations of the General Shareholders Meeting, the President of the Corporation and the remaining members of the Board of Directors, including the chairmen of their Support Committees shall attend the Meetings to address the queries that the shareholders may submit relating to the matters under their care or for reporting specific aspects of their work, when requested to do so by the Chairman of the Meeting deemed as appropriate. In the event that any of them are not be able to attend, other members of the Board of Directors of the respective committee or of the Senior Management as the case may be, may address the queries that may arise regarding the issues under the care of such management bodies, in such a way that their absences may not constitute an impediment for carrying out the Meeting. |
| **NO. Explain:** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | Implemented in 2015 adopting the recommendation proposed by the Code of Best Practices. | Implemented in 2015 adopting the recommendation proposed by the Code of Best Practices. | Implemented in 2015 adopting the recommendation proposed by the Code of Best Practices. | Implemented in 2015 adopting the recommendation proposed by the Code of Best Practices. |
| **Modification Date** |  |  |  |  |

---

**FINANCIAL SUPERINTENDENCE OF COLOMBIA**

***This translation from the original Spanish version is provided for convenience purposes only. No representation is made as to the accuracy of this document and the company does not assume any liability based upon it. Should any doubt or contradiction arise between the Spanish and English versions, the Spanish version shall prevail.***

**18.22.** The internal regulation of the Nomination and Compensation Committee include the functions established on Recommendation 1.22.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **18.22. Measure Implementation:** | **YES** | **NO** | **X** | **NA** |
| **YES. Briefly Indicate** |  |  |  |  |
| **NO. Explain:** The Corporation will consider the possibility of adopting this recommendation fully in a subsequent period. | **NO. Explain:** The Corporation will consider the possibility of adopting this recommendation fully in a subsequent period. | **NO. Explain:** The Corporation will consider the possibility of adopting this recommendation fully in a subsequent period. | **NO. Explain:** The Corporation will consider the possibility of adopting this recommendation fully in a subsequent period. | **NO. Explain:** The Corporation will consider the possibility of adopting this recommendation fully in a subsequent period. |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |  |
| **Implementation Date** | Does Not Apply | Does Not Apply | Does Not Apply | Does Not Apply |
| **Modification Date** |  |  |  |  |

---

**18.23.** The main objective of the Risk Committee is to assist the Board of Directors in its responsibility to oversee the management of risks.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **18.23. Measure Implementation:** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** In the Article 2<sup>nd</sup> of the Rules and Regulations approved for the Risk Committee, establishes this responsibility for this collegiate body. | **YES. Briefly Indicate:** In the Article 2<sup>nd</sup> of the Rules and Regulations approved for the Risk Committee, establishes this responsibility for this collegiate body. | **YES. Briefly Indicate:** In the Article 2<sup>nd</sup> of the Rules and Regulations approved for the Risk Committee, establishes this responsibility for this collegiate body. | **YES. Briefly Indicate:** In the Article 2<sup>nd</sup> of the Rules and Regulations approved for the Risk Committee, establishes this responsibility for this collegiate body. | **YES. Briefly Indicate:** In the Article 2<sup>nd</sup> of the Rules and Regulations approved for the Risk Committee, establishes this responsibility for this collegiate body. |
| **NO. Explain:**  | **NO. Explain:**  | **NO. Explain:**  | **NO. Explain:**  | **NO. Explain:**  |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | June 9, 2021 | June 9, 2021 | June 9, 2021 | June 9, 2021 |
| **Modification Date** |  |  |  |  |

---

**18.24.** Upon request of the President of the Assembly, the President of the Risk Committee may inform the General Assembly of Shareholders on the concrete tasks that the committee has performed.

**FINANCIAL SUPERINTENDENCE OF COLOMBIA**

***This translation from the original Spanish version is provided for convenience purposes only. No representation is made as to the accuracy of this document and the company does not assume any liability based upon it. Should any doubt or contradiction arise between the Spanish and English versions, the Spanish version shall prevail.***

---

| | | | | |
|:---|:---|:---|:---|:---|
| **18.24. Measure Implementation:** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** The rules of procedure of the Risk Committee established the possibility, at the request of the Chairman of the Shareholders' Meeting, of expressing an opinion on matters raised at the meeting that fall within the Committee's competence. | **YES. Briefly Indicate:** The rules of procedure of the Risk Committee established the possibility, at the request of the Chairman of the Shareholders' Meeting, of expressing an opinion on matters raised at the meeting that fall within the Committee's competence. | **YES. Briefly Indicate:** The rules of procedure of the Risk Committee established the possibility, at the request of the Chairman of the Shareholders' Meeting, of expressing an opinion on matters raised at the meeting that fall within the Committee's competence. | **YES. Briefly Indicate:** The rules of procedure of the Risk Committee established the possibility, at the request of the Chairman of the Shareholders' Meeting, of expressing an opinion on matters raised at the meeting that fall within the Committee's competence. | **YES. Briefly Indicate:** The rules of procedure of the Risk Committee established the possibility, at the request of the Chairman of the Shareholders' Meeting, of expressing an opinion on matters raised at the meeting that fall within the Committee's competence. |
| **NO. Explain:** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | June 9, 2021 | June 9, 2021 | June 9, 2021 | June 9, 2021 |
| **Modification Date** |  |  |  |  |

---

**18.25.** Given any necessary adjustments to distinguish between corporations of the financial sector and those of the economy's real sector, and without prejudice to the functions prescribed to this committee by the norms in force, the Risk Committee's internal regulation assign the functions mentioned on Recommendation 18.25.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **18.25. Measure Implementation:** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** The rules of procedure of the Risk Committee incorporates the functions established in recommendation 18.25. | **YES. Briefly Indicate:** The rules of procedure of the Risk Committee incorporates the functions established in recommendation 18.25. | **YES. Briefly Indicate:** The rules of procedure of the Risk Committee incorporates the functions established in recommendation 18.25. | **YES. Briefly Indicate:** The rules of procedure of the Risk Committee incorporates the functions established in recommendation 18.25. | **YES. Briefly Indicate:** The rules of procedure of the Risk Committee incorporates the functions established in recommendation 18.25. |
| **NO. Explain:**  | **NO. Explain:**  | **NO. Explain:**  | **NO. Explain:**  | **NO. Explain:**  |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | June 9, 2021 | June 9, 2021 | June 9, 2021 | June 9, 2021 |
| **Modification Date** |  |  |  |  |

---

**FINANCIAL SUPERINTENDENCE OF COLOMBIA**

***This translation from the original Spanish version is provided for convenience purposes only. No representation is made as to the accuracy of this document and the company does not assume any liability based upon it. Should any doubt or contradiction arise between the Spanish and English versions, the Spanish version shall prevail.***

**18.26.** The main objective of the Corporate Governance Committee is to assist the Board of Directors in its functions to propose and supervise the corporation's governance measures.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **18.26. Measure Implementation:** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate** The Company established the Corporate Governance Committee in order to support the Board of Directors and Senior Management in this matter | **YES. Briefly Indicate** The Company established the Corporate Governance Committee in order to support the Board of Directors and Senior Management in this matter | **YES. Briefly Indicate** The Company established the Corporate Governance Committee in order to support the Board of Directors and Senior Management in this matter | **YES. Briefly Indicate** The Company established the Corporate Governance Committee in order to support the Board of Directors and Senior Management in this matter | **YES. Briefly Indicate** The Company established the Corporate Governance Committee in order to support the Board of Directors and Senior Management in this matter |
| **NO. Explain:** | **NO. Explain:** | **NO. Explain:** | **NO. Explain:** | **NO. Explain:** |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | August 26<sup>th</sup> 2020 | August 26<sup>th</sup> 2020 | August 26<sup>th</sup> 2020 | August 26<sup>th</sup> 2020 |
| **Modification Date** |  |  |  |  |

---

**18.27.** The internal regulation of the Corporate Governance Committee assigns it the functions mentioned on Recommendation 18.27.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **18.27. Measure Implementation:** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** The regulations of the Corporate Governance Committee incorporate the functions of recommendation 18.27. | **YES. Briefly Indicate:** The regulations of the Corporate Governance Committee incorporate the functions of recommendation 18.27. | **YES. Briefly Indicate:** The regulations of the Corporate Governance Committee incorporate the functions of recommendation 18.27. | **YES. Briefly Indicate:** The regulations of the Corporate Governance Committee incorporate the functions of recommendation 18.27. | **YES. Briefly Indicate:** The regulations of the Corporate Governance Committee incorporate the functions of recommendation 18.27. |
| **NO. Explain:** | **NO. Explain:** | **NO. Explain:** | **NO. Explain:** | **NO. Explain:** |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | August 26<sup>th</sup>, 2020 | August 26<sup>th</sup>, 2020 | August 26<sup>th</sup>, 2020 | August 26<sup>th</sup>, 2020 |
| **Modification Date** |  |  |  |  |

---

**Measure No. 19. Board of Directors Organization**

**19.1** The President of the Board of Directors with the assistance of the Secretary and of the President of the corporation prepares a work plan for the Board, for the period under assessment. This tool helps to determine a reasonable number of ordinary meetings per year, and their estimated length

**FINANCIAL SUPERINTENDENCE OF COLOMBIA**

***This translation from the original Spanish version is provided for convenience purposes only. No representation is made as to the accuracy of this document and the company does not assume any liability based upon it. Should any doubt or contradiction arise between the Spanish and English versions, the Spanish version shall prevail.***

---

| | | | | |
|:---|:---|:---|:---|:---|
| **19.1. Measure Implementation:** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate**: Pursuant to the Regulations of the Board of Directors of the Corporation part of the duties of the Chairman of the Board of Directors is coordinating and planning, with the assistance of the Secretary the operation of the Board of Directors by establishing an annual plan of meetings of the Board of Directors that shall be submitted for consideration of its members. | **YES. Briefly Indicate**: Pursuant to the Regulations of the Board of Directors of the Corporation part of the duties of the Chairman of the Board of Directors is coordinating and planning, with the assistance of the Secretary the operation of the Board of Directors by establishing an annual plan of meetings of the Board of Directors that shall be submitted for consideration of its members. | **YES. Briefly Indicate**: Pursuant to the Regulations of the Board of Directors of the Corporation part of the duties of the Chairman of the Board of Directors is coordinating and planning, with the assistance of the Secretary the operation of the Board of Directors by establishing an annual plan of meetings of the Board of Directors that shall be submitted for consideration of its members. | **YES. Briefly Indicate**: Pursuant to the Regulations of the Board of Directors of the Corporation part of the duties of the Chairman of the Board of Directors is coordinating and planning, with the assistance of the Secretary the operation of the Board of Directors by establishing an annual plan of meetings of the Board of Directors that shall be submitted for consideration of its members. | **YES. Briefly Indicate**: Pursuant to the Regulations of the Board of Directors of the Corporation part of the duties of the Chairman of the Board of Directors is coordinating and planning, with the assistance of the Secretary the operation of the Board of Directors by establishing an annual plan of meetings of the Board of Directors that shall be submitted for consideration of its members. |
| **NO. Explain:** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Date of Implementation** | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in the year 2015 as a result of the implementation of some recommendations of the New Country Code. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in the year 2015 as a result of the implementation of some recommendations of the New Country Code. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in the year 2015 as a result of the implementation of some recommendations of the New Country Code. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in the year 2015 as a result of the implementation of some recommendations of the New Country Code. |
| **Dates of Modification** |  |  |  |  |

---

**19.2.**. The Board of Directors of the corporation holds between eight (8) and twelve (12) ordinary meetings per year; except for the entities subject to surveillance, which must hold at least one (1) meeting per month because of their regime.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **19.2. Measure Implementation:** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** The Board of Directors of the Corporation meets on average every two weeks, reason for which there are more than 8 ordinary meetings per year. | **YES. Briefly Indicate:** The Board of Directors of the Corporation meets on average every two weeks, reason for which there are more than 8 ordinary meetings per year. | **YES. Briefly Indicate:** The Board of Directors of the Corporation meets on average every two weeks, reason for which there are more than 8 ordinary meetings per year. | **YES. Briefly Indicate:** The Board of Directors of the Corporation meets on average every two weeks, reason for which there are more than 8 ordinary meetings per year. | **YES. Briefly Indicate:** The Board of Directors of the Corporation meets on average every two weeks, reason for which there are more than 8 ordinary meetings per year. |
| **NO. Explain:** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date:** | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. |
| **Modification Date:** |  |  |  |  |

---

**19.3.** One (1) or two (2) of the Board's meetings per year make a distinctive emphasis on the definition and monitoring of the corporation's strategy.

**FINANCIAL SUPERINTENDENCE OF COLOMBIA**

***This translation from the original Spanish version is provided for convenience purposes only. No representation is made as to the accuracy of this document and the company does not assume any liability based upon it. Should any doubt or contradiction arise between the Spanish and English versions, the Spanish version shall prevail.***

---

| | | | | |
|:---|:---|:---|:---|:---|
| **19.3. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** It is a permanent duty of the Board of Directors to carry out the follow-up of the budget execution of the Corporation and its subordinate entities and in to that extent, the strategy of the Corporation and its subordinate entities is oriented through their Boards. | **YES. Briefly Indicate:** It is a permanent duty of the Board of Directors to carry out the follow-up of the budget execution of the Corporation and its subordinate entities and in to that extent, the strategy of the Corporation and its subordinate entities is oriented through their Boards. | **YES. Briefly Indicate:** It is a permanent duty of the Board of Directors to carry out the follow-up of the budget execution of the Corporation and its subordinate entities and in to that extent, the strategy of the Corporation and its subordinate entities is oriented through their Boards. | **YES. Briefly Indicate:** It is a permanent duty of the Board of Directors to carry out the follow-up of the budget execution of the Corporation and its subordinate entities and in to that extent, the strategy of the Corporation and its subordinate entities is oriented through their Boards. | **YES. Briefly Indicate:** It is a permanent duty of the Board of Directors to carry out the follow-up of the budget execution of the Corporation and its subordinate entities and in to that extent, the strategy of the Corporation and its subordinate entities is oriented through their Boards. |
| **NO. Explain:** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. |
| **Modification Date** |  |  |  |  |

---

**19.4.** The Board of Directors approves a concrete calendar for its ordinary sessions. However, it may also meet, on an extraordinary basis, as many times as necessary.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **19.4. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** The meetings of the Board of Directors are scheduled annually and it is possible to modify the dates of such meetings when so required or summoning additional meetings if necessary. | **YES. Briefly Indicate:** The meetings of the Board of Directors are scheduled annually and it is possible to modify the dates of such meetings when so required or summoning additional meetings if necessary. | **YES. Briefly Indicate:** The meetings of the Board of Directors are scheduled annually and it is possible to modify the dates of such meetings when so required or summoning additional meetings if necessary. | **YES. Briefly Indicate:** The meetings of the Board of Directors are scheduled annually and it is possible to modify the dates of such meetings when so required or summoning additional meetings if necessary. | **YES. Briefly Indicate:** The meetings of the Board of Directors are scheduled annually and it is possible to modify the dates of such meetings when so required or summoning additional meetings if necessary. |
| **NO. Explain:** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. |
| **Modification Date** |  |  |  |  |

---

**19.5.** At least five (5) common days before the meeting, the Board members receive, simultaneously with the meeting call, the documents or information related to each of the points on the Agenda. This ensures their active participation and their well-thought decision-making.

**FINANCIAL SUPERINTENDENCE OF COLOMBIA**

***This translation from the original Spanish version is provided for convenience purposes only. No representation is made as to the accuracy of this document and the company does not assume any liability based upon it. Should any doubt or contradiction arise between the Spanish and English versions, the Spanish version shall prevail.***

---

| | | | | |
|:---|:---|:---|:---|:---|
| **19.5. Measure Implementation:** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** Pursuant to the Regulations of the Board of Directors the pertinent material subject matter of the respective meetings should be available to the members. Provided the same has been furnished in advance, the Secretary shall deliver the material associated with the respective meeting same to the members of the Board of Directors within five calendar days prior to each meeting. | **YES. Briefly Indicate:** Pursuant to the Regulations of the Board of Directors the pertinent material subject matter of the respective meetings should be available to the members. Provided the same has been furnished in advance, the Secretary shall deliver the material associated with the respective meeting same to the members of the Board of Directors within five calendar days prior to each meeting. | **YES. Briefly Indicate:** Pursuant to the Regulations of the Board of Directors the pertinent material subject matter of the respective meetings should be available to the members. Provided the same has been furnished in advance, the Secretary shall deliver the material associated with the respective meeting same to the members of the Board of Directors within five calendar days prior to each meeting. | **YES. Briefly Indicate:** Pursuant to the Regulations of the Board of Directors the pertinent material subject matter of the respective meetings should be available to the members. Provided the same has been furnished in advance, the Secretary shall deliver the material associated with the respective meeting same to the members of the Board of Directors within five calendar days prior to each meeting. | **YES. Briefly Indicate:** Pursuant to the Regulations of the Board of Directors the pertinent material subject matter of the respective meetings should be available to the members. Provided the same has been furnished in advance, the Secretary shall deliver the material associated with the respective meeting same to the members of the Board of Directors within five calendar days prior to each meeting. |
| **NO. Explain:** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | Implemented in 2015 adopting the recommendation proposed by the Code of Best Practices | Implemented in 2015 adopting the recommendation proposed by the Code of Best Practices | Implemented in 2015 adopting the recommendation proposed by the Code of Best Practices | Implemented in 2015 adopting the recommendation proposed by the Code of Best Practices |
| **Modification Date** |  |  |  |  |

---

**19.6.** The President of the Board of Directors, with the support of the Board's Secretary, assumes the ultimate responsibility for the timeliness and usefulness of the information delivered to the members. Consequently, in the set of documents provided (the dashboard of the Board of Directors) the quality will be most important than the quantity.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **19.6. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** Pursuant to the Regulations of the Board of Directors, part of the duties of the Chairman of the Board of Directors is promoting the delivery of information to the Members of the Board of Directors through the Secretary of the Board in a timely and sufficient manner. | **YES. Briefly Indicate:** Pursuant to the Regulations of the Board of Directors, part of the duties of the Chairman of the Board of Directors is promoting the delivery of information to the Members of the Board of Directors through the Secretary of the Board in a timely and sufficient manner. | **YES. Briefly Indicate:** Pursuant to the Regulations of the Board of Directors, part of the duties of the Chairman of the Board of Directors is promoting the delivery of information to the Members of the Board of Directors through the Secretary of the Board in a timely and sufficient manner. | **YES. Briefly Indicate:** Pursuant to the Regulations of the Board of Directors, part of the duties of the Chairman of the Board of Directors is promoting the delivery of information to the Members of the Board of Directors through the Secretary of the Board in a timely and sufficient manner. | **YES. Briefly Indicate:** Pursuant to the Regulations of the Board of Directors, part of the duties of the Chairman of the Board of Directors is promoting the delivery of information to the Members of the Board of Directors through the Secretary of the Board in a timely and sufficient manner. |
| **NO. Explain:** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in the year 2015 as a result of the implementation of some recommendations of the Code of Best Practices | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in the year 2015 as a result of the implementation of some recommendations of the Code of Best Practices | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in the year 2015 as a result of the implementation of some recommendations of the Code of Best Practices | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in the year 2015 as a result of the implementation of some recommendations of the Code of Best Practices |
| **Modification Date** |  |  |  |  |

---

**19.7.** The ultimate responsibility to prepare the Agenda for the meetings of the Board of Directors corresponds to the Board's President and not to the President of the corporation. The structure of the Agenda follows given parameters that ensure a logical order for the presentation of the subjects and for the debates.

**FINANCIAL SUPERINTENDENCE OF COLOMBIA**

***This translation from the original Spanish version is provided for convenience purposes only. No representation is made as to the accuracy of this document and the company does not assume any liability based upon it. Should any doubt or contradiction arise between the Spanish and English versions, the Spanish version shall prevail.***

---

| | | | | |
|:---|:---|:---|:---|:---|
| **19.7. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** Pursuant to the Regulations of the Board of Directors, part of the duties of the Chairman of the Board of Directors is coordinating with the President of the Corporation and the Secretary of the Board of Directors the agendas of the meetings overseeing the adequate presentation of the issues forming part of such agenda. | **YES. Briefly Indicate:** Pursuant to the Regulations of the Board of Directors, part of the duties of the Chairman of the Board of Directors is coordinating with the President of the Corporation and the Secretary of the Board of Directors the agendas of the meetings overseeing the adequate presentation of the issues forming part of such agenda. | **YES. Briefly Indicate:** Pursuant to the Regulations of the Board of Directors, part of the duties of the Chairman of the Board of Directors is coordinating with the President of the Corporation and the Secretary of the Board of Directors the agendas of the meetings overseeing the adequate presentation of the issues forming part of such agenda. | **YES. Briefly Indicate:** Pursuant to the Regulations of the Board of Directors, part of the duties of the Chairman of the Board of Directors is coordinating with the President of the Corporation and the Secretary of the Board of Directors the agendas of the meetings overseeing the adequate presentation of the issues forming part of such agenda. | **YES. Briefly Indicate:** Pursuant to the Regulations of the Board of Directors, part of the duties of the Chairman of the Board of Directors is coordinating with the President of the Corporation and the Secretary of the Board of Directors the agendas of the meetings overseeing the adequate presentation of the issues forming part of such agenda. |
| **NO. Explain:** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in the year 2015 as a result of the implementation of some recommendations of the Code of Best Practices. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in the year 2015 as a result of the implementation of some recommendations of the Code of Best Practices. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in the year 2015 as a result of the implementation of some recommendations of the Code of Best Practices. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in the year 2015 as a result of the implementation of some recommendations of the Code of Best Practices. |
| **Modification Date** |  |  |  |  |

---

**19.8.** On the Annual Corporate Governance Report and on the institutional web site, the company publishes the attendance of the Board members to the meetings of the Board of Directors and to its committees.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **19.8. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** The company has implemented an Annual Corporate Governance Report, which includes the recommendations of the Country Code Survey, among which the attendance of the Directors at the meetings of the Board of Directors and its Committees is revealed. Pag. 195.<br>https://www.grupoaval.com/repositorio/grupoaval/inversionistas/informacion-para-asamblea-de-accionistas/2022/Informe-de-Gestion-Aval-2021.pdf | **YES. Briefly Indicate:** The company has implemented an Annual Corporate Governance Report, which includes the recommendations of the Country Code Survey, among which the attendance of the Directors at the meetings of the Board of Directors and its Committees is revealed. Pag. 195.<br>https://www.grupoaval.com/repositorio/grupoaval/inversionistas/informacion-para-asamblea-de-accionistas/2022/Informe-de-Gestion-Aval-2021.pdf | **YES. Briefly Indicate:** The company has implemented an Annual Corporate Governance Report, which includes the recommendations of the Country Code Survey, among which the attendance of the Directors at the meetings of the Board of Directors and its Committees is revealed. Pag. 195.<br>https://www.grupoaval.com/repositorio/grupoaval/inversionistas/informacion-para-asamblea-de-accionistas/2022/Informe-de-Gestion-Aval-2021.pdf | **YES. Briefly Indicate:** The company has implemented an Annual Corporate Governance Report, which includes the recommendations of the Country Code Survey, among which the attendance of the Directors at the meetings of the Board of Directors and its Committees is revealed. Pag. 195.<br>https://www.grupoaval.com/repositorio/grupoaval/inversionistas/informacion-para-asamblea-de-accionistas/2022/Informe-de-Gestion-Aval-2021.pdf | **YES. Briefly Indicate:** The company has implemented an Annual Corporate Governance Report, which includes the recommendations of the Country Code Survey, among which the attendance of the Directors at the meetings of the Board of Directors and its Committees is revealed. Pag. 195.<br>https://www.grupoaval.com/repositorio/grupoaval/inversionistas/informacion-para-asamblea-de-accionistas/2022/Informe-de-Gestion-Aval-2021.pdf |
| **NO. Explain:** | **NO. Explain:** | **NO. Explain:** | **NO. Explain:** | **NO. Explain:** |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | March 30<sup>th</sup> 2020 | March 30<sup>th</sup> 2020 | March 30<sup>th</sup> 2020 | March 30<sup>th</sup> 2020 |
| **Modification Date** |  |  |  |  |

---

**FINANCIAL SUPERINTENDENCE OF COLOMBIA**

***This translation from the original Spanish version is provided for convenience purposes only. No representation is made as to the accuracy of this document and the company does not assume any liability based upon it. Should any doubt or contradiction arise between the Spanish and English versions, the Spanish version shall prevail.***

**19.9.** Every year, the Board of Directors assesses the effectiveness of its work as a collective body, that of its committees, and that of its members individually considered, including peer evaluation. Furthermore, it evaluates the reasonableness of its internal regulations, and the dedication and performance of its members, proposing changes in its organization and operation deemed pertinent. In the case of conglomerates, the Board of Directors of the holding company demands that the assessment process takes place also within the Boards of Directors of the subordinate companies.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **19.9. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate** In accordance with the Regulations of the Board of Directors, the Board of Directors develops an evaluation where it analyzes its effectiveness and work as a management body. | **YES. Briefly Indicate** In accordance with the Regulations of the Board of Directors, the Board of Directors develops an evaluation where it analyzes its effectiveness and work as a management body. | **YES. Briefly Indicate** In accordance with the Regulations of the Board of Directors, the Board of Directors develops an evaluation where it analyzes its effectiveness and work as a management body. | **YES. Briefly Indicate** In accordance with the Regulations of the Board of Directors, the Board of Directors develops an evaluation where it analyzes its effectiveness and work as a management body. | **YES. Briefly Indicate** In accordance with the Regulations of the Board of Directors, the Board of Directors develops an evaluation where it analyzes its effectiveness and work as a management body. |
| **NO. Explain:** | **NO. Explain:** | **NO. Explain:** | **NO. Explain:** | **NO. Explain:** |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | December 9<sup>th,</sup> 2020 | December 9<sup>th,</sup> 2020 | December 9<sup>th,</sup> 2020 | December 9<sup>th,</sup> 2020 |
| **Modification Date** |  |  |  |  |

---

**19.10.** The Board of Directors alternates internal evaluation techniques with external evaluation performed by independent advisors.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **19.10. Measure Implementation** | **YES** | **NO** | **X** | **NA** |
| **YES. Briefly Indicate:** |  |  |  |  |
| **NO. Explain:** The Corporation shall consider the possibility of adopting this recommendation for a subsequent period. | **NO. Explain:** The Corporation shall consider the possibility of adopting this recommendation for a subsequent period. | **NO. Explain:** The Corporation shall consider the possibility of adopting this recommendation for a subsequent period. | **NO. Explain:** The Corporation shall consider the possibility of adopting this recommendation for a subsequent period. | **NO. Explain:** The Corporation shall consider the possibility of adopting this recommendation for a subsequent period. |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |  |
| **Implementation Date** | Does Not Apply | Does Not Apply | Does Not Apply | Does Not Apply |
| **Modification Date** |  |  |  |  |

---

**FINANCIAL SUPERINTENDENCE OF COLOMBIA**

***This translation from the original Spanish version is provided for convenience purposes only. No representation is made as to the accuracy of this document and the company does not assume any liability based upon it. Should any doubt or contradiction arise between the Spanish and English versions, the Spanish version shall prevail.***

**Measure No. 20. Duties and Rights applicable to the Members of the Board of Directors.** 

**20.1.** Regulation of the Board of Directors complements the dispositions of the company's regulatory framework regarding the duties and rights of the Board members.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **20.1. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** The Regulations of the Board of Directors of the Corporation complements the provisions under the regulating framework in connection with the duties and rights of the members of the Board of Directors. | **YES. Briefly Indicate:** The Regulations of the Board of Directors of the Corporation complements the provisions under the regulating framework in connection with the duties and rights of the members of the Board of Directors. | **YES. Briefly Indicate:** The Regulations of the Board of Directors of the Corporation complements the provisions under the regulating framework in connection with the duties and rights of the members of the Board of Directors. | **YES. Briefly Indicate:** The Regulations of the Board of Directors of the Corporation complements the provisions under the regulating framework in connection with the duties and rights of the members of the Board of Directors. | **YES. Briefly Indicate:** The Regulations of the Board of Directors of the Corporation complements the provisions under the regulating framework in connection with the duties and rights of the members of the Board of Directors. |
| **NO. Explain:** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | Implemented in 2015 adopting the recommendation proposed by the Code of Best Practices. | Implemented in 2015 adopting the recommendation proposed by the Code of Best Practices. | Implemented in 2015 adopting the recommendation proposed by the Code of Best Practices. | Implemented in 2015 adopting the recommendation proposed by the Code of Best Practices. |
| **Modification Date** |  |  |  |  |

---

**20.2.** Regulation of the Board of Directors develops the company's understanding of the duties of the Board members established on Recommendation 20.2.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **20.2. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** The Regulation of the Board of Directors develops the understanding of the Corporation regarding the duties of the members of the Board of Directors and includes therein those foreseen under recommendation 20.2. | **YES. Briefly Indicate:** The Regulation of the Board of Directors develops the understanding of the Corporation regarding the duties of the members of the Board of Directors and includes therein those foreseen under recommendation 20.2. | **YES. Briefly Indicate:** The Regulation of the Board of Directors develops the understanding of the Corporation regarding the duties of the members of the Board of Directors and includes therein those foreseen under recommendation 20.2. | **YES. Briefly Indicate:** The Regulation of the Board of Directors develops the understanding of the Corporation regarding the duties of the members of the Board of Directors and includes therein those foreseen under recommendation 20.2. | **YES. Briefly Indicate:** The Regulation of the Board of Directors develops the understanding of the Corporation regarding the duties of the members of the Board of Directors and includes therein those foreseen under recommendation 20.2. |
| **NO. Explain:** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | Implemented in 2015 adopting the recommendation proposed by the Code of Best Practices. | Implemented in 2015 adopting the recommendation proposed by the Code of Best Practices. | Implemented in 2015 adopting the recommendation proposed by the Code of Best Practices. | Implemented in 2015 adopting the recommendation proposed by the Code of Best Practices. |
| **Modification Date** |  |  |  |  |

---

**20.3.** Regulation of the Board of Directors develops the contents of the rights of the Board members mentioned on Recommendation 20.3.

**FINANCIAL SUPERINTENDENCE OF COLOMBIA**

***This translation from the original Spanish version is provided for convenience purposes only. No representation is made as to the accuracy of this document and the company does not assume any liability based upon it. Should any doubt or contradiction arise between the Spanish and English versions, the Spanish version shall prevail.***

---

| | | | | |
|:---|:---|:---|:---|:---|
| **20.3. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** the Regulation of the Board of Directors develops the content of the rights of the members of the Board of Directors under the terms foreseen in recommendation 20.3. | **YES. Briefly Indicate:** the Regulation of the Board of Directors develops the content of the rights of the members of the Board of Directors under the terms foreseen in recommendation 20.3. | **YES. Briefly Indicate:** the Regulation of the Board of Directors develops the content of the rights of the members of the Board of Directors under the terms foreseen in recommendation 20.3. | **YES. Briefly Indicate:** the Regulation of the Board of Directors develops the content of the rights of the members of the Board of Directors under the terms foreseen in recommendation 20.3. | **YES. Briefly Indicate:** the Regulation of the Board of Directors develops the content of the rights of the members of the Board of Directors under the terms foreseen in recommendation 20.3. |
| **NO. Explain** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | Implemented in 2015 adopting the recommendation proposed by the New Country Code. | Implemented in 2015 adopting the recommendation proposed by the New Country Code. | Implemented in 2015 adopting the recommendation proposed by the New Country Code. | Implemented in 2015 adopting the recommendation proposed by the New Country Code. |
| **Modification Date** |  |  |  |  |

---

**Measure No. 21. Conflicts of Interest**

**21.1.** In its internal regulations, the corporation has a clear and formal policy and procedure for the identification, management, and resolution of conflicts of interest, whether direct or indirect through related parties that may affect the members of the Board of Directors and other managers.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **21.1. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** The Reference Framework for Institutional Relations and the Corporate Governance Code of the Company contemplate specific mechanisms for preventing, handling and disclosing conflicts of interests. | **YES. Briefly Indicate:** The Reference Framework for Institutional Relations and the Corporate Governance Code of the Company contemplate specific mechanisms for preventing, handling and disclosing conflicts of interests. | **YES. Briefly Indicate:** The Reference Framework for Institutional Relations and the Corporate Governance Code of the Company contemplate specific mechanisms for preventing, handling and disclosing conflicts of interests. | **YES. Briefly Indicate:** The Reference Framework for Institutional Relations and the Corporate Governance Code of the Company contemplate specific mechanisms for preventing, handling and disclosing conflicts of interests. | **YES. Briefly Indicate:** The Reference Framework for Institutional Relations and the Corporate Governance Code of the Company contemplate specific mechanisms for preventing, handling and disclosing conflicts of interests. |
| **NO. Explain:** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the Code of Best Practices. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the Code of Best Practices. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the Code of Best Practices. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the Code of Best Practices. |
| **Modification Date** | December 9th, 2020 | December 9th, 2020 | December 9th, 2020 | December 9th, 2020 |

---

**21.2.** The procedure for the management of conflicts of interest makes a distinction about their nature as occasional or permanent. If they are occasional, the applicable procedure indicates the rules and steps to be followed, which should be relatively easy to implement and hard to avoid for those affected. In the case of permanent conflicts of interest, the procedure stipulates that if the situation affects the corporation's overall operations, it must be regarded as a cause for the obligatory resignation of those affected, for it makes it impossible for them to hold the position.

**FINANCIAL SUPERINTENDENCE OF COLOMBIA**

***This translation from the original Spanish version is provided for convenience purposes only. No representation is made as to the accuracy of this document and the company does not assume any liability based upon it. Should any doubt or contradiction arise between the Spanish and English versions, the Spanish version shall prevail.***

---

| | | | | |
|:---|:---|:---|:---|:---|
| **21.2. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** The Corporate Governance Code and the **Reference framework for institutional** Operations of the Company states that according to their nature, the situations of conflict of interests or potential conflict of interests may be have a sporadic or permanent character. When a situation originating an event or potential event of conflict of interests results permanent jointly affecting the operations of the Corporation, the same shall constitute cause for mandatory resignation by the affected party since such circumstance makes it impossible for performing its position. | **YES. Briefly Indicate:** The Corporate Governance Code and the **Reference framework for institutional** Operations of the Company states that according to their nature, the situations of conflict of interests or potential conflict of interests may be have a sporadic or permanent character. When a situation originating an event or potential event of conflict of interests results permanent jointly affecting the operations of the Corporation, the same shall constitute cause for mandatory resignation by the affected party since such circumstance makes it impossible for performing its position. | **YES. Briefly Indicate:** The Corporate Governance Code and the **Reference framework for institutional** Operations of the Company states that according to their nature, the situations of conflict of interests or potential conflict of interests may be have a sporadic or permanent character. When a situation originating an event or potential event of conflict of interests results permanent jointly affecting the operations of the Corporation, the same shall constitute cause for mandatory resignation by the affected party since such circumstance makes it impossible for performing its position. | **YES. Briefly Indicate:** The Corporate Governance Code and the **Reference framework for institutional** Operations of the Company states that according to their nature, the situations of conflict of interests or potential conflict of interests may be have a sporadic or permanent character. When a situation originating an event or potential event of conflict of interests results permanent jointly affecting the operations of the Corporation, the same shall constitute cause for mandatory resignation by the affected party since such circumstance makes it impossible for performing its position. | **YES. Briefly Indicate:** The Corporate Governance Code and the **Reference framework for institutional** Operations of the Company states that according to their nature, the situations of conflict of interests or potential conflict of interests may be have a sporadic or permanent character. When a situation originating an event or potential event of conflict of interests results permanent jointly affecting the operations of the Corporation, the same shall constitute cause for mandatory resignation by the affected party since such circumstance makes it impossible for performing its position. |
| **NO. Explain:** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | Implemented in 2015 adopting the recommendation proposed by the Code of Best Practices. | Implemented in 2015 adopting the recommendation proposed by the Code of Best Practices. | Implemented in 2015 adopting the recommendation proposed by the Code of Best Practices. | Implemented in 2015 adopting the recommendation proposed by the Code of Best Practices. |
| **Modification Date** |  |  |  |  |

---

**21.3.** The members of the Board of Directors, legal representatives, senior managers, and other administrators of the corporation inform the Board periodically about any relationships, whether direct or indirect, that they keep between them, or with other entities or structures of the conglomerate to which the issuer belongs, or with the issuer, or with providers, or clients, or any other stakeholders, out of which given conflicts of interest might arise, or that might influence their opinion or vote, thereby building up the managers' "map of related parties."

---

| | | | | |
|:---|:---|:---|:---|:---|
| **21.3. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** Members of the Board of Directors, Legal Representatives, Members of Senior Management and remaining Managers of the Corporation periodically report to the Corporation about their family links and corporate interests through pre-established forms for complying with applicable regulations and reporting obligations regarding operations with associated parties. <br>Additionally, the Code of Ethics available at Grupo Aval's webpage specifies that it is prohibited or against the Company´s ethic and conduct principles, hiding the existence of a Conflict of Interest involving employees, members of the Board of Directors or Directives. Consequently, if a Conflict of Interest occurs, involved employees shall abstain from adopting any decision and immediately inform this situation to the competent body pursuant to the terms included in the Code of Ethics. | **YES. Briefly Indicate:** Members of the Board of Directors, Legal Representatives, Members of Senior Management and remaining Managers of the Corporation periodically report to the Corporation about their family links and corporate interests through pre-established forms for complying with applicable regulations and reporting obligations regarding operations with associated parties. <br>Additionally, the Code of Ethics available at Grupo Aval's webpage specifies that it is prohibited or against the Company´s ethic and conduct principles, hiding the existence of a Conflict of Interest involving employees, members of the Board of Directors or Directives. Consequently, if a Conflict of Interest occurs, involved employees shall abstain from adopting any decision and immediately inform this situation to the competent body pursuant to the terms included in the Code of Ethics. | **YES. Briefly Indicate:** Members of the Board of Directors, Legal Representatives, Members of Senior Management and remaining Managers of the Corporation periodically report to the Corporation about their family links and corporate interests through pre-established forms for complying with applicable regulations and reporting obligations regarding operations with associated parties. <br>Additionally, the Code of Ethics available at Grupo Aval's webpage specifies that it is prohibited or against the Company´s ethic and conduct principles, hiding the existence of a Conflict of Interest involving employees, members of the Board of Directors or Directives. Consequently, if a Conflict of Interest occurs, involved employees shall abstain from adopting any decision and immediately inform this situation to the competent body pursuant to the terms included in the Code of Ethics. | **YES. Briefly Indicate:** Members of the Board of Directors, Legal Representatives, Members of Senior Management and remaining Managers of the Corporation periodically report to the Corporation about their family links and corporate interests through pre-established forms for complying with applicable regulations and reporting obligations regarding operations with associated parties. <br>Additionally, the Code of Ethics available at Grupo Aval's webpage specifies that it is prohibited or against the Company´s ethic and conduct principles, hiding the existence of a Conflict of Interest involving employees, members of the Board of Directors or Directives. Consequently, if a Conflict of Interest occurs, involved employees shall abstain from adopting any decision and immediately inform this situation to the competent body pursuant to the terms included in the Code of Ethics. | **YES. Briefly Indicate:** Members of the Board of Directors, Legal Representatives, Members of Senior Management and remaining Managers of the Corporation periodically report to the Corporation about their family links and corporate interests through pre-established forms for complying with applicable regulations and reporting obligations regarding operations with associated parties. <br>Additionally, the Code of Ethics available at Grupo Aval's webpage specifies that it is prohibited or against the Company´s ethic and conduct principles, hiding the existence of a Conflict of Interest involving employees, members of the Board of Directors or Directives. Consequently, if a Conflict of Interest occurs, involved employees shall abstain from adopting any decision and immediately inform this situation to the competent body pursuant to the terms included in the Code of Ethics. |
| **NO. Explain:** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. |
| **Modification Date** |  |  |  |  |

---

**FINANCIAL SUPERINTENDENCE OF COLOMBIA**

***This translation from the original Spanish version is provided for convenience purposes only. No representation is made as to the accuracy of this document and the company does not assume any liability based upon it. Should any doubt or contradiction arise between the Spanish and English versions, the Spanish version shall prevail.***

**21.4.** Any relevant conflict-of-interest situations, understood as those that would force the affected to refrain from attending a meeting and/or voting, involving the members of the Board of Directors and remaining managers, are featured in the public information that the corporation posts every year on its web site.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **21.4. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** The Corporation published through the mechanisms established by the market and on its website, the decisions of the General Assembly of Shareholders regarding conflicts of interest disclosed during 2022. | **YES. Briefly Indicate:** The Corporation published through the mechanisms established by the market and on its website, the decisions of the General Assembly of Shareholders regarding conflicts of interest disclosed during 2022. | **YES. Briefly Indicate:** The Corporation published through the mechanisms established by the market and on its website, the decisions of the General Assembly of Shareholders regarding conflicts of interest disclosed during 2022. | **YES. Briefly Indicate:** The Corporation published through the mechanisms established by the market and on its website, the decisions of the General Assembly of Shareholders regarding conflicts of interest disclosed during 2022. | **YES. Briefly Indicate:** The Corporation published through the mechanisms established by the market and on its website, the decisions of the General Assembly of Shareholders regarding conflicts of interest disclosed during 2022. |
| **NO. Explain:** | **NO. Explain:** | **NO. Explain:** | **NO. Explain:** | **NO. Explain:** |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | October 28<sup>th</sup>, 2022. | October 28<sup>th</sup>, 2022. | October 28<sup>th</sup>, 2022. | October 28<sup>th</sup>, 2022. |
| **Modification Date** |  |  |  |  |

---

**21.5.** For these purposes, the definition of Related Party that the corporation applies is consistent with the International Accounting Standard No. 24 (IAS 24).

---

| | | | | |
|:---|:---|:---|:---|:---|
| **21.5. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** For preparing the financial statements and their disclosure notes referring to operations with linked parties, IFRS 24 is applied pursuant to which the following shall be disclosed: (a) the amount of the transactions; (b) the amount of pending balances, including commitments, their terms and conditions, guarantees, as well as the nature of the consideration fixed for its liquidation; (c) estimates for debts of doubtful collection regarding amounts included in pending balances and (d) acknowledged expenses during the period regarding uncollectable debts or those of doubtful collection, deriving related parties. | **YES. Briefly Indicate:** For preparing the financial statements and their disclosure notes referring to operations with linked parties, IFRS 24 is applied pursuant to which the following shall be disclosed: (a) the amount of the transactions; (b) the amount of pending balances, including commitments, their terms and conditions, guarantees, as well as the nature of the consideration fixed for its liquidation; (c) estimates for debts of doubtful collection regarding amounts included in pending balances and (d) acknowledged expenses during the period regarding uncollectable debts or those of doubtful collection, deriving related parties. | **YES. Briefly Indicate:** For preparing the financial statements and their disclosure notes referring to operations with linked parties, IFRS 24 is applied pursuant to which the following shall be disclosed: (a) the amount of the transactions; (b) the amount of pending balances, including commitments, their terms and conditions, guarantees, as well as the nature of the consideration fixed for its liquidation; (c) estimates for debts of doubtful collection regarding amounts included in pending balances and (d) acknowledged expenses during the period regarding uncollectable debts or those of doubtful collection, deriving related parties. | **YES. Briefly Indicate:** For preparing the financial statements and their disclosure notes referring to operations with linked parties, IFRS 24 is applied pursuant to which the following shall be disclosed: (a) the amount of the transactions; (b) the amount of pending balances, including commitments, their terms and conditions, guarantees, as well as the nature of the consideration fixed for its liquidation; (c) estimates for debts of doubtful collection regarding amounts included in pending balances and (d) acknowledged expenses during the period regarding uncollectable debts or those of doubtful collection, deriving related parties. | **YES. Briefly Indicate:** For preparing the financial statements and their disclosure notes referring to operations with linked parties, IFRS 24 is applied pursuant to which the following shall be disclosed: (a) the amount of the transactions; (b) the amount of pending balances, including commitments, their terms and conditions, guarantees, as well as the nature of the consideration fixed for its liquidation; (c) estimates for debts of doubtful collection regarding amounts included in pending balances and (d) acknowledged expenses during the period regarding uncollectable debts or those of doubtful collection, deriving related parties. |
| **NO. Explain:** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as the result of the adoption of the International Regulations on Financial Information. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as the result of the adoption of the International Regulations on Financial Information. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as the result of the adoption of the International Regulations on Financial Information. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as the result of the adoption of the International Regulations on Financial Information. |
| **Modification Date** |  |  |  |  |

---

**Measure No. 22. Related-Party Transactions.** 

**FINANCIAL SUPERINTENDENCE OF COLOMBIA**

***This translation from the original Spanish version is provided for convenience purposes only. No representation is made as to the accuracy of this document and the company does not assume any liability based upon it. Should any doubt or contradiction arise between the Spanish and English versions, the Spanish version shall prevail.***

**22.1.** The corporation has a policy that specifies the concrete procedures for the assessment, approval, and disclosure of related-party transactions, including any pending balances, and the relationships among those transactions, except those operations with specific applicable regulations.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **22.1. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** The corporation has established procedures for reporting balances and transactions between linked economic parties to perform the registration of such transactions subject to the accounting principles within the term of their occurrence in such a manner to have accurate and updated information, for assessing the effect of such operations within the economic and administrative situation of Grupo Aval. Likewise, pursuant to the Reference Framework for Institutional Relations and its Code of Corporate Governance, there are specific guidelines regarding operations with linked parties. Similarly, by being authorized as a financial conglomerate, the company maintains a chart of its affiliates that is available for consults of the Superintendency of Finance | **YES. Briefly Indicate:** The corporation has established procedures for reporting balances and transactions between linked economic parties to perform the registration of such transactions subject to the accounting principles within the term of their occurrence in such a manner to have accurate and updated information, for assessing the effect of such operations within the economic and administrative situation of Grupo Aval. Likewise, pursuant to the Reference Framework for Institutional Relations and its Code of Corporate Governance, there are specific guidelines regarding operations with linked parties. Similarly, by being authorized as a financial conglomerate, the company maintains a chart of its affiliates that is available for consults of the Superintendency of Finance | **YES. Briefly Indicate:** The corporation has established procedures for reporting balances and transactions between linked economic parties to perform the registration of such transactions subject to the accounting principles within the term of their occurrence in such a manner to have accurate and updated information, for assessing the effect of such operations within the economic and administrative situation of Grupo Aval. Likewise, pursuant to the Reference Framework for Institutional Relations and its Code of Corporate Governance, there are specific guidelines regarding operations with linked parties. Similarly, by being authorized as a financial conglomerate, the company maintains a chart of its affiliates that is available for consults of the Superintendency of Finance | **YES. Briefly Indicate:** The corporation has established procedures for reporting balances and transactions between linked economic parties to perform the registration of such transactions subject to the accounting principles within the term of their occurrence in such a manner to have accurate and updated information, for assessing the effect of such operations within the economic and administrative situation of Grupo Aval. Likewise, pursuant to the Reference Framework for Institutional Relations and its Code of Corporate Governance, there are specific guidelines regarding operations with linked parties. Similarly, by being authorized as a financial conglomerate, the company maintains a chart of its affiliates that is available for consults of the Superintendency of Finance | **YES. Briefly Indicate:** The corporation has established procedures for reporting balances and transactions between linked economic parties to perform the registration of such transactions subject to the accounting principles within the term of their occurrence in such a manner to have accurate and updated information, for assessing the effect of such operations within the economic and administrative situation of Grupo Aval. Likewise, pursuant to the Reference Framework for Institutional Relations and its Code of Corporate Governance, there are specific guidelines regarding operations with linked parties. Similarly, by being authorized as a financial conglomerate, the company maintains a chart of its affiliates that is available for consults of the Superintendency of Finance |
| **NO. Explain:** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. |
| **Modification Date** |  |  |  |  |

---

**22.2.** The corporation's policy on related-party transactions addresses the matters mentioned on Recommendation 22.2.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **22.2. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate** The Company incorporated into its Reference framework for institutional operations the criteria of operations with related parties that are included in recommendation 22.2. | **YES. Briefly Indicate** The Company incorporated into its Reference framework for institutional operations the criteria of operations with related parties that are included in recommendation 22.2. | **YES. Briefly Indicate** The Company incorporated into its Reference framework for institutional operations the criteria of operations with related parties that are included in recommendation 22.2. | **YES. Briefly Indicate** The Company incorporated into its Reference framework for institutional operations the criteria of operations with related parties that are included in recommendation 22.2. | **YES. Briefly Indicate** The Company incorporated into its Reference framework for institutional operations the criteria of operations with related parties that are included in recommendation 22.2. |
| **NO. Explain:** | **NO. Explain:** | **NO. Explain:** | **NO. Explain:** | **NO. Explain:** |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | December 9<sup>th</sup>, 2020 | December 9<sup>th</sup>, 2020 | December 9<sup>th</sup>, 2020 | December 9<sup>th</sup>, 2020 |
| **Modification Date** |  |  |  |  |

---

**FINANCIAL SUPERINTENDENCE OF COLOMBIA**

***This translation from the original Spanish version is provided for convenience purposes only. No representation is made as to the accuracy of this document and the company does not assume any liability based upon it. Should any doubt or contradiction arise between the Spanish and English versions, the Spanish version shall prevail.***

**22.3**. The policy foresees that the Board of Directors does not need to authorize explicitly the related-party transactions if they are recurrent and pertain to the ordinary course of business, and performed by virtue of contracts of adhesion or master agreements, whose conditions are fully standardized, are applied massively, and carried out at market prices that have been set, on a general basis, by those who provide the given good or service, and the individual amount of which is not relevant to the corporation.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** The Reference Framework of Institutional Relations states that each entity of the Organization according to its activities and business, shall identify the situations representing or that could represent possible conflicts of interests. Likewise, they describe some possible situations of conflict of interests that generate the need for applying the mechanisms established for such purpose. The referred policy contains the provisions pointed out by recommendation 22.3. | **YES. Briefly Indicate:** The Reference Framework of Institutional Relations states that each entity of the Organization according to its activities and business, shall identify the situations representing or that could represent possible conflicts of interests. Likewise, they describe some possible situations of conflict of interests that generate the need for applying the mechanisms established for such purpose. The referred policy contains the provisions pointed out by recommendation 22.3. | **YES. Briefly Indicate:** The Reference Framework of Institutional Relations states that each entity of the Organization according to its activities and business, shall identify the situations representing or that could represent possible conflicts of interests. Likewise, they describe some possible situations of conflict of interests that generate the need for applying the mechanisms established for such purpose. The referred policy contains the provisions pointed out by recommendation 22.3. | **YES. Briefly Indicate:** The Reference Framework of Institutional Relations states that each entity of the Organization according to its activities and business, shall identify the situations representing or that could represent possible conflicts of interests. Likewise, they describe some possible situations of conflict of interests that generate the need for applying the mechanisms established for such purpose. The referred policy contains the provisions pointed out by recommendation 22.3. | **YES. Briefly Indicate:** The Reference Framework of Institutional Relations states that each entity of the Organization according to its activities and business, shall identify the situations representing or that could represent possible conflicts of interests. Likewise, they describe some possible situations of conflict of interests that generate the need for applying the mechanisms established for such purpose. The referred policy contains the provisions pointed out by recommendation 22.3. |
| **NO. Explain.** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | Implemented in 2015 adopting the recommendation proposed by the Code of Best Practices. | Implemented in 2015 adopting the recommendation proposed by the Code of Best Practices. | Implemented in 2015 adopting the recommendation proposed by the Code of Best Practices. | Implemented in 2015 adopting the recommendation proposed by the Code of Best Practices. |
| **Modification Date** |  |  |  |  |

---

**Measure No. 23. Compensation of Members of the Board of Directors**

**23.1.** The corporation has a compensation policy for the Board of Directors approved by the General Assembly of Shareholders that is reviewed every year. It identifies all the compensation elements that may be actually met. These elements may be fixed or variable. They may include fixed honoraria for being a Board member, honoraria for attending the Board sessions and/or its committee meetings, and other allowances of any type earned throughout the appointment, for whatever cause, either in cash or in kind. They also include any obligations assumed by the corporation in terms of pension or life-insurance payments, or other items, awarded to senior or newer members, as well as any liability-insurance coverage (Directors and Officers – D&O policies) that the company acquires for its Board members.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **23.1. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** The corporation has an appointment and remuneration policy for the Board of Directors, approved by the General Shareholders Meeting identifying all the retribution components of such governing body. | **YES. Briefly Indicate:** The corporation has an appointment and remuneration policy for the Board of Directors, approved by the General Shareholders Meeting identifying all the retribution components of such governing body. | **YES. Briefly Indicate:** The corporation has an appointment and remuneration policy for the Board of Directors, approved by the General Shareholders Meeting identifying all the retribution components of such governing body. | **YES. Briefly Indicate:** The corporation has an appointment and remuneration policy for the Board of Directors, approved by the General Shareholders Meeting identifying all the retribution components of such governing body. | **YES. Briefly Indicate:** The corporation has an appointment and remuneration policy for the Board of Directors, approved by the General Shareholders Meeting identifying all the retribution components of such governing body. |
| **NO. Explain** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | Implemented in 2015 adopting the recommendation proposed by the Code of Best Practices. | Implemented in 2015 adopting the recommendation proposed by the Code of Best Practices. | Implemented in 2015 adopting the recommendation proposed by the Code of Best Practices. | Implemented in 2015 adopting the recommendation proposed by the Code of Best Practices. |
| **Modification Date** |  |  |  |  |

---

**FINANCIAL SUPERINTENDENCE OF COLOMBIA**

***This translation from the original Spanish version is provided for convenience purposes only. No representation is made as to the accuracy of this document and the company does not assume any liability based upon it. Should any doubt or contradiction arise between the Spanish and English versions, the Spanish version shall prevail.***

**23.2.** If the corporation adopts any variable compensation systems related to the company's progress in the medium and long terms, the compensation policy sets limits to the amounts that may be distributed to the Board of Directors. If the variable component is related to the corporation's profits or other management indicators by the closing of the term assessed, whatever qualifications [*salvedades*] made by the Statutory Auditor in his report, which could lessen the term's results, will be considered.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **23.2. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** In accordance with the Board of Directors 'appointment and remuneration policy', approved by the General Shareholders' Meeting, the remuneration components of the Board do not include variable components and it is clear that the referred policy established fix fees per session and limits on the amount that the Board of Directors can be retributed. | **YES. Briefly Indicate:** In accordance with the Board of Directors 'appointment and remuneration policy', approved by the General Shareholders' Meeting, the remuneration components of the Board do not include variable components and it is clear that the referred policy established fix fees per session and limits on the amount that the Board of Directors can be retributed. | **YES. Briefly Indicate:** In accordance with the Board of Directors 'appointment and remuneration policy', approved by the General Shareholders' Meeting, the remuneration components of the Board do not include variable components and it is clear that the referred policy established fix fees per session and limits on the amount that the Board of Directors can be retributed. | **YES. Briefly Indicate:** In accordance with the Board of Directors 'appointment and remuneration policy', approved by the General Shareholders' Meeting, the remuneration components of the Board do not include variable components and it is clear that the referred policy established fix fees per session and limits on the amount that the Board of Directors can be retributed. | **YES. Briefly Indicate:** In accordance with the Board of Directors 'appointment and remuneration policy', approved by the General Shareholders' Meeting, the remuneration components of the Board do not include variable components and it is clear that the referred policy established fix fees per session and limits on the amount that the Board of Directors can be retributed. |
| **NO. Explain** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | September 30th 2014 | September 30th 2014 | September 30th 2014 | September 30th 2014 |
| **Modification Date** |  |  |  |  |

---

**23.3.** The proprietary and independent members of the Board of Directors are explicitly excluded from compensation schemes that include stock options or from a variable compensation linked to absolute changes in share prices.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **23.3. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** The corporation has a policy of appointment and remuneration of the Board of Directors, approved by the General Shareholders Meeting identifying all the retribution components of such body. The referred policy does not include variable components. | **YES. Briefly Indicate:** The corporation has a policy of appointment and remuneration of the Board of Directors, approved by the General Shareholders Meeting identifying all the retribution components of such body. The referred policy does not include variable components. | **YES. Briefly Indicate:** The corporation has a policy of appointment and remuneration of the Board of Directors, approved by the General Shareholders Meeting identifying all the retribution components of such body. The referred policy does not include variable components. | **YES. Briefly Indicate:** The corporation has a policy of appointment and remuneration of the Board of Directors, approved by the General Shareholders Meeting identifying all the retribution components of such body. The referred policy does not include variable components. | **YES. Briefly Indicate:** The corporation has a policy of appointment and remuneration of the Board of Directors, approved by the General Shareholders Meeting identifying all the retribution components of such body. The referred policy does not include variable components. |
| **NO. Explain:** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | Implemented in 2015 adopting the recommendation proposed by the Code of Best Practices. | Implemented in 2015 adopting the recommendation proposed by the Code of Best Practices. | Implemented in 2015 adopting the recommendation proposed by the Code of Best Practices. | Implemented in 2015 adopting the recommendation proposed by the Code of Best Practices. |
| **Modification Date** |  |  |  |  |

---

**FINANCIAL SUPERINTENDENCE OF COLOMBIA**

***This translation from the original Spanish version is provided for convenience purposes only. No representation is made as to the accuracy of this document and the company does not assume any liability based upon it. Should any doubt or contradiction arise between the Spanish and English versions, the Spanish version shall prevail.***

**23.4.** Within the compensation policy, for every term assessed, the General Assembly of Shareholders approves a maximum cost for the Board of Directors, including all the compensation elements authorized.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **23.4. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** The corporation has a policy of appointment and remuneration of the Board of Directors, approved by the General Shareholders Meeting identifying all the retribution components of such body. The referred policy does not include variable components. Pursuant to such policy the amount of fixed fees approved by the Meeting, applied to the total number of meetings of the Board of Directors or Support Committees that each member attends to, shall constitute the maximum cost of the Board of Directors and the sole retribution component approved for such body. | **YES. Briefly Indicate:** The corporation has a policy of appointment and remuneration of the Board of Directors, approved by the General Shareholders Meeting identifying all the retribution components of such body. The referred policy does not include variable components. Pursuant to such policy the amount of fixed fees approved by the Meeting, applied to the total number of meetings of the Board of Directors or Support Committees that each member attends to, shall constitute the maximum cost of the Board of Directors and the sole retribution component approved for such body. | **YES. Briefly Indicate:** The corporation has a policy of appointment and remuneration of the Board of Directors, approved by the General Shareholders Meeting identifying all the retribution components of such body. The referred policy does not include variable components. Pursuant to such policy the amount of fixed fees approved by the Meeting, applied to the total number of meetings of the Board of Directors or Support Committees that each member attends to, shall constitute the maximum cost of the Board of Directors and the sole retribution component approved for such body. | **YES. Briefly Indicate:** The corporation has a policy of appointment and remuneration of the Board of Directors, approved by the General Shareholders Meeting identifying all the retribution components of such body. The referred policy does not include variable components. Pursuant to such policy the amount of fixed fees approved by the Meeting, applied to the total number of meetings of the Board of Directors or Support Committees that each member attends to, shall constitute the maximum cost of the Board of Directors and the sole retribution component approved for such body. | **YES. Briefly Indicate:** The corporation has a policy of appointment and remuneration of the Board of Directors, approved by the General Shareholders Meeting identifying all the retribution components of such body. The referred policy does not include variable components. Pursuant to such policy the amount of fixed fees approved by the Meeting, applied to the total number of meetings of the Board of Directors or Support Committees that each member attends to, shall constitute the maximum cost of the Board of Directors and the sole retribution component approved for such body. |
| **NO. Explain:** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | Implemented in 2015 adopting the recommendation proposed by the Code of Best Practices. | Implemented in 2015 adopting the recommendation proposed by the Code of Best Practices. | Implemented in 2015 adopting the recommendation proposed by the Code of Best Practices. | Implemented in 2015 adopting the recommendation proposed by the Code of Best Practices. |
| **Modification Date** |  |  |  |  |

---

**23.5.** The shareholders know the complete actual cost of the Board of Directors during the term assessed, including all the compensation elements awarded to the Board members plus any spending reimbursements. Furthermore, it is published on the corporation's web site, itemized and detailed as the Board approves.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **23.5. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** To the extent that there are no retribution components different from the amount of fees paid for attendance to the Meetings, the Shareholders are aware of the fact that the total cost of remuneration of the Board of Directors is limited to the multiple of the fees approved per session, times the number of meetings that were effectively attended by each Director. Pursuant to article 446 of the Commerce Code, the fees paid to the Board of Directors are reported to the Meeting and are included in the financial statements as part of the item "Administrative Expenses - Fees." | **YES. Briefly Indicate:** To the extent that there are no retribution components different from the amount of fees paid for attendance to the Meetings, the Shareholders are aware of the fact that the total cost of remuneration of the Board of Directors is limited to the multiple of the fees approved per session, times the number of meetings that were effectively attended by each Director. Pursuant to article 446 of the Commerce Code, the fees paid to the Board of Directors are reported to the Meeting and are included in the financial statements as part of the item "Administrative Expenses - Fees." | **YES. Briefly Indicate:** To the extent that there are no retribution components different from the amount of fees paid for attendance to the Meetings, the Shareholders are aware of the fact that the total cost of remuneration of the Board of Directors is limited to the multiple of the fees approved per session, times the number of meetings that were effectively attended by each Director. Pursuant to article 446 of the Commerce Code, the fees paid to the Board of Directors are reported to the Meeting and are included in the financial statements as part of the item "Administrative Expenses - Fees." | **YES. Briefly Indicate:** To the extent that there are no retribution components different from the amount of fees paid for attendance to the Meetings, the Shareholders are aware of the fact that the total cost of remuneration of the Board of Directors is limited to the multiple of the fees approved per session, times the number of meetings that were effectively attended by each Director. Pursuant to article 446 of the Commerce Code, the fees paid to the Board of Directors are reported to the Meeting and are included in the financial statements as part of the item "Administrative Expenses - Fees." | **YES. Briefly Indicate:** To the extent that there are no retribution components different from the amount of fees paid for attendance to the Meetings, the Shareholders are aware of the fact that the total cost of remuneration of the Board of Directors is limited to the multiple of the fees approved per session, times the number of meetings that were effectively attended by each Director. Pursuant to article 446 of the Commerce Code, the fees paid to the Board of Directors are reported to the Meeting and are included in the financial statements as part of the item "Administrative Expenses - Fees." |
| **NO. Explain** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. |
| **Modification Date** |  |  |  |  |

---

**FINANCIAL SUPERINTENDENCE OF COLOMBIA**

***This translation from the original Spanish version is provided for convenience purposes only. No representation is made as to the accuracy of this document and the company does not assume any liability based upon it. Should any doubt or contradiction arise between the Spanish and English versions, the Spanish version shall prevail.***

**Measure No. 24. President and Senior Management of the Company**

**24.1.** The corporation's governance model creates an effective separation between the corporation's administration or governance (represented by the Board of Directors) and the ordinary course of business (in the hands of the senior management and led by the President of the corporation).

---

| | | | | |
|:---|:---|:---|:---|:---|
| **24.1. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** The Reference Framework of Institutional Relations of the Corporation establishes the organizational architecture of governance and control. Regarding senior management, it points out that the key management positions of Grupo Aval and its Subordinate entities are integrated by the Presidents of the entities, principal executives, personnel in charge of the areas of control, risk and auditing, responsible for the ordinary course of business and in charge of conceiving, executing and carrying out the follow-up of the objectives and strategies of the Organization. On their part, regarding Boards of Directors, it points out that in their capacity as maximum administrative bodies, they are responsible for guiding the strategic policies of the Organization, as well as monitoring and assessing the tasks performed by the Senior Management and for establishing the governance and control architecture directly or through their Support Committees, management and organizational development policies o, overseeing compliance of such policies by the Senior Management and acting as liaison between the Senior Management and the General Shareholders Meetings as required. | **YES. Briefly Indicate:** The Reference Framework of Institutional Relations of the Corporation establishes the organizational architecture of governance and control. Regarding senior management, it points out that the key management positions of Grupo Aval and its Subordinate entities are integrated by the Presidents of the entities, principal executives, personnel in charge of the areas of control, risk and auditing, responsible for the ordinary course of business and in charge of conceiving, executing and carrying out the follow-up of the objectives and strategies of the Organization. On their part, regarding Boards of Directors, it points out that in their capacity as maximum administrative bodies, they are responsible for guiding the strategic policies of the Organization, as well as monitoring and assessing the tasks performed by the Senior Management and for establishing the governance and control architecture directly or through their Support Committees, management and organizational development policies o, overseeing compliance of such policies by the Senior Management and acting as liaison between the Senior Management and the General Shareholders Meetings as required. | **YES. Briefly Indicate:** The Reference Framework of Institutional Relations of the Corporation establishes the organizational architecture of governance and control. Regarding senior management, it points out that the key management positions of Grupo Aval and its Subordinate entities are integrated by the Presidents of the entities, principal executives, personnel in charge of the areas of control, risk and auditing, responsible for the ordinary course of business and in charge of conceiving, executing and carrying out the follow-up of the objectives and strategies of the Organization. On their part, regarding Boards of Directors, it points out that in their capacity as maximum administrative bodies, they are responsible for guiding the strategic policies of the Organization, as well as monitoring and assessing the tasks performed by the Senior Management and for establishing the governance and control architecture directly or through their Support Committees, management and organizational development policies o, overseeing compliance of such policies by the Senior Management and acting as liaison between the Senior Management and the General Shareholders Meetings as required. | **YES. Briefly Indicate:** The Reference Framework of Institutional Relations of the Corporation establishes the organizational architecture of governance and control. Regarding senior management, it points out that the key management positions of Grupo Aval and its Subordinate entities are integrated by the Presidents of the entities, principal executives, personnel in charge of the areas of control, risk and auditing, responsible for the ordinary course of business and in charge of conceiving, executing and carrying out the follow-up of the objectives and strategies of the Organization. On their part, regarding Boards of Directors, it points out that in their capacity as maximum administrative bodies, they are responsible for guiding the strategic policies of the Organization, as well as monitoring and assessing the tasks performed by the Senior Management and for establishing the governance and control architecture directly or through their Support Committees, management and organizational development policies o, overseeing compliance of such policies by the Senior Management and acting as liaison between the Senior Management and the General Shareholders Meetings as required. | **YES. Briefly Indicate:** The Reference Framework of Institutional Relations of the Corporation establishes the organizational architecture of governance and control. Regarding senior management, it points out that the key management positions of Grupo Aval and its Subordinate entities are integrated by the Presidents of the entities, principal executives, personnel in charge of the areas of control, risk and auditing, responsible for the ordinary course of business and in charge of conceiving, executing and carrying out the follow-up of the objectives and strategies of the Organization. On their part, regarding Boards of Directors, it points out that in their capacity as maximum administrative bodies, they are responsible for guiding the strategic policies of the Organization, as well as monitoring and assessing the tasks performed by the Senior Management and for establishing the governance and control architecture directly or through their Support Committees, management and organizational development policies o, overseeing compliance of such policies by the Senior Management and acting as liaison between the Senior Management and the General Shareholders Meetings as required. |
| **NO. Explain:** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the New Country Code. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the New Country Code. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the New Country Code. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the New Country Code. |
| **Modification Date** |  |  |  |  |

---

**24.2.** In general, the policy of the Board of Directors consists of delegating the ordinary course of business to the senior management team, thereby focusing its activities on the overall strategy, supervisory, governance, and control functions.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **24.2. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** The Regulations of the Board of Directors establishes that as the highest administrative body, during the development of its legal and statutory duties is responsible of orienting the strategic policy of the Corporation, monitoring and assessing the managing activities carried out by the Senior Management and for establishing the governance and control architecture as well as the main policies for risk management and organizational development, overseeing their for compliance by the Senior Management and all the organization, acting as liaison between the Senior Management and the General Shareholders Meetings when required. Likewise it also points out that in the events where it results applicable and deemed necessary, the Board of Directors of Grupo Aval, in its capacity as parent company of other corporations shall perform its duties through general policies and guidelines or requests for information promoting the balance between the interests of the Corporation and those of its subordinate entities as a whole. The above, without prejudice of the autonomy of the governing bodies of the subordinate entities of the Corporation and of the responsibility of the members of its senior management and managers with respect of its ordinary course of the business. | **YES. Briefly Indicate:** The Regulations of the Board of Directors establishes that as the highest administrative body, during the development of its legal and statutory duties is responsible of orienting the strategic policy of the Corporation, monitoring and assessing the managing activities carried out by the Senior Management and for establishing the governance and control architecture as well as the main policies for risk management and organizational development, overseeing their for compliance by the Senior Management and all the organization, acting as liaison between the Senior Management and the General Shareholders Meetings when required. Likewise it also points out that in the events where it results applicable and deemed necessary, the Board of Directors of Grupo Aval, in its capacity as parent company of other corporations shall perform its duties through general policies and guidelines or requests for information promoting the balance between the interests of the Corporation and those of its subordinate entities as a whole. The above, without prejudice of the autonomy of the governing bodies of the subordinate entities of the Corporation and of the responsibility of the members of its senior management and managers with respect of its ordinary course of the business. | **YES. Briefly Indicate:** The Regulations of the Board of Directors establishes that as the highest administrative body, during the development of its legal and statutory duties is responsible of orienting the strategic policy of the Corporation, monitoring and assessing the managing activities carried out by the Senior Management and for establishing the governance and control architecture as well as the main policies for risk management and organizational development, overseeing their for compliance by the Senior Management and all the organization, acting as liaison between the Senior Management and the General Shareholders Meetings when required. Likewise it also points out that in the events where it results applicable and deemed necessary, the Board of Directors of Grupo Aval, in its capacity as parent company of other corporations shall perform its duties through general policies and guidelines or requests for information promoting the balance between the interests of the Corporation and those of its subordinate entities as a whole. The above, without prejudice of the autonomy of the governing bodies of the subordinate entities of the Corporation and of the responsibility of the members of its senior management and managers with respect of its ordinary course of the business. | **YES. Briefly Indicate:** The Regulations of the Board of Directors establishes that as the highest administrative body, during the development of its legal and statutory duties is responsible of orienting the strategic policy of the Corporation, monitoring and assessing the managing activities carried out by the Senior Management and for establishing the governance and control architecture as well as the main policies for risk management and organizational development, overseeing their for compliance by the Senior Management and all the organization, acting as liaison between the Senior Management and the General Shareholders Meetings when required. Likewise it also points out that in the events where it results applicable and deemed necessary, the Board of Directors of Grupo Aval, in its capacity as parent company of other corporations shall perform its duties through general policies and guidelines or requests for information promoting the balance between the interests of the Corporation and those of its subordinate entities as a whole. The above, without prejudice of the autonomy of the governing bodies of the subordinate entities of the Corporation and of the responsibility of the members of its senior management and managers with respect of its ordinary course of the business. | **YES. Briefly Indicate:** The Regulations of the Board of Directors establishes that as the highest administrative body, during the development of its legal and statutory duties is responsible of orienting the strategic policy of the Corporation, monitoring and assessing the managing activities carried out by the Senior Management and for establishing the governance and control architecture as well as the main policies for risk management and organizational development, overseeing their for compliance by the Senior Management and all the organization, acting as liaison between the Senior Management and the General Shareholders Meetings when required. Likewise it also points out that in the events where it results applicable and deemed necessary, the Board of Directors of Grupo Aval, in its capacity as parent company of other corporations shall perform its duties through general policies and guidelines or requests for information promoting the balance between the interests of the Corporation and those of its subordinate entities as a whole. The above, without prejudice of the autonomy of the governing bodies of the subordinate entities of the Corporation and of the responsibility of the members of its senior management and managers with respect of its ordinary course of the business. |
| **NO. Explain:** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the New Country Code. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the New Country Code. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the New Country Code. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the New Country Code. |
| **Modification Date** |  |  |  |  |

---

**FINANCIAL SUPERINTENDENCE OF COLOMBIA**

***This translation from the original Spanish version is provided for convenience purposes only. No representation is made as to the accuracy of this document and the company does not assume any liability based upon it. Should any doubt or contradiction arise between the Spanish and English versions, the Spanish version shall prevail.***

**24.3.** As a general rule, the President of the corporation identifies, assesses, and appoints the senior management members directly, for they are his immediate staff. Otherwise, the corporation may have the Board of Directors appoint the senior management members upon the proposal of the President of the company. However, no matter who makes the final appointment, the Board's Nomination and Compensation Committee will get to know and assess the candidates to hold key executive positions within the company, and it will issue its opinion

---

| | | | | |
|:---|:---|:---|:---|:---|
| **24.3. Measure Implementation** | **YES** | **NO** | **X** | **NA** |
| **YES. Briefly Indicate** |  |  |  |  |
| **NO. Explain:** Members of the Senior Management are identified, assessed and appointed directly by the President of the corporation. The Corporation shall consider the possibility of fully implementing recommendation 24.3 in a subsequent period. | **NO. Explain:** Members of the Senior Management are identified, assessed and appointed directly by the President of the corporation. The Corporation shall consider the possibility of fully implementing recommendation 24.3 in a subsequent period. | **NO. Explain:** Members of the Senior Management are identified, assessed and appointed directly by the President of the corporation. The Corporation shall consider the possibility of fully implementing recommendation 24.3 in a subsequent period. | **NO. Explain:** Members of the Senior Management are identified, assessed and appointed directly by the President of the corporation. The Corporation shall consider the possibility of fully implementing recommendation 24.3 in a subsequent period. | **NO. Explain:** Members of the Senior Management are identified, assessed and appointed directly by the President of the corporation. The Corporation shall consider the possibility of fully implementing recommendation 24.3 in a subsequent period. |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |  |
| **Implementation Date** | Does Not Apply | Does Not Apply | Does Not Apply | Does Not Apply |
| **Modification Date** |  |  |  |  |

---

**24.4.** The corporation has a clear policy to delegate functions approved by the Board of Directors and/or a power scheme that permits to assess the degree of empowerment of the President of the corporation, and that of the remaining members of the senior management.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **24.4. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** Pursuant to the Bylaws the Corporation has a President who acts as legal representative and has two alternates. The powers of the President and its alternates in an eventual absence of the former are limited to 20,000 monthly minimum legal salaries. Any act or agreement in excess of such amount, corresponds to the Board of Directors or to the General Shareholders as the case may be. The positions of alternate legal representatives shall be performed by two members of the Senior Management and except for these officers, no other member of the Senior Management has powers of legal representation of the corporation. | **YES. Briefly Indicate:** Pursuant to the Bylaws the Corporation has a President who acts as legal representative and has two alternates. The powers of the President and its alternates in an eventual absence of the former are limited to 20,000 monthly minimum legal salaries. Any act or agreement in excess of such amount, corresponds to the Board of Directors or to the General Shareholders as the case may be. The positions of alternate legal representatives shall be performed by two members of the Senior Management and except for these officers, no other member of the Senior Management has powers of legal representation of the corporation. | **YES. Briefly Indicate:** Pursuant to the Bylaws the Corporation has a President who acts as legal representative and has two alternates. The powers of the President and its alternates in an eventual absence of the former are limited to 20,000 monthly minimum legal salaries. Any act or agreement in excess of such amount, corresponds to the Board of Directors or to the General Shareholders as the case may be. The positions of alternate legal representatives shall be performed by two members of the Senior Management and except for these officers, no other member of the Senior Management has powers of legal representation of the corporation. | **YES. Briefly Indicate:** Pursuant to the Bylaws the Corporation has a President who acts as legal representative and has two alternates. The powers of the President and its alternates in an eventual absence of the former are limited to 20,000 monthly minimum legal salaries. Any act or agreement in excess of such amount, corresponds to the Board of Directors or to the General Shareholders as the case may be. The positions of alternate legal representatives shall be performed by two members of the Senior Management and except for these officers, no other member of the Senior Management has powers of legal representation of the corporation. | **YES. Briefly Indicate:** Pursuant to the Bylaws the Corporation has a President who acts as legal representative and has two alternates. The powers of the President and its alternates in an eventual absence of the former are limited to 20,000 monthly minimum legal salaries. Any act or agreement in excess of such amount, corresponds to the Board of Directors or to the General Shareholders as the case may be. The positions of alternate legal representatives shall be performed by two members of the Senior Management and except for these officers, no other member of the Senior Management has powers of legal representation of the corporation. |
| **NO. Explain:** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. |
| **Modification Date** |  |  |  |  |

---

**FINANCIAL SUPERINTENDENCE OF COLOMBIA**

***This translation from the original Spanish version is provided for convenience purposes only. No representation is made as to the accuracy of this document and the company does not assume any liability based upon it. Should any doubt or contradiction arise between the Spanish and English versions, the Spanish version shall prevail.***

**24.5.** The Board of Directors, through the Nomination and Compensation Committee, or whoever fulfills its functions, leads annually the performance assessment of the President of the corporation, and learns about the assessments of the other senior management members.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **24.5. Measure Implementation** | **YES** | **NO** | **X** | **NA** |
| **YES. Briefly Indicate:** |  |  |  |  |
| **NO. Explain:** The Corporation shall consider the possibility of fully implementing the recommendation 24.5 in a subsequent period. | **NO. Explain:** The Corporation shall consider the possibility of fully implementing the recommendation 24.5 in a subsequent period. | **NO. Explain:** The Corporation shall consider the possibility of fully implementing the recommendation 24.5 in a subsequent period. | **NO. Explain:** The Corporation shall consider the possibility of fully implementing the recommendation 24.5 in a subsequent period. | **NO. Explain:** The Corporation shall consider the possibility of fully implementing the recommendation 24.5 in a subsequent period. |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |  |
| **Implementation Date** | Does Not Apply | Does Not Apply | Does Not Apply | Does Not Apply |
| **Modification Date** |  |  |  |  |

---

**24.6.** The corporation has a compensation policy for the President of the company, and for the remaining senior management members approved by the Board of Directors. It identifies all the compensation elements that may be actually met, bound to the attainment of long-term objectives and to risk levels.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **24.6. Measure Implementation** | **YES** | **NO** | **X** | **NA** |
| **YES. Briefly Indicate** |  |  |  |  |
| **NO. Explain:** The Corporation shall consider the possibility of implementing recommendation 24.6 in a subsequent period.  | **NO. Explain:** The Corporation shall consider the possibility of implementing recommendation 24.6 in a subsequent period.  | **NO. Explain:** The Corporation shall consider the possibility of implementing recommendation 24.6 in a subsequent period.  | **NO. Explain:** The Corporation shall consider the possibility of implementing recommendation 24.6 in a subsequent period.  | **NO. Explain:** The Corporation shall consider the possibility of implementing recommendation 24.6 in a subsequent period.  |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |  |
| **Implementation Date** | Does Not Apply | Does Not Apply | Does Not Apply | Does Not Apply |
| **Modification Date** |  |  |  |  |

---

**24.7.** If the compensation of the President of the corporation includes fixed and variable components, its technical design and method of calculation impede that the variable component may exceed the maximum limit set forth by the Board of Directors.

**FINANCIAL SUPERINTENDENCE OF COLOMBIA**

***This translation from the original Spanish version is provided for convenience purposes only. No representation is made as to the accuracy of this document and the company does not assume any liability based upon it. Should any doubt or contradiction arise between the Spanish and English versions, the Spanish version shall prevail.***

---

| | | | | |
|:---|:---|:---|:---|:---|
| **24.7. Measure Implementation** | **YES** | **NO** | **X** | **NA** |
| **YES. Briefly Indicate** | | | | |
| **NO. Explain:** The Corporation shall consider the possibility of implementing the recommendation in a subsequent period. | **NO. Explain:** The Corporation shall consider the possibility of implementing the recommendation in a subsequent period. | **NO. Explain:** The Corporation shall consider the possibility of implementing the recommendation in a subsequent period. | **NO. Explain:** The Corporation shall consider the possibility of implementing the recommendation in a subsequent period. | **NO. Explain:** The Corporation shall consider the possibility of implementing the recommendation in a subsequent period. |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |  |
| **Implementation Date** | Does Not Apply | Does Not Apply | Does Not Apply | Does Not Apply |
| **Modification Date** |  |  |  |  |

---

&nbsp;&nbsp;&nbsp;&nbsp;**IV.** **CONTROL ARCHITECTURE** 

**Measure No. 25. Environment of Control**

**25.1.** The Board of Directors is ultimately responsible for the existence of a solid environment of control within the corporation, adapted to its nature, size, complexity, and risks, according to the standards mentioned on Recommendation 25.1.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **25.1. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** Pursuant to the corporate Bylaw (Art. 25, Item 23), it is the responsibility of the Board of Directors "to oversee compliance of the internal control policies and procedures of the Corporation". As part of such responsibility it carries out the follow-up through its support committees among other things, to matters relating to the control environment. Additionally, the Corporation has adapted its internal control system to the COSO 2013 (*Integrated Framework of the Committee of Sponsoring Organizations of the Treadway Commission of 2013)* and under the supervision and with participation of its directive staff, it carries out an annual assessment regarding the effectiveness of internal control, whose progress is reported to the Audit Committee of the Corporation. The control environment of the Corporation is adjusted to the nature, size, complexity and risks of the Corporation in the terms of the herein recommendation. | **YES. Briefly Indicate:** Pursuant to the corporate Bylaw (Art. 25, Item 23), it is the responsibility of the Board of Directors "to oversee compliance of the internal control policies and procedures of the Corporation". As part of such responsibility it carries out the follow-up through its support committees among other things, to matters relating to the control environment. Additionally, the Corporation has adapted its internal control system to the COSO 2013 (*Integrated Framework of the Committee of Sponsoring Organizations of the Treadway Commission of 2013)* and under the supervision and with participation of its directive staff, it carries out an annual assessment regarding the effectiveness of internal control, whose progress is reported to the Audit Committee of the Corporation. The control environment of the Corporation is adjusted to the nature, size, complexity and risks of the Corporation in the terms of the herein recommendation. | **YES. Briefly Indicate:** Pursuant to the corporate Bylaw (Art. 25, Item 23), it is the responsibility of the Board of Directors "to oversee compliance of the internal control policies and procedures of the Corporation". As part of such responsibility it carries out the follow-up through its support committees among other things, to matters relating to the control environment. Additionally, the Corporation has adapted its internal control system to the COSO 2013 (*Integrated Framework of the Committee of Sponsoring Organizations of the Treadway Commission of 2013)* and under the supervision and with participation of its directive staff, it carries out an annual assessment regarding the effectiveness of internal control, whose progress is reported to the Audit Committee of the Corporation. The control environment of the Corporation is adjusted to the nature, size, complexity and risks of the Corporation in the terms of the herein recommendation. | **YES. Briefly Indicate:** Pursuant to the corporate Bylaw (Art. 25, Item 23), it is the responsibility of the Board of Directors "to oversee compliance of the internal control policies and procedures of the Corporation". As part of such responsibility it carries out the follow-up through its support committees among other things, to matters relating to the control environment. Additionally, the Corporation has adapted its internal control system to the COSO 2013 (*Integrated Framework of the Committee of Sponsoring Organizations of the Treadway Commission of 2013)* and under the supervision and with participation of its directive staff, it carries out an annual assessment regarding the effectiveness of internal control, whose progress is reported to the Audit Committee of the Corporation. The control environment of the Corporation is adjusted to the nature, size, complexity and risks of the Corporation in the terms of the herein recommendation. | **YES. Briefly Indicate:** Pursuant to the corporate Bylaw (Art. 25, Item 23), it is the responsibility of the Board of Directors "to oversee compliance of the internal control policies and procedures of the Corporation". As part of such responsibility it carries out the follow-up through its support committees among other things, to matters relating to the control environment. Additionally, the Corporation has adapted its internal control system to the COSO 2013 (*Integrated Framework of the Committee of Sponsoring Organizations of the Treadway Commission of 2013)* and under the supervision and with participation of its directive staff, it carries out an annual assessment regarding the effectiveness of internal control, whose progress is reported to the Audit Committee of the Corporation. The control environment of the Corporation is adjusted to the nature, size, complexity and risks of the Corporation in the terms of the herein recommendation. |
| **NO. Explain:** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the Code of Best Practices | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the Code of Best Practices | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the Code of Best Practices | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the Code of Best Practices |
| **Modification Date** |  |  |  |  |

---

**FINANCIAL SUPERINTENDENCE OF COLOMBIA**

***This translation from the original Spanish version is provided for convenience purposes only. No representation is made as to the accuracy of this document and the company does not assume any liability based upon it. Should any doubt or contradiction arise between the Spanish and English versions, the Spanish version shall prevail.***

**25.2.** In the case of conglomerates, the Board of Directors of the holding company will foster a comprehensive and formal Control Architecture covering all the subordinate companies. It will establish responsibilities for the related policies and guidelines throughout the conglomerate and define clear reporting lines. All this will promote an all-inclusive perspective of the conglomerate's risks as well as the adoption of pertinent control mechanisms.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **25.2. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** As part of the environment control and of the objective of having a consolidated and formal control environment covering the scope of Grupo Aval and its subordinate entities, the Board of Directors of Grupo Aval Acciones y Valores S.A. has approved the *Framework Policy for Integral Risk Management*. Likewise, it has approved *Corporate Policies* applicable to the main risks having an incidence over Grupo Aval and its subordinate entities. | **YES. Briefly Indicate:** As part of the environment control and of the objective of having a consolidated and formal control environment covering the scope of Grupo Aval and its subordinate entities, the Board of Directors of Grupo Aval Acciones y Valores S.A. has approved the *Framework Policy for Integral Risk Management*. Likewise, it has approved *Corporate Policies* applicable to the main risks having an incidence over Grupo Aval and its subordinate entities. | **YES. Briefly Indicate:** As part of the environment control and of the objective of having a consolidated and formal control environment covering the scope of Grupo Aval and its subordinate entities, the Board of Directors of Grupo Aval Acciones y Valores S.A. has approved the *Framework Policy for Integral Risk Management*. Likewise, it has approved *Corporate Policies* applicable to the main risks having an incidence over Grupo Aval and its subordinate entities. | **YES. Briefly Indicate:** As part of the environment control and of the objective of having a consolidated and formal control environment covering the scope of Grupo Aval and its subordinate entities, the Board of Directors of Grupo Aval Acciones y Valores S.A. has approved the *Framework Policy for Integral Risk Management*. Likewise, it has approved *Corporate Policies* applicable to the main risks having an incidence over Grupo Aval and its subordinate entities. | **YES. Briefly Indicate:** As part of the environment control and of the objective of having a consolidated and formal control environment covering the scope of Grupo Aval and its subordinate entities, the Board of Directors of Grupo Aval Acciones y Valores S.A. has approved the *Framework Policy for Integral Risk Management*. Likewise, it has approved *Corporate Policies* applicable to the main risks having an incidence over Grupo Aval and its subordinate entities. |
| **NO. Explain:** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the Code of Best Practices. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the Code of Best Practices. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the Code of Best Practices. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the Code of Best Practices. |
| **Modification Date** |  |  |  |  |

---

**Measure 26. Risk Management**

**26.1.** The corporation's risk management objectives consider the purposes mentioned on Recommendation 26.1.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **26.1. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** The Board of Directors of Grupo Aval approved a *Framework Policy for the Integral Risk Management*. The guidelines and principles enshrined under the referred Policy apply both to Grupo Aval as well as to each of its subordinate entities regarding their respective competences.<br>As part of the specific objectives, the *Framework Policy for the Integral Risk Management of* establishes among other things, those referred to under recommendation 26.1. | **YES. Briefly Indicate:** The Board of Directors of Grupo Aval approved a *Framework Policy for the Integral Risk Management*. The guidelines and principles enshrined under the referred Policy apply both to Grupo Aval as well as to each of its subordinate entities regarding their respective competences.<br>As part of the specific objectives, the *Framework Policy for the Integral Risk Management of* establishes among other things, those referred to under recommendation 26.1. | **YES. Briefly Indicate:** The Board of Directors of Grupo Aval approved a *Framework Policy for the Integral Risk Management*. The guidelines and principles enshrined under the referred Policy apply both to Grupo Aval as well as to each of its subordinate entities regarding their respective competences.<br>As part of the specific objectives, the *Framework Policy for the Integral Risk Management of* establishes among other things, those referred to under recommendation 26.1. | **YES. Briefly Indicate:** The Board of Directors of Grupo Aval approved a *Framework Policy for the Integral Risk Management*. The guidelines and principles enshrined under the referred Policy apply both to Grupo Aval as well as to each of its subordinate entities regarding their respective competences.<br>As part of the specific objectives, the *Framework Policy for the Integral Risk Management of* establishes among other things, those referred to under recommendation 26.1. | **YES. Briefly Indicate:** The Board of Directors of Grupo Aval approved a *Framework Policy for the Integral Risk Management*. The guidelines and principles enshrined under the referred Policy apply both to Grupo Aval as well as to each of its subordinate entities regarding their respective competences.<br>As part of the specific objectives, the *Framework Policy for the Integral Risk Management of* establishes among other things, those referred to under recommendation 26.1. |
| **NO. Explain:** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the Code of Best Practices. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the Code of Best Practices. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the Code of Best Practices. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the Code of Best Practices. |
| **Modification Date** |  |  |  |  |

---

**FINANCIAL SUPERINTENDENCE OF COLOMBIA**

***This translation from the original Spanish version is provided for convenience purposes only. No representation is made as to the accuracy of this document and the company does not assume any liability based upon it. Should any doubt or contradiction arise between the Spanish and English versions, the Spanish version shall prevail.***

**26.2.** The corporation has a map of risks, understood as a tool to identify and monitor the financial and non-financial risks to which it is exposed.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **26.2. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** The Corporation has Risk Matrixes of processes for identifying the main financial and non-financial risks that have an incidence over its activities and establish applicable controls for managing the same. Under the principle of self-control, the pertinent areas draft their own risk and control matrixes and their compliance and effectiveness are assessed as part of the tasks of the Internal Audit Management of the Corporation and reported to the Audit Committee. | **YES. Briefly Indicate:** The Corporation has Risk Matrixes of processes for identifying the main financial and non-financial risks that have an incidence over its activities and establish applicable controls for managing the same. Under the principle of self-control, the pertinent areas draft their own risk and control matrixes and their compliance and effectiveness are assessed as part of the tasks of the Internal Audit Management of the Corporation and reported to the Audit Committee. | **YES. Briefly Indicate:** The Corporation has Risk Matrixes of processes for identifying the main financial and non-financial risks that have an incidence over its activities and establish applicable controls for managing the same. Under the principle of self-control, the pertinent areas draft their own risk and control matrixes and their compliance and effectiveness are assessed as part of the tasks of the Internal Audit Management of the Corporation and reported to the Audit Committee. | **YES. Briefly Indicate:** The Corporation has Risk Matrixes of processes for identifying the main financial and non-financial risks that have an incidence over its activities and establish applicable controls for managing the same. Under the principle of self-control, the pertinent areas draft their own risk and control matrixes and their compliance and effectiveness are assessed as part of the tasks of the Internal Audit Management of the Corporation and reported to the Audit Committee. | **YES. Briefly Indicate:** The Corporation has Risk Matrixes of processes for identifying the main financial and non-financial risks that have an incidence over its activities and establish applicable controls for managing the same. Under the principle of self-control, the pertinent areas draft their own risk and control matrixes and their compliance and effectiveness are assessed as part of the tasks of the Internal Audit Management of the Corporation and reported to the Audit Committee. |
| **NO. Explain:** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the Code of Best Practices. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the Code of Best Practices. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the Code of Best Practices. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the Code of Best Practices. |
| **Modification Date** |  |  |  |  |

---

**26.3.** The Board of Directors is responsible for defining a risk management policy, and for setting maximum limits of exposure for each risk identified.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **26.3. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** Article 25, item 23 of the Bylaws points out as a duty of the Board of Directors: "to oversee due compliance of the internal control policies and procedures of the Corporation". Likewise, pursuant to its Regulations for Operation (Art. 1), The Board of Directors of Grupo Aval, in its capacity as the highest administrative body, during the performance of its legal and statutory functions is responsible for orienting the strategic policy of the Corporation, monitoring and assessing the performance of the senior management, establishing the governance and control architecture and the main policies of risk management and of organizational development. In addition, in the events where it results applicable and it is deemed necessary, the Board of Directors of Grupo Aval, in its capacity as parent company of other corporations, performs its functions through general policies, guidelines or requests of information seeking the equilibrium between the interests of the Corporation and those of its subordinate entities as a whole. The foregoing, without prejudice of the autonomy of the governing bodies of the Corporation's subordinate entities and of the responsibilities of their respective senior managements and administrators during the ordinary course of their business. | **YES. Briefly Indicate:** Article 25, item 23 of the Bylaws points out as a duty of the Board of Directors: "to oversee due compliance of the internal control policies and procedures of the Corporation". Likewise, pursuant to its Regulations for Operation (Art. 1), The Board of Directors of Grupo Aval, in its capacity as the highest administrative body, during the performance of its legal and statutory functions is responsible for orienting the strategic policy of the Corporation, monitoring and assessing the performance of the senior management, establishing the governance and control architecture and the main policies of risk management and of organizational development. In addition, in the events where it results applicable and it is deemed necessary, the Board of Directors of Grupo Aval, in its capacity as parent company of other corporations, performs its functions through general policies, guidelines or requests of information seeking the equilibrium between the interests of the Corporation and those of its subordinate entities as a whole. The foregoing, without prejudice of the autonomy of the governing bodies of the Corporation's subordinate entities and of the responsibilities of their respective senior managements and administrators during the ordinary course of their business. | **YES. Briefly Indicate:** Article 25, item 23 of the Bylaws points out as a duty of the Board of Directors: "to oversee due compliance of the internal control policies and procedures of the Corporation". Likewise, pursuant to its Regulations for Operation (Art. 1), The Board of Directors of Grupo Aval, in its capacity as the highest administrative body, during the performance of its legal and statutory functions is responsible for orienting the strategic policy of the Corporation, monitoring and assessing the performance of the senior management, establishing the governance and control architecture and the main policies of risk management and of organizational development. In addition, in the events where it results applicable and it is deemed necessary, the Board of Directors of Grupo Aval, in its capacity as parent company of other corporations, performs its functions through general policies, guidelines or requests of information seeking the equilibrium between the interests of the Corporation and those of its subordinate entities as a whole. The foregoing, without prejudice of the autonomy of the governing bodies of the Corporation's subordinate entities and of the responsibilities of their respective senior managements and administrators during the ordinary course of their business. | **YES. Briefly Indicate:** Article 25, item 23 of the Bylaws points out as a duty of the Board of Directors: "to oversee due compliance of the internal control policies and procedures of the Corporation". Likewise, pursuant to its Regulations for Operation (Art. 1), The Board of Directors of Grupo Aval, in its capacity as the highest administrative body, during the performance of its legal and statutory functions is responsible for orienting the strategic policy of the Corporation, monitoring and assessing the performance of the senior management, establishing the governance and control architecture and the main policies of risk management and of organizational development. In addition, in the events where it results applicable and it is deemed necessary, the Board of Directors of Grupo Aval, in its capacity as parent company of other corporations, performs its functions through general policies, guidelines or requests of information seeking the equilibrium between the interests of the Corporation and those of its subordinate entities as a whole. The foregoing, without prejudice of the autonomy of the governing bodies of the Corporation's subordinate entities and of the responsibilities of their respective senior managements and administrators during the ordinary course of their business. | **YES. Briefly Indicate:** Article 25, item 23 of the Bylaws points out as a duty of the Board of Directors: "to oversee due compliance of the internal control policies and procedures of the Corporation". Likewise, pursuant to its Regulations for Operation (Art. 1), The Board of Directors of Grupo Aval, in its capacity as the highest administrative body, during the performance of its legal and statutory functions is responsible for orienting the strategic policy of the Corporation, monitoring and assessing the performance of the senior management, establishing the governance and control architecture and the main policies of risk management and of organizational development. In addition, in the events where it results applicable and it is deemed necessary, the Board of Directors of Grupo Aval, in its capacity as parent company of other corporations, performs its functions through general policies, guidelines or requests of information seeking the equilibrium between the interests of the Corporation and those of its subordinate entities as a whole. The foregoing, without prejudice of the autonomy of the governing bodies of the Corporation's subordinate entities and of the responsibilities of their respective senior managements and administrators during the ordinary course of their business. |
| **NO. Explain:** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | |
| **Implementation Date** | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the Code of Best Practices. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the Code of Best Practices. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the Code of Best Practices. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the Code of Best Practices. |
| **Modification Date** |  |  |  |  |

---

**FINANCIAL SUPERINTENDENCE OF COLOMBIA**

***This translation from the original Spanish version is provided for convenience purposes only. No representation is made as to the accuracy of this document and the company does not assume any liability based upon it. Should any doubt or contradiction arise between the Spanish and English versions, the Spanish version shall prevail.***

**26.4.** The Board of Directors knows about, and supervises periodically, the corporation's actual exposure to the maximum risk limits determined, and it proposes corrective and follow-up actions in case of deviations.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **26.4. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** Pursuant to what is established under the *Framework Policy for the Integral Risk Management,* the Board of Directors knows and approves policies regarding risks, ensures that the management has implemented an adequate policy for the integral management of risks and ensures the effective coordination and communication with those responsible for risk management, allowing them to take the measures they see fit, among other things. Likewise, the Audit Committee of Grupo Aval, in its capacity as support committee of the Board of Directors for the decision-making inherent to internal control and its improvement, is periodically informed about the risk situation of the Corporation, the events occurred, their level of impact and criticality, allowing them to propose corrective actions or generating process remediation or improvement instructions for the Senior Management for the cases cited. In addition, the Audit Committee may issue reports for the Board of Directors regarding matters deemed as relevant. Likewise, the Board of Directors created the Risk Committee, which performs supervisory functions in relation to the company's risks. | **YES. Briefly Indicate:** Pursuant to what is established under the *Framework Policy for the Integral Risk Management,* the Board of Directors knows and approves policies regarding risks, ensures that the management has implemented an adequate policy for the integral management of risks and ensures the effective coordination and communication with those responsible for risk management, allowing them to take the measures they see fit, among other things. Likewise, the Audit Committee of Grupo Aval, in its capacity as support committee of the Board of Directors for the decision-making inherent to internal control and its improvement, is periodically informed about the risk situation of the Corporation, the events occurred, their level of impact and criticality, allowing them to propose corrective actions or generating process remediation or improvement instructions for the Senior Management for the cases cited. In addition, the Audit Committee may issue reports for the Board of Directors regarding matters deemed as relevant. Likewise, the Board of Directors created the Risk Committee, which performs supervisory functions in relation to the company's risks. | **YES. Briefly Indicate:** Pursuant to what is established under the *Framework Policy for the Integral Risk Management,* the Board of Directors knows and approves policies regarding risks, ensures that the management has implemented an adequate policy for the integral management of risks and ensures the effective coordination and communication with those responsible for risk management, allowing them to take the measures they see fit, among other things. Likewise, the Audit Committee of Grupo Aval, in its capacity as support committee of the Board of Directors for the decision-making inherent to internal control and its improvement, is periodically informed about the risk situation of the Corporation, the events occurred, their level of impact and criticality, allowing them to propose corrective actions or generating process remediation or improvement instructions for the Senior Management for the cases cited. In addition, the Audit Committee may issue reports for the Board of Directors regarding matters deemed as relevant. Likewise, the Board of Directors created the Risk Committee, which performs supervisory functions in relation to the company's risks. | **YES. Briefly Indicate:** Pursuant to what is established under the *Framework Policy for the Integral Risk Management,* the Board of Directors knows and approves policies regarding risks, ensures that the management has implemented an adequate policy for the integral management of risks and ensures the effective coordination and communication with those responsible for risk management, allowing them to take the measures they see fit, among other things. Likewise, the Audit Committee of Grupo Aval, in its capacity as support committee of the Board of Directors for the decision-making inherent to internal control and its improvement, is periodically informed about the risk situation of the Corporation, the events occurred, their level of impact and criticality, allowing them to propose corrective actions or generating process remediation or improvement instructions for the Senior Management for the cases cited. In addition, the Audit Committee may issue reports for the Board of Directors regarding matters deemed as relevant. Likewise, the Board of Directors created the Risk Committee, which performs supervisory functions in relation to the company's risks. | **YES. Briefly Indicate:** Pursuant to what is established under the *Framework Policy for the Integral Risk Management,* the Board of Directors knows and approves policies regarding risks, ensures that the management has implemented an adequate policy for the integral management of risks and ensures the effective coordination and communication with those responsible for risk management, allowing them to take the measures they see fit, among other things. Likewise, the Audit Committee of Grupo Aval, in its capacity as support committee of the Board of Directors for the decision-making inherent to internal control and its improvement, is periodically informed about the risk situation of the Corporation, the events occurred, their level of impact and criticality, allowing them to propose corrective actions or generating process remediation or improvement instructions for the Senior Management for the cases cited. In addition, the Audit Committee may issue reports for the Board of Directors regarding matters deemed as relevant. Likewise, the Board of Directors created the Risk Committee, which performs supervisory functions in relation to the company's risks. |
| **NO. Explain:** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date**<br>| Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the New Country Code. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the New Country Code. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the New Country Code. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the New Country Code. |
| **Modification Date** |  |  |  |  |

---

**26.5.** Within the risk management policy framework, the senior management performs the processes and is responsible for managing the risks; therefore, it must identify, assess, estimate, control, monitor, and report them. In doing so, it defines methodologies and ensures that the management of risks is coherent with the risk strategies and policies set forth, and with the top limits approved.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **26.5. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** Pursuant to the *Framework Policy for the Integral Risk Management,* the Corporation shall structure its duties and responsibilities before its risks, following the scheme of the three lines of defense, namely, taking into consideration (i) the management per business line, (ii) a function of independent risk management, and (iii) an independent review. The first line of defense is comprised by each of the areas or coworkers within the Subordinate Entities managing the business (i.e. activities before the public and with direct contact with clients). This means that such areas or coworkers are responsible in first instance for identifying, assessing, managing, monitoring and reporting the risks inherent to the products, activities, processes and systems for which they are responsible. Those forming part of this first line of defense shall know their activities and processes and have sufficient resources for performing their tasks efficiently. Likewise, pursuant to the Policy, the Senior Management shall, among other responsibilities, oversee the application of the policies for each of the risks, their performance, monitoring, control, improvement plans and reports. | **YES. Briefly Indicate:** Pursuant to the *Framework Policy for the Integral Risk Management,* the Corporation shall structure its duties and responsibilities before its risks, following the scheme of the three lines of defense, namely, taking into consideration (i) the management per business line, (ii) a function of independent risk management, and (iii) an independent review. The first line of defense is comprised by each of the areas or coworkers within the Subordinate Entities managing the business (i.e. activities before the public and with direct contact with clients). This means that such areas or coworkers are responsible in first instance for identifying, assessing, managing, monitoring and reporting the risks inherent to the products, activities, processes and systems for which they are responsible. Those forming part of this first line of defense shall know their activities and processes and have sufficient resources for performing their tasks efficiently. Likewise, pursuant to the Policy, the Senior Management shall, among other responsibilities, oversee the application of the policies for each of the risks, their performance, monitoring, control, improvement plans and reports. | **YES. Briefly Indicate:** Pursuant to the *Framework Policy for the Integral Risk Management,* the Corporation shall structure its duties and responsibilities before its risks, following the scheme of the three lines of defense, namely, taking into consideration (i) the management per business line, (ii) a function of independent risk management, and (iii) an independent review. The first line of defense is comprised by each of the areas or coworkers within the Subordinate Entities managing the business (i.e. activities before the public and with direct contact with clients). This means that such areas or coworkers are responsible in first instance for identifying, assessing, managing, monitoring and reporting the risks inherent to the products, activities, processes and systems for which they are responsible. Those forming part of this first line of defense shall know their activities and processes and have sufficient resources for performing their tasks efficiently. Likewise, pursuant to the Policy, the Senior Management shall, among other responsibilities, oversee the application of the policies for each of the risks, their performance, monitoring, control, improvement plans and reports. | **YES. Briefly Indicate:** Pursuant to the *Framework Policy for the Integral Risk Management,* the Corporation shall structure its duties and responsibilities before its risks, following the scheme of the three lines of defense, namely, taking into consideration (i) the management per business line, (ii) a function of independent risk management, and (iii) an independent review. The first line of defense is comprised by each of the areas or coworkers within the Subordinate Entities managing the business (i.e. activities before the public and with direct contact with clients). This means that such areas or coworkers are responsible in first instance for identifying, assessing, managing, monitoring and reporting the risks inherent to the products, activities, processes and systems for which they are responsible. Those forming part of this first line of defense shall know their activities and processes and have sufficient resources for performing their tasks efficiently. Likewise, pursuant to the Policy, the Senior Management shall, among other responsibilities, oversee the application of the policies for each of the risks, their performance, monitoring, control, improvement plans and reports. | **YES. Briefly Indicate:** Pursuant to the *Framework Policy for the Integral Risk Management,* the Corporation shall structure its duties and responsibilities before its risks, following the scheme of the three lines of defense, namely, taking into consideration (i) the management per business line, (ii) a function of independent risk management, and (iii) an independent review. The first line of defense is comprised by each of the areas or coworkers within the Subordinate Entities managing the business (i.e. activities before the public and with direct contact with clients). This means that such areas or coworkers are responsible in first instance for identifying, assessing, managing, monitoring and reporting the risks inherent to the products, activities, processes and systems for which they are responsible. Those forming part of this first line of defense shall know their activities and processes and have sufficient resources for performing their tasks efficiently. Likewise, pursuant to the Policy, the Senior Management shall, among other responsibilities, oversee the application of the policies for each of the risks, their performance, monitoring, control, improvement plans and reports. |
| **NO. Explain:** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the New Country Code. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the New Country Code. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the New Country Code. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the New Country Code. |
| **Modification Date** |  |  |  |  |

---

**FINANCIAL SUPERINTENDENCE OF COLOMBIA**

***This translation from the original Spanish version is provided for convenience purposes only. No representation is made as to the accuracy of this document and the company does not assume any liability based upon it. Should any doubt or contradiction arise between the Spanish and English versions, the Spanish version shall prevail.***

**26.6.** The corporation has la policy to delegate risks approved by the Board of Directors. It establishes the limits of risk that may be managed directly at each of its levels.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **26.6. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** Pursuant to the governance model established in the Framework Policy for Integral Risk Management, the Board of Directors of each entity of the Organization and/or the Senior Management (depending on the regulation in force wherein the Grupo Aval operates) is responsible for approving the main policies for risk management. Such policies shall establish the parameters and guidelines applicable to all types of risks and the manner in which the exposure to the latter should be managed. On its part, the Audit Committee of each Entity knows and periodically supervises the effective exposure of the Entities to the maximum risk limits defined and proposes corrective and follow-up actions in the case of deviations. The Senior Management is the owner of the processes and responsible for risk management, namely, identifying, assessing, measuring, controlling, monitoring and reporting the risks, defining methodologies and ensuring that risk management is consistent with the strategy and the policies established per type of risks. Without prejudice to the role of Grupo Aval in its capacity as parent company, each Subordinate Entity is directly responsible for managing its risks and those of its affiliates and subsidiaries. Likewise, the Policy establishes that the Senior Management of the Entities shall have a policy of delegation by hierarchical levels and duties in charge of the directive and managing bodies and other areas regarding risks, reason for which it establishes the risks limits that can be managed directly by each level of the Entity. The policies of the risk management system of each entity shall include criteria for delegating risks as well as the powers assigned to l delegate coworkers for managing such risks as a function of their relevance and magnitude regarding the occurrence of possible events. | **YES. Briefly Indicate:** Pursuant to the governance model established in the Framework Policy for Integral Risk Management, the Board of Directors of each entity of the Organization and/or the Senior Management (depending on the regulation in force wherein the Grupo Aval operates) is responsible for approving the main policies for risk management. Such policies shall establish the parameters and guidelines applicable to all types of risks and the manner in which the exposure to the latter should be managed. On its part, the Audit Committee of each Entity knows and periodically supervises the effective exposure of the Entities to the maximum risk limits defined and proposes corrective and follow-up actions in the case of deviations. The Senior Management is the owner of the processes and responsible for risk management, namely, identifying, assessing, measuring, controlling, monitoring and reporting the risks, defining methodologies and ensuring that risk management is consistent with the strategy and the policies established per type of risks. Without prejudice to the role of Grupo Aval in its capacity as parent company, each Subordinate Entity is directly responsible for managing its risks and those of its affiliates and subsidiaries. Likewise, the Policy establishes that the Senior Management of the Entities shall have a policy of delegation by hierarchical levels and duties in charge of the directive and managing bodies and other areas regarding risks, reason for which it establishes the risks limits that can be managed directly by each level of the Entity. The policies of the risk management system of each entity shall include criteria for delegating risks as well as the powers assigned to l delegate coworkers for managing such risks as a function of their relevance and magnitude regarding the occurrence of possible events. | **YES. Briefly Indicate:** Pursuant to the governance model established in the Framework Policy for Integral Risk Management, the Board of Directors of each entity of the Organization and/or the Senior Management (depending on the regulation in force wherein the Grupo Aval operates) is responsible for approving the main policies for risk management. Such policies shall establish the parameters and guidelines applicable to all types of risks and the manner in which the exposure to the latter should be managed. On its part, the Audit Committee of each Entity knows and periodically supervises the effective exposure of the Entities to the maximum risk limits defined and proposes corrective and follow-up actions in the case of deviations. The Senior Management is the owner of the processes and responsible for risk management, namely, identifying, assessing, measuring, controlling, monitoring and reporting the risks, defining methodologies and ensuring that risk management is consistent with the strategy and the policies established per type of risks. Without prejudice to the role of Grupo Aval in its capacity as parent company, each Subordinate Entity is directly responsible for managing its risks and those of its affiliates and subsidiaries. Likewise, the Policy establishes that the Senior Management of the Entities shall have a policy of delegation by hierarchical levels and duties in charge of the directive and managing bodies and other areas regarding risks, reason for which it establishes the risks limits that can be managed directly by each level of the Entity. The policies of the risk management system of each entity shall include criteria for delegating risks as well as the powers assigned to l delegate coworkers for managing such risks as a function of their relevance and magnitude regarding the occurrence of possible events. | **YES. Briefly Indicate:** Pursuant to the governance model established in the Framework Policy for Integral Risk Management, the Board of Directors of each entity of the Organization and/or the Senior Management (depending on the regulation in force wherein the Grupo Aval operates) is responsible for approving the main policies for risk management. Such policies shall establish the parameters and guidelines applicable to all types of risks and the manner in which the exposure to the latter should be managed. On its part, the Audit Committee of each Entity knows and periodically supervises the effective exposure of the Entities to the maximum risk limits defined and proposes corrective and follow-up actions in the case of deviations. The Senior Management is the owner of the processes and responsible for risk management, namely, identifying, assessing, measuring, controlling, monitoring and reporting the risks, defining methodologies and ensuring that risk management is consistent with the strategy and the policies established per type of risks. Without prejudice to the role of Grupo Aval in its capacity as parent company, each Subordinate Entity is directly responsible for managing its risks and those of its affiliates and subsidiaries. Likewise, the Policy establishes that the Senior Management of the Entities shall have a policy of delegation by hierarchical levels and duties in charge of the directive and managing bodies and other areas regarding risks, reason for which it establishes the risks limits that can be managed directly by each level of the Entity. The policies of the risk management system of each entity shall include criteria for delegating risks as well as the powers assigned to l delegate coworkers for managing such risks as a function of their relevance and magnitude regarding the occurrence of possible events. | **YES. Briefly Indicate:** Pursuant to the governance model established in the Framework Policy for Integral Risk Management, the Board of Directors of each entity of the Organization and/or the Senior Management (depending on the regulation in force wherein the Grupo Aval operates) is responsible for approving the main policies for risk management. Such policies shall establish the parameters and guidelines applicable to all types of risks and the manner in which the exposure to the latter should be managed. On its part, the Audit Committee of each Entity knows and periodically supervises the effective exposure of the Entities to the maximum risk limits defined and proposes corrective and follow-up actions in the case of deviations. The Senior Management is the owner of the processes and responsible for risk management, namely, identifying, assessing, measuring, controlling, monitoring and reporting the risks, defining methodologies and ensuring that risk management is consistent with the strategy and the policies established per type of risks. Without prejudice to the role of Grupo Aval in its capacity as parent company, each Subordinate Entity is directly responsible for managing its risks and those of its affiliates and subsidiaries. Likewise, the Policy establishes that the Senior Management of the Entities shall have a policy of delegation by hierarchical levels and duties in charge of the directive and managing bodies and other areas regarding risks, reason for which it establishes the risks limits that can be managed directly by each level of the Entity. The policies of the risk management system of each entity shall include criteria for delegating risks as well as the powers assigned to l delegate coworkers for managing such risks as a function of their relevance and magnitude regarding the occurrence of possible events. |
| **NO. Explain:** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the Code of Best Practices. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the Code of Best Practices. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the Code of Best Practices. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the Code of Best Practices. |
| **Modification Date** |  |  |  |  |

---

**26.7.** Within conglomerates, there must be a comprehensive management of risks, so that there is cohesion among the belonging companies and control of them.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **26.7. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** The objectives of the Corporation regarding risk management at consolidated level are aligned with what is set forth under the herein recommendation and form part of the work plans of the Corporation with respect to risks, oriented towards achieving that the consolidated management of the same contributes to the cohesion and control of the institutions forming part of the conglomerate. In such sense, the parent company through its Risk Management Vice Presidency issues general guidelines, among others, regarding credit risk, operational risks, money-laundering risks and financing of terrorism and carries out the follow-up to the situation of its Subordinates with respect to market risks and liquidity. The foregoing without prejudice of the duty of subordinate entities of implementing their own processes and establishing the limits and other specific conditions according to their own characteristics and government. The care and assessment of these risks are reported to the parent company, in charge of monitoring and coordinating action plans and adoption of best practices when appropriate. The responsibilities and monitoring of risk matrixes and the control and implementation of improvement plans among others, although in charge of each subordinate entity, seek their standard application throughout the organization. Nevertheless, without prejudice to the foregoing, the management of risks at consolidated level forms part of the permanent objectives and work plans of the Risk Management Vice Presidency of the Corporation with the purpose of revising, and when required, updating existing policies, as well as establishing policies for those risks for which there are no formal procedures for providing formal procedures for implementing the guidelines set forth by the parent company. Likewise, the company's Risk Committee fulfills the functions established by the Superintendency of Finance regarding the Conglomerate's Risk Management Framework. | **YES. Briefly Indicate:** The objectives of the Corporation regarding risk management at consolidated level are aligned with what is set forth under the herein recommendation and form part of the work plans of the Corporation with respect to risks, oriented towards achieving that the consolidated management of the same contributes to the cohesion and control of the institutions forming part of the conglomerate. In such sense, the parent company through its Risk Management Vice Presidency issues general guidelines, among others, regarding credit risk, operational risks, money-laundering risks and financing of terrorism and carries out the follow-up to the situation of its Subordinates with respect to market risks and liquidity. The foregoing without prejudice of the duty of subordinate entities of implementing their own processes and establishing the limits and other specific conditions according to their own characteristics and government. The care and assessment of these risks are reported to the parent company, in charge of monitoring and coordinating action plans and adoption of best practices when appropriate. The responsibilities and monitoring of risk matrixes and the control and implementation of improvement plans among others, although in charge of each subordinate entity, seek their standard application throughout the organization. Nevertheless, without prejudice to the foregoing, the management of risks at consolidated level forms part of the permanent objectives and work plans of the Risk Management Vice Presidency of the Corporation with the purpose of revising, and when required, updating existing policies, as well as establishing policies for those risks for which there are no formal procedures for providing formal procedures for implementing the guidelines set forth by the parent company. Likewise, the company's Risk Committee fulfills the functions established by the Superintendency of Finance regarding the Conglomerate's Risk Management Framework. | **YES. Briefly Indicate:** The objectives of the Corporation regarding risk management at consolidated level are aligned with what is set forth under the herein recommendation and form part of the work plans of the Corporation with respect to risks, oriented towards achieving that the consolidated management of the same contributes to the cohesion and control of the institutions forming part of the conglomerate. In such sense, the parent company through its Risk Management Vice Presidency issues general guidelines, among others, regarding credit risk, operational risks, money-laundering risks and financing of terrorism and carries out the follow-up to the situation of its Subordinates with respect to market risks and liquidity. The foregoing without prejudice of the duty of subordinate entities of implementing their own processes and establishing the limits and other specific conditions according to their own characteristics and government. The care and assessment of these risks are reported to the parent company, in charge of monitoring and coordinating action plans and adoption of best practices when appropriate. The responsibilities and monitoring of risk matrixes and the control and implementation of improvement plans among others, although in charge of each subordinate entity, seek their standard application throughout the organization. Nevertheless, without prejudice to the foregoing, the management of risks at consolidated level forms part of the permanent objectives and work plans of the Risk Management Vice Presidency of the Corporation with the purpose of revising, and when required, updating existing policies, as well as establishing policies for those risks for which there are no formal procedures for providing formal procedures for implementing the guidelines set forth by the parent company. Likewise, the company's Risk Committee fulfills the functions established by the Superintendency of Finance regarding the Conglomerate's Risk Management Framework. | **YES. Briefly Indicate:** The objectives of the Corporation regarding risk management at consolidated level are aligned with what is set forth under the herein recommendation and form part of the work plans of the Corporation with respect to risks, oriented towards achieving that the consolidated management of the same contributes to the cohesion and control of the institutions forming part of the conglomerate. In such sense, the parent company through its Risk Management Vice Presidency issues general guidelines, among others, regarding credit risk, operational risks, money-laundering risks and financing of terrorism and carries out the follow-up to the situation of its Subordinates with respect to market risks and liquidity. The foregoing without prejudice of the duty of subordinate entities of implementing their own processes and establishing the limits and other specific conditions according to their own characteristics and government. The care and assessment of these risks are reported to the parent company, in charge of monitoring and coordinating action plans and adoption of best practices when appropriate. The responsibilities and monitoring of risk matrixes and the control and implementation of improvement plans among others, although in charge of each subordinate entity, seek their standard application throughout the organization. Nevertheless, without prejudice to the foregoing, the management of risks at consolidated level forms part of the permanent objectives and work plans of the Risk Management Vice Presidency of the Corporation with the purpose of revising, and when required, updating existing policies, as well as establishing policies for those risks for which there are no formal procedures for providing formal procedures for implementing the guidelines set forth by the parent company. Likewise, the company's Risk Committee fulfills the functions established by the Superintendency of Finance regarding the Conglomerate's Risk Management Framework. | **YES. Briefly Indicate:** The objectives of the Corporation regarding risk management at consolidated level are aligned with what is set forth under the herein recommendation and form part of the work plans of the Corporation with respect to risks, oriented towards achieving that the consolidated management of the same contributes to the cohesion and control of the institutions forming part of the conglomerate. In such sense, the parent company through its Risk Management Vice Presidency issues general guidelines, among others, regarding credit risk, operational risks, money-laundering risks and financing of terrorism and carries out the follow-up to the situation of its Subordinates with respect to market risks and liquidity. The foregoing without prejudice of the duty of subordinate entities of implementing their own processes and establishing the limits and other specific conditions according to their own characteristics and government. The care and assessment of these risks are reported to the parent company, in charge of monitoring and coordinating action plans and adoption of best practices when appropriate. The responsibilities and monitoring of risk matrixes and the control and implementation of improvement plans among others, although in charge of each subordinate entity, seek their standard application throughout the organization. Nevertheless, without prejudice to the foregoing, the management of risks at consolidated level forms part of the permanent objectives and work plans of the Risk Management Vice Presidency of the Corporation with the purpose of revising, and when required, updating existing policies, as well as establishing policies for those risks for which there are no formal procedures for providing formal procedures for implementing the guidelines set forth by the parent company. Likewise, the company's Risk Committee fulfills the functions established by the Superintendency of Finance regarding the Conglomerate's Risk Management Framework. |
| **NO. Explain:** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the Code of Best Practices | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the Code of Best Practices | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the Code of Best Practices | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the Code of Best Practices |
| **Modification Date** |  |  |  |  |

---

**FINANCIAL SUPERINTENDENCE OF COLOMBIA**

***This translation from the original Spanish version is provided for convenience purposes only. No representation is made as to the accuracy of this document and the company does not assume any liability based upon it. Should any doubt or contradiction arise between the Spanish and English versions, the Spanish version shall prevail.***

**26.8.** If the corporation has a complex and diverse structure for business and transactions, there is a risk management post (CRO Chief Risk Officer). In the case of companies integrated in control configurations and/or business groups, the incumbent has faculties over the conglomerate at large.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **26.8. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** There is a Senior Vice President of Corporate Risk and Compliance with powers at the Conglomerate level oriented towards complying with the corporate objectives for Integral Risk Management at a consolidated level. <br>Additionally, the Framework Policy for Integral Risk Management mentions that the Senior Vice President of Corporate Risk and Compliance acting as the Chief Risk Officer defines the corporate policies and monitors the different risk management policies adopted by Grupo Aval's affiliates. | **YES. Briefly Indicate:** There is a Senior Vice President of Corporate Risk and Compliance with powers at the Conglomerate level oriented towards complying with the corporate objectives for Integral Risk Management at a consolidated level. <br>Additionally, the Framework Policy for Integral Risk Management mentions that the Senior Vice President of Corporate Risk and Compliance acting as the Chief Risk Officer defines the corporate policies and monitors the different risk management policies adopted by Grupo Aval's affiliates. | **YES. Briefly Indicate:** There is a Senior Vice President of Corporate Risk and Compliance with powers at the Conglomerate level oriented towards complying with the corporate objectives for Integral Risk Management at a consolidated level. <br>Additionally, the Framework Policy for Integral Risk Management mentions that the Senior Vice President of Corporate Risk and Compliance acting as the Chief Risk Officer defines the corporate policies and monitors the different risk management policies adopted by Grupo Aval's affiliates. | **YES. Briefly Indicate:** There is a Senior Vice President of Corporate Risk and Compliance with powers at the Conglomerate level oriented towards complying with the corporate objectives for Integral Risk Management at a consolidated level. <br>Additionally, the Framework Policy for Integral Risk Management mentions that the Senior Vice President of Corporate Risk and Compliance acting as the Chief Risk Officer defines the corporate policies and monitors the different risk management policies adopted by Grupo Aval's affiliates. | **YES. Briefly Indicate:** There is a Senior Vice President of Corporate Risk and Compliance with powers at the Conglomerate level oriented towards complying with the corporate objectives for Integral Risk Management at a consolidated level. <br>Additionally, the Framework Policy for Integral Risk Management mentions that the Senior Vice President of Corporate Risk and Compliance acting as the Chief Risk Officer defines the corporate policies and monitors the different risk management policies adopted by Grupo Aval's affiliates. |
| **NO. Explain:** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. |
| **Modification Date** |  |  |  |  |

---

**Measure No. 27. Activities regarding Control**

**27.1.** The Board of Directors is responsible for ensuring that there is an adequate internal control system, adjusted to the corporation and its complexity, and coherent with the risk management in force.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **27.1. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate**: Pursuant to the Bylaws of the Corporation (Art. 25, item 23), a duty of the Board of Directors is to oversee due compliance of internal control policies and procedures of the Corporation. Likewise, as support committee of the Board of Directors, the Audit Committee, as part of its duties, shall provide support to the Board of Directors in decision-making regarding internal control and its improvement, supervising the company's internal control structure for establishing whether the procedures designed reasonably protect the assets of the Corporation and constantly assess the procedures established for determining the sufficiency of internal control (Art. 28). For such purpose, the Audit Committee approves the annual activities and the work timetable proposed by the Internal Audit of the Corporation, which periodically reports to the Audit Committee about internal results and final report of the activities developed during the respective year. During the development of the above, the Framework Policy for Risk Management assigns as part of the responsibilities of the Board of Directors: knowing and approving the policies regarding risks, ensuring that the management has implemented an adequate policy for integral risk management and ensuring the coordination and effective communication with those responsible for risk management, allowing them to take the measures deemed pertinent. Likewise, it seeks the selection and implementation of control activities to mitigate the risks up to acceptable levels. Furthermore, the Company has a Risk Committee, whose main function is to assist the Board of Directors in compliance with the risk management of Aval Financial Conglomerate. | **YES. Briefly Indicate**: Pursuant to the Bylaws of the Corporation (Art. 25, item 23), a duty of the Board of Directors is to oversee due compliance of internal control policies and procedures of the Corporation. Likewise, as support committee of the Board of Directors, the Audit Committee, as part of its duties, shall provide support to the Board of Directors in decision-making regarding internal control and its improvement, supervising the company's internal control structure for establishing whether the procedures designed reasonably protect the assets of the Corporation and constantly assess the procedures established for determining the sufficiency of internal control (Art. 28). For such purpose, the Audit Committee approves the annual activities and the work timetable proposed by the Internal Audit of the Corporation, which periodically reports to the Audit Committee about internal results and final report of the activities developed during the respective year. During the development of the above, the Framework Policy for Risk Management assigns as part of the responsibilities of the Board of Directors: knowing and approving the policies regarding risks, ensuring that the management has implemented an adequate policy for integral risk management and ensuring the coordination and effective communication with those responsible for risk management, allowing them to take the measures deemed pertinent. Likewise, it seeks the selection and implementation of control activities to mitigate the risks up to acceptable levels. Furthermore, the Company has a Risk Committee, whose main function is to assist the Board of Directors in compliance with the risk management of Aval Financial Conglomerate. | **YES. Briefly Indicate**: Pursuant to the Bylaws of the Corporation (Art. 25, item 23), a duty of the Board of Directors is to oversee due compliance of internal control policies and procedures of the Corporation. Likewise, as support committee of the Board of Directors, the Audit Committee, as part of its duties, shall provide support to the Board of Directors in decision-making regarding internal control and its improvement, supervising the company's internal control structure for establishing whether the procedures designed reasonably protect the assets of the Corporation and constantly assess the procedures established for determining the sufficiency of internal control (Art. 28). For such purpose, the Audit Committee approves the annual activities and the work timetable proposed by the Internal Audit of the Corporation, which periodically reports to the Audit Committee about internal results and final report of the activities developed during the respective year. During the development of the above, the Framework Policy for Risk Management assigns as part of the responsibilities of the Board of Directors: knowing and approving the policies regarding risks, ensuring that the management has implemented an adequate policy for integral risk management and ensuring the coordination and effective communication with those responsible for risk management, allowing them to take the measures deemed pertinent. Likewise, it seeks the selection and implementation of control activities to mitigate the risks up to acceptable levels. Furthermore, the Company has a Risk Committee, whose main function is to assist the Board of Directors in compliance with the risk management of Aval Financial Conglomerate. | **YES. Briefly Indicate**: Pursuant to the Bylaws of the Corporation (Art. 25, item 23), a duty of the Board of Directors is to oversee due compliance of internal control policies and procedures of the Corporation. Likewise, as support committee of the Board of Directors, the Audit Committee, as part of its duties, shall provide support to the Board of Directors in decision-making regarding internal control and its improvement, supervising the company's internal control structure for establishing whether the procedures designed reasonably protect the assets of the Corporation and constantly assess the procedures established for determining the sufficiency of internal control (Art. 28). For such purpose, the Audit Committee approves the annual activities and the work timetable proposed by the Internal Audit of the Corporation, which periodically reports to the Audit Committee about internal results and final report of the activities developed during the respective year. During the development of the above, the Framework Policy for Risk Management assigns as part of the responsibilities of the Board of Directors: knowing and approving the policies regarding risks, ensuring that the management has implemented an adequate policy for integral risk management and ensuring the coordination and effective communication with those responsible for risk management, allowing them to take the measures deemed pertinent. Likewise, it seeks the selection and implementation of control activities to mitigate the risks up to acceptable levels. Furthermore, the Company has a Risk Committee, whose main function is to assist the Board of Directors in compliance with the risk management of Aval Financial Conglomerate. | **YES. Briefly Indicate**: Pursuant to the Bylaws of the Corporation (Art. 25, item 23), a duty of the Board of Directors is to oversee due compliance of internal control policies and procedures of the Corporation. Likewise, as support committee of the Board of Directors, the Audit Committee, as part of its duties, shall provide support to the Board of Directors in decision-making regarding internal control and its improvement, supervising the company's internal control structure for establishing whether the procedures designed reasonably protect the assets of the Corporation and constantly assess the procedures established for determining the sufficiency of internal control (Art. 28). For such purpose, the Audit Committee approves the annual activities and the work timetable proposed by the Internal Audit of the Corporation, which periodically reports to the Audit Committee about internal results and final report of the activities developed during the respective year. During the development of the above, the Framework Policy for Risk Management assigns as part of the responsibilities of the Board of Directors: knowing and approving the policies regarding risks, ensuring that the management has implemented an adequate policy for integral risk management and ensuring the coordination and effective communication with those responsible for risk management, allowing them to take the measures deemed pertinent. Likewise, it seeks the selection and implementation of control activities to mitigate the risks up to acceptable levels. Furthermore, the Company has a Risk Committee, whose main function is to assist the Board of Directors in compliance with the risk management of Aval Financial Conglomerate. |
| **NO. Explain:** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the Code of Best Practices. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the Code of Best Practices. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the Code of Best Practices. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the Code of Best Practices. |
| **Modification Date** |  |  |  |  |

---

**FINANCIAL SUPERINTENDENCE OF COLOMBIA**

***This translation from the original Spanish version is provided for convenience purposes only. No representation is made as to the accuracy of this document and the company does not assume any liability based upon it. Should any doubt or contradiction arise between the Spanish and English versions, the Spanish version shall prevail.***

**27.2**. The Board of Directors is responsible for overseeing the effectiveness and suitability of the internal control system. This could be delegated to the Audit Committee, with no lessening of the Board's supervisory responsibilities.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **27.2. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** Supported on the same explanations of Recommendation 27.1. | **YES. Briefly Indicate:** Supported on the same explanations of Recommendation 27.1. | **YES. Briefly Indicate:** Supported on the same explanations of Recommendation 27.1. | **YES. Briefly Indicate:** Supported on the same explanations of Recommendation 27.1. | **YES. Briefly Indicate:** Supported on the same explanations of Recommendation 27.1. |
| **NO. Explain:** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the Code of Best Practices. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the Code of Best Practices. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the Code of Best Practices. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the Code of Best Practices. |
| **Modification Date** |  |  |  |  |

---

**27.3.** The corporation applies and demands the self-control principle. It is understood as the ability of the individuals who participate in the various processes to consider control as an inherent part of their responsibilities, fields of activity, and decision-making.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **27.3. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** Self-control is one of the principles established in the Framework Policy for Integral Risk Management. On the subject matter, such policy establishes that the Risks Management System of the Organization should foster self-control, understood as the capacity of individuals participating in different processes, considering control, fields of action and decision making as inherent part of their responsibilities thus ensuring that controls for mitigating risks to which the entities of the Organization are exposed, are implemented and documented. During the development of such principle, those participating in the different processes (including the Senior Management) are responsible, as defined in the matrix of roles and responsibilities, of identifying, assessing, measuring, controlling, monitoring and reporting the risks, defining methodologies and ensuring that the risk management is consistent. Likewise, the Code of Ethics and Conduct applicable to Grupo Aval includes Self-control and Self-Regulation as part of its corporate principles and values defining that the staff of Grupo Aval shall apply Self-Control and Self-Regulation policies as fundamental tools for preventing, detecting, monitoring and defining the different risks that the Corporation is exposed to and that are informed with clarity so they are useful. | **YES. Briefly Indicate:** Self-control is one of the principles established in the Framework Policy for Integral Risk Management. On the subject matter, such policy establishes that the Risks Management System of the Organization should foster self-control, understood as the capacity of individuals participating in different processes, considering control, fields of action and decision making as inherent part of their responsibilities thus ensuring that controls for mitigating risks to which the entities of the Organization are exposed, are implemented and documented. During the development of such principle, those participating in the different processes (including the Senior Management) are responsible, as defined in the matrix of roles and responsibilities, of identifying, assessing, measuring, controlling, monitoring and reporting the risks, defining methodologies and ensuring that the risk management is consistent. Likewise, the Code of Ethics and Conduct applicable to Grupo Aval includes Self-control and Self-Regulation as part of its corporate principles and values defining that the staff of Grupo Aval shall apply Self-Control and Self-Regulation policies as fundamental tools for preventing, detecting, monitoring and defining the different risks that the Corporation is exposed to and that are informed with clarity so they are useful. | **YES. Briefly Indicate:** Self-control is one of the principles established in the Framework Policy for Integral Risk Management. On the subject matter, such policy establishes that the Risks Management System of the Organization should foster self-control, understood as the capacity of individuals participating in different processes, considering control, fields of action and decision making as inherent part of their responsibilities thus ensuring that controls for mitigating risks to which the entities of the Organization are exposed, are implemented and documented. During the development of such principle, those participating in the different processes (including the Senior Management) are responsible, as defined in the matrix of roles and responsibilities, of identifying, assessing, measuring, controlling, monitoring and reporting the risks, defining methodologies and ensuring that the risk management is consistent. Likewise, the Code of Ethics and Conduct applicable to Grupo Aval includes Self-control and Self-Regulation as part of its corporate principles and values defining that the staff of Grupo Aval shall apply Self-Control and Self-Regulation policies as fundamental tools for preventing, detecting, monitoring and defining the different risks that the Corporation is exposed to and that are informed with clarity so they are useful. | **YES. Briefly Indicate:** Self-control is one of the principles established in the Framework Policy for Integral Risk Management. On the subject matter, such policy establishes that the Risks Management System of the Organization should foster self-control, understood as the capacity of individuals participating in different processes, considering control, fields of action and decision making as inherent part of their responsibilities thus ensuring that controls for mitigating risks to which the entities of the Organization are exposed, are implemented and documented. During the development of such principle, those participating in the different processes (including the Senior Management) are responsible, as defined in the matrix of roles and responsibilities, of identifying, assessing, measuring, controlling, monitoring and reporting the risks, defining methodologies and ensuring that the risk management is consistent. Likewise, the Code of Ethics and Conduct applicable to Grupo Aval includes Self-control and Self-Regulation as part of its corporate principles and values defining that the staff of Grupo Aval shall apply Self-Control and Self-Regulation policies as fundamental tools for preventing, detecting, monitoring and defining the different risks that the Corporation is exposed to and that are informed with clarity so they are useful. | **YES. Briefly Indicate:** Self-control is one of the principles established in the Framework Policy for Integral Risk Management. On the subject matter, such policy establishes that the Risks Management System of the Organization should foster self-control, understood as the capacity of individuals participating in different processes, considering control, fields of action and decision making as inherent part of their responsibilities thus ensuring that controls for mitigating risks to which the entities of the Organization are exposed, are implemented and documented. During the development of such principle, those participating in the different processes (including the Senior Management) are responsible, as defined in the matrix of roles and responsibilities, of identifying, assessing, measuring, controlling, monitoring and reporting the risks, defining methodologies and ensuring that the risk management is consistent. Likewise, the Code of Ethics and Conduct applicable to Grupo Aval includes Self-control and Self-Regulation as part of its corporate principles and values defining that the staff of Grupo Aval shall apply Self-Control and Self-Regulation policies as fundamental tools for preventing, detecting, monitoring and defining the different risks that the Corporation is exposed to and that are informed with clarity so they are useful. |
| **NO. Explain:** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the Code of Best Practices. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the Code of Best Practices. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the Code of Best Practices. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the Code of Best Practices. |
| **Modification Date** |  |  |  |  |

---

**FINANCIAL SUPERINTENDENCE OF COLOMBIA**

***This translation from the original Spanish version is provided for convenience purposes only. No representation is made as to the accuracy of this document and the company does not assume any liability based upon it. Should any doubt or contradiction arise between the Spanish and English versions, the Spanish version shall prevail.***

**Measure No. 28. Information and Communication**

**28.1**. Within the corporation, there is top-down and horizontal communication about the culture, philosophy, and policies concerning risk, and about the limits of exposure approved, so that the staff at large regards the risks and control activities within their functions.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **28.1. Measure Implementation:** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** Permanent and timely cooperation, coordination and exchange of information are some of the principles applicable to risk management of the Organization. In this respect, the policies state that the entities forming part of the Conglomerate shall communicate the culture, philosophy and risk policies downwards and horizontally (control environment). Pursuant to the Policy and during the development of such principle, the entities forming part of the Organization shall seek the generation of effective reporting mechanisms upwards (towards the Board of Directors and Senior Management), which are truthful, understandable and thorough so to create an effective support for the management. | **YES. Briefly Indicate:** Permanent and timely cooperation, coordination and exchange of information are some of the principles applicable to risk management of the Organization. In this respect, the policies state that the entities forming part of the Conglomerate shall communicate the culture, philosophy and risk policies downwards and horizontally (control environment). Pursuant to the Policy and during the development of such principle, the entities forming part of the Organization shall seek the generation of effective reporting mechanisms upwards (towards the Board of Directors and Senior Management), which are truthful, understandable and thorough so to create an effective support for the management. | **YES. Briefly Indicate:** Permanent and timely cooperation, coordination and exchange of information are some of the principles applicable to risk management of the Organization. In this respect, the policies state that the entities forming part of the Conglomerate shall communicate the culture, philosophy and risk policies downwards and horizontally (control environment). Pursuant to the Policy and during the development of such principle, the entities forming part of the Organization shall seek the generation of effective reporting mechanisms upwards (towards the Board of Directors and Senior Management), which are truthful, understandable and thorough so to create an effective support for the management. | **YES. Briefly Indicate:** Permanent and timely cooperation, coordination and exchange of information are some of the principles applicable to risk management of the Organization. In this respect, the policies state that the entities forming part of the Conglomerate shall communicate the culture, philosophy and risk policies downwards and horizontally (control environment). Pursuant to the Policy and during the development of such principle, the entities forming part of the Organization shall seek the generation of effective reporting mechanisms upwards (towards the Board of Directors and Senior Management), which are truthful, understandable and thorough so to create an effective support for the management. | **YES. Briefly Indicate:** Permanent and timely cooperation, coordination and exchange of information are some of the principles applicable to risk management of the Organization. In this respect, the policies state that the entities forming part of the Conglomerate shall communicate the culture, philosophy and risk policies downwards and horizontally (control environment). Pursuant to the Policy and during the development of such principle, the entities forming part of the Organization shall seek the generation of effective reporting mechanisms upwards (towards the Board of Directors and Senior Management), which are truthful, understandable and thorough so to create an effective support for the management. |
| **NO. Explain:** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the Code of Best Practices. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the Code of Best Practices. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the Code of Best Practices. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the Code of Best Practices. |
| **Modification Date** |  |  |  |  |

---

**28.2.** Within the corporation, there is a bottom-up mechanism to report information (toward the Board of Directors and the senior management) reliable, clear, and complete, which provides support and permits an informed decision-making, risk management, and control.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **28.2. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** The Corporation has an information reporting mechanism towards the Senior Management, the Audit Committee and the Risk Committee, which acts as a Support Committee of the Board, overseeing compliance of internal control of the Corporation, allowing such Committee to assess, as required, giving instructions about the tasks carried out by the Corporation for risk management and control. | **YES. Briefly Indicate:** The Corporation has an information reporting mechanism towards the Senior Management, the Audit Committee and the Risk Committee, which acts as a Support Committee of the Board, overseeing compliance of internal control of the Corporation, allowing such Committee to assess, as required, giving instructions about the tasks carried out by the Corporation for risk management and control. | **YES. Briefly Indicate:** The Corporation has an information reporting mechanism towards the Senior Management, the Audit Committee and the Risk Committee, which acts as a Support Committee of the Board, overseeing compliance of internal control of the Corporation, allowing such Committee to assess, as required, giving instructions about the tasks carried out by the Corporation for risk management and control. | **YES. Briefly Indicate:** The Corporation has an information reporting mechanism towards the Senior Management, the Audit Committee and the Risk Committee, which acts as a Support Committee of the Board, overseeing compliance of internal control of the Corporation, allowing such Committee to assess, as required, giving instructions about the tasks carried out by the Corporation for risk management and control. | **YES. Briefly Indicate:** The Corporation has an information reporting mechanism towards the Senior Management, the Audit Committee and the Risk Committee, which acts as a Support Committee of the Board, overseeing compliance of internal control of the Corporation, allowing such Committee to assess, as required, giving instructions about the tasks carried out by the Corporation for risk management and control. |
| **NO. Explain:** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the New Country Code. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the New Country Code. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the New Country Code. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the New Country Code. |
| **Modification Date** |  |  |  |  |

---

**FINANCIAL SUPERINTENDENCE OF COLOMBIA**

***This translation from the original Spanish version is provided for convenience purposes only. No representation is made as to the accuracy of this document and the company does not assume any liability based upon it. Should any doubt or contradiction arise between the Spanish and English versions, the Spanish version shall prevail.***

**28.3.** The corporation's mechanisms for communication and report of information:

i. Allow the senior management to engage the corporation as a whole, highlighting its responsibility in risk management and the setup of controls.

ii. Enable the corporation's personnel to understand their role in risk management and the identification of controls, as well as their individual contribution in connection with the work of others.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **28.3. Measure Implementation:** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** The policies and procedures are disclosed from top to bottom through the General Instructions which are of mandatory compliance. Roles and responsibilities of each actor of the process are clearly defined within the policies and the same are documented and available for consultation in the Intranet, which is the tool through which training sessions and virtual assessments are carried out regarding the main risks that have an incidence over the activities developed by the Corporation. | **YES. Briefly Indicate:** The policies and procedures are disclosed from top to bottom through the General Instructions which are of mandatory compliance. Roles and responsibilities of each actor of the process are clearly defined within the policies and the same are documented and available for consultation in the Intranet, which is the tool through which training sessions and virtual assessments are carried out regarding the main risks that have an incidence over the activities developed by the Corporation. | **YES. Briefly Indicate:** The policies and procedures are disclosed from top to bottom through the General Instructions which are of mandatory compliance. Roles and responsibilities of each actor of the process are clearly defined within the policies and the same are documented and available for consultation in the Intranet, which is the tool through which training sessions and virtual assessments are carried out regarding the main risks that have an incidence over the activities developed by the Corporation. | **YES. Briefly Indicate:** The policies and procedures are disclosed from top to bottom through the General Instructions which are of mandatory compliance. Roles and responsibilities of each actor of the process are clearly defined within the policies and the same are documented and available for consultation in the Intranet, which is the tool through which training sessions and virtual assessments are carried out regarding the main risks that have an incidence over the activities developed by the Corporation. | **YES. Briefly Indicate:** The policies and procedures are disclosed from top to bottom through the General Instructions which are of mandatory compliance. Roles and responsibilities of each actor of the process are clearly defined within the policies and the same are documented and available for consultation in the Intranet, which is the tool through which training sessions and virtual assessments are carried out regarding the main risks that have an incidence over the activities developed by the Corporation. |
| **NO. Explain:** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the New Country Code. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the New Country Code. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the New Country Code. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the New Country Code. |
| **Modification Date** |  |  |  |  |

---

**28.4.** There are internal anonymous-tip systems or "whistle blowers" through which the employees may inform anonymously any illegal or unethical behaviors, or those that may contravene the corporation's risk management and control culture. The Board of Directors receives a report on these claims.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **28.4. Measure Implementation:** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** The corporation has an Ethical Hotline where employees can communicate anonymously about events that they feel deserve to be reported. Likewise, an ethical hotline for vendors and third parties has been established through the web page of Grupo Aval for receiving reports or complaints by them. Such reports are analyzed and may cause investigations by the areas of internal audit on inappropriate behaviors. These matters are reported periodically and in a consolidated manner to the Corporate Affairs Committee in its capacity as support committee of the Board of Directors. | **YES. Briefly Indicate:** The corporation has an Ethical Hotline where employees can communicate anonymously about events that they feel deserve to be reported. Likewise, an ethical hotline for vendors and third parties has been established through the web page of Grupo Aval for receiving reports or complaints by them. Such reports are analyzed and may cause investigations by the areas of internal audit on inappropriate behaviors. These matters are reported periodically and in a consolidated manner to the Corporate Affairs Committee in its capacity as support committee of the Board of Directors. | **YES. Briefly Indicate:** The corporation has an Ethical Hotline where employees can communicate anonymously about events that they feel deserve to be reported. Likewise, an ethical hotline for vendors and third parties has been established through the web page of Grupo Aval for receiving reports or complaints by them. Such reports are analyzed and may cause investigations by the areas of internal audit on inappropriate behaviors. These matters are reported periodically and in a consolidated manner to the Corporate Affairs Committee in its capacity as support committee of the Board of Directors. | **YES. Briefly Indicate:** The corporation has an Ethical Hotline where employees can communicate anonymously about events that they feel deserve to be reported. Likewise, an ethical hotline for vendors and third parties has been established through the web page of Grupo Aval for receiving reports or complaints by them. Such reports are analyzed and may cause investigations by the areas of internal audit on inappropriate behaviors. These matters are reported periodically and in a consolidated manner to the Corporate Affairs Committee in its capacity as support committee of the Board of Directors. | **YES. Briefly Indicate:** The corporation has an Ethical Hotline where employees can communicate anonymously about events that they feel deserve to be reported. Likewise, an ethical hotline for vendors and third parties has been established through the web page of Grupo Aval for receiving reports or complaints by them. Such reports are analyzed and may cause investigations by the areas of internal audit on inappropriate behaviors. These matters are reported periodically and in a consolidated manner to the Corporate Affairs Committee in its capacity as support committee of the Board of Directors. |
| **NO. Explain:** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. |
| **Modification Date** |  |  |  |  |

---

**FINANCIAL SUPERINTENDENCE OF COLOMBIA**

***This translation from the original Spanish version is provided for convenience purposes only. No representation is made as to the accuracy of this document and the company does not assume any liability based upon it. Should any doubt or contradiction arise between the Spanish and English versions, the Spanish version shall prevail.***

**Measure 29. Supervision of Control Architecture** 

**29.1** The Board of Directors, through the Audit Committee, is responsible for overseeing the effectiveness of the different components of the corporation's Control Architecture.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **29.1. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** Pursuant to the Bylaws of the Corporation (Art. 29, items 2, 5 and 10), a duty of the Audit Committee of the Corporation is supervising the structure of internal control of the company with the purpose of establishing whether the procedures designed, reasonably protect the assets of the Corporation," "5. Constantly assess the procedures established to assess the sufficiency of internal control." and "10. Discussing the risk management policies with the Management." The Audit Committee supervises the internal control of the Corporation, specifically through the assessment of the work of the Internal Audit, analyzing and approving its annual work plan on carrying out the follow- up of its periodical reports regarding internal control. Likewise, it supervises the independence and objectivity of the Internal Auditor. | **YES. Briefly Indicate:** Pursuant to the Bylaws of the Corporation (Art. 29, items 2, 5 and 10), a duty of the Audit Committee of the Corporation is supervising the structure of internal control of the company with the purpose of establishing whether the procedures designed, reasonably protect the assets of the Corporation," "5. Constantly assess the procedures established to assess the sufficiency of internal control." and "10. Discussing the risk management policies with the Management." The Audit Committee supervises the internal control of the Corporation, specifically through the assessment of the work of the Internal Audit, analyzing and approving its annual work plan on carrying out the follow- up of its periodical reports regarding internal control. Likewise, it supervises the independence and objectivity of the Internal Auditor. | **YES. Briefly Indicate:** Pursuant to the Bylaws of the Corporation (Art. 29, items 2, 5 and 10), a duty of the Audit Committee of the Corporation is supervising the structure of internal control of the company with the purpose of establishing whether the procedures designed, reasonably protect the assets of the Corporation," "5. Constantly assess the procedures established to assess the sufficiency of internal control." and "10. Discussing the risk management policies with the Management." The Audit Committee supervises the internal control of the Corporation, specifically through the assessment of the work of the Internal Audit, analyzing and approving its annual work plan on carrying out the follow- up of its periodical reports regarding internal control. Likewise, it supervises the independence and objectivity of the Internal Auditor. | **YES. Briefly Indicate:** Pursuant to the Bylaws of the Corporation (Art. 29, items 2, 5 and 10), a duty of the Audit Committee of the Corporation is supervising the structure of internal control of the company with the purpose of establishing whether the procedures designed, reasonably protect the assets of the Corporation," "5. Constantly assess the procedures established to assess the sufficiency of internal control." and "10. Discussing the risk management policies with the Management." The Audit Committee supervises the internal control of the Corporation, specifically through the assessment of the work of the Internal Audit, analyzing and approving its annual work plan on carrying out the follow- up of its periodical reports regarding internal control. Likewise, it supervises the independence and objectivity of the Internal Auditor. | **YES. Briefly Indicate:** Pursuant to the Bylaws of the Corporation (Art. 29, items 2, 5 and 10), a duty of the Audit Committee of the Corporation is supervising the structure of internal control of the company with the purpose of establishing whether the procedures designed, reasonably protect the assets of the Corporation," "5. Constantly assess the procedures established to assess the sufficiency of internal control." and "10. Discussing the risk management policies with the Management." The Audit Committee supervises the internal control of the Corporation, specifically through the assessment of the work of the Internal Audit, analyzing and approving its annual work plan on carrying out the follow- up of its periodical reports regarding internal control. Likewise, it supervises the independence and objectivity of the Internal Auditor. |
| **NO. Explain:** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date:** | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. |
| **Modification Date:** |  |  |  |  |

---

**29.2.** The corporation's monitoring activities, aimed at confirming the effectiveness of the Control Architecture, involve, in a special way, the cooperation of the internal audit functions and of the Statutory Auditor in matters within their competence, and particularly those regarding the company's financial information.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **29.2. Measure Implementation:** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** The corporation has an Internal Audit Management Office in charge of monitoring with the purpose of providing assurances about the effectiveness of the Control Architecture of the Corporation, at levels of processing, reports (including financial reports) and compliance. This is the area in charge of providing support to the Audit Committee on internal control assessment of the Corporation and verifying compliance of the policies and procedures established. It performs the follow-up of action plans implementation originating in the findings of the audit, of the statutory auditor or entities of control and supervision. It reports periodically to the Audit Committee about the status of internal control. In addition, it has the Statutory Auditor in charge of determining the soundness of financial information of Grupo Aval and the relevant internal control assessment for generating such financial information. | **YES. Briefly Indicate:** The corporation has an Internal Audit Management Office in charge of monitoring with the purpose of providing assurances about the effectiveness of the Control Architecture of the Corporation, at levels of processing, reports (including financial reports) and compliance. This is the area in charge of providing support to the Audit Committee on internal control assessment of the Corporation and verifying compliance of the policies and procedures established. It performs the follow-up of action plans implementation originating in the findings of the audit, of the statutory auditor or entities of control and supervision. It reports periodically to the Audit Committee about the status of internal control. In addition, it has the Statutory Auditor in charge of determining the soundness of financial information of Grupo Aval and the relevant internal control assessment for generating such financial information. | **YES. Briefly Indicate:** The corporation has an Internal Audit Management Office in charge of monitoring with the purpose of providing assurances about the effectiveness of the Control Architecture of the Corporation, at levels of processing, reports (including financial reports) and compliance. This is the area in charge of providing support to the Audit Committee on internal control assessment of the Corporation and verifying compliance of the policies and procedures established. It performs the follow-up of action plans implementation originating in the findings of the audit, of the statutory auditor or entities of control and supervision. It reports periodically to the Audit Committee about the status of internal control. In addition, it has the Statutory Auditor in charge of determining the soundness of financial information of Grupo Aval and the relevant internal control assessment for generating such financial information. | **YES. Briefly Indicate:** The corporation has an Internal Audit Management Office in charge of monitoring with the purpose of providing assurances about the effectiveness of the Control Architecture of the Corporation, at levels of processing, reports (including financial reports) and compliance. This is the area in charge of providing support to the Audit Committee on internal control assessment of the Corporation and verifying compliance of the policies and procedures established. It performs the follow-up of action plans implementation originating in the findings of the audit, of the statutory auditor or entities of control and supervision. It reports periodically to the Audit Committee about the status of internal control. In addition, it has the Statutory Auditor in charge of determining the soundness of financial information of Grupo Aval and the relevant internal control assessment for generating such financial information. | **YES. Briefly Indicate:** The corporation has an Internal Audit Management Office in charge of monitoring with the purpose of providing assurances about the effectiveness of the Control Architecture of the Corporation, at levels of processing, reports (including financial reports) and compliance. This is the area in charge of providing support to the Audit Committee on internal control assessment of the Corporation and verifying compliance of the policies and procedures established. It performs the follow-up of action plans implementation originating in the findings of the audit, of the statutory auditor or entities of control and supervision. It reports periodically to the Audit Committee about the status of internal control. In addition, it has the Statutory Auditor in charge of determining the soundness of financial information of Grupo Aval and the relevant internal control assessment for generating such financial information. |
| **NO. Explain:** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. |
| **Modification Date** |  |  |  |  |

---

**FINANCIAL SUPERINTENDENCE OF COLOMBIA**

***This translation from the original Spanish version is provided for convenience purposes only. No representation is made as to the accuracy of this document and the company does not assume any liability based upon it. Should any doubt or contradiction arise between the Spanish and English versions, the Spanish version shall prevail.***

**29.3.** The corporation's internal audit function has bylaws approved by the Audit Committee. They describe explicitly the scope of its duties, and should comprise the issues included in Recommendation 29.3.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **29.3. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** The Internal Audit Management has an Internal Audit Regulation submitted to the Audit Committee contemplating among other aspects, the following: i. The autonomy and independence necessary for exercising its functions. ii. The assessment and assistance work of risk management processes. iii. The assessment and assurance that the risks are being correctly assessed. iv. The assessment of reporting mechanisms of hey risks of the business and v. The review of key risks management by those who are responsible. | **YES. Briefly Indicate:** The Internal Audit Management has an Internal Audit Regulation submitted to the Audit Committee contemplating among other aspects, the following: i. The autonomy and independence necessary for exercising its functions. ii. The assessment and assistance work of risk management processes. iii. The assessment and assurance that the risks are being correctly assessed. iv. The assessment of reporting mechanisms of hey risks of the business and v. The review of key risks management by those who are responsible. | **YES. Briefly Indicate:** The Internal Audit Management has an Internal Audit Regulation submitted to the Audit Committee contemplating among other aspects, the following: i. The autonomy and independence necessary for exercising its functions. ii. The assessment and assistance work of risk management processes. iii. The assessment and assurance that the risks are being correctly assessed. iv. The assessment of reporting mechanisms of hey risks of the business and v. The review of key risks management by those who are responsible. | **YES. Briefly Indicate:** The Internal Audit Management has an Internal Audit Regulation submitted to the Audit Committee contemplating among other aspects, the following: i. The autonomy and independence necessary for exercising its functions. ii. The assessment and assistance work of risk management processes. iii. The assessment and assurance that the risks are being correctly assessed. iv. The assessment of reporting mechanisms of hey risks of the business and v. The review of key risks management by those who are responsible. | **YES. Briefly Indicate:** The Internal Audit Management has an Internal Audit Regulation submitted to the Audit Committee contemplating among other aspects, the following: i. The autonomy and independence necessary for exercising its functions. ii. The assessment and assistance work of risk management processes. iii. The assessment and assurance that the risks are being correctly assessed. iv. The assessment of reporting mechanisms of hey risks of the business and v. The review of key risks management by those who are responsible. |
| **NO. Explain:** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. |
| **Modification Date** |  |  |  |  |

---

**29.4.** The head director of the internal audit remains professionally independent of the senior management of the corporation or conglomerate that has hired him, by being functionally dependent from the Audit Committee exclusively.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **29.4. Measure Implementation** | **YES** | **NO** | **X** | **NA** |
| **YES. Briefly Explain:** |  |  |  |  |
| **NO. Explain**: The Internal Audit Management functionally depends on the Presidency of the Corporation and not of the Audit Committee. Without prejudice of the foregoing, it maintains a relationship of professional independence with respect to the Senior Management of the Corporation. The analysis and approval of the work plan submitted by the Internal Audit Management of the Corporation includes the follow-up on the independence of its duty. Likewise, the independence and objectivity of the Internal Audit relating to the activities developed, is assessed by the Committee with the aim of verifying the inexistence of limitations impairing its adequate performance and verifying whether the scope of the work satisfies the control needs of the Company. | **NO. Explain**: The Internal Audit Management functionally depends on the Presidency of the Corporation and not of the Audit Committee. Without prejudice of the foregoing, it maintains a relationship of professional independence with respect to the Senior Management of the Corporation. The analysis and approval of the work plan submitted by the Internal Audit Management of the Corporation includes the follow-up on the independence of its duty. Likewise, the independence and objectivity of the Internal Audit relating to the activities developed, is assessed by the Committee with the aim of verifying the inexistence of limitations impairing its adequate performance and verifying whether the scope of the work satisfies the control needs of the Company. | **NO. Explain**: The Internal Audit Management functionally depends on the Presidency of the Corporation and not of the Audit Committee. Without prejudice of the foregoing, it maintains a relationship of professional independence with respect to the Senior Management of the Corporation. The analysis and approval of the work plan submitted by the Internal Audit Management of the Corporation includes the follow-up on the independence of its duty. Likewise, the independence and objectivity of the Internal Audit relating to the activities developed, is assessed by the Committee with the aim of verifying the inexistence of limitations impairing its adequate performance and verifying whether the scope of the work satisfies the control needs of the Company. | **NO. Explain**: The Internal Audit Management functionally depends on the Presidency of the Corporation and not of the Audit Committee. Without prejudice of the foregoing, it maintains a relationship of professional independence with respect to the Senior Management of the Corporation. The analysis and approval of the work plan submitted by the Internal Audit Management of the Corporation includes the follow-up on the independence of its duty. Likewise, the independence and objectivity of the Internal Audit relating to the activities developed, is assessed by the Committee with the aim of verifying the inexistence of limitations impairing its adequate performance and verifying whether the scope of the work satisfies the control needs of the Company. | **NO. Explain**: The Internal Audit Management functionally depends on the Presidency of the Corporation and not of the Audit Committee. Without prejudice of the foregoing, it maintains a relationship of professional independence with respect to the Senior Management of the Corporation. The analysis and approval of the work plan submitted by the Internal Audit Management of the Corporation includes the follow-up on the independence of its duty. Likewise, the independence and objectivity of the Internal Audit relating to the activities developed, is assessed by the Committee with the aim of verifying the inexistence of limitations impairing its adequate performance and verifying whether the scope of the work satisfies the control needs of the Company. |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |  |
| **Implementation Date** | Does Not Apply | Does Not Apply | Does Not Apply | Does Not Apply |
| **Modification Date** |  |  |  |  |

---

**FINANCIAL SUPERINTENDENCE OF COLOMBIA**

***This translation from the original Spanish version is provided for convenience purposes only. No representation is made as to the accuracy of this document and the company does not assume any liability based upon it. Should any doubt or contradiction arise between the Spanish and English versions, the Spanish version shall prevail.***

**29.5.** The corporation's Board of Directors is responsible for appointing and dismissing the head of the internal audit upon the proposal of the Audit Committee. The market is informed of his dismissal or resignation.

---

| | | | | |
|:---|:---|:---|:---|:---|
| | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** The Corporate Governance Code of the Company states that the appointment, as well as the removal of the Internal Auditor shall be the responsibility of the Board of Directors upon proposal of the Audit Committee, in agreement with the criteria of personnel selection of the Corporation. The Corporation shall report the appointment of the Internal Auditor of the Corporation together with the news arising from such position through its web page. | **YES. Briefly Indicate:** The Corporate Governance Code of the Company states that the appointment, as well as the removal of the Internal Auditor shall be the responsibility of the Board of Directors upon proposal of the Audit Committee, in agreement with the criteria of personnel selection of the Corporation. The Corporation shall report the appointment of the Internal Auditor of the Corporation together with the news arising from such position through its web page. | **YES. Briefly Indicate:** The Corporate Governance Code of the Company states that the appointment, as well as the removal of the Internal Auditor shall be the responsibility of the Board of Directors upon proposal of the Audit Committee, in agreement with the criteria of personnel selection of the Corporation. The Corporation shall report the appointment of the Internal Auditor of the Corporation together with the news arising from such position through its web page. | **YES. Briefly Indicate:** The Corporate Governance Code of the Company states that the appointment, as well as the removal of the Internal Auditor shall be the responsibility of the Board of Directors upon proposal of the Audit Committee, in agreement with the criteria of personnel selection of the Corporation. The Corporation shall report the appointment of the Internal Auditor of the Corporation together with the news arising from such position through its web page. | **YES. Briefly Indicate:** The Corporate Governance Code of the Company states that the appointment, as well as the removal of the Internal Auditor shall be the responsibility of the Board of Directors upon proposal of the Audit Committee, in agreement with the criteria of personnel selection of the Corporation. The Corporation shall report the appointment of the Internal Auditor of the Corporation together with the news arising from such position through its web page. |
| **NO. Explain:** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | Implemented in year 2015 to accept this recommendation of the Code of Best Practices. | Implemented in year 2015 to accept this recommendation of the Code of Best Practices. | Implemented in year 2015 to accept this recommendation of the Code of Best Practices. | Implemented in year 2015 to accept this recommendation of the Code of Best Practices. |
| **Modification Date** |  |  |  |  |

---

**29.6.** The Statutory Auditor of the corporation or conglomerate is clearly independent of them. The respective audit report makes a statement about this capacity

---

| | | | | |
|:---|:---|:---|:---|:---|
| **29.6. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** The responsibilities of the Audit Committee include overseeing the independence of the Statutory Auditor/External Auditor. Statements of independence of the Auditor are received periodically from the Statutory Auditor and there are procedures in place both in the firm of the Statutory Auditors and the in Corporation for verifying that the professional services that such firm renders do not affect its independence as Statutory Auditor/External Auditor of the Corporation. Likewise, in the audit opinions about financial statements, the statutory auditor confirms that its examination performed pursuant to Generally Accepted Auditing Regulations in Colombia, which include the independence that should characterize the exercise of its duty. | **YES. Briefly Indicate:** The responsibilities of the Audit Committee include overseeing the independence of the Statutory Auditor/External Auditor. Statements of independence of the Auditor are received periodically from the Statutory Auditor and there are procedures in place both in the firm of the Statutory Auditors and the in Corporation for verifying that the professional services that such firm renders do not affect its independence as Statutory Auditor/External Auditor of the Corporation. Likewise, in the audit opinions about financial statements, the statutory auditor confirms that its examination performed pursuant to Generally Accepted Auditing Regulations in Colombia, which include the independence that should characterize the exercise of its duty. | **YES. Briefly Indicate:** The responsibilities of the Audit Committee include overseeing the independence of the Statutory Auditor/External Auditor. Statements of independence of the Auditor are received periodically from the Statutory Auditor and there are procedures in place both in the firm of the Statutory Auditors and the in Corporation for verifying that the professional services that such firm renders do not affect its independence as Statutory Auditor/External Auditor of the Corporation. Likewise, in the audit opinions about financial statements, the statutory auditor confirms that its examination performed pursuant to Generally Accepted Auditing Regulations in Colombia, which include the independence that should characterize the exercise of its duty. | **YES. Briefly Indicate:** The responsibilities of the Audit Committee include overseeing the independence of the Statutory Auditor/External Auditor. Statements of independence of the Auditor are received periodically from the Statutory Auditor and there are procedures in place both in the firm of the Statutory Auditors and the in Corporation for verifying that the professional services that such firm renders do not affect its independence as Statutory Auditor/External Auditor of the Corporation. Likewise, in the audit opinions about financial statements, the statutory auditor confirms that its examination performed pursuant to Generally Accepted Auditing Regulations in Colombia, which include the independence that should characterize the exercise of its duty. | **YES. Briefly Indicate:** The responsibilities of the Audit Committee include overseeing the independence of the Statutory Auditor/External Auditor. Statements of independence of the Auditor are received periodically from the Statutory Auditor and there are procedures in place both in the firm of the Statutory Auditors and the in Corporation for verifying that the professional services that such firm renders do not affect its independence as Statutory Auditor/External Auditor of the Corporation. Likewise, in the audit opinions about financial statements, the statutory auditor confirms that its examination performed pursuant to Generally Accepted Auditing Regulations in Colombia, which include the independence that should characterize the exercise of its duty. |
| **NO. Explain:** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. |
| **Modification Date** |  |  |  |  |

---

**FINANCIAL SUPERINTENDENCE OF COLOMBIA**

***This translation from the original Spanish version is provided for convenience purposes only. No representation is made as to the accuracy of this document and the company does not assume any liability based upon it. Should any doubt or contradiction arise between the Spanish and English versions, the Spanish version shall prevail.***

**29.7.** If the corporation is the holding company of a conglomerate, the Statutory Auditor is the same for all the companies, including those that are offshore.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **29.7. Measure Implementation:** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** All subordinate entities consolidating the Financial Statements of Grupo Aval, are audited by the same Statutory Auditor. | **YES. Briefly Indicate:** All subordinate entities consolidating the Financial Statements of Grupo Aval, are audited by the same Statutory Auditor. | **YES. Briefly Indicate:** All subordinate entities consolidating the Financial Statements of Grupo Aval, are audited by the same Statutory Auditor. | **YES. Briefly Indicate:** All subordinate entities consolidating the Financial Statements of Grupo Aval, are audited by the same Statutory Auditor. | **YES. Briefly Indicate:** All subordinate entities consolidating the Financial Statements of Grupo Aval, are audited by the same Statutory Auditor. |
| **NO. Explain:** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. |
| **Modification Date** |  |  |  |  |

---

**29.8.** The corporation has a policy to appoint the Statutory Auditor approved by the Board of Directors and communicated to the shareholders. It contains the matters established on Recommendation 29.8.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **29.8. Measure Implementation:** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** The Corporate Governance Code approved by the Board of Directors of the Company and published in its web page, establishes the criteria for the appointment of the statutory auditor, which include the provisions established under recommendation 29.8. Specifically in numeral 2.3.1.1, the duration of the Statutory Auditor's Contract is established for the same term as the period of the Board of Directors, (1 year). The election of the Statutory Auditor can be extended indefinitely or freely removed before the expiration of his term. Likewise, the aforementioned section establishes that the election of the Statutory Auditor takes into consideration his professionalism, experience and honor, as well as that of his work teams and, when applicable, the firm to which they belong. | **YES. Briefly Indicate:** The Corporate Governance Code approved by the Board of Directors of the Company and published in its web page, establishes the criteria for the appointment of the statutory auditor, which include the provisions established under recommendation 29.8. Specifically in numeral 2.3.1.1, the duration of the Statutory Auditor's Contract is established for the same term as the period of the Board of Directors, (1 year). The election of the Statutory Auditor can be extended indefinitely or freely removed before the expiration of his term. Likewise, the aforementioned section establishes that the election of the Statutory Auditor takes into consideration his professionalism, experience and honor, as well as that of his work teams and, when applicable, the firm to which they belong. | **YES. Briefly Indicate:** The Corporate Governance Code approved by the Board of Directors of the Company and published in its web page, establishes the criteria for the appointment of the statutory auditor, which include the provisions established under recommendation 29.8. Specifically in numeral 2.3.1.1, the duration of the Statutory Auditor's Contract is established for the same term as the period of the Board of Directors, (1 year). The election of the Statutory Auditor can be extended indefinitely or freely removed before the expiration of his term. Likewise, the aforementioned section establishes that the election of the Statutory Auditor takes into consideration his professionalism, experience and honor, as well as that of his work teams and, when applicable, the firm to which they belong. | **YES. Briefly Indicate:** The Corporate Governance Code approved by the Board of Directors of the Company and published in its web page, establishes the criteria for the appointment of the statutory auditor, which include the provisions established under recommendation 29.8. Specifically in numeral 2.3.1.1, the duration of the Statutory Auditor's Contract is established for the same term as the period of the Board of Directors, (1 year). The election of the Statutory Auditor can be extended indefinitely or freely removed before the expiration of his term. Likewise, the aforementioned section establishes that the election of the Statutory Auditor takes into consideration his professionalism, experience and honor, as well as that of his work teams and, when applicable, the firm to which they belong. | **YES. Briefly Indicate:** The Corporate Governance Code approved by the Board of Directors of the Company and published in its web page, establishes the criteria for the appointment of the statutory auditor, which include the provisions established under recommendation 29.8. Specifically in numeral 2.3.1.1, the duration of the Statutory Auditor's Contract is established for the same term as the period of the Board of Directors, (1 year). The election of the Statutory Auditor can be extended indefinitely or freely removed before the expiration of his term. Likewise, the aforementioned section establishes that the election of the Statutory Auditor takes into consideration his professionalism, experience and honor, as well as that of his work teams and, when applicable, the firm to which they belong. |
| **NO. Explain:** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the Code of Best Practices. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the Code of Best Practices. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the Code of Best Practices. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the Code of Best Practices. |
| **Modification Date** |  |  |  |  |

---

**FINANCIAL SUPERINTENDENCE OF COLOMBIA**

***This translation from the original Spanish version is provided for convenience purposes only. No representation is made as to the accuracy of this document and the company does not assume any liability based upon it. Should any doubt or contradiction arise between the Spanish and English versions, the Spanish version shall prevail.***

**29.9.** The corporation sets forth a maximum contract term with the auditing firm that ranges between five (5) and ten (10) years, in order to avoid excessive proximity with such a firm and/or its teams, and to safeguard its independence. Regarding Statutory Auditor-natural person without contract with any auditing firm, the maximum contract term is 5 years.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **29.9. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Explain:** |  |  |  |  |
| The Statutory Auditing Professional Services Agreement, entered into with the audit firm that acts as Statutory Auditor of the Company, includes the alternation of individuals occupying the position of Statutory Auditor every five (5) years.<br>Additionally, the statutory auditor and the Audit Committee of the Company are individually responsible, of verifying the independence of the statutory auditor/external auditor, including the evaluation of the professional services that are requested to the statutory auditor/external auditor. | The Statutory Auditing Professional Services Agreement, entered into with the audit firm that acts as Statutory Auditor of the Company, includes the alternation of individuals occupying the position of Statutory Auditor every five (5) years.<br>Additionally, the statutory auditor and the Audit Committee of the Company are individually responsible, of verifying the independence of the statutory auditor/external auditor, including the evaluation of the professional services that are requested to the statutory auditor/external auditor. | The Statutory Auditing Professional Services Agreement, entered into with the audit firm that acts as Statutory Auditor of the Company, includes the alternation of individuals occupying the position of Statutory Auditor every five (5) years.<br>Additionally, the statutory auditor and the Audit Committee of the Company are individually responsible, of verifying the independence of the statutory auditor/external auditor, including the evaluation of the professional services that are requested to the statutory auditor/external auditor. | The Statutory Auditing Professional Services Agreement, entered into with the audit firm that acts as Statutory Auditor of the Company, includes the alternation of individuals occupying the position of Statutory Auditor every five (5) years.<br>Additionally, the statutory auditor and the Audit Committee of the Company are individually responsible, of verifying the independence of the statutory auditor/external auditor, including the evaluation of the professional services that are requested to the statutory auditor/external auditor. | The Statutory Auditing Professional Services Agreement, entered into with the audit firm that acts as Statutory Auditor of the Company, includes the alternation of individuals occupying the position of Statutory Auditor every five (5) years.<br>Additionally, the statutory auditor and the Audit Committee of the Company are individually responsible, of verifying the independence of the statutory auditor/external auditor, including the evaluation of the professional services that are requested to the statutory auditor/external auditor. |
| **NO. Explain:** | **NO. Explain:** | **NO. Explain:** | **NO. Explain:** | **NO. Explain:** |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 |
| **Modification Date** |  |  |  |  |

---

**29.10.** Within the maximum contract term, halfway through it, the corporation promotes the turnover of the auditing-firm associates assigned to it, and that of their work teams. At the end of such term, the turnover of the firm itself must obligatorily take place.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **29.10. Measure Implementation** | **YES** | **NO** | **X** | **NA** |
| **YES. Briefly Indicate:** |  |  |  |  |
| **NO. Explain:** No, considering that a rotation term has not been foreseen under the terms of section 29.9. | **NO. Explain:** No, considering that a rotation term has not been foreseen under the terms of section 29.9. | **NO. Explain:** No, considering that a rotation term has not been foreseen under the terms of section 29.9. | **NO. Explain:** No, considering that a rotation term has not been foreseen under the terms of section 29.9. | **NO. Explain:** No, considering that a rotation term has not been foreseen under the terms of section 29.9. |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |  |
| **Implementation Date** | Does Not Apply | Does Not Apply | Does Not Apply | Does Not Apply |
| **Modification Date** |  |  |  |  |

---

**FINANCIAL SUPERINTENDENCE OF COLOMBIA**

***This translation from the original Spanish version is provided for convenience purposes only. No representation is made as to the accuracy of this document and the company does not assume any liability based upon it. Should any doubt or contradiction arise between the Spanish and English versions, the Spanish version shall prevail.***

**29.11**. The corporation extends the existing prohibition to avoid contracting with the Statutory Auditor any professional services other than the financial auditing and related functions sanctioned by the current regulations, to individuals or entities related to the auditing firm. This includes companies within the group of the auditing firm, and companies of which a large number of shareholders and/or administrators coincide with those of the auditing firm.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **29.11. Measure Implementation:** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** With the purpose of verifying that the independence of the Statutory Auditor/External Auditor is not affected, the Corporation has a procedure approved by the Audit Committee for purposes of analyzing any proposal of professional services requested by the Corporation or by its subordinate institutions to the Statutory Auditor or its affiliate entities horizontally and vertically. The Statutory Auditor issues a certification regarding this recommendation. | **YES. Briefly Indicate:** With the purpose of verifying that the independence of the Statutory Auditor/External Auditor is not affected, the Corporation has a procedure approved by the Audit Committee for purposes of analyzing any proposal of professional services requested by the Corporation or by its subordinate institutions to the Statutory Auditor or its affiliate entities horizontally and vertically. The Statutory Auditor issues a certification regarding this recommendation. | **YES. Briefly Indicate:** With the purpose of verifying that the independence of the Statutory Auditor/External Auditor is not affected, the Corporation has a procedure approved by the Audit Committee for purposes of analyzing any proposal of professional services requested by the Corporation or by its subordinate institutions to the Statutory Auditor or its affiliate entities horizontally and vertically. The Statutory Auditor issues a certification regarding this recommendation. | **YES. Briefly Indicate:** With the purpose of verifying that the independence of the Statutory Auditor/External Auditor is not affected, the Corporation has a procedure approved by the Audit Committee for purposes of analyzing any proposal of professional services requested by the Corporation or by its subordinate institutions to the Statutory Auditor or its affiliate entities horizontally and vertically. The Statutory Auditor issues a certification regarding this recommendation. | **YES. Briefly Indicate:** With the purpose of verifying that the independence of the Statutory Auditor/External Auditor is not affected, the Corporation has a procedure approved by the Audit Committee for purposes of analyzing any proposal of professional services requested by the Corporation or by its subordinate institutions to the Statutory Auditor or its affiliate entities horizontally and vertically. The Statutory Auditor issues a certification regarding this recommendation. |
| **NO. Explain:** | | | | |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. |
| **Modification Date** |  |  |  |  |

---

**29.12.** In its public information, the corporation discloses the total amount of the contract with the Statutory Auditor, as well as the proportion that these honoraria have for the auditing firm in relation to the total income associated to the firm's financial auditing activity.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **29.12. Measure Implementation:** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** After the approval of the Statutory Auditor´s fees by the General Shareholders Assembly, the Company annually publishes a certification issued by the mentioned Auditor in its web page. Such certificate discloses the total amount of the Statutory Auditing Agreement as well as the proportion represented by the fees paid by the Corporation compared to the firm's income from statutory auditing activities. | **YES. Briefly Indicate:** After the approval of the Statutory Auditor´s fees by the General Shareholders Assembly, the Company annually publishes a certification issued by the mentioned Auditor in its web page. Such certificate discloses the total amount of the Statutory Auditing Agreement as well as the proportion represented by the fees paid by the Corporation compared to the firm's income from statutory auditing activities. | **YES. Briefly Indicate:** After the approval of the Statutory Auditor´s fees by the General Shareholders Assembly, the Company annually publishes a certification issued by the mentioned Auditor in its web page. Such certificate discloses the total amount of the Statutory Auditing Agreement as well as the proportion represented by the fees paid by the Corporation compared to the firm's income from statutory auditing activities. | **YES. Briefly Indicate:** After the approval of the Statutory Auditor´s fees by the General Shareholders Assembly, the Company annually publishes a certification issued by the mentioned Auditor in its web page. Such certificate discloses the total amount of the Statutory Auditing Agreement as well as the proportion represented by the fees paid by the Corporation compared to the firm's income from statutory auditing activities. | **YES. Briefly Indicate:** After the approval of the Statutory Auditor´s fees by the General Shareholders Assembly, the Company annually publishes a certification issued by the mentioned Auditor in its web page. Such certificate discloses the total amount of the Statutory Auditing Agreement as well as the proportion represented by the fees paid by the Corporation compared to the firm's income from statutory auditing activities. |
| **NO. Explain:** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | Implemented in year 2015 to adopt this recommendation of the New Country Code. | Implemented in year 2015 to adopt this recommendation of the New Country Code. | Implemented in year 2015 to adopt this recommendation of the New Country Code. | Implemented in year 2015 to adopt this recommendation of the New Country Code. |
| **Modification Date** |  |  |  |  |

---

**FINANCIAL SUPERINTENDENCE OF COLOMBIA**

***This translation from the original Spanish version is provided for convenience purposes only. No representation is made as to the accuracy of this document and the company does not assume any liability based upon it. Should any doubt or contradiction arise between the Spanish and English versions, the Spanish version shall prevail.***

&nbsp;&nbsp;&nbsp;&nbsp;**V.** **TRANSPARENCY AND FINANCIAL AND NON-FINANCIAL INFORMATION** 

**Measure No. 30. Information Disclosure Policy**

**30.1.** The Board of Directors has approved an information disclosure policy that features, at least, the information included in the recommendation.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **30.1. Measure Implementation** | **YES** | X | **NO** | **NA** |
| **YES. Briefly Indicate:** The company has implemented in its Reference Framework for Institutional Operations an information disclosure policy that incorporates the aspects established by recommendation 30.1 | **YES. Briefly Indicate:** The company has implemented in its Reference Framework for Institutional Operations an information disclosure policy that incorporates the aspects established by recommendation 30.1 | **YES. Briefly Indicate:** The company has implemented in its Reference Framework for Institutional Operations an information disclosure policy that incorporates the aspects established by recommendation 30.1 | **YES. Briefly Indicate:** The company has implemented in its Reference Framework for Institutional Operations an information disclosure policy that incorporates the aspects established by recommendation 30.1 | **YES. Briefly Indicate:** The company has implemented in its Reference Framework for Institutional Operations an information disclosure policy that incorporates the aspects established by recommendation 30.1 |
| **NO. Explain:** | **NO. Explain:** | **NO. Explain:** | **NO. Explain:** | **NO. Explain:** |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | December 9<sup>th</sup> 2020 | December 9<sup>th</sup> 2020 | December 9<sup>th</sup> 2020 | December 9<sup>th</sup> 2020 |
| **Modification Date** |  |  |  |  |

---

**30.2.** In the case of conglomerates, the disclosure of information to third parties is comprehensive and transversal in regard to the group of companies, so that those external parties may have a well-grounded idea of the conglomerate's facts, organization, complexity, activity, size, and governance model.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **30.2. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** The Corporation periodically discloses the consolidated financial situation of Grupo Aval and its subordinate entities. Likewise, the disclosure of nonfinancial information is performed in an integral and transversal manner pursuant to the criteria set forth under local and international regulations applicable to Grupo Aval in its capacity as issuer of securities in Colombia and abroad. Through its web page, the Corporation offers general access to financial and nonfinancial information of the Corporation, presentations carried out in events and links to Relevant Information. | **YES. Briefly Indicate:** The Corporation periodically discloses the consolidated financial situation of Grupo Aval and its subordinate entities. Likewise, the disclosure of nonfinancial information is performed in an integral and transversal manner pursuant to the criteria set forth under local and international regulations applicable to Grupo Aval in its capacity as issuer of securities in Colombia and abroad. Through its web page, the Corporation offers general access to financial and nonfinancial information of the Corporation, presentations carried out in events and links to Relevant Information. | **YES. Briefly Indicate:** The Corporation periodically discloses the consolidated financial situation of Grupo Aval and its subordinate entities. Likewise, the disclosure of nonfinancial information is performed in an integral and transversal manner pursuant to the criteria set forth under local and international regulations applicable to Grupo Aval in its capacity as issuer of securities in Colombia and abroad. Through its web page, the Corporation offers general access to financial and nonfinancial information of the Corporation, presentations carried out in events and links to Relevant Information. | **YES. Briefly Indicate:** The Corporation periodically discloses the consolidated financial situation of Grupo Aval and its subordinate entities. Likewise, the disclosure of nonfinancial information is performed in an integral and transversal manner pursuant to the criteria set forth under local and international regulations applicable to Grupo Aval in its capacity as issuer of securities in Colombia and abroad. Through its web page, the Corporation offers general access to financial and nonfinancial information of the Corporation, presentations carried out in events and links to Relevant Information. | **YES. Briefly Indicate:** The Corporation periodically discloses the consolidated financial situation of Grupo Aval and its subordinate entities. Likewise, the disclosure of nonfinancial information is performed in an integral and transversal manner pursuant to the criteria set forth under local and international regulations applicable to Grupo Aval in its capacity as issuer of securities in Colombia and abroad. Through its web page, the Corporation offers general access to financial and nonfinancial information of the Corporation, presentations carried out in events and links to Relevant Information. |
| **NO. Explain:** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. |
| **Modification Date** |  |  |  |  |

---

**FINANCIAL SUPERINTENDENCE OF COLOMBIA**

***This translation from the original Spanish version is provided for convenience purposes only. No representation is made as to the accuracy of this document and the company does not assume any liability based upon it. Should any doubt or contradiction arise between the Spanish and English versions, the Spanish version shall prevail.***

**Measure 31. Financial Statements.**

**31.1.** If there are qualifications [salvedades] in the Statutory Auditor's report, these, and any possible corporate actions to solve the situation, will be explained to the shareholders gathered at the General Assembly, by the president of the Audit Committee.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **31.1. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** The Corporate Governance Code of the Company states that in the event of existing exemptions, paragraphs of emphasis and/or of any other type of significant observation or comment of the Statutory Auditor in its opinion regarding the financial statements of the Corporation, such observations and actions proposed by the Corporation for solving the situation, shall be subject to pronouncement of the President of the Corporation or whom is designated before shareholders during a General Meeting. Such pronouncement shall be submitted for prior consideration and approval by the Audit Committee. | **YES. Briefly Indicate:** The Corporate Governance Code of the Company states that in the event of existing exemptions, paragraphs of emphasis and/or of any other type of significant observation or comment of the Statutory Auditor in its opinion regarding the financial statements of the Corporation, such observations and actions proposed by the Corporation for solving the situation, shall be subject to pronouncement of the President of the Corporation or whom is designated before shareholders during a General Meeting. Such pronouncement shall be submitted for prior consideration and approval by the Audit Committee. | **YES. Briefly Indicate:** The Corporate Governance Code of the Company states that in the event of existing exemptions, paragraphs of emphasis and/or of any other type of significant observation or comment of the Statutory Auditor in its opinion regarding the financial statements of the Corporation, such observations and actions proposed by the Corporation for solving the situation, shall be subject to pronouncement of the President of the Corporation or whom is designated before shareholders during a General Meeting. Such pronouncement shall be submitted for prior consideration and approval by the Audit Committee. | **YES. Briefly Indicate:** The Corporate Governance Code of the Company states that in the event of existing exemptions, paragraphs of emphasis and/or of any other type of significant observation or comment of the Statutory Auditor in its opinion regarding the financial statements of the Corporation, such observations and actions proposed by the Corporation for solving the situation, shall be subject to pronouncement of the President of the Corporation or whom is designated before shareholders during a General Meeting. Such pronouncement shall be submitted for prior consideration and approval by the Audit Committee. | **YES. Briefly Indicate:** The Corporate Governance Code of the Company states that in the event of existing exemptions, paragraphs of emphasis and/or of any other type of significant observation or comment of the Statutory Auditor in its opinion regarding the financial statements of the Corporation, such observations and actions proposed by the Corporation for solving the situation, shall be subject to pronouncement of the President of the Corporation or whom is designated before shareholders during a General Meeting. Such pronouncement shall be submitted for prior consideration and approval by the Audit Committee. |
| **NO. Explain:** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | Implemented in year 2015 to accept this recommendation of the New Country Code. | Implemented in year 2015 to accept this recommendation of the New Country Code. | Implemented in year 2015 to accept this recommendation of the New Country Code. | Implemented in year 2015 to accept this recommendation of the New Country Code. |
| **Modification Date** |  |  |  |  |

---

**31.2.** If the Board of Directors considers that it must keep its own opinion vis-à-vis the Statutory Auditor's qualifications [salvedades] or "emphasis paragraphs", these are explained and justified appropriately to the General Assembly through a written report that specifies the contents and scope of the discrepancy.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **31.2. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** The Corporate Governance Code of the Company states that upon any exemptions, paragraphs of emphasis and any other types of observations or significant comment by the Statutory Auditor in its opinion about the financial statements of the Corporation, the Board of Directors deems it shall maintain its criteria, its position shall be adequately explained and justified through a written report submitted to the General Shareholders Meeting, specifying the content and scope of the discrepancy. | **YES. Briefly Indicate:** The Corporate Governance Code of the Company states that upon any exemptions, paragraphs of emphasis and any other types of observations or significant comment by the Statutory Auditor in its opinion about the financial statements of the Corporation, the Board of Directors deems it shall maintain its criteria, its position shall be adequately explained and justified through a written report submitted to the General Shareholders Meeting, specifying the content and scope of the discrepancy. | **YES. Briefly Indicate:** The Corporate Governance Code of the Company states that upon any exemptions, paragraphs of emphasis and any other types of observations or significant comment by the Statutory Auditor in its opinion about the financial statements of the Corporation, the Board of Directors deems it shall maintain its criteria, its position shall be adequately explained and justified through a written report submitted to the General Shareholders Meeting, specifying the content and scope of the discrepancy. | **YES. Briefly Indicate:** The Corporate Governance Code of the Company states that upon any exemptions, paragraphs of emphasis and any other types of observations or significant comment by the Statutory Auditor in its opinion about the financial statements of the Corporation, the Board of Directors deems it shall maintain its criteria, its position shall be adequately explained and justified through a written report submitted to the General Shareholders Meeting, specifying the content and scope of the discrepancy. | **YES. Briefly Indicate:** The Corporate Governance Code of the Company states that upon any exemptions, paragraphs of emphasis and any other types of observations or significant comment by the Statutory Auditor in its opinion about the financial statements of the Corporation, the Board of Directors deems it shall maintain its criteria, its position shall be adequately explained and justified through a written report submitted to the General Shareholders Meeting, specifying the content and scope of the discrepancy. |
| **NO. Explain:** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Date of Implementation** | Implemented in year 2015 to adopt this recommendation of the New Country Code. | Implemented in year 2015 to adopt this recommendation of the New Country Code. | Implemented in year 2015 to adopt this recommendation of the New Country Code. | Implemented in year 2015 to adopt this recommendation of the New Country Code. |
| **Dates of Modification** |  |  |  |  |

---

**FINANCIAL SUPERINTENDENCE OF COLOMBIA**

***This translation from the original Spanish version is provided for convenience purposes only. No representation is made as to the accuracy of this document and the company does not assume any liability based upon it. Should any doubt or contradiction arise between the Spanish and English versions, the Spanish version shall prevail.***

**31.3** The public financial information contains a detailed description of transactions with or between related parties. These include transactions between conglomerate companies that the corporation deems material through objective parameters such as their volume, percentage on assets, sales or other indicators. There is also a reference to any offshore transactions.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **31.3. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** For preparing the financial statements and their disclosure notes regarding operations with associated parties, IFRS 24 becomes applicable, pursuant to which the following should be disclosed: (a) the amount of the transactions; (b) the amount of pending balances, including commitments, their terms and conditions, guarantees, as well as the nature of the considerations fixed for its liquidation; (c) estimates of debts of doubtful collection relating to amounts included in pending balances and (d) expenses acknowledged during the period corresponding to uncollectable debts or of doubtful collection arising from related parties. | **YES. Briefly Indicate:** For preparing the financial statements and their disclosure notes regarding operations with associated parties, IFRS 24 becomes applicable, pursuant to which the following should be disclosed: (a) the amount of the transactions; (b) the amount of pending balances, including commitments, their terms and conditions, guarantees, as well as the nature of the considerations fixed for its liquidation; (c) estimates of debts of doubtful collection relating to amounts included in pending balances and (d) expenses acknowledged during the period corresponding to uncollectable debts or of doubtful collection arising from related parties. | **YES. Briefly Indicate:** For preparing the financial statements and their disclosure notes regarding operations with associated parties, IFRS 24 becomes applicable, pursuant to which the following should be disclosed: (a) the amount of the transactions; (b) the amount of pending balances, including commitments, their terms and conditions, guarantees, as well as the nature of the considerations fixed for its liquidation; (c) estimates of debts of doubtful collection relating to amounts included in pending balances and (d) expenses acknowledged during the period corresponding to uncollectable debts or of doubtful collection arising from related parties. | **YES. Briefly Indicate:** For preparing the financial statements and their disclosure notes regarding operations with associated parties, IFRS 24 becomes applicable, pursuant to which the following should be disclosed: (a) the amount of the transactions; (b) the amount of pending balances, including commitments, their terms and conditions, guarantees, as well as the nature of the considerations fixed for its liquidation; (c) estimates of debts of doubtful collection relating to amounts included in pending balances and (d) expenses acknowledged during the period corresponding to uncollectable debts or of doubtful collection arising from related parties. | **YES. Briefly Indicate:** For preparing the financial statements and their disclosure notes regarding operations with associated parties, IFRS 24 becomes applicable, pursuant to which the following should be disclosed: (a) the amount of the transactions; (b) the amount of pending balances, including commitments, their terms and conditions, guarantees, as well as the nature of the considerations fixed for its liquidation; (c) estimates of debts of doubtful collection relating to amounts included in pending balances and (d) expenses acknowledged during the period corresponding to uncollectable debts or of doubtful collection arising from related parties. |
| **NO. Explain:** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and adjusted in 2015 as a result of the adoption of the International Regulations on Financial Information. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and adjusted in 2015 as a result of the adoption of the International Regulations on Financial Information. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and adjusted in 2015 as a result of the adoption of the International Regulations on Financial Information. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and adjusted in 2015 as a result of the adoption of the International Regulations on Financial Information. |
| **Modification Date** |  |  |  |  |

---

**Measure No. 32. Market Information** 

**32.1.** In the context of the information disclosure policy, the Board of Directors (or the Audit Committee), adopts the necessary measures to ensure that the financial and capital markets receive all the financial and non-financial information on the corporation required by the regulations in force, plus any other that it considers relevant for investors and clients.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **32.1. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** The corporation has procedures to guarantee that all the financial and nonfinancial information is informed to the financial and stock markets and all information deemed relevant for investors, pursuant to the regulations in force. Likewise it also has risk identification and control matrixes for the process of generating financial and nonfinancial information. These procedures are subject to auditing by the Internal Audit of the Corporation which submits several times a year, the progress status of its audit plan. Any deviation from these procedures is reported to the Audit Committee for purposes that such body establishes the necessary corrective measures. In addition to the foregoing, for purposes of implementing recommendation 30.1, the Corporation shall consider the best way of unifying in the future its different procedures with the aim of generating a policy of information disclosure under the terms referred in the recommendation.<br>In addition, for the purposes of implementing recommendation 30.1, the Company has implemented in its Code of Good Governance in its numeral 7.1 " INFORMATION" the aspects of the recommendation. | **YES. Briefly Indicate:** The corporation has procedures to guarantee that all the financial and nonfinancial information is informed to the financial and stock markets and all information deemed relevant for investors, pursuant to the regulations in force. Likewise it also has risk identification and control matrixes for the process of generating financial and nonfinancial information. These procedures are subject to auditing by the Internal Audit of the Corporation which submits several times a year, the progress status of its audit plan. Any deviation from these procedures is reported to the Audit Committee for purposes that such body establishes the necessary corrective measures. In addition to the foregoing, for purposes of implementing recommendation 30.1, the Corporation shall consider the best way of unifying in the future its different procedures with the aim of generating a policy of information disclosure under the terms referred in the recommendation.<br>In addition, for the purposes of implementing recommendation 30.1, the Company has implemented in its Code of Good Governance in its numeral 7.1 " INFORMATION" the aspects of the recommendation. | **YES. Briefly Indicate:** The corporation has procedures to guarantee that all the financial and nonfinancial information is informed to the financial and stock markets and all information deemed relevant for investors, pursuant to the regulations in force. Likewise it also has risk identification and control matrixes for the process of generating financial and nonfinancial information. These procedures are subject to auditing by the Internal Audit of the Corporation which submits several times a year, the progress status of its audit plan. Any deviation from these procedures is reported to the Audit Committee for purposes that such body establishes the necessary corrective measures. In addition to the foregoing, for purposes of implementing recommendation 30.1, the Corporation shall consider the best way of unifying in the future its different procedures with the aim of generating a policy of information disclosure under the terms referred in the recommendation.<br>In addition, for the purposes of implementing recommendation 30.1, the Company has implemented in its Code of Good Governance in its numeral 7.1 " INFORMATION" the aspects of the recommendation. | **YES. Briefly Indicate:** The corporation has procedures to guarantee that all the financial and nonfinancial information is informed to the financial and stock markets and all information deemed relevant for investors, pursuant to the regulations in force. Likewise it also has risk identification and control matrixes for the process of generating financial and nonfinancial information. These procedures are subject to auditing by the Internal Audit of the Corporation which submits several times a year, the progress status of its audit plan. Any deviation from these procedures is reported to the Audit Committee for purposes that such body establishes the necessary corrective measures. In addition to the foregoing, for purposes of implementing recommendation 30.1, the Corporation shall consider the best way of unifying in the future its different procedures with the aim of generating a policy of information disclosure under the terms referred in the recommendation.<br>In addition, for the purposes of implementing recommendation 30.1, the Company has implemented in its Code of Good Governance in its numeral 7.1 " INFORMATION" the aspects of the recommendation. | **YES. Briefly Indicate:** The corporation has procedures to guarantee that all the financial and nonfinancial information is informed to the financial and stock markets and all information deemed relevant for investors, pursuant to the regulations in force. Likewise it also has risk identification and control matrixes for the process of generating financial and nonfinancial information. These procedures are subject to auditing by the Internal Audit of the Corporation which submits several times a year, the progress status of its audit plan. Any deviation from these procedures is reported to the Audit Committee for purposes that such body establishes the necessary corrective measures. In addition to the foregoing, for purposes of implementing recommendation 30.1, the Corporation shall consider the best way of unifying in the future its different procedures with the aim of generating a policy of information disclosure under the terms referred in the recommendation.<br>In addition, for the purposes of implementing recommendation 30.1, the Company has implemented in its Code of Good Governance in its numeral 7.1 " INFORMATION" the aspects of the recommendation. |
| **No. Explain:** | **No. Explain:** | **No. Explain:** | **No. Explain:** | **No. Explain:** |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. |
| **Modification Date** |  |  |  |  |

---

**FINANCIAL SUPERINTENDENCE OF COLOMBIA**

***This translation from the original Spanish version is provided for convenience purposes only. No representation is made as to the accuracy of this document and the company does not assume any liability based upon it. Should any doubt or contradiction arise between the Spanish and English versions, the Spanish version shall prevail.***

**32.2.** The corporation's web site is user-friendly. The visitor finds any Corporate Governance information easily.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **32.2. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly indicate:** The Corporations has a web page (www.grupoaval.com) organized in such a manner that allows its users to access the information associated with or relating to the Corporate Governance of the Company in a simple manner. | **YES. Briefly indicate:** The Corporations has a web page (www.grupoaval.com) organized in such a manner that allows its users to access the information associated with or relating to the Corporate Governance of the Company in a simple manner. | **YES. Briefly indicate:** The Corporations has a web page (www.grupoaval.com) organized in such a manner that allows its users to access the information associated with or relating to the Corporate Governance of the Company in a simple manner. | **YES. Briefly indicate:** The Corporations has a web page (www.grupoaval.com) organized in such a manner that allows its users to access the information associated with or relating to the Corporate Governance of the Company in a simple manner. | **YES. Briefly indicate:** The Corporations has a web page (www.grupoaval.com) organized in such a manner that allows its users to access the information associated with or relating to the Corporate Governance of the Company in a simple manner. |
| **NO. Explain:** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | Recommendation implemented before September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented before September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented before September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented before September 30, 2014 date of issuance of the E.C. 028 of 2014. |
| **Modification Date** |  |  |  |  |

---

**32.3.** In this vein, the corporation's web site includes, at least, the links mentioned on Recommendation 32.3.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **32.3. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** The web page of the Corporation substantially includes issues proposed by Recommendation 32.3 regarding information of the Corporation, its shareholders, relationships with investors, corporate governance and relevant matters of sustainability. | **YES. Briefly Indicate:** The web page of the Corporation substantially includes issues proposed by Recommendation 32.3 regarding information of the Corporation, its shareholders, relationships with investors, corporate governance and relevant matters of sustainability. | **YES. Briefly Indicate:** The web page of the Corporation substantially includes issues proposed by Recommendation 32.3 regarding information of the Corporation, its shareholders, relationships with investors, corporate governance and relevant matters of sustainability. | **YES. Briefly Indicate:** The web page of the Corporation substantially includes issues proposed by Recommendation 32.3 regarding information of the Corporation, its shareholders, relationships with investors, corporate governance and relevant matters of sustainability. | **YES. Briefly Indicate:** The web page of the Corporation substantially includes issues proposed by Recommendation 32.3 regarding information of the Corporation, its shareholders, relationships with investors, corporate governance and relevant matters of sustainability. |
| **NO. Explain:** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the Code of Best Practices. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the Code of Best Practices. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the Code of Best Practices. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014 and complemented in year 2015 as a result of the implementation of some recommendations of the Code of Best Practices. |
| **Modification Date** |  |  |  |  |

---

**32.4.** In general, the supporting documents through which the corporation conveys information to the markets are files easy to share, download, and print.

**FINANCIAL SUPERINTENDENCE OF COLOMBIA**

***This translation from the original Spanish version is provided for convenience purposes only. No representation is made as to the accuracy of this document and the company does not assume any liability based upon it. Should any doubt or contradiction arise between the Spanish and English versions, the Spanish version shall prevail.***

---

| | | | | |
|:---|:---|:---|:---|:---|
| **32.4. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** The information published through the web page of the Corporation does not have any type of printing or downloading restrictions for being shared and for the cases where it is applicable, the same is accompanied by the necessary supports without any printing or downloading restrictions. | **YES. Briefly Indicate:** The information published through the web page of the Corporation does not have any type of printing or downloading restrictions for being shared and for the cases where it is applicable, the same is accompanied by the necessary supports without any printing or downloading restrictions. | **YES. Briefly Indicate:** The information published through the web page of the Corporation does not have any type of printing or downloading restrictions for being shared and for the cases where it is applicable, the same is accompanied by the necessary supports without any printing or downloading restrictions. | **YES. Briefly Indicate:** The information published through the web page of the Corporation does not have any type of printing or downloading restrictions for being shared and for the cases where it is applicable, the same is accompanied by the necessary supports without any printing or downloading restrictions. | **YES. Briefly Indicate:** The information published through the web page of the Corporation does not have any type of printing or downloading restrictions for being shared and for the cases where it is applicable, the same is accompanied by the necessary supports without any printing or downloading restrictions. |
| **NO. Explain:** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. |
| **Modification Date** |  |  |  |  |

---

**32.5**. If the corporation is sizable and complex, it publishes every year on its web site, an explanatory report on the organization, methods, and procedures of its Control Architecture. It seeks to provide accurate and reliable financial and non-financial information, and to protect the company's assets as well as the safety and effectiveness of its transactions. A risk management report complements the above information.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **32.5. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** In its condition as issuer of securities registered before the Securities Exchange Commission ("SEC") of the United States, the Corporation annually submits before the SEC its annual report under the Form 20-F, which includes information regarding the organization, methods and procedures of the control architecture of Grupo Aval. The Corporation submits quantitative and qualitative information with regards to risks. Likewise, it has an internal control model of financial report (ICOFR) based on internal control guidelines of the *Committee of Sponsoring Organizations of the Treadway Commission of 2013 (COSO).* Under the supervision and with the participation of the directive staff of the Corporation, an annual assessment on the effectiveness of internal control is performed annually, with the participation of an external auditor, who submits an independent pronouncement on the same. | **YES. Briefly Indicate:** In its condition as issuer of securities registered before the Securities Exchange Commission ("SEC") of the United States, the Corporation annually submits before the SEC its annual report under the Form 20-F, which includes information regarding the organization, methods and procedures of the control architecture of Grupo Aval. The Corporation submits quantitative and qualitative information with regards to risks. Likewise, it has an internal control model of financial report (ICOFR) based on internal control guidelines of the *Committee of Sponsoring Organizations of the Treadway Commission of 2013 (COSO).* Under the supervision and with the participation of the directive staff of the Corporation, an annual assessment on the effectiveness of internal control is performed annually, with the participation of an external auditor, who submits an independent pronouncement on the same. | **YES. Briefly Indicate:** In its condition as issuer of securities registered before the Securities Exchange Commission ("SEC") of the United States, the Corporation annually submits before the SEC its annual report under the Form 20-F, which includes information regarding the organization, methods and procedures of the control architecture of Grupo Aval. The Corporation submits quantitative and qualitative information with regards to risks. Likewise, it has an internal control model of financial report (ICOFR) based on internal control guidelines of the *Committee of Sponsoring Organizations of the Treadway Commission of 2013 (COSO).* Under the supervision and with the participation of the directive staff of the Corporation, an annual assessment on the effectiveness of internal control is performed annually, with the participation of an external auditor, who submits an independent pronouncement on the same. | **YES. Briefly Indicate:** In its condition as issuer of securities registered before the Securities Exchange Commission ("SEC") of the United States, the Corporation annually submits before the SEC its annual report under the Form 20-F, which includes information regarding the organization, methods and procedures of the control architecture of Grupo Aval. The Corporation submits quantitative and qualitative information with regards to risks. Likewise, it has an internal control model of financial report (ICOFR) based on internal control guidelines of the *Committee of Sponsoring Organizations of the Treadway Commission of 2013 (COSO).* Under the supervision and with the participation of the directive staff of the Corporation, an annual assessment on the effectiveness of internal control is performed annually, with the participation of an external auditor, who submits an independent pronouncement on the same. | **YES. Briefly Indicate:** In its condition as issuer of securities registered before the Securities Exchange Commission ("SEC") of the United States, the Corporation annually submits before the SEC its annual report under the Form 20-F, which includes information regarding the organization, methods and procedures of the control architecture of Grupo Aval. The Corporation submits quantitative and qualitative information with regards to risks. Likewise, it has an internal control model of financial report (ICOFR) based on internal control guidelines of the *Committee of Sponsoring Organizations of the Treadway Commission of 2013 (COSO).* Under the supervision and with the participation of the directive staff of the Corporation, an annual assessment on the effectiveness of internal control is performed annually, with the participation of an external auditor, who submits an independent pronouncement on the same. |
| **NO. Explain:** |  |  |  |  |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. | Recommendation implemented prior to September 30, 2014 date of issuance of the E.C. 028 of 2014. |
| **Modification Date** |  |  |  |  |

---

**FINANCIAL SUPERINTENDENCE OF COLOMBIA**

***This translation from the original Spanish version is provided for convenience purposes only. No representation is made as to the accuracy of this document and the company does not assume any liability based upon it. Should any doubt or contradiction arise between the Spanish and English versions, the Spanish version shall prevail.***

**Measure No. 33. Annual Corporate Governance Report**

**33.1.** The company prepares an Annual Corporate Governance Report. The Board of Directors is responsible for its contents, after their review and a favorable concept by the Audit Committee. This report accompanies the remaining documents of the closing of the accounting period.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **33.1. Measure Implementation** | **YES** | X | **NO** | **NA** |
| **YES. Briefly Indicate:** The Company has implemented as part of the 2021 Management Report (Pages 186 et seq.) Submitted for consideration by the General Shareholders' Meeting of March 2021, the "Corporate Governance Report" for the year 2019 with strict adherence to recommendation 33.3, which can be consulted at the following link:<br>https://www.grupoaval.com/repositorio/grupoaval/inversionistas/informacion-para-asamblea-de-accionistas/2022/Informe-de-Gestion-Aval-2021.pdf | **YES. Briefly Indicate:** The Company has implemented as part of the 2021 Management Report (Pages 186 et seq.) Submitted for consideration by the General Shareholders' Meeting of March 2021, the "Corporate Governance Report" for the year 2019 with strict adherence to recommendation 33.3, which can be consulted at the following link:<br>https://www.grupoaval.com/repositorio/grupoaval/inversionistas/informacion-para-asamblea-de-accionistas/2022/Informe-de-Gestion-Aval-2021.pdf | **YES. Briefly Indicate:** The Company has implemented as part of the 2021 Management Report (Pages 186 et seq.) Submitted for consideration by the General Shareholders' Meeting of March 2021, the "Corporate Governance Report" for the year 2019 with strict adherence to recommendation 33.3, which can be consulted at the following link:<br>https://www.grupoaval.com/repositorio/grupoaval/inversionistas/informacion-para-asamblea-de-accionistas/2022/Informe-de-Gestion-Aval-2021.pdf | **YES. Briefly Indicate:** The Company has implemented as part of the 2021 Management Report (Pages 186 et seq.) Submitted for consideration by the General Shareholders' Meeting of March 2021, the "Corporate Governance Report" for the year 2019 with strict adherence to recommendation 33.3, which can be consulted at the following link:<br>https://www.grupoaval.com/repositorio/grupoaval/inversionistas/informacion-para-asamblea-de-accionistas/2022/Informe-de-Gestion-Aval-2021.pdf | **YES. Briefly Indicate:** The Company has implemented as part of the 2021 Management Report (Pages 186 et seq.) Submitted for consideration by the General Shareholders' Meeting of March 2021, the "Corporate Governance Report" for the year 2019 with strict adherence to recommendation 33.3, which can be consulted at the following link:<br>https://www.grupoaval.com/repositorio/grupoaval/inversionistas/informacion-para-asamblea-de-accionistas/2022/Informe-de-Gestion-Aval-2021.pdf |
| **NO. Explain:** | **NO. Explain:** | **NO. Explain:** | **NO. Explain:** | **NO. Explain:** |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | March 30<sup>th</sup> 2020 | March 30<sup>th</sup> 2020 | March 30<sup>th</sup> 2020 | March 30<sup>th</sup> 2020 |
| **Modification Date** |  |  |  |  |

---

**33.2.** The company's Annual Corporate Governance Report is not a mere transcription of the governance norms included in the bylaws, internal regulations, good-governance codes, or other company documents. It does not intend to describe the corporation's governance model, but rather explain how it actually works and any relevant changes during the accounting period.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **33.2. Measure Implementation** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** The Annual Corporate Governance Report includes all the indicators proposed in recommendation 33.3 | **YES. Briefly Indicate:** The Annual Corporate Governance Report includes all the indicators proposed in recommendation 33.3 | **YES. Briefly Indicate:** The Annual Corporate Governance Report includes all the indicators proposed in recommendation 33.3 | **YES. Briefly Indicate:** The Annual Corporate Governance Report includes all the indicators proposed in recommendation 33.3 | **YES. Briefly Indicate:** The Annual Corporate Governance Report includes all the indicators proposed in recommendation 33.3 |
| **NO. Explain:** The Corporation shall consider the adoption of this recommendation in the future. | **NO. Explain:** The Corporation shall consider the adoption of this recommendation in the future. | **NO. Explain:** The Corporation shall consider the adoption of this recommendation in the future. | **NO. Explain:** The Corporation shall consider the adoption of this recommendation in the future. | **NO. Explain:** The Corporation shall consider the adoption of this recommendation in the future. |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | March 30<sup>th</sup> 2020 | March 30<sup>th</sup> 2020 | March 30<sup>th</sup> 2020 | March 30<sup>th</sup> 2020 |
| **Modification Date** |  |  |  |  |

---

**FINANCIAL SUPERINTENDENCE OF COLOMBIA**

***This translation from the original Spanish version is provided for convenience purposes only. No representation is made as to the accuracy of this document and the company does not assume any liability based upon it. Should any doubt or contradiction arise between the Spanish and English versions, the Spanish version shall prevail.***

**33.3**. The company's Annual Corporate Governance Report describes, at the end of the accounting period, how the company enforced, throughout the year, the governance recommendations it adopted as well as the leading resulting changes. The structure of the company's Annual Corporate Governance Report coincides with the scheme included in Recommendation 33.3.

---

| | | | | |
|:---|:---|:---|:---|:---|
| **33.3. Measure Implementation:** | **YES** | **X** | **NO** | **NA** |
| **YES. Briefly Indicate:** The Annual Corporate Governance Report includes all the indicators proposed in recommendation 33.3 | **YES. Briefly Indicate:** The Annual Corporate Governance Report includes all the indicators proposed in recommendation 33.3 | **YES. Briefly Indicate:** The Annual Corporate Governance Report includes all the indicators proposed in recommendation 33.3 | **YES. Briefly Indicate:** The Annual Corporate Governance Report includes all the indicators proposed in recommendation 33.3 | **YES. Briefly Indicate:** The Annual Corporate Governance Report includes all the indicators proposed in recommendation 33.3 |
| **NO. Explain: NO. Explain:** | **NO. Explain: NO. Explain:** | **NO. Explain: NO. Explain:** | **NO. Explain: NO. Explain:** | **NO. Explain: NO. Explain:** |
| **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** | **NA. Describe the regulations that prevent the adoption of the recommendation:** |  |
| **Implementation Date** | March 30<sup>th</sup> 2020 | March 30<sup>th</sup> 2020 | March 30<sup>th</sup> 2020 | March 30<sup>th</sup> 2020 |
| **Modification Date** |  |  |  |  |

---

**FINANCIAL SUPERINTENDENCE OF COLOMBIA**

***This translation from the original Spanish version is provided for convenience purposes only. No representation is made as to the accuracy of this document and the company does not assume any liability based upon it. Should any doubt or contradiction arise between the Spanish and English versions, the Spanish version shall prevail.***

SIGNATURE

Pursuant to the requirements of the Securities Exchange Act of 1934, the registrant has duly caused this report to be signed on its behalf by the undersigned, thereunto duly authorized.

Date: February 1, 2023

---

| | | |
|:---|:---|:---|
| **GRUPO AVAL ACCIONES Y VALORES S.A.** | **GRUPO AVAL ACCIONES Y VALORES S.A.** | **GRUPO AVAL ACCIONES Y VALORES S.A.** |
| By: | /s/ Jorge Adrián Rincón Plata | /s/ Jorge Adrián Rincón Plata |
|  | Name: | Jorge Adrián Rincón Plata |
|  | Title: | Chief Legal Counsel |

---