Compliance

COMSA Corporación's Compliance model regulates matters of great importance for the group, so its knowledge, assumption and compliance is of vital importance.

COMSA Corporación

Below are the main documents comprising COMSA Corporación’s Compliance Model developed based on the Code of Ethics and the Criminal and Anti-Bribery Compliance Policy that is applicable to all Group members and companies subject to the policy regardless of the country in which they operate, except for some jurisdictions where its application is supplementary due to local legislation requirements:

Code of Conduct for Suppliers

Code of Ethics

Criminal and Antibribery Compliance Policy

Protocol for the Ethics Channel Management, Internal Investigations and Corporate Reactions

Whistleblowing Management System Data Protection Policy

Whistleblowing Management System Policy (Ethics Channel)

Portugal

The companies FERGRUPO – Construções e Técnicas Ferroviárias, S.A., COMSA, S.A. – Sucursal em Portugal and GMF Railway Maintenance Services, S.L. – Sucursal em Portugal (“subject companies”), since they are subject to the General Corruption Prevention System, annexed to Decree–Law No. 109-E/2021, (9 December), are subject to a Compliance Compliance (or regulatory compliance programin parallel to the corporate policy that has been adjusted to the requirements of Portuguese legislation. This includes a new document called Corruption and Associated Crime Risk Prevention Plan into the Compliance Model, through which the risks associated with the business activity are analysed and mitigating preventive and corrective measures are implemented. This compliance program also has versions adapted to the Code of Ethics and other internal rules that are applied to the subject companies and to all members on a priority basis over the corporate versions of those documents. The Compliance Model documents that have not been amended are fully applicable to the extent that they do not contradict the specified content of the documents that have been aligned with Portuguese legislation. Below you will find the Corruption and Associated Crime Risk Prevention Plan and the versions adapted to the Code of Ethics, the Whistleblower Management System Policy and the Protocol for the Ethics Channel Management, Internal Investigations and Corporate Reactions. The rest of the documents comprising the regulatory compliance program are available on the Corporate Portal to all members of COMSA Corporación by accessing the following link by accessing the following link

Portugal (Decreto- Lei n.º 109-E-2021, de 9 de dezembro)

Code of Ethics

Plan for the Prevention of Risks of Corruption and Related Offences

Protocol for the Ethics Channel Management, Internal Investigations and Corporate Reactions

Whistleblower Management System Policy (Ethics Channel)

Colombia

The companies COMSA COLOMBIA SAS, COMSA S.A. SOCIEDAD UNIPERSONAL SUCURSAL COLOMBIA and COMSA INSTALACIONES Y SISTEMAS INDUSTRIALES S.A. SOCIEDAD UNIPERSONAL SUCURSAL COLOMBIA (“subject companies ”), since they are subject to the Integral Management and Self-Monitoring System for Asset Laundering, Financing of Terrorism and Financing of the Proliferation of Weapons of Mass Destruction ( “SAGRILAFT”) and the Business Transparency and Ethics Program (“PTEE”), are subject to the manuals described below and by the documents making up COMSA Corporación’s Compliance Model, to the extent that they do not contradict the content of the manuals.

COMPLIANCE MANUAL Transparency and Business Ethics Programme COMSA COLOMBIA S.A.S.

COMPLIANCE MANUAL Transparency and Business Ethics Programme COMSA INSTALACIONES Y SISTEMAS INDUSTRIALES S.A. SINGLE-MEMBER COMPANY COLOMBIA BRANCH OFFICE

COMPLIANCE MANUAL Transparency and Business Ethics Programme COMSA S.A. SOCIEDAD UNIPERSONAL BRANCH OFFICE COLOMBIA

Self-control System Manual COMSA Colombia

Self-control System Manual COMSA Industrial Colombia

Self-control System Manual COMSA S.A.

For more information on the scope of application of the compliance model, access the Perimeter of Group companies adhering to the model.

Employees of the organisation can access all Compliance documents via the following link.