Grupo Aval Acciones y Valores S A : Auditor’s Report Consolidated Financial Statements December 2023

KPMG S.A.S.

Calle 90 No. 19c - 74 Bogotá D.C. - Colombia

Phone

[phone]

[phone] www.kpmg.com/co

(FREE TRANSLATION OF THE REPORT ISSUED IN SPANISH)

STATUTORY AUDITOR'S REPORT

To the Shareholders

Grupo Aval Acciones y Valores S.A.

Opinion

I have audited the consolidated financial statements of Grupo Aval Acciones y Valores S.A. and Subsidiaries (the Group), which comprise the consolidated statement of financial position at December 31, 2023 and the consolidated statements of income and other comprehensive income, changes in equity, and cash flows for the year then ended, and their respective notes that include the summary of significant accounting policies and other explanatory notes.

In my opinion, the above mentioned consolidated financial statements, prepared in accordance with information accurately taken from the accounting books and attached to this report, present fairly, in all material aspects, the consolidated financial position of the Company at December 31, 2023, the consolidated results of its operations, and its consolidated cash flows for the year then ended, in conformity with Accounting and Financial Reporting Standards accepted in Colombia, applied on a consistent basis with previous year.

Basis for opinion

I conducted my audit in accordance with International Standards on Auditing (ISAs) accepted in Colombia. My responsibilities under those standards are further described in the "Statutory Auditor' Responsibilities for the Audit of the Consolidated Financial Statements" section of my report. I am independent of the Company in accordance with the Accountant's Professional Code of Ethics issued by the International Ethics Standards Board for Accountants (IESBA Code), included in the Information Assurance Standards accepted in Colombia together with the ethical requirements established in Colombia that are relevant to my audit of the consolidated financial statements, and I have fulfilled my other ethical responsibilities in accordance with these requirements and the IESBA Code mentioned. I believe that the audit evidence I have obtained is sufficient and appropriate to provide a basis for my opinion.

Key audit matters

Key audit matters are those matters that, in my professional judgment, were of most significance in my audit of the consolidated financial statements of the current period. These matters were addressed in the context of my audit of the consolidated financial statements as a whole, and in forming my opinion thereon, and I do not provide a separate opinion on these matters.

© 2024 KPMG S.A.S., a Colombian joint-stock simplified corporation and member of the global organization of	KPMG S.A.S.
independent member firms of KPMG International Limited, a private English entity limited by guarantee. All
Tax ID.: 860.000.846-4
rights reserved.

2

Assessment of Impairment of Credit Portfolio under IFRS 9 (see notes 4.1.5 and 11 to the

consolidated financial statements)

Key Audit Matter	How our audit approached this matter
As established in notes 4.1.5 and 11 to the	My audit procedures to assess the assignation of the
consolidated financial statements, provision	credit risk rating and the effect of the provision
for impairment of the Group's credit	includes, among others, the following:
portfolio amounted to $10.035.715 million
as of December 31, 2023.	- Evaluation of design and effectiveness of certain
The Group measures impairment of its	internal controls on the process established by the
Group to calculate impairment of the credit
credit portfolio for an amount equal to
portfolio, including, among others, controls on: (i)
Expected Credit Loses (ECL) for the life of
models and assumptions used, (ii) estimate of
each credit, except those that have not
macroeconomic variables, (iii) integrity and
experienced a significative increase of credit
accuracy of data, and (iv) the Group's monitoring on
risk since their initial recognition, for which
the general provision for impairment losses,
the Group calculates an ECL of twelve
including application of the judgement employed.
months. Provision for impairment of credit
lose reflects a probability-weighted result	- Involvement of credit risk professionals with specific
that considers multiple economic scenarios	abilities, knowledge, and industry experience, who
based on forecasts of future economic
assisted me in: (i) assessment of key models and
conditions and is determined in function of
supplies used to determined the Probability of
the Group's assessment on Probability of
Default (PD), Loss Given Default (LGD), and
Default (PD), Loss Given Default (LGD), and
Exposure Given Default (EGD) parameters, (ii)
Exposure Given Default (EGD) associated to
assessment of macroeconomic projections and
each loan. The Group, in accordance with
weighting of scenario probability, (iii) assessment of
requirements of IFRS 9 and following market
qualitative adjustments applied to models, (iv)
practices, uses complex models that
recalculation for a sample of credits evaluated
incorporate data and assumptions that
collectively and a sample of significant credits
require significant judgement to estimate
evaluated individually, of impairment and analysis
the loss for impairment of the credit
of guarantee values, and (v) verification for a
portfolio.
sample of individually-significant credits of the
I identified the assessment of impairment of	credit risk rating assigned by the Group.
the credit portfolio as a key audit matter
since there is a high degree of estimation
inherent to the determination of the
expected loss from impairment of the credit
portfolio, as a result of the judgement
required for prospective assumptions and
models involved.
The assessment of the impairment of the
credit portfolio required significant attention
from the auditor, involvement of judgement,
and participation of credit risk professionals,

3

as well as knowledge and industry experience.

Assessment of income recognized from concession contracts in construction phase and fair value of financial assets related to said concession contracts (see notes 2.20, 5 and 16 to the consolidated financial statements)

Key Audit Matter	How our audit approached this matter
As stated in notes 2.20, 5 and 16 to the	My audit procedures to assess the recognition of
consolidated financial statements, the Group and	income from concession contracts in construction
its Subsidiaries have concession contracts signed	phase and fair value of related financial assets
with the State for the construction and subsequent	included, among others:
maintenance of infrastructure for a determined
period. In exchange, the Groups and its	- Assessment of design, implementation, and
Subsidiaries have the right to received direct	effectiveness of certain internal controls
payments from Government and/or tariffs charged	established by the Group and its Subsidiaries to
to the final users of the infrastructure.	determine the fair value of financial assets
	arising from concession contracts and to
During the construction phase, the Group and its	establish income to be recognized from
Subsidiaries recognize income and a financial asset	contracts in construction phase. These controls
for payments that are unconditionally guaranteed	include those related to: (i) review of supplies
for the state and/or an intangible asset for	and assumptions used, (ii) review of completion
payments in connection with the use of the	cost estimates, and (iii) review and approval of
infrastructure.	fair value of assets and amount of income to be
	recognized.
Performance obligations related to construction
services are complied with time and the amount of	- Involvement of professionals in valuation with
income recognized depends on the termination	specific abilities and industry knowledge, who
stage of the construction services and the fair	assisted me in: (i) assessment of whether the
value of the asset recognized. The Group and its	models developed internally are consistent with
Subsidiaries have designated some of the financial	valuation practices generally used for this
assets related to concession contracts to be	purpose and IFRS, (ii) comparison of WACC
measured at fair value with changes in income	discount rates with a determined rank using
subsequent to initial recognition. As of December	macroeconomic assumptions verified by the
31, 2023, the Group and its subsidiaries have	market, (iii) assessment of future inflation rates
financial assets from concession contracts for	comparing them to available market data, (iv)
$3.830.916 million, measured at fair value and	assessment of costs estimated until completion,
classified on level 3 of the fair value hierarchy and	including assumptions used, (v) assessment of
assets for concession contracts in construction	income projected for the use of infrastructure,
phase for $7.964.822 million.	comparing it with internal and external data,
	when available, and (vi) evaluation of the
I identified the evaluation of income recognized for	accuracy of forecasts on inflation and
concession contracts in construction phase and fair	construction costs, by comparing them with a
value of related financial assets as a key audit

4

Assessment of income recognized from concession contracts in construction phase and fair value of financial assets related to said concession contracts (see notes 2.20, 5 and 16 to the consolidated financial statements)

matter because it implies an effort and significant audit judgement, including the participation of valuation professionals with specific abilities and industry knowledge.

For contracts in construction phase, the auditor's judgement was required to assess the estimated costs until the completion of the construction contracts in construction phase and evaluate the models developed by the Group and its Subsidiaries to estimate the fair value of financial assets and intangibles, as well as non-observable supplies and assumptions significant for these models.

For financial assets related to concession contracts measured subsequently to fair value with changes in income, the auditor's judgement was required to assess the models developed by the Group and its Subsidiaries to estimated their fair value, as well as important non-observable data and assumptions of these models. Important non- observable supplies and assumptions of these models include the cost of Weighted Average Capital Cost (WACC), future inflation rates, and projected income from the use of infrastructures.

sample of previously estimated values with actual values obtained.

Other matters

The consolidated financial statements at and for the year ending December 31, 2022 are submitted only for comparison purposes, were audited by me and, in my report dated Mach 6, 2023, I expressed an unqualified opinion thereon.

Responsibilities of Management and those in charge with the Company's corporate governance for the consolidated financial statements

Management is responsible for the fair preparation and presentation of these consolidated financial statements in accordance with Accounting and Financial Reporting Standards accepted in Colombia. This responsibility includes: designing, implementing and maintaining the internal control relevant that management considers necessary for the preparation and presentation of consolidated financial

5

statements that are free from material misstatement, whether due to fraud or error; selecting and applying appropriate accounting policies; and making accounting estimates that are reasonable in the circumstances.

In preparing the consolidated financial statements, management is responsible for assessing the Group's ability to continue as a going concern, disclosing, as applicable, matters related to going concern and using the going concern accounting basis unless management either intends to liquidate the Group or to cease operations, or has no realistic alternative but to do so.

Those charged with governance are responsible for overseeing the Group's financial reporting process.

Statutory Auditor's responsibilities for the audit of the consolidated financial statements

My objectives are to obtain reasonable assurance about whether the consolidated financial statements, as a whole, are free from material misstatement, whether due to fraud or error, and to issue an audit report that includes my opinion. Reasonable assurance is a high level of assurance but is not a guarantee that an audit conducted in accordance with ISAs will always detect a material misstatement, when it exists. Misstatements can arise from fraud or error and are considered material if, individually or in aggregate, they could reasonably be expected to influence the users' economic decisions taken on the basis of these consolidated financial statements.

As part of an audit conducted in accordance with ISAs, I exercise professional judgment and maintain professional skepticism throughout the audit. I also:

• Identify and assess the risks of material misstatement of the consolidated financial statements, whether due to fraud or error, design and perform audit procedures responsive to those risks, and obtain audit evidence that is sufficient and appropriate to provide a basis for my opinion. The risk of not detecting a material misstatement resulting from fraud is higher than for one resulting from error, as fraud may involve collusion, forgery, intentional omissions, misrepresentations, or the override of internal control.
• Obtain an understanding of internal control relevant for the audit in order to design audit procedures that are appropriate in the circumstances.
• Evaluate the appropriate accounting policies used and the reasonableness of accounting estimates and related disclosures made by management.
• Conclude on the appropriateness of management's use of the going concern hypothesis and, based on the audit evidence obtained, whether a material uncertainty exists related to events or conditions that may cast significant doubt on the Company's ability to continue as a going concern.
  If I would conclude that a material uncertainty exists, I am required to draw attention in my statutory auditor's report to the related disclosure in the consolidated financial statements or, if such disclosure is inadequate, to modify my opinion. My conclusions are based on the audit evidence obtained up to the date of my report. However, future events or conditions may cause the Company ceases to continue as a going concern.
• Evaluate the overall presentation, structure and content of the consolidated financial statements,

6

including the disclosures, and whether the consolidated financial statements represent the underlying transactions and events in a manner that achieves fair presentation.

• Obtain sufficient and appropriate audit evidence regarding the financial information of Group´s components or business activities to express an opinion about the consolidated financial statements. I am responsible for the direction, supervision, and performance of the Group's audit. I remain solely responsible for my audit opinion.

I communicate to those charged with the corporate governance regarding, among other matters, the planned scope and timing for the audit, as well as significant audit findings, including any significant deficiencies in internal control that I identify during my audit.

I also provide those charged with government the confirmation I have complied with the relevant independence ethical requirements, and I have communicated all relationships and other matters that may be reasonably considered to bear influence on my independence and, when appropriate, the related safeguards.

From the matters communicated with those charged with corporate governance, I determine those matters that were of most significance in the audit of the consolidated financial statements of the current period and are therefore the key audit matters. I describe these matters in my statutory auditor's report unless law or regulation precludes public disclosure about the matter or when, in extremely rare circumstances, I determine that a matter should not be communicated in my report because the adverse consequences of doing so would reasonably be expected to outweigh the public interest benefits of such communication.

(Original signed in Spanish) Diana Alexandra Rozo Muñoz

Statutory Auditor of Grupo Aval Acciones y Valores S.A.

Registration 120741 - T

Member of KPMG S.A.S.

February 27, 2024