Grupo Aval Acciones y Valores S A : Auditor’s Report Separate Financial Statements December 2023

KPMG S.A.S.

Calle 90 No. 19c - 74 Bogotá D.C. - Colombia

Phone

[phone]

[phone] www.kpmg.com/co

(FREE TRANSLATION OF THE REPORT ISSUED IN SPANISH)

STATUTORY AUDITOR'S REPORT

To the Shareholders

Grupo Aval Acciones y Valores S.A.:

Report on the audit of the financial statements

Opinion

I have audited the separate financial statements of Grupo Aval Acciones y Valores S.A. (the Company), which comprise the separate statement of financial position at December 31, 2023 and the separate statements of income and other comprehensive income, changes in equity, and cash flows for the year then ended, and their respective notes that include the summary of significant accounting policies and other explanatory notes.

In my opinion, the above mentioned separate financial statements, prepared in accordance with information accurately taken from the accounting books and attached to this report, present fairly, in all material aspects, the separate financial position of the Company at December 31, 2023, the separate results of its operations, and its separate cash flows for the year then ended, in conformity with Accounting and Financial Reporting Standards accepted in Colombia, applied on a consistent basis with previous year.

Basis for opinion

I conducted my audit in accordance with International Standards on Auditing (ISAs) accepted in Colombia. My responsibilities under those standards are further described in the "Statutory Auditor' Responsibilities for the Audit of the Separate Financial Statements" section of my report. I am independent of the Company in accordance with the Accountant's Professional Code of Ethics issued by the International Ethics Standards Board for Accountants (IESBA Code), included in the Information Assurance Standards accepted in Colombia together with the ethical requirements established in Colombia that are relevant to my audit of the separate financial statements, and I have fulfilled my other ethical responsibilities in accordance with these requirements and the IESBA Code mentioned.

I believe that the audit evidence I have obtained is sufficient and appropriate to provide a basis for my opinion.

Key audit matters

I have determined there are no key audit matters to be communicated in this report.

© 2024 KPMG S.A.S., a Colombian joint-stock simplified corporation and member of the global	KPMG S.A.S.
organization of independent member firms of KPMG International Limited, a private English
entity limited by guarantee. All rights reserved.	Tax ID.: 860.000.846-4

2

Other matters

The separate financial statements at and for the year ending December 31, 2022 are submitted only for comparison purposes, were audited by me and in my report dated March 6, 2023, I expressed an unqualified opinion thereon.

Responsibilities of Management and those in charge with the Company's corporate governance for the separate financial statements

Management is responsible for the fair preparation and presentation of these separate financial statements in accordance with Accounting and Financial Reporting Standards accepted in Colombia. This responsibility includes: designing, implementing and maintaining the internal control relevant that management considers necessary for the preparation and presentation of separate financial statements that are free from material misstatement, whether due to fraud or error; selecting and applying appropriate accounting policies; and making accounting estimates that are reasonable in the circumstances.

In preparing the separate financial statements, management is responsible for assessing the Company's ability to continue as a going concern, disclosing, as applicable, matters related to going concern and using the going concern accounting basis unless management either intends to liquidate the Company or to cease operations, or has no realistic alternative but to do so.

Those charged with governance are responsible for overseeing the Company's financial reporting process.

Statutory Auditor's responsibilities for the audit of the separate financial statements

My objectives are to obtain reasonable assurance about whether the separate financial statements, as a whole, are free from material misstatement, whether due to fraud or error, and to issue an audit report that includes my opinion. Reasonable assurance is a high level of assurance but is not a guarantee that an audit conducted in accordance with ISAs will always detect a material misstatement, when it exists. Misstatements can arise from fraud or error and are considered material if, individually or in aggregate, they could reasonably be expected to influence the users' economic decisions taken on the basis of these separate financial statements.

As part of an audit conducted in accordance with ISAs, I exercise professional judgment and maintain professional skepticism throughout the audit. I also:

• Identify and assess the risks of material misstatement of the separate financial

3

statements, whether due to fraud or error, design and perform audit procedures responsive to those risks, and obtain audit evidence that is sufficient and appropriate to provide a basis for my opinion. The risk of not detecting a material misstatement resulting from fraud is higher than for one resulting from error, as fraud may involve collusion, forgery, intentional omissions, misrepresentations, or the override of internal control.

• Obtain an understanding of internal control relevant for the audit in order to design audit procedures that are appropriate in the circumstances.
• Evaluate the appropriate accounting policies used and the reasonableness of accounting estimates and related disclosures made by management.
• Conclude on the appropriateness of management's use of the going concern hypothesis and, based on the audit evidence obtained, whether a material uncertainty exists related to events or conditions that may cast significant doubt on the Company's ability to continue as a going concern. If I would conclude that a material uncertainty exists, I am required to draw attention in my statutory auditor's report to the related disclosure in the separate financial statements or, if such disclosure is inadequate, to modify my opinion. My conclusions are based on the audit evidence obtained up to the date of my report. However, future events or conditions may cause the Company ceases to continue as a going concern.
• Evaluate the overall presentation, structure and content of the separate financial statements, including the disclosures, and whether the separate financial statements represent the underlying transactions and events in a manner that achieves fair presentation.
• Obtain sufficient and appropriate audit evidence regarding the separate financial information of Group´s components or business activities to express an opinion about the separate financial statements. I am responsible for the direction, supervision, and performance of the Group's audit. I remain solely responsible for my audit opinion.

I communicate to those charged with the corporate governance regarding, among other matters, the planned scope and timing for the audit, as well as significant audit findings, including any significant deficiencies in internal control that I identify during my audit.

I also provide those charged with government the confirmation I have complied with the relevant independence ethical requirements, and I have communicated all relationships and other matters that may be reasonably considered to bear influence on my independence and, when appropriate, the related safeguards.

Report on other legal and regulatory requirements

4

Based on the results of my tests, I believe during 2023:

1. The Company's bookkeeping has been kept in conformity with legal rules and accounting pronouncements.
2. The operations recorded in the books are in conformity with the bylaws and the
   General Shareholders' Meeting decisions.
3. The correspondence, the vouchers of accounts and the books of minutes and record of shares have been properly maintained.
4. The management report prepared by management agrees with the accompanying separated financial statements, which includes evidence about free circulation of invoices issued by of sellers or suppliers.
5. The information contained in the contribution returns submitted to the Comprehensive Social Security System, specifically the information on employees and their salary base, has been prepared from the accounting records and supporting documentation. The Company is up to date in payment of contributions to the Comprehensive Social Security System.
6. There has been compliance with the provisions of Law 2195 of 2022 through the internal control system.

In compliance with the requirements of articles 1.2.1.2. and 1.2.1.5. of Single Regulatory Decree 2420 of 2015, in development of the Statutory Auditor's responsibilities contained in numerals 1 and 3 of article 209 of the Code of Commerce, related to the evaluation whether the Company's management performance is in accordance with the bylaws and the orders or instructions of the General Shareholders' Meeting and if there are and are adequate measures of the internal control, preservation and custody of the Company's assets or third parties' assets in its possession, I issued a separate report dated February 27, 2024.

(Original signed in Spanish) Diana Alexandra Rozo Muñoz

Statutory auditor of Grupo Aval Acciones y Valores S.A. Registration 120741 - T

Member of KPMG S.A.S.

February 27, 2024