Audit and Corporate Practices Committee Annual Report

Mexico City, March 15^th, 2018

To the Board of Directors of Grupo Financiero Banorte, S.A.B. de C.V.

In accordance with Articles 58 articles of the Law to Regulate Financial Groups and 43 of the Stock Market Law, the Audit and Corporate Practices Committee (Committee) presents its annual report of activities for 2017.

The contents of this report shall refer to Grupo Financiero Banorte (GFNorte) and the following relevant institutions: Banco Mercantil del Norte, S.A., Casa de Bolsa Banorte Ixe, S.A. de C.V, Arrendadora y Factor Banorte, S.A. de C.V. SOFOM ER (Leasing and Factoring), Solida Administradora de Portafolios, S.A. de C.V. SOFOM ER, Seguros Banorte, S.A. de C.V.(Insurance company), Pensiones Banorte, S.A. de C.V. (Annuities company) and Banorte Ahorro y Previsión S.A. de C.V. (Long Term Savings).

I. In regards to auditing:

• Regarding the state of the Internal Control System (ICS) and Internal Audit of GFNorte and its relevant entities, and deficiencies and deviations, the following elements were taken into consideration:
  1. Their respective General Directors prepared the annual reports on activities in Internal Control issues of the relevant entities.
  2. The Internal Comptrollers’ reports for GFNorte’s relevant entities in Mexico, with their opinion on the functioning of the ICS.
  3. The Internal Audit’s opinion on the situation of the ICS of the relevant entities.
  4. Reports on relevant deficiencies and observations of GFNorte and its subsidiaries, presented by Internal Audit and the follow-up on corrective measures.
  5. The External Auditor’s reports of observations to Internal Control and its opinion of the financial statements of GFNorte and its subsidiaries.
  6. The inspection reports by competent authorities.
  7. Commissioners’ reports on GFNorte’s relevant entities.
  8. Reports of other Audit Committees on relevant events and the minutes of their meetings.
  9. Reports on the management Internal Audit and fulfillment of its work program.

  Taking into consideration the aforementioned elements, the ICS of GFNorte and its relevant entities is reported to function properly, and of those identified deficiencies or deviations, some have been corrected and others are in the process of being taken care of.

  With respect to the functioning of Internal Audit, the area has maintained its independence, reasonably met its work program in accordance with best practices, and effectively monitored the implementation of measures to correct observations and take advantage of detected areas of opportunity.

• No significant non-compliance with operating guidelines and policies and accounting records for GFNorte and its relevant subsidiaries were found; identified areas of opportunity were reported to policy-makers and steps were taken to address them, along with a follow-up system that was established to ensure proper implementation.
• A performance evaluation of the legal entity that provides the external audit services confirmed the quality of the firm Galaz, Yamazaki, Ruiz Urquiza, S.C. (Deloitte Touche Tohmatsu member) in the performance of its activities and in its relationships with the Administration and the Committee, as well as with the Auditor in charge.
  Also the content of its opinions and reports are considered of quality and useful in supporting the Committee, stressing that their results and opinions do not present differences with the Administration.
• With regards to the description and assessment of the additional or complementary services provided by the External Auditor, it was approved to hire them during the fiscal year to obtain an opinion on the interim financial statements as part of the Capitalization Instruments’ (Subordinated Debt) issuance process, a structural analysis of the personnel’s pension plan, of the funds that it is comprised of, the resources generated and its handling with regards to deferred taxes for the plan and to carry out work associated with the Placement Program as a recurrent issuer that Banco Mercantil del Norte plans to realize in the national market over the next 5 years.
  A review the fiscal situation of Grupo Financiero Interacciones and those companies for the fiscal years of 2015, 2016 and 2017 and to carry out work related to the Financial Due Diligence was also approved.
  And lastly, authorization was given to hire them to review reports for sustainability, local taxes and transfer prices for intercompany operations.
• A review of the financial statements for GFNorte and its subsidiaries was carried out as of December 31st, 2017 and the dictum of the External Auditor confirmed that they were prepared in accordance with the applicable accounting principles in all material aspects, and recommended their approval to the Board of Directors. The Committee also reviewed quarterly interim financial statements for the year.
• In regard to major modifications to policies and accounting criteria used during the fiscal year, it was reported that modifications were made to comply with changes in applicable provisions, which are described in Note 4 of the financial statements denominated “Main Accounting Policies”, which contains a detailed explanation of them and their effects.
• No relevant observations were received during the fiscal year from shareholders, Board members, directors, employees or any third party with respect to accounting, internal controls or internal and external audit, or allegations of irregular events. Based on best practices, there is an established anonymous complaints system which the Committee follows up on with due attention.
• With regards to the follow-up of agreements between the Shareholders’ Assembly and the Board of Directors, such bodies have not asked the Committee to follow-up on any agreement.
• During the fiscal year, Bank of Mexico paid an inspection visit which focused on issues related to financial markets, payment methods and compliance with the Transparency Law.
  For its part, the CNBV made observations related mainly to car and payroll loans, some inconsistencies in risk calculations, and aspects of accounting records and investment services.
  In December, reponses were provided to CNBV on these observations by contributing additional information in some places in order to ensure the matter is addressed, in other cases by pointing out the correction plan that is already underway and for certain cases reporting that the corresponding analysis will be carried out to initiate the correction programs.
  The main findings were reported to the Board of Directors in the meeting held on January 25^th, 2018.
• Among other relevant activities carried out within the Committee’s responsibilities are the review of operations of the Conflict of Interest Prevention System in GFNorte and the remediation plan for the observations detected by Internal Audit in the Foreign Exchange and Fiduciary Market processes.
  In terms of Technology, the Committee reviewed the actions to fully remedy the problem of users with incorrect profiles and the progress of the project to improve customer identification mechanisms to comply with provisions to prevent identity theft.
  During the fiscal year, the Committee followed up on the progress in the implementation of the new Fiduciary operating model.
  Regarding the Internal Audit function, the Committee evaluated the results of the review carried out by the Mexican Institute of Internal Auditors (IMAI), and the work plan to address the areas of opportunity identified in the Technology Audit function.
  Regarding the communication with the External Auditor, the Committee reviewed relevant events of the audit for the 2017 fiscal year and other issues considered in its external audit plan such as new developments in corporate governance and fiscal practices, the results of the evaluation on the level of compliance with the new legislation (Solvency II) presented by the Insurance and Annuities companies, the results of the review of the General Information Technology Controls (CGTI) and other matters related to the audit.
  In addition, the Committee reviewed the status of the value added services of the External Auditor pending completion of 2015 and 2016 fiscal years and authorized those corresponding to 2017.
  In relation to the event that occurred in the Casa de Bolsa Banorte Ixe, the Committee followed up on it, reviewing together with the areas of Private Banking, Legal, Comptroller and Internal Audit the identified areas of opportunity and actions for their mitigation.
  In terms of credit, the Committee reviewed the actions of the Analytical area to help reduce the cost of risk of the Payroll Loan product and the results of the Loan Review for the 2017 fiscal year applicable to Banco Mercantil del Norte and Leasing and Factoring.
  In relation to the merger with Grupo Financiero Interacciones (GFI), the Committee held work meetings both independently, as well as with members of Managment and their legal and financial advisors; as well as with other external advisors of the Committee itself.
  On this point, the Committee reviewed the presentations of Managment and the financial experts hired by Managment, as well as that of the expert hired by the Committee.
  Based on the foregoing, the Committee recommended submitting to the Board of Directors for its analysis and evaluation, the opinions of the independent experts who were hired to evaluate the proposed merger with Grupo Financiero Interacciones from different perspectives, the Board of Directors agreeing to authorize Managment to continue with the negotiation and present the project to the Shareholders’ Assembly for approval.
  With respect to other issues, the Committee reviewed the selection process of the external auditor in Banorte USA, the training course for Board Members in the field of Prevention of Money Laundering and Terrrorist Financing, information on financial profitability (ROE) by product and segment, the Uniteller Financial Services business plan, the process of analysis of quality in products and services and information on GFNorte’s manuals and regulations.

II. In regards to Corporate Practices:

• Regarding comments on the performance of relevant executives, the Secretariat of the Human Resources Committee reported that during the fiscal year ther4e were no cases of executives acting in breach of the established policies.
• Transactions with related parties were approved by the Board of Directors and to December 31st, 2017 loans provided through Banco Mercantil del Norte to related parties totaled Ps 19.410 billion, less than the limit established by the corresponding regulation.
  Intercompany transactions were carried out at market prices, which was verified by the External Auditor who did not report any findings.
  In 2017, the Committee monitored the implementation of GFNorte’s system for the prevention of conflicts of interest, relying on the management reports of Audit and Internal Control to do this.
• With regards to emolument packages for the CEO and relevant officers, there is a compensation system approved by the Board of Directors, which divides remuneration into ordinary and extraordinary and includes rules to defer the latter according to established risk indicators and policy compliance, which has been applied consistently during the fiscal year taking into account review results by Internal Audit and reports presented by the Human Resources Committee and the Risk Policy Committee to the Board of Directors.
• During the fiscal year the Board of Directors did not award dispensations to directors or relevant managers to take advantage of business opportunities.

Sincerely,

Héctor Reyes Retana y Dahl

President of Audit and Corporate Practices Committee of Grupo Financiero Banorte, S.A.B. de C.V.