In-control statement

As the Board of Management, we are responsible for the adequate design and operating effectiveness of our risk management and control system. This system is aimed at achieving strategic and operational objectives and at monitoring the reliability of our financial reporting and our regulatory compliance. The inherent limitations that apply to any internal risk management and control system must, however, be taken into account. This means we will never be able to absolutely guarantee that we will achieve our company objectives or that our processes, including the financial reporting process, will be free from errors, losses, fraud or violations of laws and regulations.

We monitored and evaluated the design and operating effectiveness of the system during 2020 and discussed this with the senior leadership team, the Board of Management and the Supervisory Board. Monitoring and evaluation took place based on regular business control reports containing an overview of operational risks and controls, business self-assessments resulting in Letters of Representation and quarterly updates on strategic risks and opportunities. Account was also taken of the information from reports from the internal audit function and the external auditor. In 2020, as a result of our investments in our Internal Control Framework, we had more opportunity to determine the adequate design and operating effectiveness of our risk management and control system over the course of the year. These interim assessments gave rise to improvement plans that have in part already been implemented and in part are yet to be implemented. Full implementation of the recovery plans will lead to more manifest and efficient control of business operations.

We declare that:

• the in-control process provides sufficient insight into any failings in the effectiveness of the internal risk management and control systems;

• the aforementioned systems provide reasonable assurance that the financial reporting does not contain any material inaccuracies;

• based on the current state of affairs, it is justified that the financial reporting is prepared on a going concern basis;

and

• the report states those material risks and uncertainties that are relevant to the expectation of the company’s continuity for the period of 12 months after the preparation of the report.

Rotterdam, 17 February 2021

Board of Management,

Marc van der Linden, CEO (chair)

Danny Benima, CFO

David Peters, CTO