31 Royal Gold, Inc. 2022 Environmental, Social and Governance Report About Royal Gold Governance ESG Stewardship Our People Our Operators and Communities Appendices Code of Business Conduct and Ethics Our Code of Business Conduct and Ethics provides the framework by which we commit to maintaining the highest ethical standards in our operations and our relationship to our employees, counterparties and other stakeholders. Anti-Corruption Policy Our Anti-Corruption Policy outlines our prohibitions against illegal and improper conduct, including bribery and corruption in all forms. Human Rights Policy Our Royal Gold Human Rights Policy provides a framework to ensure human rights are respected in all company operations. Royal Gold believes that human rights are basic standards aimed to secure dignity and equality for all people. Royal Gold is committed to respect internationally recognized human rights standards. Supplier Code of Conduct Our Supplier Code of Conduct outlines expectations regarding the standard business practices of Suppliers that conduct business with Royal Gold, Inc. and its subsidiaries and affiliates. Cybersecurity Disclosure Policy Our Cybersecurity Disclosure Policy and Incident Response Plan are designed to establish acceptable uses of electronic devices, communications systems and network resources, and a framework for reporting and managing cybersecurity incidents. Our Board and senior management oversee matters relating to cybersecurity. Under its Charter, the Audit and Finance Committee of our Board is responsible for reviewing the security of our information technology systems and operations, including programs and defenses against cyber threats. The full Board is briefed on cybersecurity at least annually and receives more frequent updates as needed. Our Chief Financial Officer and Treasurer is responsible for cybersecurity matters at the management level. Employees complete cybersecurity training program semi-annually or more frequently as warranted by changes to the business operating environment. In 2022, 100% of Royal Gold employees completed cybersecurity training. In 2022, ISS ESG Rating services made updates to its Governance QualityScore methodology with new factors on information security, including whether a company discloses its third-party information security risks and the likelihood a company could suffer a material cybersecurity breach. Royal Gold has been rated by ISS as “low risk.” Whistleblower Policy Royal Gold’s Whistleblower Policy encourages and enables the reporting of any suspected illegal activities, unethical behavior, or other misconduct. The Whistleblower Policy is intended to provide a means for Directors, officers and employees of the Company to report serious concerns that could have a negative impact on Royal Gold or its stockholders, such as actions that may lead to false or inaccurate financial reporting, are unlawful, are not in line with company policy or otherwise amount to serious improper conduct. As indicated in the figure to the right, there were no whistleblower complaints between 2019 and 2022. Political contributions Royal Gold’s Code of Business Conduct and Ethics provides that corporate funds may not be provided to political candidates, entities or organizations without the written consent of our CEO, or the Chair of the Audit and Finance Committee of our Board in the case of a political contribution suggested by our CEO. This includes direct cash contributions, the donation of property or services, and purchases associated with fundraising events. As indicated in the figure to the right, we made no political contributions between 2019 and 2022. Low Risk High Risk 850 500 650 775 300 C Y B ER R ISK SCORE 780 ISS 4.2.0 Cyber Risk Score as of 23 January 2023 0 Whistleblower complaints from 2019 to 2022 TREND: CONSISTENT 0 Political contributions from 2019 to 2022 TREND: CONSISTENT