GS MORTGAGE-BACKED SECURITIES TRUST 2026 ABS-15G

KPMG LLP 1 Sovereign Square Sovereign Street Leeds LS1 4DA United Kingdom

Tel +44 (0) 113 231 3000 Fax +44 (0) 113 231 3200 helena.lyons@kpmg.co.uk Mobile +44 (0) 7825 245 259

Engagement to perform agreed-upon procedures in relation to a portfolio of Irish mortgage loans proposed to be the subject of a securitisation

In accordance with the terms of our engagement letter dated 8 January 2026 (the “Engagement Letter”), we have performed certain agreed-upon procedures in relation to the portfolio of Irish mortgage loans referred to above proposed to be the subject of a securitisation (the “Securitisation”). This letter reports on our performance of those agreed-upon procedures (the “Data AUP Letter”). This Data AUP Letter is confidential and agreed disclosure restrictions apply.

This Data AUP Letter is addressed to the directors of GSMBS 2026-IRL1 DAC (the “Issuer”), Penryn Funding 2024 DAC (the “Seller”) and Goldman Sachs International (the “Arranger”) and collectively all addressees of this Data AUP Letter are referred to as the “Data AUP Letter Recipients”.

The procedures that we will perform are solely for the purpose of assisting you in determining the accuracy of data that you are preparing in connection with the Securitisation and so may not be suitable for any other purpose. We will not accept any responsibility to any other party to whom our Data AUP Letter is shown or into whose hands it may come.

Document Classification - KPMG Confidential

KPMG LLP Engagement to perform agreed-upon procedures in relation to a portfolio of Irish mortgage loans proposed to be the subject of a securitisation 23 April 2026

Responsibilities of the Data AUP Letter Recipients

It is the responsibility of the Data AUP Letter Recipients to determine the sufficiency of these procedures agreed with them for their own purposes. Consequently, we make no representation regarding the sufficiency of the procedures described below either for the purposes for which this report has been requested or for any other purpose.

The Data AUP Letter Recipients have acknowledged that the agreed-upon procedures are appropriate for the purpose of the engagement. The Seller is responsible for the subject matter on which the agreed-upon procedures are performed.

Our Responsibilities

Our engagement was undertaken in accordance with International Standard on Related Services 4400 (Revised), Agreed-Upon Procedures Engagements issued by the International Auditing and Assurance Standards Board. An agreed-upon procedures engagement involves our performing the procedures that have been agreed with the Data AUP Letter Recipients, and reporting the factual findings, which are the factual results of the agreed-upon procedures performed. We make no representation regarding the appropriateness of the agreed-upon procedures.

This agreed-upon procedures engagement is not an assurance engagement. Accordingly, we do not express an opinion or an assurance conclusion.

Had we performed additional procedures, other matters might have come to our attention that would have been reported.

Professional Ethics and Quality Control

We have complied with the ethical requirements in the ICAEW Code of Ethics issued by the Institute of Chartered Accountants in England and Wales. For the purpose of this engagement, there are no independence requirements with which we are obliged to comply.

We apply International Standard on Quality Control (UK) 1 Quality Control for Firms that Perform Audits and Reviews of Financial Statements, and Other Assurance and Related Services Engagements. Accordingly, we maintain a comprehensive system of quality control including documented policies and procedures regarding compliance with ethical requirements and professional standards as well as applicable legal and regulatory requirements.

KPMG LLP Engagement to perform agreed-upon procedures in relation to a portfolio of Irish mortgage loans proposed to be the subject of a securitisation 23 April 2026

Procedures and Findings

The procedures performed were not intended to satisfy any criteria for due diligence published by any nationally recognised statistical rating organisation (“NRSRO”).

We have been provided with a data file entitled “Project Phoenix Datatape 31OCT2025.xlsx” containing details relating to a portfolio of Irish mortgage loans as at 31 October 2025 (the “Portfolio Date”) (the “Extraction File”) proposed to be the subject of a securitisation (the “Portfolio”). A sample of 426 items was drawn at random from the Portfolio (the “Sample”). The number of items in the Sample was determined on the basis described in the scope of services (the “Scope of Services”) attached as Appendix A.

The procedures were performed on the Extraction File and the source documentation (the “Sources”) provided to us by the Seller or the relevant mortgage portfolio servicer. We have not verified or evaluated such Sources and therefore we express no opinion or any other form of assurance regarding the reliability, accuracy or adequacy of the Sources, or as to whether any of the Sources omit any material facts. Furthermore, we express no opinion or any other form of assurance regarding the reliability, accuracy or adequacy of the disclosures in the Extraction File, or any legal matters relating to the Portfolio or the physical existence of the mortgaged properties.

The procedures performed did not address, without limitation: (i) the conformity of the origination of the Portfolio to stated underwriting or credit extension guidelines, standards, criteria or other requirements, (ii) the value of any collateral securing the Portfolio, (iii) the compliance of the originator of the Portfolio with applicable laws and regulations, or (iv) any other factor or characteristic of the Portfolio that would be material to the likelihood that the issuer or the asset-backed security will pay interest and principal in accordance with applicable terms and conditions.

Findings

The findings from the agreed-upon procedures are set out in Appendix B.

Based on the instructions provided to us and the assumptions set out in the Scope of Services, the following statistical interpretation can be applied to the findings set out in Appendix B: on the basis of the number of differences between the Extraction File and the Sources identified in the Sample (as reported on the ‘Differences’ lines of Appendix B) and the number of missing sources relating to the Sample (as reported on the ‘Missing Sources’ line of Appendix B) it can be calculated that there is a 99% level of confidence that not more than X% of the population contains such findings relating to the specified procedure, where X is the relevant percentage reported on the ‘Statistical extrapolation’ lines of Appendix B.

KPMG LLP Engagement to perform agreed-upon procedures in relation to a portfolio of Irish mortgage loans proposed to be the subject of a securitisation 23 April 2026

Details of the differences and missing documentation found as a result of the agreed-upon procedures, and listed in Appendix B, are set out in Appendix C.

General

This Data AUP Letter may only be relied upon in respect of the matters to which it refers and as of its date. In relying upon this Data AUP Letter, you agree (save as may otherwise have been expressly agreed in writing) that we have no responsibility to, and we will not, perform any work subsequent to the date of this Data AUP Letter nor to consider, monitor, communicate or report the impact of any events or circumstances which may occur or may come to light subsequent to the date of this Data AUP Letter.

This Data AUP Letter is not issued in accordance with the professional standards of the American Institute of Certified Public Accountants or the US Public Company Accounting Oversight Board. We will provide separately an executed Form ABS Due Diligence-15E, Certification of Provider of Third-Party Due Diligence Services for Asset-Backed Securities (“Form ABS Due Diligence-15E”), using the form made available by the US Securities and Exchange Commission (“SEC”), to which this Data AUP Letter will be appended. The executed Form ABS Due Diligence-15E will be provided, without in any way or on any basis affecting or adding to or extending our duties and responsibilities to you or giving rise to any duty or responsibility being accepted or assumed by or imposed on KPMG to any party except you, to facilitate your compliance with SEC Release No. 34-72936, Nationally Recognized Statistical Rating Organizations (the “SEC Release”), pursuant to which you are required to make publicly available the findings and conclusions of any third-party due diligence report obtained. This Data AUP Letter alone is not to be relied on in the United States and we accept no responsibility for any use that you may make of this Data AUP Letter alone in the United States.

The requirement to make publicly available findings and conclusions includes disclosure of the criteria against which loans were evaluated, and how the evaluated loans compared to those criteria, along with the basis for including any loans not meeting those criteria. This is accomplished by including such information, which will include this Data AUP Letter, in Form ABS-15G, Asset-Backed Securitizer Report Pursuant to Section 15G of the Securities Exchange Act of 1934 (“Form ABS 15G”), which is required to be furnished by the Issuer or underwriter to the SEC through the Electronic Data Gathering, Analysis, and Retrieval (“EDGAR”) system.

The Issuer, sponsor or underwriter of an asset–backed securitisation is required to maintain a website (the “Rule 17g-5 website”) pursuant to paragraph (a)(3) of Rule 17g-5 of the US Code of Federal Regulations (17 CFR 240.17g-5). The SEC Release requires any NRSRO producing a credit rating to which “third party due diligence services” relate, to publish with its rating any executed Form ABS Due Diligence-15E containing information about the relevant security or money market instrument that the NRSRO receives or obtains through a Rule 17g-5 website. The agreed-upon procedures performed by KPMG on which this Data AUP Letter reports amount to “third party due diligence services” as defined in the SEC Release.

KPMG LLP Engagement to perform agreed-upon procedures in relation to a portfolio of Irish mortgage loans proposed to be the subject of a securitisation 23 April 2026

To facilitate a relevant NRSRO meeting this publication obligation, we are required to furnish any executed Form ABS Due Diligence-15E to any such NRSRO. As envisaged by the SEC Release, we will do so by providing the prescribed form to the Issuer, sponsor, or underwriter of the securitisation that maintains the Rule 17g-5 website, or to any NRSRO that requests it. In addition, the SEC Release requires that an NRSRO producing a credit rating publicly disclose each prescribed form that was posted to the Rule 17g-5 website. Such information may therefore be posted on the website of any relevant NRSRO.

Any such publicity shall take place, without in any way or on any basis affecting or adding to or extending our duties and responsibilities to you or giving rise to any duty or responsibility being accepted or assumed by or imposed on KPMG to any party except you, to facilitate your compliance with the SEC Release. Accordingly, any party (including rating agencies and investors) obtaining access to this Data AUP Letter as appended to the executed Form ABS Due Diligence-15E or separately is not authorised by KPMG to use or rely upon the Data AUP Letter, any such use or reliance shall take place at the relevant party’s own risk and, to the fullest extent permitted by law, we will have no responsibility and will deny any liability to any such party.

Yours faithfully

KPMG LLP

Attached:

KPMG LLP Engagement to perform agreed-upon procedures in relation to a portfolio of Irish mortgage loans proposed to be the subject of a securitisation 23 April 2026

Appendix A: Scope of the Services

This Appendix sets out the procedures that the Data AUP Letter Recipients have instructed us, and that we have agreed, to perform.

Provision of a data file

The Data AUP Letter Recipients have informed us that the Seller will provide a data file to us containing details of Irish mortgage loans proposed to be the subject of a securitisation (the “Portfolio”) as at a date to be determined by the Data AUP Letter Recipients (the “Portfolio Date”) (the “Extraction File”). We will draw a sample of items at random from the Extraction File (the “Sample”) and will notify the items selected to the Seller. The number of items in the Sample will be determined on the basis described under “Sampling” below.

The Seller or the relevant mortgage portfolio servicer will also provide source documentation to us that the Data AUP Letter Recipients wish us to use for the purposes of the agreed-upon procedures.

Sampling

Sampling is a process of examining less than the total number of items in a population in order to calculate a statistical interpretation about that population. Sampling techniques inherently assume that the sample is representative of the population as a whole. The Data AUP Letter Recipients have requested that we calculate the sample size based on the total number of items in the Portfolio using the following parameters:

Expected deviation rate: 0%

Tolerable deviation rate: 1%

Confidence level: 99%

on the basis that differences between the data attributes and their respective sources are hypergeometrically distributed. We make no representations regarding the use of, or assumptions underlying the sampling techniques.

Procedures

The procedures that the Data AUP Letter Recipients have instructed us, and that we have agreed, to perform in relation to the information contained in the Extraction File are set out in the table below.

KPMG LLP Engagement to perform agreed-upon procedures in relation to a portfolio of Irish mortgage loans proposed to be the subject of a securitisation 23 April 2026

As instructed by the Data AUP Letter Recipients, we should test a single property linked to each loan within the Sample. Where an item in the Sample is linked to multiple properties, we should select the property with the highest market value for testing. Where an item in the Sample is classified as a ‘warehouse’ account, the Data AUP Letter Recipients have instructed us to perform the procedures for the linked ‘main’ account only.

KPMG LLP Engagement to perform agreed-upon procedures in relation to a portfolio of Irish mortgage loans proposed to be the subject of a securitisation 23 April 2026

KPMG LLP Engagement to perform agreed-upon procedures in relation to a portfolio of Irish mortgage loans proposed to be the subject of a securitisation 23 April 2026

KPMG LLP Engagement to perform agreed-upon procedures in relation to a portfolio of Irish mortgage loans proposed to be the subject of a securitisation 23 April 2026

KPMG LLP Engagement to perform agreed-upon procedures in relation to a portfolio of Irish mortgage loans proposed to be the subject of a securitisation 23 April 2026

KPMG LLP Engagement to perform agreed-upon procedures in relation to a portfolio of Irish mortgage loans proposed to be the subject of a securitisation 23 April 2026

KPMG LLP Engagement to perform agreed-upon procedures in relation to a portfolio of Irish mortgage loans proposed to be the subject of a securitisation 23 April 2026

KPMG LLP Engagement to perform agreed-upon procedures in relation to a portfolio of Irish mortgage loans proposed to be the subject of a securitisation 23 April 2026

KPMG LLP Engagement to perform agreed-upon procedures in relation to a portfolio of Irish mortgage loans proposed to be the subject of a securitisation 23 April 2026

KPMG LLP Engagement to perform agreed-upon procedures in relation to a portfolio of Irish mortgage loans proposed to be the subject of a securitisation 23 April 2026

KPMG LLP Engagement to perform agreed-upon procedures in relation to a portfolio of Irish mortgage loans proposed to be the subject of a securitisation 23 April 2026

Notes in relation to the manner of reporting certain findings

Where a data attribute contained in the Extraction File for an individual mortgage loan does not match the source, this is to be reported as a ‘difference’ or ‘D’.

Where a source document has not been provided, or the data attribute is missing from the source document, this is to be reported as ‘missing source’, ‘missing from source’ or ‘MS’.

For the purposes of the statistical interpretation, the Data AUP Letter Recipients require us to present the statistical extrapolation for each procedure as follows:

KPMG LLP Engagement to perform agreed-upon procedures in relation to a portfolio of Irish mortgage loans proposed to be the subject of a securitisation 23 April 2026

Primary calculation:

Secondary calculation:

Where a procedure specifies agreement to specific documentation, and the Seller or the relevant mortgage portfolio servicer has provided as part of the source documentation written evidence of amendments or additions to an original document or documents, the instruction of the Data AUP Letter Recipients to us is to conduct the relevant procedure on the basis of the information contained in the amendments or additions to the original documentation and not the information contained in the original documentation.

In reporting findings on the basis of the procedures to be undertaken, the Data AUP Letter Recipients have specified that results are to be reported as being in agreement if any difference found is below the tolerance level, if any, set out above.