Quarterly Reporting to SAMA on Risks, Financial Statements, Auditor's Report, and Prudential Data; Publication of the Board of Directors' Report and Financial Statements on the Company's Website

[Logo of Saudi Central Bank]

Saudi Central Bank

Reference No.: 45063454 Date: 1445/10/07 Attachments: None

Circular

Dear Sirs, Peace, mercy and blessings of God be upon you,

Subject: Providing the Saudi Central Bank with a quarterly report on risks, financial statements, auditor's report, and prudential data; and publishing the Board of Directors' Report and quarterly and audited annual financial statements on the company's website.

Based on the authorities vested in the Saudi Central Bank under relevant regulations and instructions, we wish to inform you that deferred payment companies must comply with the following:

First: Preparing a quarterly risk report to be discussed by the Risk and Credit Management Committee and the Board of Directors, based on senior management's review and the Board's approval of necessary measures to address the risks mentioned in the risk report. The report must include, at a minimum:

1. A comprehensive assessment of the risks facing the company, and the measures taken to mitigate them, along with a review of the performance of financial positions exposed to market price risks.
2. The assumptions and factors on which the risk assessment measures are based, including: risk categories, risk levels, frequency, risk severity, and changes affecting them.
3. The performance of the financing portfolio by activity, non-performing financing, and provisions made.
4. An analysis of situations where the company exceeded permitted limits, with reasons stated, and the size and development of new business.

Second: Providing the Saudi Central Bank with the report referred to in (First) item, including decisions taken regarding it, within (30) working days from the end of each of March, June, September, and December of every Gregorian year.

Third: Providing the Saudi Central Bank with quarterly financial statements and the auditor's report within (20) working days from the end of each of March, June, and September of every Gregorian year.

Fourth: Providing the Saudi Central Bank with audited annual financial statements, the auditor's report, and the Board of Directors' Report within (45) working days from the end of the Gregorian year.

Page 1 of 2

[Logo of Saudi Central Bank] Saudi Central Bank

Fifth: Providing the Saudi Central Bank with annual and quarterly prudential data according to the attached approved forms, verifying the accuracy of all data, and submitting them within (25) working days from the end of each of March, June, September, and December for quarterly prudential data forms, and within (60) working days from the end of the Gregorian year for annual prudential data forms.

Sixth: The completed prudential data forms must be sent electronically in (Excel) format within the deadlines specified in (Fifth) item above, along with a scanned electronic copy of the Certification Statement form signed by the Chief Accountant, the Chief Financial Officer (CFO), and the Chief Executive Officer (CEO) or Managing Director, as applicable.

Seventh: The annual prudential data forms must be reviewed by the company's external auditor before submission to the Saudi Central Bank, and a copy of the signed audit certificate from the company's auditor must be attached to the forms.

Eighth: Publishing the Board of Directors' Report, quarterly financial statements, and audited annual financial statements on the company's website within (10) working days from the expiration of the submission deadline, including:

1. Statement of Financial Position.
2. Income Statement.
3. Cash Flow Statement.

For your information and compliance.

Yours sincerely,

[Signature] Yazed bin Ahmed Al-Sheikh Deputy Governor for Supervision

Distribution Scope:

• Deferred payment companies operating in the Kingdom.

Page 2 of 2

P.O. Box 2992, Riyadh 11169, Kingdom of Saudi Arabia | Phone: +966 11 463 3000