Central Bank of Tunisia Circular No. 2022-09 dated October 25, 2022

1 Tunis, October 25, 2022 CIRCULAR OF THE CENTRAL BANK OF TUNISIA No. 2022-09 Subject: Establishment of the application procedures for approval to conduct credit reporting activities, and the documents and data to be provided. The Governor of the Central Bank of Tunisia, Having regard to Organic Law No. 2004-63 of July 27, 2004, concerning the protection of personal data, Having regard to Law No. 2016-35 of April 25, 2016, establishing the status of the Central Bank of Tunisia, Having regard to Law No. 2016-48 of July 11, 2016, relating to banks and financial institutions, Having regard to Decree-Law No. 2022-2 of January 4, 2022, organizing the credit reporting activity and notably its Articles 6, 7, 8, and 22, Having regard to Decree No. 2007-3004 of November 27, 2007, setting the conditions and procedures for declaration and authorization regarding the processing of personal data, Having regard to Opinion No. 22/03-333 of the National Personal Data Protection Authority dated August 15, 2022, Having regard to Opinion No. 2022-09 of the Compliance Control Committee dated October 14, 2022,

2 Decides: Article 1: This circular establishes the procedures, documents, and data required for granting approval to conduct credit reporting activities. Article 2: The application for approval must include the documents and data specified in the annex attached to this circular. Article 3: The application for approval, along with the documents and data specified in this circular, must be submitted to the registry office at the headquarters of the Central Bank of Tunisia. Article 4: This circular enters into force from the date of its publication. THE GOVERNOR, Marouane EL ABASSI

3 Annex to the Circular of the Central Bank of Tunisia No. 2022-09 dated October 25, 2022 Documents and data required for the examination of an application for approval to conduct credit reporting activities.

1. Required Documents:

• An application addressed to the Governor of the Central Bank of Tunisia.
• A copy of the deposit receipt for the declaration submitted to the National Personal Data Protection Authority, or, where applicable, a copy of the Authority's decision confirming that it does not object to the exercise of the activity.
• A document certifying the approval of the company's information system by the National Agency for Information Security.
• Form No. 1: "Applicant's Profile" signed by the applicant.
• Form No. 2: "Sworn Declaration" signed by the applicant, attesting to the accuracy of the documents and data provided in the approval application.
• Form No. 3: "Shareholders' Identity" providing a brief overview of the shareholders, specifying their activities and holdings.
• Form No. 4: "Shareholders' Undertaking Letter" regarding participation in the capital of the company to be established, duly signed by the shareholders.
• Form No. 5: "Sworn Declaration" from the chairman of the board of directors, the administrator, the managing director, the deputy managing director, the president, a member of the executive board, the chairman or a member of the supervisory board of the credit reporting company, or any person acting on its behalf.

2. Shareholding Structure in the Capital of the Credit Reporting Company:

• An exhaustive list of natural and legal person shareholders holding direct or indirect participations in the capital of the company seeking approval to conduct credit reporting activities, including the reference shareholder and shareholders holding at least 10% of the capital. A reference shareholder is defined as any shareholder or shareholders' agreement, pursuant to an express or tacit convention under financial market legislation, that directly or indirectly holds the majority of voting rights in a credit reporting company or enables it to control such company.
• A copy of the shareholders' agreement, where applicable.
• A valid identity card, an updated curriculum vitae, and a criminal record extract issued within three months of the approval application submission date, for natural person shareholders of the credit reporting company.
• Individual financial statements and, where applicable, consolidated financial statements for the last three fiscal years, certified by an auditor, for legal person shareholders holding 10% or more of the capital of the company to be established.

3. Presentation of the Credit Reporting Company: (Strategy and Action Plan)

• A signed letter of intent by the applicant indicating the reasons for the approval application.

• The development strategy of the credit reporting company to be established, the target business model and strategic objectives, including a description of activity sectors and target clientele.

• The market study and analysis of the economic and financial environment of the credit reporting company to be established, along with its target market positioning and various business lines.

• The commercial policy reflecting strategic orientations: services, target clientele, activity sectors, and pricing policy.

• A note on the nature and extent of risks to which the credit reporting company will be exposed (reputational, legal, technological, operational, cyber risks...).

• The financing policy of the credit reporting company: the main funding sources and conditions in terms of cost and maturity.

• A note describing the operational management and roadmap of the credit reporting company.

• The standard template for agreements to be concluded with information providers to obtain credit information as part of service provision.

• The standard template for the credit report to be adopted by the credit reporting company.

4. Activity Program:

• Five-year business plan.
• The main assumptions used to develop the business plan and financial forecasts in terms of activity and profitability indicators over a five-year period.
• Projected financial data over a five-year period, along with details of the main line items based on at least three scenarios (optimistic, neutral, and pessimistic).

5. Human Resources and Information System:

• A detailed table indicating the projected evolution of human resources and their composition over a five-year period.
• A detailed report on technical means and the information system.
• Description of information system governance and IT security, particularly regarding personal data protection.
• Description of procedures and tools ensuring IT security, including: ✓ Data and system access tools; ✓ Network security; ✓ Audit trails; ✓ Backup; ✓ Data hosting (with a prohibition on cloud hosting); ✓ Mandatory archiving for a five-year period.

6. Business Continuity Plan: A report on the business continuity plan comprising the following information:

• Identification of essential activities and recovery objectives, including a schedule outlining key steps for temporary recovery and priority data.
• Measures implemented to ensure continuity in case of service interruption, such as key system failures, loss of critical data, inability to access premises, and loss of key personnel.
• Determination of the frequency for testing the business continuity and recovery plan after a disaster or cyberattack, along with mechanisms for notifying test results and incorporating them.

7. Governance and Organizational Framework:

• The target governance model (executive management and board of directors, or executive board and supervisory board),

• The composition of the board of directors or supervisory board and the various committees arising from these bodies (notably audit, risk, and compliance committees),

• The articles of association or draft articles of association of the credit reporting company,

• A file regarding members of the board of directors or supervisory board, executive management (managing and deputy managing directors), or executive board members, including their signed curricula vitae outlining academic and professional backgrounds and accompanied by a criminal record extract issued within three months of the approval application submission date,

• A curriculum vitae and a criminal record extract issued within three months of the approval application submission date for senior managers responsible for the following functions: • Internal Control and Compliance, • Risk Management, • Internal Audit.

• The target organizational chart of the company.

8. Internal Control and Risk Management:

• A report describing the internal control framework implemented by the company: role of governance structures, procedures, accounting and financial organization, information system, control activities.
• A report describing the framework implemented for risk identification, management, and monitoring (organizational risk management framework, risk identification, risk analysis, monitoring and review of risk management, financial and accounting information, etc.).

9. Data Protection System and Complaint Handling:

• Written procedures adopted to demonstrate obtaining the prior and explicit consent of concerned natural persons for sharing their personal data with the company, in accordance with personal data protection legislation and the consent of legal persons regarding the processing of their data.
• A report on measures to be implemented to guarantee individuals' right to object to the processing of their credit data and information, their right to access such data, and to request updates or destruction, in accordance with personal data protection legislation and Article 16 of Decree-Law No. 2022-2 of January 4, 2022.
• A report on procedures to be implemented for handling complaints, including a description of complaint reception and processing policies and procedures, as well as human and logistical resources and the responsible structure.
• A description of technical procedures to be implemented for destroying data held by the credit reporting company, upon withdrawal of approval or at clients' request, in accordance with personal data protection legislation.

6 FORM NO. 1: Applicant's Profile Identity of the applicant:

• Legal person, or
• Natural person Legal form: Affiliation group (if applicable): Capacity of the applicant: Academic qualifications: Areas of expertise:

9 FORM NO. 2: Applicant's Sworn Declaration I, the undersigned (name and surname), in my capacity as an applicant for approval to conduct credit reporting activities, hereby swear the accuracy of the data and documents presented in the application for approval and undertake to inform the Central Bank of Tunisia of any changes to the provided documents and data. Done at……….., on…………….. Signature of the applicant

10 FORM NO. 3: Shareholders' Identity Identity of the shareholder: Legal person: Natural person: Company name / Trade name: Surname: Legal form: First name: Registered office: Date and place of birth: National Enterprise Registry ID: Shareholding ratio in the capital of the credit reporting company / voting rights percentage: Shareholding ratio in the capital of the credit reporting company / voting rights percentage: Nationality: Nationality: Address: Holdings in other companies: (company name / trade name and shareholding ratio): Holdings in other companies: (company name / trade name and shareholding ratio):

11 FORM NO. 4: Shareholders' Undertaking Letter I, the undersigned, ………………………………………………………………… holder of:

• National identity card1 No.…………….………………..
• Residence permit2 No.…………valid until………………..
• Passport No.…………...….valid until ………………. Residing at ………………………………………………………… undertake to participate in the capital of …………………………. up to an amount of ……………., representing………… of the capital and ………….. of the voting rights.

Done at……., on ……………….. Signature 1 For persons of Tunisian nationality. 2 For persons of foreign nationality.

12 FORM NO. 5: Sworn Declaration by the Chairman, Administrator, Managing Director, Deputy Managing Director, President, Executive Board Member, or Supervisory Board Chairman/Member of the Credit Reporting Company, or any person acting on its behalf. I, the undersigned, ……………………………………………………………………… holder of:

• National identity card1 No.……………………………………..
• Residence permit2 No.……………………valid until…………..….…..
• Passport No.……………………………….valid until ………………... residing at………………………………………………………………….…….… holding the position3 of …………………………………………………………... within4 ……………………………………………………………………….. hereby swear that I have never been subject to:

1. A final judgment of bankruptcy,
2. A final judgment for forgery, theft, breach of trust, fraud, extortion of funds or valuables, misappropriation by a public depositary, corruption or tax evasion, issuance of bounced checks, concealment of goods obtained through these offenses, or violation of foreign exchange regulations or anti-money laundering and counter-terrorist financing legislation,
3. A conviction under the Penal Code provisions regarding bankruptcy for managers or corporate representatives,
4. A sanction or disqualification in the exercise of a profession governed by a legal or regulatory framework. Furthermore, I undertake to promptly notify the Central Bank of Tunisia of any change affecting my status, in accordance with Article 11 of Decree-Law No. 2022-2 of January 4, 2022 organizing the credit reporting activity. 1 For persons of Tunisian nationality. 2 For persons of foreign nationality. 3 Mention one of the positions stipulated in Article 11 of Decree-Law No. 2022-2 of January 4, 2022. 4 Name of the company.

13 Done at………, on ……………….. Signature