Regulation on the Annex to the Audit Report for Payment Institutions (ZAPV)

All English translation of the authentic German text is unofficial and serves merely information purposes. The official wording in German can be found in the Austrian Federal Law Gazette (Bundesgesetzblatt; BGBl.). All translations have been prepared with great care, but linguistic compromises had to be made. The reader should also bear in mind that some provisions of these laws will remain unclear without certain background knowledge of the Austrian legal and political system. Please note that these laws may be amended in the future and check occasionally for updates. Regulation of the Financial Market Authority (FMA) on the Annex to the Audit Report for Payment Institutions (ZAPV) Regulation on the Annex to the Audit Report for Payment Institutions (ZAPV) Original Version: Federal Law Gazette II No. 494/2009 Amended by (Federal Law Gazette II unless stated otherwise): 298/2010; 347/2011; 347/2015; 93/2017; 198/2018; 143/2026 Based on Article 25 para. 3 of the Federal Act on the Provision of Payment Services (ZaDiG; Zahlungsdienstegesetz), Federal Law Gazette I no. 66/2009, the following is determined by Regulation:

Regulation on the Annex to the Audit Report for Payment Institutions (ZAPV) . 2 / 8 TEXT Note for the following provision Para. 2 shall first apply for financial years which end after 30 December 2010 (cf. Article 3 para. 2). Article 1. (1) The result of the audit pursuant to Article 25 para. 3 ZaDiG shall be presented in an Annex to the Audit Report on the annual financial statement in accordance with the format prescribed in the annex, and its correctness shall be confirmed by means of the signature of the auditor. (2) The submission of the Annex to the Audit Report on the annual financial statement pursuant to Article 25 para. 3 ZaDiG shall be made within six months after the conclusion of the financial year on the basis of the FMA Incoming Platform Regulation – FMA-IPV, as published in Federal Law Gazette II No. 184/2010, as well as within the reporting in a standardised form by means of electronic data transmission to the Oesterreichische Nationalbank. Note for the following provision Shall first apply to financial years which end after 30 December 2015 (cf. Article 3 para. 4). Article 2. (1) Findings shall be listed in the Annex citing the relevant legal references in the fields marked for this purpose. This shall also apply to the listing of significant details, provided that they can be attributed to a relevant legal provision. (2) In the event that the audit modules contained in the Annex are not applicable for a payment institution, this circumstance shall be declared and explained for the relevant audit module using "not applicable” (“nicht anwendbar”), “no occurrence” (“keine Geschäftsfälle”), or an equivalent wording. Article 3. (1) This Regulation shall first apply to financial years that end after 30 December 2009. (2) Article 1 para. 2, Article 2 and the Annex in the version of the Regulation as published in Federal Law Gazette II No 298/2010 shall first apply to financial years that end after 30 December 2010. (3) The Annex in the version of the Regulation as published in Federal Law Gazette II No 347/2011 shall first apply to financial years that end after 30 December 2011. (4) Article 2 and the Annex in the version of the Regulation as published in Federal Law Gazette II No 347/2015 shall first apply to financial years that end after 30 December 2015. (5) The Annex in the version of the Regulation as published in Federal Law Gazette II No 93/2017 shall first apply to financial years that end after 30 December 2017. (6) The Annex in the version of the Regulation as published in Federal Law Gazette II No 198/2018 shall first apply to financial years that end after 30 December 2018. (7) The Annex in the version of the Regulation as published in Federal Law Gazette II No 143/2026 shall first apply to financial years that end after 30 December 2026.

Regulation on the Annex to the Audit Report for Payment Institutions (ZAPV) . 3 / 8 Note for the following provision Shall first apply to financial years which end after 30 December 2026 (cf. Article 3 para. 7). ANNEX PURSUANT TO ARTICLE 25 PARA. 3 ZADIG 2018 ON THE AUDIT REPORT (AZP) As the auditor of ………………………………………………………………………. (company name of the payment institution) ………………………………………………………………………. I (we) hereby submit the following Annex to the Audit Report in relationship to the financial year of the payment institution from xx.xx.xxxx until xx.xx.xxxx as well as the accompanying following Annex to the Audit Report for the annual financial statement for that financial year. Signature: (Date) (Auditor(s)) PART I Name, telephone number and e-mail address of the official in charge: Duration of audit process (in person days): Concluding summary of the overall situation of the payment institution (in particular in relation to the development of business, the risk, earnings and assets situation): (For findings, a legal reference must be supplied in any case)

Regulation on the Annex to the Audit Report for Payment Institutions (ZAPV) . 4 / 8

1. Consolidation Auditing activities conducted by the auditor: Findings of the auditor in connection with consolidation provisions pursuant to Article 25 para. 1 ZaDiG 2018: Findings: Legal Reference 1.1.
2. Own funds requirements Auditing activities conducted by the auditor: Findings of the auditor in connection with own funds requirements pursuant to Article 16 ZaDiG 2018: Findings: Legal Reference 2.1. Findings of the auditor in connection with own funds requirements pursuant to Article 17 ZaDiG 2018: Findings: Legal Reference 2.2. Findings of the auditor in connection with Article 7 para. 6 no. 4 ZaDiG 2018: Findings: Legal Reference 2.3.
3. Conditions for the granting of loans Auditing activities conducted by the auditor: Findings of the auditor regarding the granting of loans pursuant to Article 7 para. 6 nos. 1 to 3 ZaDiG 2018: Findings: Legal Reference 3.1.

Regulation on the Annex to the Audit Report for Payment Institutions (ZAPV) . 5 / 8 4. Safeguarding of customer deposits Auditing activities conducted by the auditor: Findings of the auditor regarding the safeguarding of customer deposits pursuant to Article 18 ZaDiG 2018: Findings: Legal Reference 4.1. 5. Due Diligence Obligations Auditing activities conducted by the auditor: Findings of the auditor in connection with due diligence obligations pursuant to Article 20 paras. 1 to 3, 5 and 6 ZaDiG 2018: Findings: Legal Reference 5.1. 6. Due Diligence Obligations for the Combatting of Money Laundering and of Terrorist Financing Auditing activities conducted by the auditor: Result of the audit by the auditor in connection with the due diligence obligations for combatting money laundering and terrorist financing pursuant to Article 9 para. 1 no. 11 ZaDiG 2018 in conjunction with Articles 4 to 17, Article 19 para. 2, Articles 20 to 24, Article 29 and Article 40 para. 1 of the Financial Markets Anti-Money Laundering Act (FM-GwG), published in Federal Law Gazette I No. 118/2016: Findings: Legal Reference 6.1. Number of suspicious activity reports: 6.2.

Regulation on the Annex to the Audit Report for Payment Institutions (ZAPV) . 6 / 8 7. Internal Audit Auditing activities conducted by the auditor: Result of the audit by the auditor regarding the internal audit pursuant to Article 20 para. 4 ZaDiG 2018: Findings: Legal Reference 7.1. 8. Ancillary activities Auditing activities conducted by the auditor: Result of the audit by the auditor in connection with ancillary activities performed by the payment institution pursuant to Article 7 paras. 2 to 4 ZaDiG 2018: Findings: Legal Reference 8.1. 9. Organisation and Management of the Payment Institution Auditing activities conducted by the auditor: Result of the audit by the auditor regarding the organisation and robust and prudent management of the payment institution pursuant to Article 10 para. 1 no. 3 ZaDiG 2018: Findings: Legal Reference 9.1. 10. Ownership provisions Auditing activities conducted by the auditor:

Regulation on the Annex to the Audit Report for Payment Institutions (ZAPV) . 7 / 8 Result of the audit by the auditor in connection with legal provisions on ownership pursuant to Article 14 para. 2 ZaDiG 2018: Findings: Legal Reference 10.1. 11. Retention of records and receipts Auditing activities conducted by the auditor: Result of the audit by the auditor in connection with legal provisions on the keeping of records and receipts pursuant to Article 24 ZaDiG 2018: Findings: Legal Reference 11.1. 12. Outsourcing of tasks Auditing activities conducted by the auditor: Result of the audit by the auditor in connection with legal provisions on the outsourcing of tasks pursuant to Article 21 ZaDiG: Findings: Legal Reference 12.1. 13. Agents Auditing activities conducted by the auditor: Result of the audit by the auditor in connection with legal provisions on agents pursuant to Article 22 ZaDiG: Findings: Legal Reference 13.1.

Regulation on the Annex to the Audit Report for Payment Institutions (ZAPV) . 8 / 8 14. Liability for persons attributable to the payment institution Auditing activities conducted by the auditor: Result of the audit by the auditor in connection with the legal provisions on the liability for persons attributable to the payment institution pursuant to Article 23 para. 2 ZaDiG 2018: Findings: Legal Reference 14.1. PART II 15. Licensing (Articles 9 and 10 ZaDiG 2018) Observations by the auditor in connection with the licensing of the payment institution (e.g. does the licence granted match the business model): Legal Reference 15.1. 16. Compliance with other significant legislation Observations by the auditor in connection with the observance of other provisions in ZaDiG 2018, in the Austrian Banking Act (BWG; Bankwesengesetz), published in Federal Law Gazette No. 532/1993, Regulation (EU) No. 575/2013 (CRR), OJ L 176, 27.06.2013, p. 1 and other material legal provisions for payment institutions: Legal Reference 16.1.