Regulation on the supervision of the Single Central Securities Depository

Note: The translation is unofficial, for information purpose only REGULATION on the supervision of the Single Central Securities Depository Monitorul Oficial of R. Moldova no.138 (10313) art.222 of 25.03.2026 Approved by Decision of the Executive Board of the National Bank of Moldova No 69/2026 Section 1 GENERAL PROVISIONS

1. The Regulation on the supervision of the Single Central Securities Depository (hereinafter referred to as the Regulation) establishes the rules for supervising and monitoring, organizing and conducting the control procedure applied to the Single Central Securities Depository (hereinafter referred to as the Single Central Depository) by the National Bank of Moldova (hereinafter referred to as the NBM), the rules on issuing recommendations, issuing prescriptions, and applying sanctions against it under the conditions of Articles 23, 26, and 41 of Law No 234/2016 on the Single Central Securities Depository (hereinafter referred to as Law No 234/2016).

2. The terms and expressions used in this Regulation shall have the meanings provided for in Law No 548/1995 on the National Bank of Moldova (hereinafter – Law No 548/1995), Law No 234/2016 and Law No 183/2016 on the Settlement finality in payment and financial instruments settlement systems (hereinafter referred to as Law No 183/2016).

3. The NBM supervises the Single Central Depository in order to verify compliance with the provisions of Law No 234/2016 and the normative acts issued for its enforcement, Law No 1134/1997 on joint stock companies (hereinafter referred to as Law No 1134/1997) and Law No 183/2016, as well as to verify the application of policies for identifying, managing, monitoring, and reporting risks to which the Single Central Depository is or may be exposed.

4. Within the supervisory process, including control procedures, notification of individual acts/documents shall be carried out by electronic means of communication, such as official e-mail accounts and/or NBM information systems.

5. If the individual act/document cannot be notified through electronic communication means, the notification shall be carried out using one of the notification methods provided in Article 112 paragraph (1) letters a) - d) of Law No 548/1995, as applicable.

6. If the notification methods applicable according to points 4 and 5 are unsuccessful, including in cases where the recipient is unavailable/cannot be contacted, the provisions of Article 112, paragraph (10) of Law No 548/1995 shall apply.

7. The individual act/document is considered notified under the conditions provided by Article 112, paragraph (1) letter a), paragraphs (3), (4), (8) – (10) of Law No 548/1995, depending on the notification method applied. Section 2 PERFORMING MONITORING

8. For the purpose of exercising the monitoring function by the NBM in accordance with the provisions of Article 23 of Law No 234/2016, the Single Central Depository will send to the NBM at the email address supraveghere.dcu@bnm.md: 8.1. quarterly, within a maximum of 20 working days after the end of the quarter, the following documents and information for the situation on the last day of the completed quarter: 8.1.1. financial statements for the previous quarter; 8.1.2.information on the number and types of participants, issuers, and their open accounts; 8.1.3.the number, type, and quantity of securities held and/or processed by the Single Central Depository; 8.1.4.report on the performance of the securities settlement system, including an assessment of the system's availability; 8.1.5. summary of the types of manual interventions performed by the Single Central Depository; 8.1.6.information on the identification of critical operations and participants of the Single Central Depository, any changes to its recovery plan and business continuity plan, stress test scenarios and results, alert thresholds, and recovery tools of the Single Central Depository; 8.1.7. information regarding the number, type, and scope of reconciliation issues identified by the Single Central Depository, both internally and in relation to participants, regulated markets, or multilateral trading systems; 8.2. annually, by 30 April, the following information and documents, referring to the previous management period (the period from 1 January to 31 December of the previous year): 8.2.1.the activity report of the Single Central Depository, which shall include at least the following: 8.2.1.1.information regarding internal inspections, audits conducted by the Single Central Depository, cases of identified conflicts of interest, and how they were managed;

8.2.1.2. the risk management framework referring to the risk management policy, impact analysis of activities, risk tolerance limits, procedures and measures for risk treatment, and the risk register; 8.2.1.3. the entity to which the activities or services of the Single Central Depository have been outsourced or the capital market infrastructure entities with which it is connected; 8.2.1.4. information regarding complaints received by the Single Central Depository; 8.2.1.5. information on civil, administrative, or any other judicial or extrajudicial proceedings in which the Single Central Depository is involved; 8.2.2.audited financial statements of the Single Central Depository; 8.2.3.the scenarios and results of business continuity stress tests or similar exercises performed; 8.2.4. report on any operational changes affecting the activities or connections of the Single Central Depository; 8.2.5.the general business strategy of the Single Central Depository for a period of at least three years from the last review, evaluation, and approval by the Single Central Depository and a detailed business plan for the services provided by the Single Central Depository for a period of at least one year after the last review and evaluation by the Single Central Depository; 8.2.6. information on agreements (contracts) concluded by the Single Central Depository, strategies, processes, and information systems implemented by it; 8.3. the report on operational incidents that have affected the proper provision of any core services, the measures taken to resolve them, as well as their results, shall be submitted to the NBM in accordance with the requirements set out in point 209.1 of Regulation No 289/2024 on the monitoring of financial market infrastructures, schemes, arrangements, and payment instruments. Section 3 CONDUCTING THE CONTROL 9. In exercising its control duties over the Single Central Depository in accordance with the provisions of Article 23, paragraph (2) of Law No 234/2016, the NBM may carry out controls: 9.1. depending on the aim of the control: 9.1.1.complex control – The Single Central Depository is subject to a full review within the limits of NBM's responsibilities; 9.1.2.thematic control – The Single Central Depository is subject to review in a specific area or areas of activity and/or the removal of violations for which remedial measures have been prescribed and/or sanctions applied by the NBM, following a previous control; 9.2. depending on the manner of execution:

9.2.1. scheduled inspection – it is carried out based on a control plan approved by the NBM; 9.2.2.unannounced inspection – it is not included in the NBM's control plan and can be initiated as a response to an event or incident that may affect the material activities of the Single Central Depository. 10. The NBM's control plan for the Single Central Depository is developed taking into account the violations detected during previous inspections, the measures taken by the Depository to cease and/or liquidate previously identified violations, the risks to which it is or may be exposed, and the complaints received by the NBM. 11. The Single Central Depository shall be subject to control at least once every three years. 12. For conducting the control, the NBM shall issue a decision on the control, in accordance with the provisions of Article 751, paragraph (3) of Law No 548/1995. The decision to carry out the control may be issued by the Governor, First Deputy Governor, Deputy Governors, or the Head of the subdivision within the NBM with oversight responsibilities for the Single Central Depository. 13. The decision to conduct the control shall contain, at a minimum, the name of the entity subject to control, the type of control, the inspectors appointed to conduct the control (hereinafter referred to as inspectors), the period subject to control, the date of initiation of control, the position, surname, first name, and signature of the person who issued the decision. 14. The decision to conduct the control shall be notified to the Single Central Depository in accordance with the provisions of points 4 to 7. 15. The NBM, simultaneously with the decision to conduct the control, shall notify the list of information/documents to be submitted on the date of initiation of control by the Single Central Depository. During the control, NBM may request additional information/documents to be submitted by the Single Central Depository, during which time the deadline for completing the control procedure shall be suspended in accordance with Article 11 paragraph (38 ) of Law No 548/1995. 16. In the case of an unannounced inspection, the decision to conduct the inspection and the list of information/documents to be submitted by the Single Central Depository shall be notified to the latter on the date of initiation of inspection. 17. The decision to conduct the inspection may be amended by issuing a decision by the persons indicated in point 12, with notification of the entity subject to control. 18. As part of the control, the NBM may carry out on-site inspections in accordance with the provisions of Article 751 paragraph (4) of Law No 548/1995 and of this Regulation.

19. The on-site inspection may be conducted on the basis of the decision regarding the control procedure, issued in accordance with the provisions of points 12-17, if it provides for the on-site inspection and the data of the on-site inspection, or on the basis of the NBM decision containing at least the information provided for in Article 751 paragraph (4) of Law No 548/1995.
20. During the inspection, meetings may be organized on matters related to the inspection, either in person or via electronic means of communication, between inspectors and governing and supervisory bodies, their members, shareholders, and employees of the Single Central Depository, with the participation, where necessary, of other persons.
21. The persons referred to in point 20 are required to cooperate with inspectors, including: 21.1. respond in a timely manner to requests made by inspectors and cooperate in good faith; 21.2. provide inspectors with the requested information, documents, and explanations, as appropriate, in electronic form, on paper, in the case of providing copies or extracts from the requested documents, confirm their conformity with the original/authenticity by signature; 21.3. to ensure, in the case of on-site inspections, access for inspectors to the premises and rooms of the Single Central Depository during working hours; 21.4. to enable inspectors to use/access data from the Single Central Depository's IT systems in accordance with the aim of the control, granting them viewing access to all IT systems, databases, IT tools, electronic files, and data necessary for this purpose.
22. In order to facilitate cooperation during the control, on the date of initiation of the control, the governing body/member of the governing body of the Single Central Depository shall determine and communicate to the inspectors the contact persons responsible on behalf of the Single Central Depository for organising interaction with the inspectors in each of the areas subject to control.
23. Inspectors have the right to: 23.1. to physically access the premises and rooms of the Single Central Depository, accompanied by employees of the Single Central Depository, if necessary; 23.2. to request and obtain all information and documents necessary to conduct the inspection (in electronic form, on paper, originals or copies, extracts from them, confirmed by signature), including articles of incorporation, regulations and other internal documents, reports and statements, internal documents drawn up as a result of the operations conducted, accounting records, external and internal business documents (contracts, certificates, minutes, requests, information notes), information and documents relating to its participants and the entities to which the activities and services of the Single Central Depository have been outsourced;

23.3. to request and obtain written explanations from the persons referred to in point 20, its participants, and the entities to which the activities and services of the Single Central Depository have been outsourced, for the purpose of gathering the information necessary for control; 23.4. to use technical means (audio, video, photo) to certify the facts established, to use technical means belonging to the NBM or provided by the Single Central Depository, including computers, other devices, electronic data carriers, copying equipment, scanners, telephones, to bring into the premises of the Single Central Depository and remove from them technical means belonging to the NBM; 23.5. to obtain access to the resources of the computer systems, electronic databases, and technical means used by the Single Central Depository for the purpose of carrying out its activities and to request a demonstration and explanation of how these systems operate; 23.6. examine accounts, registers, records, and other documents, in written or electronic form, to verify compliance by the Single Central Depository with the regulatory framework; 23.7. contact the external auditors of the Single Central Depository, interview any other person, with their consent, for the purpose of establishing the facts (events) and circumstances necessary in connection with the control, including for the purpose of confirming the data contained in the documents and information obtained from the Single Central Depository. 24. The Single Central Depository has the following rights: 24.1. to be informed of the initiation of the control; 24.2. to provide explanations and comments on the areas subject to verification during the control; 24.3. be notified of the results of the control and the decisions of the NBM issued on the basis thereof; 24.4. to submit objections and explanations regarding the preliminary act on the results of the control; 24.5. circumstances relevant to the unfavourable decision to be issued on the basis of the results of the control and to present their opinion in this regard (written hearing). 25. The persons referred to in point 20 shall not have the right to personally examine the inspectors, the technical means, including telephones, electronic data carriers in their possession, to seize these means or to prevent the inspectors from using these means when carrying out the control. 26. In the case of an on-site inspection, the documents and information requested by the inspectors shall be submitted in the manner and within the time limits specified by them. 27. As a result of the control procedure being carried out, including in cases where the exercise of the supervision and control authority is hindered, a report on

the control findings is drafted in accordance with the provisions of Article 751, paragraph (7) of Law No 548/1995 and the provisions of Section 4. 28. The control procedure is concluded within the time frame specified in Article 751, paragraph (11) or paragraph (13) of Law No 548/1995, as applicable. Section 4 DRAFTING OF THE REPORT ON THE CONTROL FINDINGS 29. The act on the results of the control, including the preliminary act, shall contain at least the following information: the date and number of the decision to conduct the control; the period of activity subject to control; the date of initiation of the control; information on the results of the control; the names, surnames, and signatures of the NBM inspectors who conducted the control. 30. The results of the control reflect (without being limited to) the aspects subject to verification; the general conclusions (assessment of the overall situation based on the violations found); the aspects found (both those that constitute violations within the meaning of Law No 234/2016 and the normative acts issued in their application, Law No 1134/1997, Law No 183/2016, as well as those that do not constitute violations but which have or may have an impact on the activity of the Single Central Depository), set out on the basis of: 30.1. analysis of information, documents, explanations received during the control, including those obtained by the NBM from public authorities and other persons, in the context of performing its supervisory duties; 30.2. facts and circumstances, including inaction relating, as the case may be, to the Single Central Depository, its governing bodies, members of governing bodies, persons holding positions of responsibility, and its shareholders. 31. In accordance with the provisions of points 4–7, the preliminary act on the results of the control shall be notified to the Single Central Depository subject to control. 32. The Single Central Depository may, within 5 working days from the date of notification of the preliminary act on the results of the control, submit in writing, in accordance with the provisions of Article 113 of Law No 548/1995, if applicable, objections and/or explanations regarding the same, attaching the relevant documents in this regard. 33. Following the examination of objections and/or explanations submitted in relation to the preliminary report on the results of the control by the Single Central Depository or in the absence of such objections and/or explanations, upon expiry of the period referred to in point 32, the report on the results of the control shall be drafted and notified to the Single Central Depository and/or, where applicable, to the persons concerned in the report, in accordance with the provisions of points 4 to 7. 34. If objections and/or explanations were submitted regarding the preliminary act on the results of the control, simultaneously with the notification of the act on the results of the control, the NBM shall notify the Single Central Depository and/or,

as the case may be, the persons concerned in the act, regarding the acceptance/non￾acceptance of the objections/explanations submitted. 35. In the event that, based on the results of the control, an unfavourable decision is to be issued for the Single Central Depository and/or, as applicable, for the persons concerned in the report, simultaneously with the notification of the report on the control findings, they are invited to present their opinion in writing, to the NBM, within 10 working days from the date of notification. The written opinion must be submitted in accordance with the provisions of Article 113 of Law No 548/1995. In this regard, the provisions of Article 11 paragraphs (34 )–(37 ) of Law No 548/1995 shall apply accordingly. Section 5 APPLICATION OF SANCTIONS, PRESCRIPTIONS, AND RECOMMENDATIONS 36. Sanctions and/or prescriptions against the Single Central Depository and/or the persons concerned in the report on the control findings, as well as the request to terminate any connections established with another Single Central Depository, are applied/issued in cases of violation of the provisions of Law No 234/2016 and/or the normative acts issued for the implementation of said law, and/or of Law No 1134/1997, Law No 183/2016, in accordance with the provisions of Law No 234/2016 and Articles 75 and 752 of Law No 548/1995. 37. The decision regarding the application of sanctions and/or the issuance of prescriptions is made by the Executive Board of the NBM, based on the examination of the control results and the opinion of the Single Central Depository and/or the persons concerned in the report on the control findings, if such opinion has been presented in accordance with the provisions of Article 11, paragraphs (34 )–(37 ) of Law No 548/1995. 38. In applying the sanctions provided for in Article 26, paragraph (2) of Law No 234/2016, the NBM will take into account all relevant circumstances, including those regulated by Article 26, paragraph (3) of Law No 234/2016 and Article 752 , paragraph (5) of Law No 548/1995. 39. The decision regarding the application of the sanction and/or the issuance of prescriptions is notified to the Single Central Depository and/or, as applicable, to the persons concerned in the decision, in accordance with the provisions of points 4– 7. 40. Information regarding the sanctions applied is published on the official website of the NBM in accordance with the provisions of Article 753 of Law No 548/1995. 41. The NBM shall have the right to address recommendations to the Single Central Depository, participants, or the entity to which the activities and services of the Single Central Depository have been outsourced, in order to request compliance

with the legal provisions, in accordance with Article 26, paragraph (1) of Law No 234/2016. 42. The NBM has the right to request the Single Central Depository to take the necessary actions or measures to remedy the situation, in accordance with Article 23, paragraph (6) of Law No 234/2016. 43. At the request of the NBM, the Single Central Depository is required to approve and submit to the NBM a recovery plan to ensure the continuity of the Single Central Depository's activities. The deadline, format, and minimum requirements for the content of the recovery plan will be specified in the NBM's request.