Securities Financing Transactions Enforcement Act (SFT-Vollzugsgesetz)

All English translation of the authentic German text is unofficial and serves merely information purposes. The official wording in German can be found in the Austrian Federal Law Gazette (Bundesgesetzblatt; BGBl.). All translations have been prepared with great care, but linguistic compromises had to be made. The reader should also bear in mind that some provisions of these laws will remain unclear without certain background knowledge of the Austrian legal and political system. Please note that these laws may be amended in the future and check occasionally for updates. FEDERAL ACT IMPLEMENTING REGULATION (EU) 2015/2365 ON TRANSPARENCY OF SECURITIES FINANCING TRANSACTIONS (SFT-VOLLZUGSGESETZ) SFTs Enforcement Act (SFT-Vollzugsgesetz) Original Version: Federal Law Gazette I no. 73/2016 Amendments Federal Law Gazette I: 73/2016; (89/2019); 5/2026. Date: 21.04.2026

SFTs Enforcement Act (SFT-Vollzugsgesetz) 2 / 10 TABLE OF CONTENTS Text.......................................................................................................................................................... 3 Purpose of this Act........................................................................................................................ 3 Supervision................................................................................................................................... 3 Penal provisions ........................................................................................................................... 3 Penal provisions with regard to legal persons ............................................................................ 4 Effective punishment of breaches ............................................................................................... 5 Disclosure of measures and sanctions ........................................................................................ 5 Reporting of breaches.................................................................................................................. 6 Reporting to the ESMA ................................................................................................................. 6 Special procedural provisions ..................................................................................................... 7 Costs ............................................................................................................................................. 7 Gender-neutral use of language .................................................................................................. 7 Enforcement................................................................................................................................. 7 References .................................................................................................................................... 7 Entry into force............................................................................................................................. 8 Transposition Notes ............................................................................................................................... 9 Article 1- Transposition Note ....................................................................................................... 9 Announcement in Federal Law Gazette I no. 89/2019 .............................................................. 10

SFTs Enforcement Act (SFT-Vollzugsgesetz) 3 / 10 TEXT Purpose of this Act Article 1. This Federal Act serves to allow Regulation (EU) 2015/2365 on transparency of securities financing transactions and reuse and amending Regulation (EU) No 648/2012, OJ L 337, 23.12.2015, p. 153 to enter into force. Supervision Article 2. (1) The FMA shall monitor compliance, as the competent authority pursuant to Article 16 (1) of Regulation (EU) 2015/2365, with the regulations in this Federal Act and Regulation (EU) 2015/2365 by financial counterparties pursuant to Article 3 (3) of Regulation (EU) 2015/2365 (financial counterparty). It shall perform this monitoring duty as a supervisory task in accordance with the relevant supervisory laws for the relevant financial counterparty, which have been issued to transpose or to allow the legal acts under Union law listed in Article 3 (3) points a) to i) of Regulation (EU) 2015/2365 to enter into force. In so doing it shall be afforded the supervisory powers and means in the same way and scope as set out in the relevant supervisory laws, that it may also make use of in the enforcement of other obligations in accordance with these supervisory laws. (2) The FMA is the collection body as defined in Article 2 point 2 of Regulation (EU) 2023/2859 pursuant to Article 3 (2) of Regulation (EU) 2023/2859 for the collection of information on a voluntary basis listed in Regulation (EU) 2015/2365. The FMA shall be empowered as the controller under data protection law pursuant to Article 4 point 7 of the General Data Protection Regulation in conjunction with this information for processing personal data in accordance with the General Data Protection Regulation. (3) The FMA may determine, by means of a Regulation, a specific format, additional meta data to be included and the submission modalities for the submission of data pursuant to para. 2, if this appears expedient taking into consideration rules under European Union law. Penal provisions Article 3. (1) Any person who, as person responsible (Article 9 Administrative Penal Act (VStG; Verwaltungsstrafgesetz 1991)) of a financial counterparty or a non-financial counterparty pursuant to Article 3 point 4) of Regulation EU 2015/2365

1. breaches the reporting obligations for securities financing transactions pursuant to Article 4(1) of Regulation (EU) 2015/2365, or
2. breaches the requirements for the retention of records pursuant to Article 4(4) of Regulation (EU) 2015/2365, or
3. reuses financial instruments in contravention of Article 15 of Regulation (EU) No 2015/2365,

SFTs Enforcement Act (SFT-Vollzugsgesetz) 4 / 10 commits an administrative offence and shall be punished by the FMA with a fine of up to EUR 5 000 000 or up to three times the amount of the gain realised or loss avoided arising from the breach, where this amount is able to be determined. (2) For the purpose of pursuing such infringements listed in para. 1, the FMA may, irrespective of the application of Article 2, exercise the powers listed in Article 22b of the Financial Market Authority Act (FMABG; Finanzmarktaufsichtsbehördengesetz), published in Federal Law Gazette I No. 97/2001. Penal provisions with regard to legal persons Article 4. (1) The FMA may impose fines against legal persons, if natural persons who acted individually or as part of a body of a legal person and who have a managerial role within the legal person on the basis of:

1. a power of representation of the legal person,
2. an authority to take decisions on behalf of the legal person, or
3. an authority to exercise control within the legal person have breached the obligations listed in Article 3 para. 1. (2) Legal persons may also be held responsible for breaches of the obligations listed in Article 3 para. 1, if such breaches by a natural person acting for the legal person were made possible by a lack of supervision or control by one of the persons referred to in para. 1. (3) The fine pursuant to para. 1 or para. 2 shall be:
4. in the case of a breach pursuant to Article 3 para. 1 no. 1 or no. 2 up to EUR 5 000 000 or
5. in the case of a breach pursuant to Article 3 para. 1 no. 3 up to EUR 15 000 000 or up to three times the amount of the gain realised or loss avoided arising from the breach, where this amount is able to be determined, or up to 10 % of the annual turnover, stated in the last available financial statement approved by the management body. Where the legal person is a parent undertaking or a subsidiary of a parent undertaking, which is required to draw up a consolidated financial statement in accordance with Directive 2013/34/EU on the annual financial statements, consolidated financial statements and related reports of certain types of undertakings, amending Directive 2006/43/EC of the European Parliament and of the Council and repealing Council Directives 78/660/EEC and 83/349/EEC, OJ L 182, 29.06.2013, p. 19, in the version of Directive 2014/102/EU OJ L 334, 21.11.2014, p. 86, then the authoritative total annual turnover is the total annual turnover of the relevant type of income according to the relevant accounting regulations, that was stated in the last available consolidated accounts approved by the competent body of the ultimate parent undertaking. Where the FMA is unable to determine or calculate the bases for the total annual turnover, then it shall estimate them. In so doing, all relevant circumstances shall be taken into account that are relevant for the estimate. (4) The FMA may refrain from imposing a fine on a person responsible to Article 9 VStG if an administrative penalty has already been imposed on the legal person for the same breach and no particular circumstances exist that prevent the possibility of refraining from imposing a fine.

SFTs Enforcement Act (SFT-Vollzugsgesetz) 5 / 10 Effective punishment of breaches Article 5. When determining the type of the sanction or measure in response to breaches of Article 4 or Article 15 of Regulation (EU) 2015/2365 as well as the calculation of the fine, where appropriate the circumstances listed in Article 23 of Regulation (EU) 2015/2365 in particular are to be taken into account. The provisions of the VStG remain unaffected. Disclosure of measures and sanctions Article 6. (1) In the case of measures and sanctions being imposed for breaches against Article 4 or Article 15 of Regulation (EU) 2015/2365, the FMA shall publish on its website the name of the natural person, financial counterparty or other legal person to whom the measures and sanctions imposed are addressed, once it has informed the relevant person about the decision, upon the basis of which the measure or sanction was imposed (disclosure). (2) If the FMA, following a case-by-case assessment of the proportionality of the relevant information, considers that the identification of the legal persons or the personal data of the natural persons would be disproportionate, or if such an announcement would jeopardise financial market stability or an on-going investigation, the FMA may either

1. only publish the decision to impose a sanction or other measure, once the reasons for not publishing it cease to exist; or
2. only publish the decision to impose a sanction or other measure on an anonymised basis in a manner in accordance with national law, where such an anonymised announcement ensures an effective protection of the personal data concerned; or
3. not publish the decision to impose a sanction or other measure, if it believes the options pursuant to no. 1 or 2 to be sufficient to ensure that: a. the stability of the financial markets is not jeopardised, or b. with regard to measures or sanctions deemed to be of a minor nature, that proportionality is preserved in publishing such decisions. If it is decided to publish a sanction or other measure on an anonymised basis, the announcement of the relevant data may be postponed for a reasonable period of time, in the case that it is expected that the reasons for anonymised publication will cease to exist during that period. (3) Paras. 1 and 2 shall not apply to decisions imposing measures that are of an investigatory nature. (4) The FMA shall be required to amend the publication pursuant to paras. 1 or 2 with information about any appeal being made as well as the findings of the appeal procedure. In addition, the FMA shall also amend the publication to include any decision in which a measure or sanction as defined in para. 1 contested by means of an appeal that is annulled. If an appeal or final right of appeal is made against an administrative decision that was published pursuant to para. 1 or 2, that is afforded suspensory effect in proceedings conducted before the Federal Administrative Court (BVwG; Bundesverwaltungsgericht) or courts of public law, then the FMA shall publish this fact in the same manner.

SFTs Enforcement Act (SFT-Vollzugsgesetz) 6 / 10 (5) The person affected by this publication may make an application to the FMA to review the lawfulness of the disclosure pursuant to para. 1 in a procedure that shall result in an administrative decision. In this case, the FMA shall announce the initiation of such proceedings in a similar manner. If, in the course of this review, it is found that the publication was unlawful, the FMA shall correct the publication or, at the request of the person subject to this publication, either revoke it or remove it from its website. (6) The FMA shall notify ESMA about sanctions pursuant to para. 1, which have been imposed, but which have not been announced pursuant to para. 2 no. 3, as well as all appeals in conjunction with sanctions and the outcomes of appeal procedures. (7) The FMA shall publish every disclosure issued pursuant to this provision on its official website for a period of five years. The publication of personal data shall however only be maintained while none of the criteria pursuant to para. 2 nos. 1 to 3 would be met. Reporting of breaches Article 7. (1) The FMA shall have the effective mechanisms listed in Article 24 (2) of Regulation (EU) 2015/2365 in place, to encourage the notification of breaches or the suspicion of a breach that infringes against Article 4 or Article 15 of Regulation (EU) 2015/2365. (2) Financial counterparties shall have effective procedures in place, that permit their staff members to report breaches within their company, while ensuring that their identity remains confidential, that contravene Article 4 or Article 15 of Regulation (EU) 2015/2365. (3) Employees who report breaches against Article 4 or Article 15 of Regulation (EU) 2015/2365 either by means of an internal procedure or by reporting them to the FMA, shall neither be allowed as a consequence

1. to be disadvantaged, in particular in relation to their salary, professional promotion, in relation to training and education programmes, by being moved internally or by having their employment terminated, nor
2. to be held responsible in accordance with regulations under penal law, unless the report was intentionally falsely submitted. The employer or a third party shall only have a claim for compensation in the case of a report that was clearly incorrect, made by the employee had made with intention of causing damage. The authorisation to make such reports shall not be allowed to be contractually restricted. Agreements to the contrary shall not be effective. Reporting to the ESMA Article 8. (1) The FMA shall submit an annual summary to ESMA about all administrative penalties and other measures imposed pursuant to Article 3. (2) The FMA shall inform ESMA about every disclosure pursuant to Article 6 para. 1 at the same time as the disclosure.

SFTs Enforcement Act (SFT-Vollzugsgesetz) 7 / 10 Special procedural provisions Article 9. (1) In the case of administrative penal proceedings pursuant to Article 3 para. 1 and Article 4 paras. 1 and 2, a limitation period of 18 months shall apply instead of the limitation period specified in Article 31 para. 1 VStG. (2) For the enforcement of an administrative decision in accordance with this Federal Act or Regulation (EU) 2015/2365 the amount of EUR 30 000 shall replace the amount specified in Article 5 para 3 of the Administrative Enforcement Act (VVG; Verwaltungsvollstreckungsgesetz 1991), published in Federal Law Gazette No. 53/1991. (3) Fines imposed by the FMA pursuant to this Federal Act shall be passed on to the Federal Government. Costs Article 10. The costs of the FMA arising from its activity as the competent authority shall be assigned

1. to the appropriate accounting group pursuant to Article 19 FMABG or,
2. to the appropriate sub-accounting group, where sub-accounting groups are to be established within the accounting group in accordance with the Federal Act to which the performance of supervisory tasks is assigned in accordance with the relevant supervisory laws for the relevant financial counterparty, which have been issued to transpose or to allow the legal acts under Union law listed in Article 3 (3) points a) to i) of Regulation (EU) 2015/2365. Gender-neutral use of language Article 11. Where expressions in this Federal Act relating to persons are given only in the masculine form, they shall refer equally to men and women. The respective gender-specific form shall be used when applied to specific persons. Enforcement Article 12. The Federal Minister of Finance shall be responsible for enforcing this Federal Act. References Article 13. (1) Where references to other Federal Acts are made in this Federal Act, those acts are to be applied in their respective current versions. (2) Where references are made in this Federal Act to Regulation (EU) 2016/679, then, unless specified otherwise, Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation), OJ L 119, 04.05.2016. p. 1, as amended by the corrigendum in OJ L 74, 04.03.2021, p. 35, shall apply.

SFTs Enforcement Act (SFT-Vollzugsgesetz) 8 / 10 (3) Where reference is made in this Federal Act to Regulation (EU) No 2023/2859, then, unless otherwise specified, Regulation (EU) No. 2023/2859 establishing a European single access point providing centralised access to publicly available information of relevance to financial services, capital markets and sustainability, OJ L 2023/2859, 20.12.2023, p. 1, in the version of the Directive (EU) 2024/1760, OJ L 2024/1760, 05.07.2024, shall apply. Entry into force Article 14. (1) This Federal Act shall enter into force on the following day after publication. (2) Administrative penalties pursuant to Article 3 may only be imposed by the FMA for breaches in contravention of Article 4 (1) of Regulation (EU) 2015/2365, that have been committed after the time at which Article 4 (1) became effective for the respective counterparty listed in Article 33 (2) point a) subpoints i to iv of Regulation (EU) 2015/2365. The Federal Minister of Finance shall publish the dates listed in the first sentence of this paragraph in Part I of the Federal Law Gazette. (3) Article 4 para. 4 and Article 9 paras. 1 and 2 in the version of the Federal Act published in Federal Law Gazette I No. 107/2017, shall expire at the end of 2 January 2018. (4) Article 2 paras. 1 to 3, Article 13 paras. 1 to 3 in the version of the Federal Act published in Federal Law Gazette I No. 5/2026 shall enter into force on the following day after publication. Article 2 paras. 1 to 3 in the version amended by Federal Act in Federal Law Gazette I No. 5/2026 shall apply from 10 January 2030. The FMA shall inform ESMA by 9 January 2030 that it is the collection body pursuant Article 3 (2) of Regulation (EU) 2023/2859 for the collection of information on a voluntary basis listed in Regulation (EU) 2015/2365.

SFTs Enforcement Act (SFT-Vollzugsgesetz) 9 / 10 TRANSPOSITION NOTES Article 1- Transposition Note (Note: from Federal Law Gazette I No. 107/2017, re: Articles 4 and 9, Federal Law Gazette I No. 73/2016) This Federal Act transposes the following legal acts of the European Union:

1. Directive 2014/65/EU of the European Parliament and of the Council of 15 May 2014 on markets in financial instruments and amending Directive 2002/92/EC and Directive 2011/61/EU, OJ L 173, 12.06.2014, p. 349, last amended by Directive (EU) 2016/1034, OJ L 175, 23.06.2016, p. 8, as amended by the corrigendum, OJ L 64, 10.03.2017, p. 116;
2. Delegated Directive (EU) 2017/593 supplementing Directive 2014/65/EU with regard to safeguarding of financial instruments and funds belonging to clients, product governance obligations and the rules applicable to the provision or reception of fees, commissions or any monetary or non-monetary benefits, OJ L 87 p. 500. Furthermore, this Federal Act also serves for the effective enforcement of the following legal acts of the European Union:
3. Regulation (EU) No 600/2014 on markets in financial instruments and amending Regulation (EU) No 648/2012, OJ L 173, 15.05.2014, p. 84, most recently amended by Regulation (EU) No 2016/1033, OJ L 175, 23.06.2016, p. 1;
4. Commission Delegated Regulation (EU) 2017/565 supplementing Directive 2014/65/EU as regards organisational requirements and operating conditions for investment firms and defined terms for the purposes of that Directive, OJ L 87, p. 1;
5. Commission Delegated Regulation (EU) 2017/567 supplementing Regulation (EU) No 600/2014 of the European Parliament and of the Council with regard to definitions, transparency, portfolio compression and supervisory measures on product intervention and positions, OJ L 87, p. 90.

SFTs Enforcement Act (SFT-Vollzugsgesetz) 10 / 10 Announcement in Federal Law Gazette I no. 89/2019 (in relation to Article 14 para. 2) FEDERAL LAW GAZETTE FOR THE REPUBLIC OF AUSTRIA Volume for 2019, Issued on 27 September 2019, Part I No. 89. Announcement: Entry into force of the Securities Financing Transactions (SFT) Enforcement Act (SFT-Vollzugsgesetz) No. 89. Announcement by the Federal Minister of Finance regarding the entry into force of the SFT Enforcement Act (SFT-Vollzugsgesetz) 1 Pursuant to Article 14 para. 2 of the SFT Enforcement Act (SFT-Vollzugsgesetz), published in Federal Law Gazette I No. 73/2016, most recently amended by Federal Act in Federal Law Gazette I No. 107/2017, it is hereby announced: Delegated Regulation (EU) 2019/356 supplementing Regulation (EU) 2015/2365 with regard to regulatory technical standards specifying the details of securities financing transactions (SFTs) to be reported to trade repositories entered into force on 11 April 2019. Administrative penalties pursuant to Article 3 of the SFT-Vollzugsgesetz shall therefore only be allowed to be imposed by the Austrian Financial Market Authority (FMA) for breaches against Article 4(1) of Regulation (EU) 2015/2365, which were committed by:

1. the counterparty listed in Article 33 (2) lit. a sublit. i of Regulation (EU) 2015/2365 after 11 April 2020,
2. the counterparty listed in Article 33 (2) lit. a sublit. ii of Regulation (EU) 2015/2365 after 11 July 2020,
3. the counterparty listed in Article 33 (2) lit. a sublit. iii of Regulation (EU) 2015/2365 after 11 October 2020, and
4. the counterparty listed in Article 33 (2) lit. a sublit. iv of Regulation (EU) 2015/2365 after 11 January 2021. Müller 1 This announcement replaces the announcement published in Federal Law Gazette II No. 267/2019