Capital Market Corporate Governance Code 2024

1 THE CAPITAL MARKET CORPORATE GOVERNANCE CODE N°___, 2024 Pursuant to Law Nº 057/2021 bis of 18/09/2021 establishing the Capital Market Authority of Rwanda, especially in Article 9; Pursuant to the Law N°01/2011 of 10/02/2011 regulating the Capital Market Business as modified to date, Pursuant to the Law N° 062/2021 du 14/10/2021 regulating the Collective Investment Schemes, especially in articles 7 and 8; Having reviewed the Capital Market Governance Code N° 09 of 02/07/2012 The Capital Market Authority hereinafter referred to as the “Authority”, decrees: Introductory Statement This Code comprises a set of requirements aimed at improving and guiding the governance practices of organisations in Rwanda, including sustainability governance, especially those matters related to environmental and social matters. It forms part of a larger body of existing laws, rules, regulations, principles and best practices that include: • Laws of Rwanda; • Regulations; • Listing rules (e.g., the Listing Rules for the Rwandan Stock Exchange); • Standards, guidelines and codes of best practice rules and provisions (e.g., company by laws); • Formal documents within an organisation (e.g., Board charters and company policies); Article 1: Purpose of the code The purpose of this code is to provide minimum standards to ensure that companies are directed and governed by the board in a manner that is responsible, accountable, fair and transparent to the company’s stakeholders and that the board ensures value creation, company sustainability and resilience in the long￾term. In this purpose, the board must be supported by the chief executive officer and management. The Code provides for the adoption of standards that go beyond the minimum standard required by legislation. Article 2: Scope of the code All listed companies and all issuers of securities to the public or section of the public, regardless of the nature of their business, their shareholders and other stakeholders, shall apply the provisions of the Code and explain how the company has applied the provisions (apply and explain’). Companies that intend to issue securities to the public or section of the public, other public companies, state-owned companies, private companies and small and medium sized enterprises are all encouraged to adopt the provisions of the code. Article 3: Application and accountability for code application All issuers of securities to the public in Rwanda are required to apply this code. All entities under this Code shall apply the Code provisions and explain in annual reporting how they have applied the Code provisions. The board must fully disclose any non-compliance with this Code and the steps and time frame to full compliance.

2 The board of directors of each issuer shall be responsible for formulating policies, procedures and guidelines which ensure that all directors and senior management are made fully aware of the requirements of this Code. Article 3: Definitions for interpretation of the code In this Code, unless the context otherwise requires: “Auditor” means an external auditor that is a member of the Institute of Certified Public Accountants of Rwanda; “Authority” means the Capital Market Authority; “Board” means the board of directors which is the governing body of the institution; “Board Charter” means a document outlining the role and responsibilities of the board of directors, powers of the board, various board committees and their roles, separation of roles between the board and management and the policies and practices of the board in respect of governance matters, including sustainability matters. “Code of Ethics and Conduct” is a company policy document delineating expected level of ethical behaviour from all associated with the company (directors, management, employees, customers, suppliers and other stakeholders). The Code should be clear and require compliance with all applicable laws and regulations. It should also state expected standards of behaviour on issues such as: confidential information, exhibiting corporate values in every aspect of business behaviour, relationships with government, officials, regulators, and with competitors, whistleblowing and grievance arrangements, use and care of company assets and property, disclosure of potential conflicts of interest, handling of external gifts, donations, observance of all applicable laws and regulations and behaviour towards stakeholders; “Company” means a company as defined under the law governing companies; “Company secretary” is a company’s employee or consultant with a professional background, relevant education, training or certification and experience as a company secretary, appointed by a competent authority and responsible, among other things, for ensuring that the company’s business activities comply with the provisions of law and this Code; “Companies within company group structures” are companies with parent or subsidiary companies, i.e. part of a company group; “Confidential information” means all non-public information relating to the company from whatever source; “Corporate governance” means the ethical and effective leadership of the company for the direction and control of the company. It includes the set of relationships between a company’s board, its management, its shareholders and other stakeholders, the structures through which the objectives of the company are set, the means of attaining those objectives and the monitoring of performance for the ultimate objective of realizing long-term shareholder value. The term corporate governance includes the governance of environmental and social matters; “Director", a member of the board of directors, whether a shareholder or not, being appointed by shareholders to oversee management of a company; “Disclose” refers to public disclosure in the annual report of the company and/or on the company’s website; “ESG” means a set of environmental, social and governance matters which companies should consider; “Executive directors” are persons who are appointed to the board and who concurrently hold a senior management position in the company. For the avoidance of doubt, it includes the CEO, general manager,

3 managing director, and/or other officers of the company who may from time to time, be appointed as directors of a company; “General meeting” includes the annual general meeting (AGM) and extraordinary general meetings (EGM) of shareholders; “Immediate family member” means family members (maternal and paternal) of directors and senior executives to the first, second and third degree, including the spouse or spousal equivalent, parent, parents￾in law, siblings, children, aunts, uncles and cousins and their spouses or partners of the director or senior executive; “Independent director”, means a director who has no direct or indirect material pecuniary relationship with the company other than membership on the board and who is free from any interest, position, association or relationship which would be or would appear to be an undue influence or might cause bias in decision￾making, whether directly or indirectly. The independent director is compensated only through sitting fees or allowances. The independent director: (a) is not, and has not been in the past three (3) years, employed by the company or its affiliates; (b) is not a nominated director representative of a substantial shareholder of the company or its affiliates; (c) does not have close family ties with any of the advisers, directors or senior employees of the company or its affiliates; (d) is not a significant provider of financial capital to the company or its affiliates and/or hold shares representing more than 2% of the total share capital or outstanding voting power; (e) does not have, and has not had in the past three (3) years, a material business relationship with the company or its affiliates (either directly or as a partner, shareholder (other than to the extent to which shares are held by such director), and is not a director, officer or senior employee of a person that has or had such a relationship); (f) is not, nor has been at any time during the past three (3) years the designated external auditor responsible for the performance of the statutory audit nor has been a key member of the audit team during the preceding three (3) years of the company or any of its affiliates; (g) is not nor has been during the past three (3) years a director or member of management of a significant customer or supplier of the company or its affiliates; (h) is not affiliated with any non-profit organization that receives significant funding from the company or its affiliates; (i) does not receive and has not received in the past three (3) years, any additional remuneration from the company or its affiliates other than his or her director’s fee and such director’s fee does not constitute a significant portion of his or her annual income; (j) does not participate in any share option plan or pension plan or incentive scheme of the company or any of its affiliates;

4 (k) is not employed as an executive officer of another company where any of the company’s executives serve on that company’s board of directors; (l) does not hold a material interest in the company or its affiliates (either directly or as a partner, shareholder, director, officer or senior employee of a person that holds such an interest); (m) is not a member of the immediate family (and is not the executor, administrator or personal representative of any such person who is deceased or legally incompetent) of any individual who would not meet any of the tests set out in other parts of this definition (where he or she a director of the company); (n) is identified in the Annual Report of the company distributed to the shareholders of the company as an independent director; and (o) has not served on the board for a continuous period of more than nine (9) years. “Interested party” (also called “Related party/ies”) in relation to a transaction or proposed transaction refers to a person or entity in respect of whom the following is true: a) is a party who will or is perceived to derive a material financial or other benefit from the transaction; b) has a material financial or other interest in another party to the transaction; c) exercises control or joint control or significant influence over a party to the transaction; d) is a member of the board of directors, officer or trustee, key management of another party to, or person who will or may derive a material financial benefit from, the transaction, not being a party or person that is: i. the company's holding company being a holding company of which the company is a wholly-owned subsidiary; ii. a wholly-owned subsidiary of the company; iii. a wholly-owned subsidiary of a holding company of which the company is also a wholly￾owned subsidiary; e) is an immediate family member of another party to, or person who will or may derive a material financial or other benefit from the transaction; f) is otherwise directly or indirectly materially interested in the transaction. “Internal control system” means a coordinated set of policies, procedures, tasks, behaviours and rules that serve as the controls governing the effectiveness of the company’s organisational and operational structure, including reporting processes, the functions for risk management, compliance and internal audit. The system is effected by the board, management and other personnel and is designed to provide reasonable assurance regarding the achievement of effective and efficient operations, reliability of financial reporting and compliance with applicable laws and regulations including the rules of an approved exchange or authority;

5 “Issuer of securities” means an issuer which is a legal entity that develops, registers and sells securities to finance its operations. Issuers may have a variety of legal status. “Listed company” means that the securities of the company in question have been accepted for listing on an approved exchange; “Listings Rules” means the listings rules as contained in the Rwanda Stock Exchange Rule Book or other Authorities rules as applicable from time to time; ” Management” includes the chief executive officer (CEO) or managing director, executive directors and the senior managers of the company involved in the day-to-day activities of the company; “Material information/matters” includes all information or matters that if its omission, obscuring or misstatement could be reasonably expected to influence assessment of company value, investor decisions or the price of securities. “Non-executive director” is a director who does not form part of the management team of the company and who is not an employee of the company or affiliated with it in any other way, but who can own shares in the company; “Private company” means as defined in the Law Governing Companies; “Public company” means as defined in the Law Governing Companies; “Publish” means to make public on the company website and thus enable public access to the document/information; “Share” means one of the equal parts into which a company’s capital is divided, being issued to every shareholder or the company itself; “Shareholder” is a person whose name is entered on the share register as the holder for the time being of one or more shares in the company; “Stakeholders” are specific to each company and are those individuals or groups that can affect or be affected by a company’s operations and typically may include investors, employees, customers. suppliers, community, government and regulators; “Sustainable development” means to develop in such a way as to meet the needs of the present without compromising the ability of future generations to meet their needs; “Sustainability” is the result of sustainable development and as applied to business means that the company’s long-term success lies in creating value, performing well financially, socially and environmentally. The integration of sustainability into strategy, governance and performance creates value over time. Sustainability applied to companies creates both risks and opportunities which may affect the company’s long-term performance. “Unlisted” means that the securities of the company in question are not listed on a securities exchange approved by the Authority. CHAPTER I: THE BOARD, BOARD COMMITTEES and GOVERNANCE Article 4: Ethical and effective board Every company must be led by an ethical and effective board of directors which is accountable to the shareholders and other stakeholders, including creditors and employees of the company. The board must ensure that all management decisions are made in accordance with prudent corporate governance practices. The shareholders of each institution are responsible for the appointment of a competent and dedicated board of directors.

6 The board is collectively responsible for promoting the success of the company by directing, supervising and controlling the company's affairs. For the avoidance of doubt, the board must act collectively, and no individual director has the power or authority to make binding decisions or to act without agreement by or formal delegation from the board. Directors have legal duties that include that they must: - a. act in good faith in a manner that the director on reasonable grounds believes to be in the best interest of the company; b. exercise care, diligence and skills reasonably to be expected of a director in the same circumstances; c. exercise power for proper purpose; d. act in loyalty to the company, which includes using company information acquired by virtue of the director’s position and company opportunities, in the interest of the company and not to gain personal benefit for the director or another person or entity. e. the board's governance responsibilities must be formally articulated in a board charter and published on the company website and must include to: - f. set the company's purpose, values and standards for ethics and conduct and ensure that these are formalised in writing and monitored; g. act with integrity, promote a desirable culture, provide entrepreneurial leadership and direction to management and to monitor the effectiveness of the company’s ESG and other policies and practices; h. ensure high quality governance policies are applied, reviewed and monitored, including if relevant, across a broader company group structure; i. ensure clear division of responsibilities between the board and those of management; j. Ensure board decision making takes into account the interests of stakeholders; k. Review, guide and approve strategy that ensures that environmental and social opportunities and risks are taken into account to ensure the company creates value and contributes to sustainable development; l. Ensure that the approved strategy is expressed in a business plan and budget with agreed targets (including targets on the management of environmental and social risks and opportunities) and that the implementation of the business plan and budget and progress against targets are monitored and overseen; m. govern the risks of the company by establishing an effective risk management framework and policies in a way that supports the company in achieving its strategic objectives; n. ensure that a prudent and effective internal control system exists, and that adequate assurance functions and services are established to monitor and assess the effectiveness of such internal controls; o. oversee compliance with applicable laws, regulations and non-binding rules, codes and standards that have been adopted by the company;

7 p. establish, approve and publish on the website a Code of Ethics and Conduct; q. establish a written Delegations of Authority framework, which includes any board delegations to board committees and to management as required, without abdicating accountability, and includes a clear statement of powers the board reserves only unto itself; r. the Delegation of Authority framework articulates the powers delegated to management via the CEO and is clear about the powers of the CEO to further delegate. s. annually set performance requirements of the CEO for financial and operating goals, review the CEO and management’s performance and determine fair and responsible remuneration; t. ensure that it balances the interests and expectations of shareholders and other stakeholders in the best interest of the company over time; u. ensure that the company issues report that enable shareholders and other stakeholders to make an informed assessment of the company’s structure, governance, strategy and risks, performance and prospects. Directors must be competent and have the character traits and attributes to carry out their legal and governance duties. As a guide, the following characteristics, and professional competencies are to be exhibited: a. Integrity in personal and professional dealings; b. Exercise of sound judgement in the best interest of the company; c. Sufficient working knowledge to interpret and analyse financial statements and understand the financial implications of decisions; d. The business acumen and industry knowledge to effectively contribute as a director; e. Ability to exercise duties in a fair, transparent, responsible and accountable manner; and f. Ability to challenge management constructively. Each director must be able and prepared to devote sufficient time and effort to the exercise of the duties as a director. To ensure a director has sufficient time to undertake his or her duties, an individual director must not hold directorships in more than 3 (three) boards of public listed companies. Each director must add value to the board and, bring independent and objective judgment to bear on the exercise of duties and decision making regardless of whether classified as an independent director or not. The board should approve a process to obtain, outside legal or other professional advice at the company's expense on any matter deemed necessary for a director or the board to effectively perform its duties. Every director, officer or senior manager of the company must at least once a year or immediately when changes take place submit to the board a declaration of financial, economic and other interests held by the director as well as that of immediate family members to the extent that these are known. This information will form part of the register of interests of the company. Immediate disclosure is required by every director,

8 officer or senior manager of any interest, direct or indirect, in any transaction or arrangement with the company. Participation in the transaction or arrangement is precluded. Article 5: Composition of the board for the effective discharge of duties The size of the board must be large enough to support the board committee structure. As a guide, the international benchmark for a one-tier board sizes range from 7 to 11 directors, depending on the size, nature and complexity of the operations of the company. As a guide for smaller enterprises a board of 3 to 5 directors may be suitable The board collectively should have an appropriate balance of knowledge, skills, experience and independence for effective discharge its duties and setting and achieving of the strategic objectives of the company. In the interest of accountability and balance of power at least half the board must comprise non-executive directors, with at least one third of the board being independent directors. A quorum for board meetings must comprise one-third independent directors. At least two members of the board must be executive directors for the board to have direct interaction with and contribution from more than one member of executive management. One such director must include the CEO. The board should have a goal and policy to achieve diversity and inclusion in its membership across a variety of attributes such as gender, age and professional backgrounds to promote constructive challenge and depth of decision-making. Article 6: Formal and transparent director appointment and election process The nominating committee shall oversee the establishment of a formal and transparent nomination process to identify suitable director candidates for board appointment or election by shareholders. The nominating committee should require that all candidates who seek to be appointed as director submit at least the following information for consideration by the nominating committee: a. Qualifications; b. Knowledge, skills and experience; c. Current directorships or other active involvement in other public, private, listed and unlisted companies or entities; d. Any interests in the company; e. In the case of independent directors, any other affiliation that may affect the director's ability to make independent and impartial decisions; and f. A clear statement from the nominee that there has not been in the past three years or is not currently any disqualification from serving as a director.

9 The board must provide to all shareholders at least the information in the preceding paragraph as submitted by the nominated candidates. This information will assist shareholders to vote in an informed way. Prior to their nomination for election or appointment, candidates’ backgrounds must be independently investigated, and their qualifications must be independently verified. This must include ensuring that the candidate is not disqualified from serving as director under the Law Governing Companies. No term limit will be set for directors of listed companies generally. Independent directors and their years of service on the board shall be clearly disclosed in the Annual Report. In the interest of maintaining independence, it is strongly recommended that independent directors do not continue as directors for more than 9 (nine) years. If an ‘independent’ director has been on the board for 9 years or more, the board should review the director’s independence and attest in the Annual Report why the director may remain designated as ‘independent’. The Board must ensure there is a succession plan policy in place which includes that one-third of the board should retire by rotation to ensure continuity and board refreshment. Upon election or appointment, the terms and conditions for serving as director must be formalised in a letter of appointment and the appointed director must undergo a formal induction programme as provided for in this code. The nominating committee must review annually whether the size and composition of the board contributes to the board’s effective discharge of duties and the company’s strategic direction. If any of the non-executive directors and independent directors is offered an appointment elsewhere, the chairperson of the nominating committee should be informed before any new appointments are accepted and all appointments should be included by the director in the declaration of interests register. Article 7: Chairperson’s contribution to an effective board The chairperson and CEO must be separate persons, to ensure an appropriate balance of power and increased accountability. The chairperson must meet the criteria for being classified as an independent director. The division of responsibilities between the chairperson and CEO must be clearly established and set out in writing in the board charter. The chairperson's role includes but is not limited to the following: a. lead the board to ensure that it is ethical and effective and that it maintains high standards of governance; b. guide the development of the annual workplan of the board and the setting of its agenda for each meeting; c. ensure that the board receives accurate, timely and clear information to discharge its duties; d. encourage constructive working relationships between the board and management with each respecting the other’s duties and responsibilities;

10 e. ensure the effective contribution of non-executive directors during and outside of board meetings to facilitate robust and informed oversight and decision-making. Article 8: Companies in company groups Parent or holding companies of company groups shall adopt and monitor application of governance policies and practices at the individual entity level within the group to ensure corporate governance best practices as required by this Code is applied across the whole group. Disclosure of the group structure, including company capital structure, control arrangements and communications with group entities and monitoring activities by the group board over group entities is required. Article 9: Company secretary as professional governance advisor to the board Companies must employ a professionally qualified company secretary to perform the duties as set out in the law governing companies and to provide support and guidance to the board and directors on their responsibilities. In the event that the board cannot justify the cost of a full-time in-house company secretary, the function may be performed by an external service provider subject to the provider being independent and not also the auditor, company lawyer, or other advisor to the board. The company secretary must keep an annual record of the company's compliance with this code and all other relevant laws. Article 10: Induction and ongoing professional development of directors to ensure competent boards Companies need to recognise that a directorship is a professional appointment and therefore they should provide the opportunities and funds for training and the development of directors. New directors must be provided with orientation as well as training on the law, corporate governance, accounting rules and other business matters as may be appropriate. The orientation and training should be accompanied with site visits, interviews with executive management and attendance at conferences as may be necessary to familiarise new directors with the operations of the company, its industry, current financial position, strategy, risks and business model. On a continuing basis and in any event at least once a year, the board should undertake a refresher course on the latest developments in the relevant industry, corporate governance, relevant laws, accounting and tax matters as offered by a reputable service provider. Article 11: Delegation to board committees for effective and objective discharge of duties Subject to the Law Governing Companies, the board is entitled to delegate to board committees without abdicating accountability. All board committees must be established with a written and publicly disclosed charter or terms of reference that addresses membership, role and responsibilities, meeting procedures and quorum for decisions. The terms of reference of each committee should clearly state which areas are delegated to the committee. Decisions are reserved for the board on recommendations of the committees. The board may establish other board committees, beyond the three committees mandated below to support its work.

11 (a) Nominating Committee The board must establish a nominating committee which will ensure a robust, transparent process for the nomination for election and appointment of directors. Nomination of directors for election by the shareholders should be made subject to recommendation or approval by the board. The nominating committee must comprise at least three (3) non-executive directors, a majority of whom must be independent. The Chairman of the Nominating Committee shall be an independent director. (b) Remuneration Committee The board must establish a remuneration committee to oversee the remuneration of management and non￾executive directors as well as a company-wide policy on employee remuneration. If the size of the board is an impediment to this, then this role may be undertaken by the nominating committee. The remuneration committee must comprise of at least three (3) directors, with at least one independent director. (c) Audit Committee The board must establish an audit committee with composition and duties compliant with the Law Governing Companies, this Code and with its charter. The audit committee must comprise at least three (3) directors, the majority of whom are independent directors. All companies should aspire to the majority of the Audit Committee members being independent directors. The chairperson of the audit committee must be independent and must be a financial expert, and have the relevant qualifications and experience in auditing, finance or accounting and be a member of a professional body in good standing. The board must ensure that the members of the audit committee are financially literate and collectively have the required accounting, auditing or related knowledge and experience for the execution of the duties of the committee. The audit committee should meet at least once every quarter or as often as is necessary for the effective discharge of its duties, especially with regard to reporting responsibilities.

12 Article 12: A Remuneration Policy to ensure fair and responsible reward system There must be a formal and transparent policy on fair and responsible remuneration for management and company-wide employee remuneration. No person shall be involved in deciding their own remuneration. The remuneration committee must recommend for board approval a remuneration policy which attracts, retains and motivates management to run the company successfully, whilst being fair and responsible. The performance-related elements of remuneration should form a significant proportion of the total remuneration of management and should be designed to incentivise high performance without excessive risk-taking. Performance measures should address not only economic or financial performance dimensions but also governance, environmental and social performance dimensions. The fees for non-executive directors should reflect the time commitment and responsibilities of the role and be commensurate with being a professional non-executive director. The remuneration committee should be aware of what comparable companies are paying and should take account of relative performance. Article 13: Evaluation of board for continued improvement Annually, the board must undertake the evaluation of its own performance and that of individual directors and board committees, including the performance of the chairperson. This is to check that it is operating effectively, and seeks continuous improvement. The evaluation process should be overseen by the nominating committee or a designated committee as agreed by the board and be followed with improvement plans. The board may also consider using an independent service provider to conduct an external evaluation of the performance of the board, directors and board committees, who would make recommendations for improvements based on its evaluation. Article 14: Relationship between Board and CEO The board must appoint the CEO and the CEO is accountable to the board. The board must determine the remuneration associated with this position and has the authority, if necessary, to dismiss the CEO after having followed due process. The board must empower the CEO to lead the executive management team and to implement and execute strategy, risk management, company policies and operational planning. Annually the board must formally evaluate the performance of the CEO against previously agreed performance measures and targets. The board may instruct management to attend board meetings as standing invitees or on an ad hoc-basis, as required, to provide information deemed necessary to effectively deliberate on decisions and perform its duties.

13 Article 15: Conflicts of Interest Directors, managers and employees must make best efforts to avoid conflicts of interest and perceptions of conflicts of interest. Personal interests shall not take precedence over company interests. The company must develop a board-approved Conflict of Interest policy, applicable by all directors and employees and published on the company website. Management must ensure conflicts are identified, disclosed, managed, monitored and reported. Each director and senior manager must disclose at least annually his/her interests to the company to be included in the company register of interests. Each director or senior manager is responsible for keeping his/her interests as stated in the register current (see also Article 4.2). If a director or senior manager is an interested party in a transaction or proposed transaction with the company, each director or senior manager must disclose first to the board the nature and extent of the interest, and, where it can be quantified, the monetary value of such interest. In such circumstances, the director or senior manager must not participate in any decision or seek to influence any decision in the matter. Transactions between interested or related parties (RPTs) always have the potential to be unfair or abusive and so must be regulated, scrutinized and subject to rigorous review. The board must develop, approve and publish on its website a Related-Party Transactions policy, requiring all transactions with the company must be at arm’s length, on commercial terms and conditions and RPTs be subject to review and (dis)approval processes and publicly disclosed in the Annual Report. All directors must maintain the confidentiality of non-public information entrusted to them that comes to them in the course of their activities as directors from whatever source. CHAPTER II: MANAGEMENT MATTERS Article 16: CEO and management The CEO must ensure that day-to-day business affairs of the company are appropriately managed and monitored, that key management functions are headed by an individual with the necessary competence and authority to fulfil the specified role and that these functions are adequately resourced. The board must oversee adequate succession planning in place for executive management and other key positions to provide continuity in leadership. The CEO must develop and recommend to the board a long-term vision and strategy for the company that will generate satisfactory levels of shareholder value and positive reciprocal relations with relevant stakeholders. The CEO must develop and recommend to the board annual business plans and budgets to support the company’s long-term strategy. The CEO and management must ensure proper processes for identification and assessment of the risks to the achievement of the company strategies, and report regularly to the board on the management and mitigation of these risks. Leadership of the risk management function must be assigned to an executive experienced in risk management.

14 The CEO should maintain a positive and ethical work environment conducive to attracting, retaining and motivating a diverse group of employees and management. CHAPTER III: RISK, AUDIT AND INTERNAL CONTROL Article 17: Risk management that supports achievement of company objectives The board is responsible for an effective risk management system or framework and to ensure the company develops and executes a comprehensive and robust system of risk management including effective IT governance. The risk framework should include the systematic and continuous identification, assessment and prioritisation of material risks as well as the design and implementation of effective and efficient risk responses. The use of tools for performance measurement of risks and risk mitigation are recommended. Management must ensure the effective operation of the risk management system. The board must determine the overall risk appetite for the company and communicate this to management, receive regular reports on risk management and monitor the effectiveness of the risk management system. The board must regularly review and consider and report on foreseeable risks and that there are appropriate risk responses in place. In large companies and companies with more complex business models and activities, the board should consider the introduction of a separate board committee to monitor and oversee risk. Article 18: Internal Audit that contributes to effective internal controls All listed companies must have a well-resourced and competent internal audit function for the company to provide an independent objective assurance to the board on the efficiency and effectiveness of company operations, including the evaluation of risk management, control and governance processes. The internal audit plan should include a review of compliance with laws, regulations and relevant company policies. The audit committee must recommend to the board the appointment and removal of the head of internal audit as well as the remuneration for this position. The internal audit function must have an Internal Audit Charter, have a broad scope of work to investigate all levels of the company and be independent from management. For this reason, the internal auditor's primary line of reporting must be to the chairperson of the audit committee with reporting administratively to the CEO or the CFO. The audit committee must approve the internal audit scope and plan prior to the commencement of each financial year, review all internal audit reports and monitor management's responsiveness to internal audit findings. The audit committee must, at least annually, assess the effectiveness of the internal audit function, including the adequacy of its resources. Article19: External audit for integrity of reporting The audit committee must have primary responsibility for making recommendations to the board on the appointment, re-appointment and removal of the external auditor and approving the remuneration and the terms of engagement of the external auditor.

15 Shareholders have the right to elect and vote on the appointment of the external auditor. The appointment of the external auditor should be recommended to shareholders by the audit committee and the board, and must be voted on by the shareholders at the annual general meeting. The external auditor, the Audit Engagement Partner, must be independent, well qualified to carry out his duties, and be free of actual and perceived conflicts of interests. Audit firms must not be engaged in accounting or other non-audit services that place them in a position where they audit the output of their own work. The Audit Engagement Partner, the Audit Team and the Engagement Review Partner must be independent from the company being audited and particularly not hold shares in the company. The audit committee must review the competence, independence and objectivity of the external auditor annually. The audit committee should meet with the external auditor at least once a year without management being present to facilitate frank discussion. The external Audit Engagement Partner for a listed company must be rotated every 5 (five) years. Article 20: Effective internal controls framework The audit committee must ensure that management establishes and maintains a sound system of internal controls that effectively manages risks. The audit committee must, at least annually, review the adequacy of the company's internal financial controls, operational and compliance controls, and risk management policies and systems established by management. CHAPTER IV: SHAREHOLDER RIGHTS Article 21: Fostering shareholder relationships that enhances accountability To address the concern that shareholders are not aware of or do not understand their rights, companies must inform shareholders as to their rights and responsibilities and actively promote the exercise of these rights and responsibilities. The company must ensure the equitable treatment of all shareholders, including minority and foreign shareholders. This includes that: a) all shareholders of the same class have equal voting, subscription, and transfer rights; b) there is a clearly articulated and published policy on treatment of minority shareholder rights, especially regarding changes of control, disposal of substantially all of the assets of the company and in engagement with the company; c) all shareholders, receive adequate notice and information pertaining to the agenda for shareholders’ meetings; and are permitted to participate and vote at shareholders’ meetings; d) holders of all securities of the same type and class have equal access to information (fair disclosure).

16 The company must release information equally to all shareholders. Where information is inadvertently released to selected shareholders only, companies must make the same disclosure publicly to all others as soon as practically possible and report the matter to the Authority immediately. The board must oversee all of the above and should ensure engagement in formal and informal communication with shareholders at general meetings and at other times through written communication or other means as is necessary to enable shareholders to: a) make investment decisions and exercise voting rights on an informed basis; and b) contribute constructively in engagements with the company, including providing input and raising concerns. Article 22: General meetings of shareholders as a constructive engagement platform Companies must encourage greater shareholder attendance and participation at general meetings by allowing shareholders the opportunity to communicate their views on various matters affecting the company, subject to reasonable limitations. When establishing the voting procedures and rights for companies, the principle of one share, one vote must guide every company. Within a class of shares, all shareholders must have the same voting rights. Information regarding the voting rights of all classes of shares must be available to current and potential shareholders. To facilitate voting by shareholders, proxy voting rules must be simple, easy to follow and provided with the notice and materials for the annual general meeting. All materials related to the annual general meeting should also be posted on the company website, including agenda, registration process, voting rules, proposed resolutions, and all information related to proposed resolutions. There must be separate resolutions at general meetings on each substantially separate issue. The company must avoid 'bundling' resolutions unless the resolutions are interdependent and linked to form one significant proposal. The information provided about the agenda items for general meetings must be detailed enough to allow shareholders to vote in an informed way. Ideally, the agenda should be presented in the order that items will be addressed at the meeting. Voting rights and procedures should be clearly explained to shareholders by the chairperson of the board so shareholders may fully assert their rights in general meetings. Shareholders may be allowed to participate in general meetings and to vote remotely via electronic access. In this regard, companies are encouraged to make the appropriate provisions in their articles of association to allow for electronic general meetings and in absentia voting methods. Methods for voting and participating in the general meetings in absentia must be clearly explained to shareholders and provided with the notice of the meeting. The outcome and proceedings of general meetings must be minuted to establish a transparent record of proceedings. The minutes of general meetings should be published on the company’s website or through other means which will make it accessible by stakeholders of the company within 10 days from the meeting.

17 The chairpersons of the board committees, including the audit, nominating and remuneration committees, must be present at annual general meetings and must be available to address questions. The external auditor must also be present to address shareholders' queries about the conduct of audit and the preparation and content of the auditors' report. Time must be allowed on the agenda of the annual general meeting for questions to be asked of the chairperson of the board, the chairpersons of the board committees and of the external auditor. CHAPTER V: STAKEHOLDERS Article 23: Stakeholder engagement program to address social and environmental risks and opportunities The board should ensure the establishment and effectiveness of a formal stakeholder policy and processes that encourages engagement with the company and its management, identifies key stakeholders, considers their material needs, interests and expectations and reports on these processes. To make ethical and responsible decisions, the company must comply with its legal obligations and should know and consider the reasonable expectations of its key stakeholders. The company must develop policies that ensure the health, safety, dignity and well-being of employees and customers. The company must ensure that measures are put in place for the prevention, detection and responses to fraud and corruption. The company must mitigate the negative consequence of its operations on the environment and the society within which it operates. The board is accountable for the efficiency and effectiveness of all of the above, the stakeholder engagement program. Article 24: Whistle-blowing and grievance mechanisms The board must oversee the establishment and effectiveness of mechanisms for whistle-blowing and grievances to ensure that employees, suppliers, customers, affected communities and other stakeholders can raise concerns on a confidential basis about any suspected or actual non-compliance, fraud or other misconduct. The company must ensure that those who report in good faith are protected from negative repercussions as a result of the reporting. Stakeholders must be made aware of the whistle-blowing mechanisms in an understandable format and language. CHAPTER VI: DISCLOSURE AND TRANSPARENCY A company’s corporate governance framework must ensure that timely and accurate disclosure is made on all material matters regarding the company, including its financial and non-financial situation, strategy and

18 risk management, business model, performance, ownership and governance., including governance of environmental and social matters. The expected standards for corporate reporting are continually evolving. Companies and boards should keep pace with these changes. The cornerstone of a disclosure policy is the publication of a comprehensive, understandable and balanced Annual Report. Companies should also make regular use of the company website for timely disclosure of information. The website should be easily accessible and contain regularly updated information, including annual reports, interim reports, investor briefings, company policies, board and committee charters, and other documents. Article 25: General disclosure on application of the code to enhance transparency and accountability The board must annually attest and affirm adherence to the provisions in this code. Article 26: Information disclosure to shareholders and other stakeholders The board must establish written policies and processes that are practical and in accordance with generally accepted best practices. The policies should ensure full, fair, accurate and timely disclosure of all material information to shareholders and to stakeholders. The board must oversee enforcement of quality reporting and company disclosure policies. Material company information relevant to the value of shares or to investors should be published immediately. Each company must issue an Annual Report that complies with the provisions of the Law Governing Companies, the Listings Rules, all other applicable laws and regulations, and this code. The Annual Report must include identification of the major shareholders of the company, including beneficial shareholders, their shareholdings and the key stakeholders identified by the company. The Annual Report should include the audited financial statements, a balanced view of relevant financial and non-financial information, including on strategy, the business model, risk management, performance, ownership, governance and control of the company. The Annual Report should include a discussion of the company’s significant or material environmental and social risks and opportunities and the company’s responses to these matters. The Annual Report should enable stakeholders to make an informed assessment of the overall performance of the company and its longer-term prospects. The Annual Report must include a clear statement of directors’ responsibility for the information provided. The board must ensure that the financial statements present a true and fair view of the financial position and performance of the company and must ensure that these comply fully with International Financial Accounting Standards (IFRS). Companies must have their financial statements and accounts audited in accordance with International Standards on Auditing (lSA). Companies are encouraged to provide assurance on the non-financial information presented in the Annual Report. Such assurance should be provided by a competent professional assessor or assessors who apply best international assurance standards.

19 Article 27: Specific disclosures on governance The commitment of each director of the company to ethical and effective leadership and good governance must be confirmed by the board in a statement to be included in the Annual Report. The statement by the board must include a confirmation that all directors are competent and have the skills, knowledge, character traits and attributes to carry out their legal and governance duties to the company and to shareholders. The board must ensure that the following are disclosed in the Annual Report in relation to directors’ and officers’ interests: a) The interests of all directors, officers and senior management in the equity or debt securities of the company or a subsidiary as provided in relevant laws and regulations, any dealings in the company’s shares and all material related party transactions; b) In accordance with relevant laws and regulations the Annual Report of the company must disclose particulars of any contract: i. subsisting during or at the end of the financial year in which a director of the issuer is or was materially interested, either directly or indirectly, or, if there has been no such contract, a statement of that fact; ii. for the provision of services to the group by a controlling shareholder or any of its subsidiaries. With regards to the board, the following must be disclosed in the company’s Annual Report: a) The categorisation of each member as executive, non-executive and independent non-executive director; b) The qualifications, work experience and occupations of each director as well as other board positions being held; c) The target set for gender representation on the board and progress made to achieving this target; d) Each director’s period of service on the board; e) A statement of each director’s attendance at board and committee meetings and the total meetings available to be attended; f) Other directorships held by each director currently and during the preceding five years; and In relation to each board committee, the board must disclose in the Annual Report: a) its chair and committee composition, including each member’s qualifications, experience; and independence, if applicable; b) its role, responsibilities and significant activities in the year; and c) the number of meetings and each director’s attendance at each meeting.

20 The company must disclose in the Annual Report how the Nominating Committee executed its duties and responsibilities, including the activities and process the Nominating Committees has followed in arriving at recommendations for nominations to the board and its process for inducting new board members. The Audit Committee must report on the execution of its duties and responsibilities in the company's Annual Report, including on the following: a) Responsibility to the board for oversight of all financial and non-financial reporting; b) The extent of non-audit services provided by the external auditors during the year under review; c) The committee’s view on the effectiveness of the CFO and the finance function; d) The committee’s view on the effectiveness of the internal control system and the internal audit function; e) The independence of the external auditor. The Remuneration Committee must disclose the company remuneration policy, level and mix of remuneration, and the procedure for setting remuneration for the board and executive management in the company's Annual Report. The disclosure should be such to enable investors to understand the link between remuneration and performance. In relation to reporting on sustainability or non-financial information, stakeholder engagement and corporate social and environmental responsibilities, the board must ensure disclosure of the following in the company’s Annual Report: a) The name/s of any specific framework the company used to guide the company’s sustainability practices and reporting; b) the risks and opportunities associated with environmental and social factors that may materially affect the performance of the company; c) the steps that the company has taken to manage these risks and opportunities, including specific targets and performance indicators; and d) the company’s performance against key selected social and environmental targets and performance indicators. The company’s Annual Report must disclose if the company has established a grievance and whistle￾blowing mechanism, the general themes of complaints made, how these have been addressed by the company and the number of any outstanding complaints. The company must ensure that the board charter and the terms of reference for each board committee and other relevant documents and policies, including the Annual Report, are disclosed and accessible on the company’s website. The company should use the website to disclose relevant updated company and governance information as soon as possible.

21 CHAPTER VII: MISCELANEOUS Article 28: Implementation The Authority shall work with complementary institutions to ensure compliance with this Code. Article 29: Repealing of inconsistent provisions All prior regulatory provisions contrary to this code are hereby repealed Article 30: Commencement This code shall come into force on the date of its publication in the Official Gazette of the Republic of Rwanda.