Regulation on the Annex to the Audit Report for Electronic Money Institutions (EGAPV)

All English translation of the authentic German text is unofficial and serves merely information purposes. The official wording in German can be found in the Austrian Federal Law Gazette (Bundesgesetzblatt; BGBl.). All translations have been prepared with great care, but linguistic compromises had to be made. The reader should also bear in mind that some provisions of these laws will remain unclear without certain background knowledge of the Austrian legal and political system. Please note that these laws may be amended in the future and check occasionally for updates. Regulation of the Financial Market Authority (FMA) on the Annex to the Audit Report for Electronic Money Institutions (EGAPV) Regulation on the Annex to the Audit Report for Electronic Money Institutions (EGAPV) Original Version: Federal Law Gazette II No. 348/2011 Amended by (Federal Law Gazette II unless stated otherwise): 345/2015; 94/2017; 197/2018; 143/2026 Based on Article 14 para. 3 of the E-Money Act 2010 (E-Geldgesetz 2010) published in Federal Law Gazette I No 107/2010, the following shall be ordered by means of a Regulation

Regulation on the Annex to the Audit Report for Electronic Money Institutions (EGAPV) . 2 / 9 TEXT Article 1. (1) The result of the audit pursuant to Article 14 para. 3 of the E-Money Act 2010 (E￾Geldgesetz 2010) shall be presented in an Annex to the Audit Report on the annual financial statement in accordance with the format prescribed in the Annex, and its correctness shall be confirmed by means of the signature of the auditor. (2) The submission of the Annex to the Audit Report on the annual financial statement pursuant to Article 14 para. 3 E-Geldgesetz 2010 shall be made within six months after the conclusion of the financial year on the basis of the FMA Incoming Platform Regulation (FMA-IPV), as published in Federal Law Gazette II No. 184/2010, as well as within the reporting in a standardised form by means of electronic data transmission to the Oesterreichische Nationalbank. Note for the following provision Shall first apply to financial years which end after 30 December 2015 (cf. Article 3 para. 2). Article 2. (1) Findings shall be listed in the Annex citing the relevant legal references in the fields marked for this purpose. This shall also apply to the listing of significant details, provided that they can be attributed to a relevant legal provision. (2) In the event that the audit modules contained in the Annex are not applicable for an electronic money institution, this circumstance shall be declared and explained for the relevant audit module by means of a "not applicable” (“nicht anwendbar”), “no occurrence” (“keine Geschäftsfälle”), or an equivalent wording. Article 3. (1) This Regulation shall first apply to financial years that end after 30 December 2011. (2) Article 2 and the Annex in the version of the Regulation as published in Federal Law Gazette II No 345/2015 shall first apply to financial years that end after 30 December 2015. (3) The Annex in the version of the Regulation as published in Federal Law Gazette II No 94/2017 shall first apply to financial years that end after 30 December 2017. (4) The Annex in the version of the Regulation as published in Federal Law Gazette II No 197/2018 shall first apply to financial years that end after 30 December 2018. (5) The Annex in the version of the Regulation as published in Federal Law Gazette II No 143/2026 shall first apply to financial years that end after 30 December 2026.

Regulation on the Annex to the Audit Report for Electronic Money Institutions (EGAPV) . 3 / 9 Note for the following provision Shall first apply to financial years which end after 30 December 2026 (cf. Article 3 para. 5). ANNEX PURSUANT TO ARTICLE 14 PARA. 3 E-GELDGESETZ 2010 ON THE AUDIT REPORT (AZP) As the auditor of ………………………………………………………………………. (company name of the payment institution) ……………………………………………………………………….. I (we) hereby submit the following Annex to the Audit Report in relationship to the financial year of the payment institution from xx.xx.xxxx until xx.xx.xxxx as well as the accompanying following Annex to the Audit Report for the annual financial statement for that financial year. Signature: (Date) (Auditor(s)) PART I Name, telephone number and e-mail address of the official in charge: Duration of audit process (in person days): Concluding summary of the overall situation of the electronic money institution (in particular in relation to the development of business, the risk, earnings and assets situation): (For findings, a legal reference must be supplied in any case)

Regulation on the Annex to the Audit Report for Electronic Money Institutions (EGAPV) . 4 / 9

1. Consolidation Auditing activities conducted by the auditor: Result of the audit by the auditor in connection with consolidation provisions pursuant to Article 14 para. 1 E-Geldgesetz 2010: Findings: Legal Reference 1.1.
2. Own funds requirements Auditing activities conducted by the auditor: Result of the audit by the auditor in connection with own funds requirements pursuant to Article 11 para. 1 E-Geldgesetz 2010: Findings: Legal Reference 2.1. Result of the audit by the auditor in connection with the own funds requirement pursuant to Article 11 paras. 2 to 4 E-Geldgesetz 2010: Findings: Legal Reference 2.2. Result of the audit by the auditor in connection with the granting of loans pursuant to Article 11 para. 6 E-Geldgesetz 2010: Findings: Legal Reference 2.3. Result of the audit by the auditor in connection with the multiple use of own funds pursuant to Article 11 para. 7 E-Geldgesetz 2010: Findings: Legal Reference 2.4.
3. Conditions for the granting of loans Auditing activities conducted by the auditor:

Regulation on the Annex to the Audit Report for Electronic Money Institutions (EGAPV) . 5 / 9 Result of the audit by the auditor regarding Article 3 paras. 3 and 4 E-Geldgesetz 2010 for the granting of loans in connection with payment services: Findings: Legal Reference 3.1. 4. Safeguarding of customer deposits Auditing activities conducted by the auditor: Result of the audit by the auditor regarding the safeguarding of customer deposits pursuant to Article 12 E-Geldgesetz 2010: Findings: Legal Reference 4.1. 5. Due Diligence Obligations for the Combatting of Money Laundering and of Terrorist Financing Auditing activities conducted by the auditor: Result of the audit by the auditor in connection with the due diligence obligations for combatting money laundering and terrorist financing pursuant to Article 4 para. 1 E-Geldgesetz 2010 in conjunction with Article 9 para. 1 no. 11 of the Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) published in Federal Law Gazette I No. 17/2018; and Articles 4 to 17, Article 19 para. 2, Articles 20 to 24, Article 29 and Article 40 para. 1 of the Financial Markets Anti￾Money Laundering Act (FM-GwG), published in Federal Law Gazette I No. 118/2016: Findings: Legal Reference 5.1. Number of suspicious activity reports: 5.2.

Regulation on the Annex to the Audit Report for Electronic Money Institutions (EGAPV) . 6 / 9 6. Internal Audit Auditing activities conducted by the auditor: Result of the audit by the auditor regarding the internal audit pursuant to Article 20 para. 4 ZaDiG 2018: Findings: Legal Reference 6.1. 7. Due Diligence Obligations Auditing activities conducted by the auditor: Result of the audit by the auditor in connection with due diligence obligations pursuant to Article 20 paras. 1 to 3, 5 and 6 ZaDiG 2018: Findings: Legal Reference 7.1. 8. Organisation and Management of the Electronic Money Institution Auditing activities conducted by the auditor: Result of the audit by the auditor regarding the organisation and sound and prudent management of the electronic money institution pursuant to Article 4 para. 3 E-Geldgesetz 2010 in conjunction with Article 10 para. 1 no. 3 ZaDiG 2018: Findings: Legal Reference 8.1.

Regulation on the Annex to the Audit Report for Electronic Money Institutions (EGAPV) . 7 / 9 9. Changes to the requirements for a licence Auditing activities conducted by the auditor: Result of the audit by the auditor regarding the changes to the requirements for a licence pursuant to Article 7 E-Geldgesetz 2010: Findings: Legal Reference 9.1. 10. Distribution using third parties and liability for persons attributable Auditing activities conducted by the auditor: Result of the audit by the auditor regarding distribution of electronic money using third parties and liability for persons attributable pursuant to Articles 15 and 16 para. 2 E-Geldgesetz 2010: Findings: Legal Reference 10.1. 11. Prohibition of charging interest Auditing activities conducted by the auditor: Result of the audit by the auditor regarding the prohibition of charging interest pursuant to Article 20 E-Geldgesetz 2010: Findings: Legal Reference 11.1. 12. Retention of records and receipts Auditing activities conducted by the auditor: Result of the audit by the auditor in connection with legal provisions on the keeping of records and receipts pursuant to Article 24 ZaDiG 2018:

Regulation on the Annex to the Audit Report for Electronic Money Institutions (EGAPV) . 8 / 9 Findings: Legal Reference 12.1. 13. Outsourcing of tasks Auditing activities conducted by the auditor: Result of the audit by the auditor in connection with legal provisions on the outsourcing of tasks pursuant to Article 21 ZaDiG 2018: Findings: Legal Reference 13.1. 14. Agents Auditing activities conducted by the auditor: Result of the audit by the auditor in connection with legal provisions on agents pursuant to Article 22 ZaDiG 2018: Findings: Legal Reference 14.1.

Regulation on the Annex to the Audit Report for Electronic Money Institutions (EGAPV) . 9 / 9 PART II 15. Licensing Observations by the auditor in connection with the licensing of the electronic money institution (e.g. does the licence granted match the business model): Legal Reference 15.1. 16. Ownership provisions Observations by the auditor in connection with legal provisions on ownership pursuant to Article 8 E-Geldgesetz 2010: Legal Reference 16.1. 17. Compliance with other significant legislation Observations by the auditor in connection with the observance of other provisions in the E-Geldgesetz 2010, ZaDiG 2018, in the Austrian Banking Act (BWG; Bankwesengesetz), published in Federal Law Gazette No. 532/1993, Regulation (EU) No. 575/2013 (CRR), OJ L 176, 27.06.2013, p. 1 and other material legal provisions for electronic money institutions: Legal Reference 17.1.