Capital Market Institutions Regulations

ل - Internal داخ KINGDOM OF SAUDI ARABIA Capital Market Authority CAPITAL MARKET INSTITUTIONS REGULATIONS English Translation of the Official Arabic Text Issued by the Board of the Capital Market Authority Pursuant to its Resolution Number 1-83-2005 Dated 21/05/1426H Corresponding to 28/06/2005G Based on the Capital Market Law issued by Royal Decree No. M/30 dated 2/6/1424H Amended by Resolution of the Board of the Capital Market Authority Number 2-3-2026 Dated 18/07/1447H corresponding to 07/01/2026G Note: The official text is in Arabic. This document is an unofficial translation and is provided for information purposes only Important Notice: The current version of these Rules, as may be amended, can be found at the Authority website: www.cma.org.sa

1 ل - Internal داخ TABLE OF CONTENTS PART 1: GENERAL PROVISONS Article 1: Preliminary Article 2: Definitions Article 3: Compliance with the Regulations and Rules Article 4: Waivers PART 2: THE PRINCIPLES FOR CAPITAL MARKET INSTITUTIONS Article 5: The Principles PART 3: AUTHORISATION Chapter One: Applications for authorisation Article 6: Requirements for Authorisation Article 7: Procedure and Powers of the Authority in Relation to an Application Article 8: Right of Appeal Chapter Two: Maintenance of Authorisation Article 9: Fit and Proper Article 10: Scope of Business Article 11: Variation or Amendment Article 12: Withdrawal from Business and Cancellation of Authorisation Article 13: Controllers Article 14: Close Links Article 15: Notification Requirements and Powers of Authority Article 16: Record-Keeping Article 17: Fees Annex 3.1: Information and Documents Required for Authorisation Annex 3.2: Notification Requirements PART 4: REGISTERED PERSONS Chapter One: Background and Scope Article 18: Scope of Application Article 19: Registrable Functions Article 20: Performance of Registrable Functions Chapter Two: Registration Article 21: Requirements for Application for Registration Article 22: Procedure and Powers of the Authority Article 23: Right of Appeal Chapter Three: General Provisions

2 ل - Internal داخ Article 24: Responsibilities of Registered Persons Article 25: Cancellation of Registration PART 5: CONDUCT OF BUSINESS Chapter One: General Provisions Article 26: Preliminary Provisions Article 27: Inducements Article 28: Special Commission Arrangements Article 29: Confidentiality Article 30: Chinese Walls Arrangements Article 31: The Liability of Capital Market Institution Chapter Two: Securities Advertisements Article 32: Scope of Application Article 33: Prepared Securities Advertisements Article 34: Direct Communications Article 35: Non-Retail Client’s Investment Funds and Derivatives Chapter Three: Accepting Clients Article 36: Client Classification Article 37: Anti-Money Laundering and Combating the Financing of Terrorism Article 38: Terms of Business with Clients Article 39: Know Your Client Chapter Four: Client Relations Article 40: Fiduciary Duties Article 41: Conflicts of Interest Article 42: Understanding Risk Article 43: Suitability Article 44: Client Borrowing Article 45: Margin Requirements Article 46: Fees and Commissions Chapter Five: Reporting to Clients Article 47: Contract Notes Article 48: Periodic Reporting Chapter Six: Miscellaneous Article 49: Client Records Article 50: Employees’ Personal Dealings Article 51: Recording Telephone Calls Annex 5.1: Contents Requirements for Securities Advertisements

3 ل - Internal داخ Annex 5.2: Terms of Business Requirements Annex 5.3 (A): Know Your Client Form Annex 5.3 (B): Investment Information Form Annex 5.4: Fiduciary Duties Annex 5.5: Required Contents of Contract Notes Annex 5.6: Required Contents of Periodic Valuations Statements for Client Portfolios Annex 5.7: Personal Account Dealing PART 6: SYSTEMS AND CONTROLS Chapter One: Scope of Application Article 52: Scope of Application Chapter Two: Management Arrangements Article 53: Division of Responsibilities Article 54: Establishment and Maintenance of Systems and Controls Chapter Three: Systems and Controls Article 55: General Provisions Article 56: Review by the Governing Body Article 57: Compliance Article 58: Risk Committee and Compliance Committee Article 59: Outsourcing Article 60: Audit Committee Article 61: Internal Audit Article 62: Audit and Inspections Article 63: Resolution of Complaints Article 64: Anti-Money Laundering and Combating the Financing of Terrorism Article 65: Employees Article 66: Business Continuity Article 67: Record Retrieval Article 68: Mandate Over an Account in the Client's Name Annex 6.1: Required Contents of The Board of Directors’ Report Part 7: Client Money and Assets Chapter One: General provisions Article 69: Purpose and Scope Article 70: Effect of Segregation Chapter Two: Client Money Rules Article 71: Money Received by a Capital Market Institution Article 72: Money Which is Not Client Money

4 ل - Internal داخ Article 73: Money to be Held With a Bank Article 74: Acknowledgement by the Bank Article 75: Client Accounts Article 76: Money Ceasing to be Client Money Article 77: Returns Article 78: Records and Auditor's Report Article 79: Amounts to be Held in Client Money Bank Accounts Article 80: Reconciliations Article 81: Client Money Reporting Requirement Chapter Three: Client Asset Rules Article 82: Assets Received by a Capital Market Institution Article 83: Assets Which are Not Client Assets Article 84: Segregation Article 85: Holding and Registration of Client Assets Article 86: Lending of Client Securities Article 87: Assessment of Custodian Article 88: Clients Agreements Article 89: Custodian Agreement Article 90: Reconciliations Article 91: Client Statements Chapter Four: Collateral and Money and Assets Passed to Third Parties Article 92: Scope of Application Article 93: Collateral Subject to the Client Money Rules or the Client Asset Rules Article 94: Other Collateral PART 8: PROVISIONS OF BANKRUPTCY OR DISSOLUTION OF A CAPITAL MARKET INSTITUTION Article 95: Preamble Article 96: Rights of Clients on Bankruptcy of a Capital Market Institution Holding Client Money and Assets or Managing Investment Funds Article 97: Procedures for Obtaining the Authority's Approval Article 98: Bankruptcy Proceedings PART 9: PUBLICATION AND ENTRY INTO FORCE Article 99: Publication and Entry into Force

5 ل - Internal داخ PART 1 GENERAL PROVISONS Article 1: Preliminary The purpose of these Regulations is to regulate capital market institutions and registered persons and to specify the procedures and conditions for obtaining a license, as well as the conditions for the maintenance of the license or the registration, to provide for the rules of conduct that capital market institutions must comply with when conducting their business, as well as the rules and provisions governing the conduct of business, and to set the systems and controls as well as the provisions relating to client money and assets. Article 2: Definitions a) Any reference to the “Capital Market Law” in these Regulations shall mean the Capital Market Law issued by Royal Decree No. M/30 dated 2/6/1424H. b) Expressions and terms in these Regulations have the meaning, which they bear in the Capital Market Law and in the Glossary of defined terms used in the Regulations and Rules of the Capital Market Authority, unless the context indicates otherwise. Article 3: Compliance with the Regulations and Rules a) A capital market institution and a registered person must comply with the Regulations and Rules applicable to them and must provide to the Authority without delay any information, records or documents that the Authority may require for the purpose of administration of the Capital Market Law and its Implementing Regulations. b) The governing body and employees of a capital market institution and a registered person, must comply with any requirement issued by the Authority to appear to explain any matter or to assist in any enquiry relating to the administration of the Capital Market Law and its Implementing Regulations. Article 4: Waivers a) The Authority may waive a provision of these Regulations in whole or in part as it applies to an applicant or a capital market institution either on an application from the applicant or the capital market institution or on its own initiative. b) The Authority will make an announcement of the waiver of any provisions where it believes that:

1. the waiver of the provision may be of application to more than one type of capital market institutions; and

6 ل - Internal داخ 2) the publication of the waiver will not materially prejudice the capital market institutions. This is to achieve the policy of the Authority to promote competition, including retaining a level playing field between capital market institutions.

7 ل - Internal داخ PART 2 THE PRINCIPLES FOR CAPITAL MARKET INSTITUTIONS Article 5: The Principles a) The Principles provided for in this Part are a general statement of the fundamental obligations of capital market institutions. They are intended to form a universal statement of the standards of conduct expected of capital market institutions under these Regulations. b) A capital market institution must comply with the following principles:

1. integrity, by conducting its business with integrity;
2. skill, care and diligence, by conducting its business with due skill, care and diligence;
3. efficiency of management and control, by taking reasonable care to organise its affairs responsibly and effectively, with adequate risk management policies and systems;
4. financial prudence, by maintaining adequate financial resources in accordance with the rules issued by the authority;
5. proper market conduct, by observing proper standards of market conduct;
6. protection of clients’ assets, by arranging for adequate protection of its clients’ assets;
7. co-operation with regulators, including disclosing to the authority any material event or change in the capital market institution’s business operations or organization;
8. communications with clients, by communicating information to them in a way, which is clear, fair and not misleading;
9. paying due regard to client’s interests, by treating them fairly and paying due regard to their interests;
10. resolve the conflicts of interest, by dealing with the conflicts of interest cases fairly, both between itself and its clients and between a client and another client; and
11. clients’ suitability, by taking reasonable care to ensure the suitability of its advice and discretionary managing decisions for any client to whom it provides those services.

8 ل - Internal داخ PART 3 AUTHORISATION Chapter One: Applications for authorisation Article 6: Requirements for Authorisation a) For the purposes of these Regulations, an applicant for authorisation means the person that is applying for authorisation to carry out securities business. An applicant for authorisation becomes subject to these Regulations from the date of submission of his application. b) An application for authorisation may be submitted by the founders or controlling shareholders of an applicant if the applicant is not yet established. The founders or controlling shareholders become subject to the provisions that apply to an applicant from the date of submission of the application. c) An application for authorisation must be made on the application form prescribed by the Authority and be accompanied by the information and documents required in Annex 3.1. d) The form and contents of the application and all information and documents filed with it must be as prescribed by the Authority. e) An applicant must demonstrate to the Authority that:

1. it is fit and proper to carry out securities business of the kind and scale for which it seeks authorisation in accordance with the rules prescribed by the authority;
2. it has adequate expertise and resources for the kind of securities business that it proposes to carry out in accordance with the rules prescribed by the authority;
3. it has managerial expertise, financial systems, risk management policies and systems, technological resources, and operational procedures and systems that are sufficient to fulfil its business and regulatory obligations and to conduct the kind of securities business that it proposes to carry out; and
4. its board of directors’ members, officers, employees and agents who will be involved in the applicant’s securities business have the necessary qualifications, skills, experience and integrity to carry out the kind of securities business that it proposes to carry out. f) In order to engage in dealing, custody and managing business, an applicant must be established in the Kingdom and must be:
5. a subsidiary of a local bank;
6. a joint stock company;
7. a subsidiary of a Saudi joint stock company that is engaged in financial services business; or

9 ل - Internal داخ 4) a subsidiary of a foreign financial institution that is licensed under the Banking Control Law issued by Royal Decree No. M/5 dated 22/2/1386H. The applicant may be of any legal form established in the Kingdom to apply for a license to conduct arranging or advising. g) The paid up capital of the applicant must not be less than the following:

1. dealing and custody: SR 50 million;
2. managing: SR 20 million for managing investments and operating funds; and a capital that covers the expected expenses for a year for managing investments;
3. arranging and advising: a capital that covers the expected expenses for a year. h) A capital market institution must have its management and head office in the Kingdom. i) If the applicant has close links with another person, the Authority must be satisfied with the integrity, regulatory status, business record and financial soundness of any such person, and that such close links will not impair the effective supervision of the applicant, or its operations and compliance with these Regulations. j) The applicant for authorisation must pay such fees as may be prescribed by the Authority. Article 7: Procedure and Powers of the Authority in Relation to an Application a) In considering an application, the Authority may:
4. carry out any enquiries that it considers appropriate;
5. require the applicant, or his representative, to attend before the Authority to answer questions and explain any matter the Authority considers relevant to the application;
6. require the applicant to provide such additional information as the Authority considers appropriate within 30 days of the request; and
7. verify any information furnished by the applicant. b) The Authority may refuse to consider the application for authorisation where an applicant has failed to provide information requested from it, or has failed to provide information requested from it within the time requested. c) The Authority shall, upon receipt of all information and documents required, notify the applicant in writing of the same, and shall take any of the following decisions within a maximum period of 30 days from the date of the notice:
8. approve the application in whole or in part;
9. approve the application subject to such conditions and limitations as it considers appropriate;
10. refuse the application, giving reasons.

10 ل - Internal داخ d) If the Authority resolves to authorise the applicant, it will inform the applicant of this in writing and of its permitted business profile including any limitations that the Authority may consider appropriate. The capital market institution must satisfy the requirements for commencement of business stipulated in Annex 3.1 of these Regulations before commencing its business. e) If the Authority resolves to refuse the application, it will notify the applicant in writing. f) An applicant must not carry out, or hold itself out as carrying out, securities business prior to receiving the Authority's decision referred to at paragraph (d) of this Article. g) The duration of the authorisation granted in accordance with the provisions of the Capital Market Law and these Regulations shall be ten years, automatically renewable for same periods when the capital market institution continues to fulfil the following conditions and criteria:

1. fit and proper requirements;
2. prudential requirements;
3. minimum capital requirements; and
4. payment of the fees determined by the Authority on an annual basis. Article 8: Right of Appeal The applicant may appeal to the Committee in respect of any decision or action that the Authority takes under this Part. Chapter Two: Maintenance of Authorisation Article 9: Fit and Proper a) As a condition for the maintenance of authorisation, a capital market institution must continue to be fit and proper to carry out the securities business, which it is authorised to carry out at all times. b) The following criteria are an important factor in assessing whether a capital market institution or an applicant is fit and proper:
5. the skills, experience, competence and integrity of the employees, officers and agents of a capital market institution or an applicant, which shall be assessed against the following criteria: a. they must possess adequate qualifications and professional experience to carry out their responsibilities, including appropriate technical knowledge and skills;

11 ل - Internal داخ b. they must have probity and soundness of judgement commensurate with their positions; c. they must fulfil their responsibilities with diligence and to protect clients’ interests in accordance with the Implementing Regulations; d. they must not have committed an offence involving fraud or dishonesty; and e. they must not have contravened or broken any laws or regulations governing securities business or aimed at protecting investors. 2) the founders of the capital market institution or the applicant, its controlling shareholders or registered employees, shall not have been deemed bankrupt during the past ten years, prior to submit the application for authorisation, change in the controlling shareholders or registration. c) The capital market institution must obtain the Authority’s approval before the alternation of its capital. Article 10: Scope of Business a) A capital market institution must not carry out, or hold itself out as carrying out, securities business unless that business is within its permitted business profile. b) A capital market institution must comply with the rules applicable to it and with any limitation, condition or other requirement that the Authority specifies. c) A capital market institution may carry out activities associated with the securities business upon satisfying the following:

1. carrying out such activities does not require obtaining authorisation from other regulatory or supervisory bodies;
2. carrying out such activities will not affect the ability of the capital market institution to comply with the principles set out in article 5 of these regulations; and
3. the capital market institution must fulfil the prudential requirements at all times. d) The Authority may impose any conditions or restrictions on the capital market institution in conducting activities associated with the securities business, request to provide any information about such activities, or instruct the capital market institution to cease conducting them. e) A capital market institution authorised to carry out advising business may provide advising in financial planning and in wealth management.

12 ل - Internal داخ f) A Capital Market Institution licensed to conduct investment management or investment management and fund operation activities may offer Robo-Advisory services, provided that the following conditions are met:

1. The investments of the investment portfolio must not be concentrated in a single asset or in securities issued by one issuer.
2. If the Robo-Advisory service involves securities issued or listed outside the Kingdom, such securities must be subject to the supervision of a regulatory authority that applies regulatory standards and requirements that are at least equivalent to those applied by the Authority.
3. Disclosure on the platform through which the robo-advisory service will be provided of the role of the algorithms and mechanisms relied upon by the capital market institution in delivering the robo-advisory service, as well as the associated risks, in a fair, clear, accurate, and non-misleading manner, and in a way that is appropriate to the targeted clients. Article 11: Variation or Amendment a) A capital market institution must apply to the Authority for approval of any proposed variation or amendment to its permitted business profile. b) The Authority has all the powers set out in Article 7 of these Regulations to consider a proposed variation or amendment, and may also require some or all of the information or documents referred to in Article 6 of these Regulations to be updated. c) The Authority will aim to process an application to vary or amend a capital market institution’s permitted business profile within 30 days from receiving all information that it considers necessary. d) After considering an application to vary or amend a capital market institution’s permitted business profile, the Authority may:
4. approve the application for variation or amendment in whole or in part;
5. approve the application subject to such conditions and limitations as it considers appropriate;
6. defer making a decision for such period as it may consider necessary to carry out further study or examination or to allow for the provision of additional information; or
7. refuse the application, giving reasons. e) If the Authority resolves to approve an application for a change in a permitted business profile, it will inform the capital market institution of this in writing and of its new permitted business profile, including any limitations that the Authority may consider appropriate.

13 ل - Internal داخ f) The capital market institution must not carry out (or hold itself out as carrying out) the kind of securities business concerned before receiving the Authority’s notification under paragraph (e) of this Article. g) If the Authority resolves to refuse the application for variation or amendment, it will notify the capital market institution in writing. h) The capital market institution may appeal to the Committee in respect of any decision or action that the Authority takes under this Article. Article 12: Withdrawal from Business and Cancellation of Authorisation a) A capital market institution that proposes temporarily cease to carry out securities business must notify the Authority in writing of the date on which it intends to temporarily cease to carry out securities business and the reasons for the decision:

1. at least 45 days in advance of that date; or
2. if such advance notice is not possible because the temporary cessation of business is caused by an external event of which the capital market institution was not aware, immediately on making a decision to temporary cease to carry out securities business. b) The notice referred to in paragraph (a) of this Article must contain the following:
3. the date on which the capital market institution intends to temporary cease to carry out securities business;
4. reasons for the decision of temporary cessation;
5. the period of temporary cessation;
6. potential impacts on clients, and the actions that the capital market institution intends to take to address them, including the actions that it intends to take in relation to clients’ money and assets; and
7. the status of registered persons during the temporary cessation. c) The capital market institution may not cease to carry out securities business for a period exceeding 12 months. d) Where a capital market institution decides to cease providing securities business to clients, it must ensure that any such business that is outstanding is properly completed or is transferred to another capital market institution and that it provides reasonable notice to its clients of the cessation of business. e) A capital market institution may request the cancellation of its authorisation, and must in this case submit a written request to the Authority not less than three months prior to the proposed date of the cancellation. A capital market institution must notify its clients immediately upon submitting the request for cancellation of its authorisation, and shall

14 ل - Internal داخ ensure that the outstanding business are properly completed or transferred to another capital market institution. It shall also take the necessary measures to transfer the clients’ money and assets and protect their rights. f) A request to cancel an authorisation must include sufficient information concerning the circumstances of the cancellation to enable the Authority to determine whether to accept the cancellation, to postpone the date of the cancellation, or to require other measures that it considers necessary for the protection of clients of the capital market institution. g) The Authority may refuse a request to cancel an authorisation if it considers that the maintenance of the authorisation is necessary to investigate any matter affecting the capital market institution, to protect the interests of the capital market institution’s clients, or to impose a prohibition or requirements on such capital market institution under the Capital Market Law or its Implementing Regulations. h) The Authority may suspend the capital market institution’s authorisation on its own initiative if the capital market institution does not carry out any securities business for a period of 12 months, or 6 months following the date on which a capital market institution has ceased to carry outsecurities business after notification to the Authority in accordance with paragraph (a) of this Article. i) A capital market institution continues to be subject to the jurisdiction of the Authority in respect of any act or omission that occurred before the cancellation of its authorisation and for two years thereafter. If at any time during this period the Authority commences any enforcement investigation or proceedings, the capital market institution shall continue to be subject to the jurisdiction of the Authority until the end of the enforcement investigation or proceedings. Article 13: Controllers a) A capital market institution must notify the Authority, in such form as the Authority may prescribe, that a person is intending to become, or cease to be, a controller of the capital market institution at least 30 days in advance of the proposed effective date; or if such advance notice is not possible, immediately on the capital market institution becoming aware of such intention. b) A capital market institution must not permit any person to become or act as a controller unless the Authority has approved the controller in writing. c) A person who intends to become a controller of a capital market institution must notify the Authority of such intention at least 30 days in advance of the proposed effective date, and

15 ل - Internal داخ must provide the Authority with such information as the Authority requires to satisfy itself of its identity, integrity, regulatory status, business record and financial soundness. d) Before approving a controller the Authority must be satisfied that, the person’s control of the capital market institution will not impair the effective supervision of the capital market institution or its operations and compliance with the Capital Market Law and the Implementing Regulations. e) In considering, any application submitted under this Article, the Authority has all of the powers set out in Article 7 of these Regulations. Article 14: Close Links a) A capital market institution must notify the Authority, in such form as the Authority may prescribe, that a person is intending to establish close links with the capital market institution at least 30 days in advance of the proposed effective date, or if such advance notice is not possible, immediately on the capital market institution becoming aware of any change in close links. The notice must include such information as the Authority requires to satisfy itself of the identity of the person with whom the capital market institution proposes to establish close links, its integrity, regulatory status, business record and financial soundness. b) The Authority may impose any conditions or restrictions it considers appropriate to ensure that the capital market institution establishing close links with any person will not impair the effective supervision over the capital market institution or over its operations, or the capital market intuition’s compliance with the Capital Market Law and the Implementing Regulations. Article 15: Notification Requirements and Powers of Authority a) A capital market institution must comply with the notification requirements set out in Annex 3.2. b) On receiving a notice under paragraph (a) of this Article, the Authority may:

1. require the capital market institution to provide any additional information that it considers necessary to properly assess the matter; and
2. impose any conditions, restrictions or additional requirements on a capital market institution, including limitations on its permitted business profile, that it reasonably considers to be necessary to address a regulatory concern raised by any matter that it is notified of under this Article.

16 ل - Internal داخ Article 16: Record-Keeping a) A capital market institution must record and retain sufficient information about its securities business to demonstrate compliance with these Regulations. b) Records required to be maintained by these Regulations must be retained for a period of ten years unless the Authority specifies otherwise. c) The Authority may inspect the records directly or through a person it appoints for that purpose. d) Records made by a capital market institution may be maintained in any form, but must be maintained in an organized manner and capable of reproduction in hard printed form. e) When a client or a former client requests any records kept during the regulatory record￾keeping period, the capital market institution must make available, within a reasonable period, any of the following:

1. any written material or records which relate to that client and which the capital market institution has sent, or is required to send, to that client under Part 5 of these Regulations; and
2. copies of any correspondence received from or sent to that client relating to securities business. Article 17: Fees A capital market institution must pay such fees as the Authority may prescribe for the maintenance of the license.

17 ل - Internal داخ ANNEX 3.1 INFORMATION AND DOCUMENTS REQUIRED FOR AUTHORISATION AND COMMENCEMENT OF BUSINESS These authorisation and commencement of business requirements set out below apply to all types of securities business and the application of each requirement will differ depending on the nature, scope and complexity of the business. Applicants whom the type of their activities will be limited to managing investments, arranging or advising will be excluded from submitting the information and documents stated in the paragraphs (8) and (11) of the information and documents required for authorisation set out in this Annex, and the information and documents stated in sub-paragraphs (1), (3), (4), and (5) of paragraph (1) and paragraphs (2), (3) and (4) of the information and documents required for the commencement of business set out in this Annex. Unless the applicant intends to provide robo-advisory services, in which case the exemption is limited to the documents and information set out in paragraphs (8) and (11) of the information and documents required for authorisation, and the documents and information set out in paragraphs (3) and (4) of the information and documents required for the commencement of business. First: Information and Documents Required for Authorisation

1. Controllers – An applicant must submit a list of all controllers of the applicant, and provide details of the identity, ownership (if applicable), integrity, regulatory status, business record and financial position of each proposed controller.
2. Close Links – An applicant must submit a list of all persons that have, or are proposed to have, close links with the applicant, and provide details of the identity, ownership (if applicable), integrity, regulatory status, business record and financial position of each such person.
3. Governing Body Resolution – An applicant must submit to the Authority a resolution of its governing body in the form prescribed by the Authority approving the application and its contents, and certifying the accuracy and completeness of the accompanying information and documents.
4. Business Profile – An applicant must submit a proposed business profile including full details of all securities and all services for which the applicant proposes to provide for each securities activity that it is applying to carry out. A schedule must be attached in the following form:

18 ل - Internal داخ Securities Business Types of Activity Details of Securities Details of Services Categories of clients Dealing Dealing Custody Securities custody services Managing Managing investments and operating funds Managing investments Arranging Financial advisor / corporate finance advisor Advising Investment Advisor 5. Business Plan – An applicant must submit a business plan, setting out:

1. A detailed description of the securities business activities that the applicant proposes to undertake during, at least, the first 12 months after authorisation, including: • the products and services that it intends to provide to clients; • the classes and types of securities that it intends to provide services in; and • all exchanges and markets that it intends to trade in.
2. a description of the nature of the proposed clients of the applicant; and
3. a list of any exchanges, clearing centres or depositaries of which the applicant is or intends to become a member.

6. Financial Statements – An applicant must submit financial statements accredited by the applicant’s auditors in accordance with the standards issued by SOCPA and presented in the format prescribed by the Authority, and must:

1. show the applicant’s current and projected financial position, including its capital, financial resources, revenues and expenses as at the date of the financial statements; and
2. provide supporting evidence of the capitalisation and resources of the applicant and the presumptions on which the statements have been provided. Also, the applicant must submit projected financial statements that state the expected financial position after 12 months after the proposed date of commencement.

19 ل - Internal داخ 7. Registered Persons – An applicant must submit a list of each person who is to be a registered person and an application form for registration for each such person in the format prescribed by the Authority, including details of their qualifications and experience. 8. Terms of Business – An applicant must submit a copy of proposed terms of business (in accordance with Part 5 of these Regulations), and the proposed forms. 9. Incorporation Documents – If the applicant is a company, it must submit a copy of its articles of association or by-laws. 10. Ownership Structure – If an applicant is a company, it must submit an ownership structure chart showing the group of which the applicant is a part, including each controller and each person with whom the applicant has close links. 11. Organisation Chart – An applicant must submit an organisation chart identifying the applicant’s governing body, CEO, senior management, the compliance officer and MLRO. The chart must outline the reporting lines of each department within the business in accordance with Part 6 of these Regulations. 12. The applicant must submit any other requirements under the authorisation application form determined by the Authority. Second: Information and Documents Required For the Commencement of Business

1. Systems and Controls – The capital market institution must notify the Authority in writing of the availability of the following systems and controls documentation, in accordance with Part 6 of these Regulations:

1. risk management policies and systems;
2. anti-money laundering and combating the financing of terrorism procedures;
3. compliance manual;
4. compliance monitoring programme; and
5. code of conduct.

2. Operations Manual – The capital market institution must notify the Authority in writing of the availability of an operational procedures manual detailing the procedures and systems to be employed in relation to all material business and administrative operations, including the following:

20 ل - Internal داخ

1. opening and operating clients’ accounts;
2. processing and recording of orders, the execution,settlement, clearing, and contract notes of transactions;
3. the provision of prudent and suitable advice and services to clients;
4. handling and custody of client money and client assets;
5. reporting to clients; and
6. complying with all record-keeping requirements.

3. Contracts – The capital market institution must submit to the Authority the agreements, arrangements and understandings with third parties to provide any material services or operations, including:

1. execution, clearing and settlement of trades;
2. custody of client money or client assets;
3. arrangements to offer products or services provided by, sponsored by, or associated with a third party;
4. arrangements to introduce clients;
5. information technology, databases and computer systems;
6. record-keeping;
7. compliance services;
8. audit services.

4. Business Continuity – The capital market institution must submit a copy of its business continuity plan to the Authority.
5. Insurance – The capital market institution must submit details of professional indemnity insurance policies to the Authority in accordance with the requirements stipulated in paragraph (b) of Article 31 of these Regulations.
6. Final Incorporation Documents – The capital market institution must submit to the Authority copies of the final incorporation documents, including its articles of association and by-laws, the commercial registry, and the authorisation issued by the Ministry of Investment (where applicable).
7. Technical Systems – The capital market institution must notify the Authority in writing of the availability of appropriate technical systems.

21 ل - Internal داخ 8. Work Facilities – The capital market institution must notify the Authority in writing of the availability of appropriate work facilities, including offices and support services. 9. Registered Persons – The capital market institution must notify the Authority in writing of meeting the minimum registration requirements for registered persons. 10. Website – The capital market institution must have a website in Arabic language - at a minimum - through which it discloses any information determined by the Authority. 11. The capital market institution must comply with any other conditions or requirements determined by the Authority.

22 ل - Internal داخ ANNEX 3.2 NOTIFICATION REQUIREMENTS I. A capital market institution must notify the Authority in writing not less than 30 days before any change in:

1. the name of the capital market institution or, where the capital market institution is a company, its registered name;
2. any business name under which the capital market institution carries out securities business in the Kingdom; or
3. the address of the head office of the capital market institution, or, if different, the address of the place for service of notices or documents. II. A capital market institution must notify the Authority in writing within 7 days of the occurrence of:
4. any change in the material information provided to the Authority on the form of application for registration relating to a registered person’s name, good reputation or character. A registered person must give immediate notice to the compliance officer of the capital market institution of any such changes;
5. if the capital market institution is a company, the formation, acquisition, disposal or dissolution of a subsidiary specifying the subsidiary’s name and its principal business;
6. if the capital market institution is not a company, when it acquires or disposes of a holding of more than half in nominal value of the capital of a company or equivalent holding of an unincorporated body, specifying the name of the company or unincorporated body and its principal business; or
7. any changes in the information originally submitted under the following headings: • branch offices in the Kingdom through which the capital market institution carries out securities business; • insurance arrangements; • the countries outside the Kingdom in which the capital market institution carries out securities business indicating whether this is done through a branch office, a subsidiary or otherwise; and • the contracts or arrangements to clear and settle transactions or for custody of client money or client assets.

23 ل - Internal داخ III. A capital market institution must notify the Authority in writing immediately on the occurrence of:

1. the presentation of a petition for the winding up of the capital market institution or of a company which is a subsidiary or controller of the capital market institution or the summoning of any meeting to consider a resolution to wind up a capital market institution or a company which is a subsidiary or controller of the capital market institution;
2. any insolvency event;
3. the imposition of disciplinary measures or disciplinary sanctions on the capital market institution in relation to its securities business by any regulatory authority;
4. the conviction of the capital market institution for any offence under legislation relating to banking or other financial services, companies, insolvency, or for any offence involving fraud or any act involving a lack of integrity or dishonesty, or the imposition of any penalties for deliberate zakat or tax evasion;
5. a general partner in a capital market institution becoming a limited partner;
6. the granting or refusal of any application for, or revocation of, authorisation to carry out securities, banking or insurance business in any country or territory outside the Kingdom;
7. the withdrawal or refusal of an application for, or revocation of, membership of an exchange or clearing canter;
8. the appointment of inspectors by an official or regulatory authority to investigate the affairs of the capital market institution;
9. a significant act of misconduct by the capital market institution or any of its registered persons;
10. any procedural error at the capital market institution that may negatively affect any of its clients’ interests;
11. any matter which would be material to the requirements of the capital market institution, any of its controllers, or any of its registered persons to remain fit and proper in accordance with the requirements under these Regulations;
12. any other matter which would be material to the Authority’s supervision of the capital market institution or any of its registered persons; or
13. any material changes to the information previously provided by the capital market institution in any application for registration for one of its employees or prospective employees.

24 ل - Internal داخ The duty to notify in connection with the matters set out in paragraphs 11, 12 and 13 arises immediately when the capital market institution knows, or has reasonable grounds for believing, that any of these changes has occurred or will occur. IV. A capital market institution must inform the Authority immediately in writing of any material event or change in its business or operations. V. A capital market institution must give the Authority prior written notice, or where the event has occurred, written notice as soon as it becomes aware, of:

1. a proposed reorganisation or business expansion or other change that could have a material impact on the capital market institution’s business, risk profile or resources, including, but not limited to, the following: • setting up a new business within a capital market institution’s group, or establishing a new branch; • commencing the provision of cross border services into a new territory; • commencing the provision of a new type of product or service; • sale or transfer of any material assets or parts of its business; or • ceasing to undertake a securities business activity, or significantly reducing the scope of any activity.
2. any significant failure in the capital market institution’s systems or controls, including those reported to the capital market institution by the auditor; or
3. any event related to the capital market institution that results in a material change in its capital adequacy, including: • any action that would result in a material change in the capital market institution’s financial resources or financial resources requirements under these Regulations; • the payment of a special or unusual dividend or the repayment of share capital or a subordinated loan; • any proposal under which a member of the capital market institution’s group may be considering an action such as the actions mentioned above; or • any significant losses, whether recognised or unrecognised. VI. A capital market institution must notify the Authority within 2 days of the date of the resignation or dismissal of any of the following persons:

25 ل - Internal داخ

1. CEO or Managing member of the board of directors;
2. CFO;
3. member of the board of directors or partner;
4. senior executives and departments managers; directly related to securities business;
5. compliance officer; and
6. MLRO. In the event of dismissal, the full details of the reasons for the dismissal must be provided. VII. A capital market institution must notify the Authority 30 days prior to entering into, or materially changing, outsourcing arrangement of a function of a capital market institution of sufficient importance that failure of the function would jeopardise the capital market institution’s ability to comply with these Regulations; VIII. The Capital Market Institution that offers Robo-Advisory services must notify the Authority in advance of the strategies used in constructing and managing the portfolio, as well as any subsequent updates thereto, at least 10 days prior to making them available to clients on the platform.

26 ل - Internal داخ PART 4 REGISTERED PERSONS Chapter One: Background and Scope Article 18: Scope of Application This Part applies to capital market institutions, registered persons, applicants for individual registration and persons performing registrable functions. Article 19: Registrable Functions a) The Authority shall prescribe the registrable functions. b) The following functions are considered functions that must be performed by registered persons:

1. CEO or Managing member of the board of directors;
2. CFO;
3. a member of the board of directors or partner;
4. senior executives and departments managers; directly related to securities business;
5. compliance officer;
6. MLRO; and
7. the employees providing clients with securities business activities including sales representatives, investment advisors, clients’ or funds’ portfolios managers, corporate finance professionals and brokerage professionals as defined by the Authority.
8. Information Technology officer in a capital market institution that offers Robo￾Advisory services or authorised to carry out arranging activities in the course of carrying out securities crowdfunding. Article 20: Performance of Registrable Functions a) No person other than a registered person may perform a registrable function without the Authority's prior written consent. b) Every capital market institution must at all times have a person who is registered for each of the following functions:
9. CEO or Managing member of the board of directors;
10. CFO;
11. compliance officer;
12. MLRO; and

27 ل - Internal داخ 5) Information Technology Officer at the Capital Market Institution that offers Robo￾Advisory services. c) The Authority will not take action against a capital market institution for failure to comply with paragraph (b) of this Article where there is a temporary gap in the performance of the registrable functions, provided that the capital market institution actively seeks an appropriate substitute and notifies the Authority of another registered person who will temporarily take responsibility for that registrable function. d) A person may perform more than one registrable function for a capital market institution, except that:

1. the CEO, CFO and compliance officer must be separate persons unless the Authority specifically approves another arrangement; and
2. the compliance officer should not perform a client function. e) As an exception from paragraph (a) of this Article, and without prejudice to the provisions of Article (59) of these regulations, a capital market institution whose activity is limited to managing investment, arranging or advising may delegate the function of CFO, compliance officer or MLRO to an external party, if the following conditions are met:
3. the external party responsible for the function of CFO shall be a certified accounting firm licensed by the Saudi Organization for Certified Public Accountants, where one of its employees is assigned as CFO for the capital market institution;
4. the external party responsible for the function of compliance officer or the MLRO shall be a capital market institution, a certified accounting firm licensed by the Saudi Organization for Certified Public Accountants or a law firm authorized to practice law in Saudi Arabia, where one of its employees is assigned as compliance officer or MLRO for the capital market institution;
5. the employees assigned by the delegated third parties, aforementioned in paragraph (1) and (2), must pass the qualification examinations required by the Authority, or secure an exemption from the Authority from such requirement; and
6. any other conditions that the Authority specifies. f) As an exception from the provisions of paragraph (b) of this Article, the capital market institution must have –at minimum- two persons registered at all times one of which performs the functions of the Chief Executive Officer in case that its activity is limited to managing investments or arranging, and one person registered at all times performs the functions of the Chief Executive Officer in case its activity is limited to advising, without prejudice to the provisions of paragraph (c) of this Article, in the event that any of these

28 ل - Internal داخ functions become vacant, and provided that third parties are assigned to perform the rest of the registrable functions under paragraph (b) of this Article. g) With regards to paragraph (d) of this Article, the number of persons registered to perform the function of the clients’ or funds’ portfolio manager in the capital market institution authorised to carry out investment management business or investment management and operation of funds business must not be less than two persons at all times. Chapter Two: Registration Article 21: Requirements for Application for Registration a) A capital market institution must not apply for registration of a person to perform a registrable function without the consent of the relevant person. b) The application for registration must be made on the form prescribed by the Authority. c) An applicant for registration becomes subject to these Regulations from submission of the application. d) An applicant for registration must have passed the qualification examinations required by the Authority, or secured an exemption from the Authority from such requirement. e) The Authority will specify the examination requirements associated with the registrable functions, together with guidance on eligible qualifications and criteria for an exemption from the required examination. f) The capital market institution must pay such fees as may be determined by the Authority. Article 22: Procedure and Powers of the Authority a) In considering an application for registration, the Authority may take any of the following actions:

1. carry out any enquiries which it considers appropriate;
2. require the capital market institution or the applicant for registration to appear before the Authority to answer any questions and explain any matter it considers relevant to the application;
3. require that additional information be provided; and
4. verify the accuracy of any information furnished by the applicant for registration. b) The Authority will aim to process an application for registration within 30 days of receiving all information and documents that it considers pertinent. c) The Authority may, after considering the application, take any of the following actions:
5. approve the application for registration;

29 ل - Internal داخ 2) approve the application for registration subject to such conditions as it considers appropriate; 3) defer making a decision for such period as may be necessary to carry out further investigation or to allow for the provision of additional information; or 4) refuse the application for registration, giving reasons. d) If the Authority resolves to register the applicant for registration, the Authority will add the applicant’s name to the register of registered persons that the Authority shall maintain for this purpose and so inform the capital market institution. e) If the Authority resolves to reject the application, the Authority shall notify the applicant for registration and the capital market institution named in the application in writing. f) An applicant for registration must not perform the registrable function until he has been registered by the Authority. g) The capital market institution must obtain the Authority’s approval before changing the job title of the registered person. Article 23: Right of Appeal An applicant for registration or the capital market institution named in the application may appeal to the Committee in respect of any decision or action that the Authority takes under this Part. Chapter Three: General Provisions Article 24: Responsibilities of Registered Persons a) A registered person must comply with the Principles stated in Part 2 of these Regulations, as applicable. b) A registered person must be resident in the Kingdom unless the Authority exempts him from this requirement. c) This Article applies to any person performing a registrable function who is not registered. Article 25: Cancellation of Registration a) If a registered person’s registration is cancelled, the capital market institution must ensure that the person immediately ceases to perform a registrable function. b) Within seven days of a registered person ceasing to carry out a registrable function or ceasing to be employed or associated with a capital market institution, the capital market institution must notify the Authority of that fact on the appropriate form. Upon receipt of

30 ل - Internal داخ the notice, the registration will be suspended, and the suspension shall remain in force until the Authority resolves any of the following:

1. agrees to the termination of the registration;
2. consent to the person becoming employed by a capital market institution in a similar capacity; or
3. removes the person from the register of registered persons. c) A registered person who is removed from the register by the Authority has a right of appeal to the Committee. d) A registered person continues to be subject to the jurisdiction of the Authority in respect of any act or omission that occurred before the cancellation of his registration and for two years thereafter. If at any time during this period the Authority commences any enforcement investigation or proceedings, the registered person shall continue to be subject to the jurisdiction of the Authority until the end of the enforcement investigation or proceedings. e) The Authority shall have the power to cancel the registration of a registered person if the registered person violates any provision of the Capital Market Law or its Implementing Regulations.

31 ل - Internal داخ PART 5 CONDUCT OF BUSINESS Chapter One: General Provisions Article 26: Preliminary Provisions a) This Part applies to all securities business carried on by a capital market institution in the Kingdom or outside the Kingdom with or for a client who is in the Kingdom. b) A capital market institution must clearly state that it has obtained a license from the Authority on all communications, advertisements and notices that are issued to the public that are used by its employees and agents, whether in physical or electronic form. Article 27: Inducements a) A capital market institution must not:

1. induce a client to engage in any transaction by offering or giving gifts or inducements; or
2. accept gifts or inducements if doing so would conflict to a material extent with any duty which it owes to a client. b) For the purposes of paragraph (a) of this Article, the Authority will regard any gift or inducement given or received by an affiliate of a capital market institution or by a third party at the direction of a capital market institution as being given or received by the capital market institution itself. c) A capital market institution must not participate or offer to participate in any losses made by a client. Article 28: Special Commission Arrangements a) Special commission arrangement means an arrangement where a capital market institution receives goods or services in addition to trade execution services from an intermediary in return for the commission paid on transactions directed through that intermediary. b) A capital market institution may enter into a special commission arrangement if the following conditions are met:
3. the person responsible for executing the transaction provides best execution to the capital market institution;
4. the goods or services received by the capital market institution may reasonably be regarded as being for the benefit of the capital market institution’s clients;

32 ل - Internal داخ 3) the capital market institution has disclosed in its terms of business with clients that it may receive special commission; and 4) the amount of any fees or commission paid to the provider of the goods or services is reasonable in the circumstances. Article 29: Confidentiality A capital market institution must keep information obtained from clients confidential, and may not disclose such information except where:

1. its disclosure is based on the Authority’s or the Committees for Resolution of Securities Disputes’ request under the Capital Market Law, its Implementing Regulations or the related laws, or based on the General Administration of Financial Investigations’ request in accordance with the provisions of Anti-money Laundering Law and Combating-Terrorism Crimes and its Financing Law and their Implementing Regulations;
2. the client has explicitly consented to its disclosure;
3. its disclosure is reasonably necessary to perform a particular service for the client; or
4. the information is no longer confidential. Article 30: Chinese Walls Arrangements a) “Chinese wall arrangements” means written policies and procedures established by a capital market institution to secure confidential or inside information obtained by the capital market institution in the course of carrying out securities business that are designed to ensure that the information is known only to employees of the capital market institution who are authorised to receive it, and to ensure that the information is not disclosed to any other persons. b) A capital market institution that carries out arranging business and also carries out dealing as an agent or principal, advising or managing business must establish proper Chinese wall arrangements based on the nature, scale and complexity of its business. c) A capital market institution or an employee acting on behalf of a capital market institution is not in violation of the provisions of articles 5 or 6 of the Market Conduct Regulations if the capital market institution deals or advises in a security related to inside information while another department of the capital market institution is in possession of inside information, if the following conditions are met:
5. the capital market institution has established appropriate Chinese wall arrangements in view of the nature and size of its securities business;

33 ل - Internal داخ 2) the capital market institution has effectively implemented and maintained its Chinese wall arrangements; and 3) none of the individuals involved in the dealing or advising activity has knowledge of the inside information or has received advice on the dealing or advising activity from an individual who has knowledge of the inside information. Article 31: The Liability of Capital Market Institution a) Any condition providing for the exclusion or restriction of the liability of a capital market institution, whether under terms of business or otherwise, shall be void if the exclusion or restriction contravenesthe capital market institution’s obligations under the Capital Market Law or the Implementing Regulations. b) The capital market institution must have adequate indemnity insurance for the risks of professional failures, based on the nature, scale and complexity of its business. Chapter Two: Securities Advertisements Article 32: Scope of Application This Chapter applies to all securities advertisements made by a capital market institution in the Kingdom, or approved by a capital market institution for communication by another person. This Chapter does not apply to an advertisement that is excluded under the Securities Business Regulations. Article 33: Prepared Securities Advertisements a) A prepared securities advertisement means any advertisement for securities or securities activity, prepared in advance, for the purpose of inviting or inducing a person to engage in securities activity and communicated in writing, electronically or, otherwise to one or more persons. b) Before communicating a prepared securities advertisement, or approving its contents to be communicated by another person, a capital market institution must ensure that:

1. the advertisement complies with the requirements of this Part after it is approved by a designated officer of the capital market institution;
2. the advertisement is clear, fair and not misleading; and
3. that the approved advertisement contents to be communicated by another person, include a clear, fair and not misleading disclosure that such person has received or will receive benefits in exchange for communicating that advertisement.

34 ل - Internal داخ c) A prepared securities advertisement must comply with the content requirements set out in Annex 5.1. d) If the prepared securities advertisement relates to specific securities then it must contain sufficient information to enable a person to make an informed assessment of the securities or securities activity to which it relates. e) If a capital market institution becomes aware that a prepared securities advertisement does not comply with the requirements of this Part, or when it receives instructions from the Authority in this regard, it must withdraw the advertisement as soon as possible. f) A capital market institution must maintain a complete record of each prepared securities advertisement that it has approved and confirmed compliance for. g) The Capital Market Institution that offers Robo-Advisory services must disclose on the platform the performance record of the investment portfolios since inception. This must include the criteria and methodology used to measure portfolio performance, the total returns achieved after deducting actual expenses, and any updates thereto. The Capital Market Institution must comply with the requirements stipulated in Annex (5-1). Article 34: Direct Communications a) Direct communications means any securities advertisement that is not a prepared securities advertisement, including a meeting with a client or potential client, a telephone call, a presentation or any direct interaction with one or more persons. b) Before making any direct communication a capital market institution must ensure that:

1. the recipient has consented to receiving the securities advertisement; or
2. the recipient has an existing client relationship with the capital market institution and contemplates pursuant to such relationship that such securities advertisements will be made. c) A capital market institution must ensure that an individual who makes a direct communication on the capital market institution’s behalf, including any registered person or other employee:
3. does so in a way which is clear, fair and not misleading;
4. does not make any false or misleading statements;
5. makes clear the purpose of the securities advertisement at the initial point of communication, and identifies himself and the capital market institution who he represents; and
6. does not communicate with a person outside of business hours, unless the person has previously agreed to such a communication.

35 ل - Internal داخ d) A capital market institution must have a Code of Conduct that require individuals seeking to obtain business on behalf of the capital market institution to avoid using any undue pressure or making any misleading statements, and to make clear their purpose and identity to clients or potential clients. Article 35: Non-Retail Client’s Investment Funds and Derivatives A capital market institution must not communicate securities advertisement to a retail client related to non-retail clients’ investment funds or to derivatives securities, unless it has determined that the securities are suitable for such client. Chapter Three: Accepting Clients Article 36: Client Classification a) Before conducting securities business with or for any client, a capital market institution must classify the client as one of the following:

1. a retail client;
2. a qualified client; and
3. an institutional client. b) A capital market institution must not classify a client in more than one of the categories set out in paragraph (a) of this Article. c) A capital market institution must make a record of the classification established for each client under this Article, including sufficient information to support that classification. Article 37: Anti-Money Laundering and Combating the Financing of Terrorism Before conducting securities business with or for any client, a capital market institution must ensure that it complies with all obligations under the Anti-Money Laundering Law and its implementing regulations and the Combating-Terrorism Crimes and its Financing Law and its implementing regulations. Article 38: Terms of Business with Clients a) A capital market institution must provide a client with terms of business setting out the basis on which securities business is to be carried out with or for the client. Such terms must be provided before conducting any securities business with or for the client. b) The terms of business with a client must take the form of an agreement which takes effect once an executed copy of the terms of business has been provided by the client.

36 ل - Internal داخ c) A capital market institution must ensure that its terms of business set out in adequate detail the basis on which securities business is to be conducted. d) A capital market institution must ensure that its terms of business with its retail client conform to the terms of business requirements set out in Annex 5.2. e) A capital market institution must retain a record of the terms of business it provides to a client, and any amendment to them. Article 39: Know Your Client a) Before a capital market institution carries out any securities business for a client or for its account, it must obtain information from the client concerning the client’s financial situation, investment experience and investment objectives relevant to the services to be provided. Such information must be obtained as a precondition to providing such services. b) The information required under paragraph (a) of this Article must include, at a minimum, the information required by Annex 5.3(A) and a capital market Institution may be guided by the information stipulated in Annex 5.3(B). c) The capital market institution must request an update of such information from each client under these Regulations, when there is any change to them upon such information expiry date, or at the end of the relevant time period specified by the capital market institution pursuant to the rules and polices approved by the capital market institution in accordance with the level of risks associated with the client, whichever is earlier, and the capital market institutions must perform a periodic review to study the need to update the information provided by the client at least once every five years, and the capital market institution shall establish permanent procedures and policies to achieve this. d) If the client refuses to provide the information required under paragraph (a) of this Article, the capital market institution may not conduct any securities business for him. e) A capital market institution must retain a record of all information obtained from the client pursuant to this Article. Chapter Four: Client Relations Article 40: Fiduciary Duties A capital market institution owes the statutory fiduciary duties set out in Annex 5.4 to its clients.

37 ل - Internal داخ Article 41: Conflicts of Interest a) A capital market institution must ensure that it safeguards at all times the interests of its client, and that no conflict of interest between its interest and the interest of it client affects the transactions or the services that the capital market institution carries out for its client. b) Where a capital market institution who acts for, or provides advice to a client has an actual or a potential conflict of interest in relation to a transaction or advising a capital market institution shall disclose that conflict of interest to the client in writing, and obtain a written acknowledgment from the client that he understands and is fully aware g of the actual or potential conflict of interest between the interests of the capital market institution and his interests. c) A capital market institution is not required to disclose a conflict of interest if this information would constitute provision of inside information. In that instance a capital market institution shall take reasonable steps to ensure fair treatment for the client. d) If there is a conflict between an interest of a capital market institution and an interest of the client in any transaction, the capital market institution must pay to the client the value of any loss incurred by the client as a result of the conflict unless:

1. the capital market institution has disclosed the conflict of interest to the client in accordance with paragraph (b) of this Article; and
2. the client has agreed in writing that the capital market institution can proceed notwithstanding the conflict. e) A capital market institution must in all cases comply with Article 14 of the Market Conduct Regulations in any dealing as principal with a client. f) A capital market institution authorised to carry out advising business may present itself as an independent investment advisor unless in the event of an actual or a potential conflict of interests between its interests and the interests of the person to whom advice is given. g) The capital market institution must establish a special record for each type of securities business to document all actual or potential conflicts of interest and the measures taken in their regard. Article 42: Understanding Risk a) A capital market institution must not deal, advise, offer a security, distribute investment funds units, manage for a client or take collateral for its own account from a client, unless it has taken reasonable steps to enable the client to understand the nature of the risks involved in the type of transaction in which the client would be engaging, and to enable such client to understand the nature of the risks involved, the capital market institution must have regard to:

38 ل - Internal داخ

1. The educational and knowledge level of the client (where applicable);
2. The client’s field of work; and
3. The client's experience in the capital markets, its duration, and its nature; b) This Article does not apply to the capital market institution's carrying out any securities business with or for an institutional client as a counterparty. Article 43: Suitability a) A capital market Institution must not deal, advise, offer a security, distribute investment funds units or manage for a client or take collateral for its own account from a client, unless the advice or transaction is suitable for that client having regard to the facts disclosed by that client and other relevant facts about that client of which the capital market Institution is, or reasonably should be aware. b) In considering the suitability of advice or a transaction for a client, a capital market institution must have regard to:
4. The educational and knowledge level of the client (where applicable);
5. Client’s field of work;
6. the client’s knowledge and understanding of the relevant securities and markets, and of the risks involved, and its ability to withstand them;
7. the client’s financial standing, including an assessment of his net worth or of the value of his portfolio based on the information disclosed by that client, the type of assets owned by the client, how long the client maintained them, and what the proposed transaction represents in all the assets of the client;
8. the length of time the client has been active in the relevant markets, the frequency of business and the extent to which he relies on the advice of the capital market institution;
9. the size and nature of transactions that have been undertaken for the client in the relevant markets;
10. the client’s investment objectives; and
11. the period during which the client expects to cash out his invested money. c) A capital market institution before advising the client or effecting the transaction must submit to the client a report on the suitability of that advice or transaction, provided that the report includes, at a minimum, the following:
12. The client's investment objectives and the client’s risk tolerance;
13. Disadvantages and risks of advice or potential transaction; and
14. Justifications for concluding that the advice or potential transaction is suitable or not for the client, in light of the facts disclosed by that client.

39 ل - Internal داخ d) As an exception from the provisions of paragraph (c) of this Article, the capital market institution who acts as manager of the client’s account must prepare a suitability report for that client at the beginning of the contractual relationship, upon updating its terms and upon renewing it. e) As an exception from the provisions of paragraph (a) of this Article, if a capital market institution has advised a client that a transaction is not suitable for him as per the suitability report and the client insisted on proceeding with the transaction after viewing the suitability report, a capital market institution may accept an order to buy or sell the security from the client after informing him that the execution of the transaction is not consistent with the suitability report, and obtain an acknowledgment from the client of understanding that, provided that the suitability report records and the acknowledgment of the client are retained. f) The client’s acknowledgment referred to in Paragraph (e) of this Article must be prepared in a clear, fair and non-misleading manner, and shall include the client’s acknowledgment of the following:

1. The client has reviewed the suitability report for the transaction it is insisting on executing;
2. The client is aware of all the details of the transaction it is insisting on executing, and understand its risks; and
3. The client understands that execution of the transaction is inconsistent with the suitability report. g) The client’s notice referred to in paragraph (e) of this Article must be reviewed and certified by a registered person independent of the person who prepared the suitability report. h) A capital market institution must not use pressure methods or give any misleading statements to the client that may lead the client to provide false, inaccurate, or incomplete information for the purposes of studying the suitability of the advice or transaction for the client. i) A capital market institution may rely on the information provided by the client for the purposes of studying the suitability of the advice or transaction for the client, unless it knows or must reasonably know that the information provided is false, inaccurate or incomplete. j) This Article does not apply in the following cases:
4. Where the capital market institution deals with a client as agent in accordance to the instructions it receives from the client without providing advice to the client, and the transactions will be executed in the listed debt instruments market, the main market or its equivalent securities markets outside the Kingdom;

40 ل - Internal داخ 2) Where the capital market institution offers shares or publicly offered debt instrument, or offers or distributes open public low risk investment funds units, or offer securities through securities crowdfunding platforms. 3) Where the capital market institution deals with an institutional client as agent only in accordance with the instructions it receives from the client without providing advice to the client or managing for him, except for the counterparty; or 4) Where the capital market institution deals with an institutional client as a counterparty. k) The capital market institution, after obtaining the Authority’s approval, may rely on means of modern technologies to consider the suitability of the advice or transaction for the client, provided that the capital market institution establishes permanent procedures and policies to verify the correctness and accuracy of the considering results and that they meet the requirements of this Article. Article 44: Client Borrowing a) A capital market institution shall not, in relation to securities business, knowingly lend money or extend credit to a client and must not arrange for any other person to do so, unless:

1. the capital market institution has made and recorded an assessment of the client’s financial standing, based on information disclosed by that client, and is satisfied that the amount and the arrangements for the loan or credit are suitable for the client; and
2. the client has given his prior written consent to the lending or credit facility, specifying the maximum amount of the loan or credit together with details of the amount and of any charges to be levied.
3. the lending of money or extension of credit facilities to the client shall not be linked to derivative contracts. b. Paragraph (a) of this Article does not apply where a capital market institution:
4. settles a transaction in the event of a default or late payment by the client; or
5. pays an amount to cover a margin call made for a client for a period no longer than five days.
6. effects margined transactions. Article 45: Margin Requirements a) A capital market institution may not effect a margined transaction with or for a client unless the client has entered into terms of business specifying the following:
7. the circumstances under which the client may be required to provide margin;

41 ل - Internal داخ 2) particulars of the form in which the margin may be provided; 3) particulars of the steps which the capital market institution may be entitled to take if the client fails to provide the required margin, including the communication method(s) by which the margin call will be made on the client; 4) that failure by the client to meet a margin call may lead to the capital market institution closing out the client’s position after a time limit specified by the capital market institution, and that the capital market institution is entitled to close out the position in any event after a period of five days from such failure; and 5) any circumstances, other than failure to provide margin, which may lead to the client’s position being closed without prior reference to him. b) A capital market institution may make a secured or unsecured loan or grant credit to a client for a period of more than five days for the purpose of making a deposit of margin or required margin payment if the following two conditions are met:

1. a credit assessment is made of the client by an employee of the capital market institution who is independent of the trading or marketing functions; and
2. the client has given his prior written consent to the lending or credit facility, and such consent specifies the maximum amount of the loan or credit together with details of the amount and of any charges to be levied. c) A capital market institution that effects a margin transaction with or for a client must perform the following:
3. take reasonable steps to ensure that the client is aware of the risks of margin transactions;
4. in relation to effecting a margin transaction on shares of companies listed on the exchange, require the client to provide a minimum margin not less than 50% of the transaction value prior to effecting the transaction; and
5. in relation to effecting a margin transaction on shares of companies listed on the exchange, monitor the margin provided by the client daily, and ensure that the margin is not less than 25% of the current value of each applicable security position. d) The Authority may prescribe a higher rate of margin to be provided for transactions in any security or category of securities, and the capital market institution must require a client to provide any such prescribed rate of margin. e) The Authority may prohibit margined transactions in relation to any security or category of securities. f) Without prejudice to the provisions of paragraph (j) of this Article, margin payable by a client in respect of a margin transaction on a regulated exchange or market must be of an

42 ل - Internal داخ amount or value at least equal to the margin requirements of the relevant exchange, market or clearing centre. g) Margin must be in the form of cash, fully-paid security positions or other acceptable collateral by the capital market institution. h) The capital market institution must periodically determine the securities on which margin transaction can be affected with the client in accordance with specific standards and controls approved by its board of directors. i) A capital market institution may not effect a margin transaction on shares of listed companies whose accumulated loss reaches 50% or more of its capital, according to the disclosures issued by the listed companies. j) A capital market institution may not effect a margin transaction with a client or for his account on a derivative contract. Article 46: Fees and Commissions Fees and commission charged by a capital market institution to its clients must be fully disclosed in advance of providing any services. Chapter Five: Reporting to Clients Article 47: Contract Notes a) A capital market institution who effects a sale or purchase of a security with or for a client must send the client a contract note forthwith. b) A contract note does not have to be sent where the capital market institution is acting as manager and the client has confirmed that he will not require such contracts notes to be provided in writing. c) Contract notes must provide the information required in Annex 5.5. Article 48: Periodic Reporting a) A capital market institution who acts as manager for a client must send a valuation report at least every three months in respect of securities or securities-related cash balances contained in the client’s account. b) Valuation reports must provide the information required in Annex 5.6.

43 ل - Internal داخ Chapter Six: Miscellaneous Article 49: Client Records a) A capital market institution must keep and maintain proper records of each transaction it effects. Such records must be current at all times and be sufficient to demonstrate compliance with these Regulations. b) A capital market institution must keep and maintain proper records of client accounts. Such records must:

1. accurately record at all times the assets and liabilities of each client and of all clients collectively;
2. contain such information as is necessary to enable the capital market institution to prepare a statement of each client’s assets and liabilities, and details of transactions effected for the client; and
3. identify all client money and client assets that the capital market institution, or its custodian, are responsible for. c) The records of the capital market institution must contain:
4. details of all orders in a security entered by a client;
5. details of all purchases and sales of a security made by the capital market institution for a client, or by the capital market institution for its own account;
6. a record of all income and expenses for each client, explaining their nature;
7. details of all receipts and payments of client money and client assets;
8. a record of the cash and securities held in each client account; and
9. a record of client money and client assets. Article 50: Employees’ Personal Dealings a) An employee of a capital market institution must not knowingly:
10. be a party to any transaction in a security where a client of the capital market institution is a party; or
11. Opening an investment account at another capital market institution, unless he has obtained the prior consent of the capital market institution which he works for. b) An employee of a capital market institution must disclose to the compliance officer all transactions in securities that he executes for his account or any other account for which he is authorised, unless he was acting as an employee of a capital market institution, within 7 days from the date of execution.

44 ل - Internal داخ c) The compliance officer must establish procedures to monitor employees’ personal dealings in securities to ensure compliance with the Capital Market Law and the Implementing Regulations. d) A capital market institution must implement personal account dealing procedures consistent with the provisions of Annex 5.7. Article 51: Recording Telephone Calls a) A capital market institution must not make or accept telephone communications from clients or prospective clients in relation to securities business unless the capital market institution records the telephone communications. b) A capital market institution must disclose to its clients or prospective clients that telephone communications in relation to securities business will be recorded. c) A capital market institution must retain the records of telephone communications in relation to securities business for a period of ten years following the date of the telephone communication. In the event a telephone communication is relevant to a dispute with a client or a regulatory enquiry, the record must be retained until the dispute is fully resolved or the enquiry completed.

45 ل - Internal داخ ANNEX 5.1 CONTENTS REQUIREMENTS FOR SECURITIES ADVERTISEMENTS I. GENERAL CONTENTS REQUIREMENTS FOR ALL SECURITIES ADVERTISEMENTS 1 Clarity of Purpose The purpose of the advertisement must be clear. 2 Clarity of subject The nature or type of securities business and the type of securities being advertised must be clear. 3 Statements, promises or forecasts Any statement, promise or forecast must be fair and not misleading in the form and context in which it appears. If any promise or forecast is based on assumptions, the assumptions must be stated. An advertisement must not forecast the possible future price of securities. 4 No false or misleading statements The advertisement must not include false or misleading statements relating to the securities business, size or resources of the capital market institution or any type of securities. 5 Name, address and regulatory status The advertisement (or the person making the advertisement) must state the name and address of the capital market institution, and that the capital market institution is authorised by the Authority. II. CONTENTS REQUIRED FOR PREPARED SECURITIES ADVERTISEMENTS PROMOTING A SPECIFIC SECURITY OR SECURITIES OR A SPECIFIC SECURITIES SERVICE 6 Guarantees The advertisement must not describe a security as guaranteed unless there is a legally enforceable arrangement with a third party who undertakes to meet in full an investor’s claim under the guarantee. If so, the advertisement must give details

46 ل - Internal داخ about both the guarantor and the guarantee sufficient for an investor to make a fair assessment about the value of the guarantee. 7 Comparisons Advertisements that compare different securities or services must:

1. be based either on facts verified by the capital market institution or on assumptions stated within the advertisement;
2. be presented in a fair and balanced way; and
3. not omit anything material to the comparison. 8 Material interest A capital market institution must include a statement acknowledging circumstances where the capital market institution knows that it or its affiliates:
4. has or may have a position or holding in the securities concerned or in related securities; or
5. is providing or has provided within the previous 12 months significant advice or securities business services to the issuer of the securities concerned or of a related security. 9 Past performance Any information about the past performance of securities or of a capital market institution that is included in an advertisement must:
6. be a fair representation of the past performance of the securities or capital market institution;
7. not be selected so as to exaggerate the performance of the securities or capital market institution;
8. state the source of the information;
9. be based on verifiable information; and
10. warn that past performance is not necessarily a guide to future performance. 10 Zakat and Taxation If the advertisement contains any reference to the impact of zakat or taxation, it must:
11. state the assumed rate of zakat or taxation and any relief; and

47 ل - Internal داخ 2) state that such rates and relief may change over time. 11 Cancellation rights Any advertisement for securities to which cancellation rights apply must contain details of such rights, including the period within which they may be exercised. 12 Advertiser Benefits If the contents of the advertisement are approved by the capital market institution to be communicated by another person, the capital market institution must include the advertisement with a statement disclosing clearly, fairly and not misleadingly that such person has received or will receive benefits in return for communicating that advertisement. III. RISK WARNINGS FOR PREPARED ADVERTISEMENTS OF SPECIFIC SECURITIES 13 Fluctuations in value Where the securities can fluctuate in price or value, a statement must be made that prices, values or income may fall and, if applicable, a warning that the investor may get back less than he invested. 14 Suitability Where the advertisement contains or refers to a recommendation about a specific security or securities service, a statement must be made warning that it may not be suitable for all recipients of the advertisement and a recommendation that, if they have any doubts, they should seek advice from their investment advisor. 15 Volatile securities Where the advertisement relates to a security which is a geared security or a contingent liability security, it must state, if it is the case:

1. that the security may be subject to sudden and large falls in value which could cause a loss equal to the amount invested; and

48 ل - Internal داخ 2) that the investor’s loss may not be limited to the amount originally invested or deposited, but may have to pay more. 16 Investment income Where a security is described as being suitable for an investor particularly seeking income from his security, the investor must be warned, if it is the case, that:

1. income from the security may fluctuate; and
2. part of the capital invested may be used to pay that income. 17 Foreign currency denominated securities Where a security is denominated in a foreign currency, the investor must be warned that changes in currency rates may have an adverse effect on the value, price or income of the security. 18 Illiquid Securities An advertisement for an illiquid security must state that it may be difficult:
3. for the investor to sell or realise the security; and
4. to obtain reliable information about its value or the extent of the risks to which it is exposed. 19 Sales charges and fees
5. If an advertisement relates to a security on which deductions for charges and expenses are made at the time of the initial investment or on the sale of the investment, a warning that such charges apply must be included.
6. If an advertisement relates to a security on which performance fees are charged, a warning that such charges apply must be included.

49 ل - Internal داخ ANNEX 5.2 TERMS OF BUSINESS REQUIREMENTS A capital market institution’s terms of business to be entered into with or for a retail client should, where relevant, provide for the following:

1. Commencement The date on which the terms of business come into force.
2. Name, address and regulator The name and address of the capital market institution and a statement that the capital market institution is subjected to the Authority’s supervision and control.
3. Investment objectives The retail client’s investment objectives.
4. Restrictions Any restrictions on: • the types of securities in which the retail client wishes to invest; and • the markets on which the retail client wishes transactions to be executed.
5. Services The services which the capital market institution will provide.
6. Payments for services Details of any payment for services payable by the retail client to the capital market institution, including the following:
7. structure and methods of the payments;
8. how it is to be paid and collected;
9. how frequently it is to be paid, and
10. any other payment that is receivable by the capital market institution (or by any of its affiliates) in connection with any transaction executed by the capital market institution, with or for the retail client, in addition to or in lieu of any fees.

50 ل - Internal داخ 7) Investment manager If the capital market institution is to act as manager, the terms of business must include the following:

1. the arrangements for giving instructions to the capital market institution and acknowledging those instructions;
2. the initial value of the managed portfolio;
3. the initial composition of the managed portfolio;
4. the period of account for which statements of the portfolio are to be provided;
5. the extent of the discretion to be exercised by the capital market institution, including any restrictions on investments;
6. how performance will be measured;
7. how valuations will be made.
8. When providing Robo-Advisory services, the terms of business must include the following: a) A clear explanation of the strategies used in constructing and managing the investment portfolio. b) The criteria for asset selection and the methodology for asset allocation within the investment portfolio. c) The methodology for rebalancing the investment portfolio. d) The operational framework of the algorithms and the technological tools used in providing Robo-Advisory services, and the risks associated therewith.
9. Accounting The arrangements for accounting to the retail client for any transaction executed on his behalf.
10. Cancellation rights A description of any cancellation right to which the retail client may be entitled.
11. Acting as a principal That capital market institution may act as principal in a transaction with the retail client, if applicable.
12. Risk warning Any risk warning required under Part 5 of these Regulations.
13. Security lending Whether the capital market institution may undertake security lending activity with or for the retail client.
14. Termination method How the terms of business may be terminated.
15. Complaints How to complain to the capital market institution.

51 ل - Internal داخ 15) Right to realise retail client’s assets A description of any right of the capital market institution to realise the assets of the retail client (including any collaterals) or to close out or liquidate positions on a default. 16) Contingent liability securities A statement of the basis on which the retail client will incur any contingent liability, including margin requirements, and the maximum limits placed on such funding. 17) Authority to borrow Details of any authority to borrow or raise money on the retail client’s behalf, or enter into transactions which will involve the retail client having to borrow or raise money and the maximum borrowing limit must be clarified. 18) Special commission arrangements A statement explaining the capital market institution’s policy regarding special commission arrangements. 19) Custody Arrangements for:

1. registration of client assets if these will not be registered in the retail client’s name;
2. claiming and receiving dividends, commission payments and other entitlements accruing to the retail client;
3. exercising conversion and subscription rights;
4. dealing with takeovers, other offers or capital re-organisations;
5. exercising voting rights;
6. the capital market institution’s liability in the event of a default by an eligible custodian;
7. the giving and receiving of instructions by or on behalf of the client or other person accredited by the client, and any restrictions to that authority; and
8. any agreement to lien or pledge interests over the client asset taken by the capital market institution or an eligible custodian except in respect of charges relating to the administration or custody of the client assets.
9. Pooling A capital market institution must notify a retail client where it intends to pool his client asset with that of one or more other clients and explain the meaning of pooling and warn the retail client that:
10. client assets or entitlements may not be separately identifiable by certificates, other physical documents of title or electronic record; and

52 ل - Internal داخ 2) retail clients may participate pro rata in any irreconcilable shortfall resulting from the default of a custodian. 21 ( Client assets held overseas Where a capital market institution in accordance with these Regulations arranges for client assets to be held overseas, it must notify a client in writing that there may be different settlement, legal and regulatory requirements in overseas jurisdictions from those applying in the Kingdom. 22 ( Client money A capital market institution must notify a retail client in writing of the arrangements for holding client money.

53 ل - Internal داخ ANNEX 5.3 (A) KNOW YOUR CLIENT FORM Client must provide the information required by this Annex. FILL THE FOLLOWING IF: CLIENT IS AN INDIVIDUAL PERSONAL INFORMATION Full Name:(in accordance with identification document): Date of birth: ID Number/passport No.: Marital Status: Number of dependants: Educational level: Primary / Intermediate / High school / Diploma / Bachelor/ Postgraduate) Citizenship: Address for Correspondence (national address if the client is resident of the Kingdom) Mobile Phone: Another phone: Approximate annual income (in SAR)? • 100,000 or less  • 100,001-300,000  • 300,001-600,000  • 600,001 -1,500,000  • 1,500,001 -5,000,000  • 5,000,001 – 10,000,000  • 10,000,001 – 50,000,000  • Over 50,000,000  Approximate net worth (excluding residence) (in SAR)? • 100,000 or less 

54 ل - Internal داخ • 100,001-300,000  • 300,001-600,000  • 600,001 -1,500,000  • 1,500,001 -5,000,000  • 5,000,001 – 10,000,000  • 10,000,001 – 50,000,000  • Over 50,000,000  EMPLOYER INFORMATION Employer’s Name: Employer’s Address: Employer’s Phone Number: Position / Title: Duration of Employment: BANK INFORMATION Bank’s Name: Branch: Main Account Number: CLIENT'S PROFESSIONAL EXPERIENCES IN THE FINANCIAL SECTOR Has the client worked in the financial sector during the past five years? Yes/ No (This includes, for example: working for capital market institutions, banks, finance companies, insurance companies) Does the client have any other practical experience related to the financial sector? Yes/ No GENERAL INFORMATION Is the client a board of directors member, an audit committee member or a senior executive in a listed company? Yes / No Does the client have a close association with a board of directors member, an audit committee member or a senior executive in a listed company? Yes /No Is the client entrusted with prominent public functions in the Kingdom or a foreign country, senior management positions, or a position in an international organization? Yes/ No Does the client have a relationship (by blood or marriage up to the second degree), or have an association with a person entrusted with a prominent public function in the Kingdom or

55 ل - Internal داخ a foreign country, senior management positions, or a position in an international organization? Yes/ No Is the client the beneficial owner of the account or business relationship? Yes/ No The identity of the beneficial owner of the account or business relationship (if the answer to above question is No) Any other financial information on the client’s financial situation?

56 ل - Internal داخ FILL THE FOLLOWING IF: CLIENT IS A LEGAL PERSON GENERAL INFORMATION Name: Commercial Registration No. or its equivalent: Registered Address: Country of Registration: Main business: Date of incorporation or start of business: Country of practicing business: Names of natural persons who own or control 25% or more of the shares: Names of all directors and senior executives: Business Phone: Number of employees: Paid-up capital: Annual Turnover: CONTACT Name of Contact: Address for Correspondence: Business Phone: Mobile Number: Email address: BANK INFORMATION Bank’s Name: Branch: Main Account Number OTHER INFORMATION Any other financial information on the client’s financial situation?

57 ل - Internal داخ CUSTODIAN DETAILS Name: Address for correspondence: Account name: Account number:

58 ل - Internal داخ ANNEX 5.3 (B) INVESTMENT INFORMATION FORM A capital market institution may use this guidance annex. INVESTMENT INFORMATION Investment knowledge and experience • Low ........................................................................................................ • Medium................................................................................................... • high.......................................................................................................... • Number of years of investment in securities • Products previously invested in • Professional certificates (if the client is a natural person) • Loan to invested money ratio • Margin transactions over the past five years • Securities transactions outside the Kingdom over the past five years • If securities transactions were executed outside the Kingdom over the past five years, in which countries were these transactions executed? Client’s appetite for risk Low  Medium  High  General investment objectives? • protection of capital ............................................................................... • income..................................................................................................... • balanced .................................................................................................. • growth of capital .................................................................................... • create savings for retirement................................................................... • project financing ..................................................................................... • purchase an asset (for example: real estate, or vehicle) ......................... What are the client’s preferred investment assets [tick as many as required]: • denominated in Saudi Riyals?................................................................. • denominated in other foreign currencies? ............................................... • State the foreign currencies: .......................................................................

59 ل - Internal داخ The period during which the client expects to cash out his invested money: • Short term (less than 1 year) ................................................................... • Medium term (1 year-5 years) ................................................................ • Long term (more than 10 years) ............................................................. Client’s investment portfolio profile: Client’s current investment portfolio profile: Client’s ideal investment portfolio profile: Deposits and Murabaha Debt instruments Shares Real-estates Derivative contracts Alternative investments Ensure that the sum of all Percentages of each portfolio above equal 100% Indicate where the following should be forwarded The client The custodian Other: Specify all details as instructed by client

1. Certificates
2. Dividends/other income
3. Sale proceeds

60 ل - Internal داخ ANNEX 5.4 FIDUCIARY DUTIES

1. Loyalty A capital market institution must act in all cases in good faith and in the interests of the client.
2. Conflict of Interest A capital market institution must comply with principle 10 provided for at paragraph (b) of Article 5 and with the provisions of Article 41 of these Regulations.
3. No Secret Profits A capital market institution must not use the client’s property, information or opportunities for its own or anyone else’s benefit unless the capital market institution makes full disclosure of such usage to the client and obtains his consent.
4. Care, Skill and Diligence A capital market institution owes the client a duty to exercise the care, skill and diligence which would be exercised in the same circumstance by a person having both: a. The knowledge and experience that may reasonably be expected of a person in the same position as the capital market institution; and b. The knowledge and experience which the capital market institution has.

61 ل - Internal داخ ANNEX 5.5 REQUIRED CONTENTS OF CONTRACT NOTES Particulars

1. The capital market institution’s name and a statement that it is authorised by the Authority.
2. The trade date and time.
3. The client’s name, account number, address or other identifier.
4. The security concerned, the size involved and the type of the transaction (sale or purchase), and:

1. the maturity and delivery or expiry date if the security is a contractually based security;
2. if the security is an option that has been exercised: • the strike price of the option; and • whether the exercise of the option creates a sale or purchase in the underlying asset.

5. The per security price at which the transaction was executed, or averaged and the total consideration due from or to the client, and a statement if applicable, that the price is an averaged price.
6. The settlement date where agreed.
7. The capital market institution’s charges to the client in connection with the transaction.
8. The amount of any front-end loading if the transaction is a purchase of a unit in an investment fund.
9. Whether the capital market institution executed the transaction as principal, or with or through an affiliate.
10. Where any commission or other return which has accrued or will accrue on the relevant securities is accounted for separately from the transaction price, the amount of the commission or other return which the purchaser will receive or the number of days for which he will receive commission must be clarified.
11. A statement, if this is the case, that any dividend, bonus or other right which has been declared, but which has not been paid, allotted or otherwise become effective in respect of the relevant security, will not pass to the purchaser under the transaction.

62 ل - Internal داخ 12) The amount of any costs including transaction taxes which are incidental to the transaction and which will not be paid by the capital market institution out of the charges mentioned in 7 above. 13) If the transaction involved or will involve the purchase of one currency with another, the currency conversion rate involved or a statement that the rate will be supplied on request. 14) If the security to which the contract note relates closes out an open position in a derivatives contract, the contract note must set out:

1. each derivatives contract that forms part of the open position;
2. each derivatives contract that forms part of the closing of the position; and
3. the net profit or loss made by the client on closing out the position.

63 ل - Internal داخ ANNEX 5.6 REQUIRED CONTENTS OF PERIODIC VALUATION STATEMENTS FOR CLIENT PORTFOLIOS

1. Contents and Value of Portfolio

1. Description of each security held in the portfolio, the number of shares, units or contracts held, and the current value of each security position;
2. Amount of cash balances;
3. Total value of the portfolio on the valuation date; and
4. Change in the value of the portfolio since the last valuation statement.

2. Basis of Valuation

1. A statement of the basis on which the value of each security has been determined and an explanation of any change in the basis for valuing any securities since the previous valuation report.
2. Where any securities are valued in a currency other than the currency used to value the portfolio, the relevant currency conversion rates as of the valuation date must be shown.

3. Transactions and Changes in Portfolio

1. Particulars of each transaction entered into for the portfolio during the period;
2. Total amount of money transferred into and paid out of the portfolio during the period;
3. Details of any securities transferred into or out of the portfolio during the period; and
4. Total amount of commissions, dividends and other returns received by the capital market institution for the portfolio during the period.

4. Charges and Remuneration

1. Total amount of fees, charges and taxes paid out of the portfolio for purchases and sales of securities during the period;
2. Total amount of fees and charges for managing the portfolio and any other services provided by the capital market institution during the period; and
3. Details of any remuneration received by the capital market institution from a third party in respect of transactions entered into for the portfolio, or a statement that the basis or amount of any such remuneration has been separately disclosed in writing to the client.

64 ل - Internal داخ 5. Securities Pledged or Charged

1. Particulars of any securities that have been pledged as collateral for or charged to secure borrowings on behalf of the portfolio, and the identity of the person the securities are pledged to; and
2. Total amount of any commission or other payments made in respect of such borrowings during the period.

6. Derivatives Positions

1. Profit or loss on each transaction to close out a derivatives position during the period (including any commissions or other fees payable for the transaction); and
2. Details of each open derivatives position on the valuation date, including:

• the underlying securities, commodity, index or any other asset;
• the trade price and date of the opening transaction;
• the current market price of the derivatives contract;
• the current unrealised profit or loss on the position; and
• the exercise price and expiry date of the contract.

65 ل - Internal داخ ANNEX 5.7 PERSONAL ACCOUNT DEALING A capital market institution must provide every employee with a written notice (the personal dealing notice) which must contain statements as prescribed by this Annex. Employees must undertake that they will observe the requirements of the personal dealing notice by signing a copy of it and returning it to the capital market institution. This Annex sets out a model personal dealing notice. A capital market institution is free to impose more stringent requirements than those required by this Annex. MODEL PERSONAL DEALING NOTICE So as to comply with the requirements for personal dealing transactions, it is required to comply with the provisions of this notice.

1. Permission to Deal It is permitted to buy and sell securities in these categories: [A capital market institution should insert here types of securities or transactions in which the employee can deal. A capital market institution will also need to clarify its procedure for restricting or withdrawing its consent in relation to particular securities in special conflict of interest circumstances.] An employee may not buy or sell any other securities without having obtained consent from [the compliance officer or his deputy]. Note that where a general or specific consent is given for a transaction, the other requirements set out in this notice (e.g. reporting) still need to be complied with.
2. Rights Issues, Takeovers The restrictions in this notice extend to making any formal or informal offer to buy or sell, taking up rights on a rights issue and exercising conversion or subscription rights and exercising an option.

66 ل - Internal داخ The restrictions also extend to buying or selling securities under any offer, including a takeover or tender offer, which is made to the public or all (or substantially all) the holders of the security concerned. 3) Executors and Agents The restrictions extend to dealings by the employee: a. as an executor of a will in which the employee or a relative of the employee has a significant interest; b. as an executor of any other will, unless the employee is relying entirely on the advice of another person (such as another broker or lawyer); or c. for another person, unless the employee is dealing as an employee of the capital market institution. 4) General Exemptions The restrictions do not extend to any transaction in a managed or discretionary account if the transaction is entered into without consultation with the employee. 5) Selling to or Buying from a Client The employee may not sell to or buy from any client of the capital market institution for his own account. 6) Reporting of transactions The employee must immediately report to the capital market institution in writing any purchase or sale of a security which the employee enters into otherwise than through [name of the capital market institution] or [name of another group company that is a capital market institution], including those transactions falling within 1 above. If, however, the employee has made arrangements for the capital market institution promptly to receive a copy of the contract note (or similar report) in respect of the transaction, the employee does not have to report it to the capital market institution. 7) Dealing Ahead of a Research Recommendation This restriction applies when the employee knows that the capital market institution intends to publish a research recommendation and the employee knows, or should know, that the recommendation is likely to cause a price change in the security to which it relates. In that

67 ل - Internal داخ situation, the employee must not deal until the recommendation has been published and the clients for whom it was principally intended have had a reasonable opportunity to react to it. Dealing before the research recommendation has become public may also breach insider trading rules. 8) Dealing Contrary to a Client’s Interest The employee must not deal in a security where he knows that such dealing is likely to have a direct adverse effect on the particular interests of one of the capital market institution 's clients. 9) Personal Benefits If the employee's functions involve giving securities advice, including the preparation of research material, or entering into transactions in securities for the capital market institution ’s own account or the account of those for whom it deals, the employee must not accept any benefit or inducement which is likely to conflict with the employee's duties to the capital market institution or any of the capital market institution’s clients. “Benefit or inducement” means credit or any other financial advantages, money, property or gift; any services, facilities, or any opportunity to make, receive or increase a gain or revenue or to avoid or reduce a loss or expense. If in any doubt the employee should consult with [the compliance officer or his deputy]. 10) Counselling and Procuring If the employee is precluded by the above provisions from entering into any transaction, the employee cannot advise or cause another person to enter into such a transaction or communicate any information or opinion to any other person if the employee knows, or has reason to believe, that that other person will as a result enter into such a transaction or cause or advise someone else to do so. This does not apply to actions which the employee takes in the course of his employment with the capital market institution.

68 ل - Internal داخ 11) Summary of Insider Trading Rules The employee may not act contrary to the provisions of the Capital Market Law, its Implementing Regulations, especially insider trading rules. A broad guide to the insider trading rules now follows: Inside information is information that is not generally available, but would be price sensitive if it were generally available. An insider is a person who obtains inside information from a family, business or contractual relationship. The employee is likely to be an insider as a result of the employment, as is anyone to whom the employee passes the inside information. An insider may not trade in any security related to the inside information or communicate it to another person for him to trade in the security. Another person may not trade in a security after receiving inside information relating to it. If the employee breaches these rules, the employee may face compensation claims, fines or prison.

69 ل - Internal داخ MODEL UNDERTAKING To: [name of the capital market institution] a. I undertake to observe the provisions of the Capital Market Law and of the Market Conduct Regulations in relation to insider trading as they may be amended or replaced in future, and the requirements regarding personal dealing transactions that are set out in the foregoing notice. b. I agree that this undertaking extends to any amended or replacement requirements that [name of the capital market institution] set out in any written notice which you subsequently give to me. c. I further agree that this undertaking shall form part of the contract of employment (or contract for services) with you and that any breach of this undertaking will entitle you, among other things, to terminate that contract without notice. [Print Name] ................................................................ Signature: ................................................................ Date: ................................................................

70 ل - Internal داخ PART 6 SYSTEMS AND CONTROLS Chapter One: Scope of Application Article 52: Scope of Application This Part applies to all the activities carried on by the capital market institution. Chapter Two: Management Arrangements Article 53: Division of Responsibilities a) A capital market institution must take appropriate measures to maintain a clear and appropriate division of the principal responsibilities among its governing body and senior executives so that:

1. it is clear who is responsible for each function; and
2. the business and affairs of the capital market institution. are adequately monitored and overseen by the governing body and senior executives of the capital market institution. b) The governing body is responsible for arranging the division of responsibilities under paragraph (a) of this Article, and overseeing the establishment and implementation of the capital market institution’s systems and controls. c) The formation of the capital market institution’s board of directors must include independent members not less than two or a third of the board members, whichever is more. By way of example and without limitation, the following negate the independence requirement for an independent board of directors member:
3. being an owner of 5% or more of the shares of the capital market institution or the shares of another company in its group;
4. being a representative of a legal person who owns 5% or more of the shares of a capital market institution or shares of another company in its group;
5. being a member of the board of directors of another company from the group of the capital market institution, which he is nominated for membership in its board of directors; and
6. is working or have worked as an employee during the past year at a capital market institution or any party dealing with it or another company in its group, such as auditors and major suppliers, or controlled any of those parties during the past year. d) The board of directors of a capital market institution must establish the governance infrastructure, which is to set the necessary systems and policies to achieve its corporate

71 ل - Internal داخ governance objectives, develop its own governance policies and procedures for overseeing those systems and policies, monitor their implementation and their effectiveness and amend them when needed; to include, but not be limited to, the following:

1. determine the procedures and controls for nomination for membership of the board of directors of a capital market institution and the responsibilities and main functions of the board of directors of a capital market institution;
2. determine the powers of the board of directors and senior executives;
3. develop codes of conduct for employees of a capital market institution; and
4. forming supervisory committees such as the audit committee, nominations committee, and the remuneration committee. e) A board of directors of a capital market institution must issue an annual report that includes the operations of the capital market institution during the last financial year, and all factors affecting its business, and the report of the board of directors must include the information stipulated in Annex 6.1. f) A capital market institution must send a copy of the report of the board of directors referred to in paragraph (e) of this Article to the Authority within three months of the end of the financial year of the capital market institution, and the sent report must be in Arabic language. g) A capital market institution, which is a subsidiary of a local bank, must establish the necessary procedures that guarantee independence and complete separation from the business of its local bank, and not rely on its financial, human and technical resources, including - but not limited to - opening investment accounts for clients and executing sales and purchase orders in securities, and effecting subscription and redemption transactions in investment funds through the branches of that local bank and by its employees. h) A capital market institution, whose legal form is not a joint stock company and a capital market institution, which its authorisation type is limited to managing investments or arranging or advising or combine any of these activities only, is exempted from implementing paragraphs (c), (d), (e) and (f) of this Article. Article 54: Establishment and Maintenance of Systems and Controls a) A capital market institution must establish and maintain systems and controls that are appropriate to its business. The systems and controls must conform to the requirements of Chapter 3 of this Part and be sufficient to enable the capital market institution to comply with the Capital Market Law and its Implementing Regulations.

72 ل - Internal داخ b) The capital market institution’s governing body is primarily responsible for compliance with the Capital Market Law and its Implementing Regulations and all other regulatory requirements applicable to the capital market institution. The governing body must make appropriate arrangements to ensure that the activities detailed in Chapter 3 of this Part are carried out. Chapter Three: Systems and Controls Article 55: General Provisions a) The capital market institution must establish systems and controls under this Part taking into account the following:

1. the nature, scale and complexity of its business;
2. the diversity of its operations;
3. the number and value of its transactions; and
4. the degree of risk associated with each area of its operation. b) A capital market institution must establish systems and controls to cover at a minimum:
5. the division of responsibilities and reporting lines in accordance with Article 53 of these Regulations;
6. risk management policies and systems;
7. anti-money laundering and combating the financing of terrorism procedures;
8. a compliance manual;
9. a compliance monitoring programme;
10. a code of conduct;
11. an operational procedures manual; and
12. continuity of business manuals and plans. c) A capital market institution that carries out dealing business as an agent must establish clients’ conduct trading surveillance policies and systems, provided that such policies and systems are sufficient for the capital market institution to ensure compliance of its clients with the Capital Market Law and its Implementing Regulations. d) A capital market institution must document its systems and controls appropriately and keep such documentation up to date. e) The Capital Market Institution that offers Robo-Advisory services must establish systems and control procedures to ensure the integrity, efficiency, and oversight of the algorithms and technological tools used. Such systems and procedures must include the following:
13. Control procedures for the algorithms and technological tools used, and a risk management and monitoring policy.

73 ل - Internal داخ 2) Sufficient and ongoing testing of the algorithms and technological tools to verify their reliability and effectiveness for their intended purpose, and to ensure the accuracy of the outcomes generated by the algorithms designed to provide services to clients. 3) Annual testing conducted by an independent party to assess the safety of the algorithms and technological tools used, based on the nature of such systems. 4) Establish and implement policies and procedures to address and mitigate operational and technological risks. f) The documentation described in this Article must be retained for ten years after it ceases to be used or is amended. Article 56: Review by the Governing Body a) A capital market institution’s governing body must carry out a regular review of the division of responsibilities and its systems and controls, including the documents referred to in paragraph (d) of Article 55 of these Regulations, at least once every three years. b) A capital market institution’s governing body must expeditiously monitor the actions arising as a result of the review. c) Each review conducted in accordance with paragraph (a) of this Article should be minuted and reports of such reviews must be retained for ten years. Article 57: Compliance a) A capital market institution must appoint a senior officer as compliance officer. b) The governing body of the capital market institution is responsible for supervising the following:

1. ensuring that appropriate policies and procedures are in place to enable the capital market institution to comply with the Capital Market Law, the Implementing Regulations and all other relevant regulatory requirements;
2. ensuring that the compliance officer and his department are appropriately resourced and have access to all of the capital market institution’s records;
3. the establishment, implementation, enforcement and maintenance of the compliance manual and the compliance monitoring programme;
4. the establishment of and ensuring compliance with the code of conduct;
5. the preparation of reports and notifications to be filed with the Authority; and
6. the procedures for the periodic reporting to the governing body by the compliance officer regarding the capital market institution compliance with the Capital Market

74 ل - Internal داخ Law and its Implementing Regulations and all other relevant regulatory requirements. c) The Authority may review the appropriateness of a capital market institution’s compliance arrangements at any time. d) The compliance officer shall comply to periodically submitting reports to the governing body regarding the capital market institution compliance with the Capital Market Law and its Implementing Regulations and all other relevant regulatory requirements. Article 58: Risk Committee and Compliance Committee a) Depending on the nature, scale and complexity of its business, a capital market institution may establish a compliance committee, risk committee or both to monitor its securities business and its compliance programme. b) The Authority may require a capital market institution to appoint a compliance committee, risk committee or both if it considers one to be necessary based on the nature, scale and complexity of the business. c) When a compliance committee is established, its members should include, but are not limited to, the CEO, the compliance officer and the MLRO, and it must be connected to the governing body of the capital market institution. d) Meetings of compliance committee and risk committee must be minuted and retained for ten years. Article 59: Outsourcing a) A capital market institution may delegate specific compliance or other functions to an external party, provided that appropriate safeguards are put in place, including:

1. an assessment of whether the delegate is suitable to carry out the delegated function or task, taking into account the degree of responsibility involved;
2. clear documentation of the extent and limits of any delegation and information confidentiality standards;
3. suitable arrangements to supervise the delegation, and to monitor the discharge of the delegate’s functions or tasks and ensuring its continuity, including granting the capital market institution the right to ensure the delegate’s ability to continue carrying out the delegated functions or tasks, and to oblige the delegate to provide any information it requests regarding the delegated functions or tasks within a period not exceeding ten days from the date of the request; and

75 ل - Internal داخ 4) appropriate remedial action if any concern arises about the performance of the delegate’s functions or tasks. b) A capital market institution must exercise due diligence in the selection of an external party to perform specific functions. c) The outsourcing of any function by the capital market institution will not derogate from the capital market institution’s, compliance officer’s or the compliance committee’s regulatory obligations. d) The delegated to carry out any securities business must be a capital market institution authorised to carry out the delegated securities business. Article 60: Audit Committee a) Depending on the nature, scale and complexity of its business, a capital market institution may appoint an audit committee. b) The Authority may require a capital market institution to appoint an audit committee if it considers one to be necessary based on the nature, scale and complexity of its business. c) The audit committee must meet at least twice a year, and when necessary. d) Meetings of the audit committee must be minuted and retained for ten years. Article 61: Internal Audit a) Depending on the nature, scale and complexity of its business, a capital market institution may delegate part of the task of monitoring the appropriateness and effectiveness of its systems and safeguards to an internal audit function. b) An internal audit function should have clear responsibilities and reporting lines to the audit committee or appropriate senior manager, be adequately resourced and staffed by competent individuals, be independent of the day-to-day activities of the capital market institution and have appropriate access to a capital market institution’s records. c) Reports of meetings of the internal audit function must be prepared and retained for a period of ten years. Article 62: Audit and Inspections a) A capital market institution’s internal auditor must review books, accounts and other records related to securities business at least once every three years, and when necessary. b) All accounts, records, terms of business and other agreements to which a capital market institution is party must be retained for the period specified in Part 3 of these Regulations and must be made available to the internal and external auditors.

76 ل - Internal داخ c) A capital market institution authorised to carry out dealing, custody or managing business when appointing its auditor must ensure that the auditor is registered with the Authority in accordance with the Rules for Registering Auditors of Entities Subject to the Authority's Supervision. Article 63: Resolution of Complaints a) A capital market institution must have written procedures to ensure:

1. timely and proper handling of complaints from clients;
2. that appropriate remedial action in respect of complaints is promptly taken; and
3. where a complaint arises from the conduct of a third party employed or recommended by a capital market institution, a capital market institution shall intercede on behalf of the client, making best efforts to resolve the complaint. b) The capital market institution must design the procedures to resolve complaints to ensure that:
4. each employee working with clients is aware of them;
5. a complaint is investigated promptly and fully by an officer of the capital market institution who was not originally involved in the matter giving rise to the complaint; and
6. records of the written complaints are made and any action taken documented. Article 64: Anti-Money Laundering and Combating the Financing of Terrorism A capital market institution must appoint a senior employee as MLRO. The MLRO is responsible for ensuring compliance with the requirements of the Anti-Money Laundering Law and its implementing regulations and the Combating-Terrorism Crimes and its Financing Law and its implementing regulations, and must report to the governing body on matters relating to money laundering and terrorism financing. Article 65: Employees a) A capital market institution must establish adequate procedures for the recruitment, training, supervision and discipline of employees. b) A capital market institution must establish recruitment procedures to ensure that it recruits employees who are appropriately qualified for the role and honest. c) A capital market institution must establish a programme to ensure that employees are trained appropriately (including passing any examinations required under Part 4 of these Regulations).

77 ل - Internal داخ d) A capital market institution must maintain records of the names of any employee disciplined by a capital market institution in connection with any breach of the Capital Market Law or its Implementing Regulations or any other conduct which may affect the conduct of the capital market institution ’s securities business. The records must also include particulars of:

1. the breach or conduct for which the employee was disciplined; and
2. the steps taken to discipline the employee. e) A capital market institution must train its employees periodically and such training must cover updates to the Capital Market Law, its Implementing Regulations and any other laws relevant to the business of the capital market institution. Such training should occur at least annually. f) A capital market institution must retain appropriate records relating to its employees in connection with their recruitment procedure, experience and qualifications for a period of ten years from the date on which the capital market institution recruited the employee. Article 66: Business Continuity a) A capital market institution should have in place appropriate arrangements, having regard to the nature, scale and complexity of its business, to ensure that it can continue to operate and meet its regulatory obligations in the event of an unforeseen interruption to its activities. These arrangements should be documented and regularly updated and tested to ensure their effectiveness. b) Appropriate records relating to the arrangements in connection with business continuity must be retained for a period of ten years after it ceases to be used or is amended. Article 67: Record Retrieval All records required to be maintained by a capital market institution under the Capital Market Law or its Implementing Regulations must be available for inspection by the Authority. Article 68: Mandate Over an Account in the Client's Name A capital market institution must establish and maintain adequate records and internal controls in respect of a mandate it has over an account in the client's own name. A capital market institution must in particular ensure that all transactions entered into pursuant to a mandate are within the scope of the authority conferred by the mandate and establish procedures for the giving and receiving of instructions under the mandate.

78 ل - Internal داخ ANNEX 6.1 REQUIRED CONTENTS OF THE BOARD OF DIRECTORS’ REPORT

1. A description of all the main activities of the capital market institution.
2. Formation of the board of directors and classification of its members as follows: executive board member - non-executive board member - independent board member.
3. Names of companies inside and outside the Kingdom of which a member of the board of directors of the capital market institution is a member of its boards of directors or one of its directors.
4. Name of each company affiliated with the capital market institution, its capital, the percentage of ownership of the capital market institution in it, its main activity, the main country of its operations, and the country of its establishment.
5. A description of the plans and important decisions of a capital market institution (including structural changes, expansion of business, or suspension of operations), and future expectations of the business of the capital market institution.
6. The number of board of directors’ meetings held during the last financial year, their dates, and the attendance record of each meeting indicating the names of those present.
7. A brief description of the powers and functions of the committees, such as: the Audit Committee, the Nominations Committee, and the Remuneration Committee, stating the names of these committees, their chairmen and members, the number of their meetings, the dates of their meeting, and the attendance record of each meeting, indicating the names of those present.
8. Disclosure of remunerations and compensations paid to members of the board of directors of the capital market institution and five of the senior executives who received the highest remunerations and compensations, in addition to the chief executive officer and chief financial officer if they are not among them, according to the table below: Statement Executive Board Members* Non-Executive Board Members Independent Board Members Allowance for attendance of the board of directors’ sessions Allowance for attendance of the committees’ sessions Periodic and annual remunerations

79 ل - Internal داخ Incentive plans Any compensations or other in -kind benefits paid monthly or annually Total: *As members of the board of directors. Statement Five of the senior executives who received the highest remunerations and compensations in addition to the CEO and CFO, if they are not among them Salaries and wages Allowances Periodic and annual remunerations Incentive plans Commissions Any compensations or other in -kind benefits paid monthly or annually Total 9. A statement of any arrangement or agreement whereby a member of the board of directors of the capital market institution or a senior executive waives any remunerations and compensations. 10. Any penalty, sanction, precautionary measure, or precautionary restriction imposed on a capital market institution by the Authority or from any supervisory, regulatory, or judicial body, along with a statement of its signatory, the reasons for the violation, and the ways to address it and avoid its occurrence in the future. 11. The results of the audit report of a capital market institution’s system and controls, in addition to the audit committee’s opinion on the adequacy of the internal audit system (where applicable).

80 ل - Internal داخ 12. Information related to any risks faced by a capital market institution (whether operational risks, financing risks or market risks) and the policy for managing and monitoring these risks. 13. If the auditor's report includes reservation to the annual financial statements, the report of the board of directors must clarify those reservations, their reasons and any information related to them. 14. Summary in the form of a table or diagram of the assets and liabilities of a capital market institution and the results of its business in the last five financial years or since inception, whichever is shorter. 15. Clarification of any material differences in the operating results from the results of the previous financial year, or any expectations announced by the capital market institution. 16. A description of any interest, contractual securities and rights issue belonging to the members of the board of directors of the capital market institution, the senior executives and their relatives in the shares or debt instruments of the capital market institution or any of its affiliates, and any change in that interest, those securities or rights during the last financial year. 17. Information related to any loans on the capital market institution (whether payable on demand or otherwise), a statement of the total indebtedness of the capital market institution and its affiliates, and any amount paid for loans during the financial year, the amount of the loan principal, and the remaining amount, the amount of the loan’s principal, the name of the lender, its duration, and the remaining amount, and in the event of the absence of loans on a capital market institution, it must provide an acknowledgment thereof. 18. A description of each transaction concluded between a capital market institution and a connected person. 19. Information related to any business or contracts to which a capital market institution is a party, or in which it has an interest for one of the members of the board of directors of the capital market institution or for senior executives or for any person related to any of them, so that it includes the names of those involved in the business or contracts and the nature of these business or contracts, their terms, duration and amount and in the absence of any such business or contracts, the capital market institution must provide an acknowledgment thereof.

81 ل - Internal داخ Part 7 Client Money and Assets Chapter One: General provisions Article 69: Purpose and Scope a) The provisions in this Part implement Principle 6, which is provided for at paragraph (b) of Article 5 of these Regulations. b) A capital market institution must segregate its own money and assets from client money and client assets, and client money and client assets must only be used for the benefit of a capital market institution’s clients. c) Clients' money or assets kept in accordance with the provisions of this Part must be through a capital market institution authorised to carry out custody business. d) As an exception from paragraph (c) of this Article, a capital market institution authorised to carry out arranging activity may keep, in accordance with the provisions of this section, clients’ money in the course of carrying out securities crowdfunding, provided that it satisfies the two following additional requirements:

1. Clients' money kept must not exceed SR 80 million.
2. Retail client's money kept must not exceed SR 100,000. Article 70: Effect of Segregation a) Clients’ money and assets, which are segregated from capital market institution's money and assets, are deemed to be held for the capital market institution’s clients and shall be not deemed money nor assets of the capital market institution. b) Creditors of a capital market institution do not have any claim or entitlement to segregated money or assets. Chapter Two: Client Money Rules Article 71: Money Received by a Capital Market Institution a) With regards to Article 72 of these Regulations, all money that a capital market institution receives from or on behalf of a client in the course of carrying out securities business is client money. b) Client money must be segregated and held in a client account, separately from the money of a capital market institution, except where otherwise provided in this Part.

82 ل - Internal داخ c) All money paid into a client account by a capital market institution will be treated as client money. d) Only client money should be held in a client account unless it is required to open or keep open the account or it is temporarily in the account. e) A capital market institution may transfer client money to another person for the purpose of settling a securities transaction with or through that other person or to provide collateral for a client. Article 72: Money Which is Not Client Money Money is not client money if it is immediately due and payable to the capital market institution for its own account (including, fees and commissions which are lawfully due to the capital market institution). Article 73: Money to be Held With a Bank a) A capital market institution must hold client money in a client account with a local bank. b) A capital market institution must assess the risk of a local bank prior to opening a client account and consider whether it is necessary to open client accounts with more than one bank. c) A capital market institution may open a client account with a local bank in its own group, provided it notifies its client of its intention and the client has not objected. d) Client money may be held with an overseas bank but only if this is necessary for the settlement of a transaction in securities outside the Kingdom. Dividends or other income received outside the Kingdom for a capital market institution’s client may be paid into an account with an overseas bank in the capital market institution’s name, provided that the funds in question are either transferred to a client account or paid to the client no later than three days after notification of receipt. A capital market institution must notify its client of its intention to hold client money with a bank outside the Kingdom. e) The requirements specified in paragraphs (b) and (c) of this Article and the requirements in Article 74 of these Regulations apply equally to an account with an overseas bank. Article 74: Acknowledgement by the Bank a) A capital market institution must within 20 days of opening a client account obtain a written acknowledgement from the local bank with which a client account has been opened that:

1. the client account will hold client money and not money belonging to the capital market institution; and

83 ل - Internal داخ 2) the local bank will not enforce any right or claim that it has against the capital market institution against funds held in the client account and will not combine the client account with any other account. b) If a capital market institution does not receive the acknowledgement referred to in paragraph (a) of this Article within the 20 days period, it must withdraw all money in the account and pay it into another client account with another local bank. Article 75: Client Accounts a) Except as otherwise provided in this Part 7 a capital market institution must, where it receives client money, either:

1. pay the money into a client account no later than the next day after receipt; or
2. pay the money out in accordance with Article 76 of these Regulations. b) If a remittance comprises part client money and part other money it must be paid in full into a client account. The part of the remittance that is not client money should be transferred out of the client account as soon as possible. c) Client money may be held in a client account in a different currency from that of receipt. In such a case a capital market institution must daily ensure that the amount held in the different currency is at least equal to the amount of the original currency and must adjust the amount held in the different currency accordingly (if necessary by making up any deficit). In carrying out the currency conversion the capital market institution should use the closing spot currency conversion rate on the business day preceding the day on which the conversion calculation is carried out. Article 76: Money Ceasing to be Client Money Money ceases to be client money for which the capital market institution is responsible if it is paid:
3. To the client;
4. To a third party on the instructions of the client;
5. Into a bank account in the name of the client (not being an account which is also in the name of the capital market institution); or
6. To a capital market institution itself, where it is lawfully due and payable to the capital market institution. Article 77: Returns Without prejudice to the provisions of this Part, a capital market institution may:
7. Deposit the client’s money in an account that provides returns with a local or overseas bank, and obtain such returns or part of them, provided that the client’s prior written

84 ل - Internal داخ approval has been obtained, in addition to satisfying the conditions stipulated in the Client Money Rules. 2) Provide a service to the client, in which the money held in the client’s investment account is invested and provide a return on it, if the following requirement are satisfied: a) Comply with the requirements of understanding risks and suitability in accordance with the provisions of these Regulations. b) Obtaining the client’s prior written approval to receiving the service and terms of providing it, including the period in which the client can - based on his request - redeem his invested money. c) Investment shall be in the Kingdom and in short-term and low-risk products. Article 78: Records and Auditor's Report a) A capital market institution must keep records which are sufficient to demonstrate compliance with the Client Money Rules. b) A capital market institution's auditors shall annually review the capital market institution’s compliance with the Client Money Rules and shall report on this review as part of its audit of the capital market institution. c) A capital market institution must provide the Authority with the auditor’s report mentioned in paragraph (b) of this Article within 4 months of the end of its financial year. Article 79: Amounts to be Held in Client Money Bank Accounts a) A capital market institution must:

1. daily confirm that the aggregate balance on all of its client accounts as at the close of the preceding business day was at least equal to the "client money requirement" calculated in the manner prescribed by the Authority; and
2. ensure that any shortfall is paid into a client account by the close of business on the day the calculation is performed, and any excess is withdrawn within the same time period. b) For the purposes of paragraph (a) of this Article, a capital market institution should use the values contained in its accounting records, such as its cash book, rather than values contained on statements received from banks. Fees and commissions may be excluded from the calculation. c) So as to satisfy paragraph (a) of this Article, a capital market institution may be required to pay money into a client account. Such money will be client money. d) A capital market institution must notify the Authority immediately if it is unable to perform the calculation required by this Article.

85 ل - Internal داخ Article 80: Reconciliations a) A capital market institution must, at least once in every 7 days, reconcile:

1. the balance on each client account as recorded by the capital market institution with the balance on that account as set out on the statement or other form of confirmation issued by the local bank;
2. the balance on each client transaction account with exchanges, clearing centres, intermediate brokers, settlement agents and counterparties as recorded by the capital market institution with the balance on that account as set out in the statement or other form of confirmation issued by the person with whom the account is held; and
3. its records of collateral received from clients with the statement of collateral or other form of confirmation issued by the person with whom that collateral is located. b) A capital market institution must perform the reconciliations in paragraph (a) of this Article within 10 days of the date to which the reconciliation relates. c) Where any difference arises on any of the reconciliations in paragraph (a) of this Article, the capital market institution must correct it as soon as possible and in any event within 3 days. d) A capital market institution must notify the Authority as soon as possible where it is unable to perform any of the reconciliations required by the provisions in this Chapter. e) Where a capital market institution is unable to resolve a difference arising from a reconciliation, but the records examined by the capital market institution during its reconciliation indicate that there might need to be a greater amount of money in the relevant client accounts or collateral than is in fact the case, the capital market institution must assume, until the matter is finally resolved, that those records are accurate and pay the difference from its own money into a client account and the amount paid will be client money. Article 81: Client Money Reporting Requirement A capital market institution who holds client money must submit to the Authority such accounts as it requests.

86 ل - Internal داخ Chapter Three: Client Asset Rules Article 82: Assets Received by a Capital Market Institution a) A capital market institution must not hold client assets unless it is authorised to provide custody services. b) All assets which include, or may include, securities that are received by a capital market institution in the course of carrying out securities business shall be treated as client assets unless they consist of cash or collateral, to which Article 83(b) of these Regulations applies. c) A capital market institution must segregate the client assets that it holds from its own assets. d) A capital market institution must not use client assets for its own account or the account of another client unless it has obtained the prior consent of the client to whom the assets belong. Article 83: Assets Which are Not Client Assets a) Client assets shall include collateral taken by way of pledge to satisfy an obligation arising from that pledge until applied to satisfy that obligation. b) Collateral retained by a capital market institution as Other Collateral (as defined at paragraph (a) of Article 94 of these Regulations) for its own account is not a client asset, provided that the capital market institution has complied with the requirements of paragraph (b) of that Article. Article 84: Segregation a) If a client asset is recorded in an account with a capital market institution, the capital market institution must ensure that the title to the account makes it clear that such assets belong to the client and are segregated from the capital market institution's assets. b) A capital market institution must require that where a client asset is recorded in an account with a custodian or with an overseas custodian, the custodian or overseas custodian makes it clear in the title of the account that the client asset belongs to one or more clients of the capital market institution and that the assets are segregated. Article 85: Holding and Registration of Client Assets a) Securities that are eligible for the Depositary Centre must be held in an account with the Depositary Centre according to the Depository Centre Rules. b) A capital market institution must hold a document of title to a client asset in its physical possession, or with a custodian in an account designated for client assets.

87 ل - Internal داخ c) Where a capital market institution registers or records title to a client asset it must ensure that it is registered or recorded in the name of the client, unless the client is a capital market institution acting on behalf of its own client, in which case the asset must be registered in the name of that client. d) In the event of registering or recording client’s assets in the name of the capital market institution in accordance with the Depository Centre Rules or in the name of an overseas custodian where the asset concerned is a security acquired overseas, the capital market institution must disclose to the client, in advance and in writing, any risks that may arise due to the client’s assets being registered or recorded other than in the client’s name, and obtain the client’s prior written approval to register or record the client’s assets in the name of the capital market institution or in the name of an overseas custodian. e) In the event of registering or recording client’s assets in the name of the capital market institution in accordance with the Depository Centre Rules or in the name of an overseas custodian where the asset concerned is a security acquired overseas, the capital market institution must comply with the following:

1. Maintaining separate accounts and records that enable it to distinguish between its own assets and the assets belonging to its clients. These records and accounts must enable the capital market institution to distinguish between the assets of each client and any other client.
2. A capital market institution’s audit report, prepared in accordance with Paragraph (b) of Article (78) of these regulations, must confirm the capital market institution’s compliance with the clients’ assets rules. Article 86: Lending of Client Securities a) A capital market institution must not lend securities belonging to a client or engage in such lending activities with a client except after obtaining the client’s express consent to this in writing. b) Any securities lending activity must be subject to appropriate terms and conditions, including, as relevant, those specified by Annex 5.2 to these Regulations. c) A capital market institution must at all times during the period of a securities transaction:
3. ensure that the borrower provides collateral to cover the realisable value of the securities being lent;
4. daily monitor whether the amount of the collateral is sufficient to cover the realisable value of the securities; and

88 ل - Internal داخ 3) if the amount of the collateral is not sufficient to cover the realisable value of the securities, make up the level of collateral, unless otherwise agreed in writing with the client. d) Securities, which are registered or otherwise held together for more than one client must not be used for the purpose of a securities lending transaction unless all of the clients to whom the securities belong consent in writing and, if only some of the clients consent, the capital market institution must ensure and demonstrate that only securities belonging to clients who have given their consent are used for this purpose. e) A capital market institution must ensure that all securities lending transactions are appropriately documented. Article 87: Assessment of Custodian a) A capital market institution person owes a duty of care to a client in deciding or recommending where to hold the client assets. b) A capital market institution must undertake a risk assessment prior to recommending or deciding to hold client assets with a custodian to ensure that the custodian has in place adequate arrangements to safeguard the assets, and is subject to appropriate standards of regulatory oversight. A capital market institution must conduct a risk assessment of custodians holding client assets as frequently as required to be satisfied of the above matters on a continuing basis. c) A capital market institution must notify its client before holding that client's assets with a custodian in the capital market institution’s group and must not hold the relevant client’s assets with a custodian in its group if the client objects. d) A capital market institution must not hold client assets with or recommend an overseas custodian to a client unless the proposed arrangements with the overseas custodian are necessary for the purpose of the acquisition or holding of securities outside the Kingdom. e) The requirements set out in paragraphs (a) to (c) of this Article apply in relation to overseas custodians. In carrying out a risk assessment in relation to an overseas custodian, a capital market institution must take into account the extent to which the overseas custodian is subject to regulatory obligations at least equivalent to those imposed on custodians under the Capital Market Law and the Implementing Regulations. Article 88: Clients Agreements a) Before a capital market institution provides custody services to a client, it must agree in writing with that client appropriate terms of business which must cover the matters set out in paragraph (b) of this Article. Before a capital market institution provides custody services

89 ل - Internal داخ to a counterparty, it must send a written notice to the counterparty which must cover the matters set out in paragraph (b) of this Article. b) The agreement or the notice referred to in paragraph (a) of this Article must cover the following matters:

1. The manner in which the client assets will be registered;
2. Arrangements for the receiving and giving of instructions by the client in respect of custody services;
3. The capital market institution's liability to the client;
4. Any lien or security interest taken over the client assets by the capital market institution or other party;
5. The circumstances in which the capital market institution may realise client assets which are held as collateral, to meet the client's liabilities;
6. How the capital market institution will deal with the claiming and receipt of dividends, commissions and other income and entitlements accruing to the client;
7. How the capital market institution will deal with corporate actions, such as the voting of shares, capital reorganisations and take-overs;
8. The information to be provided to the client in respect of client assets that the capital market institution holds;
9. The provision of statements to the client;
10. The fees and charges to the client in respect of the custody services; and
11. An explanation of whether the client's assets will be pooled with the assets of other clients and an explanation of the effect of that pooling. Article 89: Custodian Agreement a) Before a capital market institution holds client assets with a custodian, it must agree in writing with the custodian appropriate terms of business, which must cover the following:
12. that the title of the account in which any client assets will be held indicates that the assets credited to the account do not belong to the capital market institution;
13. that the custodian is not to permit withdrawal of any client assets from the account other than to the capital market institution or to another person as the custodian may be instructed by the capital market institution;
14. that the custodian will hold or record a client asset belonging to the capital market institution's client separate from any securities or other assets of the custodian, and that it will treat the assets in the account as client assets;
15. that the custodian will deliver to the capital market institution a statement as at a date or dates specified by the capital market institution which details the

90 ل - Internal داخ description and amounts of all the securities credited to the account and the statement must be delivered to the capital market institution within 7 days of the date of the statement; and 5) that the custodian will not claim any lien, right of retention or sale, over the securities standing to the credit of any account designated in accordance with sub-paragraph (a)(1) of this Article, except: • where the clients whose assets are held in the account have consented; or • in respect of any charges relating to the administration or custody of the client asset. b) The requirements of paragraph (a) apply if client assets are lodged in an account with an overseas custodian. Article 90: Reconciliations a) A capital market institution must as often as necessary, but at least every 7 days, reconcile its record of client assets which it does not physically hold, with statements obtained from the Depositary Centre, custodians or overseas custodians and, in the case of dematerialised securities not held with the Depositary Centre or through a custodian or overseas custodian, statements obtained from the person who maintains the record of entitlement. b) A capital market institution must as often as necessary, but at least every six months, carry out:

1. a count of all client assets physically held by it, and reconcile the results of that count to its record in this regard; and
2. a reconciliation between the capital market institution's record of client holdings, and its record of the location of client assets. c) The count and reconciliation in paragraph (b) of this Article must cover all of the capital market institution's books and records, and must be performed by counting and reconciling all securities and other client assets as at the same date. d) A capital market institution must perform the reconciliations within 10 days of the date to which the reconciliation relates. e) A capital market institution must within 3 days correct any discrepancy, which is revealed by any reconciliation that it has carried out. If the capital market institution discovers any discrepancy, which amounts to a shortfall, it must within 3 days make good any shortfall and if the discrepancy is not resolved within 7 days, report the matter to the Authority.

91 ل - Internal داخ Article 91: Client Statements a) A capital market institution must, as often as necessary, but not less frequently than annually, provide each client in writing with a statement prepared in accordance with paragraph (d) of this Article. b) A capital market institution is required to provide a statement in paragraph (a) of this Article to a client for whom a client asset, collateral or other asset has been held at any time during the capital market institution's financial year even when there are no holdings at the statement date. However, there is no requirement to provide a statement where the client's account with the capital market institution has been closed, and the capital market institution has sent the client a closing statement which demonstrates that the capital market institution no longer holds a client asset, collateral or other asset for the client. c) Statements may be sent electronically with the client's prior written consent where the capital market institution is capable of reproducing the statement and keeping a record of its despatch. d) All statements produced by or on behalf of a capital market institution in accordance with paragraph (a) of this Article must list all client assets, collateral and other assets owned by the client for which the capital market institution is accountable and:

1. identify any securities registered in the client's name, separately from those registered in another name;
2. identify those securities and assets which are being used as collateral, or have been pledged to third parties, separately from any other securities and asset;
3. show the market value of any collateral held, as at the date of the statement; and
4. be based on information as of trade date or settlement date, and the basis must be notified to the client. Chapter Four: Collateral and Money and Assets Passed to Third Parties Article 92: Scope of Application a) This Chapter applies to capital market institutions which hold collateral or provide collateral to third parties, or which pass client money or client assets to settlement agents. b) Article 93 of these Regulations applies to:
5. collateral that is subject to the Client Money Rules or the Client Asset Rules; and
6. client money and client assets passed to settlement agents. c) Article 94 of these Regulations applies to collateral that is not subject to the Client Money Rules or the Client Asset Rules.

92 ل - Internal داخ Article 93: Collateral Subject to the Client Money Rules or the Client Asset Rules a) A capital market institution must take reasonable steps to ensure that collateral is properly safeguarded. Where the capital market institution has reasonable grounds to believe that the collateral will not be properly utilised or safeguarded by a third party, then it must withdraw the collateral from the third party unless the client has indicated otherwise in writing. b) Collateral held by the capital market institution must be separately identifiable from assets of the capital market institution. The capital market institution must be able to identify at all times the client providing the collateral. c) Where a capital market institution passes collateral of a client which is client money or client assets to a counterparty in the Kingdom, it must:

1. take reasonable steps to ensure that the counterparty treats the collateral as client money or client assets; or
2. have obtained the consent of the client in the terms of business not to treat the money or assets as client money or client assets. d) A capital market institution must not undertake a transaction for a client that involves client money or client assets being passed either as collateral to a counterparty or to a settlement agent outside the Kingdom before formally notifying the client that:
3. his money or assets may be passed to such person;
4. the regulatory regime applying to such persons is different from that of the Kingdom; and
5. it has taken reasonable steps to ensure that the counterparty or settlement agent will effectively segregate the collateral from its own assets under the law of the country in which the counterparty or settlement agent is located. e) A capital market institution who transfers clients' collateral to an exchange or clearing house must:
6. notify the exchange or clearing house that the collateral is client money or client assets, and that the capital market institution is under an obligation to keep clients' collateral separate from the capital market institution's collateral; and
7. instruct the exchange or clearing centre to: • credit the value of that collateral passed by the capital market institution to the capital market institution's client transaction account with the exchange or clearing house; and • treat the sale proceeds of that collateral in accordance with the requirements of that exchange or clearing house.

93 ل - Internal داخ f) Before a capital market institution deposits a client asset as collateral with, mortgages, pledges, charges or grants another encumbrance over any client asset to, a third party, it must:

1. properly consider the credit risk to its clients;
2. notify the client that the collateral will not be registered in the client's name; and
3. obtain the client's prior written consent whether in the terms of business or otherwise. g) The capital market institution must have prior written consent from its client if it proposes to return to the client collateral other than the original collateral, or original type of collateral, or money. h) A capital market institution must:
4. notify the Authority as soon as it is aware of the insolvency of a person to whom it has passed collateral; and
5. notify the Authority as soon as reasonably practicable, of its intentions regarding making good any shortfall in client money or client assets that has arisen or may arise, stating the amounts involved. Article 94: Other Collateral a) Other collateral is collateral that a capital market institution is entitled to treat as its own provided the capital market institution is obliged to return equivalent assets to the client upon conclusion of a transaction or satisfaction of an obligation. b) A capital market institution must not receive or hold other collateral under this Article in the case of collateral of a client before it has:
6. determined in accordance with Article 43 of these Regulations that the taking of collateral is suitable for the client;
7. taken reasonable steps to ensure that the client understands the nature of the risks involved in his providing other collateral to the capital market institution;
8. disclosed to the client in the terms of business that his collateral will not be subject to the protections under the Client Asset Rules and as a consequence, his collateral will not be separated from the assets of the capital market institution and will be used by the capital market institution in the course of the capital market institution's business, and he will therefore rank as a general creditor of the capital market institution; and
9. ensured that it maintains adequate records to enable it to meet any prospective obligations including the return of equivalent assets to the client.

94 ل - Internal داخ PART 8 PROVISIONS OF BANKRUPTCY OR DISSOLUTION OF A CAPITAL MARKET INSTITUTION Article 95: Preamble a) This Part aims to identify the regulations governing the bankruptcy of a capital market institution in accordance with the Authority’s powers under the Law and the Bankruptcy Law, including Paragraph (2) of Article (229) of the Bankruptcy Law. It also identifies the provisions governing the dissolution of a capital market institution in accordance with the Companies Law. b) In accordance with the Law and the Bankruptcy Law, the Authority has the power to take any of the steps that it considers appropriate to ensure the proper protection of the rights of clients of the Capital Market Institution. Article 96: Rights of Clients on Bankruptcy of a Capital Market Institution Holding Client Money and Assets or Managing Investment Funds a) Clients’ money and assets shall not be included in the Capital Market Institution’s bankruptcy assets. Clients’ money and assets are excluded from the provisions of moratorium stipulated in the Bankruptcy Law. b) If, on a bankruptcy event of a capital market institution holding client money or client assets, the Capital Market Institution has or may have insufficient client assets or client money to satisfy its obligations to return such money and assets to its clients, then the claims of clients in respect of any shortfall in client assets and client money rank ahead of all other creditors. Article 97: Procedures for Obtaining the Authority's Approval a) A capital market institution that holds clients’ money or assets, or manages investment funds, must obtain the Authority’s written consent prior to filing a petition for the initiation of any of the bankruptcy procedures or the judicial depository with the competent court. A creditor of a capital market institution must, in all cases, obtain the Authority’s written consent prior to filing a petition for the initiation of any of the bankruptcy procedures or the judicial depository for the Capital Market Institution with the competent court. b) an application submitted by the Capital Market Institution for obtaining the Authority’s consent - in accordance with the provisions of Paragraph (a) of this Article- must be accompanied by an audited report issued by an auditor registered with the Authority in accordance with the Rules for Registering Auditors of Entities Subject to the Authority's

95 ل - Internal داخ Supervision. The report should specify all clients’ money and assets and where they are being held in a way that distinguishes them from the Capital Market Institution’s money and assets, and a written acknowledgement from that auditor, that there is no deficit in the clients’ money and assets, or if any, a statement of the amount of deficit, and its justifications. The Capital Market Institution must provide the auditor with any information or documents that it requires for this purpose. c) If a creditor of a capital market institution applies for obtaining the Authority’s consent - in accordance with Paragraph (a) of this Article-, The Authority may - at its discretion￾requires the Capital Market Institution to provide an audited report issued by an auditor registered with the Authority in accordance with the Rules for Registering Auditors of Entities Subject to the Authority's Supervision. The report should specify all clients’ money and assets and where they are being held in a way that distinguishes them from the Capital Market Institution’s money and assets, and a written acknowledgement from that auditor, that there is no deficit in the clients’ money and assets, or if any, a statement of the amount of deficit, and its justifications. The Capital Market Institution must provide the auditor with any information or documents that it requires for this purpose. d) The Capital Market Institution must provide the Authority with any information and documents that it requires for the purpose of initiating any of the bankruptcy procedures or judicial depository for the Capital Market Institution. e) The Authority shall, upon receipt of all information and documents required, notify the applicant in writing of the same, and shall take any of the following decisions within a maximum period of (30) days from the date of the notice:

1. Approve the application;
2. Approve the application subject to such conditions and limitations as it considers appropriate; or
3. Refuse the application. f) The Capital Market Institution must inform its clients when receiving the Authority’s approval to initiate any bankruptcy procedures or judicial depository. g) In case of deficit in the clients’ money and assets, the Authority may request a report from the Capital Market Institution clarifying the remedial action for such deficit, and the expected timeframe to execute such remedial action. h) The Capital Market Institution must cooperate with the Authority prior to initiating bankruptcy proceedings in order to ensure that client money, client assets, and all other clients’ claims relating to their accounts are resolved. i) The Authority may appoint or require the Capital Market Institution to appoint a third party to take any steps as it considers necessary for the protection of the clients of the Capital

96 ل - Internal داخ Market Institution. The fees and expenses of the third party shall be collected from the Capital Market Institution’s own money. The fees and expenses of the third party has the same creditors’ priority ranking of the fees and expenses of the trustee in accordance with the Bankruptcy Law. j) The Authority may direct the Capital Market Institution to take any measures that it considers necessary under the Law and its implementing regulations for the protection of the clients of the Capital Market Institution, including completing any outstanding business or transferring it to another capital market institution, and taking the necessary measures to transfer the clients’ money and assets and protect their rights, and pay back any shortage in the clients’ money or assets - if any- from the Capital Market Institution’s own money. k) A capital market institution that does not hold clients’ money or assets nor manage investment funds, must notify the Authority in writing at least (30) days in advance of filing a petition for the initiation of any of the bankruptcy procedures or the judicial depository with the competent court. Such notification must be accompanied by a written acknowledgement from an auditor registered with the Authority in accordance with the Rules for Registering Auditors of Entities Subject to the Authority's Supervision, that the Capital Market Institution does not hold clients’ money or assets nor manage investment funds. l) The Authority may, within the thirty days period mentioned in Paragraph (k) of this Article, impose on the Capital Market Institution the requirement of obtaining the Authority’s written consent in accordance with the provisions of Paragraph (a) of this Article. m) If the Authority does not impose the requirement to obtain its written consent in accordance with the provisions of Paragraph (l) of this Article within the thirty-day period mentioned in Paragraph (k) of this Article, the petition shall be considered approved by the Authority. n) A capital market institution that holds clients’ money or assets or manages investment funds, must obtain the Authority’s written consent prior to taking a decision to dissolve it in accordance with the Companies Law. o) The Authority is an interested party for the purposes of any proceedings relating to a capital market institution under the Bankruptcy Regulations. Article 98: Bankruptcy Proceedings a) The Capital Market Institution that initiate any of the bankruptcy proceedings under the Bankruptcy Law must:

1. notify the Authority of the bankruptcy procedure and of the proposed date of any meeting of members or creditors relating to the bankruptcy procedure; and

97 ل - Internal داخ 2) provide the Authority with any documentation it requests in relation to the bankruptcy proceedings. b) The Authority may request from the competent court to dismiss the trustee and appoint a new trustee from the list of trustees or others. c) The Authority may attend and be heard at any proceedings relating to the bankruptcy of the Capital Market Institution, including:

1. any meeting of members or creditors of the Capital Market Institution; and
2. any bankruptcy proceedings under the Bankruptcy Regulations. d) From the date of issuance of the Authority’s consent to filing a petition for the initiation of any of the bankruptcy procedures or the judicial depository and until a court ruling on such initiation of procedures and appointment of a trustee under the Bankruptcy Law, the Capital Market Institution may not, without the prior consent of the Authority, undertake any of the following actions:
3. accept further client money or client assets, unless those money and assets are originated from the rights associated with client money and assets.
4. dispose of client money or client assets, except if such disposal was upon the prior written consent of the concerned client; or
5. compromise, effect a mortgage, charge or pledge, give a guarantee, donate any part of its assets or effect a transfer of ownership in relation to its assets. e) The Authority may direct the trustee to take such steps as the Authority considers fit to establish the entitlements of clients of the Capital Market Institution at any time, or to appoint a third party to take such steps.

98 ل - Internal داخ PART 9 PUBLICATION AND ENTRY INTO FORCE Article 99: Publication and Entry into Force These Regulations shall become effective upon their publication.