AFSA Annual AML Return Form

Annual AML Return This AML Return is only required to be completed by a Relevant Person [1] (referred to in this Form as “Firm”). The Astana Financial Services Authority (“AFSA”) expects Firms to complete the AFSA's AML Return form on an annual basis and submit such form to the AFSA within two (2) months after the end of each year. [2] The purpose of the AML Return is to assist the AFSA in assessing a Firm’s compliance with its AML obligations. Any reference to “AML” or “money laundering” in this form is to be taken to include terrorist financing and financing the proliferation of weapons of mass destruction unless the context provides otherwise. The term “AML Rule” in this form refers to the AIFC Anti-Money Laundering, Counter-Terrorist Financing and Sanctions Rules and Guidance (available on the AFSA website). Where appropriate, questions in the AML Return make reference to the AML Rules to assist in framing the context of your answer and determining if the question is applicable to your Firm. All answers in the AML Return must be typed. If there is insufficient space to answer a question, please attach the answer in an appendix. Do not leave any questions blank – if a question is not applicable this should be indicated as “N/A” in the response section. Name of Firm Licence number Return for the Year Ending Date AML Annual Return Completed Date AML Annual Return Submitted Declaration by the applicant I declare that, to the best of my knowledge and belief, having made due inquiry, the information given in this form, the supplements and documents attached, as well as any applicable supporting documents, is complete and correct. I understand that it may be a breach of Article 119(e) of the AIFC Framework Regulations to provide to the AFSA any information which is deceptive, misleading or dishonest. I confirm that I have the authority to complete this questionnaire, to declare as specified above and sign this form for, or on behalf of, the Firm I understand that any personal data provided to the AFSA will be used to discharge its regulatory functions under the AIFC Data Protection Regulations, and other relevant legislation and may be disclosed to third parties for those purposes.

Signature Date Enter the name and position or title of the above signed individual: Responsibility for Compliance with the AML Rules Describe how the senior management of the Firm manages the responsibility of complying with the AML Rules in the event that a senior officer is not acting as the Money Laundering Reporting Officer (“MLRO”). [AML Rule 2.2] [Insert text here] Responsibility for Compliance with the AML Rules How often does the Firm review the effectiveness of its AML policies, procedures, systems and controls? State when the firm last conducted such a review, who conducted it, and describe the scope of the review. [AML Rule 4.3.1 (d), 14.6.1] [Insert text here] Does the Firm have any branches or subsidiaries operating outside of AIFC? [AML Rule 4.1.2] If yes, please indicate: the names of these entities; their relationship to the Firm; the jurisdictions they are domiciled in; and whether the firm’s AML policies, procedures, systems and controls are applied to them. [Insert text here] Applying a Risk-Based Approach to AML Briefly describe how the Firm applies the Risk-Based Approach to assessing and addressing its AML risk. [AML Rule 4.1] [Insert text here] Business Risk Assessment The Business Risk Assessment refers to a Firm’s assessment of the AML risks facing its business and operations. The assessment involves assessing its AML vulnerabilities across, but not limited to, the various factors described in AML Rule 4.2.1. A business risk assessment is also commonly known as an “enterprise-wide AML risk assessment”. Describe the Firm’s Business Risk Assessment (“BURA”) methodology. State when the Firm last conducted such an assessment, and attach any relevant documentation for this, including a copy of the current BURA. [AML Rule, 4.1.1, .4.1.2, 4.1.3, 4.2.1] [Insert text here] Did the results of the Firm’s latest Business Risk Assessment require the Firm to undertake any remedial actions? If so, please provide details of these actions. [Insert text here] AML Systems and Controls Attach a copy of the Firm’s AML Internal policies, Controls and Procedures. [AML Rule 4.3] Customer Risk Assessment/Customer Due Diligence How many customers does the Firm have as at the date of this AML Return? Provide a breakdown of “active” versus “dormant” customers (and provide the Firm’s definition of “dormant customers”). [Insert text here] With regard to the Firm’s customers, provide a breakdown in terms of: Retail Clients, Professional Clients, and Market Counterparties [Insert text here] For Clients that are individuals: their nationalities and country of domicile [Insert text here] For Clients that are non-individuals: their country of incorporation / establishment [Insert text here] Firms are required to assign each Customer an AML risk rating proportionate to the Customer’s money laundering risks. [AML Rule 5.1.1] Describe the procedures/methodology that the Firm uses to assess the money laundering risk of a Customer and assign an AML risk rating [Insert text here] Provide a breakdown of the number of Customers the Firm has assigned for each customer risk rating level [Insert text here] Describe the steps undertaken by the Firm in conducting Customer Due Diligence (“CDD”) including Simplified and Enhanced CDD, and the types of information collected on Customers to identify them verify their identities, and confirm source of funds. [AML Rule 6.3.1] [Insert text here] Describe the systems and controls used by the Firm to determine whether a Customer or beneficial owner is a PEP. [AML Rule 6.3.3] [Insert text here] How many of the Firm’s customers or beneficial owners have been identified as a PEP as at the date of this Return? [Insert text here] How many of the Firm’s customers are Restricted Scope Companies? [Insert text here] If the Firm has customers that are Restricted Scope Companies, what CDD information does it obtain to assess the AML risks of such customers? [Insert text here] Does the company allow non-face-to-face account opening? If yes, describe the circumstances where this is allowed, and the controls the Firm has to mitigate money laundering risks in such cases. [Insert text here] Has the Firm been unable to complete CDD within 30 days of establishing a business relationship for any customer? If yes, please provide details of the event and what steps were taken or are being taken by the Firm to conduct or complete CDD. [AML Rule 6.2.4] [Insert text here] On-going Customer Due Diligence Explain how the Firm undertakes ongoing monitoring of its customers and their transactions. [AML Rule 6.4.1] [Insert text here] How often does the Firm review the CDD information it holds on customers to ensure that it is kept up to date? [AML Rule 6.4.1(iv)] [Insert text here] How often does the Firm review each Customer to ensure that the risk rating assigned to the Customer remains appropriate? [AML Rule 6.4.1(v)] [Insert text here] Were there any customers whose risk ratings changed during the year in question? If so, state the number of such clients and how their ratings changed. [Insert text here] Reliance and Outsourcing of AML Compliance Does the Firm rely on any third parties to conduct one or more elements of CDD on its behalf? If yes, please list these third parties, describe the circumstances in which the Firm relies on them to conduct CDD on its behalf, and state whether these third parties are subject to any AML regulation. [AML Rule 9.1] [Insert text here] If the Firm relies on any third parties to conduct CDD, describe the due diligence procedures the Firm carried out on these third parties and any concerns identified. [AML Rule 9.1] [Insert text here] Correspondent Banking If the Firm has a Correspondent Account for a Correspondent Banking Client, describe the steps taken by the Firm to conduct due diligence on such clients at both account opening (including identifying any third parties that will use the Correspondent Account) and on-going monitoring of transactions processed through the Correspondent Account. [AML Rule 10.2.1] [Insert text here] Audit This section only applies to Authorised Persons. When was the last time the Firm’s audit function conducted a review of its AML policies, procedures, systems and controls and its compliance with the obligations under the AML Rules? [AML Rule 14.6.1] [3] [Insert text here] If an AML audit of the Firm was conducted, please attach a copy of the latest AML audit report.

Describe any actions that were undertaken by the Firm in response to any findings arising from the last AML audit (and indicate the person(s) in the Firm who were responsible for carrying out these actions). [Insert text here] Sanctions and Other International Obligations Describe the Firm’s systems and controls to obtain and make use of resolutions or Sanctions which it is required to comply with relevant resolutions or sanctions issued by the United Nations Security Council or by the Republic of Kazakhstan. [AML Rule 12.1] [Insert text here] Which reference lists does the Firm use to screen its customers against for money laundering and terrorism financing risks? [AML Rule 6.5.1] [Insert text here] Describe the Firm’s systems and controls to obtain and make use of any relevant findings, recommendations, guidance, directives, resolutions, Sanctions, notices or other conclusions issued by the various bodies listed in AML Rule 12.2.1. [AML Rule 12.2.1] [Insert text here] Money Laundering Reporting Officer (MLRO) Provide the name, designation,experience/qualifications and certification/degree of the MLRO. [AML Rule 13.1.2] [Insert text here] Is the MLRO role outsourced? [AML Rule 13.4] [Insert text here] Aside from carrying out the AML responsibilities, describe any other roles the MLRO carries out for the Firm. [Insert text here] What qualifications or experience does the MLRO hold? [Insert text here] Provide the names, designations and departments of any individuals in the firm who were appointed as Deputy MLRO during the year in question. [AML Rule 13.2.1] [Insert text here] AML Training and Awareness Summarize the topics covered, frequency and delivery method [4] of AML training that the Firm provided to its employees for the year in question. Please provide copies of training materials used. [AML Rule 14.1] [Insert text here] Indicate the number of employees that have received AML training for the year in question, broken down by positions held in the Firm (e.g. Board of Directors, management, non- management staff). [Insert text here] Indicate the number of relevant Employees that have not received AML training for the year in question, broken down by positions held in the Firm (e.g. Board of Directors, management, non- management staff), and provide an explanation for this. [Insert text here] Threshold Transaction and Suspicious Activity Reports Describe the Firm’s policies, procedures, systems and controls to monitor and detect suspicious activity or transactions in relation to potential money laundering or terrorist financing. [AML Rule 13.7.2, 13.7.3] [Insert text here] How many internal suspicious transaction reports (“STRs”) and threshold transaction reports (“TTRs”) did the Firm have during the year in question? Of these, how many were then submitted as external STRs and TTRs to the Financial Intelligence Unit of the Republic of Kazakhstan? [AML Rule 13.7.2, 13.7.5, 13.8.1] [Insert text here] Please refer to AIFC Anti-Money Laundering, Counter-Terrorist Financing and Sanctions Rules (AML Rule) Rule 2.1(b) ↑ The first report you complete may only cover a part year, depending on when your business began offering products and services captured by the AIFC Act. ↑ The review undertaken for the purposes of AML Rule 14.6.1 may be undertaken by the Firm’s internal audit function or by competent external professional audit or compliance professionals. The review should cover at least the following: sample testing of compliance with the Authorised Person’s CDD arrangements; an analysis of all notifications made to the MLRO to highlight any area where procedures or training may need to be enhanced; and a review of the nature and frequency of the dialogue between the senior management and the MLRO.

↑ Delivery methods to provide AML training may include classroom sessions, online training, tests, etc. ↑