Securities Supervision Act 2018 (WAG 2018)

All English translation of the authentic German text is unofficial and serves merely information purposes. The official wording in German can be found in the Austrian Federal Law Gazette (Bundesgesetzblatt; BGBl.). All translations have been prepared with great care, but linguistic compromises had to be made. The reader should also bear in mind that some provisions of these laws will remain unclear without certain background knowledge of the Austrian legal and political system. Please note that these laws may be amended in the future and check occasionally for updates. Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) Original Version: Federal Law Gazette I 107/2017 Amendments: Federal Law Gazette I unless stated otherwise: 37/2018; 76/2018; 62/2019; 104/2019; 25/2021; 98/2021; 190/2021; 36/2022; 139/2022; 237/2022; 63/2023; 112/2024; 48/2025; 49/2025; 50/2025; 5/2026; 27/2026. Date: 07 May 2026

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 2 / 126 TABLE OF CONTENTS Chapter 1: General Section 1: General provisions Article 1. Definition of Terms Article 2. Exceptions Article 3. Investment firms Article 4. Investment Services Providers Article 5. Group of investment firms and the FMA as consolidating supervisor Article 6. Surrendering and lapsing of licences Article 7. Application of the BWG Article 8. Obligation of secrecy Article 9. Commercial Register Article 10. Own funds Article 11. Procedure for the exemption of institutions belonging to the group of institutions Article 12. The Management Board and the Supervisory Board Article 13. Shareholders or other members with qualifying holdings Article 14. Notification about a proposed acquisition Article 15. Assessment Procedure Article 16. Assessment Criteria Section 2: Freedom of Establishment and Freedom to Provide Services Article 17. Operation of investment services and activities, MTFs and OTFs from other Member States in Austria Article 18. Operation of investment services and activities, MTFs and OTFs in other Member States Article 19. Establishment of a Branch from a Member State in Austria Article 20. Establishment of a Branch in a Member State Section 3: Provision of investment services and activities by third country firms Article 21. Establishment of a Branch Article 22. Obligation to provide information Article 23. Granting of the authorisation Article 24. Provision of services at the exclusive initiative of the client Article 25. Withdrawal of the authorisation Chapter 2: Organisational Requirements Section 1: Organisation Article 26. Legal entities Article 27. Algorithmic trading Article 28. Direct electronic access Article 29. General organisational requirements:

3 / 126 Article 30. Product governance obligations for legal entities manufacturing financial instruments Article 31. Product governance obligations for distributors Article 32. Risk management and internal audit Article 33. Obligation to keep records Section 2: Outsourcing and the involvement of tied agents and securities brokers Article 34. Outsourcing of significant operational duties to service providers Article 35. Provision of services through another legal entity Article 36. Involvement of tied agents Article 37. Involvement of securities brokers Section 3: Safeguarding of Client Assets Article 38. Safeguarding of clients’ financial instruments and funds Article 39. Depositing clients’ financial instruments Article 40. Depositing clients’ funds Article 41. Use of clients’ financial instruments Article 42. Inappropriate use of title transfer collateral arrangements Article 43. Governance arrangements concerning the safeguarding of client assets Article 44. Reports by external auditors Section 4: Organisation Article 45. Conflicts of interest potentially detrimental to a client Article 46. Policy for handling conflicts of interest Section 5: Obligation to act in the client's best interest Article 47. General obligations Article 48. Appropriate Information for Clients Article 49. Fair, clear and non-misleading information Article 50. Obligations when providing investment advice on an independent basis Article 51. Granting and accepting of benefits Article 52. Quality Enhancement of the Service Article 53. Payment and receipt of benefits in relation to Independent Investment Advice and Portfolio Management Article 54. Payment and receipt of benefits in connection with Research Section 6: Suitability and appropriateness of investment services Article 55. General provision Article 56. Suitability of investment advice and portfolio management services Article 57. Appropriateness of other investment services Article 58. Transactions that only consist of the execution or receiving and transmission of client orders Article 59. Documentation of the contractual parties’ rights and duties Section 7: Reporting obligations towards clients

4 / 126 Article 60. Reporting obligations Article 61. Credit agreements relating to residential immovable property Section 8: Best execution of services Article 62. Best execution Article 63. Execution policy Article 64. Organisational regulations regarding the execution policy Section 9: Handling of client orders Article 65. Handling of client orders Section 10: Professional clients and eligible counterparties Article 66. Professional clients Article 67. Article 68. Transactions executed with eligible counterparties Section 11: Unsolicited communication and door-to-door sales Article 69. Unsolicited communications Article 70. Door-to-door sales Chapter 3: Supervision and other measures Section 1: Accounting, Investor Compensation and Receivership Article 71. Accounting and Auditing of the annual financial statement Article 72. Article 73. Investor Compensation Article 74. Financing of the Investor Compensation Scheme Article 75. Information obligations Article 76. Investment firms that have joined schemes voluntarily for supplementary cover Article 77. Receivership and Insolvency Provisions Article 78. Article 79. Article 80. Article 81. Article 82. Article 83. Article 84. Article 85. Article 86. Article 87. Article 88. Section 2: Supervisory Powers and Procedural Provisions Article 89. Costs Article 90. Supervision Article 90a. ESAP collection body

5 / 126 Article 91. Form of communication with the FMA - electronic transmission Article 92. Additional supervisory measures Article 93. Reporting obligations of external auditors Article 94. Penal provisions Article 95. Article 96. Penal provisions with regard to legal persons Article 97. Effective punishment of breaches Article 98. Reporting of breaches Article 99. Reporting to the ESMA Article 100. Disclosure of measures and sanctions Article 101. Legal protection against publications made by the FMA Article 102. Special procedural provisions Article 103. Data protection Section 3: Cooperation between authorities Article 104. Contact points and exchanging of information Article 105. Cooperation and Exchanging of Information with the ESMA Article 106. Cooperation in monitoring, on-site inspections and investigations Article 107. Binding Mediation Article 108. Refusal to cooperate and inter-authority consultation Article 109. Powers of host Member States Article 110. Precautionary measures to be taken by host Member States Article 111. Cooperation and Exchanging of Information with Third Countries Chapter 4: Transitional and Final Provisions Articles 112 to 113a. Transitional provisions Article 114. References and Regulations Article 114a. Transposition note Article 115. Gender-neutral use of language Article 116. Enforcement Article 117. Entry into force Article 118. Repeal

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 6 / 126 CHAPTER 1: GENERAL PROVISIONS Section 1: General provisions Definition of Terms Article 1. For the purposes of the present Federal Act, the following definitions shall apply:

1. Investment firm: an investment firm pursuant to Article 3 as well as natural persons and legal entities, who are authorised in their home Member State to provide investment services or activities as an investment firm as defined in Article 4 (1) 1 of Directive 2014/65/EU.
2. CRR-investment firm: an investment firm pursuant to Article 4 (1) 2 of Regulation (EU) No 575/2013.
3. Investment services and activities: a. receiving and transmitting of orders in relation to one or more financial instruments; b. execution of orders on behalf of clients: acting to conclude agreements to buy or sell financial instruments on behalf of clients including acting to conclude agreements to sell financial instruments that were issued by an investment firm or a credit institution at the point of time at which they were issued; with regard to Sections 5 to 10 of Chapter 2, this includes both the execution of orders pursuant to Article 1 para. 1 no. 7 of the Austrian Banking Act (BWG; Bankwesengesetz), Federal Law Gazette no. 532/1993, as well as the service under lit. a; c. dealing on own account: trading against proprietary capital resulting in the conclusion of trades in financial instruments, unless traded for private assets; d. portfolio management: the management of portfolios in accordance with mandates given by clients on a discretionary client-by-client basis where such portfolios consist of one or more financial instruments; e. investment advice: the giving of personal recommendations pursuant to Article 9 of Commission Delegated Regulation (EU) 2017/565 supplementing Directive 2014/65/EU as regards organisational requirements and operating conditions for investment firms and defined terms for the purposes of that Directive, OJ. L 87 p. 1 (Commission Delegated Regulation (EU) 2017/565), either upon the client's request or on the initiative of the investment firm, in respect of one or more transactions relating to financial instruments; f. underwriting of financial instruments and/or placing of financial instruments with a firm commitment basis; g. placing of financial instruments without a firm commitment basis; h. operation of a multilateral trading facility (MTF) pursuant to no. 24; i. operation of an organised trading facility (OTF) pursuant to no. 25.

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 7 / 126 If such activities are performed on behalf of third parties, they are considered as services; otherwise they are considered as investment activities. 4. Ancillary services: a. the safekeeping and administration of financial instruments for the account of clients, including custodianship and related services such as cash/collateral management and excluding maintaining securities accounts at the top tier level; b. the granting or credits or loans to investors to allow the investor to carry out a transaction in one or more financial instruments, where the firm granting the credit or loan is involved in such transactions; c. advice to undertakings on capital structure, industrial strategy and related matters and advice and services relating to mergers and the purchase of undertakings; d. foreign exchange services where these are connected to the provision of investment services; e. the production, the distribution or transmission of securities and investment research or other forms of general recommendations relating to transactions in financial instruments; f. services related to underwriting; g. investment services and activities pursuant to no. 3 as well as ancillary services of the type included under lits. a to f regarding commodities, climatic variables, freight rates, inflation rates or other official economic statistics if they are used as base values of the derivatives specified in no. 7 lits. e to g and j and where these are connected to the provision of investment or ancillary services. 5. Transferable securities: the categories of securities that which are negotiable on the capital market, with the exception of instruments of payment, such as in particular: a. shares and other securities comparable to shares to Austrian or foreign legal persons, partnerships, and other entities, as well as share certificates pursuant to no. 9; b. bonds or other forms of securitised debt, including certificates (depositary receipts) for such securities; c. any other securities giving the right to acquire or sell any such transferable securities or giving rise to a cash settlement determined by reference to transferable securities, currencies, interest rates or yields, commodities or other indices or (financial) measures. 5a. make whole clause: a clause that aims to protect the investor by ensuring that, in the event of early redemption of a bond, the issuer is obliged to pay to the investor holding the bond an amount equal to the sum of the net present value of the remaining coupon payments expected until maturity and the principal amount of the bond to be redeemed. 6. Money-market instruments: those classes of instruments which are normally dealt in on the money-market, such as treasury bills, certificates of deposit, and commercial papers and excluding instruments of payment.

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 8 / 126 7. Financial instruments: the following financial instruments, including instruments issued by means of Distributed Ledger Technology: a. transferable securities pursuant to no. 5; b. money-market instruments pursuant to no. 6; c. units in UCITS pursuant to Article 2 of the Investment Funds Act of 2011 (InvFG 2011; Investmentfondsgesetz 2011), published in Federal Law Gazette I No. 77/2011 and unit certificates in AIFs pursuant to Article 2 para. 1 no. 1 of the Alternative Investment Fund Managers Act (AIFMG; Alternative Investmentfonds Manager-Gesetz) published in Federal Law Gazette I No. 135/2013, provided that it is an open-ended type of AIF in accordance with Article 1 para. 2 no. 1 AIFMG; d. options, futures, swaps, forward rate agreements and any other derivative contracts relating to securities, currencies, interest rates or yields, emission allowances (EUAs) or other derivatives instruments, financial indices or financial measures which may be settled physically or in cash; e. options, futures, swaps, forwards and all other derivatives contracts relating to commodities, which must be settled in cash or may be settled in cash at the option of one of the parties, without a default or another termination event exists; f. options, futures, swaps and any other derivatives contract relating to commodities that may be physically settled provided that they are traded on a regulated market, or via an MTF or via an OTF, with the exception of wholesale energy products traded on an OTF that must be physically settled; g. options, futures, swaps, forward rate agreements and any other derivative contracts relating to commodities that may be physically settled, that are otherwise not listed in lit. f and which do not serve commercial purposes that have the characteristics of other derivative financial instruments; h. derivative instruments for the transfer of credit risk; i. financial contracts for differences; j. options, futures, swaps, forward rate agreements and any other derivatives contracts relating to climatic variables, freight rates, inflation rates or other official economic statistics that must be settled in cash or may be settled in cash at the option of one of the parties, without a default or another termination event existing, as well as all other derivative contracts in relation to assets, rights, obligations, indices and financial measures, which are not otherwise listed in this point, and that have the characteristics of other derivative financial instruments, although among other factors it shall be taken into account whether they are traded on a regulated market or using an OTF or an MTF; k. emission allowances consisting of any units recognised for compliance with the requirements of Directive 2003/87/EC (Emissions Trading Scheme). 8. non-complex financial instruments:

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 9 / 126 a. shares admitted to trading on a regulated market or on an equivalent market in a third country or on an MTF, where they are shares of companies, with the exception of units in collective investment undertakings that are not UCITS, and shares in which a derivative is embedded; b. bonds or other forms of securitised debt that are admitted to trading on a regulated market or in an equivalent third-country or on an MTF, with the exception of bonds or other forms of securitised debt, in which a derivative is embedded, or which contain a structure, which makes it difficult for the client to understand the risk involved; c. Money-market instruments, with the exception of instruments, in which a derivative is embedded, or which contain a structure, which makes it difficult for the client to understand the risk involved; d. shares or units in UCITS, excluding structured UCITS as referred to in Article 36(1)(2) of Regulation (EU) No 583/2010; e. structured deposits, excluding those that incorporate a structure which makes it difficult for the client to understand the risk of return or the cost of exiting the product before term; f. other non-complex financial instruments as defined in this paragraph, that fulfil the criteria determined in Article 57 of Delegated Regulation (EU) 2017/565; g. (repealed in the amendment published in Federal Law Gazette I 37/2018) For the purposes of lits. a to f a third-country market shall be considered to be equivalent to a regulated market, if the requirements and procedures of Article 25 (4) point a subparagraphs 3 and 4 of Directive 2014/65/EU are met. 9. depositary receipts: those securities which are negotiable on the capital market and which represent ownership of the securities of a non-domiciled issuer while being able to be admitted to trading on a regulated market and traded independently of the securities of the non-domiciled issuer. 10. exchange-traded fund: a fund of which at least one unit or share class is traded throughout the day on at least one trading venue and with at least one market maker pursuant to no. 32 which takes action to ensure that the price of its units or shares on the trading venue does not vary significantly from its net asset value and, where applicable, from its indicative net asset value. 11. certificates: securities as defined in Article 2(1)(28) Regulation (EU) No 600/2014; 12. structured finance products: securities as defined in Article 2(1)(28) of Regulation (EU) No 600/2014; 13. structured deposits: deposits pursuant to Article 7 para. 1 no. 3 of the Deposit Guarantee Schemes and Investor Compensation Act (ESAEG; Einlagensicherungs- und Anlegerentschädigungsgesetz) published in Federal Law Gazette I No. 117/2015, which are to be repaid in full upon becoming due, with the payment of interest or a premium or the interest rate or premium risk is calculated using a formula, dependent on certain factors, such as:

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 10 / 126 a. an index or combination of indices, excluding variable rate deposits whose return is directly linked to an interest rate index such as Euribor or Libor; b. a financial instrument or combination of financial instruments; c. a commodity or combination of commodities or other physical or non-physical non￾fungible assets; d. a foreign exchange rate or combination of foreign exchange rates. 14. derivatives: securities as defined in Article 2(1)(29) Regulation (EU) No 600/2014. 15. commodity derivatives: securities as defined in Article 2(1)(28) Regulation (EU) No 600/2014. 16. wholesale energy product: wholesale energy products as defined in Article 2 (4) of Regulation (EU) No 1227/2011. 17. C6 energy derivatives contracts; options, futures, swaps or other derivatives contracts listed in no. 7 lit. f relating to coal or oil that are traded on an OTF and must be physically settled. 18. agricultural commodity derivatives: derivative contracts relating to products listed in Article 1 of, and Annex I, Parts I to XX and XXIV/1, to, Regulation (EU) No 1308/2013 as well as Annex I of Regulation (EU) No 1379/2013 19. sovereign debt: a debt instrument which is issued by a sovereign issuer pursuant to no. 20. 20. sovereign issuer: any of the following issuers of debt instruments: a. the European Union; b. a Member State including a government department, an agency or a special purpose vehicle of the Member State; c. in the case of federal Member State, a member of the federation; d. a special purpose vehicle for several Member States; e. an international financial institution established by two or more Member States which has the purpose of mobilising funding, and providing financial assistance to the benefit of its members that are experiencing or threatened by severe financing problems; f. the European Investment Bank. 21. Regulated market: a regulated market pursuant to Article 1 para. 2 of the Stock Exchange Act 2018 (BörseG 2018; Börsegesetz 2018), published in Federal Law Gazette I no. 107/2017. 22. Market operator: anyone who manages and/or operates the business of a regulated market; the market operator may be the regulated market itself. 23. Multilateral system: a system pursuant to Article 2(1) (11) of Regulation (EU) No 600/2014. 24. Multilateral Trading Facility (MTF): a multilateral system, operated by an investment firm or a market operator, which brings together multiple third-party buying and selling interests in financial instruments - in the system and in accordance with non-discretionary rules - in a way that results in a contract in accordance with the provisions of Title II of Directive 2014/65/EU, which is not a regulated market. 25. Organised Trading Facility (OTF): a multilateral system which is neither a regulated market nor an MTF and in which multiple third-party buying and selling interests in bonds, structured

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 11 / 126 finance products, emission allowances or derivatives are able to interact in the system in a way that results in a contract in accordance with Title II of Directive 2014/65/EU. 26. Trading venue: a regulated market, an MTF or an OTF. 27. Liquid market: means a market for a financial instrument or a class of financial instruments, where there are ready and willing buyers and sellers on a continuous basis, assessed in accordance with the following criteria, taking into consideration the specific market structures of the particular financial instrument or of the particular class of financial instruments: a. the average frequency and size of transactions over a range of market conditions, having regard to the nature and life cycle of products within the class of financial instrument; b. the number and type of market participants, including the ratio of market participants to traded instruments in a particular product; c. the average size of spreads, where available. 28. Systematic internaliser: a credit institution or an investment firm, which, on an organised, frequent, and systematic basis, deals on its own account when executing client orders outside a regulated market, or an MTF or an OTF, without operating a multilateral system itself, or which has decided upon the status of a systematic internaliser. 29. central counterparty (CCP): a legal person as defined in Article 2 (1) of Regulation (EU) No 648/2012. 30. market maker: a person who holds himself out on the financial markets on a continuous basis as being willing to deal on own account by buying and selling financial instruments against that person's proprietary capital at prices defined by that person. 31. credit institution: a credit institution as defined in Article 1 para. 1 BWG. 32. CRR-credit institution: a CRR-credit institution as defined in Article 1a para. 1 no. 1 BWG. 33. UCITS management company: a management company as defined in Article 3 para. 2 no. 1 of the Investment Fund Act 2011 (InvFG 2011; Investmentfondsgesetz 2011). 34. client: any natural or legal person to whom a legal entity provides investment and/or ancillary services and any natural or legal person to whom the investment firm has pre-contractual obligations. 35. professional client: a client as defined in Article 66 para. 1. 36. retail client: a client who is not a professional client. 37. limit order: an order to buy or sell a financial instrument at its specified price limit or better and for a specified size. 38. home Member State for investment firms that are not CRR-investment firms (Article 1 no. 2): a. in the case of natural persons: the Member State in which they have their head office; b. in the case of legal persons: the Member State in which the legal person's registered office in accordance with its statutes is located, or in the event that the legal person

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 12 / 126 does not have a registered office in accordance with its statutes under the applicable national law the Members State in which its head office is situated. 39. home Member State of a regulated market: the Member State in which the regulated market is authorised or, if in accordance with the law of that Member State it has no registered office, the Member State in which the head office of the regulated market is situated. 40. the home Member State of an approved publication arrangement (APA) as defined in no. 60, of a consolidated tape provider (CTP) as defined in no. 61 or of an approved reporting mechanism (ARM) as defined in no. 62: a. in the case of it being a natural person: the Member State in which the head office of the APA, CTP or ARM is situated; b. in the case of it being a legal person: the Member State in which the APA, CTP or ARM has its registered office in accordance with its statutes, or, in the event that it does not have a registered office in accordance with its statutes under the applicable national law, the Member State in which its main office is situated. 41. Host Member State: the Member State, other than the home Member State, in which an investment firm has a branch or performs services and/or activities or a Member State in which a regulated market provides appropriate arrangements so as to facilitate access to trading on its system by remote members or participants established in that same Member State. 42. Third country firm: a firm, that would be a credit institution that provides investment services or activities, or an investment firm pursuant to no. 1, if its head office or registered office had been situated in the European Union. 43. competent authority: the authority designated by each Member State as the competent authority in accordance with Article 67 of Directive 2014/65/EU. 44. tied agent: a natural or legal person who, under the full and unconditional responsibility of only one investment firm or only one investment services provider or only one credit institution on whose behalf it acts, promotes investment and/or ancillary services to clients or prospective clients, receives and transmits instructions or orders from the client in respect of investment services or financial instruments, places financial instruments and/or provides advice to clients or prospective clients in respect of those financial instruments or services; a tied agent is not an investment firm. 45. investment intermediaries: natural persons with a business licence in accordance with Article 94 no.77 of the Commercial Code of 1994 (GewO 1994, Gewerbeordnung 1994), published in Federal Law Gazette no. 194/1994, in conjunction with Article 136b GewO 1994, who though self-employed, provide one or more services in accordance with Article 3 para. 2 nos. 1 and 3 exclusively with regard to financial instruments in accordance with Article 1 no. 7 lits. a and c on behalf and on account of an investment firm or an investment services provider, and do not require a licence pursuant to Articles 3 or 4 WAG. Natural persons holding a business licence in accordance with Article 94 no. 75 GewO 1994 in conjunction with Article 136a GewO 1994 shall also be authorised to act as investment intermediaries.

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 13 / 126 Investment intermediaries may only provide such services for securities firms and investment services providers, with a maximum of three agency relationships being allowed. 46. branch: for investment firms that are not CRR-investment firms as defined in no. 2, a place of business which is a legally dependent part of an investment firm, and which provides investment services or activities related to the activities of the investmentfirm, and which may also perform ancillary services, although it may not be permitted to exclusively perform ancillary services; all the places of business set up in the same Member State by an investment firm with head office or headquarters in another Member State shall be regarded as a single branch. 47. qualifying holding: for investment firms that are not CRR-investment firms (Article 1 no. 2), the direct or indirect holding of at least 10 % of the capital or the voting rights in an undertaking or the possibility to exercise a significant influence over the management of the investment firm; for the assessment of voting rights, Article 130 para. 2 to para. 4 in conjunction with Articles 133 and 134 paras. 2 and 3 BörseG 2018 shall be applied; although in the cases of Articles 13 to 16 of this Federal Act,the voting rights or capital shares held by investment firms or credit institutions as a result of the underwriting of financial instruments or the placing of financial instruments on a firm commitment basis under no. 3 lit. f shall not be taken into consideration, provided that such rights are not exercised or used in another manner, for the purpose of interfering with the issuer's management, and are sold within one year of the date of their acquisition. 48. parent undertaking: for investment firms that are not CRR-investment firms (no. 2), parent undertakings shall be as defined in Article 189a no 6 of the Austrian Commercial Code (UGB; Unternehmensgesetzbuch), published in Reich Law Gazette p. 219/1897, taking into consideration of the following provisions: a. the legal form and the registered office shall not be taken into consideration; b. Article 244 paras. 4 and 5 UGB shall be applied; c. the term "participation" defined in Article 4(1)(35) of Regulation (EU) No 575/2013 shall be applied. 49. subsidiary: for investment firms that are not CRR-investment firms (no. 2), subsidiaries shall be as defined in Article 189a no. 7 UGB, taking into consideration of the following provisions: a. the legal form and the registered office shall not be taken into consideration; b. Article 244 paras. 4 and 5 UGB shall be applied. c. the term "participation" defined in Article 4(1)(35) of Regulation (EU) No 575/2013 shall be applied. 50. close links: for investment firms that are not CRR-investment firms (no. 2), a situation in which two or more natural or legal persons are linked by a. participation in the form of ownership, direct or by way of control, of 20 % or more of the voting rights or capital of an undertaking;

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 14 / 126 b. by means of control as defined in no. 48; subsidiaries of subsidiaries shall also be considered as subsidiaries of the parent undertaking which is at the head of those undertakings; or c. a permanent link of both or all of them to the same third person by a control relationship; 51. control: a relationship between a parent undertaking and a subsidiary as defined in Article 189a no. 6 UGB or a similar relationship between any natural or legal person and an undertaking. 52. group: a group to which an investment firm or a credit institution belongs, consisting of a. a parent undertaking, its subsidiaries, and the undertakings in which the parent undertaking or its subsidiaries hold a participation, or b. several undertakings, that are not related to one another in the form of parent or subsidiary relationship and aa) which are controlled by the same undertaking on the basis of a mutually concluded agreement or the statutory provisions of such undertakings, or bb) whose administrative, management, or supervisory bodies are mostly comprised of the same persons, who are in office during the financial year and until the consolidated financial statements are drawn up. 53. central securities depositary (CSD): a legal person that operates a securities settlement system pursuant to Article 2(1)(1) of Regulation (EU) No 909/2014 in conjunction with point (3) of Section A of the Annex to Regulation (EU) No 909/2014 and provides at least one other core service pursuant to Article 2(1)(1) of Regulation (EU) No 909/2014 in conjunction with Section A of the Annex to Regulation (EU) No 909/2014. 54. management body: the body of an investment firm as defined in no. 1, of an investment services provider, of credit institution as defined in no. 31, of a market operator as defined in no. 22 or a data reporting services provider as defined in point 36a of Article 2(1) of Regulation (EU) No 600/2014, that is appointed in accordance with national law of a Member State, in order to determine the strategy, aims and overall policy of the undertaking (depending on the applicable legal framework: "management function of the management body" or "management body") and to check and monitor the decisions taken by the management body (depending on the applicable legal framework: "supervisory function of the management body" or "supervisory board"). The persons who actually conduct the business of the entity also belong to the management body. 55. senior management: the natural persons that exercise executive functions in an investment firm as defined in the no. 1, an investment services provider as defined in no. 33, a market operator as defined in no. 22 or a data reporting services provider as defined in point 36a of Article 2(1) of Regulation (EU) No 600/2014, and are responsible for the day-to-day management of the entity, including for the implementation of the company's strategy

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 15 / 126 concerning the distribution of products and services to clients by the firm and its personnel, and are accountable to the supervisory body. 56. algorithmic trading: trading in financial instruments where a computer algorithm automatically determines individual parameters of orders such as whether to initiate the order, the timing, price or quantity of the order or how to manage the order after its submission, with limited or no human intervention, and does not include any system that is only used for the purpose of routing orders to one or more trading venues or for the processing of orders involving no determination of any trading parameters or for the confirmation of orders or the post-trade processing of executed transactions. 57. high-frequency algorithmic trading technique: an algorithmic trading technique characterised by: a. an infrastructure intended to minimise latencies (network latencies and other delays in the routing of orders), including at least one of the following facilities for algorithmic order entry: co-location, proximity hosting or high-speed direct electronic access; b. system-determination of order initiation, generation, routing or execution without human intervention for individual trades or orders; and c. high message intraday rates which constitute orders, quotes or cancellations. 58. direct electronic access: an arrangement where a member or participant or client of a trading venue permits a person to use its trading code so that the person can electronically transmit orders relating to a financial instrument directly to the trading venue and includes arrangements which involve the use by a person of the infrastructure of the member or participant or client, or any connecting system provided by the member or participant or client, to transmit the orders (direct market access) and arrangements where such an infrastructure is not used by a person (sponsored access). 59. cross-selling practice: the offering of an investment service together with another service or product as part of a package or as a condition for the same agreement or package. 60. approved publication arrangement (APA): a person pursuant to Article 2(1)(34) of Regulation (EU) No 600/2014. 61. consolidated tape provider (CTP): a person pursuant to Article 2(1)(35) of Regulation (EU) No 600/2014. 62. approved reporting mechanism (ARM): a person pursuant to Article 2(1)(36) of Regulation (EU) No 600/2014. 63. (repealed) 64. durable medium: any medium enabling a client to store information addressed personally provided to him in such a way that it can subsequently access such information for a period of time adequate for its purpose and which allows the unchanged reproduction of the information. 64a. electronic format: a durable medium that is not paper. 65. relevant person:

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 16 / 126 a. a shareholder or a member of the senior management or a tied agent of the investment firm or the investment services provider or the credit institution; b. a shareholder or a member of the senior management of a tied agent of the investment firm or the investment services provider or the credit institution; c. an employee of the investment firm, credit institution, or of a tied agent or any other natural person whose services are made available to the investment firm, the credit institution, or to a tied agent of the investment firm or the investment services provider or the credit institution and which are controlled by them and are which are involved in the investment services and activities provided/performed by the firm or credit institution; d. any natural person who as part of outsourcing is directly involved in the provision services for the investment firm, the credit institution, or their tied agent, for the purpose of the provision of investment services and activities by the investment firm, investment services provider or credit institution. 66. financial analyst: anyone who draws up a substantial part of investment research pursuant to Article 36 of Commission Delegated Regulation (EU) 2017/565. 67. outsourcing: an agreement between an investment firm or credit institution and another service provider, under which the service provider performs a process, a service or an activity which would otherwise be undertaken by the investment firm or credit institution. 68. natural and legal person: natural and legal persons including partnerships having full legal capacity (ordinary partnerships and limited partnerships). 69. predominantly commercial group: any group whose principal activity is not providing investment services as defined in this Federal Act, or in providing activities listed in Annex I of Directive 2013/36/EU or in the activity as a market-maker in relation to commodity derivatives. 70. sustainability factors: sustainability factors as defined in Article 2(24) of Regulation (EU) No 2019/2088; 71. fixed overheads: the operating expenses (Annex 2 to Article 43 BWG, Part 2, Item III), that are independent of the respective level of activities of the investment firm, and which are unable to be directly allocated to the individual cost centres (products). Where not determined otherwise in this Federal Act, the definitions contained in the BWG, BörseG 2018, Regulation (EU) No 600/2014, Commission Delegated Regulation (EU) 2017/565 and Commission Delegated Regulation (EU) 2017/567 amending Regulation (EU) No 600/2014 with regard to definitions, transparency, portfolio compression and supervisory measures on product intervention and positions, OJ L 87, p. 90. Exceptions Article 2. (1) The provisions of this Federal Act shall not apply to:

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 17 / 126

1. undertakings pursuant to Article 1 para. 1 nos. 1 to 5 of the Insurance Supervision Act 2016 (VAG 2016; Versicherungsaufsichtsgesetz 2016), published in Federal Law Gazette I No. 34/2015, within the meaning of para. 2;
2. persons who provide investment services exclusively for their parent undertakings, for their subsidiaries, for their subsidiaries or for other subsidiaries of their parent undertakings;
3. persons who provide investment services consisting exclusively in the administration of employee contributions schemes;
4. persons solely providing investment services exclusively pursuant to nos. 2 and 3;
5. persons who only provide an investment service in an incidental manner within their professional activities when that activity is regulated under law or a code of ethics governing the profession which do not exclude the provision of that service;
6. persons dealing on their own account in financial instruments, that are not commodity derivatives or emission allowances or derivatives thereof, and who do not provide any other investment services or activities in financial instruments that are not commodity derivatives or emission allowances or derivatives thereof, except when these persons a. are market makers, or b. are members or participants in a regulated market or MTFs with the exception of non￾financial entities that conduct trades at a trading venue for liquidity management purposes or which reduce the risks directly associated with the business activities or liquidity and finance management of such non-financial entities or their groups in an objectively measurable manner, or c. apply a high-frequency algorithm trading technique, or d. deal on their own account when executing client orders; Persons excluded pursuant to nos. 1, 10, 11 or 13 from application, shall not be required to fulfil the conditions listed in this point, in order be excluded from its application.
7. the Oesterreichische Nationalbank as well as other members of the European System of Central Banks;
8. the Austrian Treasury (Österreichische Bundesfinanzierungsagentur);
9. international financial institutions founded by two or more states, which have the purpose of mobilising funding for their members that are experiencing or threatened by severe financing problems;
10. management companies pursuant to Article 5 para. 1 InvFG 2011 as well as investment fund management companies pursuant to Article 2 para. 1 of the Real Estate Investment Fund Act (ImmoInvFG; Immobilien-Investmentfondsgesetz) published in Federal Law Gazette I no. 80/2003, subject to the provisions of para. 3;
11. Pensionskassen (pension funds) under the Pension Funds Act (PKG; Pensionskassengesetz) published in Federal Law Gazette no. 281/1990, and employees’ provision funds as defined in the Company Pension Fund Act (BMVG; Betriebliches Mitarbeitervorsorgegesetz), published in Federal Law Gazette I no. 100/2002;

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 18 / 126 12. operators with compliance obligations under Directive 2003/87/EC who, when dealing in emission allowances, do not execute client orders and who do not provide any investment services or perform any investment activities other than dealing on own account, provided that those persons do not apply a high-frequency algorithmic trading technique; 13. persons, a. who deal on own account in commodity derivatives or emission allowances or derivatives thereof, including market makers, but excluding persons dealing on own account if they execute client orders, or b. who in relation to commodity derivatives or emission allowances or derivatives thereof provide as their principal activity other investment services than dealing on own account for clients or suppliers, provided that: aa) this, in all of these cases both on an individual and aggregated basis at the level of the group of undertakings, constitutes an ancillary activity to their principal activity, bb) these persons are not part of a group of undertakings, whose principal activity is providing investment services as defined in this Federal Act, or in providing activities listed in Annex I of Directive 2013/36/EU or in the activity as a market￾maker in relation to commodity derivatives, cc) these persons do not apply high-frequency algorithmic trading techniques, and dd) these persons notify the competent authority upon request about the basis upon which they arrive at the conclusion that their activity in accordance with lits. a and b constitutes an ancillary activity to their principal activity; 14. Persons, who within another professional activity that does not fall under the scope of this Federal Act or the BWG or the AIFMG provide investment advice, provided such advice is not separately remunerated; 15. Operators of transmission networks as defined in Article 7 para. 1 no. 70 of the Electricity Sector Act 2010 (ElWOG 2010; Elektrizitätswirtschafts- und -organisationsgesetz 2010) as published in Federal Law Gazette I No. 110/2010, or Article 7 para. 1 no. 20 of the Gas Sector Act 2011 (GWG 2011; Gaswirtschaftsgesetz 2011), published in Federal Law Gazette I No. 107/2011, where they perform their duties pursuant to Directive 2009/72/EC, Directive 2009/73/EC, Regulation (EC) No 714/2009, Regulation (EC) No. 715/2009 or in accordance with network codes or Guidelines issued in accordance with these regulations, persons dealing in their name as service provider, in order to perform the duties of a transmission network provider pursuant to the network codes or Guidelines issued in accordance with these Regulations, and operators or managers of an energy balancing scheme, a pipeline network or a system for balancing out the supply and demand of energy in performing such duties. This exception shall apply for the persons that perform the activities listed in this point only if they provide investment services or activities in relation to commodity derivatives that are

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 19 / 126 performed in relation to the aforementioned activities. This exception shall not apply for the operation of a secondary market, including a platform for secondary dealing in financial transmission rights; 16. central securities depositories as defined in Regulation (EU) No. 909/2014; 17. crowdfunding service providers as defined in point e of Article 2 (1) Regulation (EU) 2020/1503 on European crowdfunding service providers for business, and amending Regulation (EU) 2017/1129 and Directive (EU) 2019/1937, OJ L 347, 20.10.2020 p. 1. (2) The provisions of Articles 3, 21 to 25, 28 to 31, 33, 34, 44 to 53, 57 and 59 of Commission Delegated Regulation (EU) 2017/565 as well as Articles 33, 36, 45 to 55, 58, 60, 90, Article 92 paras. 9 and 10 and Articles 94 to 96 shall apply to insurance undertakings that conduct the mediation of units in investment funds pursuant to Article 6 para. 3 VAG 2016 in relation to this activity; where such insurance undertakings have a compliance function, risk management function and an internal audit function in accordance with the provisions of the VAG, the duties listed in Articles 22 to 24 of Commission Delegated Regulation (EU) 2017/565 may be conducted by the relevant organisational unit. Such companies are entities liable to pay costs and as such are to be allocated to the investment services accounting sub- group as defined in Article 89 para. 1 and must be taken into account at 67% when issuing a regulation in accordance with Article 89 para. 2. The amounts attributable to the above shall be prescribed by way of an administrative decision. (3) The provisions listed in Article 1(1) of Commission Delegated Regulation (EU) 2017/565 as well as Articles 30, 31, 33, 36, 45 to 55, 58, 60, 90, Article 92 paras. 9 and 10 and Articles 94 to 96 shall apply to management companies pursuant to Article 5 para. 1 InvFG 2011 that provide services pursuant to Article 5 para. 2 no. 3 or 4 InvFG 2011, and AIFMs as defined in Article 4 AIFMG that provide services pursuant to Article 4 para. 4 no. 1 or no. 2 AIFMG. Such companies shall be considered as entities liable to pay costs and shall be allocated to the investment services accounting sub-group as defined in Article 89 para. 1 and must be taken into account at 67% when issuing a regulation in accordance with Article 89 para. 2. The amounts attributable to the above shall be prescribed by way of an administrative decision. (4) Articles 27 and 28 shall apply to legal entities pursuant to para. 1 nos. 1, 10, 11, 12 and 13 that are members of regulated markets or participants of MTFs. (5) This Federal Act shall not apply for the provision of services as counterparty in transactions carried out by public bodies dealing with public debt or by members of the ESCB performing their tasks as provided for by the TFEU and Protocol no. 4 on the Statute of the European System of Central Banks and of the European Central Bank or performing equivalent functions in accordance with national provisions. Investment firms Article 3. (1) An investment firm is a legal person whose registered office and head office are in Austria and which is authorised under this Federal Act to provide investment services and activities.

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 20 / 126 Natural and legal persons, whose authorisation to provide/perform investment services and activities is based on Article 4, on the BWG or the BörseG 2018, shall not be considered as investment firms. (2) The provision of the following investment services and ancillary investment services on a commercial basis shall require a licence granted by the FMA:

1. investment advice in relation to financial instruments;
2. portfolio management by way of managing portfolios in accordance with mandates given by clients on a discretionary client-by-client basis, where such portfolios include one or more financial instruments;
3. receiving and transmitting of orders, providing that such activities are in relation to one or more financial instruments;
4. operating a multilateral trading facility (MTF)
5. operating an organised trading facility (OTF)
6. execution of orders on behalf of clients;
7. trading on own account;
8. underwriting of financial instruments and/or placing of financial instruments with a firm commitment basis;
9. placing of financial instruments without a firm commitment basis;
10. safekeeping and administration of financial instruments for the account of clients, including custodianship and related services such as cash/collateral management and excluding maintaining securities accounts at the top tier level (custody business);
11. granting of credits or loans to investors to allow the investor to carry out a transaction in one or more financial instruments, where the firm granting the credit or loan is involved in such transactions;
12. foreign exchange services, where related to the provision of investment services;
13. services related to underwriting of issuances for third parties;
14. investment services and activities pursuant to Article 1 no. 3 as well as ancillary investment services pursuant to Article 1 no. 4 lits. a to f regarding commodities, climatic variables, freight rates, inflation rate statistics or other official economic statistics where used as underlying assets for the derivatives specified in no. 7 lit. e to g and j and where these are connected to the provision of investment or ancillary services or ancillary investment services. When granting a licence as well as in every case of a licence being extended, the FMA shall also discuss about the authorisation for holding client deposits and financial instruments. A licence for ancillary investment services pursuant to nos. 10 to 14 may only be granted, if a licence exists or is granted at the same time for the provision of at least one of the services pursuant to nos. 1 to 9; in the event of the lapsing or withdrawal of the licence for all investment services pursuant to nos. 1 to 9 the licence shall automatically lapse for all ancillary investment services pursuant to nos. 10 to
15. The FMA shall discuss the lapsing of the licence for all ancillary investment services together with the surrendering or relinquishing of licence regarding investment services pursuant to nos. 1 to 9;

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 21 / 126 lapsing shall only be permissible when all ancillary investment services have been concluded beforehand. (3) Austrian credit institutions and investment firms shall also be authorised to conduct investment research or to make any other forms of general recommendations relating to transactions for financial instruments. Investment firms shall also be authorised to advise undertakings on capital structure, their industry-specific strategy and related matters as well as to provide advice and services relating to mergers and the purchase of undertakings. (4) (repealed) (5) The licence shall be granted, if:

1. the undertaking is to be operated with the legal form of a joint stock company or a cooperative society;
2. the initial capital shall at least be in the amount specified in para. 6 and shall be freely available to the management without restrictions and encumbrances in the Member States;
3. the management shall as defined in Article 12 hold suitable professional qualifications and possess the necessary skills and experience required for the provision of investment services;
4. (repealed)
5. the general terms and conditions, rules, and procedures for operating an MTF or an OTF shall correspond to the requirements set out in Article 76 BörseG 2018;
6. the requirements of Article 5 para. 1 nos. 2 to 4a, 6, 7 and 9 and nos. 10 to 14 BWG shall be met. The FMA shall notify the applicant within six months of receipt of the complete application, whether an authorisation has been granted or not. (6) The initial capital of an investment firm shall be determined pursuant to Article 13 of the Investment Firms Act (WPFG; Wertpapierfirmengesetz) published in Federal Law Gazette I No. 237/2022. (7) Investment firms wishing to provide services in the manner stated in Article 1 no. 45, must explicitly state this in the application that they submit in relation to the granting or extending of a licence. The administrative decision, by means of which such a licence is granted, shall separately address the permissibility of providing services pursuant to Article 1 no. 45. (8) The licence shall be granted in writing, otherwise it shall be invalid; the licence may be granted subject to conditions and obligations, may be valid for a single kind or business or several kinds of business pursuant to para. 2, while parts of individual services may also be excluded from the scope of the licence. Article 4 paras. 3 and 5 BWG shall apply with regard to the application for the granting of a licence. (9) The compensation scheme shall be consulted prior to granting the licence. (10) The distribution of units in AIFs shall only be permissible within an authorisation pursuant to para. 2, where the units are allowed to be distributed in accordance with the AIFMG. (11) The FMA shall register all investment firms in a publicly accessible register and shall update the register regularly. This register shall contain information about the investment services and activities that the investment firm is authorised to conduct.

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 22 / 126 (12) The granted licence entitles the investment firm to provide its investment services and activities throughout the entire European Union. Investment Services Providers Article 4. (1) In order to provide commercial investment services pursuant to Article 3 para. 2 nos. 1 and 3, natural or legal persons with registered office and head office in Austria are not required, where such services are provided within the bounds of Article 3 (1) of Directive 2014/65/EU, – to fulfil the requirements stipulated in para. 2 provided that the undertaking's annual turnover from investment services does not exceed EUR 2 million. Such undertakings shall not be allowed to use the designation of investment firms. They are solely authorised to provide services in Austria. They shall not be allowed to perform any services that include the holding of money of third-parties, securities or other instruments of clients, thereby ensuring that they shall not at any time be able to become their clients' debtor by virtue of performing such activities. (2) The following requirements for issuing authorisations and other requirements that apply for investment firms shall not be required to be met by investment services providers:

1. the requirements of managers stipulated in Article 5 para. 1 nos. 12 and 13 BWG;
2. the compulsory membership of a compensation facility pursuant to Articles 73 to 76;
3. the equity capital requirements pursuant to Article 3 para. 6; the provisions under company law about initial capital remain unaffected. The business documents must include suitable reference about the missing condition pursuant to Article 5 para. 1 no. 12 BWG. The FMA shall explicitly state in every licence granted to an investment services provider that this licence was granted in accordance with Article 3 (1) of Directive 2014/65/EU. (3) Investment services providers shall be required to take out professional indemnity insurance with an insurance undertaking that is authorised to conduct insurance business in Austria. This professional indemnity insurance shall be required to cover the resulting risk arising from their business activities. The investment services provider must offer the customer a comparable level of protection to the client with regarding to the scope, the risk profile and the legal form of the undertaking that to that provided by the investor compensation facility (Articles 73 to 76). The liability coverage sum of the insurance policy with regard to the business activities relating to investment services and activities shall be at least EUR 1 000 000 for every individual damage event and a total amount of at least EUR 1 500 000 for all damage events during a calendar year. The insurer shall notify the FMA without delay in writing about any subsequent expiry of insurance cover, otherwise being obliged to compensate for damages incurred. The insurance contract shall stipulate that
4. the client shall be entitled to a direct claim against the insurer, independent from the insurance certificate;

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 23 / 126 2. Article 158c paras. 1 and 2 of the Insurance Policy Act 1958 (VersVG, Versicherungsvertragsgesetz 1958), published in Federal Law Gazette No. 2/1959, shall apply accordingly. (4) Investment services providers wishing to provide services in the manner stated in Article 1 no. 45, must explicitly state this in the application that they submit in relation to the granting or extending of a licence. In the administrative decision in which such a licence is granted, the permissibility of providing services pursuant to Article 1 no. 45 shall be addressed separately. (5) Investment services providers shall hold sufficient equity capital at all times. Investment service providers shall maintain the initial capital required at the time of the licence being granted as their minimum capital or shall maintain the necessary professional indemnity insurance pursuant to Article 4 para. 3. Group of investment firms and the FMA as consolidating supervisor Article 5. (repealed) Surrendering and lapsing of the licence Article 6. (1) The FMA may revoke the licence, if

1. the business operation to which it refers, is not commenced within twelve months of the granting of the licence, or
2. the business operation to which it refers was not conducted for more than six months. (2) The FMA shall revoke the authorisation, if
3. it was obtained by making false statements or by any other irregular means;
4. the licensing requirements pursuant to Article 3 para. 5 or the requirements in Regulation (EU) No 2019/2033 on prudential requirements for investment firms and amending Regulations (EU) No 1093/2010, (EU) No 575/2013, (EU) No 600/2014 and (EU) No. 806/2014, OJ L 314, 05.12.2019, p. 1, in the version of the corrigendum in OJ L 261, 22.07.2021, p. 60, are no longer fulfilled and other measures in accordance with this Federal Act are unable to ensure the ability of the investment firm or the investment services provider to function;
5. there have been serious and systematic infringements against the provisions in this Federal Act or those in Regulation (EU) no. 600/2014 that stipulate the conditions for conducting the activity of investment firms and investment services providers;
6. bankruptcy proceedings have been initiated against the assets of the investment firm or of the investment services provider. (3) With regard to the lapsing of the licence, Article 7 BWG shall apply with the provision that the lapsing of the licence shall only be permissible if all investment services have already been settled.

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 24 / 126 Application of the BWG Article 7. The following provisions of the BWG shall apply to investment firms and investment services providers: Article 21 para. 1 nos. 1, 3 and 5 to 7 and paras. 2 and 3, Article 73 para. 1 nos. 1 to 7 and 11 first clause and Article 96. Obligation of secrecy Article 8. (1) Investment firms and investment services providers as well as the persons working for them shall be required to keep any secrets in confidence, about which they have learned about exclusively from investment transactions (Article 1 para. 1 no. 7 lits. b to f BWG) or from investment services pursuant to Article 3 para. 2 nos. 1 to 3 from their clients, provided that such a obligation of secrecy does not contradict any statutory duty of disclosure or if the client provides written consent to the disclosure of such secrets. The obligation of secrecy set out in the first sentence shall also not apply if the disclosure of such secret is required in order to clear up legal matters in relation to the relationship between investment firms and investment services providers and clients. (2) para. 1 shall also apply to investor compensation schemes, with the exception of the necessary cooperation with other protection schemes set out in Articles 73 to 75 of this Federal Act or the Deposit Guarantee Schemes and Investor Compensation Act (ESAEG; Einlagensicherungs- und Anlegerentschädigungsgesetz). (3) The obligation to observe secrecy in accordance with para. 1 may only be breached towards tax offices and the authority for punishing financial crimes in relation to criminal proceedings that have been initiated related to financial offences as well as based on the Common Reporting Standards Act (GMSG; Gemeinsamer Meldestandard Gesetz) published in Federal Law Gazette I No. 116/2015, or where such information or disclosure is necessary to determine a relevant obligation to pay taxes on the part of the investment firm, the investment services provider or the custodian credit institution. Commercial Register Article 9. Investment firms and investment services providers may only be entered in the Commercial Register if the appropriate legally effective administrative decisions have been submitted in the original or as certified copies. Own Funds Article 10. (repealed) Procedure for the exemption of institutions belonging to the group of institutions Article 11. (repealed)

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 25 / 126 The Management Board and the Supervisory Board Article 12. (1) The FMA shall ensure that investment firms, investment services providers, their senior managers and the member of the supervisory board shall comply with Articles 88 and 91 of Directive 2013/36/EU. (2) When granting the licence pursuant to Article 3 para. 2 the FMA may authorise the senior managers to perform one more supervisory function than is permissible pursuant to Article 91(3) of Directive 2013/36/EU. The FMA shall inform the EBA about such approvals on a regular basis. (3) The senior management of an investment firm or an investment services provider shall be responsible for implementing governance rules, which guarantee the effective and prudent management of the investment firm or of the investment services provider and shall prescribe, determine and monitor among other items the separation of duties in the investment firm or the investment services provider as well as the prevention of conflicts of interest. The senior management shall be responsible for the implementation of the governance rules. (4) Without prejudice to the requirements laid down in Article 88 (1) of Directive 2013/36/EU the arrangements set out in para. 3 shall guarantee that the senior management shall define, approve and oversee:

1. the organisation of the firm for the provision of investment services and activities and ancillary services, including the skills, knowledge and expertise required by personnel, the resources, the procedures and the arrangements for the provision of services and activities by the investment firm or the investment services provider. In so doing the nature, scale and complexity of its business and all the requirements the investment firm or investment services provider has to comply with shall be taken into consideration;
2. an institutional policy with regard to the services, activities, products and operations offered or provided, in accordance with the risk tolerance of the investment firm or investment services provider and the characteristics and needs of the clients of the investment firm or the investment services provider to whom they will be offered or provided, including carrying out appropriate stress testing, where appropriate;
3. a remuneration policy of persons involved in the provision of services to clients aiming to encourage responsible business conduct, fair treatment of clients as well as avoiding conflict of interest in the relationships with clients. (5) The supervisory board shall monitor and periodically assess the adequacy and the implementation of the investment firm's or the investment services provider's strategic objectives in the provision of investment services and activities and ancillary services, the effectiveness of the investment firm’s or the investment services provider's governance arrangements and the adequacy of the policies relating to the provision of services to clients. The supervisory board shall take appropriate steps to address any deficiencies.

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 26 / 126 (6) It must be ensured that the members of the supervisory board are granted appropriate access to the information and documents that are necessary for the supervision and oversight of the senior management's decision-making. (7) The FMA shall revoke the licence pursuant to Article 6, if it is of the opinion that the management of the investment firm or the investment services provider are not of good repute, do not possess adequate knowledge, skills and expertise, and are not able to dedicate sufficient time to the performance of their duties, or where objective and demonstrable grounds exist to believe that the management body of the investment firm or the investment services provider may pose a threat to its effective, sound and prudent management and to the adequate consideration of the interests of its clients and the integrity of the market. (8) Investment firms and investment services provides shall notify the FMA of details about all members of their senior management and their supervisory board as well as all changes in their line￾up together with all information needed to assess whether an investment firm or an investment services provider complies with paras. 1 to 6. Shareholders or other members with qualifying holdings Article 13. (1) The FMA shall only grant a licence for the provision of investment services or the performance of investment activities to investment firms or investment services providers once it has been notified of the identities of the natural or legal persons who have qualified holdings as shareholders or members, whether direct or indirect, and the amount of those holdings. (2) The FMA shall be required to take appropriate measures, in the event that the influence exercised by the persons referred to in para. 1 is likely to threaten the sound and prudent management of the investment firm or investment services provider, to put an end to that situation. Such measures shall consist in particular of:

1. applications for judicial orders;
2. supervisory actions pursuant to Article 92;
3. a petition, submitted to the court of first instance for commercial matters competent where the head office of the investment firm or investment services provider is situated, for the suspension of voting rights associated with those shares or other units, that are held by the shareholders or other members in question, a. for the duration of such a threat existing, with the end of such a threat being determined by the court; or b. until such shares or other holdings have been acquired by third parties following assent having been granted pursuant to Article 15 para. 2; the court shall decide except in case of disputes.

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 27 / 126 Notification about a proposed acquisition Article 14. (1) Any person who has decided to acquire, directly or indirectly, a qualifying holding in an investment firm or an investment services provider, or to increase such a qualifying holding directly or indirectly (proposed acquirer), which results in such an acquirer's share in voting rights or in capital reaching or exceeding the threshold values of 20%, 30% or 50% or if the investment firm or investment service provider would become the acquirer's subsidiary, must notify the FMA in advance in writing, specifying the size of the planned participation. In the case of notifications about a qualifying holding in an investment firm the information pursuant to Delegated Regulation (EU) 2017/1946 must be stated, and in the case of notifications about a qualifying holding in an investment services provider the information pursuant to Article 16 para. 3. The obligation to notify shall also apply to persons acting jointly, that considered together would acquire or reach a qualifying holding. The notification may be performed jointly by all or several of the persons acting together, or individually by each person acting. (2) The obligation to notify pursuant to para. 1 shall apply in the same way for the decision to dispose of a directly or indirectly qualifying holding or if the thresholds for participations in an investment firm or an investment services provider listed in para. 1 are fallen below. (3) When reviewing whether the criteria prescribed in Article 13 and this Article have been fulfilled for a qualifying holding, the voting rights or capital shares, that investment firms in another Member State or credit institutions potentially hold following the taking over of the offering of financial instruments or the placing of financial instruments on a firm commitment basis as defined in no. 3 lit. f, shall not be taken into consideration, provided that:

1. such rights are not exercised or are used in another manner, in order to interfere with the issuer's management, and
2. the participation is disposed of again within one year of the date of it being acquired. (4) Investment firms and investment services providers shall be required to
3. inform the FMA without delay if they become aware of any acquisitions or disposal of holdings in their capital, which would cause such holdings to exceed or fall below any of the threshold values referred to in para. 1;
4. to inform the FMA at least once a year about the names of shareholders and members possessing qualifying holdings and the respective sizes of such holdings as shown, for example, by the information received at annual general meeting of shareholders and members or as a result of the compulsory reporting of the companies, whose transferable securities are admitted to trading on a regulated market. (5) The FMA shall take action pursuant to Article 12 para. 2 in regard of persons that do not comply with their obligation to inform the FMA in advance in acquiring or increasing a qualifying holding. It a participation was acquired despite being prohibited by the FMA, then the voting rights of the shares or other units shall be suspended, for such instruments held by the relevant shareholders or

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 28 / 126 other members, until the FMA determines that the reason for the prohibition being issued no longer exists. (6) If the court suspends voting rights in accordance with Article 13 para. 2 no. 3, the court shall at the same time appoint a trustee who must satisfy the requirements defined in Article 5 para. 1 no. 3 BWG, and shall assign the exercising of the voting rights to the trustee. In the case of para. 5, the FMA shall apply for the appointment of a trustee at the competent court pursuant to Article 13 para. 2 no. 3 without delay, upon becoming aware of the voting rights having been suspended. The trustee shall be entitled to be compensated for expenses incurred, as well as for remuneration of its activities; the amount of which is to be determined by the court. The investment firm or the investment services provider as well as the shareholders and other stockholders, whose voting rights are suspended, shall be jointly and severally liable. The obliged parties shall be entitled to appeal against decisions that determine the amount of remuneration for the trustee and the expenses to be reimbursed to them. No further appeal shall take place against the decision of the Oberlandesgericht (regional court of appeal). Assessment procedure Article 15. (1) The FMA shall, promptly and in any case within two working days following receipt of the complete notification required under Article 14 para. 1 as well as following the possible subsequent receipt of the information referred to in para. 3, acknowledge receipt thereof in writing to the proposed acquirer and shall inform the proposed acquirer of the date of the expiry of the assessment period at the time of acknowledging receipt. If the FMA points out to the proposed acquirer that certain documents or information are obviously missing in the notification, Article 13 para. 3 last sentence General Law on Administrative Procedure 1991 (AVG; Allgemeines Verwaltungsverfahrensgesetz 1991) published in Federal Law Gazette no. 51/1991 shall not apply. (2) The FMA within a maximum of 60 working days as from the date of the written confirmation of receipt of the notification and of all the documents required pursuant to Article 16 para. 3 shall prohibit the proposed acquisition in writing, provided that following the assessment according to the assessment criteria pursuant to Article 16, there are reasonable grounds to do so, or if the information submitted by the proposed acquirer is incomplete. The administrative decision prohibiting the proposed acquisition shall be sent within two working days following the FMA's decision prohibiting the proposed acquisition. In the event that the acquisition is not prohibited by the FMA within the assessment period, the acquisition shall be deemed to be approved. If the holding is not prohibited, then the FMA may define a date by when the proposed acquisition listed in Article 14 para. 1 shall be required to be completed. Where applicable, this period may be extended. At the request of the proposed acquirer, the FMA shall also issue an administrative decision in the case of the non-prohibition of the acquisition. The FMA shall indicate any views or reservations expressed by the competent authority responsible for the proposed acquirer in the reasoning of any written assessment decision or administrative decision prohibiting the acquisition. Conditions and

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 29 / 126 obligations may be attached to the administrative decision, in order to ensure that the criteria pursuant to Article 16 are met. At the request of the proposed acquirer, the FMA may make the administrative decision and underlying reasons accessible to the public, taking into consideration the conditions set out in Article 22c no. 3 lits. a to c Financial Market Authority Act (FMABG; Finanzmarktaufsichtsbehördengesetz), published in Federal Law Gazette I No. 97/2001. (3) The FMA may request in writing any further information that is necessary to complete the assessment, no later than on the fiftieth working day of the assessment period (para. 2). Any such request shall specify which informed is additionally required. The assessment period shall be interrupted by the request for information for the period between the date of request for information and the receipt of a response thereto by the proposed acquirer, up to a maximum of 20 working days. The FMA may make further requests for the completion or clarification of the information, although this shall not result in an interruption of the assessment period. (4) The FMA may extend the interruption period of 20 working days to a maximum of 30 working days, in the case that the proposed acquirer

1. is established outside of the European Union, or is supervised outside of the European Union, or
2. is not subject to supervision under Directives 2008/65/EC, 2009/138/EC, or 2013/36/EU. (5) The FMA shall cooperate closely with the competent authorities of other Member States or another sector in conducting the assessment of a proposed acquisition or the increasing of a holding pursuant to Article 16 para. 1 and shall exchange any information that is significant or relevant for the assessment, where the proposed acquirer:
3. is a credit institution, a life insurance or non-life insurance or reinsurance undertaking, an investment firm or a management company pursuant to Article 6 of Directive 2009/65/EC that is authorised in another Member State or in another sector than that in which the acquisition is intended;
4. is a parent undertaking of a credit institution, of a life insurance or non-life insurance or reinsurance undertaking, of an investment firm or a management company pursuant to Article 6 of Directive 2009/65/EC that is authorised in another Member State or in another sector than that in which the acquisition is intended;
5. controls a credit institution, a life insurance or non-life insurance or reinsurance undertaking, an investment firm or a management company pursuant to Article 6 of Directive 2009/65/EC that is authorised in another Member State or in another sector than that in which the acquisition is intended; (6) In the case of a procedure pursuant to para. 5, the FMA shall if requested provide any information and on its own initiative communicate all essential information to the competent authorities, in particular information regarding the assessment of the acquisition and/or prohibition of the acquisition of the participation. In particular, the FMA shall be required to obtain opinions of the competent authorities on the criteria set out in Article 16 para. 1 nos. 1 to 5.

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 30 / 126 Assessment Criteria Article 16. (1) When assessing the notification pursuant to Article 14 para. 1, the FMA shall in the interest of ensuring the sound and prudent management of the investment firm or the investment services provider, in which an acquisition is intended, while taking into consideration the likely influence of the proposed acquirer on the investment firm or the investment services provider, and review the suitability of the proposed acquirer and the financial soundness of the intended acquisition against all of the following criteria:

1. the reputation of the proposed acquirer;
2. the propriety and experience of any person who will manage the investment firm or the investment service provider's business as a result of the proposed acquisition;
3. the financial soundness of the proposed acquirer, in particular in relation to the type of business pursued and envisaged in the investment firm or the investment services provider in which the acquisition is intended;
4. whether the investment firm or the investment services provider will be able to comply and remains able to comply with the prudential requirements based on Directives 2002/87/EC and 2013/36/EU and, in particular, whether the group which it will become a part of has a structure that enables the conducting of effective supervision, the effective exchange of information between the competent authorities and to determine the distribution of competences among the competent authorities (Article 5 para. 1 nos. 4 and 4a BWG);
5. whether there are reasonable grounds to suspect that, in connection with the proposed acquisition, money laundering or terrorist financing as defined in Article 1 of Directive (EU) 2015/849 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing, amending Regulation (EU) No 648/2012 and repealing Directive 2005/60/EC and of Directive 2006/70/EC, OJ L 141, 05.06.2015 p. 73, is occurring, has occurred or such offences has been attempted or whether the proposed acquisition could increase the risk of such behaviour. (2) When conducting the assessment of the proposed acquisition it shall not be geared to the economic needs of the market. (3) The FMA shall determine by means of a Regulation a list of information, that must be supplied to the FMA together with the notifications about participations in investment services providers. This information must be appropriate and necessary for the prudential assessment of compliance with the criteria set out in para. 1 nos. 1 to 5. The scope of the information to be provided shall be proportionate and tailored to the nature of the proposed acquirer and the proposed acquisition. The scope and type of the participation as well as the size and business activities of the proposed acquirer must be taken into account. (4) Where two or more proposals to acquire or increase qualifying holdings in the same investment firm or in the same investment services provider are notified to the FMA, then the FMA shall treat all proposed acquirers in a non-discriminatory manner.

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 31 / 126 SECTION 2: FREEDOM OF ESTABLISHMENT AND FREEDOM TO PROVIDE INVESTMENT SERVICES AND ACTIVITIES Operation of investment services and activities, MTFs and OTFs from other Member States in Austria Article 17. (1) Every investment firm as defined in Article 4(1)(1) of Directive 2014/65/EU, that is authorised and supervised by the competent authorities of another Member State in accordance with Directive 2014/65/EU, and every CRR-credit institution that is approved and supervised in accordance with Directive 2013/36/EU, shall be allowed pursuant to para. 3 to provide investment services or activities in Austria as well as ancillary services pursuant to Section B of Annex I of Directive 2014/65/EU, where such services and activities are covered by their authorisation. Ancillary services shall only be allowed to be provided in conjunction with an investment service or activity. Such investment firms or CRR-credit institutions shall not be required to fulfil any additional requirements in the sectors addressed by Directive 2014/65/EU. This shall also apply if such investment firms or market operators from other Member States operating an MTF or an OTF propose to make such a system available in Austria, in order to enable remote users, members or participants in Austria to have access to and be able to trade on their markets. (2) The provision of the services listed in para. 1 in Austria shall be permitted, if the competent authorities of the home Member State has provided the FMA with all information necessary pursuant to Article 18 paras. 1, 2, 3, 4 and 5. If information pursuant to Article 18 para. 2 or 5 is submitted to the FMA, then the FMA shall be required to disclose this. (3) Once a notification pursuant to para. 2 has been received, the services pursuant to para. 1 may be provided, or amendments as defined in Article 18 para. 3 made. (4) Investment firms conducting activities in Austria through the freedom to provide services shall be required to comply with provisions set out in Articles 47 to 67, 69 and 70 of this Federal Act, Articles 36 and 44 to 70 of Commission Delegated Regulation (EU) 2017/565, Articles 14 to 26 of Regulation (EU) No 600/2014, Articles 34 to 38 and 41 BWG and Article 52 ESAEG as well as administrative decisions are Regulations issued on the basis of these provisions. Operation of investment services and activities, MTFs and OTFs in other Member States Article 18. (1) Every investment firm pursuant to Article 3 wishing to provide/perform investment services or activities within the territory of another Member State for the first time, or wishing to modify the types of investment services or activities offered, shall first notify the FMA in writing including the following information:

1. the Member State in which they intend to perform activities;
2. a business plan, from which it is in particular apparent which investment services or activities and ancillary services they proposed to provide/perform in the territory of this Member State, as well as whether they intend to make used of tied agents for this purpose that are

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 32 / 126 established in Austria. Where the investment firm intends to make use of tied agents, they shall be required to notify the FMA of the names of these tied agents. (2) The FMA shall forward the information in accordance with para. 1 within one month of receipt to the competent authority of the host Member State designated as contact point pursuant to Article 79 (1) of Directive 2014/65/EU. (3) In the event of any amendment to the information submitted in accordance with para. 1 and 2 the investment firm shall notify the FMA in writing about this amendment at least one month prior to the amendment being performed. The FMA shall make the competent authority in the host Member State aware of this amendment. (4) Any credit institution, wishing to provide/perform investment services or activities as well as ancillary services pursuant to para. 1 using tied agents, shall be required to notify the FMA of the names of these tied agents. If the credit institution intends to make use of tied agents that are established in Austria within the territory of the Member States in which it intends to provide services, the FMA shall notify the competent authority of the host Member State designated as contact point pursuant to Article 79 (1) of Directive 2014/65/EU within one month of receiving all the information of the name or names of the tied agents, which the credit institution proposes to use to provide services in the designated Member State. (5) An investment firm or a market operator that is operating an MTF or an OTF shall notify the FMA where applicable about any other Member States where it is proposes to make an MTF or an OTF available. The FMA shall provide this information within one month to the competent authority of the Member State in which the MTF or OTF is wishing to make such systems available. Furthermore, the FMA shall also provide information to the competent authority of the host Member State of the MTF or OTF without delay at the competent authority's request, about the names of the remote members or participants of the MTF or OTF established in that Member State. (6) In addition to the information pursuant to para. 1, the FMA shall also provide the competent authority of the host Member State with precise information about the accredited compensation scheme of which the investment firm is a member. In the event of there being any amendment to such information, the FMA shall notify the competent authority of the host Member State of this amendment. Establishment of a Branch in Austria Article 19. (1) Investment services or activities as well as ancillary services in accordance with this Federal Act and Directive 2014/65/EU and Directive 2013/36/EU under the freedom of establishment — whether by establishing a branch or by making used of a tied agent established in another Member State than the home Member State — are allowed to be provided or performed in Austria, provided that these services and activities are covered by the authorisation granted to the investment firm or CRR-credit institution in its home Member State. Ancillary services may be provided only in conjunction with an investment service or activity. With the exception of the permissible obligations

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 33 / 126 in accordance with para. 5 no further requirements shall be allowed to the made with regard to the establishment and operation of a branch in the areas addressed in this Federal Act or in Directive 2014/65/EU. (2) The establishment of a branch in Austria or the making use of a tied agent that is established in another Member State than Austria or in another Member State than the one in which the investment firm has established a branch, presupposes that the competent authority of the home Member State has submitted all the information pursuant to Article 20 para. 1 and 7 to the FMA. (3) Following receipt of a notification by the FMA pursuant to para. 2 or in the case of the FMA not issuing any such notification at latest two months from the date of the notification by the competent authority of the home Member State, the branch may commence its activities or amendments as defined in Article 20 para. 7 may be made. (4) Equally, any CRR-credit institution that wishes to make use of a tied agent for the provision of investment services or performing of investment activities and ancillary services in accordance with this Federal Act and Directive 2014/65/EU that is situated in another Member State other than its home Member State, shall be authorised to do so, once the information listed in Article 20 para. 1 have been submitted by the competent authority in the home Member State to the FMA as the competent authority designated as the point of contact in the host Member State pursuant to Article 79 (1) of Directive 2014/65/EU. (5) Investment firms conducting activities in Austria through a branch shall be required to comply with provisions set out in Articles 47 to 67, 69 and 70 of this Federal Act, Articles 36 and 44 to 70 of Commission Delegated Regulation (EU) 2017/565, Articles 14 to 26 of Regulation (EU) No 600/2014, Articles 34 to 38 and 41 BWG and Article 52 ESAEG as well as administrative decisions and Regulations adopted on the basis of these provisions. The FMA shall be responsible for ensuring that the branch in providing its services in Austria complies with the obligations set out in Articles 24, 25, 27 and 28 of Directive 2014/65/EU and Articles 14 to 26 of Regulation (EU) No 600/2014 as well as measures adopted by the host Member State in accordance with the aforementioned provisions, provided that such actions are permissible pursuant to Article 24 (12) of Directive 2014/65/EU. The FMA shall have the right to check the measures taken by the branch as well as to request that amendments are made to them that are mandatory to enable it to monitor compliance with the obligations set out in Articles 24, 25, 27 and 28 of Directive 2014/65/EU and Articles 14 to 26 of Regulation (EU) No 600/2014 as well as measures adopted in relation to services and activities of the branch in Austria. (6) The tied agent may commence their activities following acknowledgement of receipt of a notification pursuant to para. 2 by the FMA or in the event of such a notification not being made at latest two months from the date of transmission of the notification by the competent authority of the home Member State. The tied agent shall be subject to the provisions in this Federal Act that apply to branches. (7) The competent authority of the home Member State of an investment firm, which is authorised in another Member State and has established a branch in Austria, shall be allowed in the performing

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 34 / 126 of its duties and following an instruction by the FMA as the competent authority of the host Member State may conduct on-site investigations in this branch. Establishment of a Branch in a Member State Article 20. (1) Any investment firm wishing to establish a branch within the territory of another Member State than Austria or to make of use of tied agents that are established in another Member State than Austria, in which the investment firm has not established a branch, must inform the FMA of this intention and submit the following information to the FMA:

1. the Member States, in the territory of which the establishment of a branch is planned, or the Member States in which the investment firm has not established a branch, but in which it proposes to make use of tied agents that are established in those countries;
2. a business plan, from which it is possible inter alia to determine the type of investment services or activities as well as ancillary services that are to be offered;
3. as applicable the organisational structure of the branch with explanations and informing about whether the branch intends to use tied agents, as well as the names of these tied agents;
4. in the case that tied agents are intended to be used in a Member State in which an investment firm has not established a branch, a description of the proposed deployment of these agents and the organisational structure, also including reporting lines, from which it is possible to determine how the agents fit into the investment firm's organisational structure;
5. the address in the host Member State from which documents may be obtained;
6. the names of those responsible for the management of the branch or the tied agent. (2) If an investment firm used a tied agent located in a Member State other than Austria, such a tied agent shall be assimilated to the branch, provided one has been established, and shall be subject in any case to the provisions of Directive 2014/65/EU relating to branches. (3) Provided that the FMA does not have any reasons to doubt the adequacy of the administrative structures or the financial situation of the investment firm with regard to its planned activities, it shall forward the information pursuant to para. 1 within three months of receiving all the information to the competent authority of the host Member State designated as contact point in accordance with Article 79 (1) of Directive 2014/65/EU and shall notify the relevant investment firm of this. (4) In addition to the information pursuant to para. 1, the FMA shall also provide the competent authority of the host Member State with precise information about the accredited compensation scheme of which the investment firm is a member. In the event of there being any amendment to such information, the FMA shall notify the competent authority of the host Member State of this amendment. (5) If the FMA declines to transmit the information to the competent authority in the host Member State, it shall be required to inform the investment firm of the reasons for doing so within three months of receipt of all the information.

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 35 / 126 (6) Any credit institution wishing to make use of a tied agent for the provision of investment services or performing of investment activities and ancillary services in accordance with this Federal Act and Directive 2014/65/EU, where the tied agent is located in a Member State other than Austria, shall notify the FMA of this being the case, and provided that no branch was established in the Member State, shall submit the information listed in para. 1 to the FMA. Provided that the FMA does not have any reasons to doubt the adequacy of the administrative structures or the financial situation of the credit institution, it shall forward the information within three months of receiving all the information to the competent authority of the host Member State designated as contact point in accordance with Article 79 (1) of Directive 2014/65/EU and shall notify the relevant credit institution of this. If the FMA declines to transmit the information to the competent authority in the host Member State, it shall be required to inform the credit institution in question of the reasons for doing so within three months of receipt of all the information. (7) In the event of any amendment to the information submitted in accordance with para. 1 the investment firm shall notify the FMA in writing about this amendment at least one month prior to the amendment being performed. The competent authority of the host Member State must be informed by the FMA about this amendment. SECTION 3: PROVISION OF INVESTMENT SERVICES AND ACTIVITIES BY THIRD COUNTRY FIRMS Establishment of a Branch Article 21. (1) A third country firm, that proposes to provide investment services or perform investment activities with or without ancillary activities in Austria for retails clients or for professional clients as defined in Annex II Section 2 of Directive 2014/65/EU, must establish a branch in Austria. (2) The third country firm that intends to provide investment services or activities, with or without ancillary activities, must seek prior authorisation from the FMA to do so. This presupposes that:

1. the provision of the services, for which the third country firm is applying for an authorisation for, is subject to authorisation and supervision in the third country, in which the firm is established, and the firm applying has been authorised in an orderly manner, with the competent authority having taken the FATF Recommendations on the Combatting of Money Laundering and Terrorist Financing into consideration to an appropriate extent;
2. Memoranda of Understanding (MoUs) exist between the FMA as the competent authority in the Member State, in which the branch is intended to be established, and the competent supervisory authorities in the third country, in which the firm is established, in which provisions are contained that regulation the exchange of information, in order to preserve the integrity of the market and to protect investors;
3. the branch has an adequate amount of freely available initial capital;

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 36 / 126 4. one or several persons have been appointed to manage the branch, and they fulfil the requirements set out in Directive 2014/65/EU; 5. the third country, in which the third country firm is established, has signed a corresponding agreement with Austria; this agreement shall fully comply with the standards set out in Article 26 of the OECD Model Tax Convention on Income and Capital to avoid double taxation and guarantees an effective exchange of information in taxation issues, including even multilateral tax agreements; 6. the firm is a member of an investor-compensation scheme that has been authorised or recognised in accordance with Directive 97/9/EC. (3) The third country firm shall submit its application to the FMA in the latter's capacity as the competent authority in the Member State in which the third country firm intends to establish a branch. Obligation to provide information Article 22. A third country firm which seeks an authorisation to provide investment services or performing investment activities with or without ancillary services in Austria through a branch, shall first submit the following information to the FMA:

1. the name of the authority responsible for its supervision in the third country concerned. In the event that more than one authority is responsible for supervision, the details of the respective areas of competence shall be provided;
2. all relevant details of the firm (name, legal form, registered office and address, members of the management body, relevant shareholders) and a programme of operations setting out the investment services and/or activities as well as the ancillary services to be provided and the organisational structure of the branch, including a description of any outsourcing to third parties of essential operating functions;
3. the name of the persons responsible for the management of the branch and the relevant documents to demonstrate compliance with requirements laid down in Article 9(1) of Directive 2014/65/EU;
4. information about the initial capital at free disposal of the branch. Granting of the authorisation Article 23. (1) The FMA shall only grant the third-country firm an authorisation, if it is satisfied that:
5. the conditions set out in Article 21 are fulfilled, and
6. the branch of the third-country firm shall be able to comply with the provisions referred to in paras. 2 and 6. The FMA shall inform the third-country firm, within six months of submission of a complete application, whether or not an authorisation has been granted.

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 37 / 126 (2) The branch of the third-country firm authorised in accordance with para. 1, shall comply with the obligations laid down in Articles 29 to 34, 38 to 64, Article 65 para. 1 and Article 68 of the Federal Act, Articles 75 and 77 to 81 BörseG, of Articles 3, 21 to 76 and 80 to 82 of Commission Delegated Regulation (EU) 2017/565 and Articles 3 to 26 of Regulation (EU) No 600/2014 and the measures adopted pursuant thereto. (3) Third-country firms shall allow the observance of the provisions listed in para. 2 to be reviewed by the statutory auditor. An audit report shall be drawn about the findings of such an audit, which shall be explained, if required. This report is to be submitted to the FMA by the third-country firms within six months from the end of the financial year. (4) The audit report pursuant to para. 3 is to be drawn up in a timely managed and to be submitted to the managers of the third-country firm in Austrian, so that the deadline for submission stated in para. 3 may be observed. Information pursuant to para. 3 shall be prepared in German. (5) The FMA shall submit a list of branches of third-country firms active in Austria to ESMA annually. (6) The branch of the third-country firm authorised pursuant to para. 1 shall submit the following details to the FMA annually:

1. the scale and scope of the services provided and activities conducted by the branch in Austria;
2. for third-country firms that conduct trading on own account pursuant to Article 1 no. 3 lit. c, their monthly minimum, average and maximum exposure towards EU counterparties;
3. for third-country firms that provide one of the services listed in Article 1 no. 3 lit. f, the total value of financial instruments originating from EU counterparties underwritten or placed on a firm commitment basis over the previous 12 months;
4. the turnover and the aggregated value of the assets corresponding to the services and activities referred to in no. 1;
5. a detailed description of the investor protection arrangements available to the clients of the branch, including the rights of those clients resulting from the investor￾compensation scheme pursuant to Article 21 para. 2 no. 6;
6. the risk management policy and arrangements applied by the branch for the services and activities referred to in no. 1;
7. the governance arrangements and key function holders for the activities of the branch;
8. any other information considered necessary by the FMA to enable comprehensive monitoring of the activities of the branch. (7) The FMA submit the following information to ESMA at the latter’s request:
9. all the authorisations for branches authorised pursuant to para. 1 and any subsequent changes to such authorisations;
10. the scale and scope of the services and activities conducted by an authorised branch in Austria;
11. the turnover and total assets corresponding to the services and activities referred to in no. 2;
12. the name of the third-country group to which an authorised branch belongs.

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 38 / 126 (8) The FMA shall cooperate closely with the competent authorities of entities that are part of the same group to which the branches of third-country firms authorised pursuant to para. 1 belong, as well as with ESMA and EBA to ensure that all authorities of that group in the European Union are subject to comprehensive, consistent, and effective supervision in accordance with this Federal Act, Directive 2014/65/EU, Regulation (EU) No 575/2013, Regulation (EU) No 600/2014, Regulation (EU) 2019/2033, Directive 2013/36/EU and Directive (EU) 2019/2034. Provision of services at the exclusive initiative of the client Article 24. (1) Where a retail client or professional client within the meaning of Section II of Annex II of Directive 2014/65/EU established or situated in Austria exclusively initiates at its own initiative the provision of an investment service or activity by a third-country firm, the requirement for authorisation pursuant to Article 21 shall not apply to the provision of such services or the performance of such an investment activity by the third country firm that are directly related to the provision of such services or the performance of such investment activities. (2) Where a third-country firm or an entity acting on its behalf or having close links with that third￾country firm or any other person acting on behalf of that entity actively solicits clients or potential clients in Austria, it shall not be deemed to by a service provided exclusively at the initiative of this client; this shall apply irrespective of intragroup relationships. (3) An initiative by a client listed in para. 1 shall not entitle the third-country firm to market new categories of investment products or investment services to that client through other means than through the branch. Withdrawal of the authorisation Article 25. The FMA, which granted an authorisation pursuant to Article 23 may withdraw the authorisation issued to the third country firm where this third country firm

1. does not make use of the authorisation within 12 months of it being granted, or expressly renounces the authorisation or in the case that it has not provided any investment services or performed any investment activities in the preceding six months;
2. has obtained the authorisation by making false statements or by any other irregular means;
3. no longer fulfils the conditions under which authorisation was granted;
4. has seriously and systematically infringed the provisions adopted pursuant to this Federal Act or Directive 2014/65/EU governing the operating conditions for investment firms and applicable to third-country firms, or
5. falls within any of the cases where other regulations, in respect of matters outside the scope of this Federal Act or Directive 2014/65/EU, provide for withdrawal.

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 39 / 126 CHAPTER 2: ORGANISATIONAL REQUIREMENTS SECTION 1: ORGANISATION Legal entities Article 26. (1) Legal entities for the purpose of this chapter are credit institutions, investment firms, investment services providers, insurance undertakings in accordance with Article 2 para. 2, management companies and AIFMs in accordance with Article 2 para. 3 as well as branches of investment firms in accordance with Article 19 para. 5, of third country firms in accordance with Article 23 para. 2 and of credit institutions in accordance with Article 9 para. 7 BWG from Member States. (2) The following provisions shall not apply to investment services providers:

1. the requirement to have an independent compliance function pursuant to Article 22 of Commission Delegated Regulation (EU) 2017/565;
2. the requirement to have an independent risk management function pursuant to Article 23 of Commission Delegated Regulation (EU) 2017/565; and
3. the requirement to have a separate independent risk management function pursuant to Article 24 of Commission Delegated Regulation (EU) 2017/565. (3) In the case of credit institutions that in accordance with the provisions set out in the BWG have an adequately independent risk management function and have an internal audit function, the duties listed in Articles 23 and 24 of Commission Delegated Regulation (EU) 2017/565 may be performed by the relevant organisational unit. Algorithmic trading Article 27. (1) A legal entity that engages in algorithmic trading shall have in place effective systems and risk controls suitable for the business it operates to ensure that its trading systems are resilient in accordance with the requirements set forth in Chapter II of Regulation (EU) 2022/2554 and have sufficient capacity. In particular, it shall ensure that:
4. its systems are subject to appropriate trading thresholds and trading limits;
5. the sending of erroneous orders or the systems otherwise functioning in a way are prevented that may create or contribute to a disorderly market;
6. the trading systems cannot not be used for a purpose that is contrary to Regulation (EU) No 596/2014 or the rules of the trading venue to which it is connected;
7. it shall have in place effective business continuity arrangements, including an ICT business continuity policy and plans as well as ICT response and recovery plans pursuant to Article 11 of Regulation (EU) 2022/2554, to deal with any failure of its trading systems; and

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 40 / 126 5. its systems are fully tested and properly monitored, so that the general requirements determined in this paragraph as well as the specific requirements determined in Chapters II and IV of Regulation (EU) 2022/2554 are met. (2) An investment firm that engages in algorithmic trading in a Member State shall notify this to the FMA and the competent authority of the trading venue at which the investment firm engages in algorithmic trading as a member or participant. The FMA may prescribe that the following information should be submitted either on a regular or an ad-hoc basis:

1. a description of the nature of its algorithmic trading strategies,
2. details about the trading parameters or limits to which the system is subject,
3. the key compliance and risk controls that it has in place to ensure the conditions laid down in para. 1 are satisfied, and
4. details about the testing of its systems. The FMA may also determine by means of a Regulation the information to be submitted on a regular basis in accordance with this provision. The FMA may request additional information at any time from the legal entity in relation to its algorithmic trading activities as well as the systems used for such trading. (3) The FMA shall upon request from the competent authority of the trading venue in another Member State, in which a legal entity is engaged in algorithmic trading as a member or participant, communicate the information listed in para. 2 that it receives from the legal entity conducting algorithmic trading. (4) The legal entity shall ensure that the records in relation to the matters referred to in paras. 1 to 3 are kept, and shall ensure that they are sufficient to allow the FMA to check compliance with the requirements set out in this Federal Act. (5) A legal entity that engages in a high-frequency algorithmic trading technique, shall store in an approved form accurate and time sequenced records of all its placed orders, including cancellations of orders, executed orders and quotations on trading venues and shall make them available to the FMA upon the latter's request. (6) Any legal entity that engages in algorithmic trading to pursue a market making strategy shall, taking into account the liquidity, scale and nature of the specific market and the characteristics of the instrument traded, shall fulfil the following requirements:
5. the legal entity must carry out this market making continuously during a specified proportion of the trading venue’s trading hours, except under exceptional circumstances, with the result of providing liquidity on a regular and predictable basis to the trading venue;
6. the legal entity must conclude a binding written agreement with the trading venue which shall at least specify the obligations of the legal entity in accordance with no. 1; and
7. the legal entity must have in place effective systems and controls to ensure that it fulfils its obligations under the agreement referred to in no. 2 at all times. (7) For the purposes of this provision it shall be assumed that a legal entity that engages in algorithmic trading shall be considered to be pursuing a market making strategy if, as a member or

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 41 / 126 participant at the trading venue, its strategy, when dealing on own account, involves posting firm, simultaneous two-way quotes of comparable size and at competitive prices relating to one or more financial instruments at an individual trading venue or at multiple trading venues, with the result of providing liquidity on a regular and frequent basis to the overall market. Direct electronic access Article 28. (1) A legal entity that provides direct electronic access to a trading venue shall have in place effective systems and controls which ensure a proper assessment and review of the suitability of clients using the service. Direct electronic access without such controls is prohibited. The legal entity shall in particular ensure that:

1. clients are prevented from exceeding appropriate pre-set trading and credit thresholds,
2. trading by clients is properly monitored,
3. appropriate risk controls prevent trading that may create risks to the legal entity itself or that could create or contribute to a disorderly market or could be contrary to Regulation (EU) No 596/2014 or the rules of the trading venue,
4. clients using the service comply with the requirements for clients set out in this Federal Act as well as the rules of the trading venue,
5. the legal entity shall monitor the transactions in order to identify infringements of those rules, disorderly trading conditions or conduct that may involve market abuse and that is to be reported to the FMA,
6. there is a binding written agreement between the legal entity and the client regarding the essential rights and obligations arising from the provision of the service, and
7. that responsibility under this Federal Act is retained by the legal entity in accordance with the agreement pursuant to no. 6. (2) A legal entity that provides direct electronic access to a trading venue shall notify the FMA about this. Any legal entity providing direct electronic access at a trading venue in another Member State, shall in addition be required to notify the competent authority of the other Member State in question accordingly. (3) The FMA may require a legal entity providing a direct electronic access, to provide, on a regular or ad-hoc basis, a description of the systems or controls referred to in para. 1 and evidence that those have been applied. (4) At the request of a competent authority of the trading venue in another Member State, to which the legal entity provides direct electronic access, the FMA shall communicate the information listed in para. 3 with delay that it receives from the legal entity. (5) The legal entity shall ensure that the records are kept in relation to the matters referred to in paras. 1 to 4, and shall ensure that they are adequate to allow the FMA to check compliance with the requirements set out in this Federal Act.

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 42 / 126 (6) A legal entity that acts as a general clearing member for other persons shall have in place effective systems and controls to ensure clearing services are only applied to persons who are suitable and meet clear criteria and that appropriate requirements are imposed on those persons to reduce risks to the investment firm and to the market. The legal entity shall ensure that there is a binding written agreement between the investment firm and the person regarding the essential rights and obligations arising from the provision of that service. General organisational requirements Article 29. (1) A legal entity shall establish adequate policies and procedures to ensure that the legal entity, its managers, employees, and tied agents comply with the obligations set out in this Federal Act as well as the organisational requirements and operating conditions set out in Chapter II and Chapter III of Delegated Regulation (EU) 2017/565 ("Compliance"). (2) A legal entity shall take permanently effective organisational and administrative precautions as appropriate measures for preventing the interests of clients from being compromised by conflicts of interest pursuant to Article 45. (3) The measures, procedures and precautions listed in para. 2 as well as in Articles 30 and 31 shall not affect all other requirements stipulated in this Federal Act and Regulation (EU) No 600/2014, including requirements relating to disclosure, suitability or appropriateness, identification and management of conflicts of interests, and benefits. (4) A legal entity shall take reasonable steps to ensure continuity and regularity in the performance of investment services and activities. For this purpose, the legal entity shall establish appropriate and proportionate systems, including information and communication technology (ICT) systems established and managed pursuant to Article 7 of Regulation (EU) 2022/2554, as well as appropriate and proportionate resources and procedures. (5) A legal entity that is authorised to provide investment services pursuant to Article 1 no. 3 lit. b or c or to provide banking transactions pursuant to Article 1 para. 1 nos. 7 and 7a BWG, shall take measures pursuant to Article 6 (2) of Regulation (EU) No 909/2014 on improving securities settlement in the European Union and on central securities depositories and amending Directives 98/26/EC and 2014/65/EU and Regulation (EU) No 236/2012, in order to limit the number of failed settlements. (6) Regardless of the FMA's possibility to request access to communications in accordance with this Federal Act and Regulation (EU) No 600/2014, a legal entity shall be required to have sound safeguarding mechanisms in accordance with the requirements set out on Regulation (EU) 2022/2554 in place to guarantee the security and authentication of the means of transfer of information, minimise the risk of data corruption and unauthorised access and to prevent information leakage maintaining the confidentiality of the data at all times.

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 43 / 126 Product governance obligations for legal entities manufacturing financial instruments Article 30. (1) A legal entity, that manufactures financial instruments (manufacturer) which also includes creation, development, issuance and design of financial instruments, shall comply with the following requirements in such a such as is appropriate and proportionate in taking into consideration the type of the financial instrument, the investment service and the target market of the product. (2) A manufacturer that manufactures financial instruments for selling to clients, shall maintain, operate and review a procedure for the approval of every individual financial instrument as well as any significant adaptation of existing financial instruments, prior to the financial instrument being marketed or distributed to clients. (3) The manufacturer shall establish, implement and maintain procedures and measures to ensure the manufacturing of financial instruments complies with the requirements on proper management of conflicts of interest, including remuneration. The manufacturer shall ensure in particular that the design of the financial instrument, including its features, does not adversely affect end clients or does not lead to problems with market integrity, so that the design allows the manufacturer to mitigate or dispose of its own risks or exposure to the underlying assets of the product, where the manufacturer already holds the underlying assets on own account. (4) The manufacturer shall analyse potential conflicts of interest in the manufacturing of a financial instrument. In particular, the manufacturer shall assess whether the financial instrument creates a situation where end clients may be adversely affected if they take:

1. an exposure opposite to the one previously held by the manufacturer itself; or
2. an exposure opposite to the one that the manufacturer wants to hold after the sale of the product. (5) The manufacture shall check whether the financial instrument may represent a threat to the orderly functioning or to the stability of financial markets before it decides to proceed with the launch of the product. (6) The manufacturer shall ensure that relevant staff involved in the manufacturing of financial instruments possess the necessary expertise to understand the characteristics and risks of the financial instruments they intend to manufacture. (7) The manufacturer shall ensure that the management body has effective control over the manufacturer's product governance process. The manufacturer shall ensure that the compliance reports to the management also systematically include information about the financial instruments manufactured by the manufacturer, including information on the distribution strategy. The manufacturer shall make these reports available to the FMA at the latter's request. (8) The manufacturer shall ensure that the compliance function monitors the development and periodic review of product governance arrangements, in order to detect any risk of failure by the manufacturer to comply with the obligations set out in this Article.

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 44 / 126 (9) The manufacturer shall, in the case of collaboration in the creation, development, issuance and design of a product, in particular with entities that are not authorised and supervised in accordance with Directive 2014/65/EU or third-country legal entities, outline their respective responsibilities. (10) In the product approval procedure pursuant to para. 2, a manufacturer shall define a specific target market for end clients within the respective client classification for every financial instrument and shall ensure that all relevant risks for this specific target market are assessed, and that the intended distribution strategy corresponds to the specific target market. (11) The manufacturer shall identify at a sufficiently granular level the potential target market for each financial instrument and specify the types of client for whose needs, characteristics and objectives, including any sustainability-related objectives, the financial instrument is compatible. As part of this process, the manufacturer shall identify any groups of clients for whose needs, characteristics and objectives the financial instrument is not compatible, unless sustainability factors are taken into account in the financial instruments concerned. In addition, the manufacturer shall ensure that all relevant risks for this specific target market are assessed, and that the intended distribution strategy corresponds to the specific target market. Where legal entities collaborate to manufacture a financial instrument only one target market needs to be identified. (12) A manufacturer manufacturing financial instruments that are distributed through other investment firms shall determine the needs and characteristics of clients for whom the product is compatible based on their theoretical knowledge of and past experience with the financial instrument or similar financial instruments, the financial markets and the needs, characteristics and objectives of potential end clients. (13) The manufacturer shall undertake a scenario analysis of its financial instruments which shall assess the risks of poor outcomes for end clients posed by the product and in which circumstances these outcomes may occur. The manufacturer shall assess the financial instrument under negative conditions, and shall in particular analyse what will happen, if

1. the market environment deteriorates;
2. the manufacturer or a third party involved in manufacturing or functioning of the financial instrument experiences financial difficulties or another counterparty risk materialises;
3. the financial instrument fails to become commercially viable; or
4. demand for the financial instrument is much higher than anticipated, putting a strain on the manufacturer's resources and/or on the market of the underlying instrument. (14) The manufacturer shall determine whether a financial instrument corresponds to the identified needs, characteristics and objectives, in particular by examining whether the following elements are met:
5. the financial instrument's risk/reward profile is consistent with the target market;
6. any sustainability factors of the financial instrument are consistent with the target market;
7. financial instrument design is driven by features that benefit the client and not by a business model that relies on poor client outcomes to be profitable.

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 45 / 126 (15) The manufacturer shall review the charging structure proposed for the financial instrument, by in particular examining whether:

1. the financial instrument's costs and charges are compatible with the needs, objectives and characteristics of the target market;
2. the fees do not undermine the financial instrument's expected returns, which is particular the case, where the costs or charges equal, exceed or remove almost all the expected tax advantages linked to a financial instrument; or
3. the fee structure of the financial instrument is appropriately transparent for the target market, such as that it does not disguise fees und is not too complex to be understandable. (16) The manufacturer shall ensure that the provision of information about a financial instrument to distributors includes information about the appropriate channels for distribution of the financial instrument, the product approval process and the target market assessment and is of an adequate standard to enable distributors to understand and recommend or sell the financial instrument properly. (16a) the manufacturer shall describe the financial instrument’s sustainability facts in a transparent manner and provide distributors with the relevant information to duly consider any sustainability￾related objectives of the client or potential client. (17) A manufacturer shall review the financial instruments it manufactures on a regular basis, taking into account any event that could materially affect the potential risk to the identified target market. The manufacturer shall check whether the financial instrument remains consistent with the needs, characteristics and objectives of the target market and if it is being distributed to the target market, or is reaching clients for whose needs, characteristics and objectives, including any sustainability￾related objectives, the financial instrument is not compatible. (18) A manufacturer shall review financial instruments prior to any further issue or re-launch, if it is aware of any event that could materially affect the potential risk to investors and at regular intervals to assess whether the financial instruments function as intended. The manufacturer shall determine at what intervals it shall review its financial instruments based on relevant factors, in particular including factors linked to the complexity or the innovative nature of the investment strategies pursued. The manufacturer shall also identify crucial events that would affect the potential risk or return expectations of the financial instrument, in particular
4. the crossing of a threshold that will affect the return profile of the financial instrument; or
5. the solvency of certain issuers whose securities or guarantees may impact the performance of the financial instrument. (19) The manufacturer shall take appropriate measures where events defined in para. 18 occur, in particular:
6. to provide any relevant information on the event and its consequences on the financial instrument to the clients or the distributors of the financial instrument if the manufacturer does not offer or sell the financial instrument directly to the clients;
7. to modify the product approval process;

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 46 / 126 3. to stop the further issuance of the financial instrument; 4. to modify the contractual conditions of the financial instrument; 5. to check whether the channels through which the financial instruments are sold are appropriate, in the event that the manufacturer becomes aware that the financial instrument is not being sold as envisaged; 6. to contact the distributor to discuss a modification of the distribution process; 7. the end the relationship with the distributor; 8. to inform the FMA without delay. Product governance obligations for distributors Article 31. (1) The legal entity, when deciding about the range of financial instruments issued by it or by other legal entities, and services it intends to offer or recommend to clients, shall comply with the following requirements in such a way that is appropriate and proportionate, taking into account the nature of the financial instrument, the investment service and the target market for the product. (2) A legal entity shall also comply with the requirements set out in this Federal Act, when offering or recommending financial instruments that were manufactured by entities that are not subject to Directive 2014/65/EU. As part of this process the legal entity shall have in place effective arrangements to ensure that it obtains sufficient information pursuant to Article 30 para. 16 about the financial instruments. The legal entity shall determine the target market for the respective financial instrument, even where the target market was not defined by the manufacturer. (3) The legal entity shall have in place adequate product governance arrangements to ensure that products and services that it intends to offer or recommend are compatible with the needs, characteristics, and objectives, including any sustainability-related objectives, of an identified target market and that the intended distribution strategy is consistent with the identified target market. The legal entity shall appropriately identify and assess the circumstances and needs in an appropriate manner of the clients it intends to focus on, so as to ensure that clients' interests are not compromised as a result of commercial or financial pressure. As part of this process, the legal entity shall identify any groups of clients for whose needs, characteristics and objectives the product or service is not compatible, unless sustainability factors are considered for the financial instruments concerned. (4) The legal entity shall obtain information from manufacturers that are subject to Directive 2014/65/EU in order to gain the necessary understanding and knowledge of the products it intends to recommend or sell in order to ensure that these products will be distributed in accordance with the needs, characteristics and objectives of the identified target market. (5) The legal entity shall take all reasonable steps to ensure it also obtains adequate and reliable information from manufacturers not subject to Directive 2014/65/EU to ensure that products will be distributed in accordance with the characteristics, objectives and needs of the target market. Where relevant information is not publicly available, the distributor shall take all reasonable steps to obtain

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 47 / 126 such relevant information from the manufacturer or its agent. Acceptable publicly available information is information which is clear, reliable and produced to meet regulatory requirements, such as disclosure requirements pursuant to Directive 2003/71/EC or Directive 2004/109/EC. This obligation is relevant for products sold on primary and secondary markets and shall apply in a proportionate manner, depending on the degree to which publicly available information is obtainable and the complexity of the product. (6) The legal entity shall identify the target market and distribution strategy on the basis of the information obtained from manufacturers and information on their own clients. When a legal entity acts both as a manufacturer and a distributor, only one target market assessment shall be required. (7) The legal entity shall when deciding the range of financial instrument and services that it wishes to offer or recommend and the respective target markets, to maintain procedures and measures to ensure compliance with all applicable requirements in accordance with this Federal Act including those relating to disclosure, assessment of suitability or appropriateness, benefits and proper management of conflicts of interest. In this context, particular care is to be taken when distributors intend to offer or recommend new products or there are alterations to the services they provide. (8) The legal entity shall periodically review and update its product governance arrangements in order to ensure that they remain robust and fit for purpose, and take appropriate actions where necessary. (9) The legal entity shall review the investment products it offers or recommends and the services it provides on a regular basis, taking into account any event that could materially affect the potential risk to the identified target market. The legal entity shall assess at least whether the product or service remains consistent with the needs, characteristics and objectives, including any sustainability-related objectives, of the identified target market and whether the intended distribution strategy remains appropriate. The legal entity shall review the target market again and update the product governance arrangements if it becomes aware that it has wrongly identified the target market for a specific product or service or that the product or service no longer meets the circumstances of the identified target market, such as where the product becomes illiquid or very volatile due to market changes. (10) The legal entity shall ensure that its compliance function monitors the development and periodic review of product governance arrangements, in order to detect any risk of failure by the manufacturer to comply with the obligations set out in this provision. (11) The legal entity shall ensure that relevant staff possess the necessary expertise to understand the characteristics and risks of the products that it intends to offer or recommend and the services provided as well as the needs, characteristics and objectives of the identified target market. (12) The legal entity shall ensure that the management has effective control over the firm's product governance process to determine the range of investment products that the legal entity offers or recommends and the services it provides to the respective target markets. The legal entity shall ensure that the compliance reports to the management also systematically include information

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 48 / 126 about the products offered and recommended by the legal entity and the services provided. The compliance reports shall be made available to the FMA upon request. (13) The distributors shall provide the manufacturers with information on sales and, where appropriate, information on the aforementioned reviews, in order to support the product reviews carried out by the manufacturers. (14) Where different legal entities work together in the distribution of a product or service, the legal entity with the direct client relationship shall bear ultimate responsibility for ensuring compliance with the product governance obligations set out in this provision. The intermediate legal entities shall however be obliged:

1. ensure that relevant product information is passed from the manufacturer to the final distributor in the chain;
2. if the manufacturer requires information on product sales in order to comply with their own product governance obligations, enable them to obtain it; and
3. apply the product governance obligations for manufacturers, as relevant, in relation to the service they provide. Exception from product governance requirements Article 31a. Legal entities shall be exempted from the product governance requirements determined in Articles 30, 31 and Article 47 paras. 2 and 3 of this Federal Act, provided that the investment service that they provide relates to bonds, that do not include any other embedded derivatives as a make-whole clause, or where the financial instruments are exclusively marketed or distributed to suitable counterparties. Risk management and internal audit Article 32. A legal entity shall be required to have sound administrative and accounting procedures, internal control mechanisms, and effective procedures for risk assessment. Obligation to keep records Article 33. (1) A legal entity shall be required to keep records about all its services, activities and transactions, on the basis of which the FMA is able to fulfil its supervisory obligations, and to take the implementing measures set out in this Federal Act, the BörseG 2018, in Regulation (EU) No 600/2014 and in Regulation (EU) No 596/2014 and may above all ascertain whether the legal entity has complied with all obligations, including those towards its clients or potential clients as well as with regard to ensuring market integrity. (2) The records pursuant to para. 1 shall include the recording of telephone calls and electronic communication at least in relation to transactions conducted in relation to trading on own account and the provision of services that relate to the receiving, transmitting and execution of client orders.

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 49 / 126 (3) Telephone calls and electronic communications pursuant to para. 2 shall also include those made in which the transactions falling under trading on own account or the provision of services are intended to be conducted, that relate to the receiving, transmitting and execution of client orders, even in the case that such calls and communications do not lead to such transactions being concluded or such services being provided. (4) A legal entity shall take all appropriate measures for the purposes set out in paras. 2 and 3, to record relevant telephone calls and electronic communications, that are creating using devices, or sent or received from devices that the legal entity has provided to an employee or a self-employed staff member or whose usage has been approved or permitted by an employee or a self-employed staff member of the legal entity. (5) A legal entity shall be required to inform new and existing clients that telephone calls or electronic communications between the legal entity and its clients, that lead or could lead to transactions, are recorded. It is sufficient to inform new and existing clients of this being the case prior to the provision of investment services, but at least once a year. (6) It is not permitted for a legal entity that has not informed its customers in advance about the recording of telephone calls and electronic communications to provide investment services for them by telephone or to perform investment activities by telephone, where such investment services and activities relate to receiving, transmitting and execution of client orders. (7) Clients may place their orders via other channels, but such communications must be conducted using a durable medium, such as e-mail, fax or records drawn up during a meeting about client orders. In particular the content of relevant personal conversations shall be allowed to be recorded by means of written minutes or notes. Such instructions shall be considered as comparable to orders given over the phone. (8) A legal entity shall take all appropriate measures for the purposes to prevent that an employee or a self-employed staff member makes telephone calls or sends or receives electronic communications using private devices, which the legal entity is unable to record or copy. (9) A legal entity shall make the recordings stored pursuant to paras. 2 to 8 available to the client they concern free of charge upon the client’s request, and shall store such recordings for five years. The FMA may instruct that longer retention periods are to be observed by means of a Regulation once the necessity and proportionality of doing so has been reviewed, where doing so in light of the particular circumstances for specific types of legal entities is necessary for evidence purposes. The retention periods shall not be allowed to exceed seven years. (10) The FMA shall be responsible to monitor compliance with paras. 1 to 9 in relation to transactions performed by the Austrian branches of investment firm and credit institutions with their registered office in a Member State or a third country. The possibility of the competent supervisory authority of the legal entity's home Member State having direct access to such records shall remain unaffected.

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 50 / 126 SECTION 2: OUTSOURCING AND THE INVOLVEMENT OF TIED AGENTS AND SECURITIES BROKERS Outsourcing of critical or important operational functions to service providers Article 34. A legal entity shall ensure that when relying on a third party (service provider) for the performance of operational functions which are critical for the continuous and satisfactory provision of services for clients and for the performance of investment activities, that reasonable steps are taken to avoid undue additional operational risks while observing Articles 30 to 32 of Commission Delegated Regulation (EU) 2017/565. The outsourcing of significant operational functions shall not be allowed to be undertaken in such a way that materially impairs the quality of internal control or the ability of the FMA to monitor the firm's compliance with all obligations. Provision of services through another legal entity Article 35. (1) A legal entity that receives an instruction from another legal entity to provide investment services or ancillary service for a client, may rely on client information that has been transmitted by the other legal entity. The legal entity granting the mandate shall bear responsibility for the completeness and correctness of such forwarded client information. (2) The legal entity that receives an instruction pursuant to para. 1 may also rely on recommendations in relation to the service or transaction that have been given to the client by the legal entity. The responsibility for the suitability of recommendations or advice to the client shall be borne by the legal entity that granted the mandate. (3) The responsibility for the provision of the service or conclusion of the transaction on the basis of such information or recommendations in accordance with the relevant provisions of this Federal Act shall be borne by the legal entity that received the instruction. Involvement of tied agents Article 36. (1) A legal entity may appoint tied agents for the purposes of promoting its services, acquiring new business or receiving orders from clients and transmitting them, placing of financial instruments and providing investment advice in respect of such financial instruments and services offered by the legal entity. (2) A legal entity that appoints a tied agent, shall be liable pursuant to Article 1313a of the General Civil Code (ABGB, Allgemeines bürgerliches Gesetzbuch) published in the Collection of Juridical Texts (JGS; Justizgesetzsammlung) no. 946/1811, for any action or omission on the part of the tied agent, where the tied agent is acting on behalf of the legal entity. (3) A legal entity shall monitor the activities of the tied agents that are active on its behalf. The legal entity shall ensure that a tied agent informs the client, when making contact or prior to concluding transactions with clients, in which capacity it is acting and which legal entity it is representing.

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 51 / 126 (4) A legal entity may appoint only tied agents that are entered in the public register in the Member State where they are established. (5) Tied agents working in Austria shall be required to hold a trade authorisation pursuant to Article 136a GewO 1994. They may only be entered into the public register, once it has been verified that they have the necessary personal reliability and the appropriate general commercial and professional knowledge, in order to be able to provide investment services or ancillary services and to transmit all relevant information regarding the service offered correctly to the client or the potential client. The tied agent shall provide the legal entity, at the latter's request, with all evidence required for reviewing that these requirements are satisfied. (6) The public register shall be kept by the FMA and shall be constantly maintained. The credit institutions and investment firms shall register the tied agents without delay and shall be responsible for orderly checking. (6a) The FMA, which keeps the public register pursuant to para. 6 shall be the ESAP collection body pursuant to Article (2) point 2 of Regulation (EU) 2023/2859 for information pursuant to paras. 4 and 6 and shall make this information available in the ESAP. (6b) For the purposes of para. 6a, the information pursuant to paras. 4 and 6 shall be required to meet the following requirements:

1. it is to be submitted in a data extractable format pursuant to Article 2 point 3 of Regulation (EU) 2023/2859 and
2. shall contain the following meta data: a. all names of the tied agent to which the information relates; b. where available, the tied agent’s legal entity identifier (LEI) pursuant to Article 7(4) point b of Regulation (EU) 2023/2859; c. the type of information pursuant to the classification in Article 7(4) point c of Regulation (EU) 2023/2859, and d. a statement about whether the information contains personal data. (7) A legal entity appointing tied agents shall take adequate actions to avoid that the activities conducted by the tied agent that do not require a licence for providing investment services, do not have any negative impact on the activities that the tied agent performs on behalf of the legal entity. (8) Activity as a tied agent shall not constitute an employment relationship under provisions set out in national employment, social or tax laws. (9) Commercial financial advisers working as tied agents shall not be authorised to work concurrently as securities brokers. Involvement of securities brokers Article 37. (1) Investment firms authorised pursuant to Article 3 para. 7 and investment services providers authorised pursuant to Article 4 para. 4 may involve securities brokers for the provision of one or several services pursuant to Article 3 para. 2 nos. 1 and 3 exclusively with regard to financial

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 52 / 126 instruments in accordance pursuant to Article 1 no. 7 lits. a and c, provided that and subject to their authorisation authorising them to do so. (2) The respective investment firm or the respective investment services provider shall in any case be liable for any negligence of the securities brokers, whose services it makes use of for the provision of investment services pursuant to Article 1313a ABGB, irrespective of whether the securities broker discloses to the respective principal or not. (3) In relation to compliance with the provisions of this Federal Act and the other laws and regulations applicable to investment services, but not the provisions of GewO 1994, the conduct of securities brokers shall in any case only be attributable to the respective investment firm or investment services provider itself. (4) Investment firms and investment services providers may only make use of securities brokers that hold the necessary commercial authorisation pursuant to Article 94 no. 77 GewO 1994 in conjunction with Article 136b GewO 1994 or in pursuant to Article 94 no. 75 GewO 1994 in conjunction with Article 136a GewO 1994. (5) Investment firms and investment services providers shall monitor the activities of securities brokers that are active for them. They shall ensure that a securities broker informs the client, when making initial contact or before concluding transactions with the client, in what capacity the securities broker is acting and which investment firm or investment services provider the securities broker is representing. (6) Investment firms and investment services providers may only make use of securities brokers that are entered in a public register. (7) The public register shall be maintained by the FMA. The register shall be constantly maintained. Investment firms or investment services providers shall enter the securities brokers without delay and shall be responsible for orderly checks. (8) Investment firms or investment services providers that make use of securities brokers, shall take appropriate actions to ensure that the activities conducted by the securities broker, that do not require a licence for providing investment services, shall not have any negative impact on the activities that the securities broker performs on behalf of the investment firm or the investment services provider. (9) Performing activities as a securities broker shall not constitute an employment relationship as defined in the provisions contained in Federal Acts relating to employment, social or tax law. (10) Commercial financial advisers working as securities brokers shall not be authorised to work concurrently as tied agents.

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 53 / 126 SECTION 3: SAFEGUARDING OF CLIENT ASSETS Safeguarding of clients’ financial instruments and funds Article 38. (1) A legal entity shall, when holding financial instruments belonging to clients, make adequate arrangements to safeguard clients' ownership rights, especially in the event of the legal entity's insolvency, and shall prevent the use of a client's instruments on own account without the clients' express consent. (2) A legal entity shall, when holding funds belonging to clients, make adequate arrangements to safeguard the clients' rights and, except in the case of credit institutions, prevent the use of clients' funds for its own account. (3) To safeguard the rights of clients to their financial instruments or funds, a legal entity must

1. maintain the required records and accounts that permit them at all times to distinguish the assets held by individual clients without delay from those of other clients and from its own assets;
2. maintain their records and accounts in a way that ensures their accuracy and in particular so that they correspond to the financial instruments and funds held for clients and may also be used as an audit trail;
3. regularly reconcile its internal accounts and records with those of any third parties holding such assets;
4. take necessary measures that are required to ensure that any client financial instruments deposited pursuant to Article 39 with a third party are distinguishable from financial instruments belonging to the legal entity or of the third party by using differently titled accounts on the books of the third party or other comparable measures that ensure the same level of protection;
5. take the necessary measures required to ensure that clients’ funds deposited with a body under Article 40 para. 1 nos. 1 to 4 are held in one or several separate accounts that are held separately from the other accounts in which the legal entity's funds are held; and
6. take adequate organisational precautions to minimise the risk of clients’ assets or the rights associated therewith being lost or diminished as a result of the misuse of assets or due to fraud, poor administration, inadequate record-keeping or negligence. (4) The FMA shall be authorised by way of regulation to determine the details of the measures and precautions defined in para. 3 nos. 1 to 6 where so doing is necessary for the safeguarding of clients’ assets. (5) Security interests, liens or rights of set-off over client financial instruments or funds enabling a third party to dispose of client's financial instruments or funds in order to recover debts that do not relate to the client or provision of services to the client shall not be permitted except where this is required by applicable law in a third country in which the client funds or financial instruments are held.

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 54 / 126 (6) A legal entity shall inform its clients, when it is obliged to enter into agreements that create security rights, liens, or rights of set-off pursuant to para. 5, and shall indicate to its clients the risks associated with such agreements. (7) Where a legal entity grants security interests, liens, or rights or set-off pursuant to para. 5 in relation to client financial instruments or funds, or where the legal entity has been informed that such rights have been granted, then the legal entity shall record these in client contracts and its own accounts, in order to make the ownership status of client assets clear, e.g. in the event of an insolvency. (8) A legal entity shall be required to ensure that information about client financial instruments and funds: the FMA, appointed insolvency practitioners and those responsible for the resolution of insolvent financial institutions. The information to be made available shall in particular include:

1. related internal accounts and records, from which the balances of funds and financial instruments held for each client may be readily identified;
2. where client funds are held by a legal entity pursuant to Article 40, details about the accounts in which client funds are held and about the relevant agreements with those legal entities;
3. where financial instruments are held by a legal entity pursuant to Article 39, details about the accounts opened at third parties as well as the relevant agreements with those third parties;
4. details of third parties, carrying out any related (outsourced) tasks and details of any outsourced tasks;
5. key individuals of the legal entity involved in related processes, including those responsible for oversight of the legal entity's requirements in relation to the safeguarding of client assets; and
6. agreements relevant to establish client ownership over assets. Depositing clients’ financial instruments Article 39. (1) A legal entity may deposit any financial instruments held on behalf of its clients in one or several accounts opened with a third party provided that the legal entity exercises all due skill, care and diligence in the selection, appointment, and periodic review of the third party and of the agreements in regard of the holding and safekeeping of those financial instruments. In particular, the third party’s expertise and market reputation as well as any legal requirements or market practices relating to the holding of such financial instruments and that could adversely affect clients’ rights must be taken into consideration. (2) In the event that a legal entity deposits a client's financial instruments with a third party, the legal entity shall ensure that such financial instruments are only deposited with a third party in a jurisdiction, where the safekeeping of financial instruments for the account of another person is subject to specific regulations and supervision, and that the third party is subject to these specific regulations and supervision.

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 55 / 126 (3) A legal entity may only deposit financial instruments that it holds on behalf of clients with a third party in a third country in which the holding and safekeeping of financial instruments for the account of another person is not regulated, provided that one of the following requirements has been met:

1. the nature of the financial instruments or of the investment services connected with those instruments, requires them to be deposited with a third party in that third country; or
2. the financial instruments are held on behalf of a professional client that requests the legal entity in writing to deposit them with a third party in that third country. (4) Paras. 2 and 3 shall also apply when the third party has delegated any of its functions concerning the holding and safekeeping of financial instruments to another third party. Depositing clients’ funds Article 40. (1) A legal entity shall promptly deposit clients’ funds that it has received into one or more accounts with one of the following bodies:
3. a central bank,
4. a credit institution authorised under Directive 2013/36/EU,
5. a bank that is authorised in a third country, or
6. a qualified money market fund (para. 3). (2) Para. 1 shall not apply to credit institutions that have been authorised under Directive 2013/36/EU to accept deposits as defined therein. (3) A qualified money market fund for the purpose of para. 1 no. 4 is a collective investment undertaking that is either authorised in accordance with Directive 2009/65/EC or that is subject to supervision, and where applicable is authorised by an authority in accordance with the national law of the Member State granting the authorisation and which satisfies all of the following conditions:
7. its primary investment objective shall be to maintain its net asset value, and either constantly at par (net of earnings) or at the value of the investor’s initial capital, plus earnings proceeds;
8. to achieve its primary investment objective, it must invest exclusively in high quality money market instruments with a maturity or residual maturity of no more than 397 days or with regular yield adjustments consistent with such a maturity and with a weighted average maturity of 60 days; to achieve this objective it may also invest in deposits with credit institutions;
9. liquidity is guaranteed through same-day or next day settlement. (4) A money market instrument shall be considered for the purposes of para. 3 no. 2 to be of high quality if the management company conducts its own documented assessment of the credit quality of money market instruments, that allows it to consider a money market instrument as high quality. Where one or more credit rating agencies registered and supervised by ESMA have provided a rating of the instrument, the management company's conducted internal assessment should take into consideration, inter alia, those credit ratings.

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 56 / 126 (5) A legal entity shall, when it does not deposit customer funds with a central bank, exercise all due skill, care and diligence in the selection, appointment and periodic review of the credit institution or money market fund where the funds are placed and the arrangements for the holding of those funds and they shall consider the need for diversification of these funds as part of their due diligence. (6) To safeguard its clients’ rights, a legal entity shall take into account the expertise and market reputation of such institutions or money market funds as well as any legal requirements or market practices that relate to the holding of clients’ funds that may affect clients’ rights. (7) A legal entity shall ensure that clients shall be required to give their explicit consent to the placement of their funds in a qualifying money market fund. The legal entity shall inform its clients that funds placed with a qualifying money market fund will not be held in accordance with the requirements for the safeguarding of client funds set out in this provision. (8) In the case of client funds being deposited with a credit institution or money market fund that belong to the same group as the legal entity, then the funds deposited with such a group entity shall not exceed 20 % of all such funds held by the legal entity. (9) A legal entity shall only be allowed to exceed the limit stated in para. 8, where it is able to demonstrate that that the conditions applicable pursuant to paras. 5 to 7 with regard to the nature, scope and complexity of its business as well as the safety offered by the third parties considered in para. 8, and in any case where the client funds that are held by the legal entity are low are not proportionate. The legal entity shall regularly review the assessment conducted in accordance with this paragraph and shall inform the FMA both of its initial assessment as well as its reviewed assessments. Use of clients’ financial instruments Article 41. (1) A legal entity may only enter into agreements arrangements for securities financing transactions in respect of financial instruments held by them behalf of a client, or otherwise use such financial instruments for its own account or the account of another client of the legal entity, if the following requirements have been met:

1. The client must have given prior express consent to use of the instruments on specified terms, and shall be evidenced in writing and affirmatively executed by signature or equivalent.
2. The use of that clients’ financial instruments must be restricted to the specified terms to which the client consents. (2) A legal entity shall only be allowed to conclude agreements regarding securities financing transactions in respect of financial instruments that are held on behalf of a client in an omnibus account maintained by a third party or to otherwise use financial instruments held in such an account on own account or on account of another client of the legal entity, if in addition to the conditions set out in para. 1 at least one of the following requirements is fulfilled:
3. every client, whose financial instruments are kept in an omnibus account, has explicitly approved this in advance in accordance with para. 1 no. 1;

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 57 / 126 2. the legal entity has systems and control mechanisms available that ensure that only financial instruments of clients, who have given prior express approval in accordance with para. 1 no. 1, shall be used in this way. (3) The records of the legal entity shall be required to include details of the client on whose instructions the use of the financial instruments has been effected, as well as the number of financial instruments used belonging to each client who has given consent, in order to enable any loss to be correctly allocated. (4) A legal entity shall be required to take appropriate measures to prevent the unauthorised use of client financial instruments for their own account or for the account of any other person, in particular:

1. the conclusion of agreements with clients on measures to be taken by the legal entity in case the client does not have enough provision on its account on the settlement date, such as the borrowing of the corresponding securities on behalf of the client or the unwinding of the position;
2. the close monitoring by the legal entity of its projected ability to deliver on the settlement date and the putting in place of remedial measures, that it is unable to deliver;
3. the close monitoring and prompt requesting of undelivered securities outstanding on the settlement day or beyond. (5) A legal entity shall adopt specific arrangements for all clients to ensure that the borrower of client financial instruments provides the appropriate collateral and that the legal entity monitors the continued appropriateness of such collateral and takes the necessary steps to maintain the balance with the value of client instruments. Inappropriate use of title transfer collateral arrangements Article 42. (1) The legal entity shall not be allowed to conclude title transfer collateral arrangements with retail clients as defined in Article 3 para. 1 no. 2 of the Financial Collateral Arrangements Act (FinSG; Finanzsicherheiten-Gesetz), published in Federal Law Gazette I No. 117/2003 for the purpose of hedging or covering, existing or future, actual, potential, or expected obligations. (2) The legal entity shall properly consider, and document this proper consideration, the use of title transfer collateral arrangements in the context of the relationship between the client's obligation to the legal entity and the client's assets that are subject to title transfer collateral arrangements by the legal entity. (3) When reviewing and documenting whether the use of title transfer collateral arrangements is appropriate, the legal entity shall take into consideration whether:
4. there is only a very tenuous connection between the client's obligation to the legal entity and the use of title transfer collateral arrangements, including whether the likelihood of a clients' liability to the legal entity is low or negligible;

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 58 / 126 2. the amount of client funds or financial instruments subject to title transfer collateral arrangements far exceeds the client's obligation, or is even unlimited if the client has any obligation at all to the legal entity; and 3. all clients' funds or financial instruments are made subject to title transfer collateral arrangements, without consideration of what obligation each client has to the legal entity. (4) Where using title transfer collateral arrangements, the legal entity shall highlight to professional clients and eligible counterparties the risks involved and the effect of such title transfer collateral arrangements on the client's financial instruments and funds. Governance arrangements concerning the safeguarding of client assets Article 43. The legal entity shall ensure that a single officer of sufficient skill and authority is appointed with specific responsibility for matters relating to the compliance with their obligations regarding the safeguarding of client financial instruments and funds. Without prejudice to the provisions in this section, the legal entity may decide whether the appointed officer is expected to exclusively fulfil these duties, or whether the appointed officer shall also be allow to simultaneously perform other responsibilities. Reports by external auditors Article 44. A legal entity shall ensure that its external auditors or auditors as defined in Article 72 para. 3 submit a report at least annually to the FMA about the adequacy of arrangements made pursuant to Articles 38 to 43. The provisions regarding the auditor’s liability under Article 275 UGB shall apply accordingly. SECTION 4: CONFLICTS OF INTEREST Conflicts of interest potentially detrimental to a client Article 45. A legal entity shall take suitable precautions to identify and avoid conflicts of interest between itself, relevant persons, tied agents or other persons directly or indirectly linked to it by control on the one hand and its clients on the other hand or among its clients that arise in the course of providing any investment services, investment activities, or ancillary services or combinations thereof, including such that originate from the receiving of benefits by third parties or as a result of the legal entity's remuneration structure or other proprietary incentive structures of the legal entity. Disclosing of Conflicts of Interest Article 46. If the measures or procedures are not sufficient to prevent that conflicts of interest are detrimental to the interest of the client, to reasonably ensure that the risk of affecting clients’ interests is avoided, the legal entity shall disclose the general type and cause of conflicts of interest to the client as well as measures taken to limit such risks prior to performing transactions for the

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 59 / 126 client. Such information shall be provided on a durable medium. The scope shall be based on the client's classification, to enable the client to be able to make their decision on an informed basis about the service affected by the conflict of interests. SECTION 5: OBLIGATION TO ACT IN THE CLIENT'S BEST INTEREST General obligations Article 47. When providing investment services and ancillary services, a legal entity shall act honestly, fairly and professionally in accordance with the best interests of its clients and shall comply with Articles 47 to 61; when trading as well as when receiving and transmitting orders in connection with investments pursuant to Article 1 para. 1 no. 3 of the Capital Market Act 2019 (KMG 2019, Kapitalmarktgesetz 2019), published in Federal Law Gazette I no. 62/2019 shall in particular comply with Articles 48 to 54, Article 59 and Article 60. (2) Legal entities that manufacture financial instruments for selling to clients shall ensure that:

1. such financial instruments are designed in such a way that they correspond to the requirements of a specific target market or end clients within the respective class of client,
2. that the strategy for the distribution of the financial instruments is compatible with the specific target market, and
3. that the legal entity takes discernible steps to ensure that the financial instrument is only distributed to the specific target market. (3) A legal entity must comprehend the financial instruments that it offers or recommended, assess the compatibility of the financial instruments with the requirements of the client for which it is providing investment services and also to take into consideration and ensure the target market of the end clients pursuant to Article 30 para. 10, that financial instruments are only offered or recommended, if so doing is in the client's interest. (4) A legal entity that provides investment services for clients must ensure that it does not remunerate or assess the performance of its staff in a way that conflicts with its duty to act in the best possible interests of its clients. In particular, the legal entity shall not make any arrangement by in relation to remuneration, sales targets or otherwise that could provide an incentive to its staff to recommend a particular financial instrument to a retail client when the investment firm could offer a different financial instrument which would better meet that client’s needs. (5) When an investment service is offered together with another service or product as part of a package or as a condition for the same agreement or package, the legal entity shall inform the client whether it is possible to buy the different components separately. The legal entity shall also provide separate evidence of the costs and charges of each component. Where the risks resulting from such an agreement or package offered to a retail client are likely to be different from the risks associated with the components taken separately, the legal entity shall provide an adequate description of the

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 60 / 126 different components of the agreement or package and the way in which its interaction modifies the risks. The FMA shall determine specific details by means of a Regulation while taking into consideration the established European practices, in particular in relation to the appropriate description of the various components of the arrangement or package, as well as to indicate situations in which the association of services or products in such an arrangement or such a package is not compatible with the legal entity's duty, to act honestly, fairly and professionally in accordance with the best interests of its clients. Appropriate Information for Clients Article 48. (1) A legal entity shall make appropriate information to its clients in an easily comprehensible form about the legal entity and the services and financial instruments provided by it and the proposed investment strategies, places of execution, and all costs and associated charges promptly. Consequently the legal entity's clients must be reasonably able to understand the precise nature and risks of the investment services and of the specific type of financial instrument that is being offered to them and, consequently, to take investment decisions on an informed basis. Such information shall include at least the following:

1. where investment advice is provided, then the legal entity shall inform the client promptly prior to providing this advice about: a. whether or not the advice is being provided independently as set out in Articles 50 and 53; b. whether the advice is based on a broad or on a more restricted analysis of different types of financial instruments and, in particular, whether the range is limited to financial instruments issued or provided by entities having close links with the legal entity or any other legal or economic relationships, such as contractual relationships, that are so close as to impair the independent basis of the advice provided as set out in Articles 50 and 53; c. whether the legal entity offers the customer with a regular evaluation of the suitability of the financial instruments, which were recommended to this client;
2. the information on financial instruments and proposed investment strategies must include appropriate guidance on and warnings of the risks associated with investments in those instruments or in respect of particular investment strategies and whether the financial instrument is intended for retail or professional clients, taking account of the identified target market in accordance with Article 47 para. 2;
3. the information on all costs and associated charges must include information relating to both investment and ancillary services, including the cost of advice, where relevant, the cost of the financial instrument recommended or marketed to the client and how the client may pay for it, also encompassing any third-party payments.

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 61 / 126 The information about all costs and charges, including costs and charges in connection with the investment service and the financial instrument shall be aggregated to allow the client to understand the overall cost as well as the cumulative effect on return of the investment, however market-related price fluctuations shall not be considered to be costs. Such information shall be provided to the client on a regular basis, at least annually, during the life of the investment. (2) The following shall be considered appropriate information with regard to information about the financial instruments and the suggested investment strategies and with regard to the costs and associated charges, including entry and exit charges:

1. in the case of units of any UCITS that is subject to Directive 2009/65/EC a Key Investor Information Document (KID) as defined in Article 134 InvFG 2011 and within the meaning of Article 78 of Directive 2009/65/EC,
2. in the case of units of any AIF that is subject to Directive 2011/61/EU a Key Investor Information Document (KID) or simplified prospectus as defined in Article 48 para. 5 no. 7 AIFMG as well as information pursuant to Article 21 para. 1 AIFMG in the case of professional clients. The KID or the simplified prospectus shall be made available free of charge in paper form or in another durable medium. (3) The information in accordance with para. 1 may also be made available in a standardised format. If an agreement to buy or sell a financial instrument is concluded by using a means of distance communication thereby preventing the prior handing out of information about the charges and fees, the legal entity may hand over information about the charges and ancillary costs to the client in either electronic or paper form, directly after the client has contractually bound itself, where the retail client requests this, provided that: a. the client has consented to receiving the information about the costs without undue delay after the conclusion of the transaction, and b. the legal entity has given the client the option of delaying the transaction in order to receive the statement on suitability in advance. In addition the legal entity shall afford the client the possibility to receive information over the telephone about charges and fees prior to concluding the transaction. (4) If an investment service is related to a consumer credit agreement, the Consumer Finance Act (VKrG; Verbraucherkreditgesetz), published in Federal Law Gazette I no. 28/2010 shall apply to information regarding such consumer credit. (5) Legal entities shall make all information that is to be made available to their clients or potential clients in accordance with this Federal Act available in electronic form. In the case of retail clients or potential retail clients, the legal entity shall make the information available free of charge in paper form at the request of the retail client or potential retail client. The legal entity shall make the retail clients or potential retail clients aware about the possibility to receive information in paper form. (6) Legal entities shall inform existing customers, who receive information to be made available in accordance with this Federal Act in paper form, at least eight weeks prior to sending the information in electronic form, that:

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 62 / 126

1. they will receive the information in electronic form;
2. they will have the choice to either continue to receive the information in paper form in the future or to receive it in electronic form in the future;
3. an automatic change to electronic form will take place, in the event that the clients do not advise within an eight week period that they wish to continue to receive the information in paper form. Existing clients, who already receive information that is required to be made available in accordance with this Federal Act, shall not be required to be informed pursuant to nos. 1 to 3. (7) The requirements under para. 1 no. 3 that are provided for professional clients pursuant to Article 66 shall only apply for investment advice and portfolio management. Fair, clear and non-misleading information Article 49. (1) All information, including marketing communications, addressed by the legal entity to clients shall be fair, clear and non-misleading. Such information shall also include the name and firm of the legal entity. Marketing communications shall be required to be clearly identifiable as such and shall not be allowed to be in contradiction to the information disclosed pursuant to Regulation (EU) 2019/2088. (2) Analyses that are conducted by a legal entity or a third party, and which are used by a legal entity, its clients or potential clients, or which are disseminated to a legal entity, its clients or potential clients shall be fair, clear and non-misleading. The analyses must be clearly recognisable as such or recognisable in a similar provided that all conditions set out in Delegated Regulation (EU) 2017/565 that apply to analyses are met. (3) Legal entities providing portfolio management or other investment services or ancillary services, shall ensure that the research they distribute to clients or potential clients which is paid for, in full or in part, by an issuer shall only be labelled as “issuer-sponsored research” if it is produced in accordance with the EU code of conduct for issuer-sponsored research pursuant to Article 24 (3c) of Directive 2014/65/EU. (4) Legal entities that produce or disseminate issuer-sponsored research, shall have organisational arrangements in place to ensure that such analyses are drawn up in accordance with the EU code of conduct for issuer-sponsored research pursuant to Article 24 (3c) of Directive 2014/65/EU and that they observe the standards stated in paras. 2, 3 and 6. (5) Every issuer shall submit its issuer-sponsored research pursuant to para. 3 to the FMA in the latter’s capacity as the competent collection body as defined in Article 2 point 2 of Regulation (EU) 2023/2859. When submitting such analyses, the issuer shall ensure that metadata are attached to them, from which is it possible to ascertain that the information is in line with the EU code of conduct for issuer-sponsored research. Such analyses shall neither be considered as regulatory information pursuant to Article 118 para. 1 no. 9 BörseG 2018, nor as investment research pursuant to Article 54,

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 63 / 126 and shall therefore not be subject to the same level of regulatory scrutiny as regulatory information or investment research. (6) Research labelled as “issuer-sponsored research” shall indicate on its front page in a clear and prominent way that it has been prepared in accordance with the EU code of conduct for issuer￾sponsored research pursuant to Article 24 (3c) of Directive 2014/65/EU. Any other research material paid in full or in part by the issuer but not prepared in compliance with that EU code of conduct for issuer-sponsored research shall be labelled as a marketing communication. Obligations providing investment advice on an independent basis Article 50. If a legal entity informs the client, that investment advice is being provided on an independent basis, then the legal entity shall assess an adequately broad range of financial instruments offered on the market, that must be adequately diversified with regard to their nature and issuers or providers of products, in order to ensure that the investment objectives of the client may be achieved in a suitable form, and may not be restricted solely to financial instruments, that:

1. are issued or provided by the legal entity itself or by entities that have close ties to the legal entity,
2. are issued or provided by other entities, to which the legal entity has such close legal or economic relationships, such as contractual relationships, that the risk exists that the independent nature of the advice will be compromised. Granting and accepting of benefits Article 51. (1) Benefits are charges, commissions or other cash benefits or non-monetary benefits. (2) A legal entity shall not be acting honestly, fairly and professionally in the best possible interest of its clients pursuant to Article 47 and shall not fulfil the obligation pursuant to Article 45, if it grants a benefit or accepts one from a third party in conjunction with the provision of securities or ancillary services, provided that the third party is neither the client itself, nor a person active on the client’s behalf. (3) The granting or acceptance of benefits pursuant to para. 2 shall however be permissible, provided that such benefits:
3. improve the quality of the service for the client pursuant to Article 52,
4. do not compromise the fulfilling of the duty of the legal entity to act in the best interest of the clients, and
5. disclose the existence, nature and amount of the inducement in full, accurately, and comprehensibly in an unambiguous manner to the client prior to providing the relevant investment or ancillary service; if the amount cannot be ascertained, the type and method of calculation must be disclosed to the client; and
6. if they enable or are necessary for the provision of investment services, such as custody costs, settlement and exchange fees, management fees or legal fees and which by their nature

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 64 / 126 cannot create any conflicts with the legal entity’s obligation to act honestly, fairly and professionally in the best interests of its clients. (4) The legal entity shall inform the client on mechanisms for transferring the benefits to the client that it has received in relation to the provision of the investment or ancillary service. (5) In relation to benefits received from or paid to third parties, the legal entity shall disclose to the client the following information:

1. prior to the provision of the relevant investment or ancillary service, the legal entity shall disclose to the client information on the payment about the benefit concerned in accordance with para. 3 no. 3. A generic description of minor non-monetary benefits shall be permitted. Other non-monetary benefits accepted or paid by the legal entity in connection with the investment service provided to a client shall be priced and disclosed separately;
2. where a legal entity was unable to ascertain on an ex-ante basis the amount of any benefit to be accepted or paid, and instead disclosed to the client the method of calculating that amount, then the legal entity shall also provide its clients with information of the exact amount of the benefit that it accepted or paid.
3. as long as the legal entity receives benefits in conjunction with the investment services provided to the relevant clients, the legal entity shall inform its clients on an individual basis at least once a year about the actual amount of benefits received or paid. A generic description of minor non-monetary benefits shall be permitted. (6) In the implementation of the requirements pursuant to para. 5 the legal entity shall take into account the rules on costs and charges in Article 48 para. 1 no. 3 of this Federal Act and Article 50 of Delegated Regulation (EU) 2017/565. (7) Where several legal entities are involved in a delivery channel, each legal entity providing an investment or ancillary service shall comply with its obligations to make disclosures to its clients. Quality Enhancement of the Service Article 52. (1) A benefit enhances the quality of the respective service for the client, where all of the following conditions are satisfied:
4. the benefit shall be justified by the provision of an additional or higher level service to the relevant client, proportional to the level of benefits accepted, in particular a. the provision of non-independent investment advice on and access to a wide range of suitable financial instruments including an appropriate number of financial instruments from third party product providers having no close links with the relevant legal entity, or b. the provision of non-independent investment advice, either aa) combined with an offer to the client, at least on an annual basis, to assess the continuing suitability of the financial instruments in which the client has invested; or

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 65 / 126 bb) combined with another on-going service that is likely to be of value to the client such as advice about the suggested optimal asset allocation of the client; or c. the provision of access, at a competitive price, to a wide range of financial instruments that are likely to meet the needs of the client, including an appropriate number of financial instruments from third party product providers having no close links with the investment firm, either aa) combined with the provision of added-value tools, such as objective information tools helping the relevant client to take investment decisions or enabling the relevant client to monitor, model and adjust the range of financial instruments in which they have invested, or bb) combined with providing periodic reports of the performance and costs and charges associated with the financial instruments or d. when access to investment advice is made possible by the on-site availability of qualified advisors. 2. The benefit does not directly benefit the recipient legal entity, its shareholders or employees without simultaneously forming a material advantage to the relevant client. 3. The benefit shall be justified by the continuous quality enhancement for the relevant client that shall be proportional to the ongoing benefit. 4. The benefit shall not lead to any kind of bias or distortion towards the legal entity in the provision of the relevant services to the client. (2) The legal entity shall fulfil the requirements pursuant to para. 1, for as long as it accepts or pays the benefit. (3) The legal entity shall be required to provide evidence that any benefit that it accepts or pays, enhances the quality of the relevant service to the client:

1. by keeping an internal list of all benefits that it accepts from third parties in conjunction with the provision of an investment or ancillary services, and
2. by recording how the benefit received or paid by or intended by the legal entity enhances the quality of the services provided to the relevant client, and which steps were taken in order not to impair the legal entity's duty to act honestly, fairly and professionally in accordance with the best interests of the client. Payment and Receipt of Benefits in relation to Independent Investment Advice and Portfolio Management Article 53. (1) If a legal entity informs the client that the investment advice is being provided on an individual basis, or if the legal entity offers portfolio management, then the legal entity shall not be permitted to receive and keep benefits from a third party or a person acting on behalf of a third party for the provision of the services to clients. The legal entity shall transfer all benefits that are paid by

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 66 / 126 a third party or a person acting on behalf of a third party in conjunction with services that are provided for a customer, to the client without undue delay upon receipt. All benefits that are received from third parties in relation to the provision of independent investment advice and portfolio management, shall be transferred in full to the client. (2) The legal entity shall set up and implement policies to ensure that all benefits paid or provided by any third party or a person acting on behalf of a third party in relation to the provision of independent investment advice and portfolio management are allocated and transferred to each individual client. (3) The legal entity shall inform the client about the benefits transferred to them, in particular as part of the regular reports to the client. (4) Minor non-monetary benefits pursuant to para. 5 shall however be permitted, where they

1. may improve the quality of the service for the client pursuant to Article 52,
2. on the basis of their scale and nature do not suggest that they are unlikely to impair compliance with a legal entity's duty to act in the best interest of their client, and
3. are disclosed in an unambiguous manner. (5) Minor non-monetary benefits shall in particular include:
4. The information or documentation relating to a financial instrument or an investment service, is generic in nature or personalised to reflect the circumstances of an individual client;
5. the written material from a third party that is commissioned and paid for by an corporate issuer or potential issuer to promote a new issuance by the company, or where the third party legal entity is contractually engaged and paid by the issuer to produce such material on an ongoing basis, provided that the relationship is clearly disclosed in the material and that the material is made available at the same time to any legal entities wishing to receive it or to the general public;
6. the participation in conferences, seminars and other training events on the benefits and features of a specific financial instrument or an investment service, including a class of financial instruments or investment services, or
7. hospitality of a reasonable de minimis value, such as refreshments during a business meeting or during conferences, seminars or other training events mentioned in no. 3. (6) minor non-monetary benefits pursuant to para. 5 must be reasonable and proportionate and of such a scale that they are unlikely to influence the legal entity's behaviour in any way that is detrimental to the interests of the relevant client. (7) Minor non-monetary benefits pursuant to para. 5 must be disclosed prior to the provision of the relevant investment and ancillary services to clients. A generic description shall be permissible pursuant to Article 51 para. 5 no. 1.

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 67 / 126 Payment and Receipt of Benefits in connection with Research Article 54. (1) The provision of research by third parties to legal entities shall not be regarded as a benefit if it is received in return for either of the following:

1. direct payments by the legal entity from its own funds;
2. payments from a separate research payment account controlled by the legal entity, provided the following conditions relating to the operation of the account are met: a. it is funded by a specific research charge to the client; b. as part of establishing a research payment account and agreeing the research charge with their clients, the legal entity shall set and regularly assess a research budget as an internal administrative measure; c. the legal entity shall assume liability for the research payment account; d. the legal entity regularly assesses the quality of the research purchased based on robust quality criteria and its ability to contribute to better investment decisions. The legal entity shall, if it makes use of the research payment account pursuant to no. 2, prior to the provision of the investment service for clients provide the client with information about the budgeted amount for research and the amount of the estimated research charge for each client; as well as an annual information breakdown about the total costs of research by third parties per client. (2) A legal entity that operates a research payment account shall be required, at the request of its clients or the FMA to present a summary of the providers remunerated from this account, of the total amount paid to the providers listed during a specified period, the benefits and services received by the legal entity as well as a comparative breakdown of the total amount paid from this account against the research budget proposed by the legal entity for this period. This statement should also list any rebate or carry-over if residual funds remain in the account. For the purposes of para. 1 no. 2 point a), the specific research charge shall:
3. it is only based on a research budget set by the legal entity for the purpose of establishing the need for third party research in respect of investment services rendered to its clients; and
4. it is not linked to the volume and/or value of transactions executed on behalf of the clients. (3) Every operational arrangement for the collection of the client research charge, where it is not collected separately but alongside a transaction commission, shall indicate a separately identifiable research charge and shall fully comply with the conditions set out in para. 1 no. 2 and the closing part of para. 1. (4) The total amount of research charges received may not exceed the research budget. (5) The legal entity shall agree with clients, in its investment management agreement or general terms of business, the research charge as budgeted by the legal entity and the frequency with which the specific research charge will be deducted from the resources of the client over the year. Increases in the research budget shall only be allowed to take place once clients have been provided with clear information about such intended increases. If there is a surplus in the research payment account at

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 68 / 126 the end of a period, the legal entity shall have a process to rebate those funds to the client or to offset it against the research budget and charge calculated for the following period. (6) For the purposes of para. 1 no. 2 point b), the research budget shall be managed solely by the legal entity and shall be based on a reasonable assessment of the need for third party research. The allocation of the research budget to purchase third party research shall be subject to appropriate controls and senior management oversight to ensure that the research budget is managed and used in the best interests of the legal entity's clients. Those controls shall include a clear audit trail of payments made to research providers and how the amounts paid were determined with reference to the quality criteria referred to in para. 1 no. 2 point d). A legal entity shall not be permitted to use the research budget and the research payment account for financing internal research. (7) For the purposed of para. 1 no. 2 point c) the legal entity may delegate the administration of the research account to a third party, provided that the arrangement facilitates the purchase of third￾party research and payments to research providers in the name of the legal entity without any undue delay in accordance with the legal entity's instruction. (8) For the purposes of para. 1 no. 2 point d) the legal entity shall determine all necessary elements in a written policy document, and shall transmit this document to its clients. This document shall also address the extent to which research purchased through the research payment account may benefit clients' portfolios, including, also by taking into account investment strategies applicable to various types of portfolios. In addition, it shall also be determined which approach the legal entity shall take to allocate such costs fairly to the various clients' portfolios. (9) A legal entity shall define separate charges for every service through which orders are executed by clients that correspond only to the costs of executing the transaction. The provision of each other benefit or service by the same legal entity to other legal entities established in the Union shall be subject to a separately identifiable charge. The supplying of such benefits or services and the charges for those benefits or services shall not be influenced or conditioned by levels of payment for services through which the orders of clients are executed. (10) Where third parties provide research to legal entities that provide portfolio management or other investment services or ancillary services for clients, then the obligations pursuant to Article 47 para. 1 shall be considered to be met, where

1. an agreement has been concluded between the legal entity and the third-party provider of execution services and research, which sets out a remuneration model, including the manner in which the overall cost of research is generally taken into account when determining the total fees for investment services,
2. the legal entity informs its clients about its choice to make payments for execution services and research either jointly or separately, and informs them about its policies regarding the payment for execution services and research, including the type of information it may make available, depending on which payment method the legal entity chooses and how, where applicable, the legal entity prevents or manages conflicts of interest pursuant to Articles 45 and 46, where it applies a joint payment method for execution services and research,

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 69 / 126 3. the legal entity assesses the quality, usefulness and value of the research used as well as the ability of the research used to contribute to better investment decisions, 4. in the event that the legal entity chooses to pay separately for third-party execution services and research, the provision of third-party research to the legal entity is settled in one of the following ways: a. direct payments by the legal entity from its own funds; b. payments from a separate research payment account controlled by the legal entity. (11) The following shall apply for the purposes of Articles 47 to 54:

1. the term “research” means research material or research services in relation to one or several financial instruments or other assets of the issuers or potential issuers of financial instruments or research material or research services, that are closely related to a specific sector or market, so that the research provides the basis for the assessment of financial instruments, assets or issuers in the sector or market;
2. trading commentary and other bespoke trade advisory services, intrinsically linked to the execution of a transaction in financial instruments shall not be considered to be research.
3. research pursuant to no. 1 shall also comprise material or services that explicitly or implicitly recommend or suggest an investment strategy and provide a substantiated opinion as to the present or future value or price of financial instruments or assets, or otherwise contain analysis and original insights and reach conclusions based on new or existing information that could be used to inform an investment strategy and be relevant and capable of adding value to the investment firm’s decisions on behalf of clients being charged for that research. (12) Where a legal entity receives research from a research provider who is not engaged in execution services and is not part of a financial services group, that also includes a legal entity that offers execution or brokerage services, the provision of such research to the investment firm is regarded as fulfilling the obligations under Article 47 para. 1. In such cases, the legal entity shall comply with the requirement pursuant to para. 10 no. 3. (13) Where known to them, the legal entity shall keep a record of the total costs attributable to third￾party research provided to them. Upon request, such information shall be made available on an annual basis to the legal entity’s clients. SECTION 6: SUITABILITY AND APPROPRIATENESS OF INVESTMENT SERVICES General provision Article 55. Legal entities shall ensure and upon request prove to the FMA that natural persons that provide investment advice clients on behalf of the legal entity, or pass on information about investment products, investment services or ancillary services to clients, possess the necessary knowledge and competences that are required for meeting the obligations pursuant to Articles 47

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 70 / 126 to 61. The FMA shall disclose the criteria that are stipulated for the assessment of knowledge and competences. The FMA may define the criteria by means of a Regulation taking into consideration European practices. Suitability of investment advice and portfolio management services Article 56. (1) A legal entity that provides investment advice or portfolio management services shall obtain the necessary information regarding the knowledge and experience in the investment field of the client in relation to the specific type of products or services, their financial situations, including their ability to absorb losses, and their investment objectives including their risk tolerance so as to enable the legal entity to be able to recommend to the client the investment services and financial instruments that are suitable for the client, and in particular correspond to the client's risk tolerance and their ability to absorb losses. (2) If a legal entity provides investment advice, in which a package of services or products is recommended, that are bundled pursuant to Article 47 para. 5, then the entire bundled package must be suitable for the clients. (3) Where legal entities provide either investment advice or portfolio management, that covers switching of financial instruments, then they shall gather the necessary information about the client’s investments, and analyse the costs and benefits of the switching of financial instruments. When providing investment advice services, the legal entity shall inform clients whether or not the benefits of switching financial instruments outweigh the costs incurred in the switching process. (4) The requirements in accordance with para. 3 shall not apply for services provided for professional clients pursuant to Article 66, unless such clients declare either in electronic form or in paper form that they do not wish to make used of this exception. The legal entity shall be obliged to record such declarations. Appropriateness of other investment services Article 57. (1) Legal entities shall in providing other investment services than those listed in Article 56 ask the clients for details about their knowledge and experience in the investment field in relation to the specific type of products offered or requested by the client, in order to be able to assess, whether they are appropriate for the client. If a bundle of services or products is recommended pursuant to Article 47 para. 5, it is necessary in the assessment to take into account, whether the entire bundled package is appropriate. (2) If based on the information obtained under para. 1 the legal entity comes to the conclusion that the relevant product or service is not appropriate for the client, it shall warn the client. This warning may be provided in a standardised format. (3) In the event that the client does not provide or only provides insufficient information listed in para. 1 about their knowledge and experience, the legal entity shall warn the client that without such

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 71 / 126 information it will not be able to assess whether the offered or requested products or services are appropriate for the client. This warning may be provided in a standardised format. Transactions that only consist of the execution or receiving and transmission of client orders Article 58. A legal entity that provides investment services that only consist of execution and/or receiving and transmission of client orders with or without ancillary services, except for the granting of credits or loans pursuant to Article 1 no. 4 point b), that do not contain any existing upper credit limits for loans, giro accounts and overdraft facilities for clients, may provide such investment services for its clients, without the need to obtain or assess the details pursuant to Article 57 para. 1, provided that the following requirements are met:

1. the services relate to non-complex financial services pursuant to Article 1 no. 8;
2. the services are provided at the initiative of the client;
3. the client has been clearly informed that the legal entity is not required pursuant to Article 57 to assess the suitability of the instruments or services provided or offered when providing such services, and that the client therefore does not benefit from the corresponding protection of relevant conduct rules; this warning may be provided in a standardised format;
4. the legal entity complies with its obligations under Articles 45 and 46. Documentation of the contractual parties’ rights and duties Article 59. (1) A legal entity shall create a record, consisting of the document(s) including the agreements between the legal entity and the client, which sets out the rights and duties of the parties as well as the other conditions in accordance with which the legal entity provides services to the client. SECTION 7: REPORTING OBLIGATIONS TOWARDS CLIENTS Reporting obligation Article 60. (1) A legal entity shall report to its client in a suitable format using a durable medium. Such reports shall contain regular messages to the client, which contain the type and complexity of the respective financial instruments as well as the type of service provided for the client is taken into account, as well as where applicable the costs that are associated with the transactions conducted on behalf of the clients and services provided. (2) A legal entity, that provides investment advice towards retail clients, shall present the client with a statement about its suitability prior to the execution of the transaction on a durable medium, in which the advice provided is listed and it is also explained how the advice was matched with the preferences, objectives and other characteristics of the retail client. (3) If the agreement to buy or sell a financial instrument is concluded by using a means of distance communication, and the prior handing out of information of the suitability statement pursuant to

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 72 / 126 para. 2 is therefore not possible, the legal entity may make the written suitability statement available to the client on a durable medium, immediately after the client has contractually bound itself, provided that the following conditions have been fulfilled:

1. the client has consented to receiving the suitability statement without undue delay after the conclusion of the transaction, and
2. the legal entity has given the client the option of delaying the transaction in order to receive the suitability statement in advance. (4) A legal entity that provides portfolio management services for a client, or that has informed the client, that it will perform a regular assessment of suitability, shall enclose an updated statement with the regular report, that must contain how investment was matched with the preferences, objectives and other characteristics of the retail client. (5) The requirements in paras. 1 to 4 shall not apply for services provided for professional clients pursuant to Article 66, unless such clients declare either in electronic form or in paper form that they do not wish to make used of this exception. The legal entity shall be obliged to record such declarations. Credit agreements relating to residential immovable property Article 61. If a credit agreement relating to residential immovable property that is subject to the conditions for the assessment of the creditworthiness of consumers set out in the Mortgage and Immovable Property Credit Act (HIKrG; Hypothekar- und Immobilienkreditgesetz), published in Federal Law Gazette I No. 135/2015, is attached to the precondition, that an investment is provided to the same consumer with regard to covered bonds issued especially for the purpose of collateralisation of the financing of the loan with identical conditions to the credit agreement relating to residential immovable property, so that the loan may be paid out, refinanced or replaced, then this service shall not be subject to the obligations set out in Articles 55 to 60. SECTION 8: BEST EXECUTION OF SERVICES Best execution Article 62. (1) A legal entity, when executing orders taking into consideration the price, costs, speed of execution, the probability of execution and settlement, the scope, the type and all other relevant aspects for the execution of the order, shall take all reasonable measures, in order to achieve the best possible result for its clients. If, however, an explicit instruction has been issued by the client, then the legal entity shall execute the order in accordance with this explicit instruction. (2) The issuing and redemption of units in domestic investment funds and real estate funds and of units in foreign investment funds, that are allowed to be marketed in Austria, using a custodian bank shall not constitute execution of client orders as defined in para. 1.

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 73 / 126 (3) If a legal entity executes an order on behalf of a retail client, then the "best execution" shall be determined based on the overall assessment consisting of the price of the financial instrument and the costs arising in conjunction with the execution as well as all costs incurred by the client, that are directly connected with the execution of the order, including the fees of the execution venue, clearing and settlement fees, and other fees paid to third parties that are involved in the execution of the order. (4) (repealed in Federal Law Gazette I 48/2025). (5) For financial instruments that are subject to trading obligations in accordance with Articles 23 and 28 of Regulation (EU) No 600/2014, a legal entity shall communicate to the client at which trading venue the order was executed, following the execution of an order executed on behalf of a client. Execution policy Article 63. (1) In order to satisfy the obligation of "best execution" pursuant to Article 61 para. 1, a legal entity shall be required to take effective measures and to apply them. The legal entity shall in particular define and apply an execution policy, which allows the legal entity to achieve the best possible result pursuant to Article 62 para. 1 for their client orders. (2) The execution policy shall in all cases contain for every class of financial instruments details about the different trading venues, at which the legal entity executes its clients' orders and the factors that are decisive with regard to the choice of execution venue. It shall at least include those trading venues that enable the legal entity to obtain the best possible results for the execution of client orders on a constantly recurring basis; (3) If an order for a financial instrument may be executed at several competing venues, then the commissions of the legal entity and the costs of execution at each of the venues under consideration shall be included in the interest of achieving "best execution" pursuant to Article 62 para. 1, in order to compare with one another and assess the execution venues listed in the legal entity's execution policy and those listed as being capable of executing the order for the client. (4) For the purposes of this section, “execution venue” means a regulated market, a multilateral trading facility (MTF), an organised trading facility (OTF), a systematic internaliser, a market maker, any other provider of liquidity or an institution, that performs a similar function in a third country. (5) Where the execution policy permits that orders may be executed outside a trading venue pursuant to Article 1 no. 26, the legal entity shall inform its clients about this possibility. Before a legal entity executes client orders outside a trading venue pursuant to Article 1 no. 26, it shall obtain the prior explicit consent of the client. Such consent may be obtained either in the form of a general agreement or on a separate basis for each individual transaction. (6) At the client’s request, the legal entity shall provide evidence that it has executed the orders in compliance with its execution policy. The legal entity shall, at the FMA's request provide evidence that it has complied with the provisions set out in Articles 62 to 64.

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 74 / 126 Organisational regulations regarding the execution policy Article 64. (1) A legal entity shall inform its clients about its execution policy in an appropriate form. Such information shall explain, clearly and in detail, and in a manner that is comprehensible for clients, how client orders are executed by the legal entity. The legal entity shall obtain the prior consent of its clients about its execution policy. The legal entity shall notify its clients, with whom it has an ongoing business relationship, about any material changes to its arrangements about its execution of orders or its policies for the execution of orders. (2) (repealed in Federal Law Gazette I 48/2025). (3) A legal entity shall monitor the effectiveness of its arrangements for the execution of orders and policy on the execution of orders in order to identify and, where appropriate, correct any deficiencies. The legal entity shall in particular assess on a regular basis, whether the execution venues included in the policy on the execution of orders continue to provide the best possible result for the client or whether the arrangements for the execution of orders must be amended. SECTION 9: HANDLING OF CLIENT ORDERS Handling of client orders Article 65. (1) A legal entity shall establish procedures and systems in relation to the handling of client orders that ensure the prompt, fair and swift execution of client orders in comparison with other client orders and the trading interests of the legal entity. Such procedures or systems shall allow that otherwise comparable client orders shall be executed in accordance with the time they were received at by the legal entity. (2) Unless the client expressly instructs otherwise, in the case of client limit orders in relation to shares, that are admitted to trading on a regulated market, or which are traded on another trading venue, in the case that the orders cannot be executed without delay under the prevailing market conditions, legal entities shall take measures to facilitate the earliest possible execution of such orders, by publishing them without delay and in a manner which is easily accessible to other market participants. A legal entity satisfies this obligation by transmitting the client limit orders to a trading venue. The FMA dispense with the obligation to announce a limit order by means of a Regulation, if the limit order as defined in Article 4 of Regulation (EU) No 600/2014 is very large compared to the normal scope of transactions.

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 75 / 126 SECTION 10: PROFESSIONAL CLIENTS AND ELIGIBLE COUNTERPARTIES Professional clients Article 66. (1) A professional client is a client possessing adequate experience, knowledge and expertise, to be able to make its own investment decisions and appropriately assess the associated risks. The legal personalities listed in para. 2 as well as those clients pursuant to Article 67 that request to be treated as such, shall be treated as professional clients. (2) With regard to all investment services and financial instruments, profession clients shall in any case be:

1. the legal entities listed below, provided that they have been authorised or are supervised, in Austria, in a Member State, or in a third country, to operate in financial markets: a. credit institutions, b. investment firms, c. other authorised or supervised financial institutions, d. insurance undertakings, e. investment undertakings pursuant to Article 1 para. 1 no. 3 KMG 2019, domestic or foreign investment funds, domestic or foreign real estate funds, or similar entities that combine assets with diversified risks as well as their respective management companies, f. pension funds and their management companies, g. commodities dealers and commodity derivatives dealers, h. local firms pursuant to point 4 of Article 4(1) of Regulation (EU) No 575/2013, i. other institutional investors;
2. large companies other than those listed in no. 1 that at company level satisfy at least two of the following criteria: a. total assets of at least Euro 20 million, b. net revenue of at least Euro 40 million, c. own funds of at least Euro 2 million;
3. central governments, provinces, regional governments of Member States and third countries, as well as government debt management bodies on a national or regional level;
4. central banks pursuant to point 46 of Article 4 (1) of Regulation (EU) No 575/2013 as well as international and supranational institutions, including in particular the World Bank, the International Monetary Fund (IMF), the European Investment Bank (EIB) and other comparable international organisations;
5. other institutional investors, whose principle activity is to invest in financial instruments, including entities dedicated to the securitisation of assets or other financing transactions.

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 76 / 126 (3) The legal entity shall inform any entity listed in para. 2 prior to any provision of services that that the client is deemed to be a professional client on the basis of the available information, and that it shall be treated as such unless the legal entity and the entity in question agree to the contrary. Moreover, a legal entity shall inform professional clients about the possibility to change their classification pursuant to Article 45 (2) of the delegated Regulation (EU) 2017/565. (4) A company listed in para. 2 may apply for a higher level of protection from the legal entity, especially that it shall not be treated as a professional client, where it deems that it is unable to properly assess or manage the risks involved with the investment. It is necessary for providing this higher level of protection that the legal entity and the company applying for it enter into a written agreement, that the company shall not be treated as a professional client for the purposes of the applicable conduct of business regime. Such an agreement shall specify whether this applies to one or more particular services or transactions, or to one or more types of product or transaction. Article 67. (1) Clients other than those listed in Article 66, including public sector bodies and retail clients, may also request the legal entity to classify and treat them as professional clients as defined in Article 66 para. 1. The protective provisions that apply to retail clients shall no longer apply to such clients. (2) The classification and treatment of a client as defined in para. 1 as a professional client shall only be permissible, if:

1. the client has notified the legal entity in writing that it wishes to be treated as a professional client, either generally or with regard to a particular investment service or investment transaction, or with regard to a specific type of transaction or product;
2. the legal entity has given the client clear information in writing about the level of protection and which investor compensation rights the client may lose in the event of being classified as a professional client;
3. the client has confirmed in writing, in a separate document to the respective contract, that they are aware of the consequences arising from the removal of this level of protection;
4. the legal entity has assured itself on the basis of an adequate assessment of the expertise, experience and knowledge of the client, that the client is capable of making its own investment decisions and understanding the associated risks entailed, with regard to the nature of the transactions or services that it intends to use; and
5. based on the assessment pursuant no. 4, at least two of the following criteria have been fulfilled: a. The client has carried out on average ten transactions per quarter of a significant size on the relevant market during the preceding four quarters; b. the size of the client's financial instrument portfolio, including cash deposits exceeds EUR 500 000; c. the client has been working or has worked in a professional position for at least one year that requires knowledge of the envisaged transactions or services.

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 77 / 126 (3) The legal entity shall draw up appropriate written internal policies and introduce procedures, under which clients shall be categorised. The legal entity shall take appropriate provisions to ensure to ensure that a client wishing to be treated as professional client fulfils the criteria defined in para. 2 nos. 4 and 5 prior to such a request set out in para. 1 being approved; in so doing, it shall not be allowed to assume that this client has market knowledge and experience that are comparable those of professional clients in accordance with Article 66 para. 2. (4) Professional clients shall inform the legal entity about any changes that could affect their current categorisation. The legal entity shall take appropriate action, in the event that the client no longer fulfils the conditions required for classification as a professional client. Transactions executed with eligible counterparties Article 68. (1) Legal entities that are authorised to execute orders on behalf of clients or to deal on own account or to receive and transmit orders, shall be allowed to broker or conclude transactions with eligible counterparties without being required to apply the provisions listed in Articles 47 to 52, Article 55, Article 56, Article 57 paras. 1 to 3, Articles 58 to 64 and Article 65 para. 1 for such transactions or in respect of ancillary services directly related to such transactions. (2) A legal entity shall act honestly, fairly and professionally in its relationship with eligible counterparties, as well as communicating in a fair, clear and non-misleading manner, and shall in doing so take into account the type of eligible counterparty and its business activities. (3) For the purpose of this provision, the legal personalities listed in Article 66 para. 2 nos. 1 to 4 shall be considered as eligible counterparties. The legal personalities listed in Article 66 para. 2 no. 1 lit. i shall demonstrate net revenue of at least Euro 40 million. Where a legal personality is subject to the legal jurisdictions of various Member States, the classification of this legal personality shall be determined in accordance with the legal provisions of the Member State in which that legal personality has its registered office. The legal entity that concludes transactions pursuant to para. 1 with such legal personalities, shall seek the explicit approval of the potential counterparty to be treated as an eligible counterparty. This approval may be obtained either in the form of a general agreement, or on a separate basis for each individual transaction. (4) A legal entity classified as eligible counterparty pursuant to para. 3 may request the application of para. 1 to be excluded, either generally or with regard to individual transactions. (5) A legal personality that has its registered office in a third country, shall be classed as an eligible counterparty, provided that the counterparty is equivalent to the legal personalities listed in para. 3.

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 78 / 126 SECTION 11: UNSOLICITED COMMUNICATION AND DOOR-TO￾DOOR SALES Unsolicited communications Article 69. (1) The permissibility of sending unsolicited messages to advertise any of the financial instruments listed in Article 1 no. 7 and investments as defined in Article 1 para. 1 no. 3 KMG 2019 shall be based upon Article 174 of the Telecommunications Act 2021 (TKG 2021; Telekommunikationsgesetz 2021), published in Federal Law Gazette I No. 190/2021. Door-to-door sales Article 70. (1) The legal entities listed in Article 26 shall only be allowed to visit consumers as defined in Article 1 para. 1 no. 2 of the Consumer Protection Act (KSchG; Konsumentenschutzgesetz) published in Federal Law Gazette no. 140/1979, for the purpose of advertising the purchasing of any of the financial instruments listed in Article 1 no. 7 or of investments as defined in Article 1 para. 1 no. 3 KMG 2019, where invited to do so. (2) Where a consumer's contractual declaration is based on the purchase of:

1. an investment as defined in Article 1 para. 1 no. 3 KMG 2019, or
2. units/shares in domestic or foreign investment funds, in domestic or foreign real estate funds or in similar facilities that combine assets with diversified risks, then Article 3 KSchG shall apply, irrespective of whether a business relationship is initiated by the customer for the purpose of concluding this contract. CHAPTER 3: SUPERVISION AND OTHER MEASURES SECTION 1: ACCOUNTING, INVESTOR COMPENSATION AND RECEIVERSHIP Accounting and Auditing of the annual financial statement Article 71. (1) Investment companies shall prepare their annual accounts in accordance with the structure used in Annex 2 to Article 43 BWG in a timely manner to ensure that the deadline of para. 2 is observed; Annex 2 to Article 43, part 2 BWG (layout of the income statement) shall apply to that extent that the item "III. Operating Expenses" shall also contain the item "thereof: fixed overheads"; Articles 43 paras. 1, 2 and 3, Articles 45 to 59a and Article 64 BWG shall apply. Investment firms that do not meet the requirements for classification as small and non￾interconnected investment firms pursuant to Article 12 (1) of Regulation (EU) 2019/2033, shall apply Article 65 paras. 1 and 2 BWG. The provisions pursuant to Article 275 Austrian Commercial Code (UGB; Unternehmensgesetzbuch) relating to the auditor’s liability shall apply.

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 79 / 126 (2) The annual financial statements drawn up pursuant to para. 1 and audited pursuant to para. 3 as well as the audit reports drawn up pursuant to para. 4 shall be submitted to the FMA no later than within six months following the end of the financial year. The FMA may also request that the data of the annual financial statements are transmitted electronically or submitted on electronic durable medium in standardised form. (3) The annual financial statements shall be audited by statutory auditors and in case of cooperatives by the audit bodies of statutory audit institutions. The auditor shall review the legal compliance of the annual financial statements. In addition, the audit procedure shall address:

1. The factual accuracy of the assessment, including the any required depreciations, value adjustments, and provisions; and
2. compliance with the provisions a. of this Federal Act, in particular Article 7 and Chapter 2; b. of Title II (Articles 3 to 13) as well as Article 26 of Regulation (EU) 600/2014, c. of Chapter II and of Chapter III of Delegated Regulation (EU) 2017/565; d. of Articles 4 to 17, Article 19 para. 2, Articles 20 to 24, Article 29 and Article 40 para. 1 of the Financial Markets Anti-Money Laundering Act; (FM-GwG; Finanzmarkt￾Geldwäschegesetz) and e. of the Investment Firms Act (WPFG; Wertpapierfirmengesetz) and Delegated Regulation (EU) 2019/2033. (4) The findings of the audit are to be presented in an Annex to the Audit Report (AzP) on the annual financial statement. This report shall be made available in a timely manner to the management and the supervisory bodies of the investment firm existing either in accordance with the law or their articles of association, so that the deadline for submission stated in para. 2 may be observed. Article 72. (1) Investment services providers pursuant to Article 4 shall, where they are required to keep accounts pursuant to Article 189 paras. 1 and 2 UGB, draw up an annual financial statement pursuant to the structure of Articles 224 and 231 UGB, and where they are not subject to the obligation to keep accounts Article 189 para. 4 UGB, shall draw up an income and expenditure statement in accordance with the provisions of Article 4 para. 3 of the Income Tax Act 1988 (EstG 1988; Einkommensteuergesetz 1988) published in Federal Law Gazette no. 400/1988. (2) The annual financial statements or income and expenditure statements drawn up pursuant to para. 1 and the audit reports drawn up pursuant to para. 4 must be submitted at latest within six months after the end of the financial year to the FMA. (3) Investment services providers shall appoint one of the persons specified in Article 268 para. 4 UGB to review compliance with the provisions of this Federal Act, in particular Articles 7 and 10 and of Chapter 2 as well as Articles 4 to 17, Article 19 para. 2, Articles 20 to 24, Article 29 and Article 40 para. 1 FM-GwG; the provisions regarding the selection of the auditor pursuant to Article 271 para. 2 UGB shall apply. In the case of cooperative societies, the reviewing of the compliance with the provisions of this Federal Act shall conducted by the audit bodies of statutory audit institutions. The provisions regarding the auditor’s liability pursuant to Article 275 UGB shall apply accordingly.

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 80 / 126 (4) The findings of this review shall be included in a separate report. This report shall be submitted to the management of the investment services provider in a timely manner to allow the deadline for submission set out in para. 2 to be observed. Investor Compensation Article 73. (1) Investment firms that provide one or more of the services listed in Article 3 para. 2 nos. 2 to 10 shall be required to belong to a compensation scheme. In the case that such an investment firm does not belong to a compensation scheme, then the authorisation (licence) to provide investment services pursuant to Article 3 para. 2 shall lapse; Article 7 para. 2 BWG shall apply. If a structured deposit pursuant to Article 1 no. 13 is issued by a credit institution, then the credit institution shall be required to belong to a deposit guarantee scheme pursuant to Article 1 para. 1 or Article 59 no. 1 ESAEG, and shall in this regard be subject to the provisions of ESAEG conditional upon structures deposits being treated as deposits pursuant to Article 7 para. 1 no. 3 ESAEG. (2) The compensation scheme shall accept any investment firms entitled to provide services pursuant to Article 3 para. 2 nos. 2 to 10 as members. The compensation scheme shall be operated as a legal person in the form of a liability company. The compensation scheme shall ensure that, in the event of bankruptcy proceedings being initiated against any member or any notification being made by the competent authority pursuant to Annex II letter b of Directive 97/9/EC, that the claims of an investor arising services subject to guarantee obligations pursuant to Article 3 para. 2 nos. 2 to 10 shall be paid out, upon request, up to a limit of Euro 20 000 per investor or equivalent in foreign currency within three months from the point in time when amount and justification of such claim have been determined. The provisions of Article 46 para. 1 ESAEG regarding pending criminal proceedings as defined in Article 10 para. 1 no. 3 ESAEG as well as about support and information obligations towards the compensation scheme shall apply. (3) The compensation scheme shall compensate investors for claims arising from services subject to guarantee obligations pursuant to Article 3 para. 2 nos. 2 to 10 within the meaning of Articles 73 to 76 and the applicable provisions of the BWG where such claims arose as a result of the investment firm not being in a position, in accordance with legal or contractual provisions, to:

1. repay funds owed to or belonging to investors that are held for their account in connection with services subject to guarantee obligations pursuant to Article 3 para. 2 nos. 2 to 10; or
2. return instruments to investors that belong to them and which have been managed on account of such investors in connection with services subject to guarantee obligations pursuant to Article 3 para. 2 nos. 2 to 10. Claims as defined in Article 47 para. 2 ESAEG shall be excluded from compensation as well as components of the investment firm’s equity capital.

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 81 / 126 (4) For the purposes of Articles 73 to 76 an investor shall be any person that has entrusted funds or financial instruments to an investment firm in conjunction with services subject to guarantee obligations pursuant to Article 3 para. 2 nos. 2 to 10 (5) The following provisions in ESAEG shall apply with regard to services subject to guarantee obligations pursuant to Article 3 para. 2 nos. 2 to 10: Article 47 para. 1, Article 48 para. 1, Article 50 paras. 2 and 4, Article 52 and Article 53. (6) Any investment firms or investment services undertakings that are not required to be members of a compensation scheme shall notify their clients about this fact in writing no later than at the time of concluding the contract and, as applicable, shall inform them by public notice in their business premises. (7) Investment firms shall also point out to their retail clients, at latest at the time of concluding the contract, on a durable medium, whether their transactions with the customer also include proprietary products; all financial instruments, the sale of which is associated with a direct or indirect economic advantage for the investment firm, for a firm affiliated with such an investment firm or for a relevant person in this investment firm beyond the fee charged for this investment service shall be considered as proprietary products. (8) Furthermore, investment firms must point out to retail clients, at latest at the time a contract is concluded, on a durable medium that they are not allowed to accept client money when providing investment services to clients, where they do not have the necessary authorisation to hold client money. (9) The investment firms shall refer their clients to the FMA's publication regarding the possible range of market standard fees to their customers. For this purpose, the legal representation of interests of the financial service providers shall regularly conduct a survey of fees and make them known to the FMA; the FMA shall publish the range of market standard fees on its Internet presence. (10) The compensation scheme shall serve as an early warning system for investment firms; the auditors of the investment firms shall cooperate with the compensation scheme for the purposes of the early warning system. The member institutes shall be required to provide the compensation scheme with the data required for the purposes of the early warning system. The compensation scheme shall be considered as the controller pursuant to Article 4 (7) of Regulation (EU) 2016/679. The FMA shall cooperate with the compensation scheme for the purposes of the early warning system, in particular with regard to comparing and exchanging the reported data. Financing of the Investor Compensation Scheme Article 74. (1) The compensation scheme shall commit its member institutions to pay annual contributions and in addition to pay proportionate contributions without delay in the event of a pay￾out event, in order to be able to fulfil its compensation obligations. The contributions of the member institutions must cover the claims against the compensation scheme, as well as the costs arising from the activity of the compensation scheme. The member institutes shall communicate their

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 82 / 126 audited annual financial statements to the compensation scheme by 30 June of the following year, as well as any other data relevant to the payment of contributions, in particular also information on the number of clients. The compensation scheme shall take the necessary organisational action to enable the immediate assessment and pay-out of secured claims. (2) Annual contributions shall be:

1. for member institutions with up to 100 clients 1‰
2. for member institutions with up to 1000 clients 2‰
3. for member institutions with 1001 or more clients 3‰ of every member institution's revenues from services pursuant to Article 3 para. 2 nos. 2 to 10 in the respective financial year. Those member institutions that do not fulfil the conditions for classification as small and non￾interconnected investment firms pursuant to Article 12 (1) of Regulation (EU) 2019/2033 and that are allowed to hold client money, shall pay an annual contribution of 1 promille of the revenues of the member institution from services pursuant to Article 3 para. 2 nos. 2 to 10 in the respective financial year in addition to the contribution pursuant to nos. 1 to 3. The amount determined must therefore be paid to the compensation scheme by the respective member institution by 30 June of the following year. (2a) For
4. existing member institutions that no longer meet the requirements for classification as small and non￾interconnected investment firms pursuant to Article 12 (1) of Regulation (EU) 2019/2033, and
5. new member institutions that according to their business plan do not meet the requirements for classification as small and non￾interconnected investment firms pursuant to Article 12 (1) of Regulation (EU) 2019/2033, when being admitted as a member institution the compensation scheme shall prescribe an additional contribution equal in amount of an annual contribution pursuant to para. 2, provided that such member institutions provide one or more of the services listed in Article 3 para. 2 nos. 6 to 10. In cases pursuant to no. 2 this requirement shall be based on a calculation of the additional contribution obligation to be carried out by the compensation scheme on the basis of the revenues and the number of clients in the business plan of the new member institution. Once the audited annual financial statement has been submitted and other data required for the contribution to be made pursuant to the third sentence of para. 1 by the new member institution, the compensation scheme shall calculate its additional contribution obligation in a binding manner, and to request the difference compared to the prescribed amount from the new member institution, or to credit the difference to it as applicable. (3) Additional contributions (extraordinary contributions) shall be required in the event of compensation being paid out if the amount of the contributions received by the compensation scheme from the annual contributions is not sufficient to service its compliance obligations. The member institutions' contribution obligations shall be determined by the compensation scheme, and the amount of the calculated contributions prescribed on a pro rata basis to the member institutions based on their fixed overheads pursuant to Article 1 no. 71 of each individual member

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 83 / 126 from the preceding financial year as a proportion of the fixed overheads of all member institutions in the preceding financial year. (4) Until the amount of contributions received by the compensation scheme from annual contributions reaches the level of 5% of revenues of all member institutions the compensation scheme shall make up the shortfall between the available amount of contributions already received from annual contributions by means of insurance coverage or bank guarantees, also including damages sustained from criminal activities, using a part of the annual contributions to do so, limited to half thereof. This shall also apply if contribution amount falls below 5% of revenues. (5) The contributions shall be invested in gilt-edged investments by the compensation scheme until they are used for their intended purpose. Together with any claims pursuant to para. 4, these assets constitute special assets that must be held in trust by the compensation scheme. The compensation scheme shall draw up accounts for this special fund annually at the same time as the annual financial statement of the compensation scheme. The orderly management of the special fund shall be audited annually by an external auditor appointed by the compensation scheme. With regard to claims made against the compensation scheme, that have arising for reasons other than compensation obligations, execution may not be conducted against the special assets. The special fund shall be excluded from the bankruptcy of the compensation scheme. (6) Entitled claimants whose claims arising from services pursuant to Article 3 para. 2 nos. 2 to 10 subject to guarantee obligations may register their claims with the compensation scheme within a period of one year starting from the initiation of bankruptcy proceedings or the notification by the competent authority pursuant to Annex II lit. b of Directive 97/9/EC. The final clause of Article 46 para. 3 ESAEG shall apply. (7) The compensation scheme shall collect contributions from the member institutions without delay following the expiry of the filing period for claims in order to cover compensation claims. The contributions to be determined pursuant to para. 3 shall be limited for the individual member institutions, so that in a financial year, excluding the annual contributions pursuant to para. 2, contributions shall not exceed a maximum of 2.5% of the fixed overheads for the previous financial year pursuant to Article 10 para. 6. Member institutions may be required to pay an extraordinary contribution pursuant to para. 3 only twice within a five-year period. Where the compensation scheme is not able to pay out the secured claims in full, that it shall be required to take out loans or to issue debt securities in order to satisfy the remaining pay-out obligations. The compensation scheme, the member institutions of which or the clients of the member institutions shall have no claim of any kind as regards investor compensation against authorities for subsidies, other financial support or guarantees. The Federal Minister of Finance may however subject to specific statutory authorisation assume liability for the state guarantee for loans taken out by or debt securities issued by the compensation scheme, if so doing is necessary to avert significant damage for the financial centre. In the event of claims being asserted against these guarantees, the Austrian Federal Government may take recourse against the compensation scheme. Such a right of recourse shall be

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 84 / 126 limited to an extraordinary contribution pursuant to para. 3. The terms of loans or debt securities shall be arranged in such a way to match the maturity of the second extraordinary contribution due. (8) The compensation scheme shall ensure that the claims of an investor arising from services subject to guarantee obligations pursuant to Article 73 para. 3, which were registered in accordance with the provisions set out in para. 6, are paid up to maximum of Euro 20 000 or equivalent value in a foreign currency per investor at their request and within three months from the point in time when the amount and justification of the claim was determined. Article 13 para. 2 ESAEG shall apply as appropriate of the calculate and reimbursement of compensation. The compensation scheme shall be authorised to offset compensation claims against the claims of the member institution. Article 19 para. 2 of the Insolvency Code (IO; Insolvenzordnung) as published in Imperial Law Gazette No. 337/1914 shall apply. (9) If extraordinary obstacles exist with regard to the determination of claims or the raising of the amounts to be compensated, due to which the deadline pursuant to para. 8 cannot be met pursuant to para. 8, then this deadline shall be extended by a further three months. Furthermore, upon request by the compensation scheme, the FMA shall be authorised to extend this deadline by a further three months, where this is necessary in light of particular circumstances prevailing to avert damage to the national economy, in particular any threat to the stability of the financial system. (10) The compensation scheme shall collect contributions pursuant to para. 7 and shall settle compensation payments as a trustee. For this purpose,the compensation scheme shall draw up and maintain a list of all investor claims (para. 8) and the required contributions (para. 7). Contributions pursuant to para. 7 and claims pursuant to para. 8 shall be recorded off balance-sheet and the compensation scheme shall not establish any provisions to Article 198 para. 8 UGB. A breakdown of the assets held in trust shall be documented in an annex to the annual financial statement. Information obligations Article 75. (1) The compensation scheme shall

1. submit its annual accounts including the annex mentioned in Article 74 para. 10 to the FMA at latest within six months from the end of the financial year, and
2. notify the FMA without delay about any institution withdrawing from the protection scheme. (2) Credit institutions, which in conducting banking transactions have been entrusted with the acquisition, disposal, custody or management of the funds or instruments of the member institution, or those of its clients, shall provide the compensation scheme with the information required to determine such claims. Investment firms that have joined schemes voluntarily for supplementary cover Article 76. (1) Investments firms that provide services in Austria pursuant to Annex I Section A or Section B No. 1 of Directive 2014/65/EU via a branch pursuant to Article 19, provided that they are a member of an investor compensation scheme as defined in Directive 97/9/EC in their home country,

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 85 / 126 are authorised to also join the compensation facility in addition to the investor compensation scheme of their home Member State; in this case notifying the competent authority pursuant to Annex II point b of Directive 97/9/EC shall be considered a pay-out event. Supplementary membership shall apply only in relation to the investment services subject to guarantee obligations provided in Austria pursuant to Annex I Section A or Section B no. 1 of Directive 2014/65/EU, and only to the extent that Articles 73 and 74 afford greater or further-reaching protection of claims arising from investment services subject to guarantee obligations than the investor compensation scheme in the investment firm’s home Member State. The compensation scheme shall oblige investment firms that have voluntarily joined the scheme for supplementary cover to pay contributions on a pro rata basis without delay in the event of a pay-out of guaranteed claims arising from services subject to guarantee obligations. Article 50 paras. 2 and 4 ESAEG shall apply analogously to the calculation of contributions on a pro rata basis. In this instance, the investment firm that has joined on a voluntary basis for the purpose of supplementary cover, shall not be allowed to be treated worse than a comparable Austrian investment firm based on the type of institution and purpose of business. If an investment firm that has joined on a voluntary basis for the purpose of supplementary cover has several branches in Austria, such branches shall be considered as a single branch when calculating claims and the calculating of contributions pursuant to Article 50 ESAEG. (2) If the investment firm that has joined on a voluntary basis for the purpose of supplementary cover fails to meet its obligations, then compensation scheme shall notify the FMA of this being the case without delay. The FMA shall request the investment firm that has joined on a voluntary basis for the purpose of supplementary cover to meet its obligations, and at the same time notify the competent authority in the investment firm’s home Member State. If the investment firm that has joined on a voluntary basis for the purpose of supplementary cover fails despite such steps to meet its obligations being taken, then it may be excluded from the compensation scheme with a notice period of twelve month upon twelve months’ notice and subject to the approval of the home Member State’s competent authority. Any services pursuant to Annex I Section A or Section B No. 1 of Directive 2014/65/EUprovided prior to the time of such exclusion, shall remain covered thereafter by the supplementary investor compensation. Investors shall be notified about the cancellation of supplementary cover by the compensation scheme shall by means of an announcement in the Official Gazette of the Wiener Zeitung “Amtsblatt zur Wiener Zeitung” and in at least one other daily newspaper with national circulation. The investment firm that has been excluded shall display a public notice at its premises that states the fact that supplementary coverage has been cancelled and shall also highlight this as being the case in both its advertising and in any contractual documents. (3) The compensation scheme shall cooperate with the investor compensation schemes of EU Member States in accordance with Annex II to Directive 97/9/EC. Investment firms pursuant to para. 1 shall provide the competent protection scheme in their home Member State with any information required that it requires to ensure that investors shall be compensated without delay and in an orderly manner. Otherwise, the provisions of Articles 73 to 75 and Articles 95 and 96 shall

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 86 / 126 apply to investment firms as defined in para. 1, including the provisions of the BWG referred to therein. (4) Investment firms that establish branches in another Member State under the freedom of establishment shall similarly be entitled in relation to the investment services provided in this Member State, to also join the relevant investor compensation scheme for supplementary cover. In the event of the bankruptcy of the investment firm, the FMA shall submit the notification defined in Annex II letter b of Directive 97/9/EC to the competent authority in the host Member State. Receivership and Insolvency Provisions Article 77. The provisions of Article 81 to 81m BWG shall apply to investment firms as defined in Article 4 (1) (2) of Regulation (EU) No 575/2013 with the exception that instead of the reference to Article 82 para. 2 BWG in Article 81 para. 2 BWG this reference shall instead be to Article 79 para. 2 of this Federal Act, and instead of the references to Article 9ff of Directive 2013/36/EU in Article 81 para. 3 BWG the reference shall instead be to Article 5 of Directive 2014/65/EU. Article 78. Articles 79 to 88 shall only apply to investment firms and investment services providers in the legal form or a joint stock company (Kapitalgesellschaft) or a cooperative society (Genossenschaft) (Article 3 para. 5 no. 1). Article 79. (1) Recovery proceedings may not be initiated against the assets of an investment firm or an investment services provider. The bankruptcy of an investment firm or an investment services provider undertaking shall not include any petition to institute a recovery plan. (2) The FMA shall have the status of a party to the proceedings for any receivership and bankruptcy proceedings regarding investment firms and investment services providers. (3) The petition to open bankruptcy proceedings in regard to investment firms may only be filed by the FMA, and regarding investment services providers may also be filed by the FMA, whereas during receivership in both cases such a petition may be filed only by the receiver. Otherwise, Article 70 IO shall apply. (4) A legal person may also be appointed as receiver. (5) The court shall consult the FMA prior to appointing or dismissing any receiver or administrator. (6) The court shall notify the FMA without delay about the receivership order by sending a court order. Article 80. (1) Investment firms or investment services providers that are either overly indebted or unable to pay, may, if it is expected that the overindebtedness or incapacity to pay may be resolved, may apply to be placed into receivership at the competent court for initiating bankruptcy proceedings. The FMA may also submit this application. (2) Investment firms and investment services providers shall submit a structured list of their receivables and liabilities as well as the annual financial statements including the annexes and management reports for the last three years. (3) The court may hear witnesses and experts and conduct other analyses for preparing its decision.

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 87 / 126 Article 81. (1) If receivership is ordered, then the court shall appoint a natural or legal person to act as receiver. The receiver shall by responsible for monitoring the management of the investment firm or the investment services provider. The receiver shall be liable to all parties involved for any damage caused by the negligent performance of his/her function. (2) The receiver shall be entitled to inspect the business records of the investment firm or investment services provider; the receiver shall be invited to the meetings of their management or supervisory bodies and may also convene such meetings. The receiver shall be authorised to prohibit the passing of resolutions by the body of the investment firm or the investment services provider. (3) The court may revoke the appointment of the receiver at any time. (4) The receiver shall be entitled to be remunerated for the activities; the amount of which shall be determined by the court. (5) The receivership order and appointment of the receiver shall be made public. The court shall arrange for the receivership order and the appointment of the receiver to be entered into the Commercial Register. Article 82. Receivership shall take effect from the start of the day following the public announcement of the court order about the receivership order. Article 83. (1) Once receivership takes effect, all claims that have previously arisen against the investment firm or against the investment services provider, including any receivables from bills of exchange or cheques, which in case of bankruptcy would have to be satisfied from the joint bankruptcy estate (Article 50 IO), as well as interest and other ancillary charges applying to them shall be deferred, even if they only have become due or have been incurred during receivership. (2) After ordering receivership, the court shall have the financial situation of the investment firm or the investment services provider assessed by experts, the cost of the assessment being borne by the entity in receivership. The receiver must report to the court in writing on the result of this assessment. The report shall also indicate whether the investment firm or the investment services provider is able to pay a certain fraction of the liabilities it incurred before receivership legally took effect. Based on the report, the court may order that only a fraction of the prior claims be subject to cancellation; the court may also allow the receiver to settle prior claims in their entirety to be determined according to their type or amount. (3) During receivership, prior claims must neither be secured nor, unless partial payment is permitted (para. 2) paid out or satisfied in any way. (4) During receivership, bankruptcy proceedings may neither be instigated against old claims against the assets of the investment firm or the investment services provider, nor may a judicial pledge or right to satisfy a claim be acquired on the associated assets, provided that they are subject to a deferment of payment. (5) The period for which payment has been postponed as a result of such deferral shall not be included when calculating the period of limitation and the statutory periods to file suits.

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 88 / 126 (6) In the event of bankruptcy of the investment firm or investment services provider, investors shall be entitled to offset their claims against the investment firm or against the investment services provider against its receivables. Article 84. (1) If the investment firm or the investment services provider, for which receivership has been ordered, is a cooperative society then the shares may neither be terminated with legal effect during receivership and nor may shares and the credit balance otherwise due to the retiring cooperative shareholder on the basis of the cooperative agreement be paid out; ongoing termination or liability periods will be suspended. (2) The investment firm or the investment services provider may continue to conduct its business activities, unless the court has ordered to the contrary at the receiver's request. However, the consent of the receiver must be obtained to conduct transactions that are not part of normal business operations. The investment firm of the investment services provider shall also refrain from activities forming part of normal business operations, if the receiver objects to such activities. Legal acts carried out without the consent or against the objection of the receiver shall be ineffective towards the creditors, in the event that the involved third party knew, or ought to have known, that such acts exceeded the scope of normal business operations, and the receiver had neither granted consent for, nor objected to those acts. (3) The funds, which the investment firm or the investment services provider receives from transactions concluded after receivership has commenced (new claims), shall be accounted for and administered separately; these funds – even after the expiration of receivership – shall constitute a special bankruptcy estate for the purpose of the preferential settlement of new claims. Article 85. After two years following the termination of receivership, the investment firm or the investment services provider may apply, unless bankruptcy proceedings have been initiated against its assets during this period of time, to have the obligation waived to account for and administer the funds received on the basis of new claims separately. If such an application is submitted, the court shall review the applicant's financial situation. If this review reveals the security of the new claims are not jeopardised by such an exemption, the request shall be approved; thereafter the special bankruptcy estate shall be deemed to be dissolved. Article 86. The court shall issue an order deciding any disputes resulting from the receiver’s instructions. The court may also obtain the required information without the involvement of the parties and, by virtue of office, carry out all suitable analyses in order to make the necessary determinations. Article 87. (1) Receivership shall be terminated by a court decision revoking receivership, as well as by the initiation of bankruptcy proceedings. (2) The court shall terminate receivership, if:

1. the conditions which prompted the receivership order no longer exist, or
2. a period of one year has passed since receivership was ordered.

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 89 / 126 (3) The lifting of the receivership order shall be announced publicly once the decision to lift receivership has become legally effective. The court shall also arrange that the termination of the receivership order is entered in, and the receiver deleted from, the commercial register. (4) In cases where the receivership order is terminated due to the initiation of bankruptcy proceedings, or where bankruptcy proceedings are initiated on the basis of a petition submitted within 14 days following the termination of receivership, then the periods to be calculated retroactively from the date of the petition for the initiation of such proceedings or from the date of initiation of such proceedings in accordance with the Insolvency Code (IO) are to be calculated from the date on which receivership entered into effect. (5) The investment firm or investment services provider as well as the FMA shall have the right to appeal against the rejection of an application for receivership or against the lifting of the receivership order; however, only the investment firm or the investment services provider may appeal against orders in which the amount of the receiver’s remuneration or their expenses to be reimbursed are addressed. Other decisions may not be contested. Appeals beyond rulings of the provincial superior court will not be permitted. Article 88. (1) The provisions of the Insolvency Code (IO; Insolvenzordnung) shall apply to public announcements. (2) Inspection rights in the insolvency database shall no longer be granted, if three years have elapsed since the lifting of receivership. In cases where receivership was terminated due to the initiation of bankruptcy proceedings, then such an inspection shall be permitted until the period for inspection in bankruptcy proceedings has also expired (Article 256 IO). SECTION 2: SUPERVISORY POWERS AND PROCEDURAL PROVISIONS Costs Article 89. (1) The FMA's costs from the accounting group Securities Supervision (Article 19 para. 1 no. 3 and para. 4 FMABG) shall be refunded by the institutions subject to reporting requirements, issuers, investment firms, investment services providers, investment firm pursuant to Article 19 para. 1 as well as third country firms pursuant to Article 21 para. 1, that perform investment services or activities in Austria through a branch as well as other legal entities subject to costs in the accounting group Securities Supervision on the basis of other provisions under national law. Taking into account the costs-by-cause principle and the economic interest in functional supervision of investment services, such supervision costs shall be allocated based on the FMA’s cost accounting. The FMA shall in any case for this purpose form separate sub-accounting groups in the accounting group for Securities Supervision for institutions subject to reporting requirements, for issuers with the exception of the Federal Government, as well as a collective sub-accounting group for investment firms, investment services providers and investment firms pursuant to Article 19 para. 1

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 90 / 126 as well as third country firms pursuant to Article 21 para. 1 that perform investment services or activities via a branch. The allocation of costs within the sub-accounting groups shall be performed on the basis the Regulation to be issued in accordance with para. 2. (2) The amounts to be allocated to the parties liable to pay costs pursuant to para.1 shall be prescribed by the FMA by means of an administrative decision; it shall be permitted to determine fixed amounts. The FMA shall determine more detailed regulations regarding the breaking down of such costs, and their prescription by means of a regulation. In particular, the following shall be defined:

1. the assessment base for the individual types of fees prescribed;
2. deadlines for payment notifications and timeframe for payments by the parties liable to pay. When issuing regulations pursuant to nos. 1 and 2, the type and scope of transactions required to be reported and the investment services provided shall be taken into account, and with regard to the issuers, the type and scope of the issued instruments required to be reported. The parties liable to pay and all operators of a trading venue in Austria shall provide the FMA with all required information with regard to the bases for cost assessment. Supervision Article 90. (1) The FMA shall monitor compliance with the provisions of: this Federal Act as well as any regulation issued on the basis of this Federal Act; Regulation (EU) No 600/2014 and, as applicable, Regulation (EU) No 575/2013 as well as delegated Regulation issued on the basis of these EU Regulations or Directive 2014/65/EU or any decision issued on the basis of Article 40 or 41 of Regulation (EU) No 600/2014 or any relevant Technical Standards issued as defined in Articles 10 to 15 of Regulation (EU) No 1095/2010 for the purpose of supervision over legal entities, by:
3. investment firms,
4. investment services providers,
5. credit institutions pursuant to Article 1 para. 1 BWG with regard to Chapter 2 of this Federal Act and Titles III and IV of Regulation (EU) No 600/2014,
6. credit institutions and financial institutions from Member States pursuant to Articles 9 et seq. BWG with regard to Articles 47 to 67, 69 and 70 of this Federal Act, Articles 36 and 44 to 70 of Delegated Regulation (EU) 2017/565 as well as Articles 14 to 26 of Regulation (EU) No 600/2014,
7. investment firms from Member States pursuant to Article 17 para. 1 that conducting activities in Austria through a branch, with regard to Articles 47 to 67, 69, and 70 of this Federal Act, Article 36 and Articles 44 to 70 of Delegated Regulation (EU) 2017/565, Articles 14 to 26 of Regulation (EU) No 600/2014, Articles 34 to 38 and Article 41 and Article 93 para. 2 BWG, the provisions of the Financial Markets Anti-Money Laundering Act (FM-GwG; Finanzmarkt￾Geldwäschegesetz), published in Federal Law Gazette I No 118/2016 and Article 52 ESAEG,
8. branches of third-country firms with regard to the provisions listed in Article 23 para. 2,

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 91 / 126 7. recognised investment firms with their place of incorporation in a third country, local firms, and members of a co-operating exchange active at an Austrian stock exchange (Article 29 para. 5 BörseG 2018) with regard to Chapter 2 of this Federal Act, Titles III and IV of Regulation (EU) No 600/2014, Articles 39 para. 3 and 41 BWG and the provisions of the FM￾GwG, 8. insurance undertakings within the scope of Article 2 para. 2, 9. management companies pursuant to Article 5 para. 1 InvFG 2011 as well as AIFMs pursuant to Article 4 AIFMG within the scope of Article 2 para. 3, 10. approved publication arrangements (APAs) pursuant to Article 1 no. 60 that are subject to supervision by the FMA in accordance with the delegated act issued on the basis of Article 2 (3) of Regulation (EU) No 600/2014, 11. approved reporting mechanisms (ARMs) pursuant to Article 1 no. 62 that are subject to supervision by the FMA in accordance with the delegated act issued on the basis of Article 2 (3) of Regulation (EU) No 600/2014, and in doing so shall take into account the economic interest in a functioning capital market as well as the investors’ interests. In enforcing the provisions listed, the FMA shall take into account European convergence with respect of supervisory tools and supervisory procedures. For this purpose, the FMA shall apply the Guidelines, Recommendations and other measures decided upon by the ESMA. The FMA may deviate from the guidelines and recommendations, provided justified grounds exist to do, in particular where they conflict provisions set out under national law. (1a) The FMA shall monitor ongoing compliance with

1. the regulations contained in Regulation (EU) 2019/2088 on sustainability-related disclosures in the financial services sector, and
2. the regulations contained in Articles 5, 6 and 7 of Regulation (EU) 2020/852 on the establishment of a framework to facilitate sustainable investment by investment firms, that provide portfolio management or investment advice, and credit institutions pursuant to Article 1 para. 1 BWG, that provide portfolio management or investment advice. Without prejudice to the powers assigned to it in the aforementioned Regulations, for this purpose, the FMA shall in particular be conferred the powers pursuant to para. 3 nos. 1 and 2. (2) The FMA shall conduct all investigations necessary on the basis of the duties conferred upon it in accordance with the Federal Act, and shall take any measures that are necessary
3. in order to be able to assess and ensure the orderly nature and fairness of trading in instruments registered on a regulated market of a Member State (Article 2 no. 5 BWG);
4. in order to guarantee the safeguarding of investors’ interests as defined in Chapter 2 when providing investment services and activities;
5. in order to provide other administrative authorities, in particular the Federal Minister of Finance, the European Commission, the ESMA and the competent authorities (Article 4 (1) (40) of Regulation (EU) No 575/2013) of other Member States, with the necessary information for the fulfilling of their duties in accordance with the BWG and the other valid laws for credit

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 92 / 126 institutions (Article 69 para. 1 BWG) or their duties pursuant to Regulation (EU) 596/2014, Regulation (EU) 600/2014 as well as Directives 2014/57/EU, 2014/65/EU, 2004/109/EC and 2013/36/EU and in order to ensure cooperation and the exchange of information in accordance with paras. 5, 6 and Section 4 of this Chapter. (3) When exercising its competences pursuant to paras. 1 and 2, the FMA shall, notwithstanding the powers afforded to it in the provisions of other Federal Acts, the FMA shall at any time be authorised to,

1. access records, documents and durable media of the legal entities pursuant to para. 1 regardless of their technical format, and to receive copies of them;
2. request information from the legal entities pursuant to para. 1 and from their bodies and to summon and question persons in accordance with administrative procedural law;
3. conduct on-site inspections using its own inspectors, statutory auditors or other experts;
4. request existing recordings of telephone calls and data transmissions from the legal entities pursuant to para. 1;
5. take measures pursuant to Article 92 para. 8 of this Federal Act in conjunction with Article 70 para. 4 BWG to prevent breaches of law and to permanently guarantee compliance with licensing requirements;
6. order temporary confiscations and confiscations; temporary confiscations lapse in the event that a confiscation order is not issued by the FMA in the form of an administrative decision within four weeks;
7. conduct searches (Article 117 no. 2 and no. 3 lit. a of the Code on Criminal Procedure (StPO; Strafprozessordnung)); Articles 119 to 122 StPO shall apply with the proviso that the procedural provisions pursuant to Article 153 paras. 2, 4 to 7 and 9 BörseG 2018 apply to searches pursuant to Article 117 no. 2 lit. b StPO;
8. take measures against managers pursuant to Article 92 paras. 1 and 8 of this Federal Act and pursuant to Article 70 paras. 2 and 4 BWG;
9. obtain information from auditors and statutory audit institutions of legal entities pursuant to para. 1;
10. report any suspicion of criminal offences pursuant to Article 78 StPO to a Public Prosecutor's Office or to security authorities;
11. make public announcements as defined in Article 93 para. 2 no. 19 BörseG 2018;
12. demand a request for information about data contained in a message transmission pursuant to Article 134 no. 2, Article 135 para. 2 and Article 137 para. 1 StPO (including the data listed in Article 76a StPO) and to consult the findings of such investigative procedures that have already been filed and to receive copies of them, where justified suspicion exists that there has been a breach against the provisions of this Federal Act or Regulation (EU) No 600/2014 and these records could be relevant for an investigation in conjunction with these breaches; the procedural provisions pursuant to Article 153 paras. 3 to 6 BörseG 2018 shall apply to a request for information about data in a message transmission;

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 93 / 126 13. suspend the distribution or sale of financial instruments or structured deposits, where the conditions listed in Articles 40, 41 or 42 of Regulation (EU) No 600/2014 are satisfied; 14. suspend the distribution or sale of financial instruments or structured deposits, in the case that the legal entity pursuant to para. 1 has not developed or does not apply an effective approval procedure for products, or has otherwise breached Articles 30 and 31 of this Federal Act; 15. determine measures in the public interest pursuant to Article 42 of Regulation (EU) No 600/2014 by means of a regulation or an administrative decision 16. take all necessary measures to verify that legal entities pursuant to para. 1 have in place organisational arrangements to ensure that the issuer-sponsored research that they produce or distribute complies with the EU code of conduct for issuer-sponsored research; 17. suspend the distribution by legal entities pursuant to para. 1 of any issuer-sponsored research not produced in compliance with the EU code of conduct for issuer-sponsored research; 18. issue warnings to inform the public where research labelled as ‘issuer-sponsored research’ and distributed by an investment firm, is not produced in compliance with the EU code of conduct for issuer-sponsored research, that that research was not produced in compliance with the EU code of conduct for issuer-sponsored research. The FMA may also exercise the powers listed in nos. 1 to 4 directly against tied agents and securities brokers. (4) The FMA shall be authorised to process personal data, provided that doing so is an essential condition for the performed of the following tasks conferred upon it in accordance with this Federal Act, the Investment Firms Act (WPFG) and the Stock Exchange Act 2018 (BörseG 2018):

1. licensing of investment firms and investment services providers and the relevant circumstances for granting such licences;
2. management, administrative and accounting organisation as well as internal controlling and audit of investment firms, investment services providers and institutions subject to reporting obligations;
3. branches and the exercising of the freedom to provide services;
4. information about transactions pursuant to Title IV of the Regulation (EU) No 600/2014;
5. compliance with the provisions contained in Chapter 2;
6. (repealed in Federal Law Gazette I 48/2025);
7. equity capital;
8. qualified holdings in investment firms and investment services providers;
9. annual financial statements and accounting;
10. supervisory measures pursuant to Article 92 paras. 8 to 10 and Articles 27 and 28 WPFG;
11. administrative penalties pursuant to Articles 94 to 96, Article 49 WPFG and pursuant to Articles 72, 75, 107, 154, 155 and 156 BörseG 2018;
12. investigations pursuant to paras. 3 and 7, Article 3 para. 2 WPFG, Article 93 para. 2 and Article 140 para. 1 BörseG 2018, Article 14 KMG 2019 and Article 22b FMABG;

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 94 / 126 13. information obtained from competent authorities as part of an exchange of information pursuant to Articles 104 to 111 or pursuant to Articles 101, 102 and Article 140 paras. 3 and 4 BörseG 2018 or by way of Article 21 FMABG; 14. cooperation in the early warning system pursuant to Article 73 para. 10. The FMA shall be authorised to process personal data, provided doing so is an essential condition for the performed of the following tasks conferred upon it in accordance with this Federal Act and the BörseG 2018: (5) The transmission of data pursuant to para. 4 and of data that the FMA may request in accordance with its powers, as well as the conclusion of cooperation agreements pursuant to Article 111, shall be permitted within the scope of official assistance as well as for the competent authorities of Member States that are responsible for securities supervision, provided that doing so is necessary for the performance of tasks corresponding to the tasks of the FMA in accordance with this Federal Act, the BörseG 2018 or Commission Regulation (EU) No. 600/2014, or is necessary for other statutory tasks in relation to the supervision of the financial market for the requesting competent authority for securities supervision, and provided that a justified request has been made and the transmitted data are subject to a comparable confidentiality regime at such authorities as the confidentiality regime pursuant to Article 14 FMABG. (6) The transmission of data pursuant to para. 4 shall also only be permitted to authorities in third countries which are required to perform tasks equivalent to the FMA within the same scope, for the same purposes, and subject to the same restrictions as to competent authorities in Member States pursuant to para. 5 provided that the transmitted data are subject to a comparable confidentiality regime as the confidentiality regime pursuant to Article 14 FMABG, and if they are in keeping with Chapter IV of Regulation (EU) 2016/679. (7) For the purposes of cooperation and the exchange of information pursuant to paras. 5 and 6, the FMA may also make use exclusively for the purposes of such a cooperation, provided that so doing is necessary for fulfilling duties that correspond to the FMA's duties in accordance with this Federal Act, the BörseG 2018, the KMG 2019 or the WPFG, or where this is necessary for the fulfilment of other statutory duties in the context of the supervision of the financial market by the requesting authority responsible for securities supervision, and provided that the requesting authority would act in the same manner in the event of receiving a comparable request for cooperation and for the exchange of information, even if the conduct that is the subject of the investigation does not constitute any breach of a regulation that is applicable in Austria. The FMA may also exercise any powers at its disposal pursuant to para. 3 nos. 1 to 4 and 9 for the purpose of such a cooperation against natural and legal persons, who are not authorised to or who are only authorised in their country of origin to provide investment services or investment activities as defined in Directive 2014/65/EU. (8) The FMA shall be authorised to determine measures pursuant to para. 3 no. 15 by means of a regulation or an administrative decision subject to the proviso that they apply to investment services providers, management companies pursuant to Article 5 para. 1 InvFG 2011, that provide services pursuant to Article 5 para. 2 no. 3 or no. 4 InvFG 2011, or AIFMs pursuant to Article 4 AIFMG, that

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 95 / 126 provide services pursuant to Article 4 para. 4 no. 1 or no. 2 lits. a or c AIFMG. Article 42 (3) and (4) as well as Article 43 of Regulation (EU) No. 600/2014 shall not apply to such measures. (9) The Landesgericht für Strafsachen Wien (Vienna Regional Criminal Court) shall adjudicate upon the application of the FMA in accordance with para. 3 no. 6 or 11 in a single judge procedure by means of a resolution (Article 86 StPO), and applying the principle of legality and proportionality, in accordance with Article 5 StPO. The FMA shall justify its application (Article 102 para. 2 nos. 2 to 4; applications in accordance with para. 3 no. 12 shall in addition also contain the information prescribed in Article 138 para. 1 no. 1, 3 and 4 stop) and shall be submitted to the court with the accompanying files. (10) The provisions of this Federal Act shall remain unaffected by the provisions of Section 14 of the Telecommunications Act 2021 (TKG 2021; Telekommunikationsgesetz 2021). (11) The FMA, as the competent authority for Titles II and III of Regulation (EU) No. 600/2014, may by means of a Regulation grant waivers with regard to pre-trade transparency pursuant to Articles 4 and 9 of Regulation (EU) No 600/2014 as well as deferrals for post-trading transparency pursuant to Article 7, Article 11 (3), Article 20 (2) and Article 21 (4) and (4a) of Regulation (EU) No. 600/2014. ESAP collection body for the purposes of Regulation (EU) 2019/2088 and information submitted on a voluntary basis Article 90a. (1) The FMA shall be the collection body as defined in Article 2 point 2 of Regulation (EU) 2023/2859 pursuant to Article 18a (1) and (3) of Regulation (EU) 2019/2088 for credit institutions and investment firms, which act as financial market participants pursuant to Article 2 point 1 of Regulation (EU) 2019/2088 or as financial advisers pursuant to Article 2 point 11 of Regulation (EU) 2019/2088, and shall make this information available in the ESAP. (2) The FMA is the collection body as defined in Article 2 point 2 of Regulation (EU) 2023/2859 pursuant to Article 3 (2) of Regulation (EU) 2023/2859 for the collection of information on a voluntary basis listed in

1. Directive 2014/65/EU,
2. Regulation (EU) No 600/2014 and
3. Regulation (EU) 2019/2088, provided that the information is submitted by credit institutions or investment firms that act as financial market participants pursuant to Article 2 point 1 of Regulation (EU) 2019/2088 or as financial advisers pursuant to Article 2 point 11 of Regulation (EU) 2019/2088. (3) The FMA may determine, by means of a Regulation, a specific format, additional meta data to be included and the submission modalities for the submission of data pursuant to para. 2, if this appears expedient taking into consideration rules under European Union law. The FMA shall be empowered as the controller under data protection law pursuant to Article 4 point 7 of the General Data Protection Regulation in conjunction with the tasks pursuant to paras. 1 and 2 for processing personal data in accordance with the General Data Protection Regulation.

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 96 / 126 Form of communication with the FMA - electronic transmission Article 91. The FMA may prescribe by means of a Regulation that notifications and other communications pursuant to Article 3 para. 8 in conjunction with Article 4 para. 3 BWG, Article 7 in conjunction with Article 25 (2) and Article 31 (2) of Delegated Regulation (EU) 2017/565 in conjunction with Article 4 para. 3 as well as Article 73 para. 1 nos. 1 to 8 and 11 BWG, Article 12 para. 8, Article 14 para. 4, Article 18 paras. 1 and 3 to 5, Article 20 paras. 1, 6 and 7, Article 44, Article 71 para. 2, Article 72 para. 2, and Article 90 para. 3 nos. 1, 2 and 4 of this Federal Act shall only be made in electronic form, and shall be required to conform to specific formats, minimum technical requirements and transmission modalities. In so doing, the FMA shall observe the principles of economy and expediency, ensuring that data is electronically available to the FMA at all times and that supervisory interests are not compromised. Furthermore, in this Regulation the FMA may also require statutory auditors on a voluntary basis to use the electronic data transmission system in accordance with the first sentence of this Article for reports and notifications pursuant to Article 93 paras. 1 and 2 and for submissions pursuant to Article 90 para. 3 no. 9 of this Federal Act. The FMA shall ensure appropriate arrangements are in place that the parties subject to reporting requirements or as applicable the individuals charged with submitting the reports are able to check the accuracy and completeness of the data in the system for a reasonable period of time that was reported by them or their submission officers. Additional supervisory measures Article 92. (1) To avert any threat to the financial interests of the clients of a legal entity pursuant to Article 90 para. 1 nos. 1 and 2 in connection with its activities, the FMA may, in the case of legal entities with the legal form of a joint stock company or a cooperative society (Article 3 para. 5 no. 1) issue temporary measures by means of an administrative decision, which shall expire no later than 18 months following the date upon which they become effective. In particular, the FMA may by way of an administrative decision:

1. partially or fully prohibit the withdrawal of capital or earnings;
2. appoint an expert supervisor (government commissioner), who belongs to the legal or auditing profession; the supervisor, who shall be afforded full rights pursuant to Article 90 para. 3, shall a. prohibit this legal entity from conducting any transactions, that are suited to exacerbating the aforementioned threat, or b. in the case that the legal entity has been partially or fully prohibited from continuing transactions, to allow individual transactions that will not exacerbate the aforementioned threat;
3. partially or fully prohibit managers of the legal entity from managing the company, at the same time notifying the body responsible for appointing managers; the competent body shall appoint the relevant number of managers within one month; such appointments shall require

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 97 / 126 the FMA’s approval to be legally effective, and such appointments shall be rejected in the case that the newly appointed managers do not appear suitable to be able to avert the aforementioned threat; 4. to partially or fully prohibit the continuation of business operations. (2) The FMA may, at the request of the supervisor (government commissioner) appointed pursuant to para. 1 no. 2 or para. 3, appoint a deputy, if and for as long as is necessary for important reasons, especially in the event of the supervisor being temporarily prevented from performing their duties. The provisions applicable to the supervisor as well as his rights and duties shall also apply to the appointment of any deputy. Subject to the FMA's approval, the supervisor (government commissioner) may enlist suitably qualified persons to assistance in the performance of his tasks if required in light of scope and difficulty of the tasks. The FMA’s approval shall specify such persons by name and shall also be delivered to the legal entity. Such persons shall act on orders given by, as well as on behalf of the supervisor (government commissioner) or their deputy. (3) The FMA shall obtain information regarding suitable government commissioners from the Austrian Bar Association (Österreichischer Rechtsanwaltskammertag) as well as from the Austrian Chamber of Chartered Accountants and Tax Advisors (Kammer der Wirtschaftstreuhänder). If a government commissioner in accordance with para. 1 no. 2, or a deputy in accordance with para. 2, is required to be appointed, and such an appointment is not possible on the basis of such information, the FMA shall notify the competent Bar Association at the place of incorporation of the legal entity or the Chamber of Chartered Public Accountants and Tax Consultants to nominate a suitably qualified lawyer or auditor as government commissioner. In cases of imminent danger, the FMA may appoint

1. a lawyer, or
2. an external auditor as a temporary government commissioner. Such an appointment shall cease to be effective upon appointment of a lawyer or auditor in accordance with the first sentence. (4) All measures ordered by the FMA pursuant to paras. 1 and 2 shall be suspended for the duration of any receivership procedure. (5) The government commissioner shall be remunerated by the FMA (function fee), which is commensurate to the work associated in supervision and the expenses incurred for this purpose. The government commissioner shall be entitled to render accounts for each preceding quarter and after completion of its activities. The FMA shall pay such remuneration without delay after reviewing the invoice. (6) The FMA shall be authorised to notify the public of any supervisory measures it takes in accordance with paras. 1, 3 and 8 by publishing them in a national daily newspaper or on the Internet or by public notice at a suitable location in the business premises of the legal entity pursuant to Article 90 para. 1 nos. 1 and 2. The publication of measures taken in accordance with para. 8 in conjunction with Article 70 para. 4 no. 1 BWG shall only occur where it is necessary to inform the public due to the nature and severity of the breach. Such publication measures may also be taken

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 98 / 126 on a cumulative basis. The party affected by the publication may file a request to the FMA to review the lawfulness of such a publication in a procedure concluded by means of an administrative decision. In this case, the FMA shall notify the public of the initiation of such a procedure in the same way. If, in the course of this review, it is found that the publication was unlawful, then the FMA shall correct the publication or, at the request of the person subject to this publication, either revoke it or remove it from its website. If suspensory effect is granted to a complaint against an administrative decision pursuant to paras. 1, 3 or 8 in a supreme court procedure, the FMA shall announce this in the same way. The publication shall be corrected, or, upon request of the concerned party, revoked or removed from the website if the administrative decision is repealed. (7) Administrative decisions that fully or partially prohibit managers from managing a legal entity Article 90 para. 1 nos. 1 to 3 (para. 1 no. 3 and para. 8) as well as any repealing of this measure shall be communicated by the FMA to the Commercial Register Court (Firmenbuchgericht) for entry into the Commercial Register. (8) If a legal entity pursuant to Article 90 para. 1 nos. 1 to 3 breaches provisions of this Federal Act, or a Regulation issued on the basis of this Federal Act, of Regulation (EU) No 600/2014 or any Delegated Regulation issued on the basis of these EU Regulations or of Directive 2014/65/EU, or any relevant Technical Standards issued as defined in Articles 10 to 15 of Regulation (EU) No 1095/2010 for the purpose of supervision over legal entities, or any administrative decision issued or a decision issued on the basis of Article 40 or 41 of Regulation (EU) No 600/2014, then the FMA shall take the measures listed in Article 70 para. 4 nos. 1 to 3 BWG in relation to this legal entity; where investment services are provided on the basis of holding a legal licence to do so, instead of revoking the licence or approval, the continuing provision of investment services on the basis of this legal licence shall be prohibited. In the event that a legal entity listed in Article 90 para. 1 nos. 4 to 7, an insurance undertaking as defined in Article 2 para. 2, or a management company as defined in Article 2 para. 3 breaches provisions of this Federal Act, a Regulation issued on the basis of this Federal Act, of Regulation (EU) No 600/2014, of Regulation (EU) No 1031/2010 or any Delegated Regulation issued on the basis of this EU Regulation or of Directive 2014/65/EU or any relevant Technical Standards issued as defined in Articles 10 to 15 of Regulation (EU) No 1095/2010 for the purpose of supervision over legal entities, or any administrative decision issued, then the FMA shall take the measures listed in Article 70 para. 4 no. 1 BWG in relation to this legal entity; (9) In case of an inspection pursuant to Article 79 para. 3, the bodies conducting the inspection shall be issued with a written inspection engagement and prior to the commencement of the inspection shall prove their identity without being requested to do so and shall present the inspection engagement. Otherwise, Article 71 paras. 1 to 6 BWG shall apply. (10) For the purpose of inspecting branches and representative offices in other Member States, the FMA may also request the competent authorities of the host Member State to conduct such inspections, if this simplifies or expedites the procedure or if this is expedient in the interest of convenience, simplicity, quickness or cost-effectiveness; under such conditions, the FMA's own

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 99 / 126 inspectors may also participate in inspections conducted by the competent authorities of the host Member State. (11) The FMA may notify the public by way of publication on the Internet, or in a newspaper with nationwide circulation that a named natural or legal person is not authorised to perform certain investment services transactions (Article 3 para. 2 nos. 1 to 5), provided that this person has given cause for such action and informing the general public, and is reasonable with regard to any disadvantages suffered by the affected parties. Such publication measures may also be taken on a cumulative basis. The person must be clearly identifiable in the publication; for this purpose the FMA may also indicate, if known, the business or residential address, Commercial Register number, internet address, telephone number and fax number. The party affected by the publication may file a request to the FMA to review the lawfulness of such a publication in a procedure concluded by means of an administrative decision. In this case, the FMA shall announce the initiation of such proceedings in a similar manner. If, in the course of such a review, it is found that the publication was unlawful, the FMA shall correct the publication or, at the request of the person subject to this publication, either revoke it or remove it from its website. (12) The FMA shall provide, upon individual request, within a reasonable period of time, information about the scope of licences of legal entities in accordance with Article 90 para. 1 nos. 1 and 2. The FMA registers all legal entities and shall maintain a database that contains information about the current scope of the existing licences held by these legal entities, and shall make it possible to query these data via the Internet. Every registration and every withdrawal of authorisation shall be notified to the ESMA. In addition, the FMA shall also maintain a list of investment firms from Member States that are authorised to provide investment services in Austria under the freedom to provide services or via a branch in this database, provided that such activity in Austria has been notified in accordance with Articles 34 or 35 of Directive 2014/65/EU. (13) The FMA shall inform the ESMA about appeal procedures and redress procedures that are provided for in Austria. Reporting obligations of statutory auditors Article 93. (1) If a statutory auditor auditing the annual accounts of a legal entity specified in Article 90 para. 1 nos. 1 and 2 or performing any other activity required under law at the aforementioned legal entity, detects circumstances that justify a reporting obligation pursuant to Article 273 para. 2 UGB, he/she shall also notify the FMA without delay, at latest at the same time as submitting the report required pursuant to Article 273 para. 3 UGB. (2) Even where no reporting obligations exist pursuant to Article 273 para. 2 UGB, the auditor shall nevertheless notify the FMA and the management body as well as the competent supervisory body under law or in accordance with the statutes without delay of any factual circumstance about which he/she has obtained knowledge of while conducting his/her duties,

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 100 / 126

1. that could constitute a material breach against Regulation (EC) No 1287/2006 or, where applicable against Regulation (EU) No. 575/2013 or against Regulations or against Regulations or administrative decisions issued on the basis of Regulation (EU) No. 575/2013, or
2. that could constitute a material breach of this Federal Act, or regulation or administrative decisions issued based on this Federal Act, or
3. that could lead to the refusal to issue or qualification of the audit opinion. The statutory auditor shall furthermore be obliged to report any factual circumstances of which he has obtained knowledge about while performing any of the above activities in an undertaking that has close links to the legal entity specified in Article 90 para. 1 nos. 1 and 2 for which he/she performs such activities. (3) If the statutory makes such a notification in good faith in accordance with paras. 1 or 2, this shall not constitute a violation of a disclosure restriction governed by a contract or by legal or administrative provisions and shall not attach any liability to the external auditor. (4) Paras. 2 and 3 shall apply analogously to auditors of third country firms pursuant to Article 23 paras. 3 and 4 with regard to the provisions listed therein. Penal provisions Article 94. Anyone who provides investment services pursuant to Article 3 para. 2 without the necessary authorisation to do so commits an administrative offence and shall be punished by the FMA with a fine of up to EUR 5 million or up to twice the amount of the gain arising from the breach, where this amount is able to be determined. Article 95. (1) Anyone who, as the person responsible (Article 9 Administrative Penal Act (VStG; Verwaltungsstrafgesetz 1991), published in Federal Law Gazette No. 52/1991) of a legal entity, breaches
4. the monitoring and information requirements in relation to the governance arrangements pursuant to Article 12 paras. 3 to 6 and 8,
5. the notification requirements in relation to the proposed acquisition or increasing of a qualifying holding pursuant to Article 14 paras. 1 to 4,
6. the notification requirements with regard to the provision of investment services and the conducting of investment activities in the territory of another EU Member State pursuant to Article 18 paras. 1, 3 and 4,
7. the notification requirements in relation to the operation of an MTF or OTF in another Member State pursuant to Article 18 para. 5 first sentence,
8. the requirements in relation to the provision of investment services and the conducting of investment activities in Austria via a branch pursuant to Article 19 para. 5 first sentence,
9. the notification requirements in relation to the establishment of a branch in another Member State pursuant to Article 20 paras. 1, 2 and 7,

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 101 / 126 7. the notification requirements in relation to making use of a tied agent pursuant Article 20 para. 6 first sentence, 8. the notification requirements in relation to algorithmic trading systems pursuant to Article 27 para. 1, 9. the notification requirements in relation to algorithmic trading pursuant to Article 27 para. 2, 10. the recording and retention obligations in relation to algorithmic trading pursuant to Article 27 para. 4 and 5, 11. the requirements when following a market-making strategy in relation to algorithmic trading pursuant to Article 27 para. 6, 12. the monitoring obligations and the system requirements for the systems in relation to direct electronic access pursuant Article 28 paras. 1 and 6, 13. the reporting and retention obligations in relation to direct electronic access pursuant to Article 28 paras. 2 and 5, 14. an obligation in relation to the organisational requirements and the provisions for personal transactions ("compliance") pursuant to Article 29 of this Federal Act and Article 29 of Delegated Regulation (EU) 2017/565, 15. obligations with regard to product governance pursuant to Articles 30 and 31, 16. the requirements for the risk management and the internal audit unit pursuant to Article 32, 17. the obligation to keep records pursuant to Article 33, 18. the obligations in regard to the outsourcing of critical operation services to third parties pursuant to Article 34, 19. the obligations in regard to the provision of services via another legal entity pursuant to Article 35 para. 1 2nd sentence and Article 35 paras. 2 and 3, 20. the obligations in regard to the making use of tied agents pursuant to Article 36 paras. 3, 4, 6 and 7, 21. the obligations in regard to the protection of client funds pursuant to Article 38 paras. 1 and 2, 22. the information obligations in connection with the exercising of security interests, liens, or rights or set-off pursuant to Article 38 para. 6 to 8, 23. the obligations in regard to the custody of client financial instruments pursuant to Article 39, 24. the obligations in regard to the depositing of client funds pursuant to Article 40, 25. the obligations in regard to the usage of financial instruments of clients pursuant to Article 41, 26. the appropriate use of title transfer collateral arrangements pursuant to Article 42, 27. an obligation in relation to the governance for the safeguarding of client funds and the financial instruments of clients pursuant to Article 43, 28. its obligations with regard to the reports of the auditors pursuant to Article 44, 29. an obligation with regard to the handling of conflicts of interest pursuant to Articles 45 and 46, 30. an obligation to act in the best interests of the client pursuant to Article 47 paras. 1 to 5, 31. its information obligations towards clients pursuant to Article 48 para. 1 and Article 49,

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 102 / 126 31a. the obligation for transparency of the integration of sustainability risks pursuant to Article 6 (1) or (2) of Regulation (EU) 2019/2088; 31b. the obligation for transparency of the integration of sustainability impacts at financial product level pursuant to Article 7 (1) or (2) of Regulation (EU) 2019/2088; 31c. the obligation for transparency of the promotion of environmental or social characteristics in pre￾contractual disclosures pursuant to Article 8 (1) or (2) of Regulation (EU) 2019/2088; 31d. the obligation for transparency of sustainable investments in pre￾contractual disclosures pursuant to Article 9 (1), (2), (3) or (4) of Regulation (EU) 2019/2088; 31e. the transparency requirements in pre-contractual disclosures and in periodic reports a. regarding environmentally sustainable investments pursuant to Article 5 of Regulation (EU) 2020/852, b. regarding financial products that promote environmental characteristics pursuant to Article 6 of Regulation (EU) 2020/852, or c. regarding other financial products pursuant to Article 7 of Regulation (EU) 2020/852 32. an obligation in relation to providing investment advice on an independent basis pursuant to Article 50, 33. an obligation in relation to the granting or accepting of benefits pursuant to Article 51, 34. the requirements in relation to quality enhancement by granting or accepting of benefits pursuant to Article 52, 35. the requirements in relation to the granting or accepting of benefits in the case of providing investment advice on an independent basis pursuant to Article 53 paras. 1, 2 and 3, 36. the disclosure requirements in relation to the granting or accepting of minor non-monetary benefits pursuant to Article 53 paras. 4 to 7, 37. the requirements in relation to the granting or accepting of benefits in conjunction with investment research pursuant to Article 54, 38. the requirements in relation to the knowledge and competence of natural persons in conjunction with the provision of investment advice or giving information to clients about investment products as well as investment services and ancillary services pursuant to Article 55, 39. the obligation to review the suitability of investment advice and portfolio management services for the client pursuant to Article 56, 40. the obligation to review the suitability of other investment services for the client pursuant to Article 57, 41. the requirements in relation to the execution, acceptance or transmission of client orders pursuant to Article 58, 42. the documentation obligations pursuant to Article 59, 43. the reporting obligations to clients pursuant to Article 60, 44. the requirements in relation to the best execution of orders pursuant to Article 62, 45. the obligations in relation to the execution policy pursuant to Articles 63 and 64,

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 103 / 126 46. the requirements in relation to the processing of client orders pursuant to Article 65, 47. the information obligation and the requirements in relation to the classification of the client pursuant to Article 66 para. 3 and Article 67 paras. 3 and 4, 48. an obligation in relation to the execution of transactions with eligible counterparties pursuant to Article 68 para. 2, 49. an obligation pursuant to an FMA Regulation issued on the basis of Article 38 para. 4 in relation to the protection of client assets, 50. an obligation pursuant to an FMA Regulation issued on the basis of Article 47 para. 5 in relation to the requirements to act in the best interest of the client, 51. the compliance of trading obligations for investment firms pursuant to Article 23 (1) and (2) of Regulation (EU) No 600/2014, 52. the record-keeping obligations pursuant to Article 25 (1) of Regulation (EU) No. 600/2014, 53. the transaction reporting obligations pursuant to Article 26 (1) subpara. 1, Article 26 (2) to (5), Article 26 (6) subpara. 1 and Article 26 (7) subparas. 1 to 5 and 8 of Regulation (EU) No. 600/2014, 54. the obligations to supply financial instrument reference data pursuant to Article 27 (1) of Regulation (EU) No. 600/2014, or 55. against measures by the ESMA pursuant to Article 40, the EBA pursuant to Article 41 or the FMA pursuant to Article 42 of Regulation (EU) No. 600/2014, 56. against the prohibition of receiving payment for order flow pursuant to Article 39a of Regulation (EU) No 600/2014 or the associated obligations pursuant to delegated acts and implementing regulations issued on the basis of Regulation (EU) No. 600/2014 or Directive 2014/65/EU, commits an administrative offence and shall be punished and shall be punished by the FMA with a fine or up to EUR 5 million or up to double the amount of the benefit derived from the breach, where this can be quantified. (2) Any person who, as the person responsible (Article 9 VStG) of a legal entity, does not completely and punctually fulfil the reporting and disclosure obligations pursuant to Title II of Regulation (EU) No 600/2014 or in so doing makes a false declaration, commits an administrative offence and shall be punished by the FMA with a fine or up to EUR 5 million or up to double the amount of the benefit derived from the breach, where this can be quantified. (3) Any person who, as the person responsible (Article 9 VStG) of a legal entity breaches:

1. the information requirements set forth in Article 73 paras. 6 to 9,
2. the obligation to submit the information listed in Article 36 paras. 4 and 6 to the public register pursuant to Article 36 para. 6b,
3. the obligation to submit the information listed in Articles 3 (1) and (2), Article 4 (1), (3) and (4), Article 5 (1) Article 10 (1) of Regulation (EU) 2019/2088 to the FMA at the same time as its publication pursuant to Article 18a of Regulation (EU) 2019/2088, or
4. the obligation to obtain a legal entity identifier (LEI) pursuant to Article 18a (2) of Regulation (EU) 2019/2088,

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 104 / 126 commits an administrative offence and shall be punished with a fine of up to EUR 60 000. (4) Any person who, as the person responsible (Article 9 VStG) of a legal entity:

1. fails to submit its annual financial statement to the FMA on time, thereby contravening Article 75 para. 1 no. 1,
2. fails to notify the FMA without delay about the withdrawal of an institution from the protection scheme, thereby contravening Article 75 para. 1 no. 2,
3. breaches an obligation in relation to accounting and auditing of the financial statements pursuant to Articles 71 or 72, or
4. breaches an obligation pursuant to an FMA Regulation issued on the basis of Article 38 para. 4 or Article 65 para. 2 commits an administrative offence and shall be punishable by a fine of up to EUR 20 000 in the case of nos. 1 or 2, or a fine of up to EUR 100 000 in any of the cases listed in nos. 3 to 5. (5) Any person acting as the external auditor of a legal entity pursuant to Article 90 para. 1 nos. 1 and 2 who violates their reporting obligations pursuant to Article 93 para. 1, commits an administrative offence and shall be fined up to EUR 100 000. (6) Any person acting as the person responsible (Article 9 VStG) of a legal entity pursuant to Article 90 para. 1 nos. 1 and 2 who fails to provide the FMA with an immediate written notification of the situations set out in Article 73 para. 1 nos. 1 to 8 and 11 BWG, commits an administrative offence and shall be fined up to EUR 20 000. (7) Any person acting as the person responsible (Article 9 VStG) of a legal entity pursuant to Article 90 para. 1 no. 5 who breaches the obligations set out in Articles 34 to 36 BWG, commits an administrative offence and shall be fined up to EUR 60 000. (8) Any person acting as the person responsible (Article 9 VStG) of an investment firm or an investment services provider breaches Article 37 paras. 4 to 8, commits an administrative offence and shall be fined up to EUR 50 000. (9) In the case of the breach of an obligation pursuant to Article 14 para. 4, Article 20 paras. 6 and 7 as well as Article 7 of this Federal Act in conjunction with Article 73 para. 1 no. 1 BWG with regard to changes to the articles of association as well as Article 73 para. 1 no. 4, no. 7 and no. 11 BWG, the FMA shall refrain from initiating and conducting administrative penal proceedings, in the case that the notification that was not properly submitted was subsequently made prior to the FMA gaining knowledge of this offence. (10) Any person who, in contravention of Article 8, discloses or makes use confidential facts to obtain a financial advantage for him/herself or for another party or in order to cause a disadvantage for another party, shall be sentenced to up to six months’ imprisonment or shall be fined up to 360 per diem rates. The offender shall only be prosecuted with the authorisation of the person whose interest in confidentiality was breached.

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 105 / 126 Penal provisions with regard to legal persons Article 96. (1) The FMA may impose fines against legal persons, if natural persons who acted individually or as part of a body of a legal person and who have a managerial role within the legal person on the basis of:

1. a power of representation of the legal person,
2. an authority to take decisions on behalf of the legal person, or
3. an authority to exercise control within the legal person have breached the obligations listed in Articles 94 and Article 95 paras. 1 and 2. (2) Legal persons may also be held responsible for breaches of the obligations listed in Article 94 and Article 95 paras. 1 and 2, where such breaches by a person acting on behalf of the legal person occurred due to a lack of supervision or control by one of the persons referred to in para. 1. (3) The fine pursuant to paras. 1 or 2 shall amount to up to Euro 5 million or up to twice the amount of the benefit derived from the breach, where this can be quantified, or up to 10 % of the total annual turnover pursuant to para. 4. (4) The total annual turnover shall be taken as the one stated in most recent audited annual financial statement. In the case of investment firms and credit institutions the total annual turnover shall be the total of all revenues listed in nos. 1 to 7 of Annex 2 to Article 43 BWG less the expenditures listed therein; in the case that the undertaking is a subsidiary, then the total annual turnover should be applied that is stated for the previous financial year in the consolidated financial statements of the ultimate parent undertaking in the group. Where the FMA is unable to determine or calculate the bases for the total revenues, then it shall estimate them. In so doing, all relevant circumstances shall be taken into account that are relevant for the estimate. Effective punishment of breaches Article 97. (1) The FMA shall, when determining the type of sanction or measure to be taken in relation to breaches against the provisions of this Federal Act, against regulations or administrative decisions issued on the basis of this Federal Act, or against the provisions of Regulation (EU) No 600/2014 as well as when calculating the amount of a fine, where appropriate, shall also take into account the following circumstances in particular:
4. the severity and duration of the breach;
5. the level of responsibility of the natural or legal person responsible;
6. the financial strength of the responsible natural or legal person as may be deduced, for example, from the total turnover of the responsible legal person or the annual income of the responsible natural person;
7. the amount of the gains made or losses avoided by the responsible natural or legal person, provided that these amounts can be determined;
8. the losses sustained by third parties as result of the breach, provided that these amounts can be determined;

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 106 / 126 6. the willingness of the responsible natural or legal person to cooperate with the FMA; 7. previous breaches by the responsible natural or legal person; as well as 8. any potentially systemically-relevant effects arising from the breach. (2) The FMA shall apply the AVG in exercising its supervisory powers, and shall apply the VStG in punishment of administrative offences conducted in accordance with this Federal Act. Reporting of breaches Article 98.(1) Legal entities that provide investment services or ancillary services, and which possess data reporting services, that are subject to supervision by the FMA in accordance with delegated acts issued on the basis of Article 2 (3) of Regulation (EU) No 600/2014.shall have appropriate procedures in place to enable their employees, while ensuring their identity remains confidential, to report any internal breaches of the provisions against the provisions of this Federal Act, against Regulations or administrative decisions issued on the basis of this Federal Act, against the provisions of Regulation (EU) No 600/2014 or against an administrative decision issued on the basis of that Regulation to a suitable body. The procedures pursuant to this paragraph must correspond with the requirements set out in para. 3 nos. 2 to 3. (2) The FMA shall establish effective mechanisms to encourage the reporting of breaches or suspected breaches of the provisions of this Federal Act, of the regulations or administrative decisions issued on the basis of this Federal Act, of the provisions of Regulation (EU) No. 600/2014, or of an administrative decision issued on the basis of that Regulation. (3) The mechanisms listed in para. 2 shall at least include:

1. specific procedures for receiving reports on breaches and their follow-up;
2. appropriate protection for employees of legal entities pursuant to para. 1 who report breaches committed within their institution, as a minimum against retaliation, discrimination or other forms of harassment;
3. appropriate protection of identity pursuant to Regulation (EU) 2016/679 for both the person notifying the breach as well as for the natural person who is allegedly responsible for a breach, in all stages of the procedure, provided that the disclosure of identity is not compulsory within a procedure conducted by the Public Prosecutor's Office, a court of law, or under administrative procedural law. (4) Employees who report such breaches with regard to this Federal Act by means of an internal procedure or by reporting them to the FMA, shall neither be allowed as a consequence
4. to be disadvantaged, in particular in relation to their salary, professional promotion, in relation to training and education programmes, by being moved internally or by having their employment terminated, nor
5. to be held responsible in accordance with regulations under penal law, unless the report was intentionally falsely submitted. The legal entity or a third party shall only have a claim for compensation in the case of a report that was clearly incorrect, made by the employee

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 107 / 126 had made with intention of causing damage. The authorisation to make such reports shall not be allowed to be contractually restricted. Agreements to the contrary shall not be effective. (5) Paras. 1 to 4 shall only be valid for legal entities that are not subject to Article 95 or Articles 159 and 160 BörseG 2018. Reporting to ESMA Article 99. The FMA shall submit an annual summary to ESMA about all administrative penalties and other measures imposed pursuant to Articles 94, 95 and 96. Disclosure of measures and sanctions Article 100. (1) Measures pursuant to Article 90 para. 3 nos. 5, 8, 13 and 14 or administrative penalties, that have been imposed for breaches against the provisions contained in this Federal Act or contained in Regulation (EU) No. 600/2014, shall be published immediately on the FMA's website including the identity of the sanctioned person and information about the type and character of the underlying breach. (2) The FMA shall be required to amend such announcements to include any appeal being made as well as any further information about the outcome of the appeal procedure. Moreover, the FMA shall also append the announcement to include any decision, with which a measure or sanction as defined in para. 1 contested by means of an appeal, is repealed. (3) Publication pursuant to paras. 1 and 2 shall be carried out anonymous, if the disclosure of names:

1. of a natural or legal person being sanctioned would be disproportionate, or
2. would endanger the stability of the financial markets of a Member State or several Member States of the European Union, or
3. would endanger the conducting of ongoing criminal law investigations. Where grounds exist for anonymous publication pursuant to nos. 1 to 3, but where it may be assumed that such grounds will cease to exist in the foreseeable future, the FMA may refrain from an anonymous publication, and may also announce the sanction pursuant to para. 1 once the grounds pursuant to nos. 1 to 3 have ceased to apply. (4) The FMA may desist completely from publication, where such a publication pursuant to para. 3 is not sufficient to avert hazards for the stability of the financial markets of an individual Member State or multiple Member States of the European Union of where in light of the immateriality of the breach proportionality may only be maintained by desisting from publication. (5) If an appeal or final right of appeal is raised against an administrative decision that was published pursuant to para. 1 or 2, which is afforded suspensory effect in proceedings conducted in front of Federal Administrative Court or civil law courts, then the FMA shall publish this in the same manner. (6) The FMA shall ensure that every announcement as well as any amendment to this Regulation shall be accessible on its website from the point of time of its publication for a period of five years. (7) If the FMA has publicly disclosed an administrative measure or sanction, it shall inform ESMA about it at the same time.

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 108 / 126 (8) The FMA shall notify ESMA about sanctions pursuant to para. 1, which have been imposed, but which have not been announced pursuant to para. 2 no. 3, as well as all appeals in conjunction with sanctions and the outcomes of appeal procedures. (9) The FMA shall be the ESAP collection body pursuant to Article (2) point 2 of Regulation (EU) 2023/2859 for information pursuant to paras. 1, 2 and 5 and shall make this information available in the ESAP. (10) For the purposes of para. 9, the information pursuant to paras. 1, 2 and 5 shall be required to meet the following requirements:

1. it is to be submitted in a data extractable format pursuant to Article 2 point 3 of Regulation (EU) 2023/2859, and
2. shall contain the following meta data: a. all names of the investment firm to which the information relates, b. where available the investment firm’s legal entity identifier (LEI) pursuant to Article 7(4) point b of Regulation (EU) 2023/2859, c. the type of information pursuant to the classification in Article 7(4) point c of Regulation (EU) 2023/2859, and d. a statement about whether the information contains personal data. (11) The FMA may determine, by means of a Regulation, a specific format in accordance with para. 10, additional meta data to be included and the submission modalities for the submission of data pursuant to para. 9, if this appears expedient taking into consideration rules under European Union law. The FMA shall be empowered as the controller under data protection law pursuant to Article 4 point 7 of the General Data Protection Regulation in conjunction with the tasks pursuant to para. 9 for processing personal data in accordance with the General Data Protection Regulation. Legal protection against publications made by the FMA Article 101. The party affected by the publication pursuant to Article 90 para. 3 no. 11 or pursuant to Article 100 may file a request to the FMA to review the lawfulness of such a publication in a procedure concluded by means of an administrative decision. In this case, the FMA shall announce the initiation of such proceedings in the same way as the original publication. If, in the course of this review, it is found that the publication was unlawful, then the FMA shall correct the publication or, at the request of the person subject to this publication, either revoke it or remove it from its website. Special procedural provisions Article 102. (1) The FMA shall be the first instance responsible for the imposing of administrative penalties pursuant to Articles 94, 95 and 96. (2) In the case of administrative offences pursuant to Articles 94, 95 and 96, a limitation period of 18 months shall apply instead of the limitation period set out in Article 31 para. 1 VStG.

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 109 / 126 (3) For the enforcement of an administrative decision in accordance with this Federal Act or Regulation (EU) 600/2014 the amount of EUR 30 000 shall replace the amount specified in Article 5 para 3 of the Administrative Enforcement Act (VVG; Verwaltungsvollstreckungsgesetz 1991), published in Federal Law Gazette No. 53/1991. (4) Fines imposed by the FMA pursuant to this Federal Act shall be passed on to the Federal Government. Data protection Article 103. The provisions of Regulation (EU) 2016/679 as well as Regulation (EC) No. 45/2001 are to be complied with in exercising supervisory and investigatory powers pursuant to Article 90 para. 3. SECTION 3: COOPERATION BETWEEN AUTHORITIES Contact point and exchange of information Article 104. (1) The FMA shall act as contact point as defined in Article 79 (1) of Directive 2014/65/EU. The Federal Minister of Finance shall notify the European Commission, ESMA and other Member States about which authority may accept requests about the exchanging of information or cooperation pursuant to para. 2. (2) The FMA may cooperate with competent authorities from other Member States, where doing so is required for the performance of duties determined in Directive 2014/65/EU and Regulation (EU) No. 600/2014 and provided that the information submitted to those authorities is subject to professional secrecy pursuant to Article 14 FMABG. The FMA may make use of its powers for the purpose of cooperation, even if the conduct that is the subject matter of the investigation does not constitute a breach of any legal provisions applicable in Austria. The FMA may also make use of its powers in accordance with Article 90 para. 3 nos. 1, 2 and 4 for the purpose of cooperation towards natural and legal persons, that are authorised in their Home Member State for the provision of investment services or activities as an investment firm pursuant to Article 1 no. 1. (3) If the operations of a trading venue with branches in a host Member State have become of substantial importance for the functioning of the securities markets and investor protection in that Member State, then the FMA as the competent authority of either the Home Member State or the Host Member State shall take appropriate measures for the cooperation with the competent authority in the trading venue's home or host Member State. (4) Where the FMA has justified grounds to suspect that undertakings that are not subject to its supervision, are breaching or has breached the provisions of Directive 2014/65/EU or the Regulation (EU) No. 600/2014 in the territory of another Member State, it shall notify the competent authority of the other Member State and the ESMA as precisely as possible. In turn, the FMA shall take appropriate action if it receives such notification from another competent authority and shall inform that authority and ESMA about the outcome of such measures and, as far as possible about

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 110 / 126 any significant developments that have occurred in the meantime. The FMA's powers as the competent authority that submitted the information shall not be affected by this paragraph. (5) Regardless of paras. 1, 2 and 4, the FMA shall inform the ESMA and the other competent authorities in the Member States about the details:

1. about any instructions pursuant to Article 93 para. 2 no. 9 BörseG 2018, to reduce the size of a position or outstanding claims;
2. about any limits that apply for persons to enter into positions in a commodity-based derivative pursuant to Article 93 para. 2 no. 2 BörseG 2018. (6) The instructions pursuant to para. 5 shall as applicable also include specific details about the request or demand in accordance with Article 93 para. 2 no. 8 BörseG 2018 including the identity of the person or persons, to whom they were issued, and the reasons for, as well as the scope of the restrictions imposed pursuant to Article 93 para. 2 no. 10 BörseG 2018 and the affected person, the respective financial instruments, any restrictions on the size of the positions that this person shall be allowed to hold at any time, any permitted exceptions pursuant to Articles 18 and 19 BörseG 2018 and the reasons therefor. (7) The notification pursuant to para. 5 must take place at least 24 hours prior to when the steps or measures are intended to enter into force. If a notification is not possible 24 hours in advance, the FMA may in exceptional cases the notification may also be made less than 24 hours prior to the prior to the measure taking effect. (8) If the FMA is notified by the competent authority of another Member State pursuant to Article 79 (5) of Directive 2014/65/EU, it may take measures pursuant to Article 93 para. nos. 9 or 10 BörseG 2018, where it is convinced that the measure is necessary to achieve the objective of the competent authority in the other Member State. If measures are taken, then a notification pursuant to para. 5 must be made. (9) If a measure pursuant to para. 5 affects wholesale energy products, then the FMA shall also notify the Agency for Cooperation between Energy Regulators (ACER) established by Regulation (EC) No 713/2009. (10) With regard to emission allowances, the FMA shall cooperate with the competent government bodies for the supervision of spot and auction markets as well as the competent authorities, managers of registers and other government bodies charged with the monitoring of compliance with the Emissions Allowance Act 2011 (EZG 2011; Emissionszertifikategesetz 2011) (Directive 2003/87/EC), in order to ensure that it has a complete overview of the emission allowances markets. (11) In relation to agricultural commodity derivatives the FMA shall notify and cooperate with the competent public sector entities for the supervision, management and regulation of agricultural commodity markets pursuant to Regulation (EU) No 1308/2013.

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 111 / 126 Cooperation and Exchanging of Information with the ESMA Article 105.(1) The FMA shall cooperate with ESMA in accordance with Regulation (EU) No 1095/2010 for the purposes of Directive 2014/65/EU. (2) The FMA shall make all information available to the ESMA pursuant to Articles 35 and 36 of Regulation (EU) No. 1095/2010 without delay that are required for the performance of its tasks on the basis of this Federal Act and Regulation (EU) No 600/2014. Cooperation in monitoring, on-site inspections and investigations Article 106.(1) The FMA may request the cooperation of the competent authority of another Member State in conducting monitoring activities, an on-site inspection or in an investigation. In the case of investment firms that are remote members of a regulated market in Austria, the FMA may also choose to address them directly, although it should inform the competent authority of the home Member State of the remote member when doing so. In the case of a legal entity that has its statutory registered office or its head office in Austria and that is a remote member of a regulated market in another Member State, the competent authority of the home Member State of the regulated market may directly contact the legal entity, although it should inform the FMA of this occurrence without delay. Where the FMA receives a request with respect to an on-site inspection or an investigation, it shall be active within the scope of its powers, by

1. undertaking the inspection or investigation itself, or
2. permitting the requesting authority to conduct the inspection or investigation; or
3. allowing external auditors or experts to conduct the inspection or investigation. (2) The FMA shall submit information required for the purposes of conducting of duties by the named competent authorities pursuant to Article 90 para. 1, that arise from this Federal Act, the BörseG 2018 as well as Regulation (EU) No. 600/2014. The FMA may, when exchanging information with other competent authorities, advise when transmitting this information that it may only be disclosed with the FMA's express consent. In this case, such information may only be exchanged for the purposes for which consent was given. (3) The FMA shall only be allowed to transmit information pursuant to Articles 93 and 111 and information received from third countries to other bodies or natural or legal persons with the explicit approval of the authority in another Member State that disclosed it, and then only for the purposes for which that authority has given its approval. In this case, the FMA shall inform the contact point that sent the information without delay. (4) The FMA as well as other bodies or natural and legal persons that receive confidential information in accordance with para. 2, pursuant to Article 93 and 111 or from a third country, may only use such information in the course of their duties, in particular:
4. for checking whether the conditions for authorisation for investment firms are fulfilled, and for facilitating monitoring of performing activities of the administrative and accounting organisation as well as the internal control mechanisms,
5. for monitoring the proper functioning of trading venues,

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 112 / 126 3. for imposing sanctions; 4. for contesting decisions by competent authorities in administrative proceedings; 5. in court proceedings; or 6. in out-of-court proceedings for investors' complaints. (5) Paras. 2 to 4 and Article 111 shall not preclude the FMA from transmitting confidential information for the purpose of performing its duties to the ESMA, the European Systemic Risk Board (ESRB), central banks, the European System of Central Banks (ESCB) and the European Central Bank in its capacity as a monetary authority, as well as where applicable other government authorities that are responsible for overseeing payment and settlement systems; similarly these provisions do not preclude the aforementioned authorities or bodies from transmitting information to the competent authorities, that they require for the performance of their duties pursuant to this Federal Act, the BörseG 2018 and Regulation (EU) No 600/2014. Binding Mediation Article 107. The FMA may bring to the attention of ESMA cases, where

1. a request for monitoring, on-site inspection or an investigation pursuant to Article 106 was rejected or did not lead to any reaction within a reasonable period of time, or
2. a request for the exchange of information as defined in Article 106 was rejected, or that to no reaction within a reasonable period of time. Refusal to cooperate and inter-authority consultation Article 108. (1) The FMA may refuse to act on a request for cooperation in carrying out an investigation, on-site inspection or monitoring activity or refuse to exchange information pursuant to Article 106, if:
3. such an investigation, on-site inspection, monitoring activity or exchange of information could adversely affect the sovereignty, security or public order in Austria;
4. judicial proceedings have already been initiated over the same actions, and where proceedings are already pending before an Austrian court;
5. a final judgment has already been delivered in Austria against the persons in question for the same actions. In the event that the FMA rejects such cooperation, it shall notify the requesting competent authority and ESMA accordingly, providing as detailed information as possible. (2) The FMA shall consult the competent authorities of the other Member State involved prior to an authorisation being granted to an investment firm that is
6. a subsidiary of an investment firm, a market operator or a credit institution that is authorised in another Member State; or
7. a subsidiary of the parent undertaking of an investment firm or a credit institution authorised in another Member State; or

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 113 / 126 3. controlled by the same natural or legal persons that control an investment firm or credit institution that is authorised in another Member State. (3) The FMA shall consult the competent authorities of the Member State responsible for the supervision of credit institutions or insurance undertakings prior to granting an authorisation to an investment firm that is

1. a subsidiary of a credit institution or insurance undertaking authorised in the Community;
2. a subsidiary of the parent undertaking of a credit institution or insurance undertaking authorised in the Community;
3. controlled by the same natural or legal person that controls a credit institution or insurance undertaking authorised in the Community. (4) The FMA shall in particular consult the authorities defined in paras. 2 and 3 when assessing the suitability of the shareholders or members as well as the reputation and experience of persons who effectively direct the business of another entity within the same group. It shall provide such authorities with all relevant information regarding the suitability of shareholders or members and the reputation and experience of persons who effectively direct the business, where such information is of relevance for other competent authorities for granting an authorisation and for the ongoing assessment of compliance with conditions for conducting of activities. Powers of host Member States Article 109. (1) The FMA as competent authority of the host Member State may require for statistical purposes that all legal entities as defined in Article 90 para. 1 nos. 4 and 5 that have branches in Austria shall report to it periodically about the activities of those branches. (2) The FMA as competent authority of the host Member State may, in exercising the powers conferred upon it in accordance with this Federal Act or the BörseG 2018, require branches of legal entities as defined in Article 90 para. 1 nos. 4 and 5 to provide the information necessary for monitoring their compliance with the applicable standards in the cases set out in Article 19 para. 5. These requirements shall not be allowed to be stricter than those the FMA imposes on established firms for the monitoring of their compliance with the same standards. Protective measures to be taken by host Member States Article 110. (1) Where the FMA as the competent authority in the host Member State has clear and demonstrable grounds for believing that a legal entity active in Austria under the freedom to provide services pursuant to Article 17 para. 1 or Article 90 para. 1 no. 4 breaches the obligations arising from this Federal Act or the BörseG 2018 or Regulation (EU) No 600/2014 or that a legal entity as defined in Article 19 para. 1 or Article 90 para. 1 no. 4 with a branch within Austria breaches the obligations arising from the provisions of this Federal Act or the BörseG 2018 or Regulation (EU) No 600/2014 that do not confer powers on the FMA as the competent authority of the host Member State, then it shall refer those findings to the competent authorities of the home Member State.

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 114 / 126 (2) If the FMA as competent authority of the host Member State determines that a legal entity as defined in Article 90 para. 1 nos. 4 and 5 that has a branch in Austria does not comply with the Austrian legal or administrative provisions regarding the FMA's competence as the competent authority of the host Member State, the FMA shall instruct the legal entity concerned to ensure legal compliance within three months. If the legal entity fails to comply with this request, the FMA as the competent authority of the host Member State shall take all appropriate actions to ensure that the affected legal entity rectifies this irregular situation. The FMA shall inform the competent authorities of the home Member State, the European Commission and ESMA of the nature of the action taken. In addition, the FMA as the competent authority of the host Member State may also bring the matter to the attention of ESMA. If the legal entity continues to breach the aforementioned Austrian legal or administrative provisions, in spite of the actions taken by the FMA, the FMA may, after having informed the competent authorities of the home Member State, take appropriate measures to prevent or to sanction further breaches; if necessary, it can partially or fully prohibit the responsible managers of the branch of the institution from managing it, and may also prohibit the legal entity from initiating new transactions in Austria. The FMA shall inform the European Commission and ESMA immediately about such action having been taken. In addition, the FMA may bring the matter to the attention of ESMA as the competent authority of the host Member State. (3) If the FMA as the competent authority of the host Member State of a regulated market, an MTF or an ORF has given clear and demonstrable grounds for the assumption that the regulated market concerned, the MTF concerned or the OTF concerned breaches the obligations imposed upon it arising from this Federal Act or the BörseG 2018 as well as Regulation (EU) No 600/2014, then it shall communicate its findings to the competent authority of the home Member State of the regulated market, the MTF or the OTF. If the regulated market, the MTF or the OTF, despite the actions taken by the competent authority of the home Member State, or because such actions prove insufficient, continues to act in a manner that clearly threatens the interests of investors in Austria or the orderly functioning of markets, then the FMA as the competent authority of the host Member State shall, after informing the competent authority of the home Member State, take all appropriate actions necessary to protect investors and to safeguard the orderly functioning of markets. This shall also include the option to prohibit the regulated market, the MTF or the OTF concerned from making its system available to remote members or participants in Austria. The European Commission and ESMA are to be informed about such actions without delay. In addition, the FMA, as the competent authority of the host Member State, may bring the matter to the attention of ESMA. (4) The FMA shall duly justify any action taken pursuant to paras. 1, 2 or 3 that involves sanctions or restricting the activities of a legal entity or of a regulated market, and shall communicate these reasons to the investment firm or to the regulated market concerned. (5) If a legal entity as defined in Article 90 para. 1 nos. 1 and 3, which carries out its activities in a Member State by means of a branch, continues to breach the national regulations of the host Member State despite the request by the competent authorities to instate legal compliance, then the FMA, having been informed by the competent authorities of the host Member State, shall take

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 115 / 126 appropriate measures in accordance with Article 92 para. 8 to instate legal compliance in the host Member State. The competent authority of the host Member State shall be informed without delay in writing about the measures taken. (6) If the licence of a legal entity is withdrawn pursuant to Article 90 para. 1 nos. 1 and 3, then the FMA shall inform the competent authorities of the Member States in which the legal entity performs its business activities without delay. Cooperation and Exchanging of Information with Third Countries Article 111. (1) The FMA may conclude cooperation agreements regarding the exchange of information with the competent authorities of third countries, subject to the proviso, that the submitted information are subject at least to professional secrecy pursuant to Article 14 FMABG. Such an exchange of information must serve the purpose of support of the performance of the duties of the FMA. The onward transmission of personal data to a third country must take place in accordance with Chapter IV of Directive 95/46/EC. (2) The FMA may conclude cooperation agreements on the exchange of information with other authorities, bodies or natural or legal persons from third countries, provided they are competent for one or several of the following tasks:

1. Supervision of credit institutions, other financial institutions, insurance undertakings and financial markets,
2. Liquidations, insolvency proceedings and similar proceedings in investment firms;
3. Performance of statutory audits of accounting documents of investment firms and other financial institutions, banks and insurance undertakings in exercising their supervisory powers or the management of compensation systems in performing their duties;
4. Supervision of those involved in liquidation and insolvency and similar proceedings or similar proceedings with respect to investment firms;
5. Supervision of the persons performing statutory audits of accounting documents of insurance undertakings, credit institutions, investment firms and other financial institutions;
6. Supervision of persons active in emission allowance markets for preserving a full perspective about the financial and spot markets;
7. Supervision of persons active in agricultural commodity derivatives markets for preserving a full perspective about the financial and spot markets; (3) Cooperation agreements pursuant to para. 2 may only be concluded where it is guaranteed that the transmitted information is at least subject to professional secrecy that is at least comparable to Article 14 FMABG. Such an exchange of information shall serve to support the performance of the tasks of those authorities, bodies or natural or legal persons. Where cooperation agreements include the transmission of personal data, then such a transmission must be conducted in accordance with Chapter V of Regulation (EU) 2016/679.

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 116 / 126 (4) The FMA shall only be allowed to transmit information onwards that originate from another Member State, if the competent authorities of the Member State have explicitly approved their transmission, and where applicable only for the purposes that such authorities have given their consent. This shall also apply for information that is to be transmitted by the competent authorities of a third country. CHAPTER 4: TRANSITIONAL AND FINAL PROVISIONS Transitional provisions Article 112. (1) At the point of the entry into force of this Federal Act, existing licences pursuant to the WAG 2007 published in Federal Law Gazette I No. 60/2007 in the version of the Federal Act amended in Federal Law Gazette I No. 118/2016, shall continue to be valid as licences in accordance with this Federal Act in their existing scope, without requiring a new licence to be applied for separately in accordance with the provisions of this Federal Act. (2) A notification pursuant to Article 18 or Article 20 for investment services as defined in Article 3 para. 2 shall only be necessary, provided that such a notification has not already been notified to the FMA pursuant to Article 13 WAG 2007 prior to entry into force of this Federal Act. (3) If the total assets of an entity that had applied for a licence pursuant to Article 3 para. 5 BWG in the version of the Federal Act amended in Federal Law Gazette I No. 237/2022 prior to the entry into force of Article 4 para. 1 BWG in the version of the Federal Act amended in Federal Law Gazette I No. 237/2022 for dealing on own account (Article 1 no. 3 lit. c) or underwriting the issuance or placing of financial instruments with a firm commitment basis (Article 1 no. 3 lit. f), are expected to reach or exceed an amount of EUR 30 billion, then the FMA shall make the entity aware of this and initiate a licensing procedure pursuant to Article 4 BWG. Article 113. The following transitional provisions shall apply following the entry into force of this Federal Act:

1. For C6 energy derivatives contracts that have been entered into by non-financial counterparties as defined in Article 10 (1) of Regulation (EU) No 648/2012 or by non-financial counterparties, that are only authorised for the first time as legal entities after 3 January 2018, neither the clearing obligation pursuant to Article 4 of the Regulation (EU) No 648/2012 nor risk mitigation techniques pursuant to Article 11 (3); but they shall however be subject to all other requirements in Regulation (EU) No 648/2012. The FMA shall grant exemptions, and shall report to the ESMA for which C6 energy derivatives contracts have been granted an exemption.
2. Until 3 January 2021 C6 energy derivatives contracts shall be considered as OTC derivative contracts for the purposes of the clearing threshold pursuant to Article 10 (1) of Regulation (EU) No 648/2012.

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 117 / 126 3. Article 33, Article 73 para. 10, Article 90, Article 98 and Article 111 shall expire on 25 May 2018 with regard to obligations for the purposes of data processing to be undertaken. The data processing to be performed for purposes of these provisions shall fulfil the requirements of Article 35 (10) of Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), OJ L 119, 4.5.2016, p. 1, for an omission of the data protection impact assessment. Article 33, Article 73 para. 10, Article 90, Article 98 and Article 111 shall not apply prior to 25 May 2018 with regard to the obligations for purposes of data processing to be undertaken, provided the requirements of the General Data Protection Regulation are observed. 4. The regular notification of the public determined pursuant to Article 62 para. 5 shall first apply from 28 February 2023. Article 113a. Following the publication of the amendment of this Federal Act in Federal Law Gazette I No. 237/2022, the following transitional provisions shall apply:

1. (regarding Article 3 para. 2): Where an entity performs an ancillary investment service pursuant to Article 3 para. 2 no. 10 at the time of the Federal Act amended in Federal Law Gazette I No. 237/2022 entering into force without the existence of an obligation to hold a licence pursuant to Article 4 BWG, the licence including the ancillary investment service pursuant to Article 3 para. 2 no. 10 shall only be considered as having been granted on a temporary basis at that time, if the entity places a complete application that is able to be approved for a licence pursuant to Article 3 para. 2 including the ancillary investment service pursuant to Article 3 para. 2 no. 10 by 30 June 2023, and the licence including the ancillary investment service pursuant to Article 3 para. 2 no. 10 is then subsequently granted. Applications pursuant to Article 3 para. 2 shall be permissible following the publication of the amendment of this Federal Act in Federal Law Gazette I No. 237/2022.
2. (regarding Article 73 para. 1): Investment firms that are not yet members of the compensation scheme at the time of the entry into force of Article 73 para. 1 WAG 2018 in the version amended by Federal Act in Federal Law Gazette I No. 237/2022, but that must join a compensation scheme pursuant to Article 73 para. 1 in the version of the Federal Act amended in Federal Law Gazette I No. 237/2022, shall be required to do so within two months following the entry into force of Article 73 para. 1 WAG 2018 in the version amended by Federal Act in Federal Law Gazette I No. 237/2022; the second sentence of Article 73 para. 1 shall apply after the expiry of this two-month period. For investor compensation in relation to services pursuant to Article 3 para. 2 nos. 2 to 10 performed by investment firms, which until the entry into force of Article 4 para. 1 BWG in the version amended by Federal Act in Federal Law Gazette I No. 237/2022 were licensed as credit institutions pursuant to the version prior to the version amended by Federal Act in Federal Law Gazette I No. 237/2022, the competent deposit guarantee schemes remain competent until they join the investor compensation; Part 3

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 118 / 126 ESAEG shall apply to such kinds of investment firms until they join the investor compensation scheme, as though they had continued to be credit institutions. 3. (regarding Article 73 para. 1): By way of derogation from no. 1 and Article 73 para. 1 in the version of the Federal Act amended in Federal Law Gazette I No. 237/2022 investment firms pursuant to Article 3 in the version of the Federal Act amended in Federal Law Gazette I No. 237/2022, that held licences as credit institutions pursuant to Article 4 para. 1 BWG in the version prior to the amendment of the Federal Act in Federal Law Gazette I No. 237/2022, may, for the purposes of investor compensation, continue to remain members of the deposit guarantee scheme to which they had hitherto belonged. In this instance, Part 3 of ESAEG shall apply to such investment firms in such a way as if they were still credit institutions. Such investment firms must notify the FMA and their deposit guarantee scheme that they will remain in their deposit guarantee scheme within two months following the entry into force of Article 73 para. 1 in the version of the Federal Act amended in Federal Law Gazette I No. 237/2022. References and Regulations Article 114. (1) Where this Federal Act refers to other Federal Acts, unless provided otherwise, the Federal Acts referred to shall be referred to in their respective current amended versions. (2) Where in other legal regulations issued by the Federal Government, including those published by the FMA refer to the provisions of the WAG 2007 that have been repealed, the corresponding provisions of this Federal Act shall instead apply in their place. (3) Where references are made in this Federal Act to Directives issued by the European Union, unless instructed otherwise, the following listed versions thereof shall apply:

1. Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data, OJ L 281, 23.11.1995, p. 31, repealed by Regulation (EU) No 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), OJ L 119, 04.05.2016, p. 1;
2. Directive 97/9/EC on investor compensation schemes, OJ L 84, 26.03.1997, p. 22;
3. Directive 2002/87/EC on the supplementary supervision of credit institutions, insurance undertakings and investment firms in a financial conglomerate and amending Council Directives 73/239/EEC, 79/267/EEC, 92/49/EEC, 92/96/EEC, 93/6/EEC and 93/22/EEC, and Directives 98/78/EC and 2000/12/EC, OJ L 35, 11.02.2003, p. 1, in the version of Directive (EU) 2019/2034, OJ L 314, 05.12.2019, p. 64;
4. Directive 2003/71/EC of the European Parliament and of the Council of 4 November 2003 on the prospectus to be published when securities are offered to the public or admitted to trading and amending Directive 2001/34/EC, OJ L 345, 31.12.2003 p. 64, repealed by Regulation (EU) 2017/1129 on the prospectus to be published when securities are offered to the public or

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 119 / 126 admitted to trading on a regulated market, and repealing Directive 2003/71/EC, OJ L 168, 30.06.2017, p. 12; 5. Directive 2003/87/EC establishing a scheme for greenhouse gas emission allowance trading within the Community and amending Council Directive 96/61/EC, OJ L 275, 25.10.2003, p. 32, in the version of Delegated Regulation (EU) No 2021/1416, OJ L 305, 31.08.2021, p. 1; 6. Directive 2004/109/EC on the harmonisation of transparency requirements in relation to information about issuers whose securities are admitted to trading on a regulated market and amending Directive 2001/34/EC, OJ L 390, 31.12.2004 p. 38, in the version of Regulation (EU) 2021/337, OJ L 68, 26.02.2021, p. 1; 7. Directive 2009/65/EC on the coordination of laws, regulations and administrative provisions relating to undertakings for collective investment in transferable securities (UCITS), OJ L 302, 17.11.2009, p. 32, in the version of Directive (EU) 2021/2261, OJ L 455, 20.12.2021, p. 15; 8. Directive 2009/72/EC of the European Parliament and of the Council of 13 July 2009 concerning common rules for the internal market in electricity and repealing Directive 2003/54/EC, OJ L 211, 14.08.2009, p. 55, repealed by Directive (EU) 2019/944 on common rules for the internal market for electricity and amending Directive 2012/27/EU, OJ L 158, 14.06.2019, p. 125; 9. Directive 2009/73/EC concerning common rules for the internal market in natural gas and repealing Directive 2003/55/EC, OJ L 211, 14.08.2009, p. 94, in the version of Regulation (EU) No 2022/869, OJ L 152, 03.06.2022, p. 45; 10. Directive 2011/61/EU on Alternative Investment Fund Managers and amending Directives 2003/41/EC and 2009/65/EC and Regulations (EC) No 1060/2009 and (EU) No 1095/2010, OJ L 174, 01.07.2011, p. 1, in the version of Directive (EU) 2019/2034, OJ L 314, 05.12.2019, p. 64; 11. Directive 2013/36/EU on access to the activity of credit institutions and the prudential supervision of credit institutions, amending Directive 2002/87/EC and repealing Directives 2006/48/EC and 2006/49/EC, OJ L 176, 27.06.2013, p. 338, in the version of Directive (EU) 2021/338, OJ L 68, 26.02.2021, p. 14 and the corrigendum in OJ L 214, 17.06.2021, p. 74; 12. Directive 2014/17/ЕU on credit agreements for consumers relating to residential immovable property and amending Directives 2008/48/EC and 2013/36/EU and Regulation (EU) No 1093/2010, OJ L 60, 28.02.2014, p. 34, in the version of Regulation (EU) 2016/1011, OJ L 171, 29.06.2016, p. 1; 13. Directive 2014/57/EU on criminal sanctions for market abuse (Market Abuse Directive), OJ L 173, 12.06.2014, p. 179; 14. Directive 2014/65/EU on markets in financial instruments and amending Directive 2002/92/EC and Directive 2011/61/EU, O L 173, 12.06.2014, p. 349, in the version amended by Directive (EU) 2024/2811, OJ L 2024/2811, 14.11.2024; 15. Directive (EU) 2015/849 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing, amending Regulation (EU) No 648/2012 and

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 120 / 126 repealing Directive 2005/60/EC and Directive 2006/70/EC, OJ L 141, 05.06.2015, p. 73, in the version of Directive (EU) 2019/2177, OJ L 334, 27.12.2019, p. 155; 16. Directive (EU) 2019/2034 on the prudential supervision of investment firms and amending Directives 2002/87/EC, 2009/65/EC, 2011/61/EU, 2013/36/EU, 2014/59/EU and 2014/65/EU, OJ L 314, 05.12.2019, p. 64, as amended by the corrigendum, OJ L 214, 17.06.2021, p. 74; 17. Directive (EU) 2024/2811 amending Directive 2014/65/EU to make public capital markets in the Union more attractive for companies and to facilitate access to capital for small and medium-sized enterprises and repealing Directive 2001/34/EC, OJ L 2024/2811, 14.11.2024. (4) Where references are made in this Federal Act to EU Regulations, unless instructed otherwise, the following listed versions thereof shall apply:

1. Regulation (EC) No 45/2001 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data, OJ L 8, 12.01.2001, p. 1, repealed by Regulation (EU) No 2018/1725, OJ L 295, 21.11.2018, p. 39;
2. Regulation (EC) No 1287/2006 implementing Directive 2004/39/EC as regards recordkeeping obligations for investment firms, transaction reporting, market transparency, admission of financial instruments to trading, and defined terms for the purposes of that Directive, OJ L 241, 02.09.2006, p. 1;
3. Regulation (EC) No 713/2009 establishing an Agency for the Cooperation of Energy Regulators, OJ L 211, 14.08.2009, p. 1, repealed by Regulation (EU) No 2019/942, OJ L 158, 14.06.2019, p. 22;
4. Regulation (EC) No 714/2009 on conditions for access to the network for cross-border exchanges in electricity and repealing Regulation (EC) No 1228/2003, OJ L 211, 14.08.2009, p. 15, repealed by Regulation (EU) No 2019/943, OJ L 158, 14.06.2019, p. 54;
5. Regulation (EC) No 715/2009 on conditions for access to the natural gas transmission networks and repealing Regulation (EC) No 1775/2005, OJ L 211, 14.08.2009, p. 36, last amended by Regulation (EU) No 2022/715, OJ L 152, 03.06.2022, p. 45;
6. Commission Regulation (EU) No 583/2010 implementing Directive 2009/65/EC as regards key investor information and conditions to be met when providing key investor information or the prospectus in a durable medium other than paper or by means of a website, OJ L 176, 10.07.2010, p. 1, as amended by the corrigendum, OJ L 108, 28.04.2011, p. 38;
7. (repealed in Federal Law Gazette I 48/2025)
8. Regulation (EU) No 1093/2010 establishing a European Supervisory Authority (European Banking Authority), amending Decision No 716/2009/EC and repealing Decision 2009/78/EC, OJ L 331, 15.12.2010, p. 12, in the version of Regulation (EU) 2019/2175, OJ L 334, 27.12.2019, p. 1;
9. Regulation (EU) No 1095/2010 establishing a European Supervisory Authority (European Securities and Markets Authority), amending Decision No 716/2009/EC and repealing Decision

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 121 / 126 2009/77/EC, OJ L 331, 15.12.2010, p. 84, in the version of Regulation (EU) No 2021/23, OJ L 22, 22.01.2021, p. 1; 10. Regulation (EU) No 1227/2011 on wholesale energy market integrity and transparency, OJ L 326, 08.12.2011 p. 1; 11. Regulation (EU) No 236/2012 on short selling and certain aspects of credit default swaps, OJ L 86, 24.03.2012 p. 1, in the version in Delegated Regulation (EU) No 2022/27, OJ L 6, 11.01.2022 p. 9; 12. Regulation (EU) No 648/2012 on OTC derivatives, central counterparties and trade repositories, OJ L 201, 27.07.2012, p. 1, in the version of the corrigendum, OJ L 321, 30.11.2013, p. 6, most in the version of Regulation (EU) 2021/168, OJ L 49, 12.02.2021, p. 1; 13. Regulation (EU) No 575/2013 on prudential requirements for credit institutions and investment firms and amending Regulation (EU) No 648/2012, OJ L 176, 27.06.2013, p. 1, in the version of Implementing Regulation (EU) No 2021/1043, OJ L 225, 25.06.2021, p. 52, and the corrigendum in OJ L 398, 11.11.2021, p. 32; 14. Regulation (EU) No 1308/2013 establishing a common organisation of the markets in agricultural products and repealing Council Regulations (EEC) No 922/72, (EEC) No 234/79, (EC) No 1037/2001 and (EC) No 1234/2007, OJ L 347, 20.12.2013, p. 671, in the version of the Regulation (EU) 2021/2117, OJ L 435, 06.12.2021 p. 262; 15. Regulation (EU) No 596/2014 on market abuse (Market Abuse Regulation) and repealing Directive 2003/6/EC and Directives 2003/124/EC, 2003/125/EC and 2004/72/EC, OJ L 173, 12.06.2014, p. 1, in the version of Regulation (EU) 2024/2809, OJ L 2024/2809, 14.11.2024; 16. Regulation (EU) No 600/2014 on markets in financial instruments and amending Regulation (EU) No 648/2012, OJ L 173, 12.06.2014, p. 84, in the version of Regulation (EU) No 2024/2809, OJ L 2024/2809, 14.11.2024; 17. Regulation (EU) No 909/2014 on improving securities settlement in the European Union and on central securities depositories and amending Directives 98/26/EC and 2014/65/EU and Regulation (EU) No 236/2012, OJ L 257, 28.08.2014 p. 1, in the version of Regulation (EU) No. 2022/858, OJ L 151, 02.06.2022, p. 1; 18. Delegated Regulation (EU) 2017/565 supplementing Directive 2014/65/EU as regards organisational requirements and operating conditions for investment firms and defined terms for the purposes of that Directive, OJ L 87, p. 1, in the version of Delegated Regulation (EU) 2021/1254, OJ L 277, 02.08.2021, p. 6 and the corrigendum, OJ L 309, 02.09.2021, p. 38; 19. Delegated Regulation (EU) 2017/567 supplementing Regulation (EU) No 600/2014 with regard to definitions, transparency, portfolio compression and supervisory measures on product intervention and positions, OJ L 87 p. 90, as amended by the corrigendum, OJ L 251, 29.09.2017, p. 30; 20. Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 122 / 126 (General Data Protection Regulation), OJ L 119, 04.05.2016, p. 1, in the version of the corrigendum OJ L 074, 04.03.2021, p. 35; 21. Regulation (EU) 2019/2088 on sustainability￾related disclosures in the financial services sector, OJ L 17, 09.12.2019, p. 1, as amended by Regulation (EU) 2023/2869, OJ L 2023/2869, 20.12.2023; 22. Regulation (EU) 2020/852 on the establishment of a framework to facilitate sustainable investment, and amending Regulation (EU) 2019/2088, OJ L 198, 22.06.2020, p. 13; 23. Regulation (EU) 2019/2033 on prudential requirements for investment firms and amending Regulations (EU) No 1093/2010, (EU) No 575/2013, (EU) No 600/2014 and (EU) No. 806/2014, OJ L 314, 05.12.2019, p. 1, in the version of the corrigendum in OJ L 261, 22.07.2021, p. 60; 24. Regulation (EU) 2022/2554 on digital operational resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No. 909/2014 and (EU) 2016/1011, OJ L 333, 27.12.2022, p. 1; 25. Regulation (EU) 2023/2859 establishing a European single access point providing centralised access to publicly available information of relevance to financial services, capital markets and sustainability, OJ L 2023/2859, 20.12.2023, p. 1, in the version of the Directive (EU) 2024/1760, OJ L 2024/1760, 05.07.2024; 26. Directive (EU) 2023/2864 amending certain directives as regards the establishment and functioning of the European single access point, OJ L 2023/2864, 20.12.2023, in the version of the corrigendum published in OJ L 2024/90411, 15.07.2024; 27. Regulation (EU) 2023/2869 amending certain regulations as regards the establishment and functioning of the European single access point, OJ L 2023/2869, 20.12.2023; 28. Regulation (EU) 2024/2809 amending Regulations (EU) 2017/1129, (EU) No 596/2014 and (EU) No 600/2014 to make public capital markets in the Union more attractive for companies and to facilitate access to capital for small and medium-sized enterprises, OJ L 2024/2809, 14.11.2024. (5) Any regulation issued based on this Federal Act as amended may be issued from the day following publication of the federal act to be implemented; however, Regulations shall not be allowed to enter into force before the statutory provisions to be implemented have themselves entered into force. Transposition Note Article 114a. (1) The Federal Act published in Federal Law Gazette I No. 107/2017 transposes the following legal acts of the European Union:

1. Directive 2014/65/EU of the European Parliament and of the Council of 15 May 2014 on markets in financial instruments and amending Directive 2002/92/EC and Directive 2011/61/EU, OJ L 173, 12.06.2014, p. 349, in the version amended by Directive (EU) 2016/1034, OJ L 175, 23.06.2016, p. 8, as amended by the corrigendum, OJ L 64, 10.03.2017, p. 116; and

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 123 / 126 2. Delegated Directive (EU) 2017/593 supplementing Directive 2014/65/EU with regard to safeguarding of financial instruments and funds belonging to clients, product governance obligations and the rules applicable to the provision or reception of fees, commissions or any monetary or non-monetary benefits, OJ L 87 p. 500. (2) The Federal Act published in Federal Law Gazette I No. 107/2017 serves to effectively enforce the following legal acts of the European Union:

1. Regulation (EU) No 600/2014 on markets in financial instruments and amending Regulation (EU) No 648/2012, OJ L 173, 12.06.2014, p. 84, in the version amended by Regulation (EU) No 2016/1033, OJ L 175, 23.06.2016, p. 1;
2. Commission Delegated Regulation (EU) 2017/565 supplementing Directive 2014/65/EU as regards organisational requirements and operating conditions for investment firms and defined terms for the purposes of that Directive, OJ L 87, p. 1; and
3. Commission Delegated Regulation (EU) 2017/567 supplementing Regulation (EU) No 600/2014 of the European Parliament and of the Council with regard to definitions, transparency, portfolio compression and supervisory measures on product intervention and positions, OJ L 87, p. 90. (3) The amendment published by federal act in Federal Law Gazette I no. 98/2021 transposes Directive (EU) 2019/878 amending Directive 2013/36/EU as regards exempted entities, financial holding companies, mixed financial holding companies, remuneration, supervisory measures and powers and capital conservation measures, published in OJ L 150, 07.06.2019, p. 253, as amended by the corrigendum in OJ L 212, 03.07.2020. p. 20. (4) The amendment in the Federal Act published in Federal Law Gazette I No. 36/2022 serves to implement
4. Regulation (EU) 2019/2088 on sustainability￾related disclosures in the financial services sector, OJ L 17, 09.12.2019, p. 1, as amended by Regulation (EU) 2020/852, OJ L 198, 22.06.2020, p. 13;
5. Regulation (EU) 2020/852 on the establishment of a framework to facilitate sustainable investment, and amending Regulation (EU) 2019/2088, OJ L 198, 22.06.2020, p. 13; and
6. Regulation (EU) 2019/2175 amending Regulation (EU) No 1093/2010 establishing a European Supervisory Authority (European Banking Authority), Regulation (EU) No 1094/2010 establishing a European Supervisory Authority (European Insurance and Occupational Pensions Authority), Regulation (EU) No 1095/2010 establishing a European Supervisory Authority (European Securities and Markets Authority), Regulation (EU) No 600/2014 on markets in financial instruments, Regulation (EU) 2016/1011 on indices used as benchmarks in financial instruments and financial contracts or to measure the performance of investment funds, and Regulation (EU) 2015/847 on information accompanying transfers of funds, OJ L 334, 27.12.2019. p. 1. (5) The Federal Act amended in Federal Law Gazette I No. 36/2022 transposes

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 124 / 126

1. Directive (EU) 2019/2177 amending Directive 2009/138/EC on the taking-up and pursuit of the business of Insurance and Reinsurance (Solvency II), Directive 2014/65/EU on markets in financial instruments and Directive (EU) 2015/849 on the prevention of the use of the financial system for the purposes of money-laundering or terrorist financing, OJ L 334, 27.12.2019, p. 155; and
2. Directive (EU) 2020/1504 amending Directive 2014/65/EU on markets in financial instruments, OJ L 347, 20.10.2020, p. 50. (6) The Federal Act amended in Federal Law Gazette I No. 69/2022 transposes Directive (EU) 2021/338 amending Directive 2014/65/EU as regards information requirements, product governance and position limits, and Directives 2013/36/EU and (EU) 2019/878 as regards their application to investment firms, to help the recovery from the COVID-19 crisis, OJ L 68, 26.02.2021, p. 14. (7) The amendment published by federal act in Federal Law Gazette I no. 139/2022 transposes Delegated Regulation (EU) 2021/1269 of 21 April 2021 amending Delegated Directive (EU) 2017/593 as regards the integration of sustainability factors into the product governance obligations, OJ L 277, 02.08.2021, p. 137. (8) The Federal Act published in Federal Law Gazette I No. 112/2014 transposes Directive (EU) 2022/2556 amending Directives 2009/65/EC, 2009/138/EC, 2011/61/EU, 2013/36/EU, 2014/59/EU, 2014/65/EU, (EU) 2015/2366 and (EU) 2016/2341 regarding digital operationalresilience in the financial sector, OJ L 333, 27.12.2022, p. 153. (9) The Federal Act published in Federal Law Gazette I No. 48/2025 serves to transpose Directive (EU) 2024/790 amending Directive 2014/65/EU on markets in financial instruments, OJ L 2024/790, 08.03.2024, and to implement Regulation (EU) 2024/791 amending Regulation (EU) No 600/2014 as regards enhancing data transparency, removing obstacles to the emergence of consolidated tapes, optimising the trading obligations and prohibiting receiving payment for order flow, OJ L 2024/791, 08.03.2024. (10) The Federal Act published in Federal Law Gazette I No. 5/2026 serves to transpose Directive (EU) 2023/2864 and the effective enforcement of Regulation (EU) 2023/2859 as well as Regulation (EU) 2023/2869. (11) The Federal Act published in Federal Law Gazette I No. 27/2026 serves to transpose Directive (EU) 2024/2811 and the effective enforcement of Regulation (EU) 2024/2809. Gender-neutral use of language Article 115. Where expressions in this Federal Act relating to persons are given only in the masculine form, they shall refer equally to men and women. The respective gender-specific form shall be used when applied to specific persons. Enforcement Article 116. The following shall be responsible for the enforcement of this Federal Act

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 125 / 126

1. with regard to Article 13 para. 2 no. 3, Article 14 paras. 5 and 6, Articles 77 to 88 and Article 95 para. 10 the Federal Minister of Justice,
2. with regard to Articles 8 and 47 to 64 of the Federal Minister of Finance upon agreement with the Federal Minister of Justice,
3. with regard to all other provisions the Federal Minister of Finance. Entry into force Article 117. (1) This Federal Act shall enter into force on 3 January 2018. (2) Article 47 para. 1, Article 66 para. 2 no. 1 lit. e, Article 69 para. 1, Article 70 para. 1, para. 2 no. 1, Article 90 para. 4 no. 12 and Article 90 para. 7 in the version of the Federal Act amended in Federal Law Gazette I no. 62/2019 shall enter into force on 21 July 2019. (3) Article 8 para. 3 in the version of the Federal Act amended in Federal Law Gazette I no. 104/2019 shall enter into force on 1 July 2020. (4) Article 90 para. 7 in the version of the Federal Act amended in Federal Law Gazette I no. 25/2021 shall enter into force on the day after publication. (5) Article 69 para. 1 and para. 10 in the version of the Federal Act amended in Federal Law Gazette I No. 190/2021 shall enter into force on the day after publication. (6) The table of contents, Article 1 nos. 54, 55 and 60 to 62, Article 2 para. 1 nos. 16 and 17, Article 49, Article 90 para. 1 nos. 10 and 11, Article 92 para. 8, Article 95 para. 1 nos. 31a, 31c, 31d and 31e, Article 98 para. 1, Article 114 para. 3 no. 14, para. 4 nos. 16, and 20 to 22 and Article 114a including its heading in the version amended by Federal Act in Federal Law Gazette I No. 36/2022 shall enter into force on the following day after publication. Article 1 no. 63, Article 90 para. 1 no. 12 and Article 119 including heading shall expire at the end of the day of publication. (7) Article 95 para. 1 no. 31b in the version of the Federal Act amended in Federal Law Gazette I No. 36/2022 shall enter into force on 30 December 2022. (8) The table of contents with regard to Article 31a, Article 1 no. 5a, Article 1 no. 18, Article 1 no. 64a, Article 1 nos. 69 and 70, Article 2 para. 1 no. 13, Article 31a including heading, Article 48 paras. 3, 5, 6 and 7, Article 54 paras. 10 and 11, Article 56 paras. 3 and 4, Article 60 para. 5, Article 68 para. 1, Article 98 para. 1, Article 113 no. 4 and Article 114a para. 6 in the version of the Federal Act amended in Federal Law Gazette I No. 69/2022 shall enter into force on the day following publication. (9) Article 1 no. 70, Article 30 para. 11, Article 30 para. 14, Article 30 para. 16a, Article 30 para. 17, Article 31 para. 3, Article 31 para. 9 and Article 114a para. 7 in the version of the Federal Act amended in Federal Law Gazette I No. 139/2022 shall enter into force on 22 November 2022. (10) The table of contents with regard to Articles 112 to 113a, and Article 1 no. 4 lit. g, Article 1 no. 71, Article 2 para. 3, Article 3 paras. 2, 3, 5 and 6, Article 4 para. 1, para. 2 no. 3 and para. 5, Article 6 para. 2 no. 2, Article 7 para. 1, Article 23 paras. 5 to 8, Article 24, Article 71 para. 1 and para. 3 no. 2, Article 73 paras. 1 to 5, 8 and 10, Article 74 paras. 2 to 4, 6 and 8, Article 76 para. 1 and 2, Article 90 para. 4 and 7, Article 95 para. 9, Article 106 para. 4 no. 1, Article 112 para. 3, Article 113a and

Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018) 126 / 126 Article 114 para. 3 nos. 1, 3 to 12, 15 and 16 and para. 4 nos. 1, 3 to 5, 7 to 9, 11 to 18, 20, 22 and 23 in the version amended by Federal Act in Federal Law Gazette I No. 237/2022 shall enter into force on 01 February 2023. Article 3 para. 4 and para. 5 no. 4, Article 5, Article 7 para. 2, Article 10 and Article 11 shall be repealed at the end of 31 January 2023. (11) Article 1 no. 7 in the version of the Federal Act published in Federal Law Gazette I No. 63/2023 shall enter into force on 01 July 2023. (12) Article 27 para. 1, Article 29 paras. 4 and 6, Article 32, Article 114 para. 4 nos. 23 and 24 as well as Article 114a para. 8 in the version of the Federal Act amended in Federal Law Gazette I No. 112/2024 shall enter into force on 17 January 2025. (13) Article 1 nos. 23, 28 and 60 to 62, Article 2 para. 1 no. 6 lit. b, Article 62 para. 5, Article 64 paras. 1 and 3, Article 90 para. 11, Article 95 para. 1 nos. 54 to 56, Article 114 para. 3 no. 14 and para. 4 no. 16 as well as Article 114a para. 9 in the version amended by Federal Act in Federal Law Gazette I No. 48/2025 shall enter into force on 29 September 2025. Article 62 para. 4 and Article 64 para. 2 shall be repealed at the end of 28 September 2025. (14) Article 106 para. 5 in the version amended by the Act amending provisions in relation to the Freedom of Information Act (Informationsfreiheits-Anpassungsgesetz) published in Federal Law Gazette I No. 50/2025 shall enter into force on 01 September 2025. (15) The table of contents with regard to Article 90a, Article 36 paras. 6a and 6b, Article 90a including the heading, Article 95 para. 3, Article 100 paras. 9 to 11, Article 114 para. 4 nos. 21, 24 to 27 and Article 114a para. 10 in the version of the Federal Act amended in Federal Law Gazette I No. 5/2026 shall enter into force on the following day after publication. Article 90a para. 1 and Article 95 para. 3 nos. 3 and 4 in the version of the Federal Act amended in Federal Law Gazette I No. 5/2026 shall apply from 10 January 2028. The FMA shall notify ESMA by 9 January 2028 that it is the collection body pursuant to Article 18a (3) of Regulation (EU) 2019/2088. Article 36 paras. 6a and 6b, Article 90a para. 2, Article 95 para. 3 no. 2 as well as Article 100 paras. 9 to 11 in the version of the Federal Act published in Federal Law Gazette I No. 5/2026 shall apply from 10 January 2030. The FMA shall notify ESMA by 9 January 2030 that it is the collection body pursuant to Article 87a (3) first subparagraph of Directive 2014/65/EU and the collection body pursuant to Article 3 (2) of Regulation (EU) 2023/2859 for the collection of information submitted on a voluntary basis that are listed in Directive 2014/65/EU, Regulation (EU) No 600/2014 and Regulation (EU) 2019/2088. (16) Article 49, Article 54 paras. 10 to 13, Article 90 para. 3 nos. 15 to 18, Article 114 para. 3 nos. 16 and 17 and para. 4 nos. 15, 27 and 28 and Article 114a para. 11 in the version of the Federal Act amended in Federal Law Gazette I No. 27/2026 shall enter into force on 06 June 2026. Repeals Article 118. The Securities Supervision Act 2007 (WAG 2007; Wertpapieraufsichtsgesetz 2007), published in Federal Law Gazette I No. 60/2007, shall be repealed at the end of 2 January 2018.