Central Depositories (Licensing and Operations) Regulations, 2016

Page 1 of 50 Government of Pakistan Securities and Exchange Commission of Pakistan NOTIFICATION Islamabad, the 15th February, 2016 S. R. O. 120 (I)/20161 . - In exercise of powers conferred by sub-section (1) of section 169 read with sections 48, 49, 50, 59, 60, 61 and 151 of the Securities Act, 2015 the Securities and Exchange Commission of Pakistan hereby makes the following Regulations, the same being previously published in the official gazette vide S.R.O. 1196(I)/2015 dated 2nd December 2015 and also placed on its website as required under sub-section (4) of section 169 of the said Act, namely:- CHAPTER I PRELIMINARY

1. Short title and commencement. - (1) These Regulations shall be called the Central Depositories (Licensing and Operations) Regulations, 2016. (2) They shall come into force at once.
2. Definitions. - (1) In these Regulations, unless there is anything repugnant in the subject or context, – (a) "Act" means the Securities Act, 2015 (III of 2015); (b) “Depositories Act” means the Central Depositories Act, 1997 (XIX of 1997) (c) “Ordinance” means the Companies Ordinance, 1984 (XLVII of 1984); and (d) “senior management officer” for the purposes of these regulations in addition to the persons mentioned in clause (lviii) of section (2) of the Act include the following, by whatever name called: (i) company secretary (ii) chief financial officer (iii) head of internal audit (iv) head of IT, IT security or technology (v) chief risk and compliance officer (2) Words and expressions used but not defined in these Regulations shall have the

1 The S.R.O. 120 (I)/2016 dated 15th February, 2016 is further amended vide S.R.O. 82 (I)/2017 dated 7th February, 2017; S.R.O. 994 (I)/2018 dated 10th August, 2018; S.R.O. 1304 (I)/2019 dated 1st November, 2019; S.R.O. 549 (I)/2020 dated 11th June, 2020; S.R.O. 1270(I)/2020 dated 26th November, 2020; S.R.O. 18 (I)/2021 dated 11th January, 2021, S.R.O. 1417 (I)/2021 dated 3rd November, 2021, S.R.O. 962(I)/2022 dated 23rd June, 2022, March 29, 2023, S.R.O.1064(I)/2023 dated August 13, 2023 and S.R.O.1031(I)/2026 dated June 16, 2026.

Page 2 of 50 same meaning as assigned to them in the Act, the Ordinance, the Securities and Exchange Commission of Pakistan Act, 1997 (XLII of 1997) or the Depositories Act or any rules or regulations made thereunder. CHAPTER II LICENSING OF CENTRAL DEPOSITORY 3. Application for grant of license. (1) Subject to compliance with the requirements of section 48 of the Act and these regulations, an application for grant of license as a central depository shall be submitted to the Commission in Form A. (2) An applicant seeking a license as central depository shall pay an amount of rupees one million as license fee and submit the following documents along-with its application: (i) copy of challan evidencing payment of license fee; (ii) copies of its memorandum of association and articles of association; (iii) proposed regulations under section 51 of the Act; and (iv) proposed regulations under section 35 of the Depositories Act. (3) The Commission, while considering the application for license, may require the applicant to furnish such further information or clarification regarding its activities and businesses as it deems appropriate. (4) The applicant shall, if so required, appear before the Commission for a representation through an officer duly authorized for this purpose in writing by the board of directors of the applicant. (5) Any subsequent change in the information provided to the Commission at the time of filing of application under sub-regulation (2) and (3) above shall be intimated to the Commission within five working days from the date of such change. (6) No application for grant of license made under sub-regulation (1) above shall be refused except after giving the applicant an opportunity of being heard. 4. Grant of license. (1) The Commission, while considering the application made under regulation 3, shall inter-alia take into account the following matters, - (a) that the eligibility requirements of the Act and these regulations have been complied with; (b) that the applicant has demonstrated its ability to perform its duties in accordance with the provisions of the Act, the Depositories Act and any rules and regulations made or codes, guidelines, directions and circulars issued thereunder;

Page 3 of 50 (c) the applicant has shareholding and governance structure as provided in these regulations; and (d) that the applicant has the necessary infrastructure including but not limited to adequate office space, equipment, experienced human resource and technical capabilities, financial resources, policies, procedures, systems and controls to effectively and efficiently discharge its responsibilities as a central depository. (2) The Commission may inspect the premises of the applicant to determine whether it fulfills the eligibility criteria and may also require the applicant to submit reports from experts in the manner specified by the Commission to confirm compliance with the Act and these regulations including the existence of adequate infrastructure, technical capacity, financial standing and other requisite benchmarks. (3) The Commission, after conducting such inquiries and after obtaining such further information as it deems appropriate, and upon being satisfied. - (a) that the applicant is eligible for a licence; (b) its memorandum of association specifically allows it to act as a central depository; (c) the applicant is in compliance with the provisions of the Act and these regulations; and (d) it is in the public and capital market interest; may grant licence to the applicant in Form-B under the sub-section (4) of section 49 of the Act subject to the conditions as provided in regulation 5. (4) A central depository shall pay an annual renewal fee of rupees one million. 5. Conditions of licensing, - 2 [(1)] A central depository shall, in addition to the requirements of the Act, comply with the following conditions on 3 [an] ongoing basis 4 [or within such time as the Commission may direct]: - (a) ensure availability and maintenance of necessary infrastructure for the establishment and operation of book-entry systems for the transfer of securities; 5 [(b) make adequate arrangements including insurance cover for indemnifying

2 Insertion made by S.R.O. 82 (I)/2017 dated 7th February, 2017. 3 Insertion made by S.R.O. 82 (I)/2017 dated 7th February, 2017. 4 Insertion made by S.R.O. 82 (I)/2017 dated 7th February, 2017. 5 Sub-clause (b) substituted by S.R.O. 82(I)/2017 dated 7th February, 2017. The substituted sub-clause read as follows: “(b) make adequate arrangements including insurance for indemnifying the beneficial owners for any loss that may be caused to such beneficial owners by the wrongful act, negligence or default of the depository or any of its employees;”

Page 4 of 50 the beneficial owners of the securities for any loss that may be caused to such beneficial owners by the wrongful act, negligence or default of the depository or any of its employees for a minimum amount as may be annually determined by the central depository based on predetermined criteria as approved by the Commission from time to time;] (c) put in place adequate systems, procedures and necessary 6 [capacity] to have a wide network of CDS elements; (d) put in place adequate monitoring, inspection and enforcement mechanism for CDS elements 7 [including any outsourcing arrangements as allowed under these regulations; 8 [(e) establish and maintain connectivity with the clearing house(s) and CDS elements and enter into service level agreement(s) with the securities exchange(s) and clearing house(s);] 9 [(f) have a documented business continuity plan including a disaster recovery site;] 10[(fa) continuously improve the quality and efficiency of its systems and procedures, and attain relevant internationally recognized certifications; (fb) put in place necessary controls and safeguards to ensure cyber security, access to confidential information and alteration, destruction, disclosure or dissemination of records and data;] (g) put in place necessary arrangements, for resolving disputes and redressal of grievances of CDS elements, beneficial owners of securities, customers or any other person; 11[(h) comply with the code of corporate governance for listed companies to the

6 The word “capability” substituted by S.R.O. 82 (I)/2017 dated 7th February, 2017. 7 Inserted by S. R. O. 1304 (I)/2019 dated 1st November, 2019. 8 Sub-clause (e) substituted by S.R.O. 82 (I)/2017 dated 7th February, 2017. The substituted sub-clause read as follows: “(e) establish and maintain connectivity with the clearing house and CDS elements and have documented business continuity plan;” 9 Sub-clause (f) substituted by S.R.O. 82 (I)/2017 dated 7th February, 2017. The substituted sub-clause read as follows: “(f) ensure data secrecy and have systems for protection against unauthorized access, alteration, destruction, disclosure or dissemination of records and data;” 10 Inserted sub-clause (fa) and sub-clause (fb) by S.R.O. 82 (I)/2017 dated 7th February, 2017. 11 Sub-clause (h) substituted by S.R.O. 82 (I)/2017 dated 7th February, 2017. The substituted sub-clause read as follows: “(h) comply with the code of corporate governance for listed companies or other requirements as may be specified by the Commission from time to time;”

Page 5 of 50 extent consistent with the provisions of the Act, rules and regulations made thereunder;] (i) ensure that its memorandum and articles of association contain no provision inconsistent with the provisions of the Act and these regulations and that no change is made in its memorandum and articles of association except with the prior written approval of the Commission; (j) ensure that its directors shall not register 12[or allow] the transfer of any of its shares without prior written approval of the Commission; (k) shall facilitate access to its depository function by securities exchange, clearing house or other central depository; 13[(l) shall not carry on any activity other than that of a central depository unless the activity is incidental to the functions of the central depository: Provided that a central depository 14[directly or by forming subsidiary(ies)] may carry-out such activity which is not incidental to functions of a central depository, as may be allowed by the Commission and subject to such conditions as may be imposed: 15[Omitted] 16[(la) prescribe a code of conduct for its employees and ensure compliance with the same; and] (m) any further condition as may be imposed by the Commission from time to time.

12 Inserted by S.R.O. 82 (I)/2017 dated 7th February, 2017. 13 Sub-clause (l) substituted by S.R.O. 82 (I)/2017 dated 7th February, 2017. The substituted sub-clause read as: “(l) shall not carry on any activity other than that of a central depository unless the activity is incidental to the activity of the central depository: Provided that a central depository may carry-out such activity not incidental to its activities as a central depository, as may be assigned by the Commission and subject to such conditions as may be imposed. Provided further that a central depository may carry-out such activity not incidental to its activities as a central depository, by forming subsidiary(ies) subject to the approval of the Commission; and” 14 Inserted by S.R.O. 994 (I)/2018 dated 10th August, 2018. 15 The following two provisos have been omitted by S.R.O. 994 (I)/2018 dated 10th August, 2018: “Provided further that, subject to the approval of the Commission, a central depository may carry-out such activity which is not incidental to functions of a central depository, by forming subsidiary(ies) subject to the approval of the Commission for formation of such subsidiary (ies) and investment in such subsidiary(ies): Provided further that a central depository registered with the Commission prior to commencement of these regulations shall be required to transfer any such activity which is not incidental to its functions as a central depository to its subsidiary company(ies) within one year from the date of grant of license under these regulations;” 16 Inserted sub-clause (la) by S.R.O. 82 (I)/2017 dated 7th February, 2017.

Page 6 of 50 CHAPTER III OBLIGATIONS OF CENTRAL DEPOSITORY 17[6. Financial resource requirements, -(1) An applicant seeking license under regulation 4 shall have an initial paid-up capital and net worth of not less than rupees one billion: Provided that the Commission may require the applicant to achieve and maintain, as a licensing condition, a higher paid-up capital and net-worth in a progressive manner: 18[Provided further that a central depository registered with the Commission prior to commencement of this notification shall be required to maintain such minimum paid-up capital and net-worth and within such timelines as may be notified by the Commission.] Explanation: For the purpose of these regulations, net worth shall be calculated as total assets less total liabilities. 19[ ] 20[7. Application of fit and proper criteria, - (1) The applicant and its promoters,

17 Substituted regulation 7 by regulation 6 by S.R.O. 82 (I)/2017 dated 7th February, 2017. The substituted regulation read as follows: “7. Financial resource requirements, -(1) An applicant seeking license under regulation 4 shall have and maintain at all times, a minimum paid-up capital (net of losses) of rupees four billion and net worth of rupees seven billion. Provided that an existing central depository shall meet these requirements within the timelines given below commencing from the date of publication of these regulations in the official gazette. Minimum Paid-up Capital Minimum net-worth Time period allowed Rs.1 billion Rs. 3 billion Within one year Rs. 2.5 billion Rs.5 billion Within 3 years Rs. 4 billion Rs.7 billion Within 5 years Explanation: For the purpose of these regulations, net worth shall be calculated as total assets less total liabilities less surplus on revaluation, if any, created upon revaluation of fixed assets.” 18 Substituted the second sub-proviso and table in regulation 6 vide S.R.O. 1227 (I)/2020 dated 17th November, 2020. 19 In the Regulation 6 the words “less surplus on revaluation, if any, created upon revaluation of fixed assets” omitted vide S.R.O 994 (I)/2018 dated 10th August, 2018. 20 Substituted regulation 6 by regulation 7 by S.R.O. 82 (I)/2017 dated 7th February, 2017. The substituted regulation read as follows: “6. Application of fit and proper criteria, - The substantial shareholders, directors and senior management officers of a central depository shall at all times be fit and proper persons as per the criteria specified as Annexure-I.

Page 7 of 50 substantial shareholders, directors and senior management officers shall at all times be fit and proper persons as per the criteria specified as Annexure-I: Provided that while evaluating fit and proper criteria in respect of promoters and substantial shareholders of the central depository, the fit and proper criteria shall also be applied to the extent practical on the directors and majority shareholders of such promoters and substantial shareholders.] 21[8. Shareholding requirements, - (1) No person other than the following shall, directly or indirectly, acquire or hold shares of a central depository: (a) a securities exchange or a connected company or the majority shareholder of such securities exchange, or an associate of the majority shareholder of

Provided that in case of substantial shareholders, the requirements of fit and proper criteria shall also be applicable to the directors, sponsors and majority shareholders of such substantial shareholders to the extent as may be practical. Provided further that, in addition to the relevant/applicable clauses, past track record including the history of regulatory compliance and any disciplinary action taken against such substantial shareholder by the relevant regulatory authority shall also be duly considered.” 21 Substituted regulation 8 by S.R.O. 82 (I)/2017 dated 7th February, 2017. The substituted regulation read as follows: “8. Shareholding requirements, -(1) No person other than the following shall, directly or indirectly, acquire or hold shares of a central depository: a. A public financial institution operating as a development finance institution, an insurance company, and a non-banking finance company; b. A licensed local or a foreign bank operating in Pakistan; c. A licensed securities exchange; d. A local or foreign body corporate constituted or recognized for providing custodial, clearing or settlement services in the securities market as may be approved by the Commission; e. An institution engaged in providing financial services established outside Pakistan as may be approved by the Commission; or f. An institution as may be notified by the Commission from time to time. Provided that any person other than the above holding shares in an existing central depository shall dispose of its shareholding to an eligible person within a time period of three years from the date of commencement of these regulations. (2) Shareholding in a central depository shall be subject to the following limits: (a) collective shareholding of securities exchanges, directly or indirectly, shall not exceed forty percent; (b) collective shareholding of persons residing outside Pakistan, directly or indirectly, shall not exceed twenty percent; (c) a single shareholder, other than a securities exchange, directly or indirectly, shall not hold more than fifteen percent shares in a central depository. Provided that any person holding shares in an existing central depository in excess of the above limits on the date of commencement of these regulations, shall bring its holding in accordance with the above specified limits within a time period of three years from the date of commencement of these regulations.”

Page 8 of 50 such securities exchange; (b) any of the following institutions subject to compliance with the conditions provided under sub-regulation (2) below: (i) a financial institution operating as a development finance institution, an insurance company, or a non-banking finance company; (ii) a licensed local or a foreign bank operating in Pakistan; (iii) a local or foreign body corporate constituted or recognized for providing trading, custodial, clearing or settlement services in the securities market as may be approved by the Commission; (iv) an institution engaged in providing financial services established outside Pakistan as may be approved by the Commission; or (v) An institution as may be notified by the Commission from time to time: Provided that any person other than the above holding shares in an existing central depository shall dispose of its shareholding to an eligible person within a time period of three years from the date of commencement of these regulations. (2) Shareholding in a central depository by institutions referred at clause (b) of sub￾regulation (1) shall be subject to the following conditions: (a) the institution or any of its sponsors or directors are not associated person(s) of a TRE certificate holder or any of its sponsors or directors; (b) it complies with the capital requirements specified under the relevant provisions of applicable laws; (c) it has a minimum long-term credit rating, where applicable, not below A￾or equivalent; (d) has the capacity and demonstrated the commitment to meet any capital call by the central depository in accordance with the requirements of the Act or regulations made thereunder; (e) its license for providing any financial services has not been suspended or cancelled by any regulatory authority during the last five years; (f) no investigation or enquiry conducted under the relevant laws has been concluded against it by the Commission, State Bank of Pakistan, National Accountability Bureau, Federal Investigation Agency or any other regulatory or government body, with any material adverse findings; (g) an order restraining, prohibiting or debarring it from providing any financial services has not been passed by any regulatory authority, government body or agency or a court of law; and (h) it has not been declared defaulter in payment of taxes. (3) Shareholding in a central depository shall be subject to the following limits:

Page 9 of 50 (a) collective shareholding of 22[all shareholders other than those mentioned at clause (a) of sub-regulation (1) above shall not exceed forty nine percent]; (b) collective shareholding of persons residing outside Pakistan, directly or indirectly, shall not exceed 23[twenty five percent] 24[: Provided that shareholding of the following shall be excluded from the prescribed limit applicable to foreign investors: (i) shareholding of foreign strategic investors or foreign anchor investors in the securities exchange; and (ii) shareholding acquired by foreign investors in financial institutions, insurance companies and Development Finance Institutions which are shareholders of the Central Depository and listed at securities exchange, excluding shareholding held or acquired by foreign sponsors, promoters, or majority shareholders of such listed institutions.] (c) a single shareholder, other than a securities exchange, directly or indirectly, shall not hold more than fifteen percent shares in a central depository. (4) Any person holding shares in an existing central depository on the date of commencement of these regulations, shall comply with requirements of sub-regulations (2) and (3) above within a time period of three years from the date of commencement of these regulations.] 9. Composition of 25[board] of directors and related matters. - (1) The board of directors of a central depository shall have following categories of directors: (a) Independent directors; (b) Shareholder directors; and (c) Chief executive officer. Explanation: - For the purposes of this clause the term "independent director" means a director who is not connected or does not have any other relationship, whether pecuniary or otherwise, with the 26[central depository], its associated companies, subsidiaries, holding company or directors. The test of independence principally emanates from the fact whether such

22 Substituted the words “securities exchanges, directly or indirectly, shall not exceed forty percent” by S.R.O. 1417 (I)/2021 dated 3rd November, 2021. 23 Substituted the word “twenty percent” by S.R.O.1031(I)/2026 dated June 16, 2026. 24 Inserted by S.R.O.1031(I)/2026 dated June 16, 2026. 25 Substituted the word “board” by S.R.O. 82 (I)/2017 dated 7th February, 2017. 26 Substituted the word “applicant” by S.R.O. 82 (I)/2017 dated 7th February, 2017.

Page 10 of 50 person can be reasonably perceived as being able to exercise independent business judgment without being subservient to any form of conflict of interest: Provided that without prejudice to the generality of this explanation no director shall be considered independent if one or more of the following circumstances exist: (a) he/she has been an employee of the 2 [central depository], any of its subsidiaries or holding company within the last three years; (b) he/she is or has been the chief executive officer of subsidiaries, associated company, associated undertaking or holding company 27[of a central depository] in the last three years; (c) he/she has, or has had within the last three years, a material business relationship with the 2 [central depository] either directly, or indirectly as a partner, substantial shareholder or director of a body that has such a relationship with the 2 [central depository] 28[;] (d) he/she has received remuneration in the three years preceding his/her appointment as a director or receives additional remuneration, excluding retirement benefits from the applicant apart from a director’s fee or has participated in the 29[central depository’s] share option or a performance related pay scheme; (e) he/she is a close relative of the 30[central depository’s] promoters, directors or 31[substantial] shareholders: Explanation: 32[“close relative”] means spouse(s), lineal ascendants and descendants and siblings; (f) he/she holds cross-directorships or has significant links with other directors through involvement in other companies or bodies; or (g) 33[“he/she has served on the board for more than two terms from the date

27 Inserted by S.R.O. 82 (I)/2017 dated 7th February, 2017. 28 Substituted the colon with a semi-colon. 29 Substituted the word “applicant’s” by S.R.O. 82 (I)/2017 dated 7th February, 2017. 30 Substituted the word “applicant’s” by S.R.O. 82 (I)/2017 dated 7th February, 2017. 31 Substituted the word “major” by S.R.O. 82 (I)/2017 dated 7th February, 2017. 32 Inverted commas inserted by S.R.O. 82 (I)/2017 dated 7th February, 2017. 33 Substituted sub-clause (g) and sub-provisos vide SRO 1064(I)/2023 dated August 13, 2023. The substituted sub￾clause reads as follow: “(g) he/she has served on the board for more than three consecutive terms from the date of his/her first appointment provided that such person shall be deemed “independent director” after a lapse of one term. Provided that any person nominated as a director under sections 182 and 183 of the Ordinance shall not be taken to be an "independent director" for the above-mentioned purposes. Provided further that in case of any ambiguity in determining independence of a person for the purposes of these regulations, the decision of the Commission shall be final and binding upon the central depository.”

Page 11 of 50 of his/her first appointment: Provided that no individual shall serve as an independent director for more than three terms in total across all capital market infrastructure institutions i.e. securities exchanges, clearing houses, central depositories and futures exchanges: Provided further that any person nominated as a director under sections 182 and 183 of the Ordinance shall not be taken to be an "independent director" for the above-mentioned purposes: Provided further that in case of any ambiguity in determining independence of a person for the purposes of these regulations, the decision of the Commission shall be final and binding upon the central depository.”] 34[(2) The central depository shall not have more than two directors associated with a TRE certificate holder on its board of directors and shall have independent directors not less than one third of its total directors.] 35[(3) An independent director shall be appointed by the board of directors of the central depository with prior written approval of the Commission in the following manner: (a) a central depository shall maintain a panel of fit and proper persons suitable for appointment as independent directors 36[in accordance with the guidelines issued by the Commission]; (b) a minimum of two names from the panel maintained under clause (a) above shall be submitted by the central depository to the Commission for each vacancy for its approval; (c) the Commission may, if satisfied that a person is suitable for appointment as independent director grant its approval for the appointment of the selected person by the board of directors of the central depository:

34 Substituted sub-regulation (2) by S.R.O. 82 (I)/2017 dated 7th February, 2017. The substituted sub-regulation read as follows: “(2) The central depository shall have independent directors not less than one third of its total directors.” 35 Substituted sub-regulation (3), by S.R.O. 82 (I)/2017 dated 7th February, 2017. The substituted sub-regulation read as: “(3) An independent director shall be appointed in the following manner: (a) A central depository shall forward to the Commission the names of persons to be appointed as independent directors. A minimum of two names shall be submitted to the Commission for each vacancy of independent directors for its approval. (b)The central depository shall ensure that independent directors are selected from diverse field of work with appropriate qualification and experience.” 36 Inserted vide S.R.O. 549 (I)/2020 dated 11th June, 2020.

Page 12 of 50 Provided that where the Commission is not satisfied about the suitability of the proposed persons for appointment as a director, it may refer the matter back to the central depository for proposing other names after following the due process; (d) unless provided otherwise, the term of the independent directors so appointed shall be the same as that of the shareholder directors; (e) an independent director may be removed by the board of directors of the central depository with prior written approval of the Commission if such persons fails to comply with the fit and proper criteria; (f) any vacant position of an independent director shall be filled in the similar manner as provided for initial appointment of an independent director.] 37[Provided further that where the Commission is not satisfied about the suitability of person(s) proposed again by the central depository, the Commission shall appoint any such person as deemed appropriate as independent director of the central depository.] 38[Omitted] (4). At least one independent director shall be present in the meeting of board of directors of 39[the] central depository to constitute the quorum. 40[Provided that this condition shall not be applicable in the case of first meeting of the board of directors after the election of directors in which the names of the independent directors are to be finalized for submission to Commission as per sub-regulation 9(3): Provided further that in the first meeting of the board of directors after the election of directors in which the names of the independent directors are to be finalized no other matter shall be decided by the board of directors.] (5) The chairman of the board of directors of a central depository shall be from amongst the independent directors. (6) Every director and senior management officer of a central depository shall abide by the code of conduct to be formulated by the central depository in accordance with the guidelines specified at Annexure II. 41[(7) A central depository registered with the Commission prior to the commencement

37 Inserted vide S.R.O. 549 (I)/2020 dated 11th June, 2020. 38 Deleted the proviso vide S.R.O. 1270 (I)/2020 dated 26th November, 2020. 39 Substituted the word “a” by S.R.O. 82 (I)/2017 dated 7th February, 2017. 40 Inserted vide S.R.O. 549 (I)/2020 dated 11th June, 2020. 41 Substituted sub-regulation (7) by S.R.O. 82 (I)/2017 dated 7th February, 2017. The substituted sub-regulation read as follows: “(7) An existing central depository shall ensure compliance with the provisions of this regulation within three months from the date of commencement of these regulations.”

Page 13 of 50 of these regulations shall ensure compliance with the provisions of this regulation within nine months from the date of commencement of these regulations.] 42[(8) The central depository shall obtain clearance from the Commission on the fit and propriety of the directors prior to their appointment or election, as the case may be, on the board of directors of the central depository and shall submit confirmation that it has evaluated the persons against the fit and proper criteria as provided under these regulations and has no adverse findings therein.] 10. Appointment of chief executive officer.- 43[(1) The appointment, renewal of appointment and termination of services of the chief executive officer of a central depository shall be made subject to prior approval of the Commission and for this purpose the term “removal and/or termination” shall include non-renewal of his contract.] (2) The board of directors of a central depository shall determine the manner of appointment, terms and conditions of appointment and other procedural formalities associated with the selection/ appointment of the chief executive officer. 44[(3) A chief executive officer shall be appointed by the central depository through following process: (a) a central depository shall shortlist names of three persons meeting the fit and proper criteria provided in these regulations and shall submit one name with its recommendation for approval of the Commission; (b) the Commission may, if satisfied that such person is suitable for appointment by the central depository as chief executive officer of the central depository, grant its approval for the same: Provided that, if the Commission is not satisfied with the suitability of the proposed person for appointment as chief executive officer, it may refer the matter back to the central depository for proposing another name for consideration of the Commission.] (4) 45[The appointment of the chief executive officer shall be made for a period of

42 Inserted vide S.R.O. 549 (I)/2020 dated 11th June, 2020. 43 Substituted sub-regulation (1) by S.R.O. 82 (I)/2017 dated 7th February, 2017. The sub-regulation read as: “(1) The appointment, renewal of appointment and termination of service of the chief executive officer of a central depository shall be subject to prior approval of the Commission. Explanation: For this purpose, removal shall include non-renewal of the contract of chief executive officer. 44 Substituted sub-regulation (3) by S.R.O. 82 (I)/2017 dated 7th February, 2017. The sub-regulation (3) read as follows: “(3) A chief executive officer shall be appointed in the following manner: (a) A central depository shall forward to the Commission names of three persons meeting fit and proper criteria provided in these regulations for selection and approval of one of them as chief executive officer. (b) The Commission may, if satisfied that the person is suitable for appointment as chief executive officer of the central depository, grant its approval for the appointment of the selected person as chief executive officer of the central depository.” 45 Substituted sub-clause 4 of the Regulation 10 vide SRO 1064(I)/2023 dated August 13, 2023. The substituted

Page 14 of 50 three years, which may be renewed for one more term of three years, with the prior approval of the Commission: Provided that a person may be appointed for third and final term of three years, based on exceptional performance that is substantiated by the board of directors through a rigorous review, subject to following a competitive hiring process and final review and approval by the Commission.] 11. Appointment of compliance officer, -. 46[(1) The appointment and termination of services of the compliance officer of a central depository shall be subject to prior written approval of the Commission.] 47[(2) A compliance officer shall be appointed by the central depository through the following process: (a) a central depository shall shortlist names of three persons meeting the fit and proper criteria provided in these regulations and shall submit one name with its recommendation for approval of the Commission; (b) The Commission may, if satisfied that such person is suitable for appointment by the central depository as compliance officer of the central depository, grant its approval for the same: Provided that, if the Commission is not satisfied with the suitability of the proposed person for appointment as compliance officer, it may refer the matter back to the central depository for

sub-clause reads as follows: “The appointment of the chief executive officer shall be made for a period of three years subject to renewal with the prior approval of the Commission. “ 46 Substituted sub-regulation (1) by S.R.O. 82 (I)/2017 dated 7th February, 2017. The substituted sub-regulation read as follows: “(1) A central depository shall appoint a compliance officer, with prior written approval of the Commission, who shall be responsible for monitoring compliance of the central depository with the applicable legal and regulatory framework.” 47 Substituted sub-regulation (2) by S.R.O. 82 (I)/2017 dated 7th February, 2017. The substituted sub-regulation read as follows: “(2) A compliance officer shall be appointed in the following manner: (a) A central depository shall forward to the Commission names of three persons meeting fit and proper criteria provided in these regulations for selection and approval of one of them as compliance officer. The Commission may, if satisfied that the person is suitable for appointment as compliance officer of the central depository, grant its approval for the appointment of the selected person as compliance officer of the central depository.”

Page 15 of 50 proposing another name for consideration of the Commission.] 48[(3) The compliance officer shall be a dedicated position and must not have any other responsibilities except as listed below or any ancillary responsibility; (a) manage, lead and control the compliance and regulatory functions of the central depository 49[unless otherwise outsourced to the extent permitted under these regulations]; (b) develop, implement and monitor compliance policies, processes and procedures to cover all aspects relating to regulatory, operational and statutory obligations of the central depository; (c) handle matters relating to the regulations of the central depository, including regular review of the same to ensure their suitability and finalizing proposals for making new regulations or carrying out amendments in the existing regulations for the approval of the board of directors of the central depository; (d) monitor compliance of the central depository and CDS elements with applicable legal and regulatory framework, policies and procedures 50[unless otherwise outsourced to the extent permitted under these regulations] and take enforcement action(s) under the applicable regulatory framework; (e) supervise or conduct any investigation, inspection or enquiry required to be conducted by a central depository 51[unless otherwise outsourced to the extent permitted under these regulations]; (f) monitor the redressal of disputes, complaints or grievances arising out of handling of securities in the central depository system in a timely manner; (g) maintain effective liaison with the Commission in respect of the above stated matters 52[through periodic meetings and submission of reports as may be required by the Commission]; and (h) perform any other related function as may be assigned by the central depository or the Commission.] 53[(3A) The compliance officer shall functionally report to the board of directors of the central depository. (3B) In case of any non-compliance, the compliance officer shall take necessary action under the applicable regulatory framework and where the matter requires attention of the board

48 Substituted sub-regulation (3) by S.R.O. 82 (I)/2017 dated 7th February, 2017. The substituted sub-regulation read as follows: “(3) The compliance officer shall independently report to the board of directors of the central depository any non-compliance of the applicable legal and regulatory framework. Provided that where a compliance officer is convinced that the matter needs immediate attention of the Commission, it may simultaneously report to the Commission stating the reasons for such simultaneous reporting.” 49 Inserted vide S.R.O. 1304 (I)/2019 dated 1st November, 2019. 50 Inserted vide S.R.O. 1304 (I)/2019 dated 1st November, 2019. 51 Inserted vide S.R.O. 1304 (I)/2019 dated 1st November, 2019. 52 Inserted vide S.R.O. 549 (I)/2020 dated 11th June, 2020. 53 Inserted vie S.R.O. 82 (I)/2017 dated 7th February, 2017.

Page 16 of 50 of directors of the central depository, the same shall be reported immediately: Provided that where a compliance officer is convinced that the matter also needs immediate attention of the Commission, he shall simultaneously report to the Commission stating the reasons thereof.] (4) In case no action is taken by the board of directors within a reasonable time period or the compliance officer is of the view that the action taken by the board of directors is insufficient, 54[he] shall forthwith report the matter to the Commission. (5) The compliance officer shall submit a comprehensive report on quarterly basis to the board of directors 55[and the Commission] regarding matters reported during the respective quarter, the corrective actions taken and their status 56[and shall submit such additional reports to the Commission as may be specified]. 57[(6) The board of directors of the central depository shall put in place necessary mechanism to ensure that the compliance officer performs his functions in a transparent, equitable and timely manner] 58[(7) The central depository may outsource its compliance function subject to compliance with the conditions specified in regulation 11A.] 59[11A.Outsourcing of compliance functions. - (1) A central depository may enter into an arrangement with a securities exchange, with the prior approval of the Commission, for outsourcing its compliance function with respect to its CDS elements which are TRE certificate holders in the following manner: (a) the central depository shall enter into a service level agreement with the securities exchange for outsourcing the compliance function after obtaining approval of its board of directors with respect to shifting of employees and defining the role, responsibilities, duties, obligations of securities exchange, scope of services, remuneration of shifting compliance function, indemnification to the central depository and any other important matter; (b) upon signing the service level agreement and from the effective date provided in the agreement, the securities exchange shall, on the behalf of central depository, supervise or conduct any investigation, inspection or enquiry, in accordance with the service level agreement and the regulations of the securities exchange and central depository, required to be conducted by a central depository in respect of CDS elements which are TRE

54 Substituted the word “it” vide S.R.O. 82 (I)/2017 dated 7th February, 2017. 55 Inserted vide S.R.O. 549 (I)/2020 dated 11th June, 2020. 56 Inserted vide S.R.O. 549 (I)/2020 dated 11th June, 2020. 57 Inserted vide S.R.O. 82 (I)/2017 dated 7th February, 2017. 58 Inserted vide S.R.O. 1304 (I)/2019 dated 1st November, 2019. 59 Inserted vide S.R.O. 1304 (I)/2019 dated 1st November, 2019.

Page 17 of 50 certificate holders; (c) the central depository shall maintain liaison with the chief regulatory officer of the securities exchange and jointly develop procedures for enabling the securities exchange in performing functions relating to monitoring compliance through inspections, investigation or enquiry in respect of CDS elements which are TRE certificate holders and for regular updating with respect to changes in the regulations. (2) The central depository shall be fully liable and accountable for the compliance functions that are being outsourced to the same extent as if the functions were performed in￾house.] 12. Manner of outsourcing of important functions, - (1) A central depository shall not outsource any of its functions without prior written approval of the Commission. (2) The board of directors of a central depository shall be responsible for formulation and approval of outsourcing policy describing activities or the nature of activities that can be outsourced, the authorities who can approve outsourcing of such activities, and the selection of third party to whom it can be outsourced. (3) The records relating to all activities outsourced shall be preserved centrally by the central depository so that the same is readily accessible for review by the board of directors, the Commission or any other authorized person. (4) The central depository shall be fully liable and accountable for the activities that are being outsourced to the same extent as if the service were provided in-house. The facilities, premises or data involved in carrying out the outsourced activity by the service provider shall be deemed to be those of the central depository. (5) The central depository shall take appropriate steps to ensure that third parties protect confidential information of both the central depository, its customers and other parties involved from intentional or inadvertent disclosure to unauthorized persons. (6) The central depository desirous of outsourcing their activities shall not, however, outsource their core business activities 60[ ]. 61[(7) The central depository may outsource its compliance function subject to compliance with the conditions specified in regulation 11A.] CHAPTER IV AUDIT AND ACCOUNTS 13. General, - These obligations and duties of central depository under these

60 Deleted the words “and compliance functions” vide S.R.O. 1304 (I)/2019 dated 1st November, 2019. 61 Inserted vide S.R.O. 1304 (I)/2019 dated 1st November, 2019.

Page 18 of 50 regulations with respect to audit and accounts are in addition to the requirements of the Ordinance, the rules and regulations made thereunder and any directives issued thereunder. 14. Maintenance of accounting records, - (1) A central depository shall keep accounting and other records which shall sufficiently explain its business and transactions entered into (whether effected on its own behalf or on behalf of participants) and shall be such as to, – (a) disclose with accuracy the financial position at that time; (b) enable the central depository to prepare financial statements at any time and which comply with requirements of the law; (c) demonstrate whether the central depository is maintaining adequate financial resources to meet its business commitments; (d) demonstrate capacity of the central depository with respect to its duties, functions and operations under the Act and these regulations; and (e) demonstrate its preparedness to manage any risk arising out of its duties, functions and operations (2) The central depository shall ensure that all requirements with respect to accounting and audit under these regulations are updated in a timely manner. (3) The central depository shall ensure that information which is required to be recorded under the Act and these regulations shall be recorded in such a way as to enable a particular transaction to be identified at any time and traced from initiation of the order to final settlement. (4) All records required to be maintained under the Act and these regulations shall be arranged, filed, indexed and cross-referenced so as to permit prompt access to any particular record. (5) The central depository shall preserve the records required under these regulations for a period of ten years from the date on which they are made and should seek clearance from the Commission before destruction of any of its records. 15. Appointment of auditor and related matters, - (1) A central depository shall ensure that it has appointed an auditor 62[from the list of approved auditors to conduct audit of central depository as notified by the Commission] who has inter-alia the powers and duties specified under sub-regulation 3 and, – (a) those powers and duties are set out in an engagement letter;

62 Inserted vide S.R.O. 412(I)/2023 dated March 29, 2023.

Page 19 of 50 (b) the engagement letter is signed by the central depository and the auditor; and (c) the central depository retains a copy of the engagement letter. (2) A central depository shall, within seven days, give written notice to the Commission of the appointment, removal or resignation of an auditor. (3) The auditor appointed by a central depository shall have a right to, – (a) access to its accounting and other records and all other documents relating to its business including the documents required to be maintained under the Act and these regulations; and (b) require from it such information and explanations as the auditor considers necessary for the performance of duties. (4) In preparing an 63[auditor’s] report of a central depository, the auditor shall carry out such relevant audit procedures as will enable him to form an opinion as to the matters required to be stated in the audit report. (5) 64[Omitted] (6) Where an auditor resigns or is removed by the central depository, a notice to that effect shall be sent to the Commission containing a statement signed by the auditor to the effect that there are no circumstances connected with his resignation or removal which the auditor considers should be brought to the attention of the Commission. 65[(7) A central depository shall undergo a mandatory annual audit of its operations, regulatory

63 Substituted the word “auditor” vide S.R.O. 82 (I)/2017 dated 7th February, 2017. 64 Sub-regulation (5) of Regulation (15) omitted vide S.R.O.962 (I)/2022 dated 23th June, 2022. the omitted sub￾regulations read as follows: (5) The auditor's report shall state all the matters as are required to be stated in accordance with the requirements of the Ordinance and additionally must state whether in the opinion of the auditor. (a) an adequate internal control system commensurate with the size and nature of services performed by the central depository was implemented during the period; and (b) the compliance function had appropriate resources including the human resource and implemented effective compliance procedures and reporting mechanism which can be reasonably expected to ensure compliance with the applicable laws and detect and report any non-compliance in a timely manner. 65 Substituted sub-regulation (7) by S.R.O. 82 (I)/2017 dated 7th February, 2017. The substituted sub-regulation read as follows: “(7) The central depository shall appoint an auditor with the prior approval of the commission to carry out an audit of its systems every alternate year in accordance with the terms of reference specified in Annexure III.”

Page 20 of 50 functions and IT systems and any other systems or functions as specified by the Commission from time to time.] 66[(7A) For the purposes of the audit specified in sub-regulation (7) above, the central depository shall, 67[ ], appoint an independent auditor 68[from the list of approved auditors for a central depository as notified by the Commission, other than the auditor appointed under sub-regulation (1) above] with relevant expertise who shall conduct such audit in accordance with the terms of reference specified in Annexure III.] 69[7B For the purposes of audit specified in sub-regulation (7) above, a central depository shall, at the minimum, rotate the auditor after every five years.] (8) The 70[Commission] may appoint an auditor to carry out a special audit of the central depository, including 71[ ] regulatory compliance audit, at the expense of the central depository, in accordance with the terms of reference as specified in Annexure IV. The audit shall be carried out for such period as the Commission may direct at the time of appointing the auditor. 16. Submission of annual report, -(1) A central depository shall submit an annual report to the Commission within 72[four] months of the close of financial year, inter alia, containing the following information in addition to the requirements of section 61 of the Act; (a) audited financial statements containing information as required under the Act and these regulations; 73[(aa) audit report in respect of audit of operations, regulatory functions and IT systems conducted under regulation 15 to demonstrate regulatory compliance of the central depository during the financial year;] (b) report of directors to shareholders; (c) statement of compliance with the code of corporate governance; (d) month-wise transaction volume and value; (e) total number of participants, eligible securities and other elements along￾with information with respect to addition or 74[reduction]during the period; (f) summary of assets held under custody by the participants with the central depository; (g) names and brief profiles of members of 75[the] board of directors and senior management officers;

66 Inserted by S.R.O. 82 (I)/2017 dated 7th February, 2017. 67 Deleted the words “with the prior approval of the Commission” S.R.O. 412(I)/2023 dated March 29, 2023. 68 Inserted vide S.R.O. 412(I)/2023 dated March 29, 2023. 69 Inserted vide S.R.O. 412(I)/2023 dated March 29, 2023. 70 Substituted the word’ “commission” by S.R.O. 82 (I)/2017 dated 7th February, 2017. 71 Omitted the word “a” by S.R.O. 82 (I)/2017 dated 7th February, 2017. 72 Substituted the word “three” by S.R.O. 82 (I)/2017 dated 7th February, 2017. 73 Inserted by S.R.O. 82 (I)/2017 dated 7th February, 2017. 74 Substituted the word “deletion” by S.R.O. 82 (I)/2017 dated 7th February, 2017. 75 Inserted the word “the” by S.R.O. 82 (I)/2017 dated 7th February, 2017.

Page 21 of 50 (h) details of disciplinary actions taken, fines and penalties imposed and recovered; 76[(i) pattern of shareholding with name of each shareholder; and] (j) any other information that may be deemed material by the central depository for disclosure in the annual report. 77[(2) In addition to the submission of annual report to the Commission, the central depository shall place the annual report on its official website no later than one week from the date of its publication.] 17. Submission of information and returns, -(1) The central depository, with approval of its board of directors, shall submit to the Commission, within 78[two months] of the close of its financial year, a yearly performance report of the central depository against the approved targets and plans, highlighting in particular performance of the board of directors, chief executive officer and compliance officer of the central depository. (2) The Commission may by written notice require a central depository to submit to it such periodic returns as it may direct. (3) In addition to any periodic returns required under 79[sub-regulation (1) and (2)], the Commission may by written notice require a central depository, either generally or in a particular case or class of 80[cases], to submit to it such 81[other information or] exceptional returns as it may direct. FORM A APPLICATION FOR GRANT OF LICENSE AS A CENTRAL DEPOSITORY UNDER REGULATION 4 The Securities and Exchange Commission of Pakistan Islamabad

76 Substituted sub-clause (i) by S.R.O. 82 (I)/2017 dated 7th February, 2017.The substituted sub-clause (i) read as follows: “(i) pattern of shareholding, giving names of persons holding more than 10% shares and all changes in the shareholding above 10%;” 77 Inserted by S.R.O. 82 (I)/2017 dated 7th February, 2017. 78 Substituted the words, “one month” by S.R.O. 82 (I)/2017 dated 7th February, 2017. 79 Substituted the words “sub-regulation (1)” by S.R.O. 82 (I)/2017 dated 7th February, 2017. 80 Substituted the word, “case” by S.R.O. 82 (I)/2017 dated 7th February, 2017. 81 Inserted by S.R.O. 82 (I)/2017 dated 7th February, 2017.

Page 22 of 50 Subject: Application for grant of license under regulation 4 of the Central Depositories (Licensing and Operations) Regulations, 2016 Dear Sir, We/I on behalf of.................. (name and address of applicant) hereby apply for grant of license as central depository for the purposes of the Securities Act, 2015 and the Central Depositories (Licensing and Operations) Regulations, 2016. All the necessary information required under the laws is enclosed. Any additional information will be furnished as and when called for by the Commission. We/I, on behalf of the applicant, hereby undertake to comply with the requirements of the laws and such other conditions and terms as may be communicated while granting the license or imposed subsequently. Bank Challan No…….dated……evidencing payment of license fee of rupees one million and collection charges into the designated bank account of the Securities and Exchange Commission of Pakistan is also enclosed Yours sincerely, Authorised signatory

Page 23 of 50 FORM B THE SECURITIES AND EXCHANGE COMMISSION OF PAKISTAN License of a Central Depository under section 49 of the Securities Act, 2015 The Securities and Exchange Commission of Pakistan, having considered the application for grant of license under regulation 4 of the Central depositories (Licensing and Operations) Regulations, 2016 by..................... (name and address of central depository) and being satisfied that it would be in the interest of the securities market and also in the public interest so to do, hereby grants license, in exercise of the powers conferred by section 49 of the Securities Act, 2015, to the said central depository on the …. day of ……. 20…. subject to the such conditions as stated in the attached letter or as may be imposed hereafter. Seal of the Commission Signature of Officer Islamabad

Page 24 of 50 82[Annexure I Fit and Proper Criteria for the Central Depository and its Promoters, Substantial Shareholders, Directors and Senior Management Officers APPLICATION AND SCOPE This Fit and Proper Criteria is perpetual in nature and its compliance is mandatory. All persons subject to Fit and Proper Criteria must submit any change in the submitted information, including the financial soundness to the company secretary of the central depository within three business days and the central depository shall within a period of seven business days report the same to the Commission. In addition to the applicant and its promoters and substantial shareholders eligibility of any person desiring to act as director on the board of directors or senior management officers of a central depository shall be judged on the basis of following criteria, which in the case of directors, shall be in addition to meeting requirements of the Ordinance relating to eligibility of a director: (a) Financial Soundness and Integrity (i) The person should not have been adjudged as an insolvent or he should not have suspended payment of debts or compounded liabilities with its/his creditors. (ii) The person should not have been convicted by a court of competent jurisdiction as a defaulter in payment of any loan to a financial institution including banking company, a Development Financial Institution or a Non- Banking Financial Company. (iii) The person and companies, firms, sole proprietorship etc. where the person is a chief executive, director (other than nominee director), owner or partner etc., have no overdue payment to any investor, financial institution, securities exchange, commodity exchange, clearing company, central depository and/or defaulted in payment of any taxes in the individual capacity or as a proprietary concern or any partnership firm or as director in any unlisted and listed company. Explanation: For the purposes of clause (iii) above, the central depository shall obtain Credit Information Bureau (CIB) reports from State Bank of Pakistan to determine any overdue/past due payment of the person to a financial institution. In case of any amount appearing in the overdue column of the latest CIB report, such person shall not be considered fit and proper person except: (a) where such overdue amount is under litigation and the same is also appearing as amount under litigation in CIB report; or (b) No overdue payment is appearing in the overdue column in the subsequent latest CIB

82 Substituted Annexure I vide S.R.O. 82 (I)/2017 dated 7th February, 2017. To see substituted Annexure I, see endnote I.

Page 25 of 50 report. In case of overdue in CIB report, no rejection shall be made unless the person has been provided with an opportunity of making a representation before the Commission. (iv) The person should not have been a director and/or chief executive of any company or body corporate which has defaulted in payment of Government duties/taxes/cess or has misused customer/investor assets. (v) The person should be a tax payer and its/his name should be borne on the Active Tax Payers List regularly published by FBR. Provided that this requirement shall not be applicable in the case of non-resident foreign nationals. (b) Educational Qualification and Experience (i) In case of director, the person should: a) be a member of a recognized body of professional accountants or possess a graduate degree in finance, accountancy, law, business management, commerce, economics, capital market, information technology and financial services or related disciplines from a university recognized by the Higher Education Commission of Pakistan, or equivalent; and b) have a management or business experience including directorships, of at least seven years at a senior level preferably in the regulated financial services sector and other fields such as law, information technology etc. Provided that where a person possesses more than 15 years of experience and knowledge of the capital markets, clearing houses, central depositories, commodities market, or in the areas relating to finance, corporate governance, audit, information technology etc. the minimum qualification requirement may be relaxed on case to case basis by the central depository, with prior approval of the Commission. (ii) In case of chief executive officer, the person should: a) be a member of a recognized body of professional accountants or possess a post-graduate degree in finance, accountancy, business management, commerce, economics, capital market and financial services or other related disciplines from a university recognized by the Higher Education Commission of Pakistan, or equivalent; and b) have a minimum experience of seven years in a senior management position at the central depository or has served at a senior management position preferably as chief executive officer for a period of five years in any other company of substantial size in the regulated financial services sector; and c) have demonstrated, through his qualification and experience, the capacity to successfully undertake the cognate responsibilities of the position.

Page 26 of 50 83[(iii) Any other senior management officer must be a qualified professional possessing relevant experience and degree relating to the job/assignment and must have demonstrated, through his qualification and experience, the capacity to successfully undertake the cognate responsibilities of the position.] 84[Provided that if a central depository appoints or retains any person as senior management officer who was in the service of a TRE certificate holder or an associated company of such TRE certificate holder during the last six months, reasons for such appointment shall be recorded in writing by the central depository.] (ix) In case of promoters and substantial shareholders of the central depository, such person should have an established and proven track record of successfully running a business enterprise for 3 to 5 years. (x) The person must be fully conversant with the duties of director or senior management officer, as the case may be, as specified under the statutes, rules and regulations, memorandum and articles of association and the code of corporate governance. (c) Competency (i) Membership, license or registration of the person or any company in which he was a director during the last five years has not been suspended/ cancelled on disciplinary grounds by the Commission, any other regulatory authority, any professional body, association or relevant entity. Provided that eligibility of a person may be considered on the basis of prior clearance obtained from any such organization that suspended/ cancelled the membership, license or registration. (ii) No proceedings are pending with respect to the applicant’s winding up, insolvency or analogous relief. (iii) The person has not been disqualified/ removed from the post of a key executive position of a company by the Commission or any other regulatory authority. (d) Integrity, Honesty and Reputation (i) The person should not have been convicted in any criminal offence or directly involved in any

83 Deleted clauses (iii) to (viii) and a new clause (iii) is inserted vide S.R.O. 549 (I)/2020 dated 11th June, 2020. 84 Substituted all provisos after clause (viii) with a new proviso vide S.R.O. 549 (I)/2020 dated 11th June, 2020. The substituted provisos read as follows: Provided that a central depository shall not appoint or retain any person as senior management officer who was in service of a TRE certificate holder or an associated company of such TRE certificate holder during the last three years or who is above sixty years of age. Provided further that in exceptional circumstances and reasons to be recorded in writing a central depository may extend the age limit of sixty years to sixty-two years Provided further that upon request of a central depository supported by cogent reasons, the Commission may consider allowing continuation of service of an existing senior management officer who does not fulfil the requirements prescribed above, on a case to case basis.

Page 27 of 50 settlement in civil/ criminal proceedings in a court of law, particularly with regard to moral turpitude, investments, financial/business misconduct, fraud/ forgery, breach of trust, financial crime etc. and/ or it has not been concluded by any regulatory authority that he has been associated with any unauthorized financial activity including illegal brokerage business. (ii) The person is not a party in litigation against the Commission in respect of any criminal offence or a matter relating to non-payment of customer claims or in any other manner prejudicial to the interest of customers and general public. (iii) No investigation/ enquiry, conducted under Section 139 of the Securities Act, 2015, Section 29 of the Securities and Exchange Commission of Pakistan Act, 1997, Section 21 of the Securities and Exchange Ordinance, 1969, Section 263 or Section 265 of the Ordinance, has been concluded against him by the Commission with adverse findings. (iv) The person has not defaulted on settlement of a customer complaint where such complaint has been adjudicated by the Commission or the securities exchange. (v) An order restraining, prohibiting or debarring him from dealing in the securities market or from accessing the capital market has not been passed; or penalty of rupees five hundred thousand or more has not been imposed on him by the Commission in the last three years, in respect of any laws administered by the Commission. Provided that a person may be considered eligible in case a period of at least three years from the date of expiry of the period specified in the order for which such person has been restrained/ prohibited/ debarred has elapsed. (vi) The person should not have provided false or misleading information either to the Commission or to any of the regulatory body, securities exchange, central depository or a clearing house. (vii) The person should not have been actively involved in the management of a company whose registration or license has been revoked or cancelled or which has gone into liquidation or other similar proceedings due to financial irregularities or malpractices; (viii) The person must not be ineligible, under the Ordinance or any other legislation from acting as a director or senior management officer; or (ix) The person should not have entered into a plea bargain arrangement with the National Accountability Bureau. (x) In case of promoters and substantial shareholders, their majority shareholders and directors have proven track record of regulatory compliance with no major disciplinary action taken and any adverse comment provided by the relevant regulatory authority. (e) Additional Criteria for Independent Directors (i) The person has no relationship with the central depository that would interfere with him exercising independent professional judgment as a director and he can be reasonably perceived

Page 28 of 50 as being able to exercise independent business judgment without being subservient to any apparent form of interference. (ii) The person should not be a director, officer, sponsor or shareholder of a company holding TRE certificate or any holding or subsidiary company of such company. (iii) The person’s family member is also not a director, officer or sponsor of a company holding TRE certificate and/ or the combined shareholding of the family members in such company(ies) does not exceed twenty percent. (iv) It shall be mandatory to disclose any shareholding in a listed company in such person’s name or in the name of his family member or in the name of an entity being managed or controlled by him or his family member to the central depository and the Commission; a. at the time of submission of initial information; and b. on quarterly basis for the respective period, Further, the central depository shall, during the tenure of independent director, disseminate the information relating to the trading in securities by such independent director to the securities exchange for public disclosure. (v). The person shall have no personal services contract(s) and shall not be currently serving as an employee and has not been employed at any position of the central depository within the past three years. (vi). The person shall not simultaneously be serving as a director on the board of more than seven listed companies. Note: • All directors must inform the central depository of any change in the submitted information that may potentially affect their status of directorship, within 48 hours of knowledge of such change. • In case of any ambiguity in determination of fitness and propriety of a person in terms of this criteria, the decision of the Commission shall be final and binding upon the central depository. • Along-with the application for licence as a central depository and on subsequent appointment; (i) the applicant’s directors and senior management officers shall submit duly filled form and affidavit given below: (ii) the authorized person on behalf of the applicant and authorized person on behalf of the promoters and substantial shareholders shall submit the following duly filled Affidavit: Form for Information to be provided by Persons Desiring Prospective Directorship on the Board or a senior management officer of a central depository

Page 29 of 50

1. Curriculum Vitae/Resume containing: (a) Name: (b) Father’s or Husband’s Name: (c) C.N.I.C # (attach copy) (d) Latest photograph (e) Nationality: (f) Age: (g) Contact details: i) Residential address: ii) Business address: iii) Tel: iv) Mobile: v) Fax: vi) E-mail: (h) National Tax Number: (i) Present occupation: (j) Qualification(s): i) Academic: ii) Professional: (k) Experience: (Positions held during the last 10 years along with name and address of company/ institution) Information to be provided on the following sample format*: Sr# Name of Organization Designation Period 1 Company A dd/mm/yy - dd/mm/yy 2 Company B dd/mm/yy - dd/mm/yy

Page 30 of 50 2. In case of proposed director:

1. Nature of directorship: Executive Non-executive
2. Status of directorship: Independent director Shareholder director

Number of shares subscribed or held _________ Nominated by (name of shareholder) 3. In case of proposed director: Names of companies, firms and other organizations of which the proposed person is presently a director, partner, office holder or major shareholder (Information to be provided on the following sample format*) Sr# Name of Organization Designation Period 1 Company A dd/mm/yy - dd/mm/yy 2 Company B dd/mm/yy - dd/mm/yy 4. In the case of nomination of director by a shareholder the date of board of directors’ meeting in which the nomination of proposed director was approved. (Attach copy of the minutes of the meeting of the board of directors.) 5. Names of any persons on the board of the central depository who are related to the applicant. Signature __________________________________ *use additional sheets if required

Page 31 of 50 Affidavit to be provided by persons subject to Fit and Proper Criteria (On Stamp Paper of Appropriate Value) AFFIDAVIT (name of central depository) A. In case of an individual in his/her own capacity: I, _____________________ son/daughter/wife of _____________________ adult, resident of ______________________________________________ and holding CNIC/ Passport No. __________________________ do hereby state on solemn affirmation as under:-

1. That I am eligible for the position of director/senior management officer of the … (name of central depository)…. according to the fit and proper criteria specified for the position of directors/senior management officers of a central depository, as per the Central Depositories (Licensing and Operations) Regulations, 2016.
2. That I and the companies, firms, sole proprietorship etc. where I am a chief executive officer, director (other than nominee director), owner or partner etc. has no overdue payment of any financial institution.
3. That I hereby confirm that the statements made and the information given by me are correct and that there are no facts which have been concealed.
4. That I have no objection if … (name of central depository)….. or the Commission requests or obtains information about me from any third party.
5. That I undertake to bring to the attention of the …(name of central depository)….. any matter which may potentially affect my status for the position of director/senior management officer as per the fit and proper criteria specified in the Central Depositories (Licensing and Operations) Regulations, 2016.
6. That all the documents provided to … (name of central depository)….., are true copies of the originals and I have compared the copies with their respective originals and certify them to be true copies thereof.
7. That I will comply with any other condition as may be specified by the Commission. B. In case of an individual as authorized person on behalf of promoter and substantial shareholder: I, _____________________ son/daughter/wife of _____________________ adult, resident of ______________________________________________ and holding CNIC/ Passport No. __________________________, on behalf of …..(name of institution)….. being

Page 32 of 50 promoter/substantial shareholder of the …(name of central depository)….. do hereby state on solemn affirmation as under:-

1. That …. (name of the institution)….. is eligible for being promoter/substantial shareholder of the ….(name of central depository)….. according to the fit and proper criteria specified as per the Central Depositories (Licensing and Operations) Regulations, 2016.
2. That ….…. (name of the institution)….., and the companies, firms, sole proprietorship etc. associated with ….….(name of the institution)….., have no overdue payment to any financial institution.
3. That I hereby confirm that the statements made and the information given by me are correct and that there are no facts which have been concealed.
4. That ….…. (name of the institution)….. has no objection if the …(name of central depository).. or the Commission requests or obtains information about ….….(name of the institution)….. from any third party.
5. That I undertake, on behalf of … (name of the institution)….. that ….….(name of the institution)….. will bring to the attention of the … (name of central depository)…. any matter which may potentially affect its status as promoter/substantial shareholders of the … (name of central depository)…. as per the fit and proper criteria specified in the Central Depositories (Licensing and Operations) Regulations, 2016.
6. That all the documents provided to …. (name of central depository)…. are true copies of the originals and I have compared the copies with their respective originals and certify them to be true copies thereof. C. In case of an individual as authorized person on behalf of applicant: I, _____________________ son/daughter/wife of _____________________ adult, resident of ______________________________________________ and holding CNIC/ Passport No. __________________________, on behalf of …..(name of the applicant)….. do hereby state on solemn affirmation as under:-

Page 33 of 50

1. That …. (name of the applicant)….. is eligible for applying for licence as a central depository as per the Central Depositories(Licensing and Operations) Regulations, 2016.
2. That ….…. (name of the applicant)….., and the companies, firms, sole proprietorship etc. associated with ….….(name of the applicant)….., have no overdue payment to any financial institution.
3. That I hereby confirm that the statements made and the information given by me are correct and that there are no facts which have been concealed.
4. That ….…. (name of the applicant)….. has no objection if the Commission requests or obtains information about ….….(name of the applicant)….. from any third party.
5. That I undertake, on behalf of ….….(name of the applicant)….. that ….….(name of the applicant)….. will bring to the attention of the Commission any matter which may potentially affect its status as a central depository as per the licencing conditions and fit and proper criteria specified in the Central Depositories (Licensing and Operations) Regulations, 2016.
6. That all the documents provided by ….(name of applicant)…. are true copies of the originals and I have compared the copies with their respective originals and certify them to be true copies thereof.
7. That the ….…. (name of the applicant)….. will comply with any other condition as may be specified by the Commission.

---

DEPONENT The Deponent is identified by me Signature__________________ ADVOCATE (Name and Seal)

Page 34 of 50 Solemnly affirmed before me on this ___day of ______________ at ______________ by the Deponent above named who is identified to me by , Advocate, who is known to me personally. Signature OATH COMMISSIONER FOR TAKING AFFIDAVIT]

Page 35 of 50 Annexure II GUIDELINES FOR FORMULATION OF CODE OF CONDUCT FOR DIRECTORS AND SENIOR MANAGEMENT OFFICERS OF A CENTRAL DEPOSITORY While formulating the code of conduct as required under the code of corporate governance, the board of directors of the central depository shall ensure that at-least the following areas are covered and duties and responsibilities of directors and senior management officers are accordingly defined in the said code of conduct:

1. Duties and Responsibilities of Directors and Senior Management Officers: Every director and senior management officer shall: a) participate in the formulation and execution of strategies in the best interest of the central depository and contribute towards pro-active decision making; b) give benefit of their experience and expertise to the central depository and provide assistance in strategic planning and execution of decisions; c) endeavor to ensure that the central depository abides by all the provisions of the Act, the Ordinance, the Depositories Act, these regulations and other applicable rules, regulations, codes, guidelines, circulars and directions issued by the Commission from time to time; d) endeavor to ensure that the central depository takes steps commensurate to honor the time limit stipulated by the Commission for corrective action; e) not support any decision in the meeting of the board which may adversely affect the interest of investors and shall report forthwith any such decision to the Commission; f) place priority for redressing investor grievances and encouraging fair business practice so that the central depository becomes an engine for the growth of the securities market; g) endeavor to analyze and administer the central depository issues with professional competence, fairness, impartiality, efficiency and effectiveness; h) submit the necessary disclosures/statement of holdings/ dealings in securities as required by the central depository or the Commission from time to time as per their regulations or Articles of Association or any directives of the Commission; i) unless otherwise required by law, maintain confidentiality and shall not divulge/disclose any information obtained in the discharge of their duty and no such information shall be used for personal gains; j) maintain the highest standards of personal integrity, truthfulness, honesty and fortitude in discharge of their duties in order to inspire public confidence and shall not engage in acts discreditable to their responsibilities;

Page 36 of 50 k) perform their duties in an independent and objective manner and avoid activities that may impair, or may appear to impair, their independence or objectivity or official duties; l) not engage in any act involving moral turpitude, dishonesty, fraud, deceit, or misrepresentation or any other act prejudicial to the administration of the central depository m) not disclose confidential information, including commercial secrets, technologies, advertising and sales promotion plans, unpublished price sensitive information, unless such disclosure is expressly approved by the board of directors or required by law; 2. Meetings of the Board Every Director of the central depository shall - a) endeavor to ensure that in case all the items of the agenda of a meeting were not covered for want of time, the next meeting is held within reasonable timeframe as the board of directors may determine for considering the remaining items; and b) endeavor to have the date of next meeting fixed at each board meeting in consultation with other members of the board. 3. Guidelines for conduct of independent directors a) In addition to the conditions stated above, independent directors shall endeavor to attend all the board meetings and they shall be liable to vacate office if they do not attend fifty percent of the total meetings of the board of directors in a calendar year. 85[] Further, the independent directors shall: 86[b)] participate constructively and actively in the committees of the board in which they are chairpersons or members; 1 [c)] strive to attend the general meetings of the central depository; 1 [d)] where they have concerns about the running of the central depository or a proposed action, ensure that these are addressed by the board and, to the extent that they are not resolved, insist that their concerns are recorded in the minutes of the board meeting; 1 [e)] keep themselves well informed about the affairs and matters of the central depository and the external environment in which it operates;

85 Omitted sub-clause (b) by S.R.O. 82 (I)/2017 dated 7th February, 2017. The omitted sub-clause read as follows: “(b) Independent directors shall endeavor to meet separately, at least once in six months to review the critical issues of the central depository.” 86 Changed the numbering by S.R.O. 82 (I)/2017 dated 7th February, 2017.

Page 37 of 50 1 [f)] pay sufficient attention and ensure that adequate deliberations are held before approving related party transactions and assure themselves that the same are in the interest of the central depository; 1 [g)] ascertain and ensure that the central depository has an adequate and functional grievance resolution mechanism and to ensure that the interests of a person who uses such mechanism are not prejudicially affected on account of such use; 1 [h)] report concerns about unethical behavior, actual or suspected fraud or violation of the code of conduct of the central depository; and 1 [i)] acting within 87[their] authority, assist in protecting the legitimate interests of the central depository, shareholders and its employees.

87 Substituted the word “its” by S.R.O. 82 (I)/2017 dated 7th February, 2017.

Page 38 of 50 88[Annexure III TERMS OF REFERENCE OF OPERATIONAL, REGULATORY AND SYSTEM AUDIT OF CENTRAL DEPOSITORY UNDER REGULATION 15(7A) (1) A central depository shall require an independent auditor to conduct operational and system audit in accordance with any or all of the following: (i) reviewing appropriateness of controls and safeguards mentioned at regulation 5(fb); (ii) reviewing the information processing facilities of the central depository and the integrity of its central depository systems including: (a) maintenance of security and confidentiality over the data of the CDS Elements; (b) security over the physical operation of the central depository systems; (c) backup and disaster control and recovery procedures for central depository systems; and (d) access controls for central depository systems; and (iii) assessing the integrity and accuracy of information generated by the central depository systems including, without limitation: (a) internal controls over data input by the central depository; and (b) processing and reporting of transaction data. (iv) performing any other function or conducting audit of any other area as may be assigned by the Commission or central depository at the time of appointment of such auditor. (2) The TORs for regulatory compliance audit of a central depository may include all or any of the following procedures as may be specified by the Commission at the time of appointment of special auditor and any additional procedures that Commission may direct: (i) ensure compliance with the relevant regulatory framework, including but not limited to: (a) The Securities Act, 2015; (b) The Central Depositories Act, 1997; (c) The Companies Ordinance, 1984; (d) The Central Depositories (Licensing and Operations) Regulations, 2016; (e) The regulations of the central depository as approved by the Commission under the Central Depositories Act, 1997 and/or the Securities Act, 2015; (f) The policies, procedures, directives, guidelines, circulars issued/approved by the Commission or the board of directors of a central depository.

88 Substituted Annexure III by S.R.O. 82 (I)/2017 dated 7th February, 2017. To see substituted Annexure III, see endnote II.

Page 39 of 50 (ii) ensure compliance with the Memorandum of Association and Articles of Association of the central depository; (iii)ensure existence of and compliance with Standard Operating Procedures relating to all major operational processes; (iv) ensure that policies and procedures are formulated to identify and prevent conflict of interest of directors with the interest of capital market, investors and central depository and the same are complied with; (v) ensure that central depository system and related functionalities operate in compliance with the requirements of approved regulations and procedures of the central depository; (vi)identify the roles and responsibilities of the Commission, the securities exchange(s), clearing house and central depository as per applicable regulatory framework and also evaluate the extent to which the respective roles and responsibilities overlap and require clear demarcation. Based on this, also prepare matrix outlining roles and responsibilities where two or more institutions are involved; and (vii) evaluate any other aspect of central depository functions that may be required by the Commission.] (viii) 89[Asses that the scope, resources including human resource, procedures and reporting mechanism of the regulatory function including entity level compliance were adequate and effective to ensure compliance with relevant legal requirements and detect and report any non-compliance in a timely manner.]

89 Inserted vide S.R.O. 962(1)/2022 dated 23rd June, 2022.

Page 40 of 50 Annexure – IV TERMS OF REFERENCE (TORs) FOR THE SPECIAL AUDIT OR REGULATORY COMPLIANCE AUDIT OF A CENTRAL DEPOSITORY The TORs for the special audit or regulatory compliance audit of a central depository may include all or any of the following procedures as may be specified by the Commission at the time of appointment of special auditor and any additional procedures that Commission may direct:

1. ensure compliance with the relevant regulatory framework, including but not limited to: (a) Securities Act, 2015; (b) Central Depositories Act, 1997; (c) The Companies Ordinance, 1984; (d) Central Depository (Licensing and Operations) Regulations, 2016; (e) The regulations of the central depository as approved by the Commission under the Central Depositories Act, 2015 and/or the Securities Act, 2015; (f) The policies, procedures, directives, guidelines, circulars issued/approved by the Commission or the board of directors of a central depository.
2. ensure compliance with the Memorandum of Association and Articles of Association of the central depository;
3. ensure existence of and compliance with Standard Operating Procedures relating to all major operational processes;
4. ensure that policies and procedures are formulated to identify and prevent conflict of interest of directors with the interest of capital market, investors and central depository and are complied with;
5. ensure that central depository system and related functionalities operate in compliance with the requirements of approved regulations and procedures of the central depository;
6. identify the roles and responsibilities of the commission, the securities exchange(s), clearing house and central depository as per applicable regulatory framework and also evaluate the extent to which the respective roles and responsibilities overlap and require clear demarcation. Based on this, also prepare matrix outlining roles and responsibilities where two or more institutions are involved; and
7. evaluate any other aspect of central depository functions that may be required by the Commission.

• Sd – Secretary to the Commission End note I:

Page 41 of 50 “Annexure I FIT AND PROPER CRITERIA FOR SUBSTANTIAL SHAREHOLDERS, DIRECTORS AND SENIOR MANAGEMENT OFFICERS OF A CENTRAL DEPOSITORY APPLICATION AND SCOPE This Fit and Proper Criteria is perpetual in nature and its compliance is mandatory. All persons subject to Fit and Proper Criteria must submit any change in the submitted information through the company secretary of the central depository to the Commission. In addition to the substantial shareholders of the applicant, eligibility of any person desiring to act as director on the board of directors or senior management officers of a central depository shall be judged on the basis of following criteria, which in the case of directors, shall be in addition to meeting requirements of the Ordinance relating to eligibility of a director: (a) The Financial Status or Solvency (i) The person should not have been adjudged as an insolvent or he should not have suspended payment of debts or compounded liabilities with his creditors. (ii) The person should not have been convicted by a court of competent jurisdiction as a defaulter in payment of any loan to a financial institution including banking company, a Development Financial Institution or an Non- Banking Financial Company. (iii) The person, in his individual capacity or as director of a company, has not been in default of payment of dues owed to any investor, financial institution, or securities exchange, commodity exchange, clearing house, central depository and / or defaulted in payment of any taxes in the individual capacity or as a proprietary concern or any partnership firm or as director in any private unlisted and listed company. (iv) The person should not have been a director and/or chief executive of any company or body corporate which has defaulted in payment of Government duties/taxes/cess or has misused customer/investor assets. (v) The person should be a tax payer and his name should be borne on the Active Tax Payers List regularly published by FBR. (b) Educational Qualification and Experience (i) In case of director, the person should: a) be a member of a recognized body of professional accountants or possess a graduate degree in finance, accountancy, law, business management, commerce, economics, capital market, information technology and financial services or related disciplines from a university recognized by the Higher Education Commission of Pakistan, or equivalent;

Page 42 of 50 and b) have a management or business experience including directorships, of at least seven years at a senior level preferably in the regulated financial services sector and other fields such as law, information technology etc. Provided that where a person possesses more than 15 years of experience and knowledge of the capital markets, central depositories, commodities market, or in the areas relating to finance, corporate governance, audit, information technology etc. the minimum qualification requirement may be relaxed on case to case basis by the central depository, with prior approval of the Commission. Provided further that in case of independent director, such relaxation may be granted only by the Commission. (ii) In case of chief executive officer, the person should: a) be a member of a recognized body of professional accountants or possess a post-graduate degree in finance, accountancy, business management, commerce, economics, capital market and financial services or other related disciplines from a university recognized by the Higher Education Commission of Pakistan, or equivalent; and b) have a minimum experience of seven years in a senior management position at the central depository or has served at a position equivalent to chief executive officer for a period of five years in any other company preferably in the regulated financial services sector; and c) have demonstrated, through his qualification and experience, the capacity to successfully undertake the cognate responsibilities of the position. (iii) In case of chief operating officer, the person should: a) be a member of a recognized body of professional accountants or possess a post-graduate degree in finance, accountancy, business management, commerce, economics, capital market and financial services or other related disciplines from a university recognized by the Higher Education Commission of Pakistan, or equivalent; and b) have a minimum experience of seven years in a senior management position at the central depository or has served at a position equivalent to chief operating officer for a period of five years, in any other company preferably in the regulated financial services sector; and c) have demonstrated, through his qualification and experience, the capacity to successfully undertake the cognate responsibilities of the position. (iv) In case of chief financial officer, the person should: a) be a member of a recognized body of professional accountants or possess a postgraduate degree in finance, accountancy, business management, commerce, economics, capital market and financial services or related disciplines from a university recognized by the Higher Education Commission of Pakistan, or equivalent; and

Page 43 of 50 b) have preferably served as chief financial officer for a period of three years in any other company; or have: i) a minimum experience of five years in related functions at the central depository; or ii) served as head of finance, audit, compliance or other corporate functions for a period of four years in any other company. (v) In case of chief risk officer and head of internal audit, the person should: a) be a member of a recognized body of professional accountants, or a Certified Internal Auditor, or a Certified Fraud Examiner; and b) have preferably served as chief risk officer and/or head of internal audit for a period of three years in any other company; or have: i) a minimum experience of five years in related functions at the central depository; or ii) served as head of finance, audit, compliance or other corporate functions for a period of four years in any other company. (vi) In case of company secretary and compliance officer, the person should: a) be a member of a recognized body of professional accountants or a recognized body of corporate or chartered secretaries; or be a law graduate or possess a post-graduate degree in finance, accountancy, business management, commerce, economics, capital market and financial services or related disciplines from a university recognized by the Higher Education Commission of Pakistan, or equivalent; and b) have preferably served as company secretary and/or compliance officer for a period of three years in any other company; or have: i) a minimum experience of five years in related functions at the central depository; or ii) served as head of finance, audit, compliance or other corporate functions for a period of four years in any other company. (vii) In case of head of IT, IT security or technology, the person should: a) possess a post-graduate degree in information technology or computer sciences or related disciplines from a university recognized by the Higher Education Commission of Pakistan, or equivalent; and b) have a minimum relevant experience of five years in IT related functions at the central depository or has served as head of IT related services for a period of three years in any other company. Provided that upon request of a central depository supported by cogent reasons, the Commission may consider allowing continuation of service of an existing senior management officer who does

Page 44 of 50 not fulfil the requirements prescribed above, on a case to case basis. (viii) In case of substantial shareholders of the central depository, such person should have an established and proven track record of successfully running a business enterprise for 3 to 5 years. (ix) The person must be fully conversant with the duties of director or senior management officer, as the case may be, as specified under the statutes, rules and regulations, memorandum and articles of association and the code of corporate governance. (c) Competency (i) Membership, license or registration of the person or any company in which he was a director during the last five years has not been suspended/ cancelled by the Commission, any other regulatory authority, any professional body, association or relevant entity. Provided that eligibility of a person may be considered on the basis of prior clearance obtained from any such organization that suspended/ cancelled the membership, license or registration. (ii) The person should not been disqualified/ removed from the post of a key executive position of a company by the Commission or any other regulatory authority. (d) Integrity, Honesty and Reputation (i) The person should not have been convicted in any criminal offence or directly involved in any settlement in civil/ criminal proceedings in a court of law, particularly with regard to moral turpitude, investments, financial/business misconduct, fraud/ forgery, breach of trust, financial crime etc. and/ or it has not been concluded by any regulatory authority that he has been associated with any unauthorized financial activity including illegal brokerage business. (ii) No investigation/ enquiry, conducted under Section 139 of the Securities Act, 2015, Section 29 of the Securities and Exchange Commission of Pakistan Act, 1997, Section 21 of the Securities and Exchange Ordinance, 1969, Section 263 or Section 265 of the Ordinance, has been concluded against him by the Commission with adverse findings. (iii) An order restraining, prohibiting or debarring him from dealing in the securities market or from accessing the capital market has not been passed; or penalty of Rs.500,000/- or more has not been imposed on him by the Commission in the last three years, in respect of any laws administered by the Commission. Provided that a person may be considered eligible in case a period of at least three years from the date of expiry of the period specified in the order for which such person has been restrained/ prohibited/ debarred has elapsed. (iv) The person should not have provided false or misleading information either to the Commission or to any of the regulatory body, securities exchange, central depository or a clearing house.

Page 45 of 50 (v) The person should not have been actively involved in the management of a company whose registration or license has been revoked or cancelled or which has gone into liquidation or other similar proceedings due to financial irregularities or malpractices; (vi) The person must not be ineligible, under the Ordinance or any other legislation from acting as a director; or (vii) The person should not have entered into a plea bargain arrangement with the National Accountability Bureau. (e) Additional Criteria for Independent Directors (i) He has no relationship with the central depository that would interfere with him exercising independent professional judgment as a director and he can be reasonably perceived as being able to exercise independent business judgment without being subservient to any apparent form of interference. (ii) The person should not be a TRE certificate holder of any securities exchange in Pakistan or a director, officer, sponsor or direct shareholder of any TRE certificate holder of a securities exchange or any of holding or subsidiary company of such TRE certificate holder. (iii) The person’s immediate family member is also not a TRE certificate holder or director, officer or sponsor of any TRE certificate holder of any securities exchange in Pakistan and/ or the combined shareholding of the immediate family members in any brokerage house does not exceed twenty percent. (iv) It shall be mandatory to disclose any holding in a listed security in such person’s name or in the name of his immediate family member or in the name of an entity being managed or controlled by him or his immediate family member, or any change in such holding, to the central depository and the Commission; a. at the time of submission of initial information ; and b. On quarterly basis for the respective period, for placement of the same on the website of central depository for public disclosure. (v). The person shall have no personal services contract(s) and shall not be currently serving as an employee and has not been employed at any position of the central depository within the past two years. (vi). The person shall not simultaneously be serving as a director on the board of more than seven listed companies. EXPLANATION: Immediate family member wherever referred in these criteria means spouse, children and parents.

Page 46 of 50 Note: • All directors must inform the central depository of any change in the submitted information that may potentially affect their status of directorship, within 48 hours of knowledge of such change. • In case of any ambiguity in determination of fitness and propriety of a person in terms of this criteria, the decision of the Commission shall be final and binding upon the central depository. • Any person desiring to act as director on the board of directors or appointed as senior management officer of the central depository shall submit duly filled attached form and undertaking given below: Form for Information to be provided by Persons Desiring Prospective Directorship on the Board or a senior management office of a central depository

1. Curriculum Vitae/Resume containing: (a) Name:

Page 47 of 50 (b) Father’s or Husband Name: (c) C.N.I.C # (attach copy) (d) Latest photograph (e) Nationality: (f) Age: (g) Contact details: i) Residential address: ii) Business address: iii) Tel: iv) Mobile: v) Fax: vi) E-mail: (h) National Tax Number: (i) Present occupation: (j) Qualification(s): i) Academic: ii) Professional: (k) Experience: (Positions held during the last 10 years along with name and address of company/ institution) Information to be provided on the following sample format*: Sr# Name of Organization Designation Period 1 Company A dd/mm/yy - dd/mm/yy 2 Company B dd/mm/yy - dd/mm/yy 2. In case of proposed director,

1. Nature of directorship: Executive Non-executive
2. Status of directorship: Independent director Shareholder director

Number of shares subscribed or held _________ Nominated by (name of shareholder) 3. In case of proposed director, Names of companies, firms and other organizations of which the proposed person is presently a director, partner, office holder or major shareholder (Information to be provided on the following sample format*) Sr# Name of Organization Designation Period 1 Company A dd/mm/yy - dd/mm/yy 2 Company B dd/mm/yy - dd/mm/yy 4. In the case of nomination of director by a corporate member the date of board of directors’ meeting in which the nomination of proposed director was approved. (Attach copy of the minutes of the meeting of the board of directors.) 5. Names of any persons on the board of the central depository who are related to the applicant.

Page 48 of 50 Signature __________________________________ *use additional sheets if required

Page 49 of 50 Affidavit to be provided by Persons Desiring Prospective Directorship on the Board of the central depository or a senior management office of a central depository (On Stamp Paper of Appropriate Value) AFFIDAVIT (name of central depository) I, _____________________ son/daughter/wife of _____________________ adult, resident of ______________________________________________ and holding CNIC/ Passport No. __________________________ do hereby state on solemn affirmation as under:-

1. That I am eligible for the position of director/senior management officer according to the Fit and Proper Criteria specified for the position of directors/senior management officers of a central depository, as per the Central Depositories (Licensing and Operations) Regulations 2016.
2. That I hereby confirm that the statements made and the information given by me are correct and that there are no facts which have been concealed.
3. That I have no objection if the central depository or the Commission requests or obtains information about me from any third party.
4. That I undertake to bring to the attention of the central depository any matter which may potentially affect my status for the position of director/senior management officer as per the fit and proper criteria specified in the Central Depositories (Licensing and Operations) Regulations
6. That all the documents provided to the central depository, are true copies of the originals and I have compared the copies with their respective originals and certify them to be true copies thereof.

---

DEPONENT The Deponent is identified by me Signature__________________ ADVOCATE (Name and Seal) Solemnly affirmed before me on this ___day of ______________ at ______________ by the Deponent above named who is identified to me by , Advocate, who is known to me personally. Signature OATH COMMISSIONER FOR TAKING AFFIDAVIT”

Page 50 of 50 End note II: “Annexure III TERMS OF REFERENCE OF SYSTEM AUDIT OF CENTRAL DEPOSITORY UNDER REGULATION 15(7) A central depository shall require an independent auditor to conduct audit of its system on every alternate year in accordance with any or all of the following: (1) reviewing the information processing facilities of the central depository and the integrity of its central depository systems including: (a) maintenance of security and confidentiality over the data of the CDS Elements; (b) security over the physical operation of the central depository systems; (c) backup and disaster control and recovery procedures for central depository systems; and (d) access controls for central depository systems; and (2) assessing the integrity and accuracy of information generated by the central depository systems including, without limitation: (a) internal controls over data input by the central depository; and (b) processing and reporting of transaction data. (3) performing any other function or conducting audit of any other area as may be assigned by the Commission or central depository at the time of appointment of such auditor.”