Communiqué Regarding Operating Procedures and Capital Adequacy of Crypto Asset Service Providers

1 COMMUNIQUÉ REGARDING OPERATING PROCEDURES AND PRINCIPLES AND CAPITAL ADEQUACY OF CRYPTO ASSET SERVICE PROVIDERS (III-35/B.2) FIRST CHAPTER Preliminary Provisions Purpose ARTICLE 1 – (1) The purpose of this Communiqué is to regulate the services and activities that may be provided by crypto asset service providers, and principles in relation therewith, as well as principles regarding their capital adequacy. Scope ARTICLE 2 – (1) This Communiqué regulates the services and activities that may be provided by crypto asset service providers, and principles in relation therewith, as well as listing principles of crypto assets, and principles regarding their settlement system, capital and capital adequacy. Grounds ARTICLE 3 – (1) This Communiqué is issued in reliance upon Articles 35/B and 35/C of the Capital Markets Law 6362 of 06.12.2012. Definitions and Abbreviations ARTICLE 4 – (1) For the purposes and in the context of this Communiqué: a) Public key: Refers to a key which uniquely addresses the wallet for transfer of crypto assets from one wallet to another through distributed ledger network; b) Bank: Refers to deposit and participation banks and development and investment banks as defined in Article 3 of the Banking Law 5411 of 19/10/2005; c) BRSA: Stands for the Banking Regulation and Supervision Agency; ç) BIST 100: Stands for the index as designated by Borsa İstanbul A.Ş.; d) Wallet: Refers to software, hardware, systems or applications ensuring the transfer of crypto assets and the custody of these assets or private and public keys regarding said assets; e) Multi-party threshold cryptography: Refers to specific techniques that ensure the sharing of the private key used for control of crypto asset among more than one party by cryptographic methods, and where signature and other activities can be performed upon involvement of a predetermined number of parties in the transaction; f) Hardware security module: Refers to a module where transactions such as production of private keys, and their encryption for custody in a database, and backup are performed in a secure medium created by physical and logical measures taken against such threats as tampering and unauthorized access;

2 g) Trading marketplace: Refers to an environment where customer orders relating to crypto assets are matched with other orders in the platform; ğ) Law: Stands for the Capital Markets Law 6362 of 06.12.2012; h) PDP: Stands for Public Disclosure Platform; ı) Crypto asset: Refers to intangible assets expressing a value or right, which can be created and stored electronically by using distributed ledger technology or a similar other technology, and are distributed via digital networks; i) Crypto asset service provider: Refers to platforms, and institutions providing crypto asset custody services, and other institutions specified in the regulations to be enacted in reliance upon this Law for provision of services regarding crypto assets, including initial sales or distribution of crypto assets; j) Crypto asset custody service: Refers to custody and management of crypto assets of customers or private keys providing the right of transfer of these assets from wallets, or other custody services to be determined by the Board; k) Board: Stands for the Capital Markets Board; l) Agency dematerialized system: Refers to the records which are not inserted in the distributed ledger network, and are included in the trading platform / trading book / order book and accounting system of a platform; m) MASAK: Stands for the Ministry of Treasury and Finance, Presidency of the Financial Crimes Investigation Board; n) MKK (CRA): Stands for Merkezi Kayıt Kuruluşu Anonim Şirketi (Central Registry Agency); o) Private key: Refers to secret keys providing the right of transfer from wallets; ö) Platform: Refers to institutions where any one or more of crypto asset trading, initial sales or distribution, exchange, transfer and associated custody transactions or other transactions that may be specified in relation therewith are executed and performed; p) Project owner: Refers to natural person(s) or legal entity(ies) who develop a project for production of a crypto asset; r) Depository institution: Refers to an institution authorized by the Board for provision of crypto asset custody services; s) Hot wallet: Refers to a wallet technology, connected to the internet, not specified as a cold wallet, which is used by crypto asset service providers in order to execute crypto asset transfers for their customers; ş) Cold wallet: Refers to a wallet technology where keys ensuring the control of crypto assets are protected by physical, administrative and technical information security controls, and which allow execution of critical transactions like transaction approval and transaction signature with intervention of authorized personnel in offline environments isolated from the internet by physical or technical air gaps; t) TEFAS: Stands for Turkish Electronic Fund Trading Platform;

3 u) Token: Refers to crypto assets representing a value, service or right within a certain ecosystem, created on an existing distributed ledger technology with the help of smart contracts, without having its own distributed ledger network; ü) Transfer: Refers to transfer of crypto assets available in wallets to other wallets via distributed ledger technology; v) TÜBİTAK: Stands for the Scientific and Technological Research Council of Türkiye; y) TÜBİTAK Infrastructure Criteria: Refers to a document prepared and issued by TÜBİTAK with regard to information systems and technological infrastructures of crypto asset service providers; z) Communiqué III-35/B.1: Refers to the Communiqué Regarding Principles on the Establishment and Operation of Crypto Asset Service Providers (III-35/B.1), published in the Official Gazette edition 32840 on 13.03.2025; aa) Communiqué III-37.1: Refers to the Communiqué Regarding Investment Services and Activities and Ancillary Services (III-37.1), promulgated in the Official Gazette edition 28704 on 11/7/2013; bb) Communiqué VII-128.10: Refers to the Communiqué Regarding Procedures and Principles of Management of Information Systems (VII-128.10), published in the Official Gazette edition 32840 on 13.03.2025. SECOND CHAPTER Services and Activities That may be Provided by Crypto Asset Service Providers Services and Activities of Crypto Asset Service Providers ARTICLE 5 – (1) Services and activities regulated by this Communiqué and permitted to be performed with a prior license received from the Board are as listed below: a) Reception and execution of orders regarding crypto assets, clearing and transfer of crypto assets, and custody services needed in relation therewith; b) Intermediation in initial sales or distribution of crypto assets; c) Custody and management of crypto assets and private keys used for crypto assets, and other custody services that may be determined by the Board; ç) Investment consultancy activities relating to crypto assets; d) Other services and activities that may be determined by the Board. Obligation to Obtain a License for Crypto Asset Services and Activities ARTICLE 6 – (1) It is required to obtain a prior license from the Board for execution and provision of each of the services and activities regulated under this Communiqué as a regular occupation, business or professional activity. (2) Services and activities that may be provided by crypto asset service providers may be performed and provided only by crypto asset service providers specifically authorized under Articles 35/B and 35/C of the Law.

4 (3) However, acts of trading and transfer of crypto assets by crypto asset service providers for their own wallets with any parties, other than their customers, without any intention to provide crypto asset services thereto, shall not be subject to a license to be received from the Board. (4) The Board may determine different principles for services to be provided and activities to be performed under this Communiqué by Borsa İstanbul A.Ş., İstanbul Takas ve Saklama Bankası A.Ş., MKK (CRA) and public organizations, and other entities or institutions that may be determined by the Board. Other Services ARTICLE 7 – (1) Other services that may be provided by crypto asset service providers in relation with and as a part of the services and activities within their sphere of authorization are as follows: a) Trading, initial sales or distribution, clearing, transfer and custody transactions and operations of unique and non-fungible assets used to register representation and ownership of digital assets, and assets used only to create or supply various different elements in virtual games; b) Financial analysis and general advice regarding crypto assets (2) The Board may further determine services other than those specified in the first paragraph above. Obligation of Notification for Other Services ARTICLE 8 – (1) Other services shall be performed and provided by crypto asset service providers within the frame of principles determined by the Board without being subject to a separate certificate of authorization. (2) Crypto asset service providers are liable to notify the Board about other services planned to be performed and provided by them hereunder, at the time of their application for an operating license. If other services are also intended to be provided after receipt of an operating license, a separate notice is required to be sent to the Board for them as well. (3) Unless stated otherwise by the Board within twenty business days after delivery of a notice to the Board, such other services covered by the notice may be started to be performed and provided in accordance with the principles mentioned in this Communiqué. Time spent for completion of the incomplete information and documents that may be requested by the Board shall not be taken into consideration in calculation of this period of time. Activities of Entities Resident Abroad ARTICLE 9 – (1) Provided that such activities as promotion, advertisement and marketing addressed to persons resident in Türkiye are not carried out, all kinds of services received by persons resident in Türkiye, entirely in their sole discretion, from crypto asset service providers resident abroad, accounts they open in said institutions, cash funds and crypto assets transferred to said accounts, and transactions executed via such accounts shall not be covered by this Communiqué. (2) In the case of opening of a place of business in Türkiye by entities resident abroad, creation of a Turkish internet website, performance of promotion and marketing activities either

5 directly and/or indirectly through persons or entities resident in Türkiye in respect of their investment services and activities, and upon occurrence of any one of these events, the related activities shall be considered and treated to be addressed to persons resident in Türkiye, and the provisions of laws and regulations pertaining thereto shall be enforceable. THIRD CHAPTER Principles Regarding Platform Activities Scope and General Principles of Platform Activities ARTICLE 10 – (1) Platform activities refer to any one or more of the receipt by platforms of customer orders relating to crypto assets, execution and clearing of said customer orders by matching or as counterparty, initial sales or distribution, transfer, custody as may be needed, and other transactions determined in connection therewith. (2) During conduct of platform activities, platforms are under obligation to comply with the following principles: a) Platforms shall execute customer orders in compliance with the order execution policy and the principles set down in the framework agreement signed with customer. b) Cash credit balance of customers shall be reported to a bank upon demand of the customer as of the day the demand is submitted. c) Trading and transfer transactions of customers, and their cash and crypto asset balances shall be tracked fully, accurately and currently on a customer basis on the institutional dematerialized system, separately from the platform’s own accounts. (3) Operation of peer-to-peer digital marketplaces which allow trading and exchange of crypto assets directly between customers shall also be considered under the provisions of first paragraph. In the operation of peer-to-peer digital marketplaces, it is required to comply with the rules and limitations set forth both in this Communiqué and in the Communiqué of III￾35/B.1 with respect to the know-your-customer rule. (4) If demanded so by customers, crypto assets belonging to the network as a requirement of the structure of the distributed ledger network, may be locked by the platform and returned in kind at the end of maturity, under the provisions of the framework agreement to be signed with customers. (5) Platforms may also provide liquidity provision or market making services to other platforms. (6) Activities of the entities or institutions the primary field of business of which is comprised of trading, initial sales or distribution, clearing, transfer and custody transactions and operations of unique and non-fungible assets used to register the representation and ownership of digital assets, and assets used only to create or supply various different elements in virtual games, shall not be considered and treated as platform activities. (7) Activities of the entities or institutions the primary field of business of which is comprised only of quoting prices to platforms for provision of liquidity and execution of transactions over the prices quoted, and which do not provide any external services to investors in such manner to be covered by the definition of platform in the Law, shall not be considered and treated as platform activities.

6 Establishment of a Trading Marketplace by Platforms ARTICLE 11 – (1) Platforms may execute customer orders in a trading marketplace. Customer orders may also be matched in a trading marketplace through a customer order which is an entity resident domestically or abroad and is providing both bid price and ask price for the relevant asset. (2) In the case of execution of customer orders by platforms in a trading marketplace, orders may be entered into the trading marketplace of the platform by entities resident abroad or by customers of said entities. Opening of a trading marketplace to entities resident abroad shall not remove liabilities and responsibilities of the platform arising out of the applicable laws. (3) Before allowing platforms to enter orders into the trading marketplace of foreign entities and organizations, it is required to receive all required information and documents from said entities and organizations regarding their customers entering orders under pertinent provisions of the Law Regarding the Prevention of Laundering of Proceeds of Crime 5549 of 11.10.2006, and other applicable laws and regulations. Duties and obligations of platforms arising out of the Law on the Prevention of Financing of Terrorism 6415 of 07.02.2013 and the Law Regarding Prevention of Financing of Proliferation of Weapons of Mass Destruction 7262 of 27.12.2020 shall be applicable and enforceable also on foreign entities and organizations and their customers. (4) For transactions and operations to be carried out under the second paragraph, a contract is required to be signed between the platform and the entity resident abroad, and the crypto assets that are covered by services to be received from said entities is required to be published on the internet website of the platform. (5) Platforms may enter customer orders into their own trading marketplace in such manner not to lead to any conflicts of interest between themselves and the investor and under the principles determined pursuant to Article 18. (6) Platforms may establish different markets for trading of crypto assets by taking into consideration the qualities of project owner, buyers and sellers of crypto asset, as well as listing conditions, liquidity status and similar other criteria. Different rules of functioning may be set down for each market, and if deemed necessary, the Board may determine and impose principles in relation therewith. Execution of Customer Orders by Platforms as Counterparty ARTICLE 12 – (1) Platforms may execute customer orders outside the trading marketplace by directly meeting the same from their own wallets. In cases where customer orders are executed as counterparty, investors shall be duly informed that a loss incurred by the customer may result in a profit earned by the platform. (2) With the exception of transactions executed as a part of liquidity provision and market making activities, in transactions executed by platforms as counterparty against their customers, platforms are essentially required to make sales up to the amount of crypto assets existing in their wallets. As of the time specified in the second paragraph of Article 33, balances arising out of transactions under this Article shall be settled.

7 Price Monitoring Systems of Platforms ARTICLE 13 – (1) Platforms are under obligation to establish a unit for the management of the price monitoring system, and to assign at least one risk management officer exclusively for working in said unit. This unit may be created as a part of the risk management system built under Article 45 of the Communiqué III-35/B.1. (2) Price monitoring units shall detect actions and transactions that are executed in platforms that cannot be explained by a reasonable and economic justification, as well as actions and transactions that may disrupt the operation of transactions in platforms in security, openness and stability, and shall report such findings to the general manager. Thereupon, the general manager is obligated to take necessary actions and measures including, restriction, suspension and closing of accounts executing the aforesaid actions and transactions, and to immediately report said actions and measures to the Board. (3) Functioning of the price monitoring system, and tools and methods to be used therein, principles for their, and measures to be taken shall be set down in a written procedure issued and applied in reliance upon a resolution of the board of directors. (4) Obligations and liabilities set forth in this Article shall not be applicable to transactions relating to crypto assets considered by the Board to be traded commonly in foreign markets and priced in foreign markets as well. Leveraged, Margin and Derivative Trading by Platforms ARTICLE 14 – (1) Crypto assets listed in platforms may not be traded on leveraged basis, and may not be subject to derivative instrument contracts or margin buying, short selling and lending transactions under regulations of the Board on margin trading. Investment Advice and Portfolio Management Activities Relating to Crypto Assets ARTICLE 15 – (1) Investment advice is an activity wherein a platform provides influential comments and advice about crypto assets to a certain person or to a group similar or identical in terms of financial situation, and risk and return preferences, upon and in line with a customer request or without a customer request. Investment advice activity may only be directed to customers the current value of crypto assets held in the platform is minimum TL 50,000,000. (2) For activities to be performed by platforms under the first paragraph, an adequate number of investment advisors graduated from four-year universities and having a minimum past experience of three years in financial markets is required to be employed, and a research unit is required to be established within the platform organization in accordance with the principles set down in the Communiqué III-37.1. In the performance of investment advice activities, principles set down in the Communiqué III-37.1 pertaining to investment advice shall be applicable by analogy. (3) It is prohibited to manage customer portfolios in the name of each customer as and in the capacity of a proxy to directly or indirectly confer a benefit, or in reliance upon a verbal authorization of customer in such manner to lead to the same consequence. (4) Performance of financial analyses and provision of general advice regarding crypto assets shall not be considered as investment advice activity, and the principles set down in Article 50 hereof shall be applicable in the provision of these services.

8 Intermediation of Platforms in Initial Sales or Distribution ARTICLE 16 – (1) Platforms are under obligation to check minimum elements to be included in smart contracts depending on type and legal description of each crypto asset the initial sales or distribution of which they are going to mediate, and to inspect the accuracy of said contracts. (2) Platforms may not mediate in initial sales or distribution of crypto assets assessed not to be in conformity with the minimum listing criteria set forth in this Communiqué. (3) In cases where the Board determines, under Article 13 of the Law, that capital market instruments are issued as crypto assets, and they are traced on book-entry basis in electronic media provided by crypto asset service providers where they are created and stored, platforms are under obligation to perform checks to ensure that crypto assets classified as capital market instruments the issue of which they are going to mediate are duly issued in such manner to allow compliance with the principles and liabilities set down in the related regulations of the Board. (4) In the event that assets which are covered by the jurisdiction of different institutions and authorities in terms of subject and type thereof are sold or distributed as token, platforms are liable to confirm that the conditions stipulated in the regulations of the relevant institution or authority are satisfied, and to perform checks to ensure that the related smart contract is drafted and issued in compliance with the pertinent regulations. (5) Sales or distribution referred to in the fourth paragraph may be made through distributed ledger technologies developed by the platform, the company engaged in initial sales or distribution of crypto assets, or by the project owner itself, or through existing distributed ledger technologies. In both cases, platforms shall be held responsible on conditions stipulated in this Article with respect to smart contracts of crypto assets the initial sales or distribution of which they intermediate. (6) Listing of the same crypto asset in each platform for the first time shall be considered as an activity of intermediation in initial sales or distribution of related asset for the relevant platform. However, relisting of a delisted crypto asset shall not be considered and treated as such. (7) A custody infrastructure should be creatable for crypto assets the initial sales or distribution of which is intermediated hereunder. Custody of Crypto Assets of Customers in Platforms ARTICLE 17 – (1) Platforms may keep and store crypto assets of their customers collectively in one or more wallets, in strict compliance with the limitations arising out of their capital adequacy obligations. (2) Apart from the provisions of the first paragraph, in cases where depositary institutions fail to provide custody services for a crypto asset listed in platforms, without prejudice to capital adequacy provisions, platforms may keep and store the relevant asset for a maximum period of six months. At the end of this period, the related crypto assets shall be transferred to wallet addresses designated by customers by informing the customers thereabout. In cases where a customer fails to designate a wallet address or cannot be reached, the related crypto asset may be sold out in accordance with the principles set down in the framework agreement, and its

9 sales proceeds may be transferred in cash to the customer account, or the related assets may be continued to be kept and stored in platform by informing the customer thereabout. (3) The transfer of crypto assets kept in custody in a platform to wallets held in depository institution is optional, with the exception of settlement and customer requests. (4) For crypto assets kept in custody in platforms, compliance with the principles of custody set forth in the Communiqué shall be ensured. Order and Transfer Execution Policy and Trading Principles ARTICLE 18 – (1) Platforms are under obligation to execute orders in such manner to achieve the best possible result for the customer under the order execution policy and trading principles, with due consideration of customer preferences with respect to price, cost, speed, execution probability, clearing, size, custody and similar other issues pertaining thereto. (2) Order execution and trading principles shall be determined by platforms in such manner to ensure that transactions are executed in a secure, transparent, efficient, steady, fair, honest and competitive fashion, and that market abuse actions and transactions are detected, prevented and ensured not to be repeated, and to this end, an order execution policy that shall take effect by a resolution of the board of directors shall be created. Said policy is required to contain as a minimum the following elements: a) Order types, order validity time, order acceptance and cancellation principles. b) Principles of appointment of market makers and/or liquidity providers, and their rights and obligations determined as a part of contractual relations. c) Principles of modification and cancellation of standing orders or executed trades as a minimum under the following criteria:

1. Extraordinary events arising out of the system and applications linked to the system that do not result from the platform, and codes of conduct in relation with such events;
2. Transactions executed upon an erroneous order or orders transmitted by customers to trading systems;
3. Other material factors that may suspend transactions of traded crypto assets. ç) Price increments to be applied in orders, and price notation principles in crypto assets to be listed. (3) Order execution policies shall be reviewed at least once annually. Said policies shall also be separately reviewed and updated, if needed, upon consideration of experiences gained in processing and for the implementation of amendments made by the Board in the applicable legislation. (4) Changes to be made in the trading marketplace or in the policy for meeting customer orders shall be notified to customers no later than fifteen days in advance. The burden of proof for this notification lies with platforms. (5) An order number shall be assigned by the platform system to all orders transmitted and accepted. Orders with an order number shall be matched with other standing orders according to the order, trading and priority rules within the frame of the order policy prepared pursuant to the first paragraph, and are converted to trading, or shall be recorded in the related order book without being traded.

10 (6) Price and time priority rules shall be applied respectively as priority rule in matching orders registered the in platform system. Price priority rule refers to meeting of ask orders with a lower price before ask orders with a higher price, and meeting of bid orders with a higher price before bid orders with a lower price, while time priority rule refers to meeting with priority of orders registered in the system earlier in timing, in the case of price equality. Reporting of Special Events in Market ARTICLE 19 – (1) Upon occurrence of any one of the following events, platforms are required to send a notice in writing or electronically through the registered communication addresses of customers: a) Technical problems that prevent platforms from executing customer orders; b) Modifications arising out of the distributed ledger network’s own structure and known or expected to be known by platforms, and potential effects of such modifications on the market; c) Procedural steps aimed at compensating crypto assets losses caused by the platform. (2) In notifications to customers, the burden of proof of notice lies with the platform. FOURTH CHAPTER Listing Principles Listing Committee ARTICLE 20 – (1) Listing committee to be appointed by platform board of directors: a) Is required to be composed of minimum three members; b) Majority of full number of its members are required to have a minimum past experience of seven years in finance, law, information technologies, information security and distributed ledger network technologies fields; b) Minimum one member must be a member of the platform board of directors. (2) Listing committee shall be entrusted with the task of checking the decisions to be taken with respect to listing and delisting of crypto assets, and conformity of the crypto assets to be listed, in terms of principles referred to in Article 21, by showing due diligence and care as required. (3) The listing committee shall prepare an assessment report as to whether crypto assets are can be listed within the frame of the procedure to be designated under Article 22, or as to whether a listed crypto asset is required to be delisted, and crypto assets shall be listed or delisted according to results of said assessment reports. These reports shall be kept and stored under regulations pertaining to documentation and recording by crypto asset service providers. (4) With the exception of subparagraph (c) of the first paragraph, committee members are required to be employed by the platform. However, committee members of this category shall be subject to the principles and rules set down in the Communiqué III-35/B.1 pertaining to personnel. (5) Appointment of listing committee members and dismissals therefrom and their justification shall be notified in writing by platforms to the Board and to Sermaye Piyasası Lisanslama Sicil ve Eğitim Kuruluşu Anonim Şirketi (Capital Markets Licensing Registry and Training Agency Inc.) within two business days.

11 Crypto Assets that Can Be Listed ARTICLE 21 – (1) With the exception of the second paragraph of Article 17, it is essentially required to list in platforms, the crypto assets that can be kept in custody in depository institutions duly authorized by the Board. Crypto assets to be listed by platforms are required to be in compliance with the following principles: a) They are required to conform with principles set down in the first, third and fourth paragraphs of Article 16; b) No limitation or prohibition must have been imposed by the relevant authorities on issuance and trading of crypto assets, and they must not be usable in such manner to violate the applicable laws and regulations or for that purpose to a material extent; c) They must not have been created so as to unilaterally provide the project owner with extraordinary rights; ç) Project owner must not be named in national or international exclusion lists due to commitment of the crimes of laundering proceeds of crime or financing of terrorism and under the pertinent provisions of the Law Regarding Prevention of Financing of Proliferation of Weapons of Mass Destruction 7262 of 27.12.2020; d) They must not be of a type allowing transfers by concealing the wallet addresses; e) They must be of a type that can be stored in custody in cold wallets. (2) With the exception of crypto assets referred to in the third and fourth paragraphs of Article 16 and other crypto assets that may be determined by the Board, platforms may not list crypto assets the initial sales or distribution of which are effected by themselves or: a) By a natural person or their spouse and children under their custody, and corporations they participate as shareholder with unlimited liability, where they serve as chairperson or member of board of directors, as general manager, or deputy general manager; b) By a legal entity, with the exception of public legal entities, or by corporations participated by those referred to above directly or indirectly in 10% or more of capital shares or voting rights therein; c) By those persons or entities which are determined by the Board to act in concert due to employment relations, contractual relations or other reasons. (3) Assets mentioned in subparagraph (a) of first paragraph of Article 7 are excluded from listing principles. Listing and Delisting Procedures of Platforms ARTICLE 22 – (1) Platforms are liable to prepare a written procedure setting down the principles regarding selection and determination of crypto assets to be traded therein and termination of their trading. Said procedure shall be prepared by taking into consideration as a minimum the principles listed below, aside from the criteria set forth in Article 21, and shall become effective upon a resolution of board of directors: a) Whether the crypto asset grants a right to user of crypto assets, and characteristics of such right; b) Trading volume and supply in circulation of the crypto asset;

12 c) Whether supply of the crypto asset is limited or not; ç) Trading speed and costs specific to the related asset; d) Reliability of the crypto asset and its systems, including distributed ledger network, related to the crypto asset; e) Traceability of crypto asset trades; f) Price movements of the crypto asset in past periods; g) Whether or not the crypto asset is susceptible to price manipulation or fraud for any reason whatsoever, and whether or not there are any solutions or mitigating measures that may be implemented by the platform; ğ) Whether value of crypto asset is determined algorithmically or not; h) Where the project owner is identifiable, past records about the project owner or company engaged in initial sales or distribution of crypto asset, including whether or not it is involved in or subjected to any investigation or allegation regarding fraud or capital market crimes defined in the Law; ı) If the crypto asset represents the ownership of any other asset or legal right, the usability of such rights; i) Status of the crypto asset under effective regulations in Türkiye and abroad, and especially, whether an approval is received from any regulatory authority for the issuance of the crypto asset or not, or whether said regulations are breached or not; j) Degree of weight of a person or group in the ownership or control of the crypto asset; k) Potential security risks relating to bifurcation transactions of crypto assets (2) Current list and listing procedure with respect to crypto assets deemed fit for listing under listing and delisting procedures shall be published on the platform internet websites. Lists published during the last six months shall be accessible in such manner to allow retrospective searches on a historical basis. (3) The listing and delisting procedure shall be reviewed at least once annually. Platforms are under obligation to monitor the financial strength, cyber security gaps, compliance with national and foreign legislation, or technological or infrastructural problems that may lead to customer grievance, with respect to crypto assets they list, and the company or project owner engaged in the initial sales or distribution of said crypto assets, and to make the required updates in the listing procedure as and when needed in relation therewith. (4) Measures to be taken upon of the need of delisting of a crypto asset due to an extraordinary event or circumstance shall also be included in the listing and delisting procedure. (5) Principles determined by MKK shall be implemented in regard to notifications to MKK of the listed and delisted crypto assets. Delisting ARTICLE 23 – (1) In cases where platforms detect that a crypto asset they have listed no longer fulfills the criteria in their listing and delisting procedure, they may delist the related crypto asset within the frame of an assessment report to be issued. In this case, with the exception of principles mentioned in the second and third subparagraphs, platforms are under

13 obligation to notify to their customers of crypto assets planned to be delisted via their registered communication means at least seven days in advance. (2) If a crypto asset is delisted by a crypto asset platform of global scale, platforms may delist the related crypto asset without waiting for seven days, by informing investors thereabout at least one day in advance. This time of one day may also be skipped in case of delisting due to the occurrence of extraordinary circumstances in global markets. (3) Upon occurrence of the following events, crypto assets may be delisted without waiting for seven days, and all trading and transfer transactions of the related crypto assets shall be stopped: a) If it is later determined by the platform that the crypto asset does not conform to the principles specified in the first paragraph of Article 21, or a request is transmitted to platform by public authorities or juridical authorities in relation therewith; b) If reasonable doubt arises about reliability of the related crypto asset or the systems of associated distributed ledger network. (4) Trading in crypto assets decided to be delisted pursuant the first and second paragraphs may be enabled by platforms in peer-to-peer digital marketplaces. In any case, upon demands of customers, the related crypto assets shall also be allowed to be returned in kind or in cash. FIFTH CHAPTER Custody Service and Transfer Principles Scope of Crypto Asset Custody Services ARTICLE 24 – (1) Pursuant to the sixth paragraph of Article 35/C of the Law, it is essentially required to hold crypto assets of platform customers in the related customers’ own wallets. Crypto asset custody services refer to custody and management of crypto assets which the platform customers do not prefer to hold in their own wallets, or private keys relating to said assets, or other custody services that may be determined by the Board. (2) Depository institutions may directly offer and provide custody services to customers other than platform customers. However, provision of wallet services by a method wherein full control of the private key is left to the investor shall not be considered and treated as custody services. Institutions Which May Perform Custody Services ARTICLE 25 – (1) Custody services may be provided by banks duly authorized to provide crypto asset custody services pursuant to Communiqué and deemed fit by BRSA, or by other organizations duly authorized by the Board to provide crypto asset custody services. General Principles and Rules of Custody Services ARTICLE 26 – (1) Crypto assets belonging to customers shall be kept in custody collectively in the name of platform, separately from the depository institution’s own accounts. (2) Without prejudice to provisions of the Law 5549 and other applicable laws, platforms do not need to sign an external contract with depository institutions of their customers.

14 (3) Where depository institutions directly provide custody services to customers pursuant to the second paragraph of Article 24, with respect to said services, depository institution is required to enter into a separate contract with such customers, and to ensure that the probable risks of such services are clearly explained and disclosed to customers in detail. Crypto assets belonging to these customers shall be kept in custody by the depository institution separately for each customer. (4) All keys and their parts used by depository institution for control of customer assets are required to be stored and kept in secure hardware modules in accordance with principles set forth in TÜBİTAK Infrastructural Criteria. (5) It is required to prepare and issue a written procedure containing principles regarding the performance of custody services under the principles set down in this Communiqué to be put into effect by a resolution of board of directors, and to keep this procedure current by reviewing and revising it at least once annually. (6) Size of hot wallet of depository institutions is required to be up to 5% of total customer assets. (7) In the event that a depository institution keeps in custody all crypto assets belonging to platform customers, the depository institution may execute transfer orders with respect to these customer assets in accordance with the principles referred to in Articles 29 and 30. Upon consideration of the amount of transfers during the day, size of hot wallet of depository institutions functioning in this way may rise up to maximum 10% of total customer assets. (8) In calculation of percentages referred to in the sixth and seventh paragraphs, transfers that are signed, but pending to be inserted in the distributed ledger network shall not be taken into account. (9) The service described in the fourth paragraph of Article 10 may also be provided by depository institutions. Principles and Rules on Access to Keys ARTICLE 27 – (1) Crypto asset service providers shall comply with the principles set down in TÜBİTAK Infrastructural Criteria with respect to management of and access to assets and mechanisms such as private keys, mechanisms employed in production of private keys, and keys used in their backup process. (2) In cases where private keys are disassembled by such mechanisms as multi-party threshold cryptography, each of these parts and the mechanisms where key components are used, are required to be kept in Türkiye with their backups, and they must be under control of crypto asset service providers. Special Principles on Wallet Technologies ARTICLE 28 – (1) The following minimum conditions are sought for in components of secure hardware module and critical software programs relating to wallets where customer assets are kept in custody by crypto asset service providers: a) Keys or key components in wallets are essentially required not to be removed from the secure hardware module. However, they may be removed for backup or storage purposes only by using a method certificated to be secure.

15 b) All security measures shall be taken as needed in order to prevent unauthorized access and sabotage attempts that may be carried out physically or electronically against secure hardware module and ingredients functioning in integration with that module. c) Secure hardware module is required to be resistant against physical interventions and to delete the confidential information contained therein, thus making the same inaccessible, and/or to provide an alert in the case of a probable physical intervention attempt. (2) Crypto asset service providers shall comply with the principles set forth in TÜBİTAK Infrastructural Criteria, aside from the principles referred to in the first paragraph, with respect to wallet technologies. (3) TÜBİTAK is authorized to determine the testing and certification conditions to be applied on secure hardware modules used in wallet architecture, and on software controlling said modules and used for identity verification and policy controls. (4) With the intention of preventing unauthorized copying attempts, the process of preparation of secure hardware modules for use, creation of backup recovery keys, and delivery of keys to authorities shall be carried out under supervision of TÜBİTAK or information systems independent audit firms. Transfer Orders Execution Process ARTICLE 29 – (1) Transfer orders execution process refers to the process of signature and transmission to distributed ledger network of transfer orders after successful completion of their process of audit of access to wallets defined in the second paragraph. (2) Audit of access to wallets refers to the entirety of control and verification of the fact that transfer orders are placed and approved by authorized parties, that the process is conducted in compliance with the regulations of the Board, the policies determined by crypto asset service providers, and the custody contract signed pursuant to Article 31 of this Communiqué. For aforesaid controls, a policy shall be created and put into effect by a resolution of board of directors. The following points shall be taken into consideration in audits of access to wallets: a) Actions and measures shall be taken in order to prevent internal or external attacks which may cause interruption or excess of controls. b) Within mechanisms for audit of access to wallets, it is required to use such technologies as smart cards which safely produce, hold and process private keys and support multi-factor identity verification. (3) The process for audit of access to wallets and the process for execution of transfers are considered as separate processes. The process for execution of transfers may not be initiated before completion of the process for audit of access to wallets. (4) Crypto asset service providers shall comply with the principles set forth in TÜBİTAK Infrastructural Criteria, aside from the principles referred to in the second and third paragraphs, with respect to wallet technologies. Principles on Execution of Transfer Orders ARTICLE 30 – (1) The regulations issued by MASAK are required to be complied with in the execution of transfer orders.

16 (2) In transfer orders, the multi-factor identity verification mechanism described in the Communiqué VII-128.10 is required to be applied on investors, and it is required to take measures for keeping in strict confidence all identity verification data employed during use of these factors in identity verification process. (3) As of the time of transmission of a transfer order, it shall be possible to approve transfer requests below TL 1,000,000 by a fully automated processes. Under this paragraph, platforms may determine a higher amount up to three-ten-thousandth of current value of total crypto assets kept in the institution’s dematerialized system in the name of the customer, while depository institutions may determine a higher amount up to three-ten-thousandth of the current custody balance of the customer. For approval of transfer orders under this paragraph, at least two of the officers defined in the Communiqué III-35/B.1 shall be authorized by a resolution of the board of directors. At least one of these persons authorized as above is required to be a deputy general manager and/or in a higher job position. (4) The provisions of this Article are not applicable to transfers to be executed between the platform and depository institution under Article 41. Custody Contract ARTICLE 31– (1) A service contract must be signed between platforms and depository institutions. (2) This contract shall contain clauses pertaining to insertion of transactions by depository institutions into the distributed ledger network system, as to how the cost to be incurred for use and management of distributed ledger network system will be reflected on the parties, and rights and obligations of parties in the case of termination of the contract. (3) If a depository institution loses the conditions sought for in this Communiqué, platforms are required to sign a contract with another depository institution. However, liability of the depository institution being a party to the former contract shall remain in force until the new custody contract becomes effective. SIXTH CHAPTER Settlement System MKK (CRA) Integration ARTICLE 32 – (1) Platforms and depository institutions are obligated to ensure integration with MKK, and to issues reports demanded by MKK, with regard to information on balances of customer crypto assets held in the institution’s dematerialized system. (2) Principles and procedures regarding reports to be submitted by platforms and depository institutions to MKK, transactions to be conducted and notifications to be sent by MKK in connection therewith, shall be determined by a directive to be issued by MKK and approved by the Board. (3) Reports to be submitted by platforms and depository institutions to MKK under the first paragraph are required to entail the same results. The reports submitted by platforms and depository institutions to MKK shall be compared by MKK, and as a result of this comparison, central dematerialized reports shall be created. Central dematerialized reports shall be displayed in the MKK E-Investor system in such manner to allow balance inquiry by customers.

17 (4) In the case of a discrepancy between reports submitted by the platform and the depository institution, a notification with respect to this discrepancy shall be urgently sent by MKK to the Board. Principles of Settlement System ARTICLE 33 – (1) Platforms shall conduct netting separately for each customer on transactions registered in the institution’s dematerialized system on the basis of each crypto asset, and shall issue a netting report. If deemed necessary as a result of the netting report in accordance with the principles set forth in Article 41, a transfer shall be made between platform wallet and depository institution wallet. (2) Transfers of customer assets to be done between platform wallet and depository institution wallet as per netting report shall be executed as of 23:59 hours. However, end of day shall not be waited for transfers to be done upon customer demand or if a transfer is needed to be done as per the principles set forth in Article 41. SEVENTH CHAPTER Capital Adequacy Capital ARTICLE 34 – (1) Initial capital of platforms is required to be minimum 150,000,000 Turkish Liras. (2) Initial capital of depository institutions is required to be minimum 500,000,000 Turkish Liras. (3) Amounts of capital re-determined as per Article 53 are required to be provided by no later than the end of sixth month of the relevant year. Shareholders’ Equity ARTICLE 35 – (1) Shareholders’ equity of crypto asset service providers may not be less than their initial capital determined in Article 34. (2) As of the sixth month of every year, at least 25% of shareholders’ equity of crypto asset service providers is required to be provided as paid or issued capital. (3) Shareholders’ equity of platforms may not be less than the liquid reserve requirement. (4) An additional shareholders’ equity shall not be sought for if total amount of customer assets held in custody by depository institutions is up to TL 1,000,000,000. In cases where the total amount of customer assets exceeds TL 1,000,000,000, the depository institution is required to hold a shareholders’ equity equal to 1.5% of the amount in excess, in addition to its initial capital. If the amount of shareholders’ equity is TL 1,500,000,000, an additional shareholders’ equity shall not be sought for. (5) The requirement mentioned in fourth paragraph is traced as of the ends of third, sixth, ninth and twelfth months of each year. In calculation of this requirement, the quarterly arithmetical average of total sums of customer assets calculated as of the month-ends is taken into account.

18 Capital Adequacy Base ARTICLE 36 – (1) Capital adequacy base of platforms refers to the amount remaining after deduction of the following asset items from shareholders’ equity amount calculated as per Article 35 of this Communiqué: a) Fixed assets:

1. Tangible fixed assets (net),
2. Intangible fixed assets (net),
3. Financial fixed assets remaining after deduction of capital subscriptions and provisions for impairment losses, with the exception of assets traded in stock exchanges and other organized markets,
4. Other fixed assets. b) Receivables from personnel, shareholders, subsidiaries, affiliates and other persons or entities with which the corporation is directly or indirectly associated in terms of capital, management and audit, even if in the capacity of a customer, as well as capital market instruments issued by aforesaid persons and entities and not traded in stock exchanges and other organized markets. c) Amount of guarantees to be deposited to service providers, and receivables from said service providers, within the frame of cooperation entered into by platforms with liquidity providers or market makers. ç) Current value of crypto assets continued to be kept in custody as of the end of the six month period under the second paragraph of Article 17, as calculated by using the price information in the related platform. (2) Capital adequacy base of depository institutions refers to the amount remaining after deduction of the asset items referred to in subparagraphs (a) and (b) of the first paragraph from the shareholders’ equity amount calculated as per Article 35. Principles of Appraisal and Reporting Date ARTICLE 37 – (1) In calculation of shareholders’ equity and capital adequacy base of crypto asset service providers, the principles of appraisal described in Article 5 of the Communiqué Regarding Principles on Capital and Capital Adequacy of Intermediary Institutions (Serial V, No. 34), published in the Official Gazette edition 23384 on 26.06.1998, shall be taken into consideration, with the exception of crypto assets included in their portfolio. (2) Whether crypto asset service providers meet and satisfy the requirements set forth in this Communiqué shall be reported to the Board within two business days following the 7 th , 15th, 23rd and last day of each month within the frame of principles and methods to be determined by the Board. (3) The Board may alter the timing of calculation and of submission to the Board of tables relating to requirements set forth in this Communiqué. The Board may, if deemed necessary, request any crypto asset service providers who fail to meet any one or more of the said requirements to submit in more frequent periods the tables required to be prepared and sent to the Board pursuant to and under this Communiqué.

19 Capital Adequacy Base Requirement ARTICLE 38 – (1) Capital adequacy base of crypto asset service providers shall not be less than any one of: a) total sum of provisions for risks, b) operating expenses incurred within the last three months prior to the reporting date. (2) Operating expenses incurred within the last three months cover not the total sum of cumulative operating expenses incurred as of the ends of said months starting from the beginning of year, but only the total sum of operating expenses incurred within those months. Borrowing Limit Requirement ARTICLE 39 – (1) Total sum of all short and long-term liabilities of crypto asset service providers shown in their balance sheet shall not exceed three times their capital adequacy base. In determination of the amount of debts, their current values shall be taken into account. Liquidity Requirement ARTICLE 40 – (1) Crypto asset service providers are required to hold current assets at least equal to their short-term liabilities under the principles set forth in Article 36 of the Communiqué III-35/B.1. (2) Current assets shall be taken into account with their current values. Items deducted in calculation of the capital adequacy base and items the position risk of which is determined to be 100% shall not be taken into account as current assets. Custody Limits and Liquid Reserve Requirement ARTICLE 41– (1) Minimum 95% of crypto assets which customers do not opt to hold in their own wallets is essentially required to be kept in custody at a depository institution under the clauses of this Communiqué. The maximum 5% portion not kept in custody at a depository institution shall be kept in custody in wallets contained in the platform within the frame of principles set forth in Article 26. (2) Rates specified in first paragraph shall not be calculated separately for each crypto asset, but the sum of current values of crypto assets shall be taken into account in the calculation. These rates shall be tracked instantly. Transfers shall be completed so as to reach the percentages specified in the first paragraph as of the settlement time. In any case, total rate of crypto assets of customers held in wallets contained in the platform may not exceed 10% during the day. If this limit of 10% is exceeded at a certain time, the portion in excess is essentially required to be transferred to a depository institution immediately without waiting for the settlement time. (3) It is required to hold a liquid reserve of 3% of customer assets kept in custody by the platform under the first and second paragraphs. (4) The Board is authorized to determine the assets that may be included in liquid reserve calculations and their valuation coefficients. The Board may further decide not to include certain crypto assets kept in custody in liquid reserve calculations. (5) Until the current value of each crypto asset kept in custody in the platform in the name of customers reaches 100,000 United States Dollars, subject assets shall not be taken into account in the calculation of custody limits. In any case, in cases where total value of these

20 assets exceeds 10% of total customer assets, the amount in excess shall be taken into account in the calculation of custody limits. (6) For the purpose of monitoring custody limits, platforms are required to disclose to depository institutions the introductory information about wallets in which transfer orders will be executed. Depository institutions shall monitor executed transactions through these wallets. In any case, depository institutions are required to obtain a clarification from platforms which execute any transfers at a level contrary to the ordinary flow of market during the day, about justification of said transfers, including a confirmation of customer orders regarding said transfers. The liability arising out of this paragraph shall be borne jointly and severally by the platform and depository institution. (7) Where a platform receives custody services from more than one depository institution, the rates mentioned in the first and second paragraphs shall be monitored separately for each of these depository institutions. Reserve Composition Limits ARTICLE 42 – (1) Weight of the current value of a certain asset included in liquid reserves of platforms in the portfolio in general may not exceed 20%. (2) The rate referred to in the first paragraph shall be implemented as 10% for crypto assets listed during the last one year and for crypto assets total market value of which is below 5,000,000,000 United States Dollars. (3) Cash and cash equivalent financial assets such as deposits in Turkish Liras or any convertible foreign currency, and money market funds shall not be included in calculations under the first paragraph. (4) Information on prices formed within each platform shall be taken into consideration in calculating the current value of crypto assets. (5) Where the limitations mentioned in the first and second paragraphs cannot be satisfied as of the settlement time, such inconsistency shall be remedied until the next settlement time. Total Provisions for Risks ARTICLE 43 – (1) Total provisions for risks of crypto asset service providers refer to the sum of provisions for position risks and exchange rate risk. Position Risk ARTICLE 44 – (1) Position risk refers to risks arising out of price movements in markets where assets contained in crypto asset service providers’ own portfolios are traded, and out of changes in current values of receivables and payables of crypto asset service providers. (2) Position risk shall be calculated only for assets and liabilities of crypto asset service providers. Position risk shall not be calculated for customer assets kept in custody. (3) Assets subject to position risk calculation and rates to be taken into account in risk calculations in relation therewith are as listed below: a) 2% for short-term government debt instruments; b) 2% for mutual fund units traded in TEFAS with a risk degree between 1 and 4; c) 3% for short-term liabilities;

21 ç) 3% for long-term government debt instruments; d) 5% for mutual fund units traded in TEFAS with a risk degree between 5 and 7; e) 5% for private sector debt instruments traded in exchanges and other organized markets; f) 5% for precious metals deemed fit for listing and trading in Borsa İstanbul A.Ş.; g) 5% for long-term liabilities; ğ) 8% for short-term receivables; h) 10% for stocks traded within BIST 100 index; ı) 10% for long-term receivables; i) 10% for financial fixed assets; j) 20% for electronic warehouse receipts; k) 20% for stocks traded outside the BIST 100 index; l) 30% for crypto assets; m) 100% for capital market instruments (except for public debt securities) not traded in exchanges and other organized markets, and for assets or liabilities not mentioned in this paragraph. (4) In position risk calculations, net positions of assets and liabilities to be calculated may be taken into consideration. (5) Position risk shall not be calculated for items fully discounted from shareholders’ equity in the capital adequacy base calculation. Net Position ARTICLE 45 – (1) Net position refers to a single item of asset or liability calculated as a result of offset of liabilities of crypto asset service providers within the frame of their own portfolio transactions if such liabilities are included in assets of the same kind. (2) It is optional to calculate net position. (3) Position risk shall be calculated over amounts determined as such, regardless of the amount calculated as a result of offsetting having debit or credit characteristics. (4) Net position shall be calculated by considering the amounts of related items appraised as specified in Article 37. (5) Calculation of a net position does not preclude the setting aside of provisions separately for other risks mentioned in this Communiqué. Exchange Rate Risk ARTICLE 46 – (1) Exchange rate risk of crypto asset service providers shall be calculated through offset of the Turkish Lira equivalent sum of their assets and liabilities in each currency against each other.

22 (2) If the amount calculated as per first paragraph exceeds 2% of capital adequacy base of crypto asset service providers, 8% of the portion in excess shall be taken into account as exchange rate risk. (3) Exchange rate risk shall be calculated separately in addition to risk calculations done in respect of the assets covered by this calculation. Assets fully discounted and deducted in capital adequacy base calculations shall not be taken into consideration in exchange rate risk calculations. (4) In exchange rate risk calculations relating to derivative transactions conducted by crypto asset service providers for their portfolios, the principles set forth in regulations of the Board pertaining to capital adequacy of intermediary institutions shall be applied and complied with by analogy. Obligations Regarding Depository Institutions ARTICLE 47 – (1) With the exception of custody limits set down in Article 41, and obligations regarding monitoring of these limits, the provisions included in the Seventh Chapter of this Communiqué shall not be implemented for banks authorized to provide custody services. Provisions Applicable on Violations ARTICLE 48 – (1) In the case of a violation to Articles 35, 38, 40 and 41 of this Communiqué, a time of thirty business days starting from the date of emergence of such contradiction shall be granted for remedy of such contradiction. For of said contradictions, a letter of guarantee issued in a format and with content as determined by the Board may be used within four business days. This letter of guarantee shall be blocked at the relevant bank until performance of the related obligation. However, the period of time this letter of guarantee is blocked may not exceed three months. If additional time is requested before the end of the of three-month period, said period of time may be extended by the Board for three months, provided that actions needed for remedying the violation have been initiated by the crypto asset service provider. (2) Under the sixth paragraph of Article 41, if it is detected that custody limits are not complied with for more than twice in a month, the related platform shall be reported by the depository institution to the Board. (3) In case of a violation of Article 39, the amount of debts is required to be reduced down to the limit within thirty business days. EIGHTH CHAPTER Provision of Other Services Provision of Transaction Services for Assets Outside the Listing Principles ARTICLE 49 – (1) Where platforms provide services for unique and non-fungible assets used to register the representation and ownership of digital assets, and assets used only to create or supply various elements in virtual games, the platforms are required to conduct transactions on these assets in a market separate from the market of assets listed under the Law. (2) Platforms are further required to disclose an information message in media (internet website, mobile application and similar other media) used for receipt of customer orders, with the text “Assets traded in this market are outside the listing principles of the Capital Markets

23 Law 6362, and are not subject to supervision by the Capital Markets Board.”, and the order is required to be received only after confirmation by investor that this information message is duly read and understood. Financial Analyses and General Advice Regarding Crypto Assets ARTICLE 50 – (1) General advice refers to the provision of all kinds of influential research and other information explicitly or implicitly recommending an investment strategy, also including comments on the present or future prices or values of crypto assets, prepared for and addressed to customers or distribution channels about crypto assets, provided that they are not addressed to a certain person or to a group with similar financial status, risk and return preferences. (2) Provision of non-influential written or verbal information about crypto assets and market tendencies refers to the provision of financial information under this Communiqué. Provision of financial information shall not be considered and treated as investment advice activity or provision of general advice. However, the information provided is required to be neutral and honest. (3) All types of data, information sets, documents, or similar items referred to in the first and second paragraphs may be shared via the internet websites or mobile applications of crypto asset service providers or via registered electronic mail addresses of customers; however they may not be transmitted via special communication channels belonging to customers or may not be shared one-to-one with customers, with the exception of non-influential ones. (4) Influential information to be shared by platforms under the first paragraph shall contain the following: a) If policies regarding the frequency of renewal and if any, update of the shared information are determined, summary information about said policies, and material changes occurring in the previously published policies; b) Date of initial preparation of the advice for distribution, and dates and times of all prices included in the advice, clearly and evidently; c) If the advice contains an investment strategy different from the advice published by the same crypto asset service provider during the past twelve months for the same crypto asset or for the project owner or company engaged in sales or distribution of crypto asset, information about this change, justification for the difference, and date of the previously published advice, clearly and evidently. (5) In influential information to be shared with respect to trading of crypto assets, it is required to comply with the principles set down in the Communiqué III-35/B.1 pertaining to disclosure of conflicts of interest. NINTH CHAPTER Other Provisions Monitoring, Principles of Use, and Transfer of Cash Credit Balances in Customer Accounts ARTICLE 51 – (1) Platforms may not take delivery of customer cash funds by hand, or deliver cash funds to customers by hand, or keep customer cash funds in custody in the platform in any manner whatsoever.

24 (2) The account opened by the platform in a bank and designated as customer account shall be defined in such manner to clearly state that it belongs to the related platform customer, and may not be used for non-intended purposes. At the time of opening an account in a bank, the platform is required to provide written information to the bank stating that money deposited in said account belongs to customers of the platform, and must in no case be combined with the platform’s own account, and to receive a prior approval from the bank in connection therewith. This account must be named in such manner to be adequately distinguished and separated from other accounts of the platform held with the bank. If the bank does not give an approval in relation therewith within fifteen business days, the platform is under obligation to transfer the related amount to another bank. (3) In platforms, money transfers shall be executed only through customers’ own bank accounts. Money may not be accepted other than electronic transfers to be conducted by platforms through banks. (4) Customer cash funds held with banks are essentially required to be tracked in an individual account or accounts to be opened for the related platform customers, separately from the platform’s own cash assets. (5) Customer accounts may not be provided as a guarantee for loans, and blockage, pledge or similar other encumbrances may not be established on these accounts in favor of platforms. Cash funds of customers held in bank accounts of crypto asset service providers may not be attached, pledged, transferred to bankruptcy estate or encumbered by an injunction, even for public receivables, due to outstanding debts of crypto asset service providers, and properties of crypto asset service providers may not be attached, pledged, transferred to bankruptcy estate or encumbered by an injunction, even for public receivables, due to outstanding debts of customers. (6) Depending on the powers granted by customers in the framework agreement, platforms may invest the cash funds of customers held with banks collectively or separately for each customer in line with the activities within the scope of their authorization, their operational policies and customer’s preferences, provided that said investments are monitored on account basis in their accounting system. (7) If said cash funds are invested collectively, the proceeds of such investment are essentially required to be distributed to customer accounts proportionately. (8) Platforms may determine a lower limit with respect to the use of cash balances in customer accounts, provided that it is clearly specified in the framework agreement. Any changes in the lower limit determined as above are also required to be notified to customers in writing or by electronic mail, short message, phone, or similar means, with the burden of proof lying with platform. Principles regarding use of cash funds remaining below the lower limit determined as above shall be separately regulated by the agreement. (9) Cash credit balances in customer accounts may be invested with the return on investment remaining in the platform, in line with the pertinent provision in the framework agreement as for customer cash funds below the limit determined, and as for cash funds of customers who do not claim a return on investment, in line with a written or electronic approval to be received individually from related customers separately from the framework agreement, provided that said moneys are paid to customers if demanded by them within no later than one business day thereafter, and the investment principal sum is not lost.

25 Financial Reporting Obligations of Crypto Asset Service Providers ARTICLE 52 – (1) With respect to financial reports to be issued by crypto asset service providers and to their preparation and submission to related parties, the principles, procedures and rules attributed to entities as specified in subparagraph (d) of first paragraph of Article 4 of the Communiqué Regarding Financial Reporting in Capital Markets (II-14.1) published in the Official Gazette edition 28676 on 13.06.2013 shall be applied by analogy. (2) For financial reports to be prepared and issued by crypto asset service providers, the independent audit obligations determined for entities and investment firms referred to in Article 5 of the Communiqué Regarding Independent Audit Standards in Capital Markets (Serial X, No. 22) published in the Official Gazette edition 26196 on 12.06.2006 shall be applied by analogy. Revaluation Rate ARTICLE 53 – (1) Amounts referred to in this Communiqué may be re-determined by the Board every year over the amounts of the previous year upon consideration of the revaluation rate announced by the Ministry of Treasury and Finance. Supervision Authority of Board ARTICLE 54 – (1) The Board is authorized to request from crypto asset service providers all kinds of information relating to the pertinent provisions of the Law and this Communiqué, and to examine and inspect all books and documents, all records, including those kept in electronic, magnetic or similar other media, other tools containing information, and their data processing systems, and to request access to the same, to take copies thereof, to inspect their transactions and accounts, to receive written and verbal information from related persons, to issue minutes in connection therewith, and the related persons are under obligation to permit access of the Board to the requested information, books and documents, records, including the records kept in electronic, magnetic or similar other media, other tools containing information, and data processing systems, and to provide copies of these records and other tools containing information, to disclose information in writing and verbally, and to sign said minutes. Officers and employees of crypto asset service providers, even if they leave office, are obligated to disclose all information and documents requested from them and to sign the minutes in the course of inspections by the Board. TENTH CHAPTER Transitional and Final Provisions Compliance with Provisions of Communiqué TRANSITIONAL ARTICLE 1 – (1) Out of the applicants for establishment under the Framework Principle Decision, no. i-SPK.35.B, of the Board (decision no. 42/1259 of 08.08.2024), for platforms which are included in “List of Actively Operating Organizations” as of the date of publication of this Communiqué, and platforms which have filed an application before the date of publication of this Communiqué, the custody infrastructure is required to be in compliance with the provisions pertaining to custody services as of 30.06.2025. (2) Organizations covered by the first paragraph are under obligation to comply with the capital and shareholders’ equity requirement described in Article 34 and the first and fourth paragraphs of Article 35 as of the date of their application to the Board for operating license,

26 and with the other provisions contained in the Seventh Chapter of this Communiqué by no later than 30.06.2025. (3) Crypto asset service providers which have already performed the preparatory stage of secure hardware modules for use before the date of publication of this Communiqué are required to repeat the preparatory stage of secure hardware modules for use in such manner to comply with TÜBİTAK Infrastructural Criteria as per the fourth paragraph of Article 28 within maximum three years. Effective Date ARTICLE 55 – (1) For this Communiqué: a) Articles 7, 8, 11, 12, 13, 16, 17, 18, 19, 20, 21, 22, 23, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47 and 48 shall become effective on 30.06.2025, and b) other articles on the date of publication of this Communiqué. Enforcement ARTICLE 56 – (1) The provisions of this Communiqué shall be enforced by the Capital Markets Board.