Decision on Approval of the Procedure and Conditions for Rating Activities

NATIONAL COMMISSION FOR SECURITIES AND STOCK MARKET DECISION Kyiv On approval of the Procedure and conditions for conducting rating activities In accordance with paragraph 1 of part three of Article 2, paragraph 1 of part one of Article 7, Articles 29, 30 of the Law of Ukraine "On State Regulation of Capital Markets and Organized Commodity Markets", paragraphs 1, 8, 9 of part three of Article 36 of the Law of Ukraine "On Rating", The National Commission for Securities and Stock Market D E C I D E D:

1. Approve the Procedure and conditions for conducting rating activities, which is attached.

2. Instruct the Department of Supervision over Corporate Governance and Corporate Finance to ensure submission of this decision for state registration to the Ministry of Justice of Ukraine.

3. Instruct the Administration of Administrative Activity to ensure publication of this decision on the official website of the National Commission for Securities and Stock Market.

4. Instruct the Legal Development Department, upon receipt of official notification regarding state registration by the Ministry of Justice of Ukraine, to ensure publication of this decision on the official website of the National Commission for Securities and Stock Market.

5. This decision enters into force on January 1, 2026, but not earlier than the day following the day of its official publication.

6. Control over the implementation of this decision is entrusted to a member of the National Commission for Securities and Stock Market Ya. Shlyakhov. Chairman of the Commission Ruslan MAGOMEDOV Protocol of the Commission meeting dated 19.12.2025 No. 117

APPROVED Decision of the National Commission for Securities and Stock Market 2025 No.__ Procedure and conditions for conducting rating activities I. General Provisions

1. These Procedure and conditions determine operational, organizational and other requirements for rating activities of an authorized rating agency (hereinafter – ARA).
2. In these Procedure and conditions, terms are used in the following meanings:

1. outsourcing – attraction by an ARA on the basis of a corresponding agreement of another person (service provider) to carry out processes, provide services, perform works that constitute part of the conduct of rating activities by such ARA in the rating market;
2. important operational functions – functions that are crucial for the proper functioning of an accredited rating agency and ensuring its compliance with requirements established in accordance with legislation. Such functions include determination of credit ratings, analysis of the rating object, development and verification of rating methodology, internal control, storage and/or accounting of data, technical maintenance and/or support of information and communication systems;
3. key persons – persons who hold managerial, controlling or operationally significant positions in a rating agency and have influence on making, forming or approving decisions on assigning, updating or withdrawing credit ratings, as well as monitoring compliance with regulatory requirements. Key persons include: members of the executive and supervisory bodies, chief accountant, leading and rating analysts, members of the rating committee, heads of internal control and compliance/compliance manager, as well as other employees involved in the rating process;
4. council – supervisory board or board of directors (in case of a one-tier management structure of the ARA);
5. person approving credit ratings – an authorized employee (or member of the relevant committee) of the rating agency that has the official right to make the final decision on assigning, confirming, changing or withdrawing a credit rating;
6. person performing managerial functions – a person who exercises the powers of the sole executive body, chairman and members of the collegial executive body of the ARA, chairman and members of the supervisory board of the ARA, chairman and members of the board of directors of the ARA. The term "profile legislation" is used in these Procedure and conditions in the meaning provided in the Law of Ukraine "On State Regulation of Capital Markets and Organized Commodity Markets". The terms "financial instruments", "investment firm", "insurer", "business reputation", "issuer" are used in these Procedure and conditions in the meaning provided in the Law of Ukraine "On Capital Markets and Organized Commodity Markets". The term "non-state pension fund" is used in these Procedure and conditions in the meaning provided in the Law of Ukraine "On Non-State Pension Provision". Other terms are used in these Procedure and conditions in accordance with the Law of Ukraine "On Rating" (hereinafter – the Law).

3. These Procedure and conditions apply to rating agencies that have acquired the status of an ARA from the day of their inclusion in the Register of Authorized Rating Agencies (hereinafter – Register) and receipt of a certificate of inclusion in the Register in accordance with legislative requirements.
4. These Procedure and conditions do not apply to credit ratings that an ARA creates based on an individual order and provides exclusively to the person who ordered them, and which are not intended for public disclosure or distribution by subscription.
5. Rating activities are based on the following principles:

1. legislative definition of conditions for conducting rating activities;
2. voluntariness of determining, updating, suspending, withdrawing a rating (except for cases provided for by legislation);
3. objectivity of determining, updating, suspending, withdrawing a rating;
4. independence of the rating agency from any external or internal influence during the conduct of rating activities;
5. autonomy of rating determination;
6. publicity of ratings (except private ratings), determined by the rating agency;
7. compliance with business ethics principles;
8. collegiality of decision-making on determining, updating, suspending, withdrawing a rating;
9. responsibility of the rating agency for violation of profile legislation;
10. state regulation of rating activities and supervision over their conduct.

6. In its activities, an ARA is guided by laws of Ukraine, normative legal acts of the NCSPSM, charter, internal documents and rating methodologies developed in accordance with the Law and these Procedure and conditions.
7. The NCSPSM or any other state authorities must not interfere with the content of determined ratings or rating methodologies. II. Requirements for Internal Documents
8. An ARA must, in accordance with the requirements of the Law and these Procedure and conditions, taking into account the specifics of its activity, nature and volume of operations carried out by it during the conduct of rating activities, number of subdivisions and personnel, as well as activity risks, and other conditions under which the ARA operates, develop, define in internal documents, introduce and maintain adequate internal policies and procedures. Each policy and procedure contained in internal documents must contain or be accompanied by: specification of who is responsible for approving and maintaining policies and procedures; description of how compliance with policies and procedures will be ensured and controlled, and who is responsible for this; description of measures taken in case of violation of policies; specification of the procedure for notifying the NCSPSM about a significant violation of a policy or procedure that may lead to violation of ARA authorization requirements.
9. An ARA must develop, approve and keep up to date the following internal documents:

1. regulations on organization of activity;
2. regulations on preparation, determination, publication, update, monitoring and confirmation of credit ratings;
3. regulations on development, approval, publication, monitoring, update, confirmation and review of rating methodologies, models and key rating assumptions;
4. regulations on transfer of operational functions to outsourcing (if the ARA uses outsourcing).

10. Regulations on organization of activity must contain, in particular:

1. corporate governance system, including procedures and powers of persons performing managerial functions and committees;
2. policies and procedures for identification, prevention, settlement and disclosure of actual or potential conflicts of interest;
3. mechanisms for preventing, disclosing and mitigating any existing or potential conflicts of interest between rating activity and additional services;
4. mechanisms for rotation of rating analysts;
5. procedure for training and development related to the rating process, including any exams or other types of official assessment necessary for conducting rating activities;
6. procedure for reviewing the work results of a rating analyst upon his dismissal;
7. procedure for forming remuneration and conducting performance evaluation of the ARA;
8. requirements for disclosure of regular information about the ARA;
9. types of services, including additional ones (if provided);
10. procedure for calculating payment for rating agency services;
11. activity program, including specification of places where main activity is planned to be carried out, branches that will be created (if created), and determination of expected type of activity;
12. mechanisms for ensuring information to rating analysts, leading rating analysts, ARA employees involved in the rating process, as well as any other physical persons whose services are used by the ARA, or persons directly involved in rating activity, and persons closely related to them, about the existence of restrictions on their activity provided for in Chapter 3 of Section III of these Procedure and conditions;
13. mechanisms for ensuring information in case of dismissal of rating analysts, leading rating analysts about restrictions on holding managerial positions in the rated entity or related third party for six months from the moment of determination of credit rating or rating forecast for such rated entity;
14. systems, resources and procedures to ensure continuity and regularity in carrying out credit rating activity;
15. procedure for keeping records of significant threats and all operations related to rating activity of the ARA, and checking completeness and correctness of such records.

11. Regulations on preparation, determination, update and confirmation of credit ratings must contain, in particular:

1. duties of rating analysts and measures aimed at ensuring independence of rating analysts;
2. requirements and procedures for selection of committee members, whose powers include decision-making on approval, update of determined credit ratings and/or rating forecasts;
3. minimum requirements for information necessary for determining, updating, suspending, withdrawing credit ratings and/or rating forecasts;
4. policies and procedures regarding preparation and determination of credit ratings;
5. policies and procedures regarding disclosure of rating decision;
6. policies and procedures regarding monitoring, update, suspension and withdrawal of ratings;
7. description of control and monitoring mechanisms for determining, updating credit ratings and/or rating forecasts;
8. requirements for publication and presentation of credit ratings and/or rating forecasts;
9. procedures for confirmation by an ARA of credit ratings determined by a rating agency based in a foreign state (if such rating activity is carried out);
10. policies and procedures regarding preparation and determination, disclosure, monitoring, update, suspension and withdrawal of sovereign ratings.

12. Regulations on development, approval, publication, monitoring, update, confirmation and review of rating methodologies, models and key rating assumptions must contain, in particular:

1. policies and procedures for development, approval, publication, monitoring, update, confirmation and review of rating methodologies, models and key rating assumptions;
2. requirements for rating methodologies, descriptions of models and key rating assumptions;
3. requirements for disclosure of information about rating methodologies, model descriptions and key rating assumptions.

13. Regulations on transfer of operational functions to outsourcing must include:

1. list of important operational functions transferred to outsourcing;
2. requirements for the service provider who will carry out outsourcing of important operational functions, determines the procedure for their transfer to such person;
3. procedure for concluding contracts with the service provider, transferring operational functions to outsourcing and terminating contracts with the service provider;
4. procedure and features for identifying, managing and controlling risks arising from outsourcing of important operational functions;
5. procedure for settling conflicts of interest;
6. procedure for keeping records of outsourcing contracts.

14. Internal documents of an ARA are reviewed on a regular basis, but no less than once a year, unless otherwise provided by legislation and normative legal act of the NCSPSM. III. Requirements for Organization of ARA Activity
15. Requirements for Corporate Governance System
16. An ARA must be organized in a manner that ensures avoidance of actual or potential conflict of interest threatening independence and/or accuracy of conducting rating activities.
17. An ARA must function exclusively in the form of a joint-stock company, limited liability company or company with additional liability, and establish an executive body and a body responsible for carrying out supervision.
18. The organizational structure of an ARA must provide for clear division of powers of management, control and operational bodies, contain written description of main functions of such ARA, be transparent to all interested parties, employees, shareholders (participants) of such ARA and ensure proper system of checks and balances, subordination, reporting and effective risk management, exclude duplication of functions.
19. Duties, responsibilities, procedure for information exchange, methods of decision-making and interaction of the supervisory board and collegial/sole executive body, chief accountant, leading rating analyst, rating analyst, employees and other persons involved in assigning ratings, rating committee must be clearly defined and documented in internal documents of such ARA.
20. In an ARA, regardless of organizational-legal form, a collegial body responsible for carrying out supervision is created, whose functions may be performed by the board of directors (when using a one-tier management structure) or supervisory board (when using a two-tier management structure).
21. The body responsible for carrying out supervision is created by the highest body of the ARA and operates on the basis of the charter and corresponding internal regulation.
22. Quantitative and qualitative composition of the body responsible for carrying out supervision is determined by the ARA taking into account the specifics of its activity, nature and volume of ratings issued by it during rating activity, risks inherent to such ARA, and compliance with the following conditions: the quantitative composition of the body responsible for carrying out supervision consists of no less than 3 persons, at least one third, but no less than two members of the body of the ARA responsible for carrying out supervision, must be independent members who do not participate in rating activity of the ARA; members of the body responsible for carrying out supervision must meet minimum requirements established in chapters 1, 2 of section IV of Standard No. 4 "Corporate Governance in Professional Participants of Capital Markets and Organized Commodity Markets. Organization and functioning of internal control system in professional participants that do not belong to enterprises constituting public interest and to systemically important professional participants" approved by decision of the National Commission for Securities and Stock Market dated December 30, 2021 No. 1291, registered in the Ministry of Justice of Ukraine on February 28, 2022 No. 263/37599 (hereinafter – Standard), when using a two-tier management structure or requirements established in chapters 1, 2 (for non-executive directors) and in chapters 1, 3 (for executive directors) of section IV of the Standard when using a one-tier management structure.
23. Procedure for formation of the body responsible for carrying out supervision is established by the charter of such company taking into account, depending on the organizational-legal form of the ARA, requirements of the Law of Ukraine "On Joint-Stock Companies" or Law of Ukraine "On Limited Liability and Additional Liability Companies".
24. The body responsible for carrying out supervision must perform, in particular, the following functions:

1. establish strategic goals of the ARA, monitor relevance of such goals and periodically evaluate progress in their achievement;
2. approve internal regulations governing activities of management bodies of the ARA (except those referred to exclusive competence of general meetings of shareholders (participants) of such ARA);
3. approve internal regulations governing functioning of internal control system, as well as regulations on providing services to rated entities (except normative-technical documents);
4. monitor adequacy and effectiveness of execution of requirements of internal regulations specified in subparagraphs 2 and 3 of this point;
5. take appropriate measures to eliminate any deficiencies identified during control. Specified functions of the body responsible for carrying out supervision cannot be transferred to other bodies of the ARA.

24. The body responsible for carrying out supervision may include in the agenda of general meetings of participants (shareholders) any issue referred to its competence for resolution by general meetings of participants (shareholders).
25. The body responsible for carrying out supervision creates a standing rating committee.
26. For ARAs where a one-tier corporate governance system is introduced, an independent director is considered an independent non-executive director of the board of directors.
27. Independent member of the body of the ARA responsible for carrying out supervision (hereinafter – independent director) – is such a member of the body of the ARA, on whom there is no influence of other persons in the process of decision-making during performance of duties as an independent director. In particular, but not exclusively, a person cannot be considered an independent director of the ARA if such person:

1. was a member of management bodies of such legal entity and/or affiliated legal entity within the previous five years;
2. receives and/or received within the previous three years additional remuneration exceeding 5 percent of her total annual income for each of such years, from such legal entity and/or affiliated legal entity;
3. owns (directly or indirectly) 5 or more percent of statutory capital of such legal entity or is an official or person performing managerial functions in such legal entity, or is a natural person – entrepreneur who had significant business relations with such legal entity and/or affiliated legal entity during the previous year;
4. is and/or was within the previous three years an independent auditor of such legal entity and/or affiliated legal entity;
5. is and/or was within the previous three years an employee of an audit firm that provided audit services to such legal entity and/or affiliated legal entity during the previous three years;
6. is and/or was within the previous three years an employee of such legal entity and/or affiliated legal entities;
7. is a shareholder (participant) – owner of controlling block of shares (parts) and/or is a representative of a shareholder (participant) – owner of controlling block of shares (parts) of such legal entity in any civil legal relations;
8. has been cumulatively more than 12 years a member of such body of the legal entity responsible for carrying out supervision;
9. is a person related by family ties to persons specified in subparagraphs 1–8 of this point;
10. does not meet additional criteria established by charter or other internal documents of the ARA. Requirements of subparagraphs 1, 2 and 6 of this point do not apply to cases of holding the position of independent director of the ARA and relations related to this.

28. Term of office of an independent director must be fixed, predetermined, not exceed five years and cannot be extended.
29. Dismissal of an independent director occurs only in case of abuse of his official duties or in case of professional negligence.
30. Special duties of independent directors are supervision over:

1. management and compliance processes in the ARA;
2. development and use of rating policy and rating methodology used by the ARA in rating activity;
3. effectiveness of internal quality control system of rating activity of the ARA;
4. effectiveness of measures and procedures introduced for determining, preventing and settling any actual or potential conflict of interest;
5. effectiveness of review function. Reports of independent directors on issues specified in subparagraphs 1–5 of this point must be submitted periodically, but no less than once a year, to the body of the ARA responsible for carrying out supervision and provided to the NCSPSM upon its request.

31. Persons performing managerial functions in the ARA must have: business reputation, sufficient qualification and experience in accordance with requirements established by the NCSPSM in the Procedure for authorization of rating agency and keeping register of authorized rating agencies; sufficient time, proper informational, technical support and other opportunities for ability to perform duties.
32. Persons performing managerial functions in the ARA must ensure:

1. independence of rating activity, in particular from all political and/or economic influences and/or restrictions;
2. proper determination, prevention and settlement of actual or potential conflict of interest;
3. functioning of own website of the ARA and free access to it by users;
4. compliance by the ARA with other legislative requirements.

33. An ARA must introduce:

1. review function, according to which the ARA periodically reviews: its rating methodologies, models and key rating assumptions (including mathematical or correlation assumptions) and any significant changes or additions to them; acceptability of its rating methodologies, models and key rating assumptions in case of use and/or intention to use for evaluating new financial instruments.
2. compliance, which is carried out on a permanent basis by the compliance subdivision or separate position holder – compliance manager;
3. mechanism for gradual rotation of rating analysts.

34. An ARA must create, maintain and apply an effective internal control system that ensures:

12

1. implementation of policies and procedures for preventing and resolving actual or potential conflicts of interest in the activities of the CRA;
2. independence of credit ratings and rating analysts (including lead rating analysts) from shareholders (participants) and management of the CRA;
3. prevention of the influence of the volume of CRA service sales and measures to increase such volumes on the determination of credit ratings;
4. documentation of the functioning of such a system.

35. Persons responsible for performing the review function:

1. are independent in their activities, which are separated from other types of activities related to the rating activities of the CRA;
2. report exclusively directly to independent members of the CRA body responsible for supervision.

2. Requirements for Compliance

3. In order to ensure the performance of the compliance department (compliance officer) functions independently and at an adequate level, the CRA must:

1. provide the compliance department (compliance officer) with the necessary authority, resources, access to all necessary information, and ensure compliance with the requirements for the experience of compliance department (compliance officer) employees in the manner established by the National Commission for the State Regulation of Financial Services Markets (NCSFM);
2. ensure the appointment by the CRA body responsible for supervision of the head of the compliance department (compliance officer) and their subordination directly to the head of such body;
3. ensure that in the event of detection of a significant risk of non-performance by the CRA of its obligations undertaken within the framework of rating activities, the head of the compliance department (compliance officer) reports directly to the CRA body responsible for supervision;
4. ensure the non-involvement of managers, rating analysts, including lead rating analysts, other employees of the CRA, any other natural persons directly participating in the rating activities of the CRA, or any other persons directly or indirectly related to the CRA through control relations, in carrying out compliance regarding the rating and other activities of the CRA in which such persons directly participate;

13

5. ensure the independence of the remuneration of the head of the compliance department (compliance officer) from the results of the CRA's activities, as well as the formation of such remuneration in a manner that ensures the independence of such person and their impartiality in decision-making.

37. The compliance department (compliance officer) of the CRA is not subordinate to the executive body of the CRA, monitors compliance by the CRA and its employees with the requirements of legislation on rating activities, reports on the results of such monitoring, and performs other powers defined in accordance with legislation.

38. The compliance department (compliance officer) of the CRA:

1. ensures the development, implementation, and updating of internal requirements and procedures aimed at ensuring the CRA's compliance with the requirements of legislation on rating activities;
2. regularly monitors internal requirements and procedures aimed at ensuring the CRA's compliance with the requirements of legislation on rating activities;
3. assesses the adequacy and effectiveness of: measures and procedures provided for in the internal rules of the CRA to ensure the CRA's compliance with the requirements of legislation on rating activities; measures taken to eliminate identified non-compliance of the internal rules and procedures of the CRA with the requirements of legislation on rating activities;
4. provides advice and assistance to managers, rating analysts, including lead rating analysts, other employees of the CRA, and other natural persons directly participating in the rating activities of the CRA, or any other person directly or indirectly related to the CRA through control relations, regarding the CRA's compliance with the requirements of legislation on rating activities;
5. regularly reports on the performance of its duties directly to the CRA body responsible for supervision and the executive body of the CRA in the manner established by the CRA, but no less than once a year;
6. ensures the identification (detection), prevention, and resolution of any actual or potential conflicts of interest arising or that may arise among employees of the CRA and/or any other persons involved in the process of carrying out compliance;

14

7. performs other functions defined by specialized legislation and/or internal documents of the CRA.

3. Requirements for the procedure for preventing, resolving, and disclosing actual or potential conflicts of interest

4. The CRA must implement appropriate and effective organizational and administrative measures, policies, and procedures aimed at preventing, detecting, eliminating, or managing and disclosing information about any conflicts of interest.

5. The CRA must develop, define in internal documents, and maintain effective policies and procedures for preventing, eliminating, mitigating, and managing conflicts of interest, which correspond to the size and organizational structure of such CRA, as well as the nature, scale, and complexity of its rating activities. If the CRA is a member of a group of rating agencies, the procedure for preventing, resolving, and disclosing actual or potential conflicts of interest must take into account any circumstances of which the CRA knows or should know, which may cause conflicts of interest that may arise as a result of the peculiarities of the organizational structure and/or economic activities of other members of the group.

6. Policies and procedures for preventing, eliminating, mitigating, and managing conflicts of interest must cover: detection, prevention, disclosure, and mitigation of conflicts of interest arising from the issuance of credit ratings or provision of additional services and which may affect the work and conclusions of its rating analysts, employees, and any other natural persons whose services are used or whose work is controlled by the CRA, or any other persons directly or indirectly involved in the assignment of credit ratings, as well as persons who approve credit ratings; separation from the rating process of discussions related to commissions received from rated entities and related third parties; determination of fees charged by the CRA to rated entities and related third parties; control and protection of confidential information received from all rated entities, related third parties, and other relevant persons; control and protection of confidential information received by the CRA, to such persons: rating analysts and employees of any other person related to the CRA through control relations, any natural person providing services to a person related to the CRA through control relations, who is not directly involved in rating activities;

15

control and protection of confidential information for the purposes of trading financial instruments or for any other purposes, except for conducting rating activities; ensuring the independence of credit ratings, rating analysts, and rating committees from shareholders and persons performing management functions, as well as preventing the influence of the volume of CRA service sales and measures to increase such volumes on the determination of credit ratings; limiting the requirement to demand or accept money, gifts, or services from any person with whom the CRA has entered into business relations; rules regarding the termination of employment relations with a rating analyst, lead rating analyst; rules for disclosing information about conflicts of interest.

42. The CRA must ensure that rating analysts, employees, and any other natural persons whose services are used or whose work is controlled by the CRA, or any other persons directly or indirectly involved in the assignment of credit ratings, as well as persons who approve credit ratings, are not allowed to: initiate or participate in negotiations regarding commissions or payments with any rated entity, related third party, or any person directly or indirectly related to the rated entity through control; determine fees charged by the CRA to rated entities and related third parties; disclose information about assigned or future credit ratings of the CRA, except to the rated entity or related third party; disclose confidential information received by the CRA, by rating analysts, and employees of any person directly or indirectly related to them through control relations, and any other natural persons whose services are used or whose work is controlled by any person directly or indirectly related to them through control relations, and who directly or indirectly engage in credit rating activities; use or disclose confidential information for the purpose of trading financial instruments, or for any other purpose except rating activities.

43. Rating analysts, lead analysts, CRA employees involved in the rating process, as well as any other natural person whose services the CRA uses, or who is directly involved in rating activities, and persons closely related to them, do not have the right to participate or otherwise influence the determination of a credit rating of any rated entity if such person: holds financial instruments of the rated entity;

16

holds financial instruments of a legal entity related to the rated entity, the ownership of which may cause or may generally be perceived as a potential source of conflict of interest; recently worked, had business or other relations with the rated entity, holds financial instruments of the rated entity, which may be perceived or become a potential source of conflict of interest.

44. Rating analysts, lead analysts, CRA employees involved in the rating process, as well as any other natural person whose services the CRA uses, or who is directly involved in rating activities, and persons closely related to them, do not have the right to demand or accept money, gifts, or services from any person with whom the CRA has entered into business relations.

45. Requirements for rating analysts and mechanisms for the rotation of rating analysts

46. Rating analysts, lead analysts, and other specialists involved in the rating process must possess the necessary knowledge, experience, and qualifications, which are confirmed by documents (certificates, diplomas, work books, references from places of work, etc.).

47. Rating analysts, lead analysts, CRA employees involved in the rating process, as well as any other natural person whose services the CRA uses, or who is directly involved in rating activities, and persons closely related to them, must not buy, sell, or carry out any operations with any financial instrument issued, guaranteed, or otherwise supported by any rated entity within the scope of their main analytical responsibility, except for participation in diversified collective investment schemes, including managed funds, such as pension funds or life insurance.

48. No person specified in paragraph 46 of these Rules and Conditions must participate in the determination of a credit rating or rating forecast of any specific rated entity or otherwise influence it if this person:

1. holds financial instruments of the rated entity, except for participation in diversified collective investment schemes;
2. holds financial instruments of any person related to the rated entity, the ownership of which may cause or generally be perceived as causing a conflict of interest, except for participation in diversified collective investment schemes;

17

3. recently had employment, business, or other relations with the rated entity, which may cause or generally be perceived as causing a conflict of interest.

48. The CRA must ensure that rating analysts, lead analysts, CRA employees involved in the rating process, as well as any other natural person whose services the CRA uses, or who is directly involved in rating activities, and persons closely related to them, take all reasonable measures:

1. to protect the property and records held by the rating agency from fraud, theft, or misuse, taking into account the nature, scale, and complexity of their business, as well as the nature and scope of their rating activities;
2. not to disclose any information about credit ratings, possible future credit ratings, or rating forecasts of the CRA, except to the rated entity or related third party;
3. not to disclose confidential information entrusted to the CRA, to rating analysts, lead analysts, and employees of any person directly or indirectly related to it through control, as well as to any other natural person whose services are provided at the disposal or under the control of any person directly or indirectly related to it through control, and who does not directly participate in rating activities;
4. not to use or disseminate confidential information for the purpose of trading financial instruments or for any other purposes, except for conducting rating activities.

49. If a person specified in paragraph 48 of these Rules and Conditions believes that any other such person has committed actions that they consider illegal, they must immediately report such information to the compliance department (compliance officer), without negative consequences for themselves.

50. The CRA must introduce a mechanism for the gradual rotation of rating analysts, including lead rating analysts, and persons who approve credit ratings, taking into account the following requirements:

1. the lead rating analyst is not involved in rating activities regarding the same rated entity or related third party for more than four consecutive years;

18

2. the rating analyst is not involved in rating activities regarding the same rated entity or related third party for more than five consecutive years;
3. the person who approves credit ratings is not involved in rating activities regarding the same rated entity or related third party for more than seven consecutive years;
4. the rating analyst, including the lead rating analyst, or the person who approves credit ratings, is not involved in rating activities regarding the same rated entity or related third party for two years after the completion of their involvement in such activities, taking into account the requirements of sub-paragraphs 1-3 of this paragraph.

51. The requirements of sub-paragraphs 2 and 3 of paragraph 50 of these Rules and Conditions do not apply to cases of conducting rating activities regarding a sovereign rating and/or a rated entity (related third party) with which the CRA has concluded a contract.

52. The rotation mechanism provided for in paragraphs 50 and 51 of these Rules and Conditions consists of the gradual replacement of persons involved in rating activities regarding the same rated entity or related third party, and must not be applied to all such persons simultaneously.

53. The person specified in paragraph 48 of these Rules and Conditions must not hold key management positions in the rated entity or related third party for six months from the date of issuing a credit rating or rating forecast.

54. Procedure for reviewing the work results of a rating analyst upon dismissal

55. In the event of the dismissal of a rating analyst from their position and their joining a person in whose rating they participated, or to a person with respect to whose financial instruments they prepared/issued a rating assessment, and with whom they dealt within the framework of their duties at the CRA, the CRA reviews the relevant work of such rating analyst for the two years preceding their dismissal in the manner established by the CRA.

56. Procedure for forming remuneration

57. Policies and procedures regarding the procedure for forming remuneration of the CRA must include:

19

1. the main principles of the remuneration system introduced in the CRA for CRA officials and members of the CRA rating committee, the structure of such remuneration (introduction of exclusively fixed remuneration or a combination of fixed and variable remuneration, types of variable and fixed remuneration), criteria for determining the size and/or procedure for calculating the size of remuneration (separately for each type of fixed and variable remuneration), procedure for assessing compliance with relevant criteria;
2. criteria for assessing the effectiveness of the work of CRA officials and members of the CRA rating committee;
3. principles and parameters of the non-monetary incentive system (if introduced);
4. distribution of powers regarding the decision-making on remuneration;
5. procedure and conditions for payment of remuneration, forms of payment of remuneration (monetary/non-monetary) and payment terms;
6. the remuneration of a member of the CRA body responsible for supervision must not depend on the results of the CRA's activities and must be formed in a manner that ensures the independence of such member and their impartiality in decision-making.

56. The amount of remuneration of independent board members must not be linked to the results of the rating agency's activities and must be arranged in such a way as to ensure the independence of their judgments.

57. The assessment of effectiveness and remuneration of CRA employees who participate in the determination of a credit rating (rating forecast) or approve credit ratings (rating forecasts) must not depend on the remuneration that the CRA receives from the rated entity or its related third party.

58. The remuneration of the head of the compliance department (compliance officer) is not linked to the results of the rating agency's activities and is arranged in such a way as to ensure the independence of their judgment.

59. Any changes in the remuneration system must undergo a conflict of interest check.

60. Types of services, including additional (if provided)

61. The predominant type of activity of the CRA is the determination of ratings on a professional basis.

20

61. The CRA may determine the following types of ratings:

1. credit rating of a legal entity;
2. credit rating of debt, debt obligation (including a financial instrument);
3. sovereign rating and rating of state finances;
4. other rating regarding the object of rating in the meaning of the Law, in particular: corporate ratings of financial institutions / issuers who are not considered financial institutions.

62. Ratings are divided into:

1. public ratings – ratings, information about the determination, update, suspension, and withdrawal of which is subject to publication;
2. private ratings – ratings, information about the determination, update, suspension, and withdrawal of which is not subject to publication.

63. The right to determine public credit ratings is granted exclusively to the CRA.

64. A public credit rating is considered determined from the moment the CRA publishes information regarding the determination of such rating on its own website or using other means provided for in part four of Article 5 of the Law.

65. Public credit ratings may be used in accordance with Article 7 of the Law.

66. In addition to determining credit ratings, the CRA may provide additional services. Additional services are not part of rating activities and may include market forecasts, assessment of economic trends, price analysis, and other general data analysis, as well as related services for the dissemination of CRA services.

67. The CRA must not provide consulting or advisory services to the rated entity or a related third party regarding the corporate or legal structure, assets, liabilities, or activities of this rated entity or related third party.

68. The CRA, any person who owns directly or indirectly at least 5% of the shares (parts) of the CRA, or who otherwise has the ability to exercise significant influence on the entrepreneurial activities of the CRA, must not provide consulting or advisory services to the rated entity or a related third party regarding the corporate or legal structure, assets, liabilities, or activities of this rated entity or related third party.

21

69. The CRA must ensure that the provision of additional services does not create a conflict of interest in its rating activities and disclose in the final rating reports any additional services provided to the rated entity or any related third party.

70. Requirements for the calculation of payment for rating agency services

71. Remuneration paid by CRA clients for the determination of a credit rating and additional services must not be discriminatory and are calculated by the CRA based on the actual costs of such activities.

72. The CRA's remuneration for its services must not depend on the level of the credit rating determined by such CRA, or any other results (consequences) of its rating activities.

73. Requirements for the transfer of important operational functions to outsourcing

74. The CRA makes a decision on the transfer of important operational functions to outsourcing under the conditions:

1. development of a regulation on the transfer of operational functions to outsourcing;
2. justified feasibility of transferring functions to outsourcing;
3. ensuring confidentiality, which involves the protection of personal data, confidential information, and other information with limited access of the rated entity in accordance with legislation from unauthorized access and disclosure of such information;
4. proper management of risks associated with the transfer of functions to outsourcing and the performance by the service provider of outsourcing such functions;
5. conclusion of a contract with the service provider, the essential terms of which include, in particular: a list of important operational functions transferred, the term of their provision, rights and obligations of the parties;
6. ensuring regular conduct of an assessment of the effectiveness of services by their provider under the outsourcing contract, but no less than once a year.

22 73. An RA using outsourcing bears full and unconditional responsibility for the actions of the service provider under the outsourcing agreement, performed in accordance with the agreement. 74. The RA informs the NSSMCU about the conclusion of an outsourcing agreement, changes in the terms of the agreement, as well as about the termination of such an agreement in the manner and timeframes determined by the NSSMCU. 75. Outsourcing of an important operational function of analysis of the rating object is carried out with the consent of the rated entity on the terms of the contract. 76. In the event that the RA carries out outsourcing of important operational functions, such outsourcing must not reduce the quality of internal control in such RA and complicate the NSSMCU's supervision of compliance with legislative requirements.

10. Requirements for record-keeping
11. The RA organizes the keeping of records of significant threats and all operations related to the rating activity of the RA, and, if necessary, checks the completeness and correctness of such records.
12. Records of significant threats must contain:

1. all significant threats to the independence of rating activity, including the activities of persons specified in the first part of Article 15 of the Law;
2. all significant threats of violations of requirements provided for by Articles 16 and 17 of the Law;
3. measures aimed at eliminating the threats specified in sub-paragraphs 1 and 2 of this paragraph.

79. Records regarding operations related to the rating activity of the RA, and, if necessary, checks of the completeness and correctness of such records, must contain:

1. for each decision on a credit rating and rating forecast, the person of rating analysts involved in determining the credit rating or rating forecast, persons who approved the credit rating or rating forecast, information on whether the credit rating was ordered or not, and the date when measures were taken regarding the credit rating;

23 2) records from accounts relating to fees received from any rated entity or a third party associated with it, or any user of ratings; 3) records of accounts of each subscriber of credit ratings or related services; 4) records documenting the established procedures and methodologies used by the RA to determine credit ratings; 5) internal records and files, including non-public information and working documents, used to form the basis of any decision on a credit rating; 6) credit analysis reports, solvency assessment reports, and private credit rating reports, as well as internal records, including non-public information and working documents, used to form the basis for opinions expressed in such reports; 7) records of procedures and measures taken by the RA to comply with legislative requirements and copies of internal and external communications, including electronic messages, received and sent by the RA and its employees, relating to credit rating activity. 80. All records may be stored in electronic format provided that their authenticity, integrity, and accessibility are ensured. 81. Records regarding operations related to the rating activity of the RA, and records of checks of the completeness and correctness of such records, specified in this chapter, are kept in the premises of the RA for at least five years and provided to the NSSMCU upon its request. In the event of withdrawal of the RA's authorization, all records are kept for three years from the date of withdrawal of the RA's authorization. 82. Records defining contractual relations, corresponding rights and obligations of the RA and the rated entity or third parties associated with it under the contract for the provision of rating services, are kept for the entire duration of the relationship with the rated entity (its associated third party).

IV. Requirements for the determination, updating, and confirmation of credit and sovereign ratings

1. Determination, updating, and confirmation of credit ratings

24 83. When determining a rating, the analysis and/or judgment of rating analysts, including lead rating analysts, other employees of the RA, any other physical persons directly involved in the rating activity of the RA, including members of rating committees and/or other persons involved in making decisions on credit ratings and/or forecasts of such ratings, must not be influenced by any actual or potential conflicts of interest. 84. The RA must refrain from determining a credit rating or rating forecast in the presence of any of the following circumstances:

1. The RA or persons specified in paragraph 83 of these Rules and Conditions directly or indirectly hold financial instruments of the rated entity and/or its associated third party, directly or indirectly own a share in the authorized capital of the rated entity or its associated third party. The provisions of this paragraph do not apply to cases of holding a share in the assets of a diversified collective investment institution, a non-state pension fund, or a legal entity – an insurer that has received a license to carry out insurance activity, which grants the right to carry out insurance activity in the life insurance class;
2. The RA is connected by control relations with the rated entity or its associated third party;
3. A shareholder (participant) of the RA who owns 10 percent or more of the shares (parts) of the RA or is able to exercise significant influence on the rating activity of the RA owns 10 percent or more of the shares (parts) in the rated entity and/or its associated third party or has another interest in such rated entity and/or its associated third party. The provisions of this paragraph do not apply to cases of holding a share in the assets of a diversified collective investment institution, a non-state pension fund, or a legal entity – an insurer that has received a license to carry out insurance activity, which grants the right to carry out insurance activity in the life insurance class, if such holding does not lead to a significant influence of the said shareholder (participant) of the RA on the activity of the entity in which it holds a share;
4. The rated entity and/or its associated third party own 10 percent or more of the shares (parts) in such RA;
5. A person specified in paragraph 83 of these Rules and Conditions holds a position as a member of the executive body or the body responsible for supervision of the rated entity or its associated third party;

25 6) A shareholder (participant) of the RA who owns 10 percent or more of its shares (parts) or is able to exercise significant influence on the rating activity of the RA holds a position as a member of the executive body or the body responsible for supervision of the rated entity or its associated third party; 7) A rating analyst (lead rating analyst) who participated in determining the credit rating, or a person who participated in making a decision on the credit rating (rating forecast), had (had) relationships with the rated entity or its associated third party that could cause a conflict of interest. 85. In the event of the emergence and/or detection of circumstances specified in sub-paragraphs 1–7 of paragraph 84 of these Rules and Conditions, which affect or potentially may affect the credit rating (rating forecast) previously determined by such RA, the RA must immediately disclose information about such circumstances in the manner established by the NSSMCU in the Regulation on disclosure of information by authorized rating agencies. Simultaneously with the disclosure of information, the RA must immediately establish the presence of grounds requiring the updating or withdrawal of the existing credit rating (rating forecast), and, if necessary, take appropriate measures regarding such updating (withdrawal). 86. For the purposes of sub-paragraphs 3, 4, and 6 of paragraph 84 of these Rules and Conditions, the size of share packages (parts) is determined taking into account the features of determining the number of votes per shares (parts) provided for by paragraphs 1-8 of part nine of Article 29 of the Law, and in the presence of a parent company – taking into account the rules for combining into one package of voting shares (parts) of the parent company, determined in accordance with part seven of Article 29 of the Law. 87. If the rated entity or its associated third party intends to engage two or more RAs to prepare a credit rating for one rating object, such rated entity (its associated third party) must consider the possibility of engaging at least one RA, the total market share of which does not exceed 10 percent of the total volume of the rating market, provided that such RA can be recognized by the rating subject (its associated third party) as capable of determining a credit rating for a similar rating object based on the information specified in the list of RAs compiled and maintained by the NSSMCU, as well as in the presence of such RA in such list. 88. In the event of not engaging, in the cases specified in paragraph 87 of these Rules and Conditions, at least one RA, the total market share of which does not exceed 10 percent of the total volume of the rating market, such decision with corresponding justification must be recorded in the internal documents of the rating subject (its associated third party). 89. The RA must indicate any relevant risk warnings, including an analysis of the sensitivity of relevant assumptions. This analysis must explain how different market events changing parameters embedded in the model can affect changes in the credit rating. The RA must ensure that information on historical default rates for its rating categories is verified and quantitatively defined, and that it provides interested parties with a sufficient basis for understanding the historical rates of each rating category, as well as whether rating categories have changed and how, if the nature of the credit rating or other circumstances determine the historical default rate.

2. Submission and publication of public credit ratings and/or rating forecasts
3. The RA must develop policies and procedures regarding: determination of credit ratings; regarding the disclosure of rating decisions; regarding the monitoring of ratings.
4. Policies and procedures regarding the determination of credit ratings must include the following information: a sequence of steps performed to prepare ratings; a documentation verification process for issuers or securities subject to rating must include any control indicators used to facilitate verification; an assessment of minimum information requirements for initiating and maintaining a rating, including both public and non-public information; about data used to determine the rating, including criteria for selecting data source providers; verification of the reliability of data sources, order of their use; control mechanisms for issuing credit ratings, including the participation of the issuer/organizer/investor/service company in this process; a process for collecting, analyzing, and evaluating information used to determine the rating, including, where possible, the use of analysis conducted by another rating agency or other third parties; the role and responsibilities of rating analysts, as well as the process and procedures for their selection for specific securities; a process for approving ratings, including the determination of the role and responsibilities of persons approving ratings, as well as the process and procedures for their selection; the role and responsibilities of the head of the rating committee, as well as the necessary skills and process and procedures for his nomination;

27 minimum qualifications of persons involved in making rating decisions; rules and procedures regarding the determination of unsolicited credit ratings, including control mechanisms for determining such ratings and features of the procedure for selecting rating analysts, their role and responsibilities. 92. Policies and procedures regarding the disclosure of rating decisions must include: a process for notifying the rated entity within a working day or at least a full working day before the publication of a credit rating about the main grounds on which the credit rating or rating forecast is based, to give the rated entity the opportunity to draw the RA's attention to any factual errors; a process for appealing the rating, if the rating agency has introduced it; processes for determining which key elements underlying the credit rating should be included in press releases or reports; order for indicating any attributes and limitations of a credit rating or rating forecast, in particular, whether the RA considers the quality of information available about the rated entity to be satisfactory, and to what extent the RA has verified the information provided to it by the rated entity or a third party associated with it. If the credit rating or rating forecast concerns a type of organization or financial instrument for which historical data is limited, the RA must clearly indicate such limitations; features of the disclosure of unsolicited credit ratings. 93. Policies and procedures regarding the monitoring of ratings must include: a monitoring process, including the role and responsibilities of rating committees, where possible, and a description of rating approval processes; the role and responsibilities of rating analysts; a process for collecting, analyzing, and evaluating information used to monitor the rating, including, where possible, the use of analysis conducted by another rating agency or other third parties; a process, including the review of taken into account factors, and responsibilities for making a decision on when a rating should be officially reviewed, including actions regarding the rating; a process and responsibilities for making a decision on when a rating should be officially suspended or withdrawn; processes and control means for reviewing credit ratings in the event of changes in methodologies, models, or key rating assumptions applied in rating activity, as required by paragraph 118 of these Rules and Conditions; policies, procedures, and control means for the participation of the issuer or organizer in this process.

28 94. The RA must ensure the determination and publication of credit ratings and rating forecasts in accordance with legislative requirements and avoid the publication of other factors unrelated to rating activity. The RA must issue credit ratings and rating forecasts, indicating that the rating is the opinion of the RA and should be relied upon to a limited extent. 95. The RA must guarantee that a credit rating (rating forecast) determined by such RA is based on a thorough analysis of the available information necessary for such analysis, in accordance with the rating methodology applied in each specific case. 96. Until the publication of a credit rating or rating forecast and information related to them, such information must be considered insider information in accordance with the Law of Ukraine "On Capital Markets and Organized Commodity Markets". 97. The list of employees of the rated entity to whom information about credit ratings or rating forecasts and information related to them is disclosed before their official publication must be limited and determined in advance by the rated entity. 98. The RA must ensure that in any credit rating and forecast rating, the name and position of the lead rating analyst who prepared the credit rating, as well as the name and position of the person bearing primary responsibility for approving the credit rating or rating forecast, are clearly and clearly indicated. 99. The RA, together with the publication of a credit rating or rating forecast, publishes at least the following information:

1. indication of all significant material sources, including the rated entity (its associated third party), used to determine the credit rating (rating forecast), along with information about the familiarization of the rated entity (its associated third party) with the credit rating (rating forecast) before its publication and changes to such credit rating (rating forecast) as a result of such familiarization;
2. indication of the main rating methodology or its version used to determine the credit rating (rating forecast), with a reference to its comprehensive description. If more than one rating methodology was used to determine the credit rating (rating forecast) or if a reference solely to the main rating methodology may result in other important aspects of the credit rating, including any significant adjustments and deviations, remaining unnoticed by investors, the RA must explain such caveats and indicate a way to take into account different rating methodologies and other specified aspects in the credit rating (rating forecast);
3. explanation of the meaning of each rating category, definition of default or assessment of the degree of fulfillment of obligations in the event of default, and a corresponding risk warning, including an analysis of the sensitivity of relevant key rating assumptions, including mathematical or correlational, to which explanations of the credit rating (rating forecast) for the worst-case scenario and for the best-case scenario are added;
4. dates of the first determination of the credit rating (rating forecast) and its last update;
5. indication of whether the financial instrument for which a credit rating (rating forecast) is determined is new to the market, or whether the RA is determining the rating of such financial instrument for the first time;
6. in the case of a rating forecast, the period of time during which a change in the credit rating is expected is indicated.

100. In the event that the absence of reliable data or the complexity of the structure of a new type of financial instrument, or the quality of available information is unsatisfactory or raises serious questions about whether the RA can determine a reliable credit rating, the RA must refrain from determining a credit rating or withdraw an existing rating.
101. When announcing a credit rating or rating forecast, the RA must explain in its press releases or reports the key elements underlying the credit rating or rating forecast.
102. The RA must have procedures that ensure the detection and proper elimination of systemic anomalies of credit ratings detected during back-testing on previous data.
103. The RA conducts regular, but not less than once every six months, assessments of credit ratings, rating forecasts, and the effectiveness of the activities of rated entities and financial instruments by conducting back-testing.
104. In the event of changes in methodologies, models, or key rating assumptions applied in rating activity, the RA must: immediately, using the same communication means used to disseminate affected credit ratings, disclose the possible volume of credit ratings affected; as soon as possible, but no later than six months after the change occurred, review the affected credit ratings, meanwhile placing them under supervision; re-evaluate all credit ratings based on such methodologies, models, or key rating assumptions, if after review it turns out that the total changes affect these credit ratings; update the affected credit ratings and simultaneously continue monitoring such credit ratings; within a reasonable time, re-determine all credit ratings based on rating methodologies, models, or key rating assumptions that were changed, if as a result of the update the total cumulative effect of the specified changes affects such credit ratings.
105. If the RA has detected errors in its rating methodologies and/or facts of incorrect application of its rating methodologies, such RA must immediately:

1. report the detected errors to the NSSMCU and all rated entities to which such errors relate, explaining the impact of the errors on the determined credit ratings, and also report on the need to update the determined credit ratings;
2. post information about the detected errors on its own website, if such errors affect the determined credit ratings;
3. correct the detected errors;
4. in the event of significant changes in rating methodologies, models, and/or key rating assumptions submitted for authorization, the rating agency within the timeframe and manner determined by the NSSMCU, immediately, but no later than the end of the next working day, notifies the NSSMCU about such changes and publishes them in accordance with the Law.

3. Confirmation by the RA of credit ratings determined by a rating agency established in a foreign state
4. A credit rating determined by a rating agency established in a foreign state may be used in Ukraine exclusively after confirmation by the RA of such credit rating.
5. The RA cannot use the confirmation of a credit rating determined by a rating agency established in a foreign state for the purpose of avoiding compliance with legislative requirements.

31 108. The RA that has confirmed a credit rating determined by a rating agency established in a foreign state bears full responsibility for such credit rating and for compliance with legislative requirements. 109. The RA must also immediately assess whether there are grounds for reassigning the rating or withdrawing the existing credit rating.

4. Requirements for sovereign ratings
5. In the event of determining a sovereign rating, such determination must ensure an analysis of the individual characteristics of the state with which the rating object is associated. In the event of determining a sovereign rating for a rating object associated with a group of states, the publication of information regarding the review of such sovereign rating without the publication of reports on individual states – participants of the group is not allowed.
6. Texts of official letters or other written (electronic) communications and/or public announcements (except for credit ratings (rating forecasts) and/or accompanying press releases or reports specified in part six of Article 25 of the Law), which may lead to changes in the sovereign rating, cannot be based on information related to the rated entity without the consent of such entity to its publication. The restrictions on the use of information provided for by this paragraph do not apply to cases of the presence of information in publicly available sources and/or the absence of legal grounds for withholding consent to the disclosure of such information.
7. Sovereign ratings must be updated by the RA at least every six months.
8. The RA conducts back-testing of sovereign ratings not less than once every six months.
9. In the event of determining or updating a sovereign rating or a related rating forecast, the RA must ensure compliance with additional requirements for sovereign ratings in accordance with Article 22 of the Law.

V. Requirements for the development, approval, publication, and review of rating methodologies, models, and key rating assumptions

1. Development, approval, monitoring, and review of rating methodologies, models, and key rating assumptions

32 115. CRA is required to develop a general description of the main models and methodologies used for determining credit ratings for each type of credit rating. CRA is required to use rating methodologies that are rigorous, systematic, continuous, and subject to regular validation based on historical experience, including back-testing on past data. 116. Policies and procedures for the development, approval, and review of CRA rating methodologies must include: the responsibilities and process for the development and approval of rating methodologies, including detailed information on the composition of rating methodology committees and member selection procedures; validation and verification of rating methodologies based on historical data, including how back-testing results are taken into account. In addition, the CRA must also include the results of such validation/back-testing for the last three years, if quantitative data is available; procedures for the review of rating methodologies; procedure for reporting on the results of the rating methodology review; order for implementing changes to the methodology, models, or key rating assumptions; mechanisms for monitoring the impact of changes in macroeconomic or financial market conditions on credit ratings. 117. Rating methodologies, models, and key rating assumptions used by the CRA in its rating activities are not subject to approval or registration by the NCSPFU. 118. At least once a year and/or in the event of significant changes that may affect credit ratings determined by the CRA, such CRA must monitor and update its own rating methodologies. 119. Credit rating methodologies must be validated based on historical experience, including back-testing on past data. 120. In the process of reviewing rating methodologies, the CRA must take into account:

1. regular assessments of credit ratings and performance evaluations of rated entities and financial instruments;
2. internal and out-of-sample back-testing;

33 3) historical information regarding validation or back-testing on past data. 121. Validation (verification) of credit rating methodologies must be designed to ensure:

1. sensitivity analysis of credit rating methodologies to changes in any of their main assumptions, including qualitative or quantitative factors;
2. conducting adequate and proper assessment of historical credit ratings generated using these credit rating methodologies;
3. use of reliable input data;
4. proper accounting for major geographic regions of rated entities or financial instruments for each of the assessed categories of credit ratings, such as structured finance, sovereign capital, corporations, financial institutions, insurance, public finance.

2. Rating Methodologies, Model Descriptions, and Key Rating Assumptions
3. CRA must use credit rating methodologies that describe:

1. historical resilience and predictive power of credit ratings determined using the relevant methodology over relevant time horizons and for different asset classes;
2. the degree, deviation of assumptions used in the rating model, from actual default rates and losses.

123. Rating methodologies used by the CRA must be accurate, systematic, and continuous, and must be confirmed based on historical experience, including back-testing.
124. CRA must use and apply credit rating methodologies that: contain clear and reliable control mechanisms and processes for their development and approval, allowing for proper challenge; include all driving factors considered relevant for determining the creditworthiness of the rated entity or financial instrument, which must be confirmed by statistical, historical experience, or evidence;

34 take into account the modeled relationship between rated economic entities or financial instruments with the same risk factor and risk factors to which credit rating methodologies are sensitive; include reliable, relevant, and high-quality analytical models, key assumptions, and credit rating criteria, where such exist. 125. CRA must define in detail in the credit rating methodology: each qualitative factor used, including the volume of qualitative assessment for this factor; each quantitative factor used, including key variables, data sources, key assumptions, modeling, and quantitative methods. 126. Information defined in paragraph 125 of these Rules and Conditions must contain: the importance of each qualitative or quantitative factor used within this credit rating methodology, including, where appropriate, a description and justification of the relevant weight coefficients assigned to these factors, and their impact on credit ratings; an assessment of the relationship between key assumptions used in this credit rating methodology and critical risk factors derived from macroeconomic or financial data; and an assessment of the relationship between key assumptions used in the credit rating methodology and the volatility of credit ratings obtained under this methodology over time. 127. CRA must use credit rating methodologies and related analytical models, key credit rating assumptions, and criteria, which are confirmed by conclusions or results of a review conducted by one or more of: independent members of the rating agency's board; persons responsible for ensuring the rating agency's review function; any other responsible person or committee involved in monitoring and reviewing credit rating methodologies. 128. CRA must use credit rating methodologies and related analytical models, key assumptions, and credit rating criteria, which are regularly applied when formulating all credit ratings in a certain asset class or market segment, unless there is an objective reason to deviate from them. 129. CRA must use credit rating methodologies capable of promptly taking into account the results of any reasonableness checks. 130. CRA must use credit rating methodologies that are developed and implemented in such a way that they can:

35

1. continue to be used if there is no objective reason to change or discontinue the credit rating methodology;
2. be able to promptly take into account any conclusions of current monitoring or review, in particular, if changes in structural macroeconomic or financial market conditions may affect credit ratings obtained under this methodology;
3. compare credit ratings across different asset classes.

131. Credit rating methodologies must have a confirmed history of consistency and accuracy in predicting creditworthiness, be confirmed by quantitative evidence of the discriminatory power of the credit rating methodology, and may include validation methods such as relevant default or transition studies developed to test these specific methodologies.
132. In cases where quantitative evidence confirming the predictive power of the credit rating methodology is limited, the CRA is exempt from complying with the requirements of paragraphs 102, 120–122, and 131 of these Rules and Conditions, if such CRA:

1. ensures that credit rating methodologies are justified indicators of creditworthiness prediction;
2. applies internal procedures consistently over time and across different market segments.

3. Disclosure of Information on Rating Methodologies, Model Descriptions, and Key Rating Assumptions
4. Rating methodologies, models, and key rating assumptions used by the CRA in its rating activities are open and subject to publication free of charge on the CRA's website. The CRA has no right to charge any fee for providing such information.
5. If the rating methodologies, models, or key rating assumptions used by the CRA have been changed, or if errors are found in them, such CRA must disclose information in accordance with the Regulation on Disclosure of Information by Authorized Rating Agencies.
6. A CRA intending to significantly change or use new rating methodologies, models, or key rating assumptions that may affect determined credit ratings must on its own website:

36

1. publish such significant changes (new rating methodologies) proposed;
2. publish detailed explanations of the reasons and consequences of introducing such changes (application of new rating methodologies);
3. invite all interested parties to provide their comments within one month. VI. Notification by a person/shareholder/participant of the intention to acquire, intention to dispose, acquisition, or disposal of a significant package of shares (parts) of a CRA

136. A person (persons acting in concert) who intends to directly or indirectly acquire or dispose of voting shares (parts) of a CRA must notify such CRA of the package of shares (parts) that such person will become the owner of (the aggregate package of shares (parts), if as a result of such acquisition or disposal the package of shares (parts) becomes more than, less than, or equal to the threshold of 5, 10, 15, 20, 25, 30, 50, 75 percent of voting shares (parts)) (the content and form of information is determined in Appendix 1 to these Rules and Conditions).
137. A shareholder (participant, person) of a CRA must notify the CRA of a change in the threshold value of the package of shares (parts) owned by such shareholder (participant), including as a result of an increase or decrease in the authorized capital of such CRA (the content and form of information is determined in Appendix 2 to these Rules and Conditions).
138. The requirements of paragraph 136 of these Rules and Conditions do not apply:

1. in the case of acquisition by a person conducting clearing activities of shares in the process of conducting clearing activities within the ordinary settlement period in the manner established by legislation. Criteria for the ordinary settlement period are determined by the NCSPFU;
2. in the case of acquisition or disposal of significant packages of shares (parts) of a CRA that have reached or exceeded threshold values of 5 percent but have not reached 10 percent or more of voting shares (parts), by an investment firm performing the functions of a market-maker, provided that such functions are carried out in the manner established by legislation and the investment firm does not use such package of shares (parts) for the purpose of managing the CRA;
3. to voting shares (parts) that are in the trading portfolio of a financial institution, provided that the size of such package does not exceed 5 percent of voting shares (parts) of the CRA and the financial institution does not use such package of shares (parts) for the purpose of managing the CRA.

37 139. Notifications provided for in paragraphs 136 and 137 of these Rules and Conditions must be made no later than three business days from the date on which the shareholder (participant) or person entitled to use voting shares (parts) learned or should have learned about the acquisition or disposal or possibility of using voting shares (parts) exceeding threshold values. 140. A legal entity is exempt from the obligation to make the notification provided for in paragraph 136 if such notification is made by its parent company. 141. For the purposes of this section, a parent company under whose control a legal entity is located must not combine into one package voting shares (parts) owned by it or under its management, and voting shares (parts) of the legal entity under its control, if all such requirements are met:

1. the legal entity under the control of the parent company is an asset management company or an investment firm conducting portfolio management activities of financial instruments;
2. voting shares (parts) belong to a client (collective investment institution, non-state pension fund, management principal who has concluded a contract with an investment firm for the management of a portfolio of financial instruments) of the legal entity under the control of the parent company;
3. the parent company allows the legal entity under its control to independently and freely dispose of and use voting shares (parts) belonging to the client and under the management of such legal entity under the control of the parent company, in accordance with legislation.

142. For the purposes of this section, a parent company under whose control a legal entity is located must combine into one package voting shares (parts) owned by it or under its management, and voting shares (parts) of the legal entity under its control, if at least one of the requirements provided for in paragraph 141 of these Rules and Conditions is not met.
143. The notification provided for in paragraph 136 of these Rules and Conditions is also submitted by a natural or legal person who acquires or disposes of the right to vote on shares (parts) of a CRA, if as a result of such acquisition or disposal the total number of votes on shares (parts) of such person becomes more than, less than, or equal to the threshold value of the package of shares (parts) in such cases:

1. voting shares (parts) belong to a third party with whom such natural or legal person has entered into an agreement on coordinated voting or coordinated actions at the general meeting of the CRA;
2. voting shares (parts) belong to a third party in accordance with a contract concluded with such natural or legal person, providing for the temporary transfer of the right to vote on such shares (parts);
3. voting shares (parts) are transferred as collateral to such natural or legal person in accordance with a contract, provided that such person has the right to use such voting shares (parts);
4. voting shares (parts) belong to a third party and are transferred for lifelong use to such natural or legal person in accordance with a contract;
5. voting shares (parts) based on a transaction provided for in sub-paragraphs 1–4 of this paragraph are under the use of a legal entity that is directly or indirectly under the control of such natural or legal person;
6. voting shares (parts) belonging to a third party are transferred to the possession of such natural or legal person in accordance with a contract, provided that such person can independently and freely use such shares (parts) in the absence of any instructions or orders from such third party;
7. voting shares (parts) are in the possession of a third party who uses them in their own name but in the interests of such natural or legal person;
8. such natural or legal person has the right to independently and freely use voting shares (parts) based on a power of attorney received, provided there are no instructions or orders from the principal.

144. The notification provided for in paragraph 136 of these Rules and Conditions is also submitted by a natural or legal person who is directly or indirectly the owner of:

1. financial instruments that on the date of their exercise give their owner the right to acquire voting shares (parts) of a CRA by physical delivery;

39 2) financial instruments not provided for in sub-paragraph 1 of this paragraph, which have a similar economic nature but do not provide for physical delivery of shares (parts) of a CRA. Director of the Department for Supervision of Corporate Governance and Corporate Finance Inna MARTYNENKO

Appendix 1 to the Rules and Conditions for conducting rating activities (paragraph 136 of Section VI) Notification by a person (persons acting in concert) to a CRA of the intention to acquire/dispose directly or indirectly of voting shares (parts) of a CRA, if as a result of such acquisition or disposal the package of shares (parts) becomes more than, less than, or equal to the threshold of 5, 10, 15, 20, 25, 30, 50, 75 percent of voting shares (parts) No. Date notification to CRA by person(s) acting in concert, about intention to acquire/dispose of voting shares (parts), which is more, less than or equal to threshold value Full name – owner (owner(s)) or name – owner (owner(s)) of the package of shares/parts TIN1 EIDR2 Identification code of the legal entity, code / number from the commercial, banking or court register, registration certificate of the local authority of a foreign state on registration of a legal entity (owner(s)) Size of the share of the shareholder (participant) before change (in percent of authorized capital) Aggregate package of voting shares (parts) Date on which threshold value was reached or crossed 1 2 3 4 5 6 7 8 9 1 Taxpayer Registration Number or series (if any) and passport number (for natural persons who, due to their religious beliefs, refuse to accept the taxpayer registration number and have notified the relevant controlling authority and have a mark in their passport). In this case, such information is not subject to publication on the CRA website and in the database of the person disclosing regulated information. 2 Unique record number in the Unified State Demographic Register (if any). In this case, such information is not subject to publication on the CRA website and in the database of the person disclosing regulated information.

---

The following information must be provided: about persons who are part of the chain of ownership of corporate rights of the legal entity, through which the person who became the owner of the aggregate package exercises control over shares (parts). about the shareholder (participant) or person entitled to use voting shares (parts) (name of the natural person or name of the legal entity (with indication for the legal entity – resident – code according to the Unified State Register of Legal Entities, Individual Entrepreneurs and Public Formations, for legal entity – resident – code/number from the commercial, banking or court register, registration certificate of the local authority of a foreign state on registration of a legal entity);

2 Continuation of Appendix 1 registration number of the taxpayer's account card or series (if any) and passport number (for natural persons who, due to their religious beliefs, refuse to accept the taxpayer registration number and have notified the relevant controlling authority and have a mark in their passport), unique record number in the Unified State Demographic Register (if any) of the person(s). In this case, such information is not subject to publication on the CRA website and in the database of the person disclosing regulated information; identification code according to the Unified State Register of Legal Entities – Entrepreneurs and Public Formations (for legal entity – resident), code / number from the commercial, banking or court register, registration certificate of the local authority of a foreign state on registration of a legal entity (for legal entity – non-resident) owner (owner(s)); size of the share (in percent), which is directly or indirectly owned by the person(s) in the total number of shares (parts) and in the total number of voting shares /parts (if information is available) before and after acquiring the right of ownership to such package of shares (parts); In addition to the mandatory information, additional information necessary for full and accurate disclosure of information about the action is provided, based on the specific conditions of the financial and economic activity of the CRA.

---

Appendix 2 to the Rules and Conditions for conducting rating activities (paragraph 137 of Section VI) Notification by shareholder (participant, person) to CRA of a change in the threshold value of the package of shares (parts) owned by such shareholder (participant), including as a result of an increase or decrease in authorized capital of such CRA

1. Reason for notification (check the appropriate one): information about changes in shareholders (participants) to whom the right to vote on shares/parts belongs, the total number of rights of which becomes greater, less than or equal to the threshold value of the package of shares/parts; information about changes in persons to whom the right to vote on shares/parts belongs, the total number of rights of which becomes greater, less than or equal to the threshold value of the package of shares/parts; information about changes in persons who are owners of financial instruments associated with voting shares/parts of the company, in the event that the total number of rights for such shares/parts becomes greater, less than or equal to the threshold value of the package of shares/ parts
2. Information about the person to whom the obligation to submit a notification applies in accordance with Article 29 of the Law on Rating:

1. regarding a natural person: name, TIN1, EIDR2 Full name Identification code of the legal entity - resident or code/number from the commercial, banking or court register, registration certificate of the local authority of a foreign state on registration of a legal entity – non-resident
2. regarding a legal entity: Location

3. Date when the threshold value was reached or crossed
4. Result Size of package of voting shares / parts (in percent s) (indicator of the last column of the table in paragraph 5) Number of voting rights on shares / parts3 (in percent) (number of the last column of the table in paragraph 6) Number of voting rights on other securities (in percent) (if available) Number of voting rights on shares/parts, associated with financial instruments (in percent) (sum of indicators of the last column of the table in sub-paragraphs 1 and 2 of paragraph 7) Total (sum of indicators , indicated in columns 2, 4, 5 of this table) Total number of voting shares/parts of CRA, pcs. On the date when the threshold value was reached or

---

2 Continuation of Appendix 2 crossed Data of the previous notification (if any) 5. Details of changes in shareholders/participants who own voting shares/parts, the size of which becomes larger, smaller, or equal to the threshold value of the share/part package Size of the package of voting shares on the date when the threshold value was reached or crossed Class and type of shares/parts Action (acquisition or disposal) International identification number of the security Ownership (direct or indirect) Number of voting shares/parts, units Size of the package of voting shares/ parts (as a percentage) of the total number of voting shares/parts 6. Details of changes in persons who own the right to vote for shares/parts, the total number of rights for which becomes larger, smaller, or equal to the threshold value of the share/part package Size of rights for shares on the date when the threshold value was reached or crossed Class and type of shares/parts International identification number of the security Action (acquisition or disposal ) One of the cases specified in paragraph nine of Article 29 of the Law on Rating Number of votes, units Size of voting rights for shares/ parts (as a percentage) 7. Details of changes in persons who are owners of financial instruments related to voting shares /parts of the company, in case the total number of rights for such shares/parts becomes larger, smaller or equal to the threshold value of the share/part package

1. Size of rights for shares/parts on the date when the threshold value was reached or crossed, regarding financial instruments that on the date of their exercise give their owner the right to acquire voting shares/parts by delivering them Type of financial instrument Date of exercise Action (acquisition or disposal ) Ownership (direct or indirect) Number of voting shares/ parts that can be acquired upon exercise of financial instruments (units) Total number of rights for shares/ parts (as a percentage)

3 Continuation of Appendix 2 2) Size of rights for shares/ parts on the date when the threshold value was reached or crossed, regarding financial instruments that on the date of their exercise do not provide delivery of shares/parts to their owner Type of financial instrument Date of exercise Underlying asset (shares/ parts or right to vote) Action (acquisition or disposal ) Ownership (direct or indirect ) Calculation (cash or right to vote) Number of votes (units) Total number of rights for shares/parts (as a percentage) 8. Information on persons who are part of the chain of ownership of corporate rights of a legal entity, through which the person (persons acting in concert) exercises (exercise) control over shares/ parts Name or full name For a natural person: Taxpayer Registration Number1 , UNZR2 Identification code of the legal entity Size of the package of voting shares / parts (as a percentage) 4 Number of voting rights for shares/ parts (as a percentage)3 Number of voting rights for shares/ parts, related to financial instruments (as a percentage)3 9. In case of voting based on a received power of attorney, the following must be specified: for a natural person: name, Taxpayer Registration Number1 , UNZR2 or full name and identification code of the legal entity - the principal; number of votes (units); size of voting rights (as a percentage); expiration date of the power of attorney Information regarding the disclosure of issues defined in the note to this appendix must be provided.5 In addition to the mandatory information, additional information necessary for full and accurate disclosure of information about the action, based on the specific conditions of the financial and economic activity of the ARA. Notes: 1 - Taxpayer Registration Number or series (if available) and passport number (for natural persons who, due to their religious beliefs, refuse to accept the taxpayer registration number and have informed the relevant tax authority and have a mark in the passport). In this case, such information is not subject to publication on the website of the ARA and in the database of the person disclosing regulated information. 2 - Unique record number in the Unified State Demographic Registry (if available) In this case, such information is not subject to publication on the website of the ARA and in the database of the person disclosing regulated information. 3 - Voting rights for shares/ parts owned by the shareholder/participant are not taken into account. 4 - If the size is equal to or exceeds the threshold value. 5 - The following information must be provided: In case of changes in shareholders (participants) who own voting shares (parts), the size of which becomes larger, smaller, or equal to the threshold value of the share (part) package: name or full name of the owner (owners) of shares (parts) who own voting shares (parts), the size of which becomes larger, smaller, or equal to the threshold value of the share (part) package; identification code of the legal entity - resident or code/number from the trade, banking or court register, registration certificate of the local authority of a foreign state on the registration of a legal entity (for a legal entity - resident) owner (owners) of shares (parts);

4 Continuation of Appendix 2 action (acquisition or disposal) and how (directly or indirectly) it occurred; size of the share of the owner (owners) of shares (parts) in the total number of voting shares (parts) before and after the acquisition or disposal of the right of ownership to such a package of shares (parts) (total package of voting shares/parts); information on persons (name of a natural person or full name and identification code of a legal entity, percentage of voting rights, if it equals or exceeds the threshold value), who are part of the chain of ownership of corporate rights of a legal entity, through which the person (persons acting in concert) exercises (exercise) control over shares (parts); date on which the threshold values were reached or crossed (if any). In case of changes in persons who own the right to vote for shares (parts), the total number of rights for which becomes larger, smaller, or equal to the threshold value of the share (part) package: name of a natural person or full name of a legal entity owner (owners) of shares (parts), which acquires or disposes of the right to vote for shares (parts) of the company; identification code of the legal entity - resident or code/number from the trade, banking or court register, registration certificate of the local authority of a foreign state on the registration of a legal entity (for a legal entity - non-resident) owner (owners) of shares (parts); size of the share of the owner (owners) of shares (parts) in the total number of voting shares (parts); total number of rights for voting shares (parts) before and after the change; information on persons (name of a natural person or full name and identification code of a legal entity, percentage of voting rights, if it equals or exceeds the threshold value), who are part of the chain of ownership of corporate rights of a legal entity, through which the person (persons acting in concert) exercises (exercise) control over shares (parts); date on which the threshold values were reached or crossed; information on the shareholder (participant) or person who has the right to use voting shares (parts) (name of a natural person or full name of a legal entity (with indication of the identification code of the legal entity - non-resident or code/number from the trade, banking or court register, registration certificate of the local authority of a foreign state on the registration of a legal entity - non-resident)); circumstance (case), as a result of which (which) a natural or legal person acquires or disposes of the right to vote for shares (parts) of the company, if as a result of such acquisition or disposal the total number of votes for shares (parts) of such person becomes larger, smaller, or equal to the threshold value of the share (part) package. In case if a natural or legal person on the basis of a received power of attorney has the right to independently and independently use voting shares (parts) (there are no instructions and/or orders from the principal), it is necessary to indicate the principal (name of a natural person or full name of a legal entity (with indication of the identification code of the legal entity - non-resident or code/number from the trade, banking or court register, registration certificate of the local authority of a foreign state on the registration of a legal entity - non-resident)). In case of changes in persons who are owners of financial instruments related to voting shares (parts) of the company, in case the total number of rights for such shares (parts) becomes larger, smaller or equal to the threshold value of the share (part) package: information on persons (name of a natural person or full name and identification code of a legal entity), who are owners of financial instruments related to voting shares (parts) of the company, in case the total number of rights for such shares (parts) becomes larger, smaller, or equal to the threshold value of the share (part) package; ownership of the financial instrument (direct or indirect); information on persons (name or full name and identification code of a legal entity, percentage of rights to vote, if it equals or exceeds the threshold value), who are part of the chain of ownership of corporate rights of a legal entity, through which the person (persons acting in concert) exercises (exercise) control over shares (parts); date on which the threshold values were reached or crossed; type of financial instrument; term (period) of exercise; whether (or not) financial instruments on the date of their exercise give their owner the right to acquire voting shares (parts); number of voting shares (parts) that can be acquired upon exercise of financial instruments; total number of rights for voting shares (parts) before and after

---