Regulation on the Reporting of Violations of the Capital Market Law

1 KINGDOM OF SAUDI ARABIA Capital Market Authority REGULATION ON THE REPORTING OF VIOLATIONS OF THE CAPITAL MARKET LAW Issued by the Board of the Capital Market Authority Pursuant to its Resolution Number 2-135-2021 Dated 9/5/1443H Corresponding to 13/12/2021G Based on the Capital Market Law issued by Royal Decree No. M/30 dated 2/6/1424H Arabic is the official language of the Capital Market Authority IMPORTANT NOTICE: The current version of these Regulations, as may be amended, can be found at the Authority’s website: www.cma.org.sa

2 TABLE OF CONTENTS Article One: Preamble Article Two: Definitions Article Three: Exemptions Article Four: Right of Appeal Article Five: Reporting Channels Article Six: Requirements when Reporting Article Seven: Conditions for Granting the Reward Article Eight: Determination of the Reward Amount Article Nine: Legal Support Article Ten: Protection Policy for Reporting Individuals Article Eleven: Confidentiality Article Twelve: Reporting by the Individual who Committed or Participated in Committing a Violation Article Thirteen: Reporting an Untrue Incident Article Fourteen: Entry into Force

3 Article One: Preamble The purpose of this Regulation is to regulate the reporting of violations of the Capital Market Law and its implementing regulations, or violations of the regulations of the Exchange, the Depository Center, or the Clearing Center. This includes the determination of financial rewards for those who report such violations, the controls on granting such rewards, and the procedures that contribute to the protection of those who report violations. Article Two: Definitions: a) “Law” means the Capital Market Law issued by the Royal Decree No. M/30 dated 2/6/1424H. b) Without prejudice to sub-section (c) of this Article, terms used in this Regulation shall have the same meaning provided in the Law and in the Glossary of Defined Terms used in the Rules and Regulations of the Capital Market Authority. c) For the implementation of the provisions of this Regulation, and unless the context indicates otherwise, the following words and phrases shall have the meanings herein specified:

• “Reporting Individual” means a person who reports to the Authority any acts or practices that constitute a violation of any provisions of the Law or its implementing regulations, or of the regulations of the Exchange, the Depository Center, or the Clearing Center.
• “Reported Individual” means a person against whom a report to the Authority was made in relation to any acts or practices that constitute a violation of any provisions of the Law or its implementing regulations, or of the regulations of the Exchange, the Depository Center, or the Clearing Center.
• “Report” means information provided to the Authority – through channels to be determined by the Authority – in relation to any acts or practices that constitute a violation of any provisions of the Law or its implementing regulations, or of the regulations of the Exchange, the Depository Center, or the Clearing Center.

4

• “Information” means any statement or document – including audio recordings and digital or paper based data or documents – that indicates a violation or suspected violation of any provisions of the Law or its implementing regulations, or of the regulations of the Exchange, the Depository Center, or the Clearing Center.
• “Reward” means a monetary amount determined based on the amount of the fines and financial penalties collected as a result of the Report.
• "Relatives" includes the husband, wife, children and parents. Article Three: Exemptions The Authority may exempt any person from the application of any provisions of this Regulation in whole or in part, either through an application from that person or upon the Authority’s own initiative. Article Four: Right of Appeal Any person that is subject to this Regulation may appeal to the Committee in relation to any decision or action taken by the Authority pursuant to the provisions of this Regulation. Article Five: Reporting Channels The Authority shall receive reports through the following channels: a) The Authority's website. b) Registered mail. c) The Authority's headquarters. d) The Authority's phone number. e) The investor protection mobile application. f) Any other means determined by the Authority. Article Six: Requirements when Reporting The Report must contain the information specified by the Authority, including the following:

1. The name of the Reported Individual and, if available, the Reported Individual's contact details.

5 2. A clear and comprehensive description of the incident that is the subject of the Report, as well as the evidence, information or documents pertaining to the acts or practices that constitute a violation of any provisions of the Law or its implementing regulations, or of the regulations of the Exchange, the Depository Center, or the Clearing Center. Article Seven: Conditions for Granting the Reward The Authority may grant the Reporting Individual a reward the value of which is determined by up to (20%) of the amount of the fines and financial penalties collected as a result of the reported violations, provided the following conditions are met:

1. The report includes the Reporting Individual's name and contact details, or those of his legal representative.
2. The Reporting Individual is a natural person and made the Report of his own volition.
3. That neither the Reporting Individual nor their Relatives is an employee of the Authority or of any similar supervisory body that has access to the Information that is the subject of the Report.
4. The Information contained in the report is not available to the Authority or has not been received beforehand by the Authority from others.
5. The Reporting Individual does not disclose to others any Information related to the Report.
6. The Report leads to the issuance of a final decision by the Authority or by the Committees for the Resolution of Securities Disputes imposing a fine or financial penalty.
7. That the Authority collects the imposed fines and financial penalties, and that the total amount of the fines and financial penalties collected as a result of the reported violations exceeds one million (1,000,000) Saudi riyals.

6 Article Eight: Determination of the Reward Amount When determining the Reward amount, and the apportioning of the Reward amount between more than one Reporting Individual if applicable, the following shall be taken into consideration:

1. The Reporting Individual's role in proving the violation.
2. The timing of the Report.
3. The weight, accuracy, completeness and reliability of the Information and evidence provided by the Reporting Individual.
4. The extent to which the Information provided by the Reporting Individual contributed to the finding of a violation and issuance of a final decision of the same.
5. Extent of the Reporting Individual's cooperation.
6. The extent of the Reporting Individual’s contribution in persuading other parties to cooperate in relation to the Report.
7. The extent of the Reporting Individual's contribution in limiting the damages that would have resulted from the violation had it not been reported.
8. The degree of risk the Reporting Individual faced because of the Report.
9. That the information in the Report was not available to the public; this includes information deduced by the Reporting Individual based on the Reporting Individual's independent analysis of information available to the public. Article Nine: Legal Support The Authority may provide legal support and assistance to an individual the Authority believes was harmed as a result of a Report made by such individual.

7 Article Ten: Protection Policy for Reporting Individuals1 The Exchange, the Clearing Center, the Depository Center, Capital Market Institutions, and listed companies must set an internal policy, to be adopted by their boards of directors or their equivalent, for the protection of Reporting Individuals that are employed by them. Such policy must include, at minimum, a prohibition on taking disciplinary actions against Reporting Individuals employed by them or infringing upon their rights or employment benefits because of Reports submitted by them to the Authority. Article Eleven: Confidentiality The information of the Reporting Individual or any information obtained by the Authority under the provisions of this Regulation is considered confidential. Article Twelve: Reporting by the Individual who Committed or Participated in Committing a Violation The Authority may take into consideration when determining its decision on the reported violation whether the individual who committed or participated in committing the violation has, as an initiative by such individual, submitted a Report on the violation before the Authority is aware of such violation. Article Thirteen: Reporting an Untrue Incident The Authority has the right to take whatever measures it deems appropriate against those who knowingly and in bad faith reported an untrue incident. Article Fourteen: Entry into Force This Regulation shall enter into force upon its publication.

1 In accordance with the Board of the Authority Resolution no. (2-135-2021) Dated 9/5/1443H corresponding to 13/12/2021G, Article (Ten) of this Regulation shall become effective as of 9/8/1444H corresponding to 1/3/2023G.

8