Investment Firms Act (WPFG)

All English translation of the authentic German text is unofficial and serves merely information purposes. The official wording in German can be found in the Austrian Federal Law Gazette (Bundesgesetzblatt; BGBl.). All translations have been prepared with great care, but linguistic compromises had to be made. The reader should also bear in mind that some provisions of these laws will remain unclear without certain background knowledge of the Austrian legal and political system. Please note that these laws may be amended in the future and check occasionally for updates. INVESTMENT FIRMS ACT (WPFG; WERTPAPIERFIRMENGESETZ) Original Version: Federal Law Gazette I No. 237/2022 Amendments: Federal Law Gazette I 49/2025; 5/2026. Note about this translation: this consolidated version reflects the version of the Federal Act up to including the amendment published in Federal Law Gazette I 5/2026. Date: 19.02.2026

Investment Firms Act 2 / 48 TABLE OF CONTENTS Section 1: Scope and definitions............................................................................................................ 5 Scope ............................................................................................................................................ 5 Definition of Terms....................................................................................................................... 5 Section 2: Principles of prudential supervision..................................................................................... 7 Competent Authority ................................................................................................................... 7 Discretion of the FMA to subject certain investment firms to the requirements of Regulation (EU) No 575/2013.......................................................................................................................... 8 Cooperation within the European System of Financial Supervision.......................................... 9 Cooperation with the Competent Authorities of other EU Member States ............................. 10 On-site inspections of branch establishments in Austria ......................................................... 11 Confidentiality............................................................................................................................ 11 Cooperation agreements with third countries.......................................................................... 12 Duties of auditors ....................................................................................................................... 13 Powers to Obtain Information................................................................................................... 13 Reporting of breaches................................................................................................................ 14 Section 3: Initial Capital, Internal Capital Adequacy Assessment Process and Internal Risk Assessment Process.............................................................................................................................. 14 Initial capital............................................................................................................................... 14 Internal capital and liquid assets............................................................................................... 15 Section 4: Internal governance, transparency, treatment of risks and remuneration ...................... 16 Scope of application of Section 4 .............................................................................................. 16 Internal governance ................................................................................................................... 16 Country-by-country disclosure requirements........................................................................... 17 Role of the senior management in risk management............................................................... 17 Role of the supervisory body or the otherwise competent supervisory body under law or statutes in risk management ..................................................................................................... 18 Treatment of risks ...................................................................................................................... 18 Remuneration policies ............................................................................................................... 19 Investment firms benefitting from extraordinary public financial support............................. 19 Remuneration Committee ......................................................................................................... 20 Oversight of remuneration policies ........................................................................................... 20 Section 5: Supervisory review and evaluation process....................................................................... 21 Supervisory review and evaluation ........................................................................................... 21 Ongoing review of the permission to use internal models....................................................... 22 Section 6: Supervisory measures and powers..................................................................................... 24

3 / 48 Supervisory measures................................................................................................................ 24 Supervisory powers.................................................................................................................... 24 Additional own funds requirement ........................................................................................... 25 Guidance on additional own funds............................................................................................ 26 Additional liquidity requirement............................................................................................... 27 Exemption of certain small and non-interconnected investment firms from liquidity requirements .............................................................................................................................. 28 Cooperation with the resolution authority ............................................................................... 28 Publication requirements .......................................................................................................... 28 Obligation to inform EBA ........................................................................................................... 29 Section 7: Supervision of investment firm groups .............................................................................. 30 Scope of application of the group capital test pursuant to Article 8 of Regulation (EU) 2019/2033 ........................................................................................................................... 30 Exemption from supervision on an individual basis pursuant to Article 6 of Regulation (EU) 2019/2033 ................................................................................................................................... 30 The FMA’s competence as group supervisor............................................................................. 30 Information requirements in emergency situations................................................................. 31 Colleges of supervisors .............................................................................................................. 32 FMA cooperation with other competent authorities ................................................................ 33 Verification of information concerning entities in other Member States ................................ 34 Inclusion of holding companies in supervision of compliance with the group capital test.... 34 Suitability of members of the management board and the members of the supervisory board of a holding company................................................................................................................. 34 Mixed-activity holding companies............................................................................................. 35 Assessment of third-country supervision and other supervisory techniques ......................... 35 Section 8: Reporting by investment firms and disclosure obligations of the FMA............................. 36 Reporting by investment firms .................................................................................................. 36 Disclosure of Investment Strategy............................................................................................. 36 Disclosure obligations of the FMA.............................................................................................. 37 Section 9: Penal provisions, publication of measures and sanctions, reporting to EBA ................... 37 Penal provisions ......................................................................................................................... 37 Publication of measures and sanctions .................................................................................... 39 Reporting to EBA ........................................................................................................................ 41 Section 10: Transitional and final provisions ...................................................................................... 41 Transitional provisions............................................................................................................... 41 References and Regulations ...................................................................................................... 41 Transposition Note..................................................................................................................... 43 Enforcement............................................................................................................................... 43

4 / 48 Entry into force........................................................................................................................... 43 Annex..................................................................................................................................................... 45 Annex to Article 21: Principles of Remuneration Policy and Practices..................................... 45

Investment Firms Act 5 / 48 SECTION 1: SCOPE AND DEFINITIONS Scope Article 1. (1) This federal act lays down rules concerning:

1. the initial capital of investment firms;
2. the supervisory powers and instruments for the supervision of investment firms by the Austrian Financial Market Authority (FMA) in accordance with this federal act and Regulation (EU) 2019/2033 on the prudential requirements of investment firms and amending Regulations (EU) No 1093/2010, (EU) No 575/2013, (EU) No 600/2014 and (EU) No 806/2014, OJ L 314, 05.12.2019, p. 1;
3. the prudential supervision of investment firms by the FMA in a manner that is consistent with the rules set out in Regulation (EU) 2019/2033;
4. the FMA’s disclosure obligations in the field of prudential regulation and supervision of investment firms. (2) This federal act shall apply for investment firms with their registered office or active in Austrian federal territory, which
5. hold a licence and are supervised pursuant to Article 3 of the Securities Supervision Act of 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018), published in Federal Law Gazette I No. 107/2017, as well as
6. Are natural and legal persons, who are authorised in their home Member State for the provision of investment services or investment activities as an investment firm as defined in Article 4 (1) (1) of Directive 2014/65/EU on markets in financial instruments and amending Directives 2002/92/EC and 2011/61/EU, OJ L 173, 12.06.2014, p. 349, and conduct activities in Austria via a branch. (3) By way of derogation from para. 2, Articles 7 to 31, 33 to 35 and 38 to 51 shall not apply to certain investment firms listed in Article 1 (2) and (5) of Regulation (EU) 2019/2033; instead the listed investment firms will be supervised in accordance with the Banking Act (BWG; Bankwesengesetz) published in Federal Law Gazette no. 532/1993. Definition of Terms Article 2. For the purposes of the present Federal Act, the following definitions shall apply:
7. “investment firm”: an investment firm pursuant to Article 1 no. 1 WAG 2018;
8. “investment services and activities”: investment services and activities pursuant to Article 1 no. 3 WAG 2018;
9. “ancillary services undertaking”: an undertaking, the principal activity of which consists of a. owning or managing of property b. managing data-processing services, or

Investment Firms Act 6 / 48 c. a similar activity which has the characteristic of being ancillary to the principal activity of one or more investment firms or similar undertakings; 4. “branch”: a branch pursuant to Article 1 no. 46 WAG 2018; 5. “close ties”: close ties pursuant to Article 1 no. 50 WAG 2018; 6. “competent authority”: the authority designated by each Member State as the competent authority in accordance with Article 4 (1) of Directive (EU) 2019/2034. 7. “Member State”: any state which belongs to the European Economic Area; 8. “commodity and emission allowance dealer”: a commodity and emission allowance dealer pursuant to point (150) of Article 4(1) of Regulation (EU) No 575/2013; 9. “control”: a relationship between a parent undertaking and a subsidiary as defined in Article 189a no. 6 of the Federal Act on special regulations under civil law for undertakings (UGB; Unternehmensgesetzbuch “Austrian Commercial Code”) published in Reich Law Gazette p. 219/1897, or a similar relationship between any natural or legal person and an undertaking; 10. “compliance with the group capital test”: compliance by a parent undertaking in an investment firm group with the requirements of Article 8 of Regulation (EU) 2019/2033; 11. “credit institution”: a credit institution pursuant to Article 1 para. 1 BWG. 12. “derivatives”: financial instruments pursuant to point (29) of Article 2(1) Regulation (EU) No 600/2014. 13. “financial institution”: a financial institution pursuant to point (14) of Article 4(1) of Regulation (EU) No 2019/2033; 14. “gender neutral remuneration policy”: a remuneration policy based on equal pay for male and female workers for equal work or work of equal value pursuant to Article 2 no. 60 BWG; 15. “group”: a parent undertaking and all subsidiaries; 16. “consolidated basis”: the basis of the consolidated situation pursuant to point 11 of Article 4(1) of Regulation (EU) No 2019/2033; 17. “group supervisor”: the competent authority responsible for the supervision of compliance with the group capital test of EU parent investment firms and investment firms controlled by EU parent investment holding companies or EU parent mixed financial holding companies; 18. “home Member State”: a home Member State pursuant to Article 1 no. 38 WAG 2018; 19. “host Member State”: a host Member State pursuant to Article 1 no. 41 WAG 2018; 20. “initial capital”: the capital which is required for the purposes of authorisation as an investment firm, the amount and type of which are specified in Article 6; 21. “group of investment firms”: a group of investment firms pursuant to point (25) of Article 4(1) of Regulation (EU) No 2019/2033; 22. “investment holding company”: an investment holding company pursuant to point (23) of Article 4(1) of Regulation (EU) No 2019/2033; 23. “management body”: a management body pursuant to Article 1 no. 54 WAG 2018; 24. “management body in its supervisory function”: the management body acting in its role of overseeing and monitoring decision-making of the senior management;

Investment Firms Act 7 / 48 25. “mixed financial holding company”: a mixed financial holding company pursuant to Article 2 no. 15 of the Financial Conglomerates Act (FKG; Finanzkonglomerategesetz) published in Federal Law Gazette I No. 70/2004; 26. “mixed-activity holding company”: a parent undertaking other than a financial holding company, an investment holding company, a credit institution, an investment firm, or a mixed financial holding company under the FKG, the subsidiaries of which include at least one investment firm; 27. “parent undertaking”: a parent undertaking pursuant to Article 1 no. 48 WAG 2018; 28. “subsidiary”: a subsidiary pursuant to Article 1 no. 49 WAG 2018; 29. “senior management”: senior management pursuant to Article 1 no. 55 WAG 2018; 30. “systemic risk”: systemic risk pursuant to Article 2 no. 41 BWG; 31. “EU parent investment firm”: an EU parent investment firm pursuant to point (56) of Article 4(1) of Regulation (EU) No 2019/2033; 32. “EU parent investment holding company”: an EU parent investment holding company pursuant to point (57) of Article 4(1) of Regulation (EU) No 2019/2033; 33. “EU parent mixed financial holding company”: an EU parent mixed financial holding company pursuant to point (58) of Article 4(1) of Regulation (EU) No 2019/2033; 34. “Authorisation”: the licence of an investment firm pursuant to Article 3 para. 5 WAG 2018; 35. “Articles of association”: the articles of association, memorandum of association, or cooperative agreement, depending on the legal form of the undertaking; 36. “Central counterparty (CCP)”: a CCP as defined in Article 2, point 1, of Regulation (EU) No 648/2012; 37. “qualifying central counterparty (QCCP)”: a qualifying central counterparty as defined in Article 4 (1), point (88), of Regulation (EU) No 575/2013; 38. “ESAP”: the European Single Access Point established pursuant to Regulation (EU) 2023/2859; 39. “ESAP collection body”: a collection body as defined in Article 2 point 2 of Regulation (EU) 2023/2859. SECTION 2: PRINCIPLES OF PRUDENTIAL SUPERVISION Competent Authority Article 3. (1) As the competent authority, the FMA, irrespective of the duties conferred upon it in other Federal Acts shall conduct supervision of investment firms, investment holding companies and mixed financial holding companies in accordance with the provisions of this Federal Act and Regulation (EU) 2019/2033, and in so doing shall take into account the national economic interest in a functioning financial market as well as the interests of investors. (2) Investment firms shall make all required information available to the FMA, so that the FMA is able to assess whether the investment firms observe the provisions set out in this Federal Act and in

Investment Firms Act 8 / 48 Regulation (EU) 2019/2033. The FMA may, also without specific reason to do so, conduct on-site inspections at investment firms. (3) Investment firms are required to record all transactions, and to document the systems and processes that are subject to this Federal Act and Regulation (EU) 2019/2033 in such a manner that the FMA is able to check compliance with the provisions contained in this Federal Act and in Regulation (EU) No 2019/2033 at all times. (4) In the case of breaches against the provisions contained in this Federal Act and in Regulation (EU) 2019/2033, the FMA may:

1. publish the names of natural or legal persons, of the investment firm, the financial holding company or the mixed financial holding company responsible for the breach as well as the type of the breach pursuant to Article 50;
2. order the responsible natural or legal person to cease their conduct and desist from such conduct in the future;
3. prohibit members of the senior management or the supervisory board of the investment firm or any other natural person responsible for such a breach or irregularity from performing their activities in investment firms or credit institutions. (5) The FMA shall be the ESAP collection body pursuant to Article 3 (2) of Regulation (EU) 2023/2859 for the collection of information submitted on a voluntary basis stated in Regulation (EU) 2019/2033 and Directive (EU) 2019/2034. (6) The FMA may determine, by means of a Regulation, a specific format, additional meta data to be included and the submission modalities for the submission of data pursuant to para. 5, if this appears expedient taking into consideration rules under European Union law. The FMA shall be empowered as the controller under data protection law pursuant to Article 4 point 7 of the General Data Protection Regulation in conjunction with the tasks pursuant to para. 5 for processing personal data in accordance with the General Data Protection Regulation. Discretion of the FMA to subject certain investment firms to the requirements of Regulation (EU) No 575/2013 Article 4. (1) The FMA may order that an investment firm which trades for its own account pursuant to Article 1 no. 3 lit. c WAG 2018 or underwrites financial instruments and/or places financial instruments with a firm commitment basis pursuant to Article 1 no. 3 lit. f WAG 2018, and whose total assets are or exceed EUR 5 billion, shall apply the provisions of Regulation (EU) No 575/2013, if the investment firm
4. conducts the listed activities to such an extent that the failure or failure or the distress of the investment firm could lead to systemic risk, or
5. is a clearing member pursuant to point 3 of Article 4 (1) of Regulation (EU) 2019/2033;
6. has, based on its size, its interconnectedness with the financial system, the nature, scope and complexity of its activities or the activities that it provides on a cross-border basis, significant relevance for the economy of the European Union or Austria.

Investment Firms Act 9 / 48 (2) Paragraph 1 shall not apply to commodity and emission allowance dealers, collective investment undertakings or insurance undertakings. (3) Articles 7 to 31, 33 to 35 and 38 to 51 shall not apply to investment firms listed in para. 1; instead, such investment firms will be supervised in accordance with the Banking Act (BWG; Bankwesengesetz). (4) If an investment firm no longer meets or exceeds the threshold stipulated in para. 1 over a continuous period of twelve months, or if the criteria pursuant to para. 1 nos. 1 to 3 are no longer met, the investment firm shall notify this to the FMA without delay. In the event of the conditions no longer being met, the FMA shall revoke its order pursuant to para. 1 with effect from the time of receipt of the notification. (5) If the FMA revokes an order pursuant to para. 1, it shall inform the investment firm in question of this without delay. (6) The FMA shall inform the European Banking Authority (EBA) (Regulation (EU) No 1093/2010) about all orders pursuant to paras. 1, 4 and 5 without delay. Cooperation within the European System of Financial Supervision Article 5. (1) The FMA shall take into account European convergence in respect of supervisory tools and supervisory procedures in the enforcement of this Federal Act. For this purpose the FMA shall apply the Guidelines, Recommendations and other measures or warnings passed by the EBA pursuant to Article 16 of Regulation (EU) No. 1093/2010, by the European Securities and Markets Authority (ESMA) pursuant to Article 16 of Regulation (EU) No. 1095/2010, or by the European Systemic Risk Board (ESRB) pursuant to Article 16 of Regulation (EU) No. 1092/2010 on European Union macro-prudential oversight of the financial system and establishing a European Systemic Risk Board, OJ L 331, 15.12.2010 p. 1. The FMA may deviate from the guidelines and recommendations, provided that justified grounds exist to do so. (2) The FMA shall

1. cooperate within the European System of Financial Supervision (ESFS) with the competent authorities of other Member States and other parties to the ESFS, and in particular ensure that appropriate, reliable and exhaustive information is made available to other parties to the ESFS;
2. participate in EBA’s activities, and as applicable participate in the supervisory colleges stated in Article 77b BWG and Article 40 of this Federal Act;
3. take into account the potential impact of its decisions on the stability of the financial system in other Member States as well as the European Union as a whole, especially in crisis situations.

Investment Firms Act 10 / 48 Cooperation with the Competent Authorities of other EU Member States Article 6. (1) The FMA shall cooperate closely in the supervision of investment firms with the competent authorities in the Member States in which the investment firms conduct activities, in order to ensure that all activities performed by such investment firms or groups of investment firms are subject to comprehensive supervision within the European Union. (2) For the purposes of para. 1, the FMA shall make the following information available without delay to the relevant competent authorities, and may also request the following information from the relevant competent authorities:

1. information about the management and ownership structure of the investment firm;
2. information about compliance with own funds requirements by the investment firm;
3. information about compliance with liquidity requirements and requirements in relation to concentration risk;
4. information about the administrative and accounting procedures and internal control mechanisms of the investment firm;
5. any other relevant factors that may influence the risk posed by the investment firm. (3) The FMA as competent authority of the home Member State shall immediately provide the competent authorities of the host Member State with any information and findings about any potential problems and risks posed by an investment firm to the protection of consumers or the stability of the financial system in the host Member State which they have identified when supervising the activities of an investment firm. (4) The FMA as competent authority of the home Member State shall take all necessary measures for avoiding and averting potential risks and problems, as a result of receiving information from the competent authority in the host Member State about any problems and risks posed by an investment firm with regard to consumer protection or financial market stability. Where requested to by the competent authorities in the host Member State, the FMA shall explain how it has taken into account the information made available by the competent authorities in the host Member State. (5) Where following the submission of information and findings the FMA is of the opinion in relation to any problems and risks posed by an investment firm in relation to consumer protection or financial market stability that the competent authorities in the host Member State has not taken all necessary measures for avoiding and averting the potential risks and problems, then having informed the competent authorities in the host Member State, EBA and ESMA, the FMA may take suitable measures for consumer protection and for maintaining financial market stability. (6) The FMA may, provided that a request for cooperation, in particular a request to exchange information, was rejected or failed to elicit any reaction within an appropriate period of time, submit these factual circumstances to EBA. (7) The FMA may, provided that it does not agree with the measures taken by the competent authorities of the host Member State, submit these factual circumstances to EBA.

Investment Firms Act 11 / 48 (8) Pursuant to point (c) of Article 23(1) of Regulation (EU) 2019/2033 the FMA may request the competent authority of an investment firm’s home Member State of a clearing member to provide information relating to the margin model and the parameters used for the calculation of the margin requirement of the relevant investment firm. On-site inspections of branch establishments in Austria Article 7. (1) The competent authorities of other Member States, which supervised the Austrian branch established of an investment firm that is authorised in another Member State, may, having informed the FMA, carry out on-site inspections themselves or through intermediaries regarding the information pursuant to Article 7 para. 2 and inspections at an Austrian branch establishment of an investment firm authorised in another Member State. (2) The FMA may inspect the activities conducted by an Austrian branch establishment on an investment firm that is authorised in another Member State on a case-by-case basis and request information about their activities, where doing so is considered expedient with regard to financial market stability in Austrian territory. (3) The FMA shall consult the competent authority of the home Member State prior to conducting an on-site inspection pursuant to para. 2. (4) Having conducted an on-site inspection pursuant to para. 2, the FMA shall submit the information obtained and the pertinent findings for the investment firm’s risk assessment to the competent authority in the home Member State. Confidentiality Article 8. (1) The FMA and persons active for the FMA are subject to professional secrecy pursuant to Article 14 of the Financial Market Authority Act (FMABG; Finanzmarktaufsichtsbehördengesetz). Confidential information that the FMA received in performing its duties shall only be allowed, irrespective of para. 5, to be passed on in summarised or aggregated form, provided that it is not possible for individual investment firms or persons to be identified. (2) The FMA shall use the confidential information received or transmitted pursuant to this Federal Act and to Regulation (EU) 2019/2033 exclusively for the purpose of carrying out its duties, and for the following purposes:

1. the monitoring of the provisions under supervisory law that fall within the FMA’s competence pursuant to Article 2 of the Financial Market Authority Act (FMABG; Finanzmarktaufsichtsbehördengesetz), published in Federal Law Gazette I no. 97/2001;
2. the imposing of fines;
3. within the scope of administrative proceedings;
4. in court proceedings.

Investment Firms Act 12 / 48 (3) Other authorities as well as other natural and legal persons that receive information in accordance with this Federal Act and Regulation (EU) 2019/2033, shall use this information solely for the purposes explicitly stipulated by the FMA. (4) Where insolvency proceedings have been opened against an investment firm, or resolution in accordance with the Bank Recovery and Resolution Act (BaSAG; Sanierungs- und Abwicklungsgesetz), published in Federal Law Gazette I No. 98/2014, confidential information, which does not relate to third parties shall be allowed to be disclosed in proceedings under civil and commercial law, provided that such a disclosure is necessary for such proceedings. (5) The FMA shall be allowed to exchange confidential information with competent authorities from other Member States for the purposes listed in para. 2. The FMA may define how such information is to be handled and restrict the onward transmission of such information. (6) Irrespective of para. 1, the FMA shall be able to transmit confidential information to the European Commission, if such information is necessary for the exercising of the European Commission’s powers. (7) The FMA shall be allowed to provide EBA, ESMA, the ESRB, central banks of the Member States, the European System of Central Banks (ESCB) and the European Central Bank in their capacity as monetary authorities, and, where appropriate, public authorities responsible for overseeing payment and settlement systems, with confidential information where that information is necessary for the performance of their tasks. Cooperation agreements with third countries Article 9. Irrespective of the provisions in other Federal Acts, the FMA may, for the purpose of performing its supervisory duties for securities supervision pursuant to this Federal Act or Regulation (EU) 2019/2033 and for the purpose of exchanging information, conclude cooperation agreements with third-country supervisory authorities as well as with third-country authorities or bodies responsible for the following tasks, provided that the information disclosed is subject to guarantees of professional secrecy that are at least equivalent to those laid down in Article 9, and where personal data is affected, the rules set out in Chapter V of Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), OJ L 119, 04.05.2016, p. 1:

1. the supervision of financial institutions and financial markets, including the supervision of financial entities licensed to operate as central counterparties, where central counterparties have been recognised under Article 25 of Regulation (EU) No 648/2012;
2. the conducting of resolution, insolvency and similar proceedings in investment firms;
3. oversight of the bodies involved in the resolution and bankruptcy and similar procedures of investment firms;

Investment Firms Act 13 / 48 4. the carrying out of statutory audits of financial institutions or institutions which administer compensation schemes; 5. oversight of persons charged with carrying out statutory audits of the accounts of financial institutions; 6. oversight of persons active on emission allowance markets for the purpose of ensuring a consolidated overview of financial and spot markets; 7. oversight of persons active on agricultural commodity derivatives markets for the purpose of ensuring a consolidated overview of financial and spot markets. Duties of auditors Article 10. If, in the course of their auditing activities, the auditor identifies facts which:

1. give rise to a reporting obligation pursuant to Article 273 para. 2 UGB; or
2. may affect the continuous functioning of the investment firm; or
3. Significant breaches of this Federal Act, Regulation (EU) 2019/2033 or other legal and other types of regulations that are relevant for securities supervision, or which can be identified from FMA administrative decisions; or
4. may lead to a refusal to certify the accounts or lead to the expression of reservations; then the auditor shall report such facts to the FMA, irrespective of Article 273 para. 2 UGB, with explanatory remarks in writing without delay. Where the auditor identifies other deficiencies, changes in the risk situation or economic situation which are not a cause for concern, or identifies only minor breaches of provisions, and where such deficiencies and violations may be remedied quickly, then the auditor shall only be required to report to the FMA where the investment firm fails to remedy the deficiencies and to provide the auditor with evidence of such deficiencies being remedied within a reasonable period of time, at the latest, however, within three months. The reporting requirement shall also apply in the event that the members of the management board fail to provide information properly as requested by the auditor within a reasonable period of time. Notwithstanding the obligations pursuant to Article 273 para. 2 UGB, a report made in accordance with this paragraph must also be submitted to the senior management and the supervisory board of the investment firm at the same time as to the FMA. Powers to Obtain Information Article 11. It its scope of competence as the supervisory authority for securities supervision pursuant to Article 3, the FMA may at any time, irrespective of the powers confirmed upon it in other provisions set out under national law:
5. request information from investment firms as well as investment holding companies, mixed financial holding companies, and mixed-activity holding companies established in Austria, from persons belonging to the listed entities, from auditors of the listed entities, and from third parties, to whom the listed entities have outsourced operational functions or activities,

Investment Firms Act 14 / 48 to check books and records, to make copies and extracts of the books and records, to obtain written or oral explanations, and to question any other relevant person for the purpose of gathering information about the subject matter of an investigation; 2. conduct on-site inspections at the premises of the entities named in no. 1 and of other entities who are involved in the monitoring of compliance with the group capital test pursuant to Article 8 of Regulation (EU) 2019/2033, using its own inspectors, auditors or other experts as the consolidating supervisor and subject to having informed the other affected competent authorities in advance. Reporting of breaches Article 12. (1) The FMA shall create effective and reliable mechanisms so that potential or actual breaches against the provisions of this Federal Act or those of Regulation (EU) 2019/2033 are able to be reported without delay. Those mechanisms shall cover:

1. specific procedures for receiving, handling and following up of such reports, including the establishment of secure communication channels;
2. appropriate protection against retaliation, discrimination or other forms of unjustified treatment by the investment firm for staff members of investment firms that report breaches committed in the investment firm;
3. protection of personal data in accordance with Regulation (EU) 2016/679 concerning both the person reporting the breach and the natural person allegedly responsible for that breach;
4. clear rules that guarantee confidentiality in all instances in relation to the person who reports breaches committed in an investment firm, provided that no legal requirements in conjunction with further investigations or administrative or court proceedings preclude the passing on of the information. (2) Investment firms shall establish appropriate procedures by which their staff members may internally report breached through a special independent channel. (3) The procedures and mechanisms pursuant to Article 98 paras. 1 and 2 WAG 2018 may be applied for the purposes of paras. 1 and 2. Article 98 para. 4 WAG 2018 shall apply accordingly. SECTION 3: INITIAL CAPITAL, INTERNAL CAPITAL ADEQUACY ASSESSMENT PROCESS AND INTERNAL RISK ASSESSMENT PROCESS Initial capital Article 13. The initial capital of an investment firm shall cover the components listed in Article 9 of Regulation (EU) No 2019/2033 and shall be at least:
5. Euro 750,000 provided the corporate purpose covers

Investment Firms Act 15 / 48 a. trading for own account (Article 1 no. 3 lit. c WAG 2018), or b. underwriting the issuance of financial instruments and/or placing of financial instruments with a firm commitment basis (Article 1 no. 3 lit. f WAG 2018); 2. Euro 75,000 provided the corporate purpose comprises a. receiving and transmitting of orders, if such activities are in relation to one or more financial instruments (Article 1 no. 3 lit. a WAG 2018), or b. execution of orders on behalf of clients (Article 1 no. 3 lit. b WAG 2018), or c. portfolio management (Article 1 no. 3 lit. d WAG 2018), or d. investment advice (Article 1 no. 3 lit. e WAG 2018), or e. placing of financial instruments without a firm commitment basis; (Article 1 no. 3 lit. g WAG 2018) and the investment firm is not allowed to hold client deposits or financial instruments pursuant to Article 1 no. 7 WAG 2018; 3. EUR 150,000, provided that none of nos. 1, 2 or 4 occur; 4. EUR 750,000, provided that the business purpose covers the operating of an organised trading facility (Article 1 no. 3 lit. i WAG 2018) and the scope of the investment firm’s authorisation includes trading for one’s own account. Internal capital and liquid assets Article 14. (1) Investment firms which do not meet the conditions for qualifying as small and non￾interconnected investment firms pursuant to Article 12(1) of Regulation (EU) 2019/2033 shall have in place sound, effective and comprehensive arrangements, strategies and processes to be able to assess and maintain at an adequate level on an ongoing basis the amounts, types and distribution of internal capital and liquid assets that they consider adequate to cover the nature and level of risks which they pose or may pose to themselves and to others. (2) The arrangements, strategies and processes referred to in para. 1 must be internally reviewed on a regular basis and shall be appropriate and proportionate to the nature, scale and complexity of the activities of the investment firm concerned. (3) The FMA may request investment firms which meet the conditions for qualifying as small and non-interconnected investment firms set out in Article 12(1) of Regulation (EU) 2019/2033 to apply the requirements provided for in this Article to the extent that the competent authorities consider appropriate. The FMA may define more specific criteria by means of a Regulation, under which the requirements listed in para. 1 for small and non-interconnected investment firms pursuant to Article 12 (1) of Regulation (EU) 2019/2033 shall be determined with regard to the nature, scope, risk profile and complexity of their business as well as investor protection. In so doing it shall also take into account the respective activity requiring a licence of the investment firm.

Investment Firms Act 16 / 48 SECTION 4: INTERNAL GOVERNANCE, TRANSPARENCY, TREATMENT OF RISKS AND REMUNERATION Scope of application of Section 4 Article 15. (1) This section shall not apply to small and non-interconnected investment firms pursuant to Article 12 (1) of Regulation (EU) 2019/2033. (2) If an investment firm which has not previously met all of the conditions set out in Article 12(1) of Regulation (EU) 2019/2033 subsequently meets those conditions, this Section shall cease to apply after a period of six months from the date on which those conditions are met, provides that the investment firm meets the conditions set out in Article 12(1) of Regulation (EU) 2019/2033 without interruption during that period and has notified the FMA of this accordingly. (3) If an investment firm no longer meets all the conditions set out in Article 12(1) of Regulation (EU) 2019/2033, it shall notify the FMA and shall apply this Section within 12 months of the date on which that assessment took place. (4) Investment firms are required to apply the provisions on variable remuneration pursuant to Article 21 in the year following the financial year in which the assessment pursuant to para. 3 was conducted. (5) Where this section is required to be applied and the group capital test pursuant to Article 8 of Regulation (EU) 2019/2033 is applied, then the provisions in this section shall apply on an individual basis. (6) Where this section is required to be applied and prudential consolidation pursuant to Article 7 of Regulation (EU) 2019/2033 is applied, then the provisions in this section shall apply both on an individual basis as well as on a consolidated basis. (7) Dy way of derogation from para. 6 this section shall not apply to subsidiaries, that are included in supervision on a consolidated basis and that are domiciled in third countries, provided that the Austrian parent undertaking is able to prove to the FMA, that the application of this section would be unlawful according to the legal provisions in the third country. Internal governance Article 16. (1) Investment firms are required to have sound governance rules in place. These include:

1. a clear organisational structure with well-defined, transparent and consistent lines of responsibility;
2. effective processes to identify, manage, monitor and report the risks that investment firms are or might be exposed to, or the risks that they pose or might pose to others, including concentration risk arising from exposures towards central counterparties,taking into account the conditions set out in Article 7a of Regulation (EU) No 648/2012;
3. adequate internal control mechanisms, including sound administration and accounting procedures;

Investment Firms Act 17 / 48 4. gender neutral remuneration policies and practices that are consistent with and promote sound and effective risk management. (2) When establishing the arrangements referred to in para. 1, the criteria set out in Articles 18 to 23 shall be taken into account. (3) The arrangements referred to in para. 1 must be appropriate and proportionate to the nature, scale and complexity of the risks inherent in the business model and the activities of the investment firm. Country-by-country disclosure requirements Article 17. (1) Investment firms that have a branch or subsidiary that is a financial institution as defined in point (26) of Article 4(1) of Regulation (EU) No 575/2013 in another Member State or in a third country must disclose the following data and figures broken down by states of domicile for the financial year:

1. the name of the establishment, its business lines and the location of any subsidiaries and branches;
2. turnover;
3. the number of employees expressed in terms of full-time equivalents (FTEs);
4. annual result before taxes;
5. tax on profit or loss;
6. the public subsidies received; (2) The details listed in para. 1 must be included in the annex to the annual financial statement or as applicable the consolidated financial statements of the investment firm in question. Role of the senior management in risk management Article 18. (1) The members of the management board of the investment firm shall bear overall responsibility for the investment firm’s risk strategy and policies. They must determine and implement strategies and policies on the risk appetite of the investment firm, and on managing, monitoring and mitigating the risks the investment firm is exposed to, taking into account the macroeconomic environment and the business cycle of the investment firm, and to review these on a regular basis. (2) The members of the management board must devote sufficient time for performing the duties referred to in para. 1. They must allocate adequate resources for managing all material risks to which the investment firm is exposed. (3) Investment firms shall ensure through their reporting that the members of the management board are made aware of all material risks and for all risk management policies and any changes thereto.

Investment Firms Act 18 / 48 Role of the supervisory body or the otherwise competent supervisory body under law or statutes in risk management Article 19. (1) The supervisory body or the otherwise competent supervisory body under law or statutes of the investment firm shall identify the investment firm’s risk strategy and risk policies together with the members of the management board and is responsible for monitoring their implementation by the members of the management board. (2) Investment firms shall ensure through their reporting that the supervisory board or the otherwise competent supervisory body under law or statutes in risk management are made aware of all material risks and risk management policies and any changes thereto. (3) A risk committee shall be established in investment firms where on-balance sheet and off￾balance sheet assets in the four years immediately preceding the current financial were on average greater than EUR 100 million, which comprises of at least three members of the supervisory board or the otherwise competent supervisory body under law or statutes. (4) The members of the risk committee shall possess the appropriate knowledge, skills and expertise to fully understand, manage, and monitor the investment firm’s risk strategy and risk appetite. The risk committee shall advise the members of the management board about the investment firm’s current and future overall risk appetite and overall risk strategy and to support the supervisory board or the otherwise competent supervisory body under law or statutes, in the oversight of the implementation of this strategy by the members of the management board. (5) Investment firms shall ensure that the supervisory board or the otherwise competent supervisory body under law or statutes and the risk committee - where one has been established - have the necessary access to information about the risks that the investment is exposed or could be exposed to. Treatment of risks Article 20. (1) The FMA shall monitor that investment firms have robust strategies, policies, processes and systems in place for identifying, managing and monitoring the following risks:

1. material sources and effects of risk to clients and any material impact on own funds;
2. material sources and effects of risk to market and any material impact on own funds;
3. material sources and effects of risk to the investment firm, in particular those which can deplete the level of own funds available;
4. liquidity risk over an appropriate set of time horizons, including intra-day, to ensure that the investment firm maintains adequate levels of liquid resources, including in respect of addressing material sources of risks under nos. 1 to 3;
5. material sources and effects of concentration risk arising from exposures towards central counterparties and any material impact on own funds. (2) The strategies, policies, processes and systems shall be proportionate to the complexity, risk profile, and scope of operation of the investment firm and risk tolerance set by the senior

Investment Firms Act 19 / 48 management, and shall reflect the investment firm’s significance in every Member State in which it carries out business. (3) For the purposes of para. 1 no. 1 and para. 2, the FMA shall take into account the risk-mitigating impact of the segregation of client money held. (4) For the purposes of para. 1 no. 1, investment firms shall conclude professional indemnity insurance as an effective tool in their management of risks. (5) For the purposes of para. 1 no. 3 material sources of risk to the investment firm shall include, as applicable, material changes in the book value of assets, including any claims on tied agents, the failure of clients or counterparties, positions in financial instruments, foreign currencies and commodities, and obligations to defined benefit pension schemes. (6) Investment firms shall give due consideration to any material impact on own funds where such risks are not appropriately captured by the own funds requirements calculated under Article 11 of Regulation (EU) 2019/2033. (6a) the management body shall draw up specific plans and quantifiable objectives in line with the requirements determined in Article 7a of Regulation (EU) No 648/2012, to monitor and manage the concentration risk arising from risk exposures to central counterparties that provide services that are of substantial systemic importance for the European Union or for one or more of its Member States. (7) In the event of an investment firm needing to wind down or cease its activities, the FMA shall oblige an investment firm, taking into account the viability and sustainability of its business models and strategies, to give due consideration to requirements and necessary resources which are realistic, in terms of timescale and maintenance of own funds and liquid resources, that are expected throughout the process of exiting the market. (8) By way of derogation from Article 15 para. 1, para. 1 nos. 1, 3 and 4 shall apply to investment firms that fulfil the conditions for classification as small and non-interconnected investment firms pursuant to Article 12 (1) of Regulation (EU) 2019/2033. Remuneration policies Article 21. When establishing and applying the remuneration policies for categories of staff, including senior management, risk takers, staff engaged in control functions and any employees receiving overall remuneration equal to at least the lowest remuneration received by the senior management or risk takers, whose professional activities have a material impact on the risk profile of the investment firm or of the assets that it manages, investment firms shall apply the principles stated in the Annex to Article 21. Investment firms benefitting from extraordinary public financial support Article 22. For an investment firm that has been granted extraordinary public financial support pursuant to Article 2 no. 30 BaSAG, the following shall apply:

Investment Firms Act 20 / 48

1. the investment firm shall not be permitted to grant variable remuneration to the members of the management board and the members of the supervisory board;
2. where variable remuneration has been agreed to be paid to staff other than members of the management board and the members of the supervisory board that would be inconsistent with the maintenance of a sound capital base of an investment firm and its timely exit from extraordinary public financial support, then variable remuneration shall be limited to a portion of net revenue. Remuneration Committee Article 23. (1) A remuneration committee shall be established by the supervisory board or the competent supervisory body under law or statutes in investment firms where on-balance sheet and off-balance sheet assets in the four years immediately preceding the current financial were on average greater than EUR 100 million. The remuneration committee shall have as balanced as possible a composition of women and men and shall monitor and assess the remuneration policy and practices as well as the incentive structures created for managing risk, capital and liquidity in a competent and independent manner. The remuneration committee may be established at group level. The remuneration committee shall hold at least one meeting a year. (2) The duties of the remuneration committee include the preparation of resolutions about remuneration, including ones that have an impact on the risk and risk management of the investment firm in question, and which are to be passed by the supervisory board or other competent supervisory body or the competent supervisory body under law or statutes. The remuneration committee shall consist of at least three members of the supervisory board or the competent supervisory body under law or statutes, with at least one these persons possessing expert knowledge and practical experience in the area of remuneration policy (remuneration expert). In the event that pursuant to Article 110 of the Labour Constitution Act (ArbVG; Arbeitsverfassungsgesetz), published in Federal Law Gazette No. 22/1974, one or more employee representatives are required to participate in the credit institution’s supervisory board, at least one member of the group of employee representatives shall be a member of the remuneration committee. (3) When preparing the resolutions referred to in para. 2, the remuneration committee shall take into account the public interest and the long-term interests of shareholders, investors and other stakeholders in the investment firm. Oversight of remuneration policies Article 24. (1) The FMA shall collect the information disclosed in accordance with points (c) and (d) of Article 51 (1) of Regulation (EU) 2019/2033 as well as the information provided by investment firms on the gender pay gap and use that information to benchmark remuneration trends and practices. The FMA shall pass this information on to EBA.

Investment Firms Act 21 / 48 (2) Investment firms shall report to the FMA about the number of natural persons per investment firm that are remunerated EUR 1 million or more per financial year, split into pay brackets of EUR 1 million, including information on their job responsibilities, the business area involved and the main elements of salary, bonus, long-term award and pension contribution. (3) Investment firms shall provide the FMA, upon request, the total remuneration figures for each member of the supervisory board or the senior management. (4) The FMA shall pass the information stated in paras. 2 and 3 to EBA. SECTION 5: SUPERVISORY REVIEW AND EVALUATION PROCESS Supervisory review and evaluation Article 25. (1) The FMA shall review and evaluate the rules, strategies, procedures and mechanisms that the investment firm has introduced for compliance with this Federal Act and Regulation (EU) 2019/2033, taking into consideration the investment firm’s size, risk profile and business model. To guarantee the sound risk management and a solid coverage of risks, the FMA shall take into account the following aspects:

1. the risks referred to in Article 20;
2. the geographical distribution of the investment firm’s exposures;
3. the investment firm’s business model;
4. the assessment of systemic risk, taking into account the identification and measurement of systemic risk under Article 23 of Regulation (EU) No 1093/2010 or recommendations of the ESRB;
5. the risks posed to the security of the investment firm’s network and information systems to ensure confidentiality, integrity and availability of their processes, data and assets;
6. the exposure of the investment firm to the interest rate risk arising from non-trading book activities;
7. the investment firm’s governance arrangements and the ability of members of the supervisory board to perform their duties. (2) For the purposes of para. 1 the FMA shall take into account whether the investment firm has taken out professional indemnity insurance with the appropriate level of coverage. (2a) For the purposes of the risks listed in Article 20 the FMA shall review and monitor practical developments regarding the management of their concentration risk arising from risk exposures to central counterparties, including for plans drawn up pursuant to Article 20 as well as progress made in adapting investment firms’ business models to the requirements defined in Article 7a of Regulation (EU) No 648/2012. (3) Taking into consideration the size, nature, scale and complexity of the activities of the affected investment firm as well as its systemic importance, the FMA shall determine the frequency and

Investment Firms Act 22 / 48 intensity of the review and evaluation pursuant to para. 1, and in so doing shall take into account the principle of proportionality and as well as the rules and the scope of authorisation with regarding to client funds. (4) The FMA shall decide on a case-by-case basis whether and in which form the review and evaluation of an investment that meets the conditions listed in Article 12 (1) of Regulation (EU) 2019/2033 for classification as a small and non-interconnected investment firm is to be carried out, where this is deemed necessary due to the size, nature, scope and complexity of the activities as well as the activity requiring a licence of the investment firm in question. (5) The FMA may determine more specific criteria for the assessment of the necessary of a review and evaluation procedure pursuant to para. 4 by way of a Regulation, taking into consideration the nature, scope, risk profile and complexity of the investment firm’s business as well investor protection. In doing so, it shall also:

1. take into account the investment firm’s respective activity requiring a licence, and
2. take into account whether the investment firm has taken out professional indemnity insurance with the appropriate level of coverage. (6) When conducting the review and evaluation referred to in para.1 no. 7, the FMA shall be granted access to agendas, minutes and supporting documents for meetings of the supervisory board or the competent supervisory body under law or statutes and its committees, and the results of the internal or external evaluation of the performance of the senior management. Ongoing review of the permission to use internal models Article 26. (1) The FMA shall review on a regular basis, at least every three years, to what extent the investment firms comply with the requirements for being permitted to use internal models pursuant to Article 22 of Regulation (EU) 2019/2033. In doing so, the FMA shall especially taking into account changes in the investment firm’s business activities and the application of such internal models for new products and review and evaluate whether the investment firm applies expert and up-to-date techniques and procedures in such internal models. (2) Prior to the approval of internal models pursuant to Article 22 of Regulation (EU) 2019/2033 and prior to revoking such an approval, the FMA shall obtain an expert opinion from the Oesterreichische Nationalbank where market risk is affected. The Oesterreichische Nationalbank shall assess whether the rules to be applied with regard to market risk are duly observed. (3) The Oesterreichische Nationalbank shall submit such expert opinions pursuant to para. 2 on its own responsibility and on its own behalf. The FMA must as far as possible use the opinions of the Oesterreichische Nationalbank as a basis, and may rely on their accuracy and completeness, unless the FMA has reason to doubt their accuracy or completeness. The Oesterreichische Nationalbank shall submit opinions from the affected investment firm to the FMA without delay. (4) The Oesterreichische Nationalbank shall

Investment Firms Act 23 / 48

1. draw up a statement of the costs arising from the duties and activities arising from expert opinions pursuant to para. 2 during the relevant financial year and have this statement audited by the auditor pursuant to Article 37 of the National Bank Act of 1984 (NBG; Nationalbankgesetz 1984), published in Federal Law Gazette No. 50/1984;
2. convey the audited statement to the Federal Minister of Finance and the FMA by 30 April of the respective following financial year;
3. publish the audited statement following submission pursuant to no. 2 on its website;
4. notify the Federal Minister of Finance and the FMA by 30 September each year about the estimated costs arising from expert opinions pursuant to para. 2, as well as the estimated annual average number of employees occupied with expert opinions pursuant to para. 2, respectively for the following financial year, and
5. inform the Federal Minister of Finance and the FMA once a year about the annual average number of employees occupied with expert opinions pursuant to para. 5; such information may also be provided by means of a publication. (5) The FMA shall monitor that material deficiencies identified in the coverage of risk by an investment firm’s internal models are rectified, or take steps to mitigate their consequences, including by imposing capital add-ons or higher multiplication factors. (6) Where, for internal risk-to-market models, numerous overshootings as referred to in Article 366 of Regulation (EU) No 575/2013 indicate that the internal models are not accurate, the FMA shall revoke the approval to use the internal models or impose measures to ensure that the internal models are improved promptly within a set timeframe. (7) In the event that an investment firm that has been granted permission to use internal models no longer meets the requirements for using internal models, the FMA shall demand that:
6. a plan guaranteeing that the requirements are fulfilled again within a certain timeframe is submitted, or
7. proof is submitted that the impact of the non-observance of the requirements is immaterial. (8) Where the FMA concludes from the plan submitted pursuant to para. 7 no. 1 that it will not be possible to achieve full compliance with the requirements, or the timeframe is inadequate, the FMA shall demand that corrections are made to the plan. (9) Where the FMA concludes that it is unlikely that the investment firm will be able to comply by the prescribed deadline or has not satisfactorily demonstrated that the non-observance of the requirements is immaterial, the FMA shall revoke the permission to use internal models or limit such permission to compliant areas or to those areas where compliance is able to be achieved within an appropriate timeframe. (10) When performing the review and evaluation pursuant to para. 1, the FMA shall take the analysis across investment firms and the EBA Guidelines pursuant to Article 37 (4) of Directive (EU) 2019/2034 into account.

Investment Firms Act 24 / 48 SECTION 6: SUPERVISORY MEASURES AND POWERS Supervisory measures Article 27. (1) If an investment firm does not meet the requirements set out in this Federal Act or in Regulation (EU) 2019/2033, the FMA shall order the investment firm to take the necessary measures to do so within an appropriate timeframe. (2) If the FMA has evidence that an investment firm is likely to breach this Federal Act or Regulation (EU) 2019/2033 within the next twelve months, the FMA may take measures pursuant to para. 1. Supervisory powers Article 28. (1) The FMA may, where necessary intervene within the scope of their supervisory activity and in the exercise of their duties into the activities of investment firms in an effective and proportionate way. (2) For the purposes of Article 20, Article 25, Article 26 paras. 4 to 6 and Article 27, as well as the application of Regulation (EU) 2019/2033, the FMA shall have the power:

1. to require investment firms to have own funds in excess of the requirements set out in Article 11 of Regulation (EU) 2019/2033, under the conditions set forth in Article 29 of this Federal Act, or to adjust the own funds and liquid assets required in case of material changes in the business of those investment firms;
2. to require the reinforcement of the arrangements, processes, mechanisms and strategies implemented in accordance with Articles 14 and 16;
3. to require investment firms to present, within one year, a plan to restore compliance with supervisory requirements pursuant to this Federal Act and to Regulation (EU) 2019/2033, to set a deadline for the implementation of that plan and require improvements to that plan regarding it scope and deadline;
4. to require investment firms to apply a specific provisioning policy or treatment of assets in terms of own funds requirements;
5. to restrict or limit the business, operations or network of investment firms or to request the divestment of activities that pose excessive risks to the financial soundness of an investment firm;
6. to require the reduction of the risk inherent in the activities, products and systems of investment firms, including outsourced activities;
7. to require investment firms to limit variable remuneration as a percentage of net revenues where that remuneration is inconsistent with the maintenance of a sound capital base;
8. to require investment firms to use net profits to strengthen own funds;
9. to restrict or prohibit distributions or interest payments by an investment firm to shareholders, members or holders of Additional Tier 1 instruments where that restriction or prohibition does not constitute an event of default of the investment firm;

Investment Firms Act 25 / 48 10. to impose additional or more frequent reporting requirements to those set out in this Federal Act and Regulation (EU) 2019/2033, including reporting on capital and liquidity positions; 11. to impose additional liquidity requirements pursuant to Article 31; 12. require additional disclosures; 13. to require investment firms to reduce the risks posed to the security of investment firms’ network and information systems to ensure confidentiality, integrity and availability of their processes, data and assets; 14. to require investment firms to reduce their risk exposures towards a central counterparty or to reallocate exposures in relation to their clearing accounts pursuant to Article 7a of Regulation (EU) No 648/2012, where the FMA is of the opinion that a risk exists of an excessive exposure arising from risk exposures towards this central counterparty. (3) For the purposes of para. 2 no. 10, the FMA shall only be allowed to impose additional or more frequent reporting requirements on investment firms where the information to be reported is not duplicative and where one of the following conditions is met:

1. one of the cases referred to in Article 27 para. 1 or 2 applies;
2. the FMA deems it necessary to obtain evidence pursuant to Article 27 para. 2;
3. the additional information is required for the purpose of the supervisory review and evaluation process referred to in Article 25. (4) The information shall be considered as being duplicative, if the same, or materially similarly information is already held by the FMA or could be generated by the FMA itself or obtained in another manner that by requiring the investment firm to notify it. The FMA shall not be allowed to request additional information, if this information exists in another format or with a different degree of granularity than the additional information to be submitted, and the other format or different degree of granularity does not prevent it from generating by and large the same information. Additional own funds requirement Article 29. (1) The FMA shall only be allowed to impose the additional own funds requirement stated in Article 28 para. 2 no. 1 only where, on the basis of the reviews carried out in accordance with Articles 25 and 26, they ascertain that one of the following situations applies to an investment firm:
4. the investment firm is exposed to risks or elements of risks, or poses risks to others that are material and are not covered or not sufficiently covered by the own funds requirement, and especially K-factor requirements, set out in Part Three or Four of Regulation (EU) 2019/2033;
5. the investment firm does not meet the requirements set out in Articles 14 and 16 and other supervisory measures are unlikely to sufficiently improve the arrangements, processes, mechanisms and strategies within an appropriate timeframe;
6. the adjustments in relation to the prudent valuation of the trading book are insufficient to enable the investment firm to sell or hedge out its positions within a short period without incurring material losses under normal market conditions;

Investment Firms Act 26 / 48 4. the review carried out pursuant to Article 26 shows that non-compliance with the requirements for the application of the permitted internal models will likely lead to inadequate levels of capital; 5. the investment firm repeatedly fails to establish or maintain an adequate level of additional own funds as set out in Article 30. (2) For the purposes of para. 1 no. 1, risks or elements of risks shall be considered not to be covered or to be insufficiently covered by the own funds requirements set out in Parts Three and Four of Regulation (EU) 2019/2033 only where the amounts, types and distribution of capital considered adequate by the competent authority following the supervisory review of the assessment carried out by investment firms in accordance with Article 14 para. 1 of this Federal Act are higher than the investment firm’s own funds requirement set out in Parts Three or Four of Regulation (EU) 2019/2033. (3) For the purposes of para. 2, the capital considered to be adequate may include risks or elements of risks that are explicitly excluded from the own funds requirement set out in Parts Three or Four of Regulation (EU) 2019/2033. (4) The FMA shall determine the level of the additional own funds required pursuant to Article 28 para. 2 no. 1 as the difference between the capital considered adequate pursuant to Article 28 para. 2 and the own funds requirement set out in Parts Three or Four of Regulation (EU) 2019/2033. (5) The FMA shall instruct investment firms to meet the additional own funds requirement stated in Article 28 para. 2 no. 1 with own funds as follows:

1. at least three quarters of the additional own funds requirement shall be met with Tier 1 capital;
2. at least three quarters of the Tier 1 capital is composed of Common Equity Tier 1 capital;
3. those own funds are not used to meet any of the own funds requirements set out in points (a), (b) and (c) of Article 11(1) of Regulation (EU) 2019/2033. (6) The FMA shall state its decision to impose a specific liquidity requirement pursuant to Article 28 para. 2 no. 1 in writing, giving a clear account of the full assessment of the elements referred to in paragraphs 1 to 5 of this Article. In the case listed in para. 1 no. 4 this must also include a separate explanation, why the capital based determined pursuant to Article 30 para. 1 is no longer considered to be sufficient. (7) The FMA may prescribe an additional own funds requirement pursuant to paras. 1 to 6 to small and non-interconnected investment firms pursuant to Article 12 (1) of Regulation (EU) 2019/2033 based on an assessment of the case in hand and where it deemed doing so to be justified. Guidance on additional own funds Article 30. (1) Taking into account the principle of proportionality and commensurate with the size, systemic importance, nature, scale and complexity of activities of investment firms that do not meet the conditions for qualifying as small and non-interconnected investment firms set out in Article

Investment Firms Act 27 / 48 12(1) of Regulation (EU) 2019/2033, the FMA may require such investment firms to have levels of own funds pursuant to Article 14, they are sufficiently above the requirements set out in Part Three of Regulation (EU) 2019/2033 and in this Federal Act, to ensure that cyclical economic fluctuations do not lead to a breach of those requirements or threaten the ability of the investment firm to wind down and cease activities in an orderly manner. (2) The FMA shall, where appropriate, review the level of own funds that has been set by each investment firm that does not meet the conditions for qualifying as a small and non-interconnected investment firm set out in Article 12(1) of Regulation (EU) 2019/2033, in accordance with para. 1 and, where relevant, shall communicate the conclusions of that review to the investment firm concerned, including any expectation for adjustments to the level of own funds established in accordance with para. 1. Such a communication shall include the date by which the FMA requires the adjustment to be completed. Additional liquidity requirement Article 31. (1) The FMA shall only be allowed to prescribe the additional liquidity requirement pursuant to Article 28 para. 2 no. 11, if it comes to the conclusion based on reviews conducted pursuant to Articles 25 and 26 that an investment firm that is not classified as a small and non￾interconnected investment firm pursuant to Article 12 (1) of Regulation (EU) 2019/2033, or is classified as a small and non-interconnected investment firms pursuant to Article 12 (1) of Regulation (EU) 2019/2033, but which is not exempted from the liquidity requirement pursuant to Article 43 (1) of Regulation (EU) 2019/2033, is in one of the following situations:

1. the investment firm is exposed to liquidity risk or elements of liquidity risk that are material and are not covered or not sufficiently covered by the liquidity requirement set out in Part Five of Regulation (EU) 2019/2033;
2. the investment firm does not meet the requirements set out in Articles 14 and 16 and other administrative measures are unlikely to sufficiently improve the arrangements, processes, mechanisms and strategies within an appropriate timeframe; (2) For the purposes of para. 1 no. 1, liquidity risk or elements of liquidity risk shall be considered not to be covered or to be insufficiently covered by the liquidity requirement set out in Part Five of Regulation (EU) 2019/2033 only where the amounts and types of liquidity considered adequate by the FMA following the supervisory review of the assessment carried out by investment firms in accordance with Article 14 para. 1 are higher than the investment firm’s liquidity requirement set out in Part Five of Regulation (EU) 2019/2033. (3) The FMA shall determine the level of the additional liquidity required pursuant to Article 28 para. 2 no. 11 as the difference between the liquidity considered adequate pursuant to para. 2 and the liquidity requirement set out in Part Five of Regulation (EU) 2019/2033.

Investment Firms Act 28 / 48 (4) The FMA shall instruct investment firms to meet the additional liquidity requirement pursuant to Article 28 para. 2 no. 11 by means of liquid assets pursuant to Article 43 of Regulation (EU) 2019/2033. (5) The FMA shall state its decision to impose an additional liquidity requirement pursuant to Article 28 para. 2 no. 11 in writing, giving a clear account of the full assessment of the elements referred to in paragraphs 1 to 3 of this Article. Exemption of certain small and non-interconnected investment firms from liquidity requirements Article 32. Irrespective of its power to grant exemptions pursuant to Article 43 (2) subpara. 2 of Regulation (EU) 2019/2033 by means on an administrative decision on a case-by-case basis, the FMA, taking into action the European practices in this area, may exclude small and non-interconnected investment firms pursuant to Article 12 (1) of Regulation (EU) 2019/2033 with regard to the nature, scope, risk profile and complexity of their business as well as investor protection from the application of Article 43 (1) subpara. 2 of Regulation (EU) 2019/2033 by means of a Regulation. Cooperation with the resolution authority Article 33. The FMA shall inform the resolution authority about the additional own funds requirement pursuant to Article 28 para. 2 no. 1 for an investment firm that falls in the scope of application of the Banking Recovery and Resolution Act (BaSAG) as well as any potentially recommended corrections pursuant to Article 30 para. 2 in relation to such an investment firm. Publication requirements Article 34. (1) The FMA may

1. oblige investment firms that are not classified as small and non-interconnected investment firms pursuant to Article 12 (1) of Regulation (EU) 2019/203 and investment firms pursuant to Article 46 (2) of Regulation (EU) 2019/2033 to publish the information stated in Article 46 of Regulation (EU) 2019/2033 more frequently than annually, and may set deadlines for such publications;
2. oblige investment firms that are not classified as small and non-interconnected investment firms pursuant to Article 12 (1) of Regulation (EU) 2019/203 and investment firms pursuant to Article 46 (2) of Regulation (EU) 2019/2033 to use certain media, especially their websites, for the publication of other publications than their annual financial statement;
3. require parent undertakings to publish annually, either in full or by way of references to equivalent information, a description of their legal structure and governance and organisational structure of the investment firm group in accordance with Article 16 para. 1 (1) of this Federal Act and Article 13 WAG 2018.

Investment Firms Act 29 / 48 (2) Investment firms or parent undertakings shall submit the information pursuant to para. 1 to the FMA at the same time as publication for the purpose of making it accessible through the ESAP. The FMA is the ESAP collection body for such information. (3) Information pursuant to para. 1 shall met the following requirements:

1. The information shall be submitted in a data extractable format pursuant to Article 2 point 3 of Regulation (EU) 2023/2859 or, where prescribed under EU law in particular Implementing Technical Standards issued pursuant to Article 44a (5) of Directive (EU) 2019/2034, in a machine-readable format pursuant to Article 2 point 4 of Regulation (EU) 2023/2859 and:
2. shall contain the following metadata: a. all names of the investment firm or the parent undertaking to which the information relates, b. the investment firm or the parent undertaking’s legal entity identifier (LEI) pursuant to Article 7(4) point b of Regulation (EU) 2023/2859; c. the size category of the investment firm or the parent undertaking pursuant to Article 7(4) point d of Regulation (EU) 2023/2859; d. the type of information pursuant to the classification in Article 7(4) point c of Regulation (EU) 2023/2859, and e. a statement about whether the information contains personal data. (4) The FMA may determine, by means of a Regulation, a specific format in accordance with para. 3, additional meta data to be included and the submission modalities for the submission of data pursuant to para. 2, if this appears expedient taking into consideration rules under European Union law. The FMA shall be empowered as the controller under data protection law pursuant to Article 4 point 7 of the General Data Protection Regulation in conjunction with the tasks pursuant to para. 2 for processing personal data in accordance with the General Data Protection Regulation. (5) for the purposes of para. 3 no. 2 lit. b investment firms and mother undertakings are obliged to obtain a legal entity identifier. Obligation to inform EBA Article 35. The FMA shall inform EBA about
3. its review and evaluation process pursuant to Article 25;
4. the methodology used for issuing decisions pursuant to Articles 28 to 30; and
5. the scope of the administrative sanctions imposed pursuant to Article 49.

Investment Firms Act 30 / 48 SECTION 7: SUPERVISION OF INVESTMENT FIRM GROUPS Scope of application of the group capital test pursuant to Article 8 of Regulation (EU) 2019/2033 Article 36. (1) Where an application is made to apply the group capital test pursuant to Article 8 of Regulation (EU) 2019/2033, the conditions of a sufficiently simple group structure and the absence of significant risks to clients or the market stemming from the investment firm group as a whole shall be considered to be met, if the applicant is able to prove to the FMA that the following circumstances apply:

1. the group is founded solely on capital-based relationships between its members that exist on the basis of Common Equity Tier 1 instruments pursuant to Article 28 of Regulation (EU) No 575/2013;
2. the K-factors assets under management (AUM), client orders handled (COH), assets safeguarded and administered (ASA), client money held (CMH), net position risk (NPR) and clearing margin given (CMG) pursuant to Article 4 (1) points 27 to 30, 32 and 34 of Regulation (EU) 2019/2033 of all group members do not respectively amount to more than five times the threshold values pursuant to Article 12 (1) of Regulation (EU) 2019/2033;
3. no member of the group conducts trading for its own account (Article 1 no. 3 lit. c WAG 2018) or the underwriting of the issuance of financial instruments or placement of financial instruments with a firm commitment basis (Article 1 no. 3 lit. f WAG 2018) or is authorised pursuant to point a of Article 3 (1) of Directive 2014/65/EU to hold client funds or client securities. (2) The provisions in para. 1 nos. 2 and 3 relating to group members from EU Member States in Regulation (EU) 2019/2033 and Directive 2014/65/EU shall also apply for group members from third countries. Exemption from supervision on an individual basis pursuant to Article 6 of Regulation (EU) 2019/2033 Article 37. The FMA may exempt small and non-interconnected investment firms pursuant to Article 12 (1) of Regulation (EU) 2019/2033 from the application of Parts Two (own funds), Three (capital requirements), 4 (concentration risk), 6 (disclosure) and 7 (reporting) of Regulation (EU) 2019/2033 by means of a Regulation under the conditions set forth in Article 6 (1) or (2) of Regulation (EU) 2019/2033, when it is both the competent authority and the consolidating authority for the investment firms. The FMA’s competence as group supervisor Article 38. (1) The FMA shall perform supervision on a consolidated basis or shall monitor compliance with the group capital test in the case of groups of investment firms, if

Investment Firms Act 31 / 48

1. an EU parent investment firm incorporated in Austria heads the investment firm group;
2. an investment firm incorporated in Austria has an EU parent investment holding company or an EU parent mixed financial holding company as its parent undertaking;
3. two or more investment firms authorised in more than one Member State have the same EU parent investment holding company or the same EU parent mixed financial holding company and at least one of the investment firms and the EU parent investment holding company EU parent mixed financial holding company are incorporated in Austria;
4. two or more investment firms authorised in more than one Member State have more than one investment holding company or mixed financial holding company as parent undertaking incorporated in different Member States and where there is an investment firm in each of these Member States, and the investment firm with the highest total assets is incorporated in Austria;
5. two or more investment firms authorised in the European Union have the same EU parent investment holding company or EU parent mixed financial holding company as parent undertaking, and none of the investment firms are authorised in the Member State in which the investment holding company or the mixed financial holding company is registered, and the investment firm with the highest total assets in incorporated in Austria; or
6. consolidation pursuant to Article 18 (3) or (6) of Regulation (EU) No 575/2013 is necessary and the investment firms incorporated in Austria that belong to the group collectively have a higher level of total assets than investment firms that belong to the group that are authorised in another Member State have collectively. (2) The FMA may, by common agreement with the competent authorities of the other relevant Member States and taking into consideration the investment firms concerned and the significance of their activities in Austria and in the other relevant Member States, waive the criteria referred to in para. 1 nos. 3 to 5 and name another competent authority than the one named in para. 1 for conducting supervision on a consolidated basis or supervision of compliance with the group capital test, provided that the application of such criteria would not be appropriate for the effective supervision on a consolidated basis or the supervision of compliance with the group capital test. In those cases, competent authorities shall, before adopting any such decision, give the EU parent investment holding company or the EU parent mixed financial holding company or investment firm with the largest balance sheet total an opportunity to state its opinion on that intended decision. The FMA and the competent authorities of the other relevant Member States shall notify the European Commission and EBA of any such decision. Information requirements in emergency situations Article 39. Where an emergency situation arises, including a situation as pursuant to Article 18 of Regulation (EU) No 1093/2010 or adverse developments in markets, which could potentially threaten the market liquidity and the stability of the financial system in any of the Member States in

Investment Firms Act 32 / 48 which entities of a group of investment firms have been authorised, then the FMA, provided it is the competent authority for group supervision pursuant to Article 38 shall inform EBA and ESRB without delay, and shall communicate all information essential for the performance of their tasks. Colleges of supervisors Article 40. (1) The FMA may, provided it is competent for group supervision pursuant to Article 38 establish colleges of supervisors to facilitate the exercise of the tasks referred to in para. 2 and to ensure coordination and cooperation with relevant third-country supervisory authorities, in particular where this is needed for the purpose of applying point (c) of Article 23(1) and Article 23(2) of Regulation (EU) 2019/2033 to exchange and update relevant information on the margin model with the supervisory authorities of the qualifying central counterparties (QCCPs). (2) Colleges of supervisors shall decide upon a framework, within which the FMA as the group supervisor, EBA and the other competent authorities shall carry out the following tasks within the scope of their respective competences:

1. the exercising of information requirements in emergency situations pursuant to Article 39;
2. the coordination of information requests where this is necessary for facilitating supervision on a consolidated basis, in accordance with Article 7 of Regulation (EU) 2019/2033;
3. the coordination of information requests, in cases where several competent authorities of investment firms that are part of the same group need to request either from the competent authority of a clearing member’s home Member State or from the competent authority of the QCCP information relating to the margin model and parameters used for the calculation of the margin requirement of the relevant investment firms;
4. the exchange of information between all competent authorities and with EBA in accordance with Article 21 of Regulation (EU) No 1093/2010 and with ESMA in accordance with Article 21 of Regulation (EU) No 1095/2010;
5. reaching an agreement on the voluntary delegation between competent authorities of tasks and responsibilities, where appropriate;
6. increasing the efficiency of supervision by seeking to avoid the unnecessary duplication of supervisory requirements. (3) Colleges of supervisors may also be established where subsidiaries of an investment firm group headed by an EU investment firm, EU parent investment holding company or EU parent mixed financial holding company are located in a third country. (4) EBA may, in accordance with Article 21 of Regulation (EU) No 1093/2010, participate in the meetings of the colleges of supervisors. (5) The following shall be members of the colleges of supervisors:
7. the competent authorities responsible for the supervision of subsidiaries of an investment firm group headed by an EU investment firm, EU parent investment holding company or EU parent mixed financial holding company;

Investment Firms Act 33 / 48 2. as applicable third country supervisory authorities taking into consideration confidentiality provisions pursuant to Article 15 of Directive (EU) 2019/2034. (6) The FMA shall chair meetings and take decisions at colleges of supervisors established pursuant to para. 1. It shall inform the members of the supervisory college in an ongoing and comprehensive manner

1. in advance about the organisation of the meetings, the material agenda points and the activities to be considered; and
2. about the decisions taken at the meetings or the measures executed. (7) It is decisions the FMA shall take into account the relevant of the supervisory activity to be planned or coordinated by the authorities listed in para. 5. The FMA shall determine the modalities for the establishment and working of the colleges of supervisors in writing in agreement with the authorities listed in para. 5. FMA cooperation with other competent authorities Article 41. (1) Provided that it is competent for group supervision pursuant to Article 38, the FMA shall pass on all information that is relevant for the performance of their duties to the authorities listed in Article 40 para. 5, including:
3. details about the investment firm group’s legal and governance structure, including its organisational structure, covering all supervised entities and non-supervised entities, non￾supervised subsidiaries and the parent undertakings, and of the competent authorities of the supervised entities in the investment firm group;
4. details about the procedures for the collection of information from the investment firms in an investment firm group, and the procedures for the verification of that information;
5. details about any adverse developments in investment firms or in other entities of an investment firm group, which could seriously affect those investment firms;
6. Details about all significant sanctions or extraordinary measures imposed or taken by the FMA in accordance with this Federal Act or by other competent authorities in accordance with the national regulations transposing Directive (EU) 2019/2034;
7. details about specific own funds requirements imposed pursuant to Article 28. (2) Where a competent authority in another Member State rejects a request for cooperation from the FMA, especially for exchanging relevant information pursuant to para. 1, or where such relevant information was not notified without delay, or when the request fails to elicit a reaction within an appropriate timeframe, the FMA may ask EBA for assistance pursuant to Article 19 (1) of Regulation (EU) No 1093/2010. (3) Prior to adopting a decision that may be important for other competent authorities’ supervisory tasks, the FMA shall consult the competent authorities listed in Article 40 para. 5 about the following points:

Investment Firms Act 34 / 48

1. changes in the shareholder, organisational or management structure of investment firms in a investment firm group, which require the approval or authorisation by the relevant competent authorities;
2. significant sanctions imposed on investment firms by the relevant competent authorities or any exceptional measures taken by those authorities; and
3. addition own funds requirements pursuant to Article 28 or in nationally issued regulations transposing Article 39 of Directive (EU) 2019/2034 in another Member State. (4) Before imposing significant sanctions or taking exceptional measures pursuant to para. 3 no. 2, the FMA consult the group supervisor pursuant to Article 46 of Directive (EU) 2019/2034. (5) By way of derogation from para. 3, the FMA is not obliged to consult other competent authorities in cases of urgency or where such consultation could jeopardise the effectiveness of its decision, in which case the competent authority shall inform the relevant competent authorities of that decision not to consult without delay. Verification of information concerning entities in other Member States Article 42. (1) At the request of a competent authority in another Member State the FMA shall verify information about investment firms, investment holding companies, mixed financial holding companies, financial institutions, ancillary services undertakings, mixed-activity holding companies or subsidiaries pursuant to para. 2. (2) If the FMA receives a request pursuant to para. 1, it shall:
4. carry out the verification itself,
5. carry out the verification itself, also involving the competent authority that made the request, or
6. request an auditor or expert to carry out the verification and the subsequent reporting to the FMA. (3) For the purposes of para. 2 nos. 1 or 3, the competent authority that made the request shall be allowed to participate in the verification. Inclusion of holding companies in supervision of compliance with the group capital test Article 43. The FMA shall include investment holding companies and mixed financial holding companies in the monitoring of compliance with the group capital test. Suitability of members of the management board and the members of the supervisory board of a holding company Article 44. (1) Members of the management board and members of the supervisory board of an investment holding company or mixed financial holding company must be of good repute and possess sufficient knowledge, skills and experience to effectively perform their duties, taking into

Investment Firms Act 35 / 48 account the specific role of an investment holding company or mixed financial holding company. They must dedicate sufficient time to the performance of their duties. (2) The FMA may demand the removal of the persons named in para. 1 and prohibit them for performing their activity, if

1. they do not fulfil the requirements for the activity pursuant to para. 1, or
2. they have deliberately or negligently breached this Federal Act, Regulation (EU) 2019/2033, or instructions issued by the FMA, and have continued such conduct despite an admonishment by the FMA. Mixed-activity holding companies Article 45. (1) If the parent undertaking of an investment firm is a mixed-activity holding company, the FMA, as the competent authority for the investment firm, may
3. request any information that may be relevant for the supervision of that investment firm from the mixed-activity holding company;
4. supervise transactions between the investment firm and the mixed-activity holding company and the latter’s subsidiaries, and require the investment firm to have in place adequate risk management processes and internal control mechanisms, including sound reporting and accounting procedures to identify, measure, monitor and control those transactions. (2) The FMA may verify information received from the mixed-activity holding company and its subsidiaries by means of on-site inspections, or have it verified by external inspectors. Assessment of third-country supervision and other supervisory techniques Article 46. (1) Where one or more investment firms that are subsidiaries of the same parent undertaking that has its head office in a third country, is not subject to effective supervision at group level, the FMA shall assesses whether the investment firm are subject to supervision by the third￾country supervisory authority which is equivalent to the supervision set out in Directive (EU) 2019/2034 and in Part One of Regulation (EU) 2019/2033. (2) The FMA shall apply appropriate supervisory techniques for achieving the aims of supervision pursuant to Article 7 or 8 of Regulation (EU) 2019/2033, where the supervision by the competent third country authority is not equivalent. The FMA is the competent authority if it would have been the competent authority for group supervision, it the parent undertaking’s head office had been in the European Union. The FMA shall inform the other competent authorities, EBA and the European Commission about all measures taken in accordance with this paragraph. (3) If the FMA is the competent authority under para. 2, it may, in particular, require the establishment of an investment holding company or mixed financial holding company in the European Union and apply Article 7 or 8 of Regulation (EU) 2019/2033 to that investment holding company or mixed financial holding company.

Investment Firms Act 36 / 48 SECTION 8: REPORTING BY INVESTMENT FIRMS AND DISCLOSURE OBLIGATIONS OF THE FMA Reporting by investment firms Article 47. (1) Irrespective of the reporting obligations pursuant to Articles 54 and 55 of Regulation (EU) 2019/2033 investment firms must submit reports in accordance with the Regulation issued pursuant to para. 3 without delay following the end of each calendar quarter. (2) By way of derogation from para. 1, small and non-interconnected investment firms pursuant to Article 12 of Regulation (EU) 2019/2033 must submit an annual report. (3) The FMA shall determine reporting dates, specific formats, the type of submission and the content of the reports and reporting frequencies pursuant to paras. 1 and 2 by means of a Regulation, and in so doing take into account the Europe-wide harmonised reporting contents, intervals and cut-off points set forth in the Regulatory Technical Standards pursuant to Regulation (EU) 2019/2033 and their scope of application into account. Disclosure of Investment Strategy Article 47a. (1) Investment firms that fail to be meet the criteria listed in no. 23 lit. b of the Annex to Article 21 shall be required, pursuant to Article 46 of Regulation (EU) 2019/2033 to disclose

1. the proportion of voting rights attached to the shares held directly or indirectly by the investment firm, broken down by Member State and sector;
2. a complete description of voting behaviour in the general meetings of companies the shares of which are held in accordance with paragraph 2, an explanation of the votes, and the ratio of proposals put forward by the administrative or management body of the company which the investment firm has approved;
3. an explanation of the use of proxy advisor firms; and
4. the voting guidelines regarding the companies the shares of which are held in accordance with para. 3. (2) The disclosure requirement referred to in para. 1 no. 2 shall not apply if the contractual arrangements of all shareholders represented by the investment firm at the shareholders’ meeting do not authorise the investment firm to vote on their behalf unless express voting orders are given by the shareholders after receiving the meeting’s agenda. (3) Investment firms that fail to meet the criteria listed in no. 23 lit. b of the Annex to Article 21, shall only apply para. 1 in respect of each company whose shares are admitted to trading on a regulated market and only in respect of those shares to which voting rights are attached, where the proportion of voting rights that the investment firm directly or indirectly holds exceeds the threshold of 5 % of all voting rights attached to the shares issued by the company. Voting rights shall be calculated on the basis of all shares to which voting rights are attached, even if the exercise of those voting rights is suspended.

Investment Firms Act 37 / 48 Disclosure obligations of the FMA Article 48. (1) The FMA shall publish the following details on its web presence:

1. the wording of this Federal Act as well as all Regulations and general recommendations, that were made in accordance with this Federal Act;
2. the manner of exercising the options and discretions available pursuant to Directive (EU) 2019/2034 and to Regulation (EU) 2019/2033;
3. the general criteria and methodologies that it uses in the supervisory review and evaluation referred to in Article 25;
4. aggregate statistical data on key aspects of the application of this Federal Act and of Regulation (EU) 2019/2033, including details about the quantity and nature of supervisory measures taken in accordance with Article 28 para. 2 no. 1 and administrative sanctions imposed in accordance with Article 49. (2) The details published pursuant to para. 1 must be comprehensive and accurate enough to permit a meaningful comparison with the rules in other Member States. (3) The disclosures shall be published following a common format and updated regularly. They must be accessible using a single web address. SECTION 9: PENAL PROVISIONS, PUBLICATION OF MEASURES AND SANCTIONS, REPORTING TO EBA Penal provisions Article 49. (1) Any person who, as the person responsible (Article 9 Administrative Penal Act (VStG; Verwaltungsstrafgesetz 1991), published in Federal Law Gazette No. 52/1991) of a legal entity:
5. fails to have in place internal governance arrangements as set out in Article 16;
6. fails to report information or provides incomplete or inaccurate information on compliance with the obligation to meet own funds requirements set out in Article 11 of Regulation (EU) 2019/2033 to the FMA, thereby breaching point (b) of Article 54(1) of Regulation (EU) 2019/2033;
7. fails to report information about concentration risk or provides incomplete or inaccurate information to the FMA, thereby breaching Article 54 of Regulation (EU) 2019/2033;
8. incurs a concentration risk in excess of the limits set out in Article 37 of Regulation (EU) 2019/2033, without prejudice to Articles 38 and 39 of Regulation (EU) 2019/2033;
9. repeatedly or continually fails to hold sufficient liquid assets, thereby breaching Article 43 of Regulation (EU) 2019/2033, without prejudice to Article 44 of Regulation (EU) 2019/2033;
10. fails to disclose information, or provides incomplete or inaccurate information, thereby breaching the provisions set out in Part Six (Disclosure by Investment Firms) of Regulation (EU) 2019/2033;

Investment Firms Act 38 / 48 7. makes payments to holders of instruments included in the own funds of the investment firm where Article 28, 52 or 63 of Regulation (EU) No 575/2013 prohibit such payments to holders of instruments included in own funds; 8. permits one or more persons, who fail to observe the regulations set forth in Article 5 para. 1 no. 9a BWG, Article 28a paras. 5 or 6 BWG or a provision in another Member State, which transposes Article 91 of Directive 2013/36/EU, to become or remain members of the management body; 9. fails to provide the information listed in Article 34 para. 1 to the FMA as obliged to pursuant to Article 34 para. 2, 3 or 4; 10. fails to observe the obligation to obtain a legal entity identifier (LEI) pursuant to Article 34 para. 5; commits an administrative offence and shall be punished by the FMA pursuant to para. 4 no. 2 by means of a fine. (2) The FMA may impose fines against legal persons, if natural persons who acted individually or as part of a body of a legal person and who have a managerial role within the legal person on the basis of:

1. a power of representation of the legal person,
2. a power to take decisions on behalf of the legal person, or
3. a power to exercise control within the legal person have breached the obligations listed in para. 1. (3) Legal persons may also be held responsible for breaches of the obligations listed in para. 1, if such breaches by a natural person acting for the legal person were made possible by a lack of supervision or control by one of the persons referred to in para. 2. (4) Administrative offences pursuant to paras. 1 to 3 are to be punished as follows:
4. in the case of a legal person with a fine of: a. up to 10 % of the total annual net turnover, including the gross income consisting of interest receivable and similar income, income from shares and other variable or fixed￾yield securities, and commissions or fees of the undertaking in the preceding business year, or b. up to twice the amount of the benefit derived from the breach where that benefit can be determined;
5. in the case of a natural person with a fine of up to EUR 5 million. (5) Where an undertaking referred to in para. 4 no. 1 lit. a is a subsidiary, “gross income” shall be the gross income resulting from the consolidated financial statement of the ultimate parent undertaking in the preceding business year. (6) Anyone acting as a person responsible (pursuant to Article 9 VStG) of a legal entity who breaches this Federal Act or Regulation (EU) 2019/2033 in another way than listed in Article 1, commits an administrative offence, and shall be fined up to EUR 60 000 by the FMA.

Investment Firms Act 39 / 48 (7) When determining administrative penalties or other administrative measures and when calculating the amount of a fine, as appropriate, the FMA shall take the following circumstances into account:

1. the severity and duration of the breach;
2. the level of responsibility of the natural or legal person responsible;
3. the financial strength of the responsible natural or legal person as may be deduced, for example, from the total turnover of the responsible legal person or the annual income of the responsible natural person;
4. the amount of the gains made or losses avoided by the responsible natural or legal person, provided that these amounts can be determined;
5. the losses sustained by third parties as result of the breach, provided that these amounts can be determined;
6. the willingness of the responsible natural or legal person to cooperate with the FMA;
7. previous breaches by the responsible natural or legal person;
8. any potentially systemically-relevant effects arising from the breach. (8) In accordance with paras. 1 to 6, Article 3 para. 4, Article 12, Article 13, Article 50 and Article 51, the FMA may impose administrative penalties and other administrative measures for ending the determined breaches, to mitigate their effects, or to remove their causes, against investment holding companies, mixed financial holding companies and mixed-activity holding companies or their responsible members of the management board that have breached the listed provisions. (9) Fines imposed by the FMA pursuant to this Federal Act shall be passed on to the Federal Government. Publication of measures and sanctions Article 50. (1) Measures pursuant to Article 3 para. 4 or administrative penalties imposed pursuant to Article 49 shall be published by the FMA on the FMA’s official website without delay following their becoming legally final including the identity of the person in question and information about the nature and character of the breach, after the person in question has been informed about the administrative penalty and provided such a publication is both necessary and proportionate. Article 22c para. 1 FMABG shall apply accordingly. (2) The FMA shall be required to amend such announcements to include any appeal being made as well as any further information about the outcome of the appeal procedure. Moreover, the FMA shall also append the announcement to include any decision, with which a measure or sanction as defined in para. 1 contested by means of the legal right of appeal, is repealed. (3) Publications pursuant to paras. 1 and 2 shall be carried out in an anonymised form, if the disclosure of names:
9. of a natural or legal person being sanctioned would be disproportionate, or
10. would jeopardise the conducting of ongoing criminal law investigations, or

Investment Firms Act 40 / 48 3. would cause disproportionate damage to be inflicted on the investment firms or natural persons involved. (4) Where grounds exist for anonymous publication pursuant to para. 3 nos. 1 to 3, but where it may be assumed that such grounds will cease to exist in the foreseeable future, the FMA may refrain from an anonymous disclosure, and may also announce the sanction pursuant to para. 1 once the grounds pursuant to para. 3 nos. 1 to 3 have ceased to apply. (5) The FMA may desist completely from publication, where such a publication pursuant to para. 4 is not sufficient to avert hazards for the stability of the financial markets of an individual Member State or multiple Member States of the European Union of where in light of the immateriality of the breach proportionality may only be maintained by desisting from publication. (6) The party affected by a publication pursuant to para. 1 may file a request to the FMA for verification of the lawfulness of such a publication in a procedure concluded by means of an administrative decision. In this case, the FMA shall announce the initiation of such proceedings in the same way as the original publication. If, in the course of this review, it is found that the publication was unlawful, then the FMA shall correct the publication or, at the request of the person subject to this publication, either revoke it or remove it from its website. (7) If an appeal or final right of appeal is raised against an administrative decision that was published pursuant to para. 1 or 2, which is afforded suspensory effect in proceedings conducted in front of Federal Administrative Court (BVwG; Bundesverwaltungsgericht) or civil law courts, then the FMA shall publish this in the same manner. (8) The FMA shall monitor that the information published in accordance with this provision remains accessible on its website for at least five years. Personal data may only remain published on the FMA’s website in accordance with the applicable data protection rules, and in the case of a decision where a measure or administrative penalty pursuant to para. 1 is contested under the legal right of appeal and repealed, must be anonymised. (9) The FMA shall be the ESAP collection body for information pursuant to paras. 1, 2 and 7 and shall make this information available in the ESAP. (10) For the purposes of para. 9, the information pursuant to paras. 1, 2 and 7 shall be required to meet the following requirements:

1. it is to be submitted in a data extractable format pursuant to Article 2 point 3 of Regulation (EU) 2023/2859, and
2. shall contain the following metadata: a. all names of the investment firm to which the information relates, b. where available the investment firm’s legal entity identifier (LEI) pursuant to Article 7(4) point b of Regulation (EU) 2023/2859, c. the type of information pursuant to the classification in Article 7(4) point c of Regulation (EU) 2023/2859, and d. a statement about whether the information contains personal data.

Investment Firms Act 41 / 48 (11) The FMA may determine, by means of a Regulation, a specific format in accordance with para. 10, additional meta data to be included and the submission modalities for the submission of data pursuant to para. 9, if this appears expedient taking into consideration rules under European Union law. The FMA shall be empowered as the controller under data protection law pursuant to Article 4 point 7 of the General Data Protection Regulation in conjunction with the tasks pursuant to para. 9 for processing personal data in accordance with the General Data Protection Regulation. Reporting to EBA Article 51. The FMA shall inform EBA about all measures pursuant to Article 3 para. 4 or administrative penalties imposed pursuant to Article 49 as well as any appeals lodged against such measures and sanctions as well as their outcome. SECTION 10: TRANSITIONAL AND FINAL PROVISIONS Transitional provisions Article 52. The following transitional provisions shall apply following the entry into force of the amendment of this Federal Act published in Federal Law Gazette I No. 237/2022:

1. (Regarding Article 32) Until the Regulation pursuant to Article 32 is enacted, the liquidity requirement pursuant to Article 43 of Regulation (EU) 2019/2033 shall not apply to small and non-interconnected investment firms pursuant to Article 12 (1) of Regulation (EU) 2019/2033 during the first half year following the entry into force of the Federal Act published in Federal Law Gazette I No. 237/2022.
2. (Regarding Article 47) By way of derogation from the reporting deadlines set on the basis of point b of Article 54 (3) of Regulation (EU) 2019/2033 and Article 47 para. 3 of this Federal Act, investment firms shall submit reporting pursuant to Article 47 and Articles 54 and 55 of Regulation (EU) 2019/2033 that relate to reporting periods between the entry into force of Regulation (EU) 2019/2033 and of the Federal Act published in Federal Law Gazette I No. 237/2022, within one month, although the deadline in the case of reporting pursuant to Article 47 shall only start to run with the entry into force of the Regulation enacted on the basis of Article 47 para. 3, and in the case of reporting pursuant to Articles 54 and 55 of Regulation (EU) 2019/2033 with the entry into force of the Federal Act published in Federal Law Gazette I No. 237/2022. References and Regulations Article 53. (1) Where this Federal Act refers to other Federal Acts, then unless instructed otherwise, those Federal Acts shall be applied in their respective current versions. (2) Where references to the following legal acts of the European Union are made in this federal act, those acts shall be applicable, unless instructed otherwise, in the following version:

Investment Firms Act 42 / 48

1. Directive (EU) 2019/2034 on the prudential supervision of investment firms and amending Directives 2002/87/EC, 2009/65/EC, 2011/61/EU, 2013/36/EU, 2014/59/EU and 2014/65/EU, OJ L 314, 05.12.2019, p. 64, as amended by the corrigendum, OJ L 214, 17.06.2021, p. 74;
2. Regulation (EU) 2019/2033 on prudential requirements for investment firms and amending Regulations (EU) No 1093/2010, (EU) No 575/2013, (EU) No 600/2014 and (EU) No. 806/2014, OJ L 314, 05.12.2019, p. 1, in the version of the corrigendum in OJ L 261, 22.07.2021, p. 60.
3. Directive 2013/36/EU on access to the activity of credit institutions and the prudential supervision of credit institutions, amending Directive 2002/87/EC and repealing Directives 2006/48/EC and 2006/49/EC, OJ L 176, 27.06.2013, p. 338, in the version of Directive (EU) 2021/338, OJ L 68, 26.02.2021, p. 14 and the corrigendum in OJ L 214, 17.06.2021, p. 74;
4. Regulation (EU) No 575/2013 on prudential requirements for credit institutions and investment firms and amending Regulation (EU) No 648/2012, OJ L 176, 27.06.2013, p. 1, in the version of Implementing Regulation (EU) No 2021/1043, OJ L 225, 25.06.2021, p. 52, in the version of the corrigendum in OJ L 398, 11.11.2021, p. 32;
5. Directive 2014/65/EU on markets in financial instruments and amending Directive 2002/92/EC and Directive 2011/61/EU, O L 173, 12.06.2014, p. 349, in the version amended by Directive (EU) 2021/338, OJ L 68, 26.02.2021, p. 14;
6. Regulation (EU) No 600/2014 on markets in financial instruments and amending Regulation (EU) No 648/2012, OJ L 173, 12.06.2014, p. 84, in the version amended by Regulation (EU) No 2022/858, OJ L 151, 02.06.2022, p. 1;
7. Regulation (EU) No 1092/2010 on European Union macro-prudential oversight of the financial system and establishing a European Systemic Risk Board, OJ L 331, 15.12.2010, p. 1, most recently amended by Regulation (EU) 2019/2176, OJ L 334, 27.12.2019, p. 146;
8. Regulation (EU) No 1093/2010 establishing a European Supervisory Authority (European Banking Authority), amending Decision No 716/2009/EC and repealing Decision 2009/78/EC, OJ L 331, 15.12.2010, p. 12, in the version of Regulation (EU) 2019/2175, OJ L 334, 27.12.2019, p. 1;
9. Regulation (EU) No 1095/2010 establishing a European Supervisory Authority (European Securities and Markets Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/77/EC, OJ L 331, 15.12.2010, p. 84, in the version of Regulation (EU) No 2021/23, OJ L 22, 22.01.2021, p. 1;
10. Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), OJ L 119, 04.05.2016, p. 1, in the version of the corrigendum OJ L 74, 04.03.2021, p. 35;
11. Regulation (EU) No 648/2012 on OTC derivatives, central counterparties and trade repositories, OJ L 201, 27.07.2012, p. 1, most recently amended by Regulation (EU) 2024/2987, OJ L 2024/2987, 04.12.2024;

Investment Firms Act 43 / 48 12. Regulation (EU) 2023/2859 establishing a European single access point providing centralised access to publicly available information of relevance to financial services, capital markets and sustainability, OJ L 2023/2859, 20.12.2023, in the version of the Directive (EU) 2024/1760, OJ L 2024/1760, 05.07.2024; 13. Directive (EU) 2023/2864 amending certain directives as regards the establishment and functioning of the European single access point, OJ L 2023/2864, 20.12.2023, in the version of the corrigendum published in OJ L 2024/90411, 15.07.2024. (3) Any regulation based on this Federal Act as amended may be issued from the day following publication of the federal act to be implemented; however, they may not take effect before the statutory provisions to be implemented have themselves taken effect. Transposition Note Article 54. (1) Federal Law Gazette I No. 237/2022 transposes Directive (EU) 2019/2034 on the prudential supervision of investment firms and amending Directives 2002/87/EC, 2009/65/EC, 2011/61/EU, 2013/36/EU, 2014/59/EU and 2014/65/EU, OJ L 314, 05.12.2019, p. 64, as amended by the corrigendum, OJ L 214, 17.06.2021, p. 74. (2) This Federal Act services to implement Regulation (EU) 2019/2033 on prudential requirements for investment firms and amending Regulations (EU) No 1093/2010, (EU) No 575/2013, (EU) No 600/2014 and (EU) No. 806/2014, OJ L 314, 05.12.2019, p. 1, in the version of the corrigendum in OJ L 261, 22.07.2021, p. 60. (3) The Federal Act published in Federal Law Gazette I No. 49/2025 transposes Directive (EU) 2024/2994 amending Directives 2009/65/EC, 2013/36/EU and (EU) 2019/2034 as regards the treatment of concentration risk arising from exposures towards central counterparties and of counterparty risk in centrally cleared derivative transactions, OJ L 2024/2994, 04.12.2024. (4) The Federal Act published in Federal Law Gazette I No. 5/2026 serves to transpose Directive (EU) 2023/2864 and the effective enforcement of Regulation (EU) 2023/2859. Enforcement Article 55. The Federal Minister of Finance shall be responsible for enforcing this Federal Act. Entry into force Article 56. (1) This Federal Act shall enter into force on 01.02.2023. (2) Article 2 nos. 35, 36 and 37, Article 16 para. 1 no. 2, Article 20 para. 1 nos. 4 and 5, Article 20 para. 6a, Article 25 para. 2a, the introductory part of Article 28 para. 2, Article 28 para. 2 nos. 13 and 14, Article 53 para. 2 no. 11 as well as Article 54 para. 3 in the version amended by Federal Act in Federal Law Gazette I No. 49/2025 shall enter into force on 25 June 2026. (3) Article 2 nos. 37 to 39, Article 3 paras. 5 and 6, Article 34, Article 50 paras. 9 to 11, Article 53 para. 2 nos. 11 to 13 and Article 54 para. 4 in the version of the Federal Act published in Federal Law Gazette

Investment Firms Act 44 / 48 I No. 5/2026 shall enter into force on the following day after publication. Article 3 paras. 5 and 6, Article 34, Article 50 paras. 9 to 11 in the version of the Federal Act published in Federal Law Gazette I No. 5/2026 shall apply from 10 January 2030. The FMA shall notify ESMA by 9 January 2030 that it is the collection body pursuant to Article 44a (3) first subparagraph of Directive (EU) 2019/2034 and the collection body pursuant to Article 3 (2) of Regulation (EU) 2023/2859 for the collection of information submitted on a voluntary basis that are listed in Regulation (EU) No 2019/2033 and Directive (EU) 2019/2034.

Investment Firms Act 45 / 48 ANNEX Annex to Article 21: Principles of Remuneration Policy and Practices

1. the remuneration policy is clearly documented and proportionate to the size, internal organisation and nature, as well as to the scope and complexity of the activities of the investment firm;
2. the remuneration policy is a gender-neutral remuneration policy;
3. the remuneration policy is consistent with and promotes sound and effective risk management;
4. the remuneration policy is in line with the business strategy and objectives of the investment firm, and also takes into account long term effects of the investment decisions taken;
5. the remuneration policy contains measures to avoid conflicts of interest, encourages responsible business conduct and promotes risk awareness and prudent risk taking;
6. The supervisory board or the investment firm’s otherwise competent supervisory body by law or the articles of association shall adopt and periodically review the remuneration policy and shall be responsible for monitoring their implementation. Where investment firms have established a remuneration committee pursuant to Article 23, the remuneration committee may perform these duties.
7. the implementation of the remuneration policy is subject to a central and independent internal review by control functions at least annually.
8. staff that perform control functions shall be independent from the business units they oversee, shall have appropriate powers, and be remunerated in accordance with the achievement of the goals linked to their functions, independent of the performance of the business areas they control.
9. The remuneration of the members of the senior management in risk management and compliance functions is to be monitored directly by the remuneration committee stated in Article 23, or - in the event that such a committee does not exist - by the supervisory board or the supervisory body that is otherwise competent by law or by the articles of association.
10. Taking into account national practices, the remuneration policy shall make a distinction between criteria for fixed and variable remuneration components. This distinction, in particular, should be based on the following criteria: a. criteria for determining fixed remuneration components: aa) relevant professional experience and bb) specific activity performed in the respective organisational structure, taking into account the level of responsibility associated with such activity; b. criteria for determining variable remuneration components: aa) sustainable and risk-adjusted performance and bb) performance that exceeds the stipulated performance objectives.

Investment Firms Act 46 / 48 11. Fixed and variable components of total remuneration shall be appropriately balanced and the fixed component shall represent a sufficiently high proportion of the total remuneration to allow the operation of a fully flexible policy, on variable remuneration components, including the possibility to dispense with a variable remuneration completely. 12. For the purposes of no. 11 investment firms shall set the appropriate ratios between the variable and the fixed component of the total remuneration in their remuneration policies, taking into account the business activities of the investment firm and associated risks, as well as the impact that different categories of staff referred to in Article 21 have on the risk profile of the investment firm. 13. Where remuneration is performance related, it shall be based on a combination of the assessment of the performance of the individual and of the business unit concerned and of the overall results of the investment firm and when assessing individual performance, financial and non-financial criteria shall be taken into account: a. the assessment of the performance shall be set in a multi-year framework in order to ensure that the assessment process is based on longer-term performance and that the actual payment of performance-based components of remuneration is spread over a period which takes account of the underlying business cycle of the company and its business risks. b. the total variable remuneration shall not limit the ability of the investment firm to strengthen its capital base. c. Guaranteed variable remuneration is not compatible with sound risk management or the principle of performance-oriented pay and may not form part of future remuneration systems; exceptionally, a guaranteed variable remuneration may be granted in conjunction with the hiring of new employees if limited to the first year of employment and if the investment firm has a solid and sufficient capital base. 14. Payments relating to the early termination of an employment contract reflect the employee’s performance achieved over time and do not reward failure or misconduct. 15. Remuneration packages relating to compensation or buy out from contracts in previous employment are aligned with the long-term interests of the investment firm. 16. The measurement of performance used as a basis to calculate pools of variable remuneration components takes into account all types of current and future risks and the cost of the capital and liquidity required in accordance with Regulation (EU) 2019/2033. 17. The allocation of the variable remuneration components within the investment firm also takes into account all types of current and future risks. 18. At least 50 % of the variable remuneration components shall consist of the following instruments: a. shares or equivalent ownership interests dependent on the legal form of the investment firm concerned; b. share-linked instruments or equivalent non-cash instruments;

Investment Firms Act 47 / 48 c. Additional Tier 1 instruments or Tier 2 capital instruments, or other instruments which can be fully converted into Common Equity Tier 1 instruments or written down and that adequately reflect the credit quality as a going concern; d. non-cash instruments which reflect the instruments of the portfolios managed. The instruments referred to shall be subject to an appropriate retention policy designed to align the incentives of the individual with the longer-term interests of the investment firm, its creditors and clients. The FMA may restrict the type and design of such instruments or prohibit the use of certain instruments for the purpose of variable remuneration. 19. By way of derogation from no. 18 the FMA may grant approval by means of an administrative decision that an investment firm that does not issue any of the instruments listed in no. 18 has determined and applied alternative rules in its remuneration policy, why by doing so the basic objective for the instruments listed in no. 18 is pursued for at least 50 percent of the variable remuneration. 20. Taking into consideration the Regulatory Technical Standards issued pursuant to Article 32(8) of Directive (EU) 2019/2034 the FMA may also determine alternative rules to the instruments listed in no. 18 by way of a Regulation, provided that doing so is expedient in terms of administrative efficiency. 21. Depending on the investment firm’s business cycle and the type of business activity, and the associated risks as well as the activity of the employee in question, at least 40 percent of the variable remuneration components shall be deferred depending on circumstances for a period of three to five years. In the case of a variable remuneration component being of a particularly high amount, at least 60% of the amount shall be deferred. The length of the deferral period shall be established in accordance with the business cycle, the nature of the business, its risks and the activities of the member of staff in question: a. The claim may only be acquired or the variable remuneration, including the deferred portion, only be paid if it is sustainable according to the overall financial situation of the investment firm. The total variable remuneration will also be considerably limited by malus and clawback agreements, where the financial or earnings situation of the investment firm deteriorates or becomes negative. Malus or clawback arrangements may be entered into up to the amount of the total variable remuneration components. In this regard, investment firms must stipulate precise criteria for the application of malus and clawback agreements. These criteria shall in particular take into account situations in which employees have participated in or been responsible for actions that have resulted in significant losses, as well as of situations in which employees did not fulfil the requirements of relevant professional qualification or personal reliability. b. discretionary pension benefits are in line with the business strategy, objectives, values and long-term interests of the investment firm. c. where an employee leaves the investment firm prior to retirement age, discretionary pension benefits are to be held by the investment firm for the duration of five years in

Investment Firms Act 48 / 48 the form of instruments listed in no. 18. If an employee reaches retirement age and retires, then the discretionary pension benefits in the form of instruments listed in no. 18 shall be paid out to them, and shall be subject to a five-year retention period. d. staff members are obliged not to use personal hedging strategies or remuneration- and liability-related insurance to undermine the principles of the remuneration policy and practices. e. variable remuneration shall not be paid out through financial vehicles or methods that facilitate breaching this Federal Act or Regulation (EU) 2019/2033. 22. The claim for deferral of variable remuneration shall arise on a pro rata basis. 23. The principles stated in no. 18, the introduction of no. 21 and no. 21 lit. c shall not apply to a. investment firms, where the value of their on- and off-balance sheet assets were on average equal to or less than EUR 100 million over the four-year period immediately preceding the given financial year; and b. persons, whose annual variable remuneration does not exceed EUR 50 000 and does not represent more than one fourth of that individual’s total annual remuneration.