On Approval of the Regulation on Mechanisms, Systems and Procedures Aimed at Preventing and Detecting Insider Transactions, Manipulation or Attempts Thereof in Capital Markets

NATIONAL COMMISSION FOR SECURITIES AND STOCK MARKET DECISION Kyiv On Approval of the Regulation on Mechanisms, Systems and Procedures Aimed at Preventing and Detecting Insider Transactions, Manipulation or Attempts Thereof in Capital Markets In accordance with paragraph 1 of part one of Article 7, Articles 29, 30 of the Law of Ukraine "On State Regulation of Capital Markets and Organized Commodity Markets", Article 156 of the Law of Ukraine "On Capital Markets and Organized Commodity Markets" and with the aim of adapting Ukraine's relevant legislation to the law of the European Union (EU acquis), improving the legal regulation of the activities of professional participants of capital markets and organized commodity markets, and combating abuses in capital markets The National Commission for Securities and Stock Market D E C I D E D:

1. Approve the Regulation on Mechanisms, Systems and Procedures Aimed at Preventing and Detecting Insider Transactions, Manipulation or Attempts Thereof in Capital Markets, attached hereto.
2. Declare invalid the decision of the State Commission for Securities and Stock Market of June 14, 2011 No. 716 "On Approval of the Procedure for Preventing Price Manipulation During Securities Transactions on the Stock Exchange", registered in the Ministry of Justice of Ukraine on September 5, 2011 under No. 1045/19783 (with amendments).
3. The Department of Methodology of Professional Participants' Activities shall ensure submission of this decision for state registration to the Ministry of Justice of Ukraine.
4. The Management for Ensuring Activities of Collegial and Advisory Bodies shall ensure publication of this decision on the official website of the National Commission for Securities and Stock Market.

2 5. The Legal Department shall, after state registration of the decision by the Ministry of Justice of Ukraine, ensure publication of this decision on the official website of the National Commission for Securities and Stock Market. 6. This decision enters into force on the day following the day of its official publication, and comes into effect from January 1, 2027. 7. Persons specified in paragraph 2 of the Regulation on Mechanisms, Systems and Procedures Aimed at Preventing and Detecting Insider Transactions, Manipulation or Attempts Thereof in Capital Markets shall bring their activities into compliance with the requirements of this Regulation by January 1, 2027. 8. Control over the execution of this decision is entrusted to a member of the National Commission for Securities and Stock Market Yu. Shapoval. Chairman of the Commission Oleksiy SEMENYUK Protocol of the Commission meeting of 11.09.2026 No. 42

APPROVED Decision of the National Commission for Securities and Stock Market ______________No. REGULATION on mechanisms, systems and procedures aimed at preventing and detecting insider transactions, manipulation or attempts thereof in capital markets

1. This Regulation defines the requirements for the monitoring and reporting system that professional participants of capital markets, to whom this Regulation applies, must implement, as well as the procedure for submitting to the NCSPSM reports on applications for purchase/sale of financial instruments (including concluding derivative contracts), transactions carried out on the organized capital market or outside the organized capital market, regarding which there are justified grounds to believe they may constitute an insider transaction, manipulation, or an attempt thereof.
2. This Regulation applies to the following professional participants of capital markets who carry out activities (hereinafter – professional participants):

1. organization of trading of financial instruments;
2. trading of financial instruments in the following types: sub-brokerage activity, brokerage activity, dealer activity, portfolio management activity for financial instruments, underwriting and/or placement activity with guarantee, placement activity without guarantee;

3. The following terms are used in this Regulation in the following meanings: application – this is: a client's instruction (order, directive) to an investment firm for providing an investment service for financial instruments on conditions established by the client based on a general agreement; an offer submitted by a trading participant in accordance with the rules of functioning of the organized capital market for the purchase or sale of an asset admitted to trading on the organized capital market, for carrying out a securities repurchase operation admitted to trading on the organized capital market (repo application), or for concluding a derivative contract, which contains the conditions under which the corresponding transaction is offered, taking into account changes that may be made to such an offer in accordance with the rules of functioning of the organized capital market; operation – acceptance, processing, and execution by an investment firm / operator of the organized capital market within the scope of its professional activity

2 of client's / trading participant's applications, actions of such professional participants related to the conclusion / registration / execution of transactions regarding financial instruments in accordance with client's / trading participant's applications; suspicious application and/or suspicious operation (hereinafter – suspicious application/operation) – an application and/or quotation, notification of change or cancellation of such an application, as well as an operation regarding which there are justified grounds to believe they may constitute an insider transaction, manipulation, or an attempt thereof; risk indicator – signs of insider transactions, manipulation, or attempts thereof, the approximate list of which is defined in Appendix 1 to this Regulation; monitoring and reporting system – a set of mechanisms, systems, and procedures implemented by professional participants of capital markets for the purpose of preventing, detecting, and identifying insider transactions, manipulation, attempts to conclude insider transactions and manipulation in capital markets (hereinafter – PDIP (Preventing, Detecting and Identifying Procedures)), as well as reporting suspicious applications/operations to the NCSPSM (hereinafter – STOR (Suspicious Transaction and Order Report) notification); authorized person – a должностная особа (official) of a professional participant, whose duties include making a decision regarding a suspicious application/operation and submitting a STOR notification. The term "audit subject" is used in accordance with the Law of Ukraine "On Audit of Financial Reporting and Audit Activity". Other terms used in this Regulation are used in accordance with the Law of Ukraine "On Capital Markets and Organized Commodity Markets" and relevant legislation. 4. A professional participant must define in its internal documents the rules for the functioning of the monitoring and reporting system, ensure its practical implementation and proper support taking into account the requirements established by this Regulation, and compliance with the following principles:

1. independence – the structural subdivision or official of a professional participant to whom the functions of analyzing applications/operations, processing risk signals (hereinafter – structural subdivision/official) are entrusted, and the authorized person must be organizationally separated from the functions of the professional participant's subdivisions that directly carry out the organization or execution of operations;
2. effectiveness – PDIP ensures the detection of suspicious applications/operations regardless of their type and type of client/trading participant/counterparty in real-time mode or with minimal delay in forming risk signals, but: not more than 30 minutes from the moment of accepting the application and/or concluding the transaction – for PDIP of operators of organized capital markets; no later than the end of the working day during which the application/operation was received/executed – for PDIP of investment firms;

3 3) continuity – the monitoring and reporting system must function without interruption during the professional activity of the professional participant; 4) proportionality – PDIP must correspond to the scale, volume, and nature of the professional participant's professional activity; 5) adaptability – mechanisms for detecting and analyzing suspicious operations must be regularly reviewed, evaluated, and updated taking into account changes in market practice and identified suspicious operations; 6) accountability – the monitoring and reporting system must ensure the accountability of the professional participant to the NCSPSM regarding the prevention and detection of insider transactions, manipulation, or attempts thereof in capital markets; 7) objectivity – the assessment of risk signals and decision-making regarding a suspicious application/operation is carried out based on facts and cannot be based on assumptions; 8) documentation – information related to the functioning of the monitoring and reporting system is subject to proper documentation ensuring its reproducibility. 5. An operator of an organized capital market, for the purpose of preventing, detecting, and identifying suspicious applications/operations, must ensure continuous monitoring of trading, including submission, change, cancellation, or rejection of applications/quotations, their processing in the order book, as well as conclusion and execution of transactions, using software that allows delayed automatic reading, reproduction, and analysis of order book data and has technical resources for operation in conditions of algorithmic trading, including high-frequency trading. An investment firm, for the purpose of detecting and identifying suspicious applications/operations on the organized capital market or outside the organized capital market, must ensure continuous monitoring of received client applications, client applications transferred for execution to other persons, and operations, including using software for professional activity in conditions of algorithmic trading, including high-frequency trading, which allows delayed automatic reading, reproduction, and analysis of application/operation data and has technical resources. 6. In cases where several professional participants specified in paragraph 2 of this Regulation participate in the organization and execution of one operation, the obligation to analyze it and make a decision on the necessity of submitting a STOR notification to the NCSPSM is imposed on each of such professional participants. 7. The monitoring and reporting system of professional participants must ensure:

1. analysis of all operations during the professional activity of the professional participant (excluding operations related to actions carried out by state authorities and other state bodies in connection with the implementation of monetary policy, currency policy, or state debt management policy (except for actions of natural persons working in such bodies on the basis of an employment contract or other grounds, in case such natural persons directly or indirectly carry out operations, send applications and/or quotations, etc. in their own name)), including submitted, changed, transferred, cancelled, or rejected applications/operations on the organized capital market and outside it according to time (including the possibility of retrospective analysis for a period of not less than five years), quantitative, and price parameters at each of the following levels: operational level – comparative analysis of applications/operations regarding the corresponding financial instrument for the purpose of detecting atypical, repeated, synchronized, or related applications/operations; behavioral level – comparative analysis of actions of client(s)/trading participant(s)/counterparty(ies) and persons associated with them regarding applications/operations for the purpose of detecting abnormal deviations from their usual behavior in capital markets; market level – comparative analysis of applications/operations regarding the price and volume of supply of a financial instrument admitted to trading on the organized capital market, for the purpose of establishing their impact on the price, demand, or supply of the corresponding financial instrument; event level – comparative analysis of applications/operations regarding the corresponding financial instrument regarding their correlation with corporate events of the issuer of such financial instrument and disclosure of insider information in capital markets in accordance with Article 133-1 of the Law of Ukraine "On Capital Markets and Organized Commodity Markets", information on buyback or carrying out of securities stabilization.
2. formation of risk signals regarding each application/operation in case of establishing, as a result of the analysis conducted at any of the levels specified in subparagraph 1 of this paragraph, that such application/operation corresponds to the risk indicator defined in the internal documents of the professional participant taking into account the nature, complexity, type, and volume of its professional activity;
3. preparation, registration, and transmission of a STOR notification in accordance with the requirements of this Regulation.

5 8. Each risk signal is subject to mandatory processing within the term: during the trading session during which the risk signal was formed, but no later than the opening of the next trading session – for operators of the organized market; no later than the end of the next working day from the day of formation of the risk signal – for investment firms. 9. Processing of a risk signal is carried out by the structural subdivision/official/service provider (in case if PDIP is outsourced by a professional participant) in the following sequence:

1. registration: each risk signal is subject to registration in the risk signal journal;
2. assessment: verification of the reasons for the formation of the risk signal is carried out, including information regarding the application/operation, client/trading participant/counterparty, its actions and associated persons, price, demand and supply of the financial instrument, corporate events of the issuer of the corresponding financial instrument and disclosure of insider information, information on buyback or carrying out of securities stabilization. For the purpose of verification, the professional participant uses data of internal accounting of information on the conduct of professional activity and external sources of information;
3. fixation and transmission of risk signal processing results: the results of risk signal processing must be documented and together with documents and materials substantiating the circumstances and reasons for the formation of the risk signal, transmitted to the authorized person for making a decision on submitting a STOR notification. In case if the structural subdivision/official/service provider (in case if PDIP is outsourced by a professional participant) receives information, appeal, complaint, or request that substantiates that the executed application/operation, regarding which PDIP did not form a risk signal or the authorized person made a decision on the absence of suspicion, may be an insider transaction, manipulation, or an attempt thereof, such information, appeal, complaint, or request is considered a risk signal. Processing of such a risk signal begins by the structural subdivision/official/service provider (in case if PDIP is outsourced by a professional participant) on the day of receiving the information in the sequence provided by this paragraph. In case if processing of a risk signal is not carried out within the terms specified in paragraph 8 of this Regulation, all information regarding such signal is transmitted to the authorized person for decision-making.

6 10. The risk signal journal is intended for accounting, tracking, and documenting all stages of risk signal processing, is formed and maintained by the structural subdivision/official/service provider (in case if PDIP is outsourced by a professional participant) in electronic form, and must contain regarding each risk signal at least the following information: unique identifier of the risk signal, date and time of its formation; name of the risk indicator; identification data of the application/operation, corresponding financial instrument, client/trading participant/counterparty and associated persons (if available); date and time of fixation and transmission to the authorized person of the results of the assessment of the risk signal and their content, including description of documents and materials substantiating the circumstances and reasons for the formation of the risk signal; surname, first name, and patronymic of the person responsible for processing the risk signal; information on the decision made by the authorized person: surname, first name, and patronymic of the authorized person, date and time of making the decision, content of the decision made, identification data of the STOR notification (in case the authorized person makes a decision to send such notification). Professional participants ensure the integrity, completeness, and accuracy of information contained in the risk signal journal, as well as the possibility of reproducing all stages of processing of each risk signal. 11. Decision-making regarding a suspicious application/operation and the necessity of submitting a STOR notification is carried out by the authorized person no later than the end of the next working day from the day of receiving from the structural subdivision/official/service provider (in case if PDIP is outsourced by a professional participant) the results of risk signal processing. 12. The decision of the authorized person regarding a suspicious application/operation must contain: date and time of formation; name of the risk indicator; identification data of the application/operation, corresponding financial instrument, client/trading participant/counterparty and associated persons (if available); conclusion on the presence or absence of suspicion that the application/operation may be an insider transaction, manipulation, or an attempt thereof, and its justification, or the necessity of conducting additional assessment; surname, first name, and patronymic of the authorized person. In case the authorized person makes a decision to conduct additional assessment, the structural subdivision/official/service provider (in case if PDIP is outsourced by a professional participant) carries out such additional assessment and transmits its results to the authorized person no later than the end of the next working day from the day of receiving from the authorized person the decision to conduct additional assessment. The decision to conduct additional assessment regarding the same application/operation must be justified by the authorized person with the necessity of conducting additional verification of a defined list of facts, documents, or information. 13. In case of justified suspicion that the application/operation may be an insider transaction, manipulation, or an attempt thereof, the authorized person without undue delay but no later than the end of the working day of making a decision regarding the suspicious application/operation submits a STOR notification to the NCSPSM in the form according to Appendix 2 to this Regulation, together with the results of the assessment conducted, documents and materials substantiating such suspicion. Submission of a STOR notification to the NCSPSM cannot be postponed for the purpose of combining several suspicious applications/operations into one notification or waiting for their accumulation. In case if after submitting a STOR notification, the authorized person receives additional information that complements or refutes its conclusion on the presence of justified suspicion that the application/operation may be an insider transaction, manipulation, or an attempt thereof, such additional information must be sent by the authorized person to the NCSPSM on the day of its receipt. The authorized person in the STOR notification additionally provides explanations regarding circumstances of: processing of a risk signal regarding an executed application/operation, regarding which no risk signal was formed, or such authorized person made a decision on the absence of suspicion – in the case provided for in the fifth paragraph of paragraph 9 of this Regulation; delay between execution of the suspicious application/operation and submission of a STOR notification regarding it – in the case provided for in the sixth paragraph of paragraph 9 of this Regulation. 14. A STOR notification is submitted to the NCSPSM through an official communication channel in the order provided for by the Requirements for the Application of Means of the Integrated Subsystem of Provision of Administrative Services in Electronic Form CIS as an official communication channel, approved by the decision of the National Commission for Securities and Stock Market of December 22, 2023 No. 1444 (with amendments). The day of receipt of a STOR notification by the NCSPSM is the working day of its arrival at the NCSPSM through the electronic cabinet of the CIS user. 15. A STOR notification is submitted to the NCSPSM by the authorized person regardless of: status of execution of the suspicious application/operation (completed, not completed, cancelled); type of client/trading participant/counterparty (resident or non-resident); presence of previously submitted STOR notifications regarding the same person or application/operation.

8 The existence in contractual relations between a professional participant and a client / trading participant / counterparty of obligations regarding the preservation of confidentiality of information about such client / trading participant / counterparty by the professional participant or restrictions on its disclosure is not grounds for not submitting a STOR notification.

16. Professional participants must introduce internal procedures that ensure the non-disclosure of information regarding the fact and results of processing risk signals, decisions made by the authorized decision-maker, and the submission of STOR notifications to the person(s) to whom such notification relates, as well as to any other persons, except those who must possess such information in connection with the performance of their official duties.

A professional participant must not contact the person(s) whose application / operation is suspicious, including to obtain explanations or any other information necessary for submitting a STOR notification from them.

17. Professional participants ensure regular assessment and improvement of the monitoring and reporting system taking into account changes in legislation on combating abuses in capital markets; changes in market conditions and trading practices; new or changed risk indicators; results of decisions made by the authorized person; results of periodic testing; comments and recommendations of the NCSPFU.

Professional participants ensure the conduct of periodic testing of the PDITMM system no less than once a year, which includes, in particular: verification of the correctness of the application of risk indicators; assessment of the quality of risk signal formation (including assessment of the share of false-positive and false-negative signals); verification of the completeness of coverage of applications / operations by the monitoring and reporting system; assessment of the timeliness of risk signal processing.

The results of the assessment and improvement of the monitoring and reporting system are subject to documentation. If, as a result of the assessment, deficiencies are identified in the monitoring and reporting system, professional participants must, no later than 10 working days from the date of completion of such assessment, compile a plan of measures for its improvement, which contains a list of identified deficiencies and measures to eliminate them, responsible executors of the measures, and deadlines for their execution.

The conduct of regular assessment of the monitoring and reporting system is carried out no less than once a year by conducting:

internal review – by a structural subdivision / official and/or compliance manager and/or risk manager of the professional participant and/or service provider (in case if compliance and risk management functions are outsourced by the professional participant); audit – by the internal auditor of the professional participant or a subject of audit activity.

18. Professional participants ensure proper preparation and regular training of officials of the professional participant, on whom are placed functions

9 of analysis of applications / operations, processing of risk signals, the authorized person, as well as persons involved in preventing insider transactions and manipulation in capital markets, on issues of combating abuses in capital markets.

19. Professional participants ensure the storage of information related to the functioning of the monitoring and reporting system, in particular: data on applications / operations regarding which a risk signal was formed, with all documents and materials justifying the circumstances and reasons for the formation of the risk signal; data on applications / operations regarding which targeted analysis was carried out outside the standard automatic flow of risk signal formation (in particular, upon appeal, complaint, or request), regardless of whether such analysis led to the formation of a risk signal in the automated system; risk signal journal; decisions of the authorized person; copies of submitted STOR notifications; results of assessment and improvement of the monitoring and reporting system; results of periodic testing of the PDITMM system; information regarding the completion of training on issues of combating abuses in capital markets by officials of the professional participant, on whom are placed functions of analysis of applications / operations, processing of risk signals, the authorized person, as well as persons involved in preventing insider transactions and manipulation in capital markets; internal documents defining the rules of functioning of the monitoring and reporting system, provided for in paragraph 4 of this Regulation, changes and updates to them.

Information is stored for no less than five years in electronic form, which ensures its integrity, completeness, confidentiality, protection against unauthorized change or deletion, as well as the possibility of its reproduction and verification.

Professional participants, upon request of the NCSPFU within the established deadline, provide information and internal documents provided for by this paragraph and paragraph 4 of this Regulation.

20. Professional participants may transfer to the service provider on outsourcing the PDITMM system in the order established by the NCSPFU for the transfer by professional participants to relevant persons of functions, processes, provision of services, performance of works that are part of the professional activity of such professional participants in capital markets and organized commodity markets.

Director of the Department of Methodology of Professional Participants' Activity Maksym TYMOKHIN

Appendix 1 to the Regulation on Mechanisms, Systems and Procedures Aimed at Preventing and Detecting Insider Transactions, Manipulation or Attempts Thereof in Capital Markets (paragraph 3) Matrix of Approximate Risk Indicators

No. Risk Identifier Description of Risk Identifier Subject of Analysis

I. Manipulation through transactions (trade-based)

1. Transactions without change of beneficiary Wash trades Purchase / sale of a financial instrument without actual change of its owner application / operation / transaction identification data of buyer and seller

2. Trading by related persons Self-trading / Cross-account wash Purchase / sale of a financial instrument by persons having a common ultimate beneficial owner ownership structure data from state registers

3. Chain of transactions between related persons (artificial circulation of financial instrument) Circular trading The ultimate buyer of the financial instrument is a person (related person) who made the initial offer of this same financial instrument application / operation / transaction identification data of buyer and seller ownership structure data from state registers

4. Sharp increase in the price of a financial instrument with subsequent mass sale Pump and dump Rapid growth in the price of a financial instrument with subsequent placement of a significant volume of offers for its sale price of the financial instrument offer, demand for the financial instrument insider information information (including rumors) in media, Internet, or disseminated in another way, which provides or may provide false or misleading signals regarding the offer, demand, or price of the financial instrument

2 Continuation of Appendix 1

5. Sharp decrease in the price of a financial instrument with subsequent mass purchase Dump and Pump Rapid fall in the price of a financial instrument with subsequent placement of a significant volume of offers for its purchase price of the financial instrument offer, demand for the financial instrument insider information information (including rumors) in media, Internet, or disseminated in another way, which provides or may provide false or misleading signals regarding the offer, demand, or price of the financial instrument

6. Influence on price before market close 1 Marking the close Abnormally large number of applications for purchase / sale of a financial instrument submitted before market close, which influenced the closing price of such financial instrument number of applications price of the financial instrument

7. Influence on price at market open 1 Marking the Open Abnormally large number of applications for purchase / sale of a financial instrument submitted during the opening auction, which influenced the opening price of such financial instrument number of applications price of the financial instrument

8. Intraday manipulation 1 Intraday manipulation Abnormally large number and frequency of submission during the trading session of applications for purchase / sale of a financial instrument, which caused significant volatility of its price number, frequency of submission of applications price of the financial instrument

9. Gradual increase in the price of a financial instrument 1 Price ramping Abnormal submission of homogeneous applications / execution of operations for purchase of a financial instrument, which caused an increase in its price without justified market grounds application / operation price of the financial instrument market price of the financial instrument information (including rumors) in media, Internet, or disseminated in another way, which provides or may provide false or misleading signals regarding

3 Continuation of Appendix 1

the offer, demand, or price of the financial instrument

10. Artificial decrease in the price of a financial instrument 1 Bear raid Abnormal submission of homogeneous applications / execution of operations for sale of a financial instrument, which caused a decrease in its price without justified market grounds application / operation price of the financial instrument market price of the financial instrument information (including rumors) in media, Internet, or disseminated in another way, which provides or may provide false or misleading signals regarding the offer, demand, or price of the financial instrument

11. Trading after dissemination of rumors 1 Rumour-driven trading Submission of applications for purchase / execution of operations for sale of a financial instrument after dissemination of information (including rumors) in media, Internet, or in another way, which provides or may provide false or misleading signals regarding the offer, demand, or price of the financial instrument application / operation price of the financial instrument information (including rumors) in media, Internet, or disseminated in another way, which provides or may provide false or misleading signals regarding the offer, demand, or price of the financial instrument

12. Launch of artificial trend 1 Momentum ignition Abnormal number of applications / operations submitted / executed by one person regarding a financial instrument, which caused a sharp change in its price and attracted other unrelated market participants to purchase / sale of such financial instrument number of applications / operations identification data of buyer / seller price of the financial instrument

II. Manipulation through orders (order-based)

13. Fake orders 1 Spoofing Creation or attempt to create misleading signals regarding the demand or supply of a financial instrument from a person having a dominant position in capital markets, as a result of submission of one or several applications for purchase or sale of a significant quantity of identification data of buyer / seller number of submitted / cancelled applications / transactions price of the financial instrument

4 Continuation of Appendix 1

financial instruments, which at the same time: belong to one price range; are subsequently cancelled

14. Multi-level orders 1 Layering Creation or attempt to create misleading signals regarding the liquidity of a financial instrument as a result of submission of orders by a large number of persons, which at the same time: change the price range depending on the increase / decrease in the price of the financial instrument; are subsequently cancelled, except for the order that meets the price expectation identification data of buyers / sellers number of submitted / cancelled applications / transactions price of the financial instrument

15. Excessive number of orders 1 Quote stuffing Ultra-fast submission and cancellation of a significant number of orders per unit of time with the aim of overloading the electronic trading system of the operator of the organized market and/or worsening the opportunities of other market participants number of submitted / cancelled orders per unit of time

16. Coordinated orders 1 Matched orders Simultaneous submission by different trading participants of a significant number of applications for purchase / sale of a financial instrument with the same price and volume number of submitted / cancelled applications price of the financial instrument

17. Mass cancellation of orders 1 Abnormal order cancellation Abnormal number of cancellation of submitted applications for purchase / sale of a financial instrument number of submitted / cancelled applications for a certain period of time

18. Order book imbalance 1 Order book imbalance Significant excess of the number of submitted applications for purchase of a financial instrument over applications for its sale (or vice versa) as a result of dissemination in media, Internet, or in another way of information, which provides or may provide false or misleading signals regarding the offer, demand, or price of the financial instrument number of submitted applications for purchase / sale of the financial instrument information (including rumors) in media, Internet, or disseminated in another way, which provides or may provide false or misleading signals regarding the offer, demand, or price of the financial instrument

5 Continuation of Appendix 1

19. Excessive number of applications for purchase or sale 1 Order stacking Creation or attempt to create misleading signals regarding the liquidity of a financial instrument as a result of submission of a large number of orders, which: belong to one price range; are subsequently cancelled number of submitted / cancelled applications / transactions price of the financial instrument

20. Order flooding 1 Order flooding Submission of a significant number of orders, differing in content, with the aim of overloading the electronic trading system of the operator of the organized market and/or worsening the opportunities of other market participants applications

21. Price collapse 1 Layer collapse Submission by a person of applications for purchase or sale of a financial instrument at each of the sequential price ranges, which caused artificial increase or decrease in the price of the financial instrument applications identification data of the person and their actions price of the financial instrument

22. Simulation of liquidity 1 Fake liquidity / Phantom orders Submission by a person of an application for purchase / sale of a significant quantity of financial or continuous submission and cancellation of such applications for a short period of time, which does not involve further execution of transactions applications identification data of the person and their actions

23. Counter orders 1 Back-to-back trades Submission with minimal time interval and at the same price of counter applications for purchase and sale of a financial instrument application / transaction identification data of buyer / seller price of the financial instrument

24. Artificial trading volume 1 Artificial volume Cyclic submission by a person (related persons) over a long period of time of counter applications for purchase and sale of a financial instrument at the same price application / transaction identification data of buyer / seller price of the financial instrument

25. Surge in trading volume 1 Volume spikes Abnormally large one-time submission of an application for purchase or sale of a large quantity of application / transaction

6 Continuation of Appendix 1

financial instrument at a price that significantly differs from prices in applications submitted by other participants identification data of buyer / seller price of the financial instrument

26. Mass small orders 1 Repetitive micro-trades Submission of a significant number of applications for purchase / sale of the minimum volume of a financial instrument and at the minimum price step application / transaction identification data of buyer / seller price of the financial instrument

III. Volatility / Closing Price Manipulation

27. Volatility manipulation 1 Volatility manipulation Submission by a person of applications for purchase / sale of a financial instrument at a price that is: higher than the highest price formed during a certain period of time; lower than the lowest price formed during a certain period of time application identification data of buyer / seller price of the financial instrument

28. Closing price manipulation 1 Close-price manipulation Submission by a person before the close of the trading session of applications for purchase / sale of a large quantity of a financial instrument at a price significantly higher / lower than the price formed during the trading session application / transaction identification data of buyer / seller price of the financial instrument

IV. Position Manipulation and Cross-Market Schemes

29. Cross-market manipulation 1 Cross-market manipulation OTC manipulation Execution by a person or related persons on one of the organized capital markets of actions regarding a financial instrument, which correspond to the risk identifier Spoofing, Layering, or Order flooding, the result of which is an influence on the price of such financial instrument on another organized capital market application / transaction identification data of buyer / seller price of the financial instrument information disclosed by the operator of the organized market

30. Manipulation with ETF financial instruments 1 ETF manipulation Execution by a person or related persons on different organized capital markets of actions regarding assets of an ETF, which correspond to the risk identifier Fake liquidity / Phantom orders or Close-price manipulation application / transaction identification data of buyer / seller

7 Continuation of Appendix 1

price of financial instruments that are assets of the ETF information disclosed by the operator of the organized market

31. Manipulation with the index of an organized market 1 Index manipulation Execution by a person or related persons on an organized capital market of actions regarding the index of a specific market, which correspond to the risk identifier Marking the close, Order Stacking, or Close-price manipulation application / transaction identification data of buyer / seller information disclosed by the operator of the organized market

32. Manipulation with a derivative contract Derivative manipulation / Futures manipulation Submission by a person or related persons of a significant number of applications for purchase of a derivative contract and securities that are its underlying asset, with the aim of increasing the value of such derivative contract as a result of creating artificial demand for its underlying asset application / transaction identification data of buyer / seller price of the derivative contract price of securities that are the underlying asset of the derivative contract

33. Control of a significant share of an instrument Cornering the market Submission by a person of a significant number of applications regarding a financial instrument, the result of which is the acquisition by such person of 80-90% of the total quantity of financial instruments that are in free circulation application / transaction identification data of buyer / seller information disclosed by the operator of the organized market / issuer of the financial instrument

34. Forced closing of short positions 1 Short squeeze Submission by a person of applications for purchase of the majority of a financial instrument that is in free circulation, the result of which is the forced submission of applications for their purchase at an inflated price by trading participants, which is due to the need to fulfill their obligations regarding such financial instruments to third parties application / transaction identification data of buyer / seller price of the financial instrument

35. Inter-account manipulation 1 Cross-account manipulation Multi-account strategy Use by a person and/or related persons of external software and technical complexes and algorithms, IP addresses, MAC addresses of devices that coincide, identical VPN servers, or API keys with an identical digital footprint for the purpose of carrying out manipulative actions regarding the purchase / sale of a financial instrument, which correspond to the risk identifier Wash Trading, Pump and Dump, Spoofing, or Layering application / operation / transaction identification data of buyer / seller information-technical data of buyer / seller

8 Continuation of Appendix 1

36. Manipulations using alternative trading systems (ATS) 1 Dark pool abuse Use by a person of private alternative trading systems (ATS) with the aim of carrying out manipulative actions regarding a financial instrument on organized capital markets, which correspond to the risk identifier Spoofing, Layering, or Cross-Market Manipulation application / operation / transaction identification data of buyer / seller

V. Algorithmic Manipulation

37. Algorithmic manipulation 1 Algorithmic manipulation Use by a person of external software and technical complexes and algorithms with the aim of carrying out manipulative actions regarding a financial instrument on organized capital markets, which correspond to the risk identifier Spoofing, Layering, Quote Stuffing application / operation / transaction identification data of buyer / seller information-technical data of buyer / seller

38. High-frequency Wash Trading 1 Self-matching HFT Use by a person of external software and technical complexes and algorithms with the aim of carrying out manipulative actions regarding a financial instrument on organized capital markets, which correspond to the risk identifier Wash Trading application / operation / transaction identification data of buyer / seller information-technical data of buyer / seller

39. Manipulation with data transmission delay 1 Use by a person of external software and technical complexes and algorithms with the aim of carrying out application / operation / transaction identification data of buyer / seller

9 Continuation of Appendix 1 Latency exploitation manipulative actions regarding a financial instrument related to technological delay in data transmission between different organized capital markets IT data of the buyer / seller VI. Insider Transactions 40. Trading before disclosure of insider information Pre-announcement trading Profit warning trading Order anticipation/Front running Abnormal submission/execution of a large number of buy/sell orders for a financial instrument within a time period closest to the date of disclosure of insider information determined by the issuer order/transaction/transaction insider information issuer of the financial instrument 41. Trading before disclosure of financial reporting Earnings leak trading Abnormal submission/execution of a large number of buy/sell orders for a financial instrument immediately before the issuer of the financial instrument discloses financial reporting order/transaction/transaction financial reporting of the issuer of the financial instrument 42. Trading before disclosure of insider information about reorganization M&A insider trading Abnormal submission/execution of a large number of buy/sell orders for a financial instrument immediately before the issuer of the financial instrument discloses insider information about reorganization order/transaction/transaction insider information issuer of the financial instrument 43. Trading before disclosure of insider information about dividend payments Dividend insider trading Abnormal submission/execution of a large number of buy/sell orders for a financial instrument immediately before the issuer of the financial instrument discloses insider information about dividend payments order/transaction/transaction insider information issuer of the financial instrument 44. Trading by connected persons Connected persons trading Submission by connected persons, at least one of whom has access to insider information of the issuer of the financial instrument, of orders/orders/transactions/transactions order/transaction/transaction insider information issuer of the financial instrument

10 Continuation of Appendix 1 Cluster insider trading execution of buy/sell transactions for a financial instrument, including typical ones, within a time period closest to the date of disclosure of insider information determined by the issuer information about transactions of managers obtained from persons performing management functions in the issuer of financial instruments information about transactions of managers obtained from persons closely related to the person performing management functions in the issuer of financial instruments 45. Insider trading in derivative contracts Insider derivative trading Suspicious options trades Submission of orders/execution of transactions for the purchase/sale of a derivative contract, the underlying asset of which is the securities of the issuer, immediately before the issuer of the financial instrument discloses insider information order/transaction/transaction insider information issuer of the financial instrument 46. Abnormal profitability Abnormal return trading Obtaining by a person of abnormal income/avoidance of loss from the purchase/sale of a financial instrument compared to the expected market result for such a financial instrument transaction insider information issuer of the financial instrument

---

Note: 1 – applies to organized capital markets.

Appendix 2 to the Regulation on Mechanisms, Systems and Procedures Aimed at Preventing and Detecting Insider Transactions, Manipulation or Attempts Thereof in Capital Markets (point 13 of the Regulation) National Securities and Stock Market Commission Notification of Suspicious Orders/Transactions SECTION I. INFORMATION ABOUT THE PROFESSIONAL PARTICIPANT SUBMITTING THE NOTIFICATION Information about the physical person responsible for submitting the STOR notification Full name (surname, first name, patronymic, if any) of the person responsible for submitting the STOR notification. Position of the physical person in the professional participant Position in the professional participant of the person responsible for submitting the STOR notification. Information about the professional participant Full name of the professional participant; legal entity identification code; LEI code (if available); identification code from the commercial, banking, or court register or information about the registration of the legal entity in accordance with the legislation of the country of its location – for legal entities that are non-residents. Location of the professional participant Full address of the location of the professional participant: postal code; territory/region name and code 1; district name; settlement name; district name within the settlement (if available); type and name of square, street, alley, etc.; building number (building block number), type of premise, premise number; country name and code 2. Information regarding the professional participant's activity in capital markets Code according to Reference Book 12 "Types of Professional Activity in Capital Markets and Organized Commodity Markets" Reference Systems and Classifiers of the National Securities and Stock Market Commission, approved by the decision of the National Securities and Stock Market Commission dated May 8, 2012 No. 646, registered in the Ministry of Justice of Ukraine on May 25, 2012 under No. 831/21143 (hereinafter – Reference Systems and Classifiers). Type of professional activity of the professional participant and type of financial instrument Type of professional activity 3. The operator of the organized market additionally specifies the type of organized market on which the suspicious order/transaction was placed/executed. The investment firm additionally specifies the types of professional activity in capital markets – activity in organizing the trade of financial instruments 5, within which the suspicious order/transaction was placed/executed. Type of financial instrument regarding which the suspicious order/transaction was placed/executed. Connection of the professional participant with the person regarding whom the STOR notification is submitted Information about corporate, contractual, or organizational connections or relations with the client/trading participant/counterparty regarding whom the STOR notification is submitted. The investment firm additionally specifies the type of contract with the client 6. Contact details of the person in the professional participant for obtaining additional information regarding the STOR notification Full name (surname, first name, patronymic, if any) of the contact person. Position of the contact person. Email address of the contact person. SECTION 2. INFORMATION ABOUT THE SUSPICIOUS ORDER/TRANSACTION Description of the financial instrument: Description of the financial instrument regarding which the suspicious order/transaction was placed/executed, specifying: type of financial instrument, characteristics of the security (by issuance order, by degree of liquidity, other characteristics defined by legislation for certain types of securities); code of the financial instrument 7; International Securities Identification Number (ISIN). For a derivative contract, additionally specify: derivative contract classification based on the presence of an obligation to transfer the underlying asset, by type of underlying asset and/or underlying indicator;

3 Continuation of Appendix 2 description of the underlying asset or underlying indicator of the derivative contract according to its content; premium amount (if available); exercise price (if available), currency code; exercise period. For a stock derivative contract, additionally specify information about the securities that are its underlying asset: characteristics of the security (by issuance order, by degree of liquidity, other characteristics defined by legislation for certain types of securities); code of the financial instrument 7; number of securities; International Securities Identification Number (ISIN). Date and time of the suspicious order/transaction Date and time of submission/execution of the suspicious order/transaction (with detail down to microseconds for activity involving high-frequency algorithmic trading technology) specifying the time zone. Market on which the suspicious order/transaction was placed/executed Type of organized market on which the suspicious order/transaction was placed/executed 4, name of the operator of the organized capital market, trading technology 8. If the submission/execution of the suspicious order/transaction was carried out outside the organized market, "outside the organized market" is specified. Information about the country in which the suspicious order/transaction was placed/executed Country name and code 2. Description of the order/transaction The following characteristics of the suspicious order/transaction are specified, including: order/transaction identifier (if available); date and time of submission/execution of the order/transaction, settlement (if available); price specified in the order/transaction; volume/quantity of financial instruments. If several suspicious orders/transactions regarding the same financial instrument are placed/executed, detailed information about the number of such orders/transactions and prices specified in such orders/transactions may be provided in this STOR notification; information about the submitted order, including: type of order, method of submitting the order (e.g., electronic order book), person who actually submitted the order, person who actually received the order, means of transmitting the order; information about the modification or cancellation of the order (if available): date and time of modification or cancellation, person who modified or cancelled the order, nature of the modification (e.g., change of price or quantity), means of modifying or cancelling the order (e.g., by email, phone, etc.). If several suspicious orders regarding the same financial instrument are modified or cancelled, detailed information regarding each such order may be provided in this STOR notification. SECTION 3. DESCRIPTION OF SUSPICION Type of abuse regarding which there is a justified suspicion The type of abuse is specified: manipulation in capital markets: insider transaction; attempt to manipulate in capital markets; attempt to conclude an insider transaction. Justification of the suspicion The conclusion of the authorized person based on the results of the risk signal assessment regarding the order/transaction is specified. SECTION 4. INFORMATION ABOUT THE PERSON, ORDER/TRANSACTION OF WHICH IS SUSPICIOUS Full name/name Full name (surname, first name, patronymic, if any) – for a physical person; for foreign physical persons and stateless persons – name in English and its transliteration into Ukrainian. Full name of the legal entity; for legal entities of other states – full name in English and its transliteration into Ukrainian. Date of birth Specified only for physical persons (yyyy-mm-dd). Identification data of the person (if available) For physical persons:

5 Continuation of Appendix 2 series (if available) and/or passport number (or other document certifying identity and which, in accordance with Ukrainian legislation, can be used on the territory of Ukraine to conclude transactions – for physical persons who are non-residents). Data for physical persons who are non-residents are submitted in Ukrainian and English. taxpayer registration number or number (and series, if available) of the passport of a citizen of Ukraine, in which a mark is placed about the refusal to accept the taxpayer registration number, or passport number with a record of refusal to accept the taxpayer registration number in an electronic contactless carrier – for physical persons who are residents. For Ukrainian legal entities – legal entity identification code, and, if available, international legal entity identification code (LEI code). For collective investment institutions, additionally specify the code according to the Unified State Register of Collective Investment Institutions. For foreign legal entities – identification code from an extract from the commercial, banking, or court register or another official document confirming the registration of the foreign legal entity in the country in which its head office is registered, and, if available, international legal entity identification code (LEI code). Location Specify postal code, name and code of the region 1, district name, settlement name, district name within the settlement, type and name of square, street, alley, etc.; building number (building block number), type of premise, premise number, country name and code 2 for: physical persons – declared/registered place of residence (stay) of the person; Ukrainian legal entities – location;

6 Continuation of Appendix 2 foreign legal entities – place of registration, location in Ukrainian and English. Information about place of work and position Specify available information: for physical persons – their place of work and position; for legal entities – position of the person who placed/executed the suspicious order/transaction. Account number(s) Specify the number(s) of the account(s) of the client/trading participant/counterparty in banks and/or depository institutions, which is/are used for settlements regarding suspicious orders/transactions. Client/Trading Participant/Counterparty Identifier according to reporting on transactions in accordance with the Regulation (EU) No 600/2014 of the European Parliament and Council dated May 15, 2014 on Markets in Financial Instruments and amending Regulation (EU) No 648/2012 Specify regarding the client/trading participant/counterparty who is a resident of an EU member state. Connection with the issuer of the corresponding financial instrument Specify available information about any known relations between the client/trading participant/counterparty and the issuer of the financial instrument (e.g., contractual relations, participation in ownership structure, connected person, access to insider information due to performance of official duties, etc.). SECTION 5. ADDITIONAL INFORMATION Any other information that the professional participant considers important for the STOR notification. Approximate list of information that may be important: information about the status or role of the person, order/transaction of which is suspicious, in capital markets (e.g.: qualified investor); nature of participation of the person, order/transaction of which is suspicious, in the submission/execution of the order/transaction (e.g.: in own name, by proxy); information about the person on whose behalf the suspicious order/transaction was submitted, if such a person exists; asset size of the person, order/transaction of which is suspicious; date of commencement of business relations with the person, order/transaction of which is suspicious, type of activity of the person, order/transaction of which is suspicious; nature of behavior in the capital market of the person, order/transaction of which is suspicious, including: normal behavior in the capital market regarding all financial instruments;

7 Continuation of Appendix 2 ratio of the price specified in the suspicious order/transaction to the average size of prices specified in orders/transactions executed/concluded over the last 12 months; normal behavior of the person over the last 12 months regarding the purchase/sale of securities of a specific issuer, including whether the suspicious order/transaction concerns exclusively such securities and affects their price, demand and/or supply. Information about other persons who may have a connection to the submission/execution of the suspicious order/transaction, specifying: full name/name of such persons and the nature of their participation in the submission/execution of the suspicious order/transaction. SECTION 6. APPENDICES This section specifies the list (description) of documents submitted together with this STOR notification. Such documents may include: emails, call recordings, copies of orders/transactions, investment firm reports, powers of attorney, media information, other data, etc. If the detailed information about other orders/transactions regarding the financial instrument specified in Section 2 is provided as a separate appendix, the name of such appendix must be specified in this section.

---

( signature of the authorized person 9 )

---

(surname, first name and patronymic (if any)) Notes: 1 – filled in accordance with Reference Book 44 "List and Codes of Territories (Regions) of Ukraine" Reference Systems and Classifiers. 2 – filled in accordance with Reference Book 45 "Classification of Countries of the World" of Reference Systems and Classifiers. 3 – filled in accordance with Reference Book 12 "Types of Professional Activity in Capital Markets and Organized Commodity Markets" of Reference Systems and Classifiers. 4 – filled in accordance with Reference Book 57 "Types of Organized Markets" of Reference Systems and Classifiers. 5 – filled in accordance with Reference Book 56 "Types of Professional Activity in Capital Markets - Activity in Organizing Trade of Financial Instruments" of Reference Systems and Classifiers. 6 – filled in accordance with Reference Book 15 "Types of Contracts in Activity in Trading Financial Instruments" of Reference Systems and Classifiers. 7 – filled in accordance with Reference Book 7 "Classification of Financial and Non-Financial Instruments" of Reference Systems and Classifiers. 8 – filled in accordance with Reference Book 25 "Trading Technologies" of Reference Systems and Classifiers. 9 – – this requirement does not apply in this document if submitted by an authorized person using an electronic signature or seal based on a qualified certificate of an open key in accordance with the requirements of legislation on electronic document management and electronic trust services.

8 Continuation of Appendix 2

---