PACRA Whistleblower Protection Policy

Sr. # Contents Page # 1 Objective 1 2 Applicability 1 3 PACRA Governance Culture 1 4 What May Constitute Misconduct 1 5 Blowing a Whistle | Process and Requirements 2 6 How Resolution is Achieved 2 7 Tasks 3 8 Policy Administration 3 9 Regulatory Framework 4 10 Whistleblowing Form | Annexure I 5 THE PAKISTAN CREDIT RATING AGENCY LIMITED Awami Complex, FB-1, Usman Block, New Garden Town Lahore Phone: +92 42 3586 9504 - 6 Web: www.pacra.com Approved by Chief Executive Officer Approval Date July 28, 2025 Effective Date July 28, 2025 Signing Authority

---

USMAN HAIDER Chief Executive Officer POLICY | WHISTLEBLOWER

The Pakistan Credit Rating Agency Limited POLICY | WHISTLEBLOWER PACRA POLICY Page 1 of 4 July 2025 www.pacra.com 1 OBJECTIVE 1.1 To frame and implement a whistleblower protection policy encouraging all employees to intimate the compliance officer of any unethical practice or misconduct relating to the rating, by another employee that came to his knowledge. 1.2 To monitor all instances of unethical practice or misconduct so as to: ▪ Promptly investigate, take appropriate steps against recurrence and suitable punitive action against the responsible employee(s) ▪ Ensure that all reported events are investigated promptly by the compliance officer ▪ Ensure that all investigations are completed within the time period specified in the policy 2 APPLICABILITY 2.1 This policy applies to all employees, including full time, part time, contractual employees and internees (regardless of length of service). 3 PACRA GOVERNANCE CULTURE 3.1 PACRA has a governance culture whereby all employees can seek advice and / or make a disclosure of any instance that they consider an unethical practice or misconduct. 3.2 PACRA ensures all whistleblowers that they shall be protected from any reprisal for making such a disclosure and their claims / concerns will be addressed in a confidential, speedy and respectful manner. 4 WHAT MAY CONSTITUTE “MISCONDUCT”? 4.1 A disclosure of misconduct revolves either around a perceived actual “misconduct” or a risk that such misconduct will occur. ▪ Differentiating Misconduct from Grievance: A grievance is a complaint about an employee’s own employment situation. In a disclosure of misconduct, the employee is a witness to a situation that, in the employee’s opinion, may harm others (colleagues, clients, company etc.), whereas, in grievances, the employee is the complainant to a development that may affect self only. 4.2 The objective of establishing whistleblowing procedures is to ensure that a centralized process exists that: ▪ Encourages employees to raise concerns internally regarding any unethical practice or misconduct relating to the rating ▪ Provides a direct and designated reporting channel for disclosures that may otherwise never be reported ▪ Ensures disclosures by whistleblowers are fairly and appropriately assessed and acted upon 4.3 Though it’s left to the judgment and perception of the whistleblower, the policy provides general guidelines on what clearly constitutes an unethical practice or Misconduct: ▪ Immoral / unethical behavior including discrimination and harassment ▪ Acts endangering someone’s health or safety or the work / general environment ▪ Acts endangering PACRA’s reputation / business interests ▪ Infractions of Regulatory Framework “Retaliation against any employee for reporting in good faith any such concern and / or instance of violation is strictly forbidden and will not be tolerated” PACRA Employee Code of Conduct

The Pakistan Credit Rating Agency Limited POLICY | WHISTLEBLOWER PACRA POLICY Page 2 of 4 July 2025 www.pacra.com ▪ Violations of PACRA Policies ▪ Violations of PACRA Codes of Conduct ▪ Wastage of resources of the organization; and ▪ Acts of concealment of information 5 BLOWING A WHISTLE - PROCESS & REQUIREMENTS 5.1 The concerns reported by the Whistle Blower should be factual and not speculative or in the nature of a conclusion and should contain as much specific information as possible to allow for proper assessment of the nature and extent of the concern. 5.2 PACRA whistleblowing process follows the following steps: 5.2.1 An employee comes across something that he / she perceives as an unethical practice or misconduct, in good faith and judgment (based upon his / her best understanding of PACRA Policies, Codes of Conduct and Regulatory Framework). ▪ It then becomes incumbent upon such employee to report this perceived misconduct as soon as possible 5.2.2 Where employee is of the view that the concern raised is serious due to involvement of senior management and has a significant adverse impact on the Company (including but not limited to serious fraudulent activities, criminal breach of trust and corruption), the matter shall be reported to the Board of Directors for their deliberation. 5.3 The employee (now a whistleblower) decides to blow the whistle and, in order to do so, fills the whistleblowing form. SEE: Whistleblowing Form 5.4 The whistleblowing form should reach both Chief executive Officer (CEO) and Compliance Officer, unless there is conflict of interest, through the designated Compliance Communication E-mail: compliance@pacra.com Provided that, where employee chooses to report the matter to Board of Directors, he may do so by way of a letter delivered either by post or email to Chairman of the Board. 5.5 An aspiring whistleblower may, for guidance and clarity purposes, consult the team leads and / or the senior management before actually blowing the whistle. When faced with such a consultation request, it is the express duty of the team Leads and senior management to make arrangements, without delay, to hear out the whistleblower in complete confidence and with care and respect. After considering the employee’s concern in the light of their own understanding of PACRA policies, codes of conduct and applicable law, the team leads and senior management may offer advice in good faith and unbiased judgment. 6 HOW RESOLUTION IS ACHIEVED? 6.1 The process to achieve resolution shall proceed as follows: i The Compliance Officer shall receive the whistleblower communication, conduct due diligence to establish the authenticity of the concern; while informing the Chief Executive Officer (CEO) that a concern has been voiced. ii In both case (the concern is found to be legitimate or unfounded), the Compliance Officer shall again proceed to inform the CEO. Under no circumstances can the Team Leads / Senior Management coerce the employee into not blowing the whistle

The Pakistan Credit Rating Agency Limited POLICY | WHISTLEBLOWER PACRA POLICY Page 3 of 4 July 2025 www.pacra.com iii The response to concern may be concluded based on findings of the Compliance Officer. However, if considered necessary by the CEO, he may constitute an investigation team which then begins the investigation. iv The name of the whistleblower shall remain secret and be known only to the individuals involved in process of investigation. It is incumbent upon all those involved in the investigation to maintain confidentiality in perpetuity (during and after their employment at PACRA) regarding the proceedings and developments, therein. v No information residing inside PACRA (including Confidential Information) is off-limits for such investigation - including discussions with other employee and review of internal records, files, computer data, financial information etc. vi The investigation shall be concluded no later than one (1) month after the receipt of the whistleblower concern. [Reference: CRC Regulations 2016; clause 11-(B)-(o)] vii The CEO decides and finalizes a resolution / remedy to the whistleblower’s concern. In case, the Board takes up a whistleblower concern, the resolution process, as introduced by the Board, would be followed. viii After conclusion of investigation, Whistleblowing Form is completed and the Compliance Officer shall inform the whistleblower of the outcome of the investigation. Investigation of a Whistleblower Concern Outcome Consequence Whistleblower PACRA Claim proven to be true No Reprisal Prompt remedial action to be implemented against reported Misconduct Claim proven to be unfounded but made in good faith No Reprisal _ Claim found to be malicious or otherwise made in bad faith Disciplinary Action (including termination) _ 7 TASKS 7.1 Whistleblower must use the whistleblower form to document the whistleblowing. 7.2 The investigation team is required to document the resolution/remedy, how it is implemented, and its likely impact on the whistleblowing form 8 POLICY ADMINISTRATION 8.1 Interpretation: Competent Authority is responsible for interpreting and applying the Policy to specific situations when questions arise. 8.2 Review: This Policy is subject to review as follows: Reviewed by Scope Frequency (Minimum) Regulation Compliance Officer Appropriateness & sufficiency Annual Chapter III | 11-B- (k)

The Pakistan Credit Rating Agency Limited POLICY | WHISTLEBLOWER PACRA POLICY Page 4 of 4 July 2025 www.pacra.com Firm of Chartered Accountants Actual vs. Policy Semi￾Annual Chapter III | 11-F- (g) 8.3 Policy Approval: This Policy is required to be approved by the board of directors. 8.4 Investigations of Suspected Violations: All reported violations shall be promptly investigated and treated confidentially to the extent reasonably possible. 8.5 Disciplinary Protocol: Compliance with all Codes of Conduct and PACRA Policies, including this Policy, is a condition for employment and failing to comply is considered a breach material enough to lead to termination. Compliance with the Codes and PACRA Policies shall be monitored on periodic basis: ▪ Those who come within the bounds of this Policy shall cooperate fully to provide truthful, accurate information Capitalized terms used herein are defined in PACRA Glossary. Moreover, current version of this policy is available on the website: www.pacra.com 9 REGULATORY FRAMEWORK 9.1 PACRA’s compliance to SECP’s regulatory requirements and IOSCO Code of Conduct in terms of Whistleblower Protection Policy is as follows: PACRA’s Compliance for Whistleblower Protection Policy CRC Regulations, 2016 Policy Reference Regulation Chapter III | 11-B-(i): A credit rating company shall frame and implement a whistle-blower protection policy encouraging all employees to intimate the compliance officer of any unethical practice or misconduct relating to the credit rating, by another employee of the credit rating company that came to his knowledge; Clause 1.1 Regulation Chapter III | 11-B-(m): A credit rating company shall promptly investigate, in the event of a misconduct or a breach of the policies, procedures and controls, and take appropriate steps to rectify any weaknesses to prevent any recurrence along with suitable punitive action against the responsible employee(s); Clause 1.2 Regulation Chapter III | 11-B-(n): A credit rating company shall ensure that all reported events are investigated promptly by the compliance officer in accordance with the provisions provided in the whistle-blower policy; and Clause 6.1 [(i),(ii),(iii)] Regulation Chapter III | 11-B-(o): A credit rating company shall ensure that all investigations are completed within the time period specified in the whistle-blower policy; Clause 6.1 (vi) Annexure H: (List of Policies to be developed & disclosed by a credit rating company / agency: Whistle blower Policy Policy developed & disclosed on website

The Pakistan Credit Rating Agency Limited ANNEXURE I | WHISTLEBLOWER The Pakistan Credit Rating Agency Limited [PACRA] Lahore | FB-1, Awami Complex, Usman Block, New Garden Town Karachi | 3rd Floor, PNSC Building, MT Khan Road +92 (42) 3586 9504 www.pacra.com WHISTLEBLOWING FORM STRICTLY CONFIDENTIAL Use the Tab key in order to move between fields. The Form may then be saved and printed or emailed Name Date of Complaint: To whom Addressed Compliance Officer Chief Executive Officer Board of Directors Do you wish your name to remain confidential as far as possible? YES NO Type of Misconduct: Immoral / unethical behavior including Discrimination and Harassment Acts endangering someone’s health or safety or the work / general environment Acts endangering PACRA’s reputation / business interests Infractions of Regulatory Framework Violations of PACRA Policies Violations of PACRA Codes of Conduct Details of Concern: Put in here a summary of your concern. You should say: (i) When did the concern arise; (ii) Whom is involved; (iii) How did the concern come to your knowledge; (iv) Details of your concern; (v) if there are other people who can verify your concern; and (vi) Any other details. Continue on a separate page if you wish.

The Pakistan Credit Rating Agency Limited ANNEXURE I | WHISTLEBLOWER The Pakistan Credit Rating Agency Limited [PACRA] Lahore | FB-1, Awami Complex, Usman Block, New Garden Town Karachi | 3rd Floor, PNSC Building, MT Khan Road +92 (42) 3586 9504 www.pacra.com While blowing a whistle, I fully understand that I am bound to: Appear before the Investigation Team and answer their questions as and when required Accept the possibility of disciplinary action including termination if my concern is found to be malicious or otherwise made in bad faith You send this form to the Compliance Officer. You will be contacted by the Compliance Officer, who will confirm the process to be followed and agree how you are to be contacted in future. Signature: ___________________________________________________ (Date): ______________________ Documentation This Section is to be completed by the Investigation Team and signed off by the CEO (i) What Resolution / Remedy was put in action? (ii) How the Resolution / Remedy was implemented? (iii) What is the likely impact?

---

USMAN HAIDER CHIEF EXECUTVE OFFICER IRAM TAHIR COMPLIANCE OFFICER