Securities Industry (Electronic Communications, Recordkeeping And Off-Channel Communications For The Securities Market) Guidelines, 2026

‘Ensuring Investor Protection’ SECURITIES AND EXCHANGE COMMISSION, GHANA SECURITIES INDUSTRY (ELECTRONIC COMMUNICATIONS, RECORDKEEPING AND OFF-CHANNEL COMMUNICATIONS FOR THE SECURITIES MARKET) GUIDELINES, 2026 SEC/GUI/001/09/2026

1 ARRANGEMENT OF GUIDELINES PART A — Preliminary:

1. Citation.
2. Application.
3. Objective and regulatory approach. PART B — Approved Communication Channels:
4. Duty to designate approved channels.
5. Classification of business communications.
6. Technology neutrality and channel eligibility.
7. Class II and III communications and Recognized Market Communication Platforms.
8. Prohibition of off-channel communications. PART C — Recognition of Market Communication Platforms:
9. Application for recognition.
10. Criteria and assessment.
11. Register, conditions and continuing obligations.
12. Designated Market Communication Facility.
13. Variation, suspension and withdrawal.
14. Review and representations. PART D — Recordkeeping and Retention:
15. Capture and retention.
16. Storage, security and integrity.
17. Data protection and cross-border storage. PART E — Governance and Accountability:
18. Compliance officer responsibility and attestation.
19. Personal devices.
20. Training, monitoring and surveillance.
21. Breach reporting.

2 PART F — Supervision, Enforcement and Transition: 22. Commission access and inspections. 23. Outsourcing and third-party providers. 24. Sanctions. 25. Transitional provisions and proportionality. PART G — General: 26. Referral of doubt. 27. Consent to record telephone communications 28. Effective date. PART H — Interpretation: 29. Interpretation. ANNEX A — Classes of Market Operator Undertaking Class III Business Communication. ANNEX B — Minimum Technical and Control Standards. Part I: All Approved Channels. Part II: Additional Standards for Recognised Market Communication Platforms. ANNEX C — SEC Form RMCP-1.

3 SECURITIES AND EXCHANGE COMMISSION, GHANA In the exercise of the powers conferred on the Securities and Exchange Commission by sections 3 and 209 of the Securities Industry Act, 2016 (Act 929), as amended by the Securities Industry (Amendment) Act, 2021 (Act 1062) and in order to give effect to the objectives of the Commission in protecting investors, ensuring fair, efficient and transparent markets and reducing systemic risk, these Guidelines are issued this on 4th day of September 2026. PART A — PRELIMINARY

1. Citation (1) These Guidelines may be referred to as the Securities Industry (Electronic Communications, Recordkeeping and Off-Channel Communications for the Securities Market) Guidelines,

(2) These Guidelines shall take effect on the effective date specified in clause 27, subject to the transitional provisions of clause 25. 2. Application (1) These Guidelines shall apply to; (a) the market operators listed under section 3 (c) of the Securities Industry Act, 2016 (Act 929), as amended from time to time; (b) virtual assets service providers under the Virtual Assets Service Providers Act, 2025 (Act 1154) and, (c) the directors, officers, employees, agents and associated persons of each operator when acting in their capacity as such (2) These Guidelines shall apply to all business communications regardless of the device, application, platform or network used and regardless of whether the device or account is owned by the market operator or a third party. (3) Part C and clause 7 apply additionally to any person that provides, or seeks to provide, a communication platform to market operators for the conduct of Class III communications, whether or not that person is established in Ghana. 3. Objective and regulatory approach (1) The purpose of these Guidelines is to ensure that all business communications by market operators are sent and received over approved channels that are capable of being captured,

4 retained, retrieved and supervised, such that a complete and reliable audit trail of regulated business exists and is available to the Commission. (2) Where a class of business communication carries elevated market-integrity risk, the Commission may prescribe a higher standard for that class. PART B — APPROVED COMMUNICATION CHANNELS 4. Duty to designate approved channels (1) A market operator shall adopt and maintain a board-approved electronic communications policy that; (a) designates the approved channels over which business communications may be conducted; (b) specifies the persons and activities to which each approved channel applies, by reference to the classification in clause 5; (c) identifies, for each Class III activity, the Recognised Market Communication Platform over which that activity is conducted; and (d) prohibits the conduct of business communications over all other channels. (2) A copy of the policy shall be filed with the Commission within six (6) months after the effective date of these Guidelines and within fourteen (14) days of any amendment. 5. Classification of business communications (1) Business communication shall fall within the following classes; (a) Class I — a communication between relevant persons of the same market operator, or of the same group, that does not convey an order, an indication of interest, a price, an allocation or investment advice to a person outside the group, and includes any other business communication that does not fall within Class II or Class III; (b) Class II — a communication between a market operator and a client, prospective client or the general public, including advice, recommendations, order instructions received from a client, confirmations and complaints; and (c) Class III — a communication between a market operator and another market operator, a foreign counterparty, an issuer or an approved market infrastructure, which relates to; (i) the negotiation, solicitation, quotation or execution of a transaction in securities, including indications of interest, runs and dealing advice; (ii) pricing, allocation, or the terms of an issue or placement;

5 (iii) the submission, amendment, cancellation or settlement of an order or instruction to a securities exchange, securities depository, clearing and settlement facility; or (iv) material non-public information concerning an issuer or a transaction. (2) Class I and II communications may be conducted over any approved channel that satisfies Part I of Annex B. (3) Class III communications shall be conducted only over a Recognised Market Communication Platform, in accordance with clause 7. (4) Where a single communication falls into more than one class, the higher class applies. (5) Where a communication thread migrates into Class III, the relevant person shall continue that thread on a Recognised Market Communication Platform and shall procure that the earlier portion of the thread is captured and retained. (6) A communication of a market operator falls within Class III only where the operator is listed in Annex A of these Guidelines, and the communication engages a limb of subclause (1)(c) specified for that operator in Annex A. (7) A communication effected through the order-entry, trading, clearing, settlement or payment system of an approved market infrastructure or the Bank of Ghana, or through an authoritative financial messaging network used for the submission or settlement of transactions, is deemed to be conducted over an approved channel and, where the communication is a Class III communication, over a Recognized Market Communication Platform, provided that the system captures and retains a record of the communication in accordance with Part D. 6. Technology neutrality and channel eligibility (1) A market operator may designate any channel for use in Class I and II business communications, including commercially available compliance-grade messaging platforms, recorded telephony, archived electronic mail, or consumer messaging applications configured with a compliant capture and archiving solution, provided that the specific channel, as deployed by the operator, satisfies each applicable standard set out in Part I of Annex B. (2) The Commission may from time to time publish a list of commercially available platforms and capture solutions which it has determined are capable of meeting the standards in Part I of Annex B when properly configured. Such list shall be published by the Commission and updated periodically. Inclusion on the list does not imply endorsement by the Commission, and use of a listed platform or solution does not absolve an operator from its obligations under these Guidelines or from liability for non-compliance. (3) The determination of compliance is made by reference to how the channel is configured and deployed by the market operator, and not by reference to the identity of its provider.

6 7. Class III communications and Recognized Market Communication Platforms (1) A market operator to whom these guidelines apply shall not conduct a Class III communication otherwise than over a platform entered in the register of Recognized Market Communication Platforms maintained under clause 11. (2) Where more than one platform is recognized, a market operator is free to select among them, and may use more than one. (3) A market operator shall not be required, as a condition of access to an approved market infrastructure, to use a particular recognized platform, save where a Designated Market Communication Facility has been designated under clause 12. (4) A market operator remains responsible for compliance with these Guidelines notwithstanding that a communication was conducted over a recognized platform. 8. Prohibition of off-channel communications (1) A market operator shall not initiate or continue business communication over a channel that has not been designated as an approved channel by the operator, or, in the case of a Class III communication, over a channel that is not a Recognized Market Communication Platform. (2) Where a relevant person receives a business communication over a channel that is not an approved channel, the person shall, as soon as practicable; (a) transfer the communication to an approved channel; and (b) copy or forward the received communication into the operator’s recordkeeping system so that the communication is retained in accordance with these Guidelines. (3) An operator shall inform its clients and counterparties of the prohibition in subclause (1) and shall not solicit business communications or instructions through non-approved channels. A business communication received through a non-approved channel shall be dealt with in accordance with subclause (2), and no instruction so received shall be acted upon until it has been transferred to an approved channel and captured. PART C — RECOGNITION OF MARKET COMMUNICATION PLATFORMS 9. Application for recognition (1) A person that provides, or proposes to provide, a communication platform for the conduct of Class III communications may apply to the Commission for recognition of that platform as a Recognized Market Communication Platform. (2) An application shall be made in SEC Form RMCP-1 set out in Annex C and shall be accompanied by; (a) a description of the platform’s architecture, identity model, encryption and key-custody model, retention model and export interfaces;

7 (b) an independent assurance report, addressed to or capable of reliance by the Commission, on the platform’s controls against Parts I and II of Annex B, issued within the preceding twelve (12) months by an assurance provider acceptable to the Commission; (c) the undertakings required by clause 11(3); (d) its published fee schedule and the terms on which sponsored or entitled access is offered; and (e) the prescribed application fee. (3) The Commission shall determine an application within ninety (90) days of receipt of a complete application and shall give written reasons for a refusal. 10. Criteria and assessment (1) The Commission shall recognise a platform where it is satisfied that the platform, as offered to market operators in Ghana, is capable of meeting each standard in Part I and Part II of Annex B. (2) In assessing an application the Commission shall consider — (a) the integrity and immutability of the record, and in particular whether any single party, including the provider, is able unilaterally to destroy, alter or render inaccessible a retained record; (b) the reliability of counterparty identity attestation across institutions; (c) the enforceability of the Commission’s supervisory access, having regard to the law of any jurisdiction in which the provider or its data is located, including any foreign blocking statute, sanctions regime or state-access regime; (d) concentration, resilience and exit risk for the Ghanaian market taken as a whole; (e) the affordability and non-discriminatory availability of access to market operators of differing size; (f) the platform’s support for interoperability with other communication platforms; and (g) any other criteria the Commission may consider applicable. (3) The Commission shall not have regard to the nationality or ownership of an applicant except to the extent relevant to paragraph (2)(c).

8 11. Register, conditions and continuing obligations (1) The Commission shall maintain and publish a Register of Recognised Market Communication Platforms, stating for each platform the date of recognition, the classes of communication for which it is recognised, and any conditions attached. (2) Recognition may be granted subject to conditions, including conditions as to key custody, data location, capacity, fee transparency and reporting to the Commission. (3) A recognised provider shall give and maintain written undertakings to the Commission that it will — (a) submit to the jurisdiction of the courts of Ghana in respect of the operation of the platform in Ghana, and maintain an agent for service of process in Ghana; (b) not exercise, and not enable any person to exercise, a capability to delete or alter a retained record within the retention period specified in clause 15(2); (c) provide records, on the lawful request of the Commission through the relevant market operator, and not invoke any contractual restriction, foreign blocking statute or other impediment so as to defeat clause 17(2)(c); (d) notify the Commission within two (2) business days of any incident materially affecting the security, integrity or availability of the platform or of records held on it, and of any material change to its ownership, control, architecture or key-custody model; (e) publish its fee schedule and offer access on fair, reasonable and non-discriminatory terms; (f) provide, on termination, data portability and an orderly exit over a period of not less than twelve (12) months; (g) submit an annual independent assurance report in the form required by clause 9(2)(b); and (h) cooperate with any inspection, investigation or surveillance by the Commission concerning the operation of the platform in Ghana, including by providing records in accordance with paragraph (c). (4) A market operator shall procure that its contract with a recognised provider is not inconsistent with the undertakings in subclause (3). 12. Designated Market Communication Facility (1) Where the Commission is satisfied that the orderly functioning of the market would be materially improved by the use of a single common communication facility across the market, the Commission may designate a Recognised Market Communication Platform as the Designated Market Communication Facility for such classes of communication as it may specify.

9 (2) A designation under subclause (1) may be made only where — (a) the facility has first been selected through an open, competitive and transparent process; (b) the Commission has published a cost-benefit assessment, including the effect on all market operators, and has conducted a public consultation of not less than sixty (60) days; (c) the facility has given the undertakings in clause 11(3) and has additionally undertaken to price on a published, cost-related and non-discriminatory basis for the duration of the designation; and (d) the designation may be for a fixed term not exceeding five (5) years and is subject to renewal on expiry. (3) A designation does not prevent a market operator from also using another recognised platform for communications outside the designated classes. 13. Variation, suspension and withdrawal (1) The Commission may vary the conditions of, suspend or withdraw a recognition or designation where the provider no longer meets a standard in Annex B, has breached an undertaking, or where continued recognition or designation would be prejudicial to the integrity of the market or the interests of investors. (2) Save where the interests of investors require immediate action, the Commission shall give the provider not less than thirty (30) days’ notice and an opportunity to make representations. (3) On withdrawal of a recognition or designation, the Commission shall specify a migration period of not less than six (6) months during which affected market operators shall transition. (4) The provider shall continue to preserve and produce records for a period of seven (7) years notwithstanding the withdrawal. 14. Review and representations An applicant or provider aggrieved by a refusal, condition, variation, suspension or withdrawal under this Part may, within thirty (30) days, apply to the Commission for a review of the decision, and thereafter may pursue such rights of appeal as are available under the Act. PART D — RECORDKEEPING AND RETENTION 15. Capture and retention (1) A market operator shall capture and retain a complete and accurate record of all business communications conducted over approved channels, including all message content, attachments, voice recordings where applicable, and all associated metadata, including sender, recipients, date, time sent and channel used.

10 (2) Records shall be retained in a durable and tamper-evident manner for not less than seven (7) years from the date of the communication, or for such longer period as the Commission may specify in connection with an investigation or other proceeding. (3) Records required to be retained under these Guidelines that are less than two (2) years old shall be retrievable and producible to the Commission within forty-eight (48) hours of request, or such period as the Commission may specify. Records older than two (2) years shall be producible within five (5) business days or such period as the Commission may specify. 16. Storage, security and integrity (1) Records shall be stored in a manner that complies with the minimum technical standards specified in Part I of Annex B and, in the case of records held on a Recognised Market Communication Platform, Part II of Annex B, including encrypting records in transit and at rest, implementing role-based access controls and maintaining a complete audit trail of all accesses and administrative actions. (2) Deleting, altering or concealing a record required to be retained under these Guidelines, or using ephemeral, auto-deleting or disappearing-message functionality to conduct business communications, is prohibited. (3) Where records are encrypted such that a third-party provider holds the sole means of decryption, the operator shall ensure that a duplicate of the decryption key is held by the operator or by an independent custodian not controlled by the provider, and shall in every case be able to produce a decrypted record to the Commission within the timelines in clause 15(3). 17. Data protection and cross-border storage (1) The capture and retention of communications under these Guidelines shall comply with the Data Protection Act, 2012 (Act 843) and Cyber Security Act 2020 (Act 1038), including registration with and oversight by the Data Protection Commission and Cyber Security Authority where required, lawful basis and notice requirements in respect of relevant persons, and the implementation of appropriate safeguards for personal data. (2) Where records are stored with a cloud service provider or other third-party vendor, including a vendor located outside Ghana, the operator must ensure that — (a) the records are within the effective control of the operator and its agents at all times; (b) the records are available from Ghana at all times and may be produced to the Commission within the timelines specified in clause 15(3); and (c) the arrangement does not prevent or otherwise restrict the Commission’s supervisory access at any time by contractual restriction, foreign blocking statute or otherwise.

11 PART E — GOVERNANCE AND ACCOUNTABILITY 18. Compliance officer responsibility and attestation (1) A market operator shall designate a compliance officer in accordance with the Securities Industry (Conduct of Business) Guidelines, 2020, who shall be responsible for oversight of and compliance with these Guidelines. The designation shall not relieve the board or any officer of the operator from responsibility. (2) The compliance officer designated under subclause (1) shall, annually by 31 January in respect of the preceding calendar year, attest to the Commission, in the form prescribed and published by the Commission, that, to the best of the compliance officer’s knowledge, the market operator’s approved channels, classification of communications under clause 5, methods of capture, retention arrangements and monitoring programme comply with these Guidelines, and shall disclose all exceptions. 19. Personal devices (1) A market operator shall not allow business communications to be sent or received on a personal device unless the device uses a containerised or managed application through which business communications are captured into the recordkeeping system of the operator on the same basis as a device owned by the operator. (2) A market operator’s policy shall address inspection of business applications on personal devices for compliance purposes, including appropriate safeguards for personal data not subject to these Guidelines. 20. Training, monitoring and surveillance (1) A market operator shall train all relevant persons on its policies and these Guidelines upon recruitment and at least annually thereafter, and shall keep records of such training. (2) A market operator shall implement a documented, risk-based monitoring programme that includes — (a) sampling of retained communications; (b) periodic verification, including device-level sampling, that business communications are not being sent over non-approved channels, and that Class III communications are not being conducted otherwise than over a Recognised Market Communication Platform; and (c) disciplinary procedures for policy breaches.

12 21. Breach reporting (1) A market operator shall report any breach of these Guidelines, including any failure of capture or retention systems or any identified pattern of off-channel communications, to the Commission within five (5) business days of becoming aware of any breach, together with a remediation plan. (2) Prompt, voluntary disclosure and effective remediation shall be considered by the Commission as mitigating factors for the purposes of any enforcement action. PART F — SUPERVISION, ENFORCEMENT AND TRANSITION 22. Commission access and inspections A market operator shall produce records in its possession or control in accordance with these Guidelines, in a machine-readable and searchable format within the timelines provided in clause 15(3), and shall permit the Commission access to its communication systems and archives in the course of any inspection or investigation under the Act. 23. Outsourcing and third-party providers (1) A market operator who uses a third party to capture, archive or store records on its behalf shall remain responsible for compliance with these Guidelines. (2) An outsourcing arrangement shall preserve the Commission’s rights of access, provide for data portability and an orderly exit, and shall require the vendor to notify the market operator of any incident affecting the security, integrity or availability of records. 24. Sanctions (1) Where a person breaches or fails to comply with these Guidelines, the Commission may — (a) take action set out in section 118, 122 or 123 of the Securities Industry Act, 2016 (Act 929); (b) impose an administrative penalty of not less than fifty penalty units and not more than twenty thousand penalty units; or (c) apply clause 13(1) where the Commission considers it necessary. (2) The Commission may, in addition, impose any administrative penalty that it considers necessary or take any other remedial action that it considers appropriate in the interests of protecting investors and the integrity of the securities market. (3) Sections 206 and 209(4) to (12) of Act 929 as amended shall also apply in addition to the above in dealing with offences.

13 (4) A person ordered to pay an administrative penalty under these Guidelines shall pay the penalty to the Commission within seven (7) days, or such further period as the Commission may specify by notice, after the order has taken effect. 25. Transitional provisions and proportionality (1) A market operator shall comply with these Guidelines within six (6) months after the effective date. (2) During the transitional period a market operator shall not implement any new channel that does not comply with these Guidelines and shall preserve all existing communication records until they are successfully migrated to the market operator’s recordkeeping system. PART G — GENERAL 26. Referral of doubt (1) Where any doubt arises as to the meaning of any provision contained in these Guidelines, such doubt shall be referred to the Commission for clarification and such interpretation made by the Commission shall be final and binding. (2) Where the Commission agrees to waive the full application of any part of these Guidelines, it shall specify alternative measures in place of full application of the Guidelines. 27. Consent to record telephone communications (1)A market operator shall seek the consent of a party to record telephone communications. (2) For the purposes of sub-clause (1), a party consents to the recording where; (a) the party has agreed in writing, including in a client agreement or terms of business, that telephone communications with the market operator may be recorded; or (b) the party is informed, at the outset of the communication, that the communication is being recorded and the purpose of the recording, and proceeds with the communication. (3) An employee, agent or contractor of a market operator is taken to have consented under sub￾clause (1) where the market operator's electronic communications policy required under clause [policy clause] provides for the recording of telephone communications on the operator's systems and has been brought to the person's notice. (4) Where a party withholds or withdraws consent, the market operator shall not conduct, or continue to conduct, a Class III communication with that party by telephone and shall direct the party to an approved channel.

14 28. Effective date These Guidelines shall take effect on the 4th day of September 2026 and shall continue in force until amended, varied, revised or revoked. PART H — INTERPRETATION 29. Interpretation In these Guidelines, unless the context otherwise requires; "Approved channel" means any communication channel capable of being captured, retained and supervised which has been designated by a market operator under clause 4 and which satisfies the minimum technical standards specified in Part I of Annex B; "Business communication" means any communication sent or received by a relevant person in connection with the regulated activities of the market operator, including communications relating to client orders, advice or recommendations, negotiations, prices, allocations or dealing advice, research reports or complaints, whether or not the communication results in a transaction and regardless of whether the recipient is another relevant person, a client or the Commission but does not include — (a) a communication of a purely administrative, logistical or personal character that contains no substantive content relating to a regulated activity, including the mere arranging of a meeting or call; (b) an automated system notification that duplicates a record already captured and retained under these Guidelines; or (c) unsolicited material received from a person outside the operator to which no substantive business response is made; provided that communication is not excluded merely because it is framed in administrative terms, and in case of doubt a communication shall be treated as a business communication; "Class I communication, Class II communication and Class III communication" have the meanings given in clause 5(1); "Designated Market Communication Facility" means a Recognised Market Communication Platform designated under clause 12; "Durable and tamper-evident manner" means a method of storage that does not allow a record to be altered, overwritten or deleted without detection for the period of time required by these Guidelines, whether through write-once storage media or through a complete time-stamped audit trail of every modification to the record; "Electronic communication" means any communication made by electronic means including electronic mail, instant messaging, chat, SMS, voice or video calls, social media messaging, web collaboration platforms or any other functionally equivalent medium;

15 “Market operator” means a person licensed, approved or registered as a market operator under the Securities Industry Act, 2016 (Act 929) and, for the purposes of these Guidelines, includes a virtual assets service provider licensed under the Virtual Assets Service Providers Act, 2025 (Act 1154); “Metadata” means all data generated by, or attached to, a business communication that describes its transmission, handling, or lifecycle, as distinct from its substantive content and captured automatically at the point of communication and retained with the same integrity as the message itself. "Off-channel communication" means a business communication that is sent or received, in whole or in part, over a channel that has not been designated as an approved channel by the market operator, or, in the case of a Class III communication, over a channel that is not a Recognised Market Communication Platform; "Recognised Market Communication Platform" means a communication platform entered in the Register maintained under clause 11(1); "Relevant person" means any director, officer, employee, agent or associated person of a market operator when acting within the scope of their employment or agency relationship; ISSUED BY ORDER OF THE SECURITIES AND EXCHANGE COMMISSION DATED: 4TH SEPTEMBER 2026

16 ANNEX A CLASSES OF MARKET OPERATOR UNDERTAKING CLASS III BUSINESS COMMUNICATION This Annex identifies, for each class of operator to which the Guidelines apply under clause 2(1), the Class III limbs in clause 5(1)(c) engaged and the basis of inclusion. Operator class Class III limbs Broker-dealers (i), (ii), (iii), (iv) Primary dealers and Primary dealer (Others) (i), (ii) Fund managers (including managers of unit trusts, mutual funds, hedge, private equity and venture capital funds) (i), (ii), (iv) Issuing houses, underwriters and sponsors (ii), (iv) Investment advisers (i), (iv) Custodians (iii) Trustees (iii), (iv) Nominees (iii) Virtual asset service providers (i), (ii), (iii)

17 ANNEX B — MINIMUM TECHNICAL AND CONTROL STANDARDS PART I — STANDARDS APPLICABLE TO ALL APPROVED CHANNELS Every approved channel must satisfy each of the following standards. Compliance is determined by reference to how the channel is configured and deployed by the market operator. A.1 Capture — The channel shall automatically capture the entire content of every business communication together with its metadata and shall not rely on users to forward records into a capture system. A.2 Retention integrity — Captured records shall be written to storage in the durable and tamper￾evident manner required by clause 15(2). Any deletion or alteration of records during the required retention period shall be logged in an auditable trail. A.3 Retrievability — Records shall be indexed, searchable and readily retrievable by participant, user, date range, keyword, instrument and other relevant identifiers. Records shall include associated metadata, attachments and relevant communication context and be exportable in a machine-readable format. A.4 Security — Communications shall be encrypted in transit and at rest. Access shall be controlled through role-based permissions, least-privilege principles and multi-factor authentication. Administrative and privileged activities shall be logged and protected against unauthorized alteration. A.5 Identity — Users shall be individually identified and authenticated. Shared, group-based, or anonymous accounts must not be used for business communications. User access shall be appropriately created, modified and revoked when roles or employment status change. A.6 No ephemeral functionality — Disappearing-message, auto-delete, message-editing￾without-history features and self-destructing functionality shall not be used for business communications. Editing, recall or deletion shall not occur without preserving the original communication and associated metadata and an auditable record of the subsequent action. A.7 Availability and recovery — The channel and associated archive shall meet documented availability, backup and disaster-recovery standards, including appropriate Recovery Point Objectives (RPO) and Recovery Time Objectives (RTO). Backup and restoration arrangements shall be periodically tested, and records must be recoverable following an operational disruption. The channel shall be deployed on high-availability infrastructure with documented availability objectives appropriate to the classes of communication carried. A.8 Supervisory access — Retained records, including relevant metadata and attachments, shall be capable of retrieval and production to the Commission by the market operator within the timelines in clause 15(3), and that capability shall not depend on the continued cooperation or solvency of the provider. The market operator shall provide timely access for supervisory,

18 inspection, investigation and enforcement purposes. Regulatory access does not limit the operator's own compliance monitoring. A.9 Data protection — The operator’s deployment shall comply with the Data Protection Act, 2012 (Act 843) and, where records are stored outside Ghana, with clause 17(2). A.10 Vendor resilience — Where the platform is provided by a third party, the operator shall assess vendor concentration risk, exit risk and data-portability risk, and document its contingency arrangements. PART II — ADDITIONAL STANDARDS FOR RECOGNISED MARKET COMMUNICATION PLATFORMS A platform seeking recognition under Part C shall satisfy every standard in Part I and, in addition, each of the following;. B.1 Federated identity across institutions — The platform shall maintain a verified identity framework that links each user to both a verified natural person and a verified legal entity, such that a market operator can establish, without out-of-band verification, the institutional affiliation of a counterparty with whom it is communicating. B.2 Closed community — The platform shall enforce a closed-network architecture in which access is restricted to authenticated and verified users or entities. Any integration or gateway to public or consumer messaging networks must be separately configurable, fully auditable, and subject to communication capture and retention controls. Such integrations must not allow unverified participants to access, join, or participate in Class III communications. B.3 Divided control of the record — The platform shall employ distributed cryptographic key custody to ensure that no single party can independently decrypt, destroy, or render retained records unavailable. The provider must not hold a unilateral decryption capability over a market operator’s content, and the market operator shall not hold a unilateral destruction capability over it. Duplicate key custody with an independent custodian satisfies this standard. B.4 No provider-side deletion — The platform must not offer, and the provider must not be technically able to exercise, any guaranteed-deletion, data-expiry or content-purge capability in respect of records within the retention period in clause 15(2). Any such feature must be incapable of activation for Ghanaian market operators. B.5 Surveillance and export — The platform shall provide a secure, open, and fully documented Application Programming Interface (API) or equivalent integration mechanism that enables

19 market operators and their authorized surveillance system to access and export all retained communications records and associated metadata in a structured, machine-readable format, in real time or near real time, without requiring provider approval. The interface must use non-proprietary formats and support independent analysis, monitoring, and archival. B.6 Interoperability — The platform shall support interoperable message exchange with other Communication Platforms, so that reachability of a counterparty does not depend on both parties subscribing to the same provider. B.7 Sponsored and entitled access — The platform must offer a mechanism by which a subscribing market operator may enable a non-subscribing counterparty, issuer or smaller operator to communicate with it on the platform, on terms that do not require the non-subscriber to purchase a full licence, and with the record captured to the same standard. B.8 Ghana nexus and enforceability — The provider must give the undertakings in clause 11(3), including submission to the jurisdiction of the courts of Ghana and an agent for service of process, and must demonstrate that no law of a jurisdiction in which it or its data is located would prevent compliance with clause 17(2)(c). B.9 Resilience, service levels and exit — The provider must publish availability and recovery objectives, evidence testing against them, and contract for a data-portability and exit period of not less than twelve (12) months in a non-proprietary format. B.10 Fee transparency and non-discrimination — The provider must publish its fee schedule and offer access on fair, reasonable and non-discriminatory terms, and must not differentiate on price or functionality between market operators otherwise than by reference to objective and published criteria. B.11 Access by the Commission- The Commission shall have real-time access to the platform at all times. B.12 Independent assurance — The provider must submit an annual independent assurance report on the design and operating effectiveness of the controls supporting standards B.1 to B.10.

20 ANNEX C — SEC FORM RMCP-1 APPLICATION FOR RECOGNITION AS A MARKET COMMUNICATION PLATFORM PART 1 (1) Applicants legal name……………………………………… (2) Jurisdiction of incorporation………………………………. (3) Registered office……………………………………………. (4) Ultimate beneficial ownership and any shareholder holding ten percent (10%) or more of the shares or voting rights of the applicant………………………………………………………………………… (5) Agent for service of process in Ghana………………………………………………. (6) Name of Applicant Contact Person ………………………………………………… (7) Email ……………………………………………………………………………… (8) Contact ……………………………………………………………………………. (9) Website ………………………………………………………………………………. (10) Regulatory status in home jurisdiction………………………………………… (11) Any regulatory action taken against the applicant in the preceding five (5) years…………………………………………………………………………………….. PART 2 (1) Platform name and version………………………………………………………….. (2) Identity and directory model (B.1)…………………………………………………………………………………… (3) Community model and any consumer-network bridge (B.2)………………………………………………………………………………….. (4) Encryption and key-custody model (B.3)…………………………………………………………………………………. (5) Confirmation of the absence of provider-side deletion capability (B.4)……………………………………………………………………………………. (6) Export and surveillance interfaces (B.5)……………………………………………………………………………………

21 (7) Interoperability position or roadmap (B.6)……………………………………………………………………………………. (8) Sponsored-access mechanism and terms (B.7)……………………………………………………………………………………. (9) Business continuity and disaster recovery plan (attach) (10) Application Programming Interface documentation (attach) (11) Architecture summary (attach) PART 3 GHANA OPERATIONS (1) Proposed data location……………………………………………………………………. (2) Legal analysis of impediments to clause 17(2)(c) access, supported by an opinion of counsel qualified in each relevant jurisdiction………………………………………………………………………………… … (3) Resilience and exit arrangements (B.9)……………………………………………………………………………………… …. (4) Published fee schedule and indicative cost per seat for a market operator of each size band (B.10)………………………………………………………………………………………. . PART 4 Assurance: independent assurance report under clause 9(2)(b); summary of control exceptions and remediation. PART 5 Undertakings: the undertakings required by clause 11(3), executed by a duly authorised officer. PART 6 Declaration: declaration as to the accuracy and completeness of the application, and disclosure of any relationship, financial or otherwise, between the applicant or its affiliates and any officer,

22 employee, consultant or Commissioner of the Commission, or any market operator or approved market infrastructure in Ghana. ………………………………………… …………………………… NAME OF AUTHORIZED OFFICER SIGNATURE ………………………………………… DESIGNATION