Treatment of Confidential Information by PACRA and Its Employees

Sr. # Contents Page # 1 Objective 1 2 Applicability 1 3 Confidential Information 1 4 Safeguards 1 5 Authorized Use of Confidential Information 3 6 Compelled Disclosure of Confidential Information 4 7 Selective Disclosure of Confidential Information 4 8 Non-Disclosure Agreement 4 9 Policy Administration 4 10 Regulatory Framework 5 11 Certification and Disclosure | Annexure I 7 12 Non-Disclosure Agreement | Annexure II 9 THE PAKISTAN CREDIT RATING AGENCY LIMITED Awami Complex, FB-1, Usman Block, New Garden Town Lahore Phone: +92 42 3586 9504 - 6 Web: www.pacra.com Approved by Chief Executive Officer Approval Date July 28, 2025 Effective Date July 28, 2025 Signing Authority

---

USMAN HAIDER Chief Executive Officer POLICY | TREATMENT OF THE CONFIDENTIAL INFORMATION BY PACRA & ITS EMPLOYEES

The Pakistan Credit Rating Agency Limited POLICY | TREATMENT OF THE CONFIDENTIAL INFORMATION BY PACRA AND ITS EMPLOYEES PACRA POLICY Page 1 of 6 July 2025 www.pacra.com 1 OBJECTIVE 1.1 To establish policies & procedures to ensure the protection of Confidential Information and prevent its misuse either by self or others. 1.2 To monitor confidential information in order to assess that the same is treated with due care so as to ensure its protection and prevent misuse. 2 APPLICABILITY 2.1 This policy is applicable on all employees and external RC members. 3 CONFIDENTIAL INFORMATION 3.1 PACRA becomes bound and binds all receiving parties by Non￾Disclosure Agreements to restrict the use of confidential information for the purpose for which it has been solicited and disclosed. What constitutes ‘Confidential Information’ for PACRA? ▪ All non-public information provided by the client ▪ Deliberations supporting a rating action ▪ Rating action prior to public dissemination (Exception: sharing rating and rating action with the client during the pre-publication issuer review1 ) ▪ Criteria / methodology change prior to public dissemination ▪ Proprietary models / programs, product designs, business plans ▪ All personal employee data Confidentiality status elapses as soon as such information is publicly disseminated 4 SAFEGUARDS 4.1 PACRA has put in place following measures to safeguard confidential information: 4.1.1 Segregation of Functions: PACRA has an organizational structure with separate functions - Ratings, Solutions, Business Development, Regulatory Affairs, Operations and Support. Each function-head takes reasonable measures to ensure that Confidential Information relevant to that particular function is protected. 4.1.2 Restrictions on Securities Investment & Trading: PACRA doesn’t permit holding or transacting in trading instruments presenting a conflict of interest. Restrictions described in detail in PACRA policy for Investment & Trading in Securities are imposed so that employees and other relevant parties do not use confidential information for procuring personal benefits. 4.1.3 Firewalls: PACRA ensures strong firewalls to prevent disclosure or use of Confidential Information by its personnel, related parties or their personnel in cases where PACRA is a parent, subsidiary, joint venture partner or affiliate of any organization that might benefit from the confidential information available with PACRA: 4.1.3.1 Business firewalls: PACRA has in place the following business firewalls: a. Ratings Business: PACRA refrains from providing rating services to: i. A company where any of its director (save such directors 1 Pre-publication Issuer Review is part of PACRA’s rating process whereby PACRA furnishes a copy of the Rating Report to the Client before Public Dissemination and publication of the report. The purpose of this process is to provide an opportunity to the Client to pinpoint any factual errors or any inadvertent disclosure of Confidential Information

The Pakistan Credit Rating Agency Limited POLICY | TREATMENT OF THE CONFIDENTIAL INFORMATION BY PACRA AND ITS EMPLOYEES PACRA POLICY Page 2 of 6 July 2025 www.pacra.com nominated by the Federal Government / Provincial Government / an institution which is directly or indirectly owned or controlled by the Federal / Provincial Government) is a substantial shareholder or is in any way interested in such company. An undertaking to the effect of absence of conflict of interest with any PACRA client is furnished by directors before each board meeting. ii. A company where a person directly or indirectly, holding more than 10% of share capital of PACRA also holds directly or indirectly 10% or more of the share capital. iii. Its own instruments. iv. Its associated companies and undertakings or the instruments issued by them except as explicitly provided in the CRC regulations. b. Non-Ratings Business: PACRA shall refrain from: Providing consultancy/advisory services or other services to any of its customers or to any of its customers’ associated companies and associated undertakings that is being rated or has been rated by it during the preceding three years unless it has adequate mechanism in place ensuring that provision of such services does not lead to a conflict of interest situation with its rating activities. [Ref 1: Policy for Non-Rating Services] [Ref 2: Policy for Disclosure of COI by Employees Annexure I - Client Acceptance Undertaking] 4.1.3.2 Organizational firewalls: i. Data firewalls: ▪ Access to data files is managed by IT Function and MIT function and every employee has rights and permissions to access data files as per specific role and function. ▪ Individual user ID & Passwords regarding access to MS Office 365 is created by IT Function. ▪ Individual user ID & Passwords regarding access to wizPAC is created by MIT Function. ▪ Employees have their own dashboards according to roles and portfolios assigned from where they can view and interact with the application. ▪ Formal code of conduct and corresponding policies are in place to govern behavior of the employees, compliance to which is a precondition of the employment. ▪ Reasonable physical and electronic data access restrictions are in place to channelize data and information flow only to legitimate users. ii. Ratings firewalls: ▪ Directors and shareholders have no involvement in the rating process. Directors provide an undertaking to this effect at the

The Pakistan Credit Rating Agency Limited POLICY | TREATMENT OF THE CONFIDENTIAL INFORMATION BY PACRA AND ITS EMPLOYEES PACRA POLICY Page 3 of 6 July 2025 www.pacra.com time of appointment. The chief executive officer being deemed director shall not be part of the Rating Committee (RC). [CRC Regulations 2016, 12-(2)-(a)] ▪ No such individual is appointed as a member of a rating committee who has or is perceived to have a business development role; or who initiates or participates in fee negotiations. [CRC Regulations 2016, 12-(2)-(c)] 4.2 General Safeguards: Confidential information obtained or developed in the course of the rating process may be relevant to non-rating services provided by PACRA or its associated Companies. This is especially relevant to the provision of non-rating products and services. In this context, confidential information safeguards are: i. Secondment Arrangements: Any secondment of human resources from PACRA ratings employees to a non-rating business or associated company and vice versa is governed as follows: ▪ No transfer of Confidential Information: The secondment arrangement is meant to capitalize upon the human resource expertise across rating / non-rating functions and Associated Companies. It does not breach any Non-Disclosure Agreement and no flow of confidential information occurs to facilitate information gathering, execution and completion of the underlying assignment. ▪ Abstinence Period: No rating employee / non-rating employee /and non-rating associated company employee would work on any non-rating / rating assignment concerning a client, who, within the past one year (1) year, has worked on that same client. 4.3 PACRA has made compulsory for each employee and External RC Member to undertake full compliance with Company’s applicable policies, guidelines, codes of conduct and other standard operating procedures developed and deployed from time to time. Undertaking developed in this regard has been attached as Annexure-I. 5 AUTHORIZED USE OF CONFIDENTIAL INFORMATION 5.1 The use of confidential information would only be for the purpose of execution of rating or non-rating assignments undertaken by PACRA. Hence, PACRA reserves the right to use confidential information in the manner described below: ▪ Use confidential information, or information and analysis derived therefrom, without seeking prior client approval, in publishing any rating opinion and sector study which incorporates confidential information; as long as such information has been disclosed in such a way that it is no longer identified as tied to any individual client. ▪ Disclose confidential information to external RC members / experts / consultants or any of the individual/company engaged by PACRA, bound by Non-Disclosure Agreement (NDA) to assist in any aspect of the operations.

The Pakistan Credit Rating Agency Limited POLICY | TREATMENT OF THE CONFIDENTIAL INFORMATION BY PACRA AND ITS EMPLOYEES PACRA POLICY Page 4 of 6 July 2025 www.pacra.com 6 COMPELLED DISCLOSURE OF CONFIDENTIAL INFORMATION 6.1 PACRA is committed to cooperate fully with appropriate investigations of the government of Pakistan, state departments / agencies, judicial inquiries and regulatory requests. 6.2 Notwithstanding anything in the foregoing to the contrary, PACRA also has legitimate and important interests to protect. Most notably, PACRA is bound by Non-Disclosure Agreements to its clients (through its rating agreement), whereby PACRA undertakes that all information, which the client does not desire to publicize (barring information that PACRA considers vital to disclose in public interest and that the Client may ask to conceal), will be kept confidential and will be used only in the rating process and internal analysis. 6.3 However, in case any confidential information is requested by the Regulators or any parties with an independent legal right to receive such information, PACRA makes such disclosure without any liability on its part. 7 SELECTIVE DISCLOSURE OF CONFIDENTIAL INFORMATION 7.1 Selective disclosure creates an uneven playing field for market participants, allowing some to profit from confidential information before others. PACRA explicitly prohibits selective disclosure. In case it comes to PACRA’s knowledge that a selective disclosure of the rating opinion has occurred by the client, PACRA, if required, promptly makes a public dissemination of the rating opinion, thus disclosed. 8 NON-DISCLOSURE AGREEMENT 8.1 All parties disclosing / receiving Confidential Information to / from PACRA sign Non-Disclosure Agreements. This agreement remains binding on both the disclosing and the receiving party for the entire duration of the agreement, mentioned therein. 8.2 Whenever PACRA enters into a rating agreement with its clients, it ensures Non-Disclosure of confidential information by way of following clause incorporated in Rating Agreement: PACRA shall, except as required under these regulations and without obtaining prior written approval of its CLIENT, not share with or disclose to media or any other party including its other clients, any confidential information about its CLIENT, which has come to its knowledge in the course of the rating process [Reference: CRC Regulations 2016; clause 11 (A) o]. 8.3 Non-Disclosure Agreement pertaining to Employees and External RC Members has been designed as per Annexure I of the Securities and Exchange Commission of Pakistan’s (SECP) Credit Rating Companies Regulations, 2016 and is titled “Non-Disclosure Agreement” (NDA) 8.4 If any customization / modification is required in Non-Disclosure Agreement, it shall be made in due consultation with the Competent Authority OR in response to any modification / revision put forth by SECP. Template of confidentiality agreements/Non-Disclosure Agreements (NDA) with employees and External RC Members has been disclosed over website and attached herewith as annexure II. 9 POLICY ADMINISTRATION 9.1 Interpretation: Competent Authority is responsible for interpreting and applying the policy to specific situations when questions arise. 9.2 Review: This Policy is subject to review as follows:

The Pakistan Credit Rating Agency Limited POLICY | TREATMENT OF THE CONFIDENTIAL INFORMATION BY PACRA AND ITS EMPLOYEES PACRA POLICY Page 5 of 6 July 2025 www.pacra.com Reviewed by Scope Frequency (Minimum) Regulation Compliance Officer Appropriateness & sufficiency Annual Chapter III | 11-B- (k) Firm of Chartered Accountants Actual vs. Policy Semi￾Annual Chapter III | 11-F- (g) 9.3 Policy Approval: This policy is required to be approved by the board of directors. 9.4 Investigations of Suspected Violations: All reported violations shall be promptly investigated and treated confidentially to the extent reasonably possible. 9.5 Disciplinary Protocol: Compliance with all codes of conduct and PACRA policies, including this policy, is a condition for employment. compliance with the codes and PACRA policies shall be monitored on periodic basis: ▪ Those who come within the bounds of this Policy shall cooperate fully to provide truthful, accurate information Capitalized terms used herein are defined in PACRA Glossary. Moreover, current version of this policy is available on the website: www.pacra.com 10 REGULATORY REQUIREMENTS 10.1 PACRA’s compliance to SECP’s regulatory requirements in terms of Treatment of the Confidential Information Policy is as follows: PACRA’s Compliance for Treatment of Confidential Information Policy CRC Regulations, 2016 Policy Reference Regulation Chapter III | 10-(5): No director, officer or employee of the credit rating company shall communicate the information, acquired by him for use for rating purposes, to any other person except where required under law to do so. Section 6 Regulation Chapter III | 10-7-(b): A credit rating company shall not hold or transact in trading instruments presenting a conflict of interest with credit rating company; Section 4 Regulation Chapter III | 10-7-(d): A credit rating company shall not disclose or discuss with outside parties or make improper use of the non-public information which has come to its knowledge during business relationship with the customer; Section 5 Regulation Chapter III | 11-A-(m): A credit rating company shall ensure strong firewalls to prevent disclosure or use of the said non-public information by the related parties or their personnel in cases where a credit rating company is a parent, subsidiary, joint venture partner or affiliate of any organization that might benefit from the non-public information available with the credit rating company; Section 4 | Clause 4.1.3

The Pakistan Credit Rating Agency Limited POLICY | TREATMENT OF THE CONFIDENTIAL INFORMATION BY PACRA AND ITS EMPLOYEES PACRA POLICY Page 6 of 6 July 2025 www.pacra.com Regulation Chapter III | 11-A-(n): A credit rating company shall formulate necessary code of conduct for its employees regarding handling of the non-public information which should contain as a minimum the requirements set out in Annexure I; 8.3 Regulation Chapter III | 11-A-(o): A credit rating company shall, except as required under these regulations and without obtaining prior written approval of its customers, not share with or disclose to media or any other party including its other customers, any confidential information about its customers, which has come to its knowledge in the course of the rating process; Section 8.2 Regulation Chapter III | 12-2-(a): The credit rating company shall ensure that directors on its board shall not be involved in the rating process and shall provide an undertaking to this effect at the time of appointment as directors on the board: Provided that CEO being deemed director shall not be be part of the rating committee. Section 4 | Clause 4.1.3.2 (ii) Regulation Chapter III | 12-2-(c): The credit rating company shall ensure that it has not appointed any individual as a member of a rating committee who has or is perceived to have a business development function of the credit rating company; or who initiates or participates in a discussion regarding fee or payment with any customer of the credit rating company; Section 4 | Clause 4.1.3.2 (ii) Regulation Chapter III | 12-2-(d): The credit rating company shall ensure that it shall not provide consultancy/advisory services or other services to any of its customers or to any of its customers’ associated companies and associated undertakings that is being rated or has been rated by it during the preceding three years unless it has adequate mechanism in place ensuring that provision of such services does not lead to a conflict of interest situation with its rating activities; Clause 4.1.3.1 (b) Annexure H: List of Policies to be developed & disclosed by a credit rating company / agency | Policy for treatment of confidential information Policy developed & disclosed on website

The Pakistan Credit Rating Agency Limited ANNEXURE I | TREATMENT OF THE CONFIDENTIAL INFORMATION BY PACRA AND ITS EMPLOYEES The Pakistan Credit Rating Agency Limited [PACRA] Lahore | FB-1, Awami Complex, Usman Block, New Garden Town Karachi | 3rd Floor, PNSC Building, MT Khan Road +92 (42) 3586 9504 www.pacra.com CERTIFICATION & DISCLOSURE CODES OF CONDUCT, PACRA POLICIES AND GUIDELINES Codes of Conduct PACRA Policies Guidelines ▪ Employees ▪ Rating Committee (RC) ▪ Board of Directors (BOD) Policies as Per Annexure H of CRC Regulations, 2016 ▪ Investment and trading in securities by employees of PACRA ▪ Whistleblower ▪ Charging Fee Relating to Credit Rating Services ▪ Review of Credit Ratings ▪ Solicited, Un-Solicited & Private Credit Ratings ▪ Withdrawal & Suspension of Rating ▪ Rotation of Analyst ▪ Announcement / Dissemination of Ratings ▪ Treatment of Confidential Information by PACRA and its Employees Internal Control Policies ▪ Disclosure of Conflict of Interest by Employees ▪ Disclosure of Conflict of Interest by Members of BOD ▪ Analyst Joining Rated Entity ▪ Related Party Transactions ▪ Business Continuity Plan ▪ Non-Rating Services ▪ Risk Management Systems and Controls ▪ HR Policy ▪ Analytical & Monitoring Standards ▪ Anti-fraud, Bribery & Corruption ▪ External Complaint Handling ▪ Retention of Records ▪ Rating Committee (RC) ▪ IT Security ▪ Trainings and Development ▪ Switch Ratings

1. I have reviewed all aforementioned Codes of Conduct & PACRA Policies, understand them, and agree to be bound by their terms and conditions
2. I have not violated any of the aforementioned Codes of Conduct & PACRA Policies
3. I am not aware of any suspected violations by others
4. I have duly signed the Non-Disclosure Agreement and agree to be bound by its terms and conditions
5. I, hereby disclose these transactions / events, (previously unreported) that appear to me in violation of the aforementioned Codes of Conduct & PACRA Policies:

(You may attach an extra sheet if required) Name: ______________________________________________ Title: _______________________________________________ Signature: ___________________________________________ Date (dd/mm/yy): _____________________________________ Hereafter, this certification is to be signed annually for the entire tenor of employment / engagement with PACRA

The Pakistan Credit Rating Agency Limited ANNEXURE II | TREATMENT OF THE CONFIDENTIAL INFORMATION BY PACRA AND ITS EMPLOYEES NON-DISCLOSURE AGREEMENT (NDA) Page 1 of 3 July 2025 www.pacra.com EMPLOYEE CODE OF CONDUCT NON-DISCLOSURE AGREEMENT (NDA) APPLICABILITY: EMPLOYEES 1 Definitions 1.1 Confidential Information: refers to all confidential or proprietary information disclosed or made available by PACRA (Pakistan Credit Rating Agency Limited) to the Employee in connection with the Company, its business, and its clients, along with other related matters. This includes, but is not limited to, business information, financial information, commercial information including client lists, legal status reports, marketing strategies, policy decisions, trade secrets, know-how, processes, and any other technical, business, financial, or project development information, whether oral, written, or electronic. 1.2 Confidential Information: with respect to rating process, Confidential Information includes, but is not limited to: i. All non-public information provided by the client. ii. Deliberations supporting a rating action. iii. Rating action prior to public dissemination (Exception: sharing rating and rating action with the client during the pre-publication issuer review). iv. Criteria / methodology change prior to public dissemination. v. Proprietary models / programs, product designs, business plans. vi. All personal employee data. 1.3 Non-public Information: includes all information classified as confidential or not available to the public, as per PACRA's policies and procedures. 1.4 Public Information: is information available in a legitimate manner (website dissemination, subscription etc.). For instance, all information on PACRA’s website is Public Information. Similarly, PACRA Press Release and Rating Report of a Public Rating is considered Public Information because it is available to everyone, though PACRA may charge for it. 2 Obligations of the Employee I agree and understand that I shall: i. Not share Non-public Information known to me due to my position at PACRA with outsiders and irrelevant employees not concerned with that rating. ii. Not use such Non-public Information for personal benefits or for the benefits of any of my relatives, friends and associates or for any other purpose except for the conduct of PACRA's business. iii. Not disclose any Non-public Information about rating opinions or possible future rating actions by PACRA, except to the rating entity/issuer or its designated agents. iv. Not disclose any Confidential Information about PACRA’s clients, which has come to my knowledge, in the course of the rating process to any person, including other clients and press, without prior written approval of such client, except when such disclosure is required under any law.

NON-DISCLOSURE AGREEMENT (NDA) Page 2 of 3 July 2025 www.pacra.com v. Not use or share Confidential Information for the purpose of trading in securities or for any other purpose except the conduct of PACRA's business. vi. Fully adhere to PACRA’s Policy for Investment and Trading in Securities by employees of PACRA. vii. Not disclose any Confidential Information on any social media platforms or otherwise, and acknowledge that posting any Confidential Information on social media is strictly prohibited. viii. Return and/or destroy all Confidential Information upon termination of employment or upon PACRA's written request. 3 Conflict of Interest I shall not participate or otherwise influence the determination of PACRA’s rating of any particular entity or instrument, if I: i. own securities of such entity, other than holdings in diversified collective investment schemes. ii. own securities of any entity related to such rated entity, where the ownership may cause or be perceived as causing a conflict of interest, other than holdings in diversified collective investment schemes. iii. have had recent employment (within the past one (1) year) or other significant business relationship with such rated entity that may cause or be perceived as causing a conflict of interest. iv. have an immediate relation (i.e., a spouse, parent, child, or sibling) who currently works for such rated entity. v. have or had any other relationship with such rated entity, directly or indirectly, that may cause or be perceived as causing a conflict of interest. 4 Self Disclosure I will disclose, before the commencement of the rating process, the relationship, if any, with the rating entity or any of its substantial shareholders and directors or any other interest in the entity to the Compliance Officer designated by PACRA. 5 Mandatory Restriction I agree, not to join any entity rated by me within one (1) year of relieving from PACRA. 6 Non-Circumvention I agree, not to engage in any conduct that circumvents or would circumvent the intent of this NDA or frustrate the business of PACRA in any manner. 7 Indemnity I agree to hold PACRA harmless and indemnify it from any liability, losses, damages, costs, expenses (including legal fees, court fees, and professional fees), suits, and claims resulting from any breach of this NDA by me.

NON-DISCLOSURE AGREEMENT (NDA) Page 3 of 3 July 2025 www.pacra.com 8 Term and Termination I agree, this NDA shall remain valid and binding during the entire period of employment with PACRA and for three (3) years after the termination of employment. The NDA shall be terminated after three (3) years from the date of termination of employment from PACRA. 9 Remedies I agree, that in the event of a breach of this NDA, PACRA shall have the right to terminate my employment and take any other action in accordance with its internal policies and procedures. Furthermore, in addition to any other legal remedies available, PACRA shall be entitled to seek injunctive relief to prevent or halt any actual or threatened breach of this NDA. Name: ______________________________________________ Title: _______________________________________________ Signature: ___________________________________________ Date (dd/mm/yy): _____________________________________