Borsa İstanbul Directive on Internal Control System and Due-Diligence Principles of Precious Metals Intermediary Institutions and Refineries (31.YON.04)

ARTICLE 1 – (1) The purpose of this Directive is to set down the procedures and principles aiming to ensure that precious metals intermediary institutions and refineries establish an effective and efficient internal control system, and to determine the qualifications and working procedures and principles of internal control and supply chain due-diligence officers employed under the Regulation on Operating Principles of Precious Metals Exchange Intermediary Institutions and on Foundation of Precious Metals Intermediary Institutions and The Communiqué Concerning Precious Metals Standards and Refineries, and to assure due- diligence of precious metals intermediary institutions and refineries with the Borsa İstanbul Responsible Supply Chain Due-Diligence Directive in respect of precious metals of high-risk regions affected from conflicts. (2) This Directive covers both the precious metals intermediary institutions, other than banks, being a member of Borsa İstanbul Precious Metals Market, and the refineries established in Türkiye and included in the Borsa İstanbul Refinery List. (3) However, in respect of internal control and supply chain due-diligence officers to be appointed in scope of this Directive, the provisions of the Prevention of Laundering Proceeds of Crime Prevention of Laundering Proceeds of Crime No. 5549 dated 11/10/2006, and the Regulation on Measures Regarding Prevention of Laundering Proceeds of Crime and Financing of Terrorism and the Regulation on Program of Due-diligence with Obligations of Anti-Money Laundering and Combating the Financing of Terrorism published in the Official Gazette numbered 26751and dated 09/01/2008 are reserved. ### Grounds

ARTICLE 2 – (1) This Directive is prepared and issued in reliance upon provisions of the Regulation on Operating Principles of Precious Metals Exchange Intermediary Institutions and on Foundation of Precious Metals Intermediary Institutions promulgated in the Official Gazette edition 26528 on 21/05/2007 and the Communiqué on Precious Metals Standards and Refineries (Communiqué no. 2006/1) promulgated in the Official Gazette edition 26350 on 18/11/2006. (2) Borsa İstanbul Responsible Supply Chain Due-diligence Directive, Borsa İstanbul Precious Metals Responsible Supply Chain Due Diligence Guideline, Borsa İstanbul Responsible Supply Chain Independent Audit Directive and Directive on Internal Control System and Due-diligence Principles of Precious Metals Intermediary Institutions and Refineries are as a whole the components of Borsa İstanbul precious metals responsible supply chain due-diligence program. ### Definitions and Abbreviations

ARTICLE 3 – (1) For the purposes and in the context of this Directive: a) “Ministry” stands for the Ministry of Treasury and Finance; and b) “Exchange” or “Borsa İstanbul” stands for Borsa İstanbul A. Ş.; and 4 /17 <!-- page 5 --> HALKA AÇIK c) “Training program” refers to a program in respect of training activities to be conducted by the obligors within their own organization and with their customers for the sake of due-diligence with Borsa İstanbul Responsible Supply Chain regulations within the frame of the Due-diligence Guideline; and ç) “CEO” stands for Borsa İstanbul A.Ş Chief Executive Officer; and d) “Assurance audit” refers to an audit conducted in accordance with Assurance Engagement Standard 3000 Assurance Engagements Other Than Independent Audit or Limited Internal Audit of Historical Financial Information published by the Public Oversight, Accounting and Audit Standards Agency; and e) “Internal control unit” refers to an organization unit responsible for formation, operation and reporting of internal control system; and f) “Internal control system” refers to an organization plan implemented by obligors, together with all and any principles and procedures relating thereto, with the intention of conduct of all business activities and affairs of obligors, also including their decentralized organization units, regularly, effectively and efficiently, in accordance with management strategies and policies, within the frame of the applicable laws, regulations and rules, and with a view to ensuring the integrity and reliability of accounting and recording systems and the acquisition of information in data system in a timely and accurate manner, and the formation, backup and safekeeping of documentation and recording system, and the prevention and detection of errors, frauds and corruptions; and g) “Internal control and supply chain due-diligence officer” refers to an officer having the minimum qualifications set down in this Directive, equipped by the required powers, and employed by precious metals intermediary institutions and refineries; and ğ) “Precious metals intermediary institution” refers to precious metals intermediary institutions, banks, authorized institutions, joint-stock companies engaged in production or trade of precious metals, and branches in Türkiye of the companies residing abroad, which are permitted by the Ministry to actively operate in the Exchange as a member, and deal with trading in their own name and account, or in the name and account of others, or in their own name and in the account of others, and the operating principles of which are regulated by a Regulation; and h) “Precious metals brokerage house” refers to companies established with the permission of the Ministry to actively operate in the Exchange, and deal with trading in their own name and account, or in the name and account of others, or in their own name and in the account of others, and founding and operating principles of which are regulated by a Regulation; and ı) “Qualified share” refers to shares which directly or indirectly constitute ten percent or more of a partnership’s capital or voting rights, and shares which grant the privilege of appointment of members to board of directors, even if they are below the aforementioned percentage; and i) “Refinery” refers to refineries established in Türkiye and included in the List of Refineries issued by the Exchange within the frame of the Communiqué and other related regulations of the Ministry; and j) “List of Refineries” refers to a list issued and announced by the Exchange about the refineries the bars, bullions and granules of which are tradable in the Exchange; and 5 /17 <!-- page 6 --> HALKA AÇIK k) “Communiqué” stands for the Communiqué Concerning Precious Metals Standards and Refineries (Communiqué no. 2006/1) promulgated in the Official Gazette edition 26350 on 18/11/2006; and l) “Supply chain due-diligence program” refers to a set of actions and measures specified in Article 8 of this Directive, aiming to make sure that precious metal supply operations are carried out respectfully towards human rights and in such manner to avoid any undesirable effects to regional conflicts and financing of terrorism and laundering proceeds of crime in the precious metal supply process; and m) “Supply chain due-diligence report” refers to a report which is prepared within the procedures and principles regarding precious metals responsible supply chain as determined by the Exchange according to international criteria with a prior consent of the Ministry, and which indicates the due-diligence of all operations covering the related reporting period with the aforesaid procedures and principles; and n) “Due-diligence” refers to a continuous proactive and reactive process which enables the obligors to detect, identify, prevent, mitigate, and account for, actual and potential negative effects of their business operations and supply systems as an integral part of their commercial decision making and risk management systems, and to carry out all of their business operations in accordance with the Regulation, the Communiqué and other related applicable laws and regulations; and o) “Due-diligence Unit” stands for an organization unit which is responsible for conduct of activities required for due-diligence with the precious metals responsible supply chain regulations; and ö) “Due-diligence Guideline” stands for Borsa İstanbul Precious Metals Responsible Supply Chain Due-diligence Guideline; and p) “Country risk” refers to the risk that may be exposed to by members and refineries due to and in the course of their business relations or trades with nationals, companies and financial institutions of countries, as will be announced by the Ministry, which do not have adequate regulations in respect of prevention of financing of terrorism and laundering of criminal revenues within the frame of the principles regarding precious metals responsible supply chain as determined by the Exchange according to international criteria thereof and do not enter into cooperation at an adequate level for fight against said offences or are accepted and categorized as risky by the authorized international organizations; and r) “Member” refers to precious metals intermediary institutions duly authorized by the Exchange to trade in the Precious Metals Market from among institutions mentioned in first paragraph of Article 24 of the Regulation on Foundation, Activity, Working and Audit Principles of Exchanges and Market Operators promulgated in the Official Gazette edition 28712 on 19/07/2013; and s) “Regulation” stands for the Regulation Concerning the Principles of Operations of Precious Metals Exchange Intermediary Institutions and Foundation of Precious Metals Brokerage Houses promulgated in the Official Gazette edition 26528 on 21/05/2007; and ş) “Obligor/Obligors” refers to both precious metals intermediary institutions that are members of the Exchange holding an operating license received pursuant to the Regulation on Operating Principles of Precious Metals Exchange Intermediary Institutions and on Foundation of Precious Metals Intermediary Institutions, and refineries established in Türkiyey and inserted 6 /17 <!-- page 7 --> HALKA AÇIK in the Exchange’s List of Refineries pursuant to the Communiqué on Precious Metals Standards and Refineries. SECOND CHAPTER Internal Control System and Supply Chain Due-diligence Program Members and Refineries Obliged to Form an Internal Control System and Supply ### Chain Due-diligence Program

ARTICLE 4 – (1) Pursuant to the provisions of the Regulation and the Communiqué, the obligors are required to form internal control system and supply chain due-diligence program as described in this Directive. ### Scope of Internal Control System

ARTICLE 5 – (1) Internal control system to be established for monitoring and control of risks for the sake of assuring due-diligence with the provisions of the Regulation and the Communiqué is comprised of the following components: 1) Conduct of risk management activities, and 2) Conduct of follow-up and control activities, and 3) Appointment of an internal control and supply chain due-diligence officer, and if deemed necessary pursuant to third paragraph of Article 9 of this Directive, foundation of an internal control unit by obligors, and 4) Conduct of training programs, and 5) Examination and review, on annual basis and by a risk based approach, of whether the trades and operations are carried out in accordance with the applicable laws and the corporate policies and procedures or not. (2) Activities regarding risk management and follow-up and control as cited above are handled and performed by internal control and supply chain due-diligence officer employed as above and under supervision, audit and responsibility of board of directors of the related obligor. (3) Internal control activities are carried out by internal control and supply chain due- diligence officer of the obligors. ### Internal Control Activities

ARTICLE 6 – (1) Internal control activities are composed of actions and measures taken against occurrence and repetition of risks, deficiencies, errors and frauds detected in the corporation, and report them to board of directors, within the frame of responsible supply chain policies and procedures and other applicable laws and regulations. Aforementioned issues are also taken into consideration in performance of the responsible supply chain assurance audit. (2) In determining scope of internal controls, both the faults detected in follow-up and control activities, and the risky customers, services and operations are included in the scope of internal control. (3) In determining the units and operations subject to internal control, the corporate size and business volume factors are taken into account. Thus, units and operations which represents all of the activities carried out by members and refineries are ensured to be audited qualitatively and quantitatively. 7 /17 <!-- page 8 --> HALKA AÇIK ### Notification of Internal Control Results

ARTICLE 7 – (1) With regard to the works performed as a part of internal control activities, the statistics containing information about business volume, total number of personnel, total numbers of branches, agencies and similar other affiliated units, total numbers of audited branches, agencies and similar other affiliated units, dates of audits conducted in those units, total duration of audit, number of audit personnel, and number of audited trades and operations, of members and refineries are kept and prepared by internal control and supply chain due-diligence officer and reported to the obligor’s board of directors and to the Exchange within the initial ten business days of the month immediately after each quarter on the basis of a calendar year. Furthermore, refineries are under obligation to keep records of standard unprocessed precious metals produced by them, on the basis of metal types and serial numbers, and if requested so by the Exchange, to report such information as requested and within 3 business days following the date of receipt of request. ### Scope of Supply Chain Due-diligence Program

ARTICLE 8 – (1) Supply chain due-diligence program to be formed by a risk-based approach contains and covers the following actions and measures: 1) Formation of corporate policies and procedures relating to internal control systems, and 2) Appointment of an internal control and supply chain due-diligence officer, and founding a due-diligence unit as per third paragraph of article 9 of this Directive, and 3) Conduct of training programs. ### Internal Control System and Supply Chain Due-diligence Program

ARTICLE 9 – (1) The obligor’s board of directors appoints an adequate number of internal control and supply chain due-diligence officers, and ensures that adequate personnel and other sources are allocated, pursuant to the provisions of Article 11 hereof, by taking into consideration such factors as the corporate size, business volume and number of personnel, with a view to assuring the conduct of internal control system and the effective and efficient implementation of the supply chain due-diligence program. (2) Precious metals intermediary institutions holding an operating license received from the Ministry are, prior to application to the Exchange for an Exchange membership certificate, essentially required to establish an effective internal control system and to form a due-diligence program. (3) Internal control system may be established and the required reports may be issued also through an internal control unit. Due-diligence program defined in this Directive may be carried out by the internal control unit. The Exchange may request obligors to establish a due- diligence and/or internal control unit by considering their business volume and number of personnel. Criteria of business volume and number of personnel requiring foundation of an internal control and/or due-diligence unit are announced by the Exchange. (4) Obligors are under obligation to document in writing all of their policies and procedures regarding internal control system established as above. Written procedures regarding internal control systems may be accepted and put into force only in reliance upon a decision of the obligor’s board of directors. Activities covered by internal control system are 8 /17 <!-- page 9 --> HALKA AÇIK carried out by board of directors, personnel of all levels, and internal control and supply chain due-diligence officer of the obligor. (5) Internal control activities of obligors are regulated and carried out as an integral part of daily operations and activities in such manner to allow the monitoring of the risks detected as well. For the sake of an effective internal control, the obligations of all employees to perform their job duties in accordance with the written procedures, and their duties and powers to report to senior management such issues as practices in conflict with the professional principles, activities against the corporate policies, or illegal activities, and the mechanisms in respect of said reporting are defined in writing and notified to the related personnel. Procedures are created and formulated in such manner to ensure the effective and efficient participation of personnel of all levels into the internal control system. (6) Personnel assigned for conduct of internal control and supply chain due-diligence activities also take part and play a role in the process of assessment of internal notices of breach which may be the subject of precious metals responsible supply chain breach in the light of the applicable laws and other information. For the purposes of this Directive, given that the internal notices of breach sent to internal control and supply chain due-diligence officer are also covered by the confidentiality obligation, all actions and measures required in order to make sure that the personnel perform their job duties so as not to violate this obligation are taken by the board of directors and the internal control and supply chain due-diligence officer. ### Supply Chain Due-Diligence Report

ARTICLE 10 – (1) Obligors are under obligation to prepare and issue every year a supply chain due-diligence report verifying due-diligence with the procedures and principles determined pursuant to Borsa İstanbul Responsible Supply Chain Due-diligence Directive. (2) Independent assurance report prepared and issued by the authorized independent audit firms is required to contain the audit results regarding the supply chain due-diligence report issued pursuant to first paragraph hereof as well. (3) Supply chain due-diligence report and independent assurance report are prepared and issued within the frame of the relevant applicable laws on the basis of provisions of the Responsible Supply Chain Assurance Audit Directive. THIRD CHAPTER Internal Control and Supply Chain Due-Diligence Officers Qualifications sought for in those to be appointed as an internal control and supply ### chain due-diligence officer

ARTICLE 11 – (1) Those to be appointed as internal control and supply chain due- diligence officer in precious metals intermediary institutions and refineries are required to meet and satisfy the following conditions in addition to the conditions set down in Article 5 of the Regulation: 1) To be a citizen of the Republic of Türkiye, and 2) Not to be deprived of civil rights, and 3) Not to be subject to a verdict of conviction taken due to breach of the repealed Capital Markets Law no. 2499 and the Capital Markets Law no. 6362, and 9 /17 <!-- page 10 --> HALKA AÇIK 4) To be a graduate of at least four-years’ higher education institutions in Türkiye (or abroad, providing that it is accepted to be equivalent by the Council of Higher Education, and 5) To hold a certified public accountant certificate or a sworn-in certified public accountant certificate, or hold an independent auditor certificate received from the Public Oversight Accounting and Auditing Standards Authority, or have a minimum past job experience of four years as manager or auditor in the authorized independent audit firms or as specialist or in job positions holding foreign exchange control powers in business units in charge of foreign exchange regulations in the Ministry of Treasury and Finance or as auditor in the Capital Markets Board or as specialist or auditor in Borsa İstanbul or as manager or auditor in precious metals intermediary institutions, authorized institutions in Group “A” as specified in the foreign exchange legislation, banks, financing, factoring and financial leasing companies or refineries, or have worked as due-diligence officer pursuant to the Regulation on the Program of Due-diligence with Obligations of Anti-Money Laundering and Combating the Financing of Terrorism, promulgated in the Official Gazette edition 26999 on 16/09/2008, and 6) Not to hold or own qualified shares in members and refineries or in subsidiaries or affiliates of members and refineries, or not to take part in management of these entities or institutions, or not to be spouse or blood relative or relative by marriage up to (including) second degree of a qualified shareholder, a member of board of directors or Executives of members and refineries, and 7) The officer shall not be subject to the fifth paragraph of Article 13 of this Directive in the last one year. ### Appointment of Internal Control and Supply Chain Due-Diligence Officers

ARTICLE 12 – (1) Precious metals intermediary institutions and refineries are required to appoint at least one internal control and supply chain due-diligence officer meeting all of the qualifications set down in the Regulation and in this Directive before applying respectively to the Ministry for an operating license and to the Exchange for inclusion in the Exchange’s List of Refineries. Internal control and supply chain due-diligence officer reports to the board of directors. The Exchange may further determine an additional number of internal control and supply chain due-diligence officers required to be appointed by obligors, by taking their business volume and number of personnel into consideration. Business volume and number of personnel criteria requiring appointment of additional internal control and supply chain due- diligence officers are announced by the Exchange. (2) Internal control and supply chain due-diligence officers to be appointed by obligors may also assume other job duties in such manner not to cause a conflict of interests and not to prevent the performance of internal control duty and the conduct of due-diligence program, providing that it is not related to sales and marketing. (3) In respect of a person to be appointed as internal control and supply chain due- diligence officer, obligors will disclose in accordance with the procedures and principles to be determined by the Exchange: a) A copy of identity card, and b) A copy, duly certified by the official authorities, of diplomas of undergraduate and if any, postgraduate study programs, and c) Detailed curriculum vitae containing information about professional job experience, and 10 /17 <!-- page 11 --> HALKA AÇIK ç) A certificate of appointment approved by board of directors, and d) A criminal conviction certificate also containing archive records, received during the last one month, and e) Documents confirming the conditions listed in subparagraphs (c), (d), (e) and (f) of first paragraph of Article 11 of this Directive, and f) Other information and documents that may be requested by the Exchange. (4) Upon delivery of the decision of appointment to the Exchange, the appointee is assessed by the Exchange as to whether they meet the conditions and qualifications sought for in internal control and supply chain due-diligence officers or not. If the appointee does not bear the aforesaid qualifications, it is duly notified to the Ministry and the obligor. Then, within 30 days following receipt of this notification from the Exchange, the obligor appoints another person meeting the conditions and bearing the qualifications set down in the Regulation and in this Directive and duly name them to the Ministry and the Exchange. Following receipt of consent from the Ministry regarding said appointment, the Exchange starts an assessment process again. Duties, Powers and Responsibilities of Internal Control and Supply Chain Due- ### Diligence Officers

ARTICLE 13 – (1) Job duties and responsibilities of an internal control and supply chain due-diligence officer to be appointed as per Article 12 of this Directive are as listed below: a) To take necessary actions in order to assure due-diligence of the obligor with the Regulation, the Communiqué and other foreign exchange legislation, Borsa İstanbul Responsible Supply Chain Due-diligence Directive, and other regulations issued about responsible supply chain applications as per the applicable laws, and to establish and maintain the required communication and coordination with the Exchange and other pertinent bodies and institutions; and b) To form the corporate policies and procedures and to present them to the board of directors for approval; and c) To form the risk management policy and to present it to the board of directors for approval, and to conduct risk management activities, and to form risk action plans within the frame of these activities, and to regularly follow up and monitor the results of actions taken; and ç) To form the monitoring and control policies and to present them to the board of directors for approval, and to conduct the activities pertaining thereto; and d) To carry out the training program activities focused on due-diligence, and to present them to the board of directors for approval, and to ensure that the approved training program is effectively and efficiently implemented; and e) To establish controls aiming to record and maintain all and any documents stipulated by the applicable laws and regulations for identification of customers and suppliers; and f) To ensure that the processes regarding suppliers and customers and all of their transactions relating to transfer of assets, services, money, etc. are identified, and to establish controls aiming to maintain and keep all documents and records regarding said transactions; and g) To perform investigations about the transactions alleged to be in conflict with the applicable laws and regulations and reported to them or learned by themselves in respect of 11 /17 <!-- page 12 --> HALKA AÇIK their institution or company, and to evaluate the information and findings obtained as above, and to report in writing all and any breaches or nonconformities detected as such to the Ministry, the Exchange and other related official bodies and organizations within 5 business days thereafter; and ğ) To perform investigations about the acts or circumstances that may be considered within the zero tolerance principle set forth in the Borsa İstanbul A.Ş. Directive on the Responsible Supply Chain Assurance Engagement and are reported to them or learned by themselves in respect of his/her institution or company, and to evaluate the information and findings obtained as above, and to report in writing all and any breaches or nonconformities detected as such to the Ministry and the Exchange within no later than 24 hours thereafter; and h) To take actions and measures in order to ensure that internal and external breach reports, notifications and other related issues are kept in strict confidence; and ı) To regularly keep the results, information and statistics with regard to internal control and training activities, and to report them to the obligor’s board of directors and the Exchange within the periods of time stated in Article 7 of this Directive. (2) For the sake of establishment and maintenance of the required communication and coordination on internal control and due-diligence issues with the Exchange within the frame of a responsible supply chain, the obligation of obligors to provide information and documents to the Exchange is performed through internal control and supply chain due-diligence officer. Upon request of information and documents, the obligor is liable to deliver the requested information and documents in accordance with the format and method determined by the Exchange and notified to it. (3) An internal control and supply chain due-diligence officer is under obligation to act in good faith, reasonably, honestly, neutrally and with his/her own free will and volition in the course of performance of his/her job duties and responsibilities. (4) Board of directors ensures that internal control and supply chain due-diligence officer is equipped by the powers and assurances allowing them to take decisions with his/her own free will and volition, and to request all kinds of information and documents related to his/her area of responsibility from all organization units of the obligor, and to access them in a timely manner, and to perform his/her job duties listed in this article. (5) If an internal control and supply chain due-diligence officer is determined not to perform his/her duties and responsibilities listed in this article, the internal control and supply chain due-diligence officer will immediately be dismissed by a decision of the board of directors, and this decision of dismissal will be reported to the Exchange promptly and to the Ministry within maximum 10 days thereafter. An internal control and supply chain due- diligence officer dismissed pursuant to this paragraph may not be re-appointed as internal control and supply chain due-diligence officer even in another obligor for a period of one year. Internal Control and Supply Chain Due-Diligence Officer’s Not Being on the Job ### or Leaving the Office

ARTICLE 14 – (1) If an internal control and supply chain due-diligence officer is not on the job temporarily due to leave, sickness or similar other reasons, then, the person to serve as a substitute is required to meet the conditions sought for in the Regulation and in Article 11 of this Directive. Identity and communication data of the person appointed as a substitute are to be furnished to the Ministry and the Exchange within 1 (one) business day. 12 /17 <!-- page 13 --> HALKA AÇIK (2) The person to serve as a substitute of internal control and supply chain due-diligence officer will have all duties, powers and responsibilities of internal control and supply chain due- diligence officer. The internal control and supply chain due-diligence officer cannot be held responsible for the actions taken while he/she is not on the job. (3) An internal control and supply chain due-diligence officer cannot be deputized for more than 30 days continuously and/or for more than sixty days in total in a calendar year. (4) If an internal control and supply chain due-diligence officer does no more meet any one of the conditions listed in this Directive or is later understood that he/she does not meet said conditions or leaves the office for any reason or in any manner whatsoever, new appointment will be made by the obligor and reported to the Ministry and the Exchange within no later than ten days thereafter in accordance with provisions of Article 11 of this Directive. The procedures stipulated in the preceding paragraphs will be applied until a new internal control and supply chain due-diligence officer is appointed as such. (5) If an internal control and supply chain due-diligence officer leaves office for any reason whatsoever, the reason of his/her leaving the office is required to be reported in writing by both the obligor and the internal control and supply chain due-diligence officer to the Ministry and the Exchange within ten days following the date of retirement. FOURTH CHAPTER Training Policy, Training Activities ### Training Policy

ARTICLE 15 – (1) Obligors are required to establish a training policy, as a part of their corporate policy, covering such issues as operation of training activities, and persons responsible for conduct and management of training activities, and identification of personnel to attend training activities, and identification and training of trainers, and training methods. (2) Purposes of training policy are to ensure due-diligence with obligations and liabilities pursuant to the Regulation, the Communiqué, other foreign exchange legislation, Borsa İstanbul Responsible Supply Chain Due-Diligence Directive and other applicable laws and regulations, and to increase the awareness and sense of responsibility of personnel on corporate policies and procedures and risk-based approach, and to create a corporate culture, and to keep the knowledge of personnel current. ### Training Activities

ARTICLE 16 – (1) Obligors are under obligation to conduct training activities for due- diligence purposes in tandem with their corporate size, business volume and the changing conditions. (2) Training activities are carried out under supervision and coordination of internal control and supply chain due-diligence officer. Obligors are required to conduct their training activities under a certain training program and in such manner to cover all of the issues listed in Article 17 of this Directive. Training program is prepared by internal control and supply chain due-diligence officer with participation of the related organization units as well. Effective and efficient implementation of training program is supervised by internal control and supply chain due-diligence officer. 13 /17 <!-- page 14 --> HALKA AÇIK (3) Training activities are also reviewed with participation of the related organization units according to the assessment and evaluation results, and are repeated according to needs, not being less than once a year. (4) So as to ensure that training activities are held at the corporation, obligors make use of such training methods as organization of seminars and panels, formation of working groups, use of audio-visual materials in training activities, and computer aided training programs over internet, extranet or intranet. ### Training Subjects

ARTICLE 17 – (1) Trainings to be given by obligors to their personnel will at the minimum contain the following training subjects: a) Foreign exchange legislation and its enforcement, and b) Conflict-Affected and High-Risk Areas (CAHRAs) concept and other Due Diligence Guideline concepts, and c) Responsible supply chain steps and case studies in connection therewith, and ç) Laws and regulations pertaining to responsible supply chain, and d) Risk areas, and e) Corporate policies and procedures, and f) Within the frame of the Exchange regulations and other pertinent laws and regulations: 1) Know-your-customer (KYC) principles, and 2) Principles on notifications and reports to be sent to the related authorities and organizations, and 3) Safekeeping and submission obligations, and 4) Obligation to disclose information and documents, and 5) Sanctions to be applied if the obligations are not performed, and g) International regulations in respect of fight against laundering of criminal revenues and financing of terrorism. ### Reporting of Training Results

ARTICLE 18 – (1) The following information and statistics relating to the training activities are required to be reported and notified by obligors to the Ministry and the Exchange through internal control and supply chain due-diligence officer by the end of March of the following year: a) Training dates, and b) Regions or provinces of training, and c) Training method, and ç) Total training hours, and d) Number of trained personnel, and its ratio to total number of personnel, and e) Distribution of trained personnel by their organization units and job titles, and f) Contents of training, and g) Titles and areas of specialization of trainers. ### Training Activities to be Organized by the Exchange

ARTICLE 19 – (1) For training of employees of obligors, the Exchange is duly authorized to organize training activities, to create computer-aided distance learning programs via internet and to take measures for access of employees of obligors to these programs. 14 /17 <!-- page 15 --> HALKA AÇIK FIFTH CHAPTER ### Miscellaneous Provisions

ARTICLE 20 – (1) The CEO is authorized to take decisions, and guide and regulate the enforcement, within the frame of the relevant regulations, on all matters on which this Directive has no provisions or is not clear. Duration in Appointment of Internal Control and Supply Chain Due-Diligence Officer PROVISIONAL ARTICLE 1– (1) Obligors liable to appoint an internal control and supply chain due-diligence officer pursuant to the provisions of this Directive will appoint at least one internal control and supply chain due-diligence officer meeting the conditions listed in Article 11 by no later than 01/07/2021. Until an internal control and supply chain due- diligence officer is appointed, all and any conflicts with responsible supply chain practices are urgently reported by obligors to the Exchange. Procedure of Appointment of Internal Control and Supply Chain Due-Diligence Officer PROVISIONAL ARTICLE 2 – (1) Employees working as internal control and supply chain due-diligence officer in obligors as of the date this Directive is published may continue their job, providing that they meet the conditions listed in the Regulation and in Article 11 of this Directive and are appointed in accordance with the procedure stipulated in Article 12 of this Directive. Time Frame for the Due-Diligence Program PROVISIONAL ARTICLE 3 – (1) Obligors are required to form their due-diligence policies, procedures and programs until 01/07/2021 at the latest. ### Effective Date

ARTICLE 21 – (1) This Directive shall become effective as of 05/03/2021. ### Enforcement

ARTICLE 22 – (1) The provisions of this Directive shall be enforced and executed by the CEO. Revisions First Revision On 02/06/2021, articles 11 and 18 of this Directive have been revised and amended as shown below, and the new texts have been inserted in the Directive. 15 /17 <!-- page 16 (table kept in page layout) --> ```text HALKA AÇIK On 02/06/2021, by the 1st Revision, the following revisions and amendments are made in the Directive. Former Text New Text Qualifications sought for in those to be appointed as an Qualifications sought for in those to be appointed as an internal control and supply chain due-diligence officer internal control and supply chain due-diligence officer

ARTICLE 11 – (1) Those to be appointed as internal ARTICLE 11 – (1) Those to be appointed as internal control control and supply chain due-diligence officer in precious metals and supply chain due-diligence officer in precious metals intermediary intermediary institutions and refineries are required to meet and institutions and refineries are required to meet and satisfy the following satisfy the following conditions in addition to the conditions set conditions in addition to the conditions set down in article 5 of the down in article 5 of the Regulation: Regulation: … … d) To hold a certified public accountant certificate or a d) To hold a certified public accountant certificate or a sworn-in sworn-in certified public accountant certificate, or hold an certified public accountant certificate, or hold an independent auditor independent auditor certificate received from the Public Oversight certificate received from the Public Oversight Accounting and Auditing Accounting and Auditing Standards Authority , or have a Standards Authority , or have a minimum past job experience of four minimum past job experience of four years in audit field in years as manager or auditor in the authorized independent audit firms authorized independent audit firms or in institutions operating or as specialist or in job positions holding foreign exchange control in finance area or in refineries or precious metals intermediary powers in business units in charge of foreign exchange regulations institutions, in the Ministry of Treasury and Finance or as auditor in the Capital … Markets Board or as specialist or auditor in Borsa İstanbul or as manager or auditor in precious metals intermediary institutions, authorized institutions in Group “A” as specified in the foreign exchange legislation, banks, financing, factoring and financial leasing companies or refineries, or have worked as due-diligence officer pursuant to the Regulation on Program of Due-Diligence with Obligations Regarding Prevention of Laundering of Criminal 16 /17  ``` <!-- page 17 (table kept in page layout) --> ```text HALKA AÇIK Revenues and Financing of Terrorism, promulgated in the Official Gazette edition 26999 on 16/09/2008, and … Reporting of Training Results Reporting of Training Results

ARTICLE 18 – (1) The following information and ARTICLE 18 – (1) The following information and statistics statistics relating to the training activities are required to be relating to the training activities are required to be reported and notified reported and notified by obligors to the Ministry and the Exchange by obligors to the Ministry and the Exchange through internal control through internal control and supply chain due-diligence officer by and supply chain due-diligence officer by the end of March of the the end of March of every the following year: following year: a) Training dates, and a) Training dates, and b) Regions or provinces of training, and b) Regions or provinces of training, and c) Training method, and c) Training method, and ç) Total training hours, and ç) Total training hours, and d) Number of trained personnel, and its ratio to total d) Number of trained personnel, and its ratio to total number of number of personnel, and personnel, and e) Distribution of trained personnel by their organization e) Distribution of trained personnel by their organization units units and job titles, and and job titles, and f) Contents of training, and f) Contents of training, and g) Titles and areas of specialization of trainers. g) Titles and areas of specialization of trainers. 17 /17  ```