Borsa İstanbul Due Diligence Guideline on Responsible Supply Chain of Precious Metals

1. Definitions, Sources of Precious Metals and Other Concepts ................................. 4 1.1 Definitions ............................................................................................................... 4 1.2 Sources of Precious Metals ..................................................................................... 6 1.2.1 Precious Metals Extracted from Mines ............................................................ 6 1.2.2 Recyclable (Scrap) Precious Metals ................................................................ 6 1.2.3 Grandfathered Stocks ....................................................................................... 7 1.3 Other Concepts Related to Precious Metals ............................................................ 7 SECOND PART ............................................................................................................. 11

2. Measures Suggested for Mitigating Risks in Supply Chain Policies and Assessing Improvements ........................................................................................................................... 11 2.1 Security ................................................................................................................. 11 2.1.1 Mitigating Security Risks ........................................................................... 11 2.1.2 Suggested Indicators for Measuring Improvement ..................................... 11 2.2 Preventing EYMs Exposure to Negative Effects ............................................... 12 2.2.1 Risk Mitigation ........................................................................................... 12 2.2.2 Suggested Indicators for Measuring Improvement ..................................... 12 2.3 Bribery and Fraudulent Misrepresentation of the Origin of Mines .................... 12 2.3.1 Risk Mitigation .............................................................................................. 12 2.3.2 Suggested Indicators for Measuring Improvement ........................................ 13 2.4 Laundering Proceeds of Crime.............................................................................. 13 2.4.1 Risk Mitigation .............................................................................................. 13 2.4.2 Suggested Indicators for Measuring Improvement ........................................ 13 2.5 Transparency on Payments Made to States and Governments ............................. 13 2.5.1 Risk Mitigation .............................................................................................. 14 2.5.2 Suggested Indicators for Measuring Improvement ........................................ 14 THIRD PART ................................................................................................................. 15

3. Five-Step Application for Obligors ....................................................................... 15 3.1 Step I: Foundation of Strong Corporate Management Systems ............................ 15 3.1.1 General Recommendations for All Companies in the Precious Metals Supply Chain Including Obligors ..................................................................................... 15 3.1.2 Special Recommendations for Companies in Precious Metals Supply Chain Including Obligors............................................................................................................ 18 3.2 Step II: Determining and Assessing the Risks in Supply Chain ........................... 19 3.2.1 Risk Assessment for Medium and Large-scale Mining Establishments and Labour-intensive and Small-scale Mining Establishments .............................................. 20 <!-- page 3 --> HALKA AÇIK 3.2.2 Risk Assessment for Local Exporters, Recyclers, International Traders of Precious Metals Mined or Recycled, and Refineries ....................................................... 23 3.2.3 Risk Assessment for Post-Refinery Companies ............................................ 26 3.3 Step III: Designing and Implementing a Response Strategy to Detected Risks ... 28 3.3.1 Risk Management for Obligors...................................................................... 28 3.3.2 Risk Management for Post-refinery Companies ............................................ 30 3.4 Step IV: Audit by Independent Third Parties for Determining Compliance Level of the Current Situation of Supply Chain of Obligors (Independent Assurance Report) ..... 31 3.4.1 Assurance Audit Planning ............................................................................. 31 3.4.2 Performing Audit in Accordance with Audit Planning ................................. 33 3.5 Step V: Annual Reporting for Determining Compliance Level of the Current Situation of Supply Chain..................................................................................................... 34 FOURTH PART ............................................................................................................. 36

4. Supply Chain Policy Document for Responsible Supply Chain of Precious Metals from Conflict-affected and High-risk High-Risk Areas ........................................................... 36 4.1 Purpose of Document: ........................................................................................... 36 This document aims to common reference for the parties involved in all stages of the precious metals supply chain. The companies are suggested to integrate this policy model into their corporate social responsibility, sustainability or other policy applications. ......... 36 4.2 Document Text: ..................................................................................................... 36 FIFTH PART .................................................................................................................. 39

5. Detection, Reporting and Sanctions of Responsible Supply Chain Non- Conformities ............................................................................................................................. 39 5.1 Obligors’ Appointment of Internal Control and Supply Chain Compliance Officer and Compliance Process ....................................................................................................... 39 5.2 General Principles of Responsible Supply Chain Assurance Engagement Activities 39 5.3 Sanctions ............................................................................................................ 40 SIXTH PART ................................................................................................................. 40

6. Miscellaneous and Final Provisions....................................................................... 40 6.1. Compliance with Guideline on Voluntary Basis .................................................. 40 6.2. Other Provisions ................................................................................................... 40 TURKISH – ENGLISH TERMS .................................................................................... 41 <!-- page 4 --> HALKA AÇIK BORSA İSTANBUL PRECIOUS METALS RESPONSIBLE SUPPLY CHAIN COMPLIANCE GUIDELINE FIRST PART

1. Definitions, Sources of Precious Metals and Other Concepts 1.1 Definitions For the purposes and in the context of this Guideline: 1) Decree-Law no. 3: Stands for the Decree-Law no. 32 on Protection of Value of Turkish Currency promulgated in the Official Gazette edition 20249 on 11/8/1989; and 2) Independent Assurance Report: refers to a report issued by Authorized Independent Audit Firms as a result of audit performed in accordance with “ISAE 3000, Assurance Engagements Other than Audits or Reviews of Historical Financial Information” published by the PublicOversight, Accounting and Audit Standards Authority; and 3) Ministry: Stands for the Ministry of Treasury and Finance; and 4) Exchange or Borsa İstanbul: Stands for Borsa İstanbul A.Ş.; and 5) UN: Stands for the United Nations; and 6) Dore bar: Refers to a bullion containing gold, silver and other precious metals, produced out of ore, and not subjected to any refining process; and 7) Granule: Refers to very tiny globules of precious metals; and 8) Internal control and supply chain compliance officer: Refers to an officer having the minimum qualifications and authority sought for in the regulations issued by the Exchange in due consultation with the Ministry pursuant to the provisions of the Regulation and the Communiqué and employed by precious metals intermediary institutions and refineries; and 9) Precious Metals: Refers to all kinds and types of precious metals as defined in the Decree-Law no. 32; and 10) Refining: Refers to conversion of gold, silver, platinum and palladium in scrap form or produced out of ore into internationally accepted standards being purified by means of certain techniques; and 11) Refinery: Refers to refineries established in Türkiye and included in the List of Refineries issued by the Exchange within the frame of the Communiqué and other relevant regulations of the Ministry; and 12) List of Refineries: Refers to a list issued and announced by the Exchange in respect of refineries of which the bars, bullions and granules are tradable in the Exchange; and 13) Guideline: Stands for this Borsa İstanbul Precious Metals Responsible Supply Chain Compliance Guideline; and 14) Calibration of Fineness: Refers to the number of pure metal fragments per thousand parts of gold and per hundred parts of silver, platinum and palladium; and 4/41 <!-- page 5 --> HALKA AÇIK 15) Responsible supply chain of precious metals: Refers to continuous proactive and reactive processes, and all the systems built for them, which enable obligors to determine, prevent, reduce and account for the actual and potential negative effects that may arise out of all activities, organizations, actors, technologies, information, resources and services included and involved in the process of transportation of precious metals from their sources to end users and consumers in the course of precious metals activities and supply systems; and 16) Nonstandard unprocessed precious metals: Refers to precious metals in the form of bullion, bar, dore bar, granule, powder or scrap with a purity lower than the lowest calibration of fineness specified in the Communiqué; and 17) Standard unprocessed precious metals: Refers to unprocessed gold, platinum and palladium in the form of bars or bullions, and unprocessed silver in the form of bars, bullions or granules, having the lowest calibration of fineness specified in the Communiqué; and 18) Communiqué: Stands for the Communiqué on Precious Metals Standards and Refineries (Communiqué no. 2006/1) promulgated in the Official Gazette edition 26350 on 18/11/2006; and 19) Compliance: Refers to continuous proactive and reactive process enabling the obligors to determine, prevent, reduce and account for the actual and potential negative effects that may arise out of their activities and supply systems, and ensuring that all of their activities are carried out in accordance with the Regulation, the Communiqué and other applicable laws and regulations, as an integral part of their commercial decision making and risk management systems; and 20) Member: Refers to precious metals intermediary institutions duly authorized by the Exchange to trade in the Precious Metals Market from among institutions mentioned in first paragraph of Article 24 of the Regulation on Foundation, Activity, Working and Audit Principles of Exchanges and Market Operators promulgated in the Official Gazette edition 28712 on 19/07/2013; and 21) Authorized independent audit firms: Refers to independent audit firms which meet the conditions listed in the regulations issued by the Exchange in due consultation with and with a prior consent of the Ministry from among the companies authorized as Public Interest Entities by the Public Oversight, Accounting and Audit Standards Agency and are defined and named so in the List of Independent Audit Firms published by the Exchange; and 22) Regulation: Stands for the “Regulation Concerning the Principles of Operations of Precious Metals Exchange Intermediary Institutions and Foundation of Precious Metals Brokerage Houses” promulgated in the Official Gazette edition 26528 on 21/05/2007; and 23) Obligor/Obligors: Refers to both precious metals intermediary institutions that are members of the Exchange holding an operating license received pursuant to the Regulation Concerning the Principles of Operations of Precious Metals Exchange Intermediary Institutions and Foundation of Precious Metals Brokerage Houses, and refineries established in Turkey and inserted in the Exchange’s List of Refineries pursuant to the Communiqué on Precious Metals Standards and Refineries. 5/41 <!-- page 6 --> HALKA AÇIK 1.2 Sources of Precious Metals 1.2.1 Precious Metals Extracted from Mines Precious metals which are extracted from mines by medium and large-scale or labour- intensive and/or small-scale establishments and have not ever been refined previously. The origin of precious metals extracted from mines is their place of extraction. Sub-categories of unrefined precious metals extracted from mines are as listed and defined below: Alluvion: Very tiny, but visible corpuscles of precious metals extracted from sand and gravel residues generally at stream sides or in their vicinity. Alluvion precious metals are generally found in the form of “powder” or sometimes in the form of small parts that can easily be carried and smelted. After semi-refining, ingots of 85% to 92% purity can be obtained. Alluvion precious metals can be directly refined and made ready for use as jewelry or bullion (ingot) without any interim concentration or other processes. Ore: Rocks or gravels containing precious metal concentrations. This concentration may be very low in terms of weight (for instance, 1 gram of gold in one ton of ore), but nevertheless may provide an economic benefit in medium and large-scale industrial mining activities. Precious metal ores are generally processed near to mine site due to their mass and weight. Concentration: An intermediate substance which is obtained by processing of precious metal ore for the sake of reaching a higher concentration, but is required to be processed more for production of dore. A precious metal concentration is generally transported to a nearby smelting plant for production of dore. Dore: A gold metal alloy ingot extracted from mine (normally in 85% to 90% purity) which is produced through intensive processing of ore generally in medium and large-scale mines to obtain high concentrations. The mine in this form is not of commercial grade, and is required to be sent directly to refinery for refining purpose without any intermediate process step. Mining Byproducts: Precious metals obtained in trace quantities from other metal mining activities (for instance, from copper sulphide ore). For example, when gold is a byproduct, initially other more important metal is processed and refined, and then, gold is extracted and refined from final residues of the first metal (such as copper electrolytic cell remnants). 1.2.2 Recyclable (Scrap) Precious Metals Recyclable (Scrap) precious metals are scrapped or waste pre-refined precious metals sent to a refinery or another post-refinery company to initiate a new production and usage cycle for processing. Origin of such recyclable precious metals is accepted as the first point of entry in the supply chain where the precious metal is sent to a refinery or another post-refinery or intermediary processor or recycling firm. Sub-categories of recyclable precious metals are as described below: Industrial byproducts: It is not the targeted main product, but a substance produced in the course of processing of a different material. For instance, in gold refinining processes, 6/41 <!-- page 7 --> HALKA AÇIK generally such byproducts of low value as blast furnace flue dust, spent crucibles and floor residual dusts occur. Melted recyclable precious metals: Recyclable precious metal which is melted as the initialrecycling process, and is then casted in the form of a simple ingot or in another form having an undefined dimension and purity. Unprocessed recyclable precious metals: Precious metals such as recyclable ingot bars, jewelry parts, jewellery, gold / silver coins and machine lathes which are still in their original form and/or production scraps before shipment for processing and refining purposes. 1.2.3 Grandfathered Stocks Grandfathered stocks: Gold investment products (ingots, bars, coins, and grain in sealed containers) held in bullion bank vaults, central bank vaults, exchanges and refineries with a verifiable date prior to 1 January 2012, which will not require a determination of origin. This includes stocks held by a third party on behalf of the listed entities. Verifiable date: Refers to a date which can be verified through examining the physical date labels affixed on precious metal products and/or inventory lists. 1.3 Other Concepts Related to Precious Metals Artisanal and Small-scale Mining: This term refers to labour-intensive and small-scale mining activities of precious metals. Artisal and Small-scale Mining (ASM): This term is used for official or unofficial mining activities which are accepted and classified as Small-scale Mining and are generally comprised of simple mineral exploration, extraction, processing and transportation activities. Artisal and Small-scale Miningis normally with a low capital amount and is basically relied upon labour force. Artisal and Small-scale Miningencompasses not only individual miners, but also groups working in the form of cooperative, business enterprise or other professional units comprised of families or hundreds, even thousands of miners. For instance, in some family units of 4 to 10 people, it is commonly observed that working groups are formed, and duties are shared in the course of mine extraction (such as tunnel boring activities). Groups of 30 to 300 people jointly extracting mine in a mineral deposit and sometimes sharing the mine processing plants (for example, groups working in different tunnels) are also common. Artisal and Small-scale Mining(EYM) Establishments: They are labour-intensive and small-scale business establishments structured to meet the requirements of this Guideline and adequately officialized. Accordingly, all labour-intensive and small-scale mining businesses are suggested to have an official identity. Medium and Large-scale Mining: This term covers precious metals mining activities which are not classified and considered as labour-intensive and small-scale mining activities for the purposes of this Guideline. Mixed precious metals: This term refers to precious metals containing more than one resource (e.g. gold extracted from mine and recycled gold). Bullion: It is a general term used for refined precious metals in the form of bar or ingot. 7/41 <!-- page 8 --> HALKA AÇIK Ingot/Mold: This term is used generally for the form of an unprocessed crude metal part shaped by being casted in mold. Bar: This term is also used for the form of an unprocessed crude metal part shaped by being casted in mold. A bar which is purer than ingot carries its weight and purity data affixed on it. Conservation chain: Refers to a sequential recording process covering the entities or institutions conserving and safeguarding precious metals along a supply chain. Conflict-affected and high-risk areas: Refers to areas affected from armed conflicts, widespread acts of violence and hostilities, acts of violence committed by crime rings, and other material risks which may cause harm to people. Armed conflicts may be seen in various different forms such as international or non-international conflicts between two or more states, or struggles for freedom, riots and civil warks. Direct or indirect support to non-state armed groups through precious metals extraction, transportation, trading, handling or exportation activities: This term covers the supply of precious metals, the payment of money or the provision of logistic support or equipment in any manner whatsoever to non-state armed groups engaged in various different activities, including, but not limited to, the following: i) To illegally control the mine sites or transport routes, precious metals trading points or production actors involved in supply chain and/or ii) To illegally levy taxes or collect tributes at points of access to mine sites, along precious metals transport routes or at precious metals trading points and/or iii) To illegally levy taxes or collect tributes from intermediaries, exporters or international traders or merchants. Handling: It is a general term used for all processes such as relocation of products, unpacking and repackaging, change of container sizes, controlling, labeling and stretching in the course of logistic systems. Good Delivery: It stands for the production and delivery standards of refined precious metals accepted in exchanges or over-the-counter markets and adequacy of refineries. Industry Program: This term refers to an initiative or program created and managed by a sectoral organization or a similar sectoral venture to support and move forward some or all of the recommendations given in this Guideline. An Industry Program may be a part of more comprehensive activities of the organization containing its other goals and objectives as well. A reference made to the related activity of an Industry Program in the Guideline means that the activity is compliant with the Guideline. Institutionalized Mechanism: This term stands for a structure formed by public authorities, sector representatives and non-governmental organisations to support and develop the enforcement of suggestions given and included in the Guideline. A reference made in this Guideline to activities of Institutionalized Mechanism indicates that such activities are compliant with the Guideline. 8/41 <!-- page 9 --> HALKA AÇIK Small-scale labour-intensive mining: It is difficult to state whether labour-intensive and small-scale mining is compliant with the terms and conditions set down in this Guideline. The term “compliance with the Guideline”, whenever used herein, means, inter alia, labour- intensive and small-scale mining performed in accordance with the applicable laws and regulations. If there is no legal framework or if the existing legal framework is not applied by the official authorities, then, to evaluate the compliance of labour-intensive and small-scale mining activities with the Guideline, artisans, small-scale miners or companies are assessed whether they act in good faith with the applicable current legal framework (if any), and whether they respond to officialization opportunities granted to them (in many cases, it should also be noted that artisans and small-scale miners have only limited capacities, technical skills or financial resources or none at all). In both cases, like in all other mining activities, if labour- intensive and small-scale mining activities are leading to heavy abuses, misconducts or conflicts relating to mineral extraction, transportation and trading activities, as defined in this Guideline, they are not considered as compliant with the Guideline. Management system: This term refers to management processes and documentation that ensure correct, consistent and effective performance of duties and offer a systematic framework to achieve the desired results and improvement of performance. Recycler: This term stands for a person or entity who does not deal with refining business, but collects, consolidates and/or processes recyclable/scrap precious metals which may be reused after refining. Supplier: Refers to a person or entity who takes part in the supply chain for supply of precious metals or substances or materials containing precious metals. Supply chain: Refers to a system covering all activities, organizations, entities, technologies, information, resources and services included and involved in the process of transportation of precious metals from their sources to end users and consumers. A reference made in this Guideline to supply chain, supplier or suppliers encompasses all customers, suppliers, agencies, intermediaries and other related persons and entities involved in supplying precious metals to obligor members or refineries. Supply Chain Compliance Report: Refers to a report which is prepared by the obligor within the framework of procedures and principles regarding responsible supply chain of precious metals as determined by the Exchange in due consultation and with prior consent of the Ministry according to international criteria and indicates the compliance of transactions covering the related reporting period with the aforesaid procedures and principles. Mine/Refinery Level Supply Chain and Mining/Refinery Companies: “Mine/ Refinery Level Supply Chain” stands for the precious metals supply chain from mine sites to refineries. “Mining/Refinery Companies” cover miners (labour-intensive and small-scale miners and medium and large-scale mining companies), local precious metals traders, exporters from country of origin, or international Mined/Recyclable Precious Metals traders and refineries. Labour-intensive and small-scale precious metals producers are not expected to perform all of the compliance work and activities recommended in this Guideline in the capacity of Mining/Refinery Companies, but nevertheless are suggested to be involved in the compliance efforts of their customers, thus gaining experience for their future compliance work and activities. 9/41 <!-- page 10 --> HALKA AÇIK Post-refinery Supply Chain and Post-refinery Companies: “Post-refinery Supply Chain” stands for the whole supply chain used for transportation of precious metals from refineries to retailers. “Post-refinery Companies” cover refined precious metals traders and precious metals exchanges, and banks, exchanges and other organisations keeping ingot gold in their own vaults, and jewelry producers, jewelry retailers, and other companies using precious metals in production of their goods (e.g. electronic or medical device manufacturers). Human rights: For the purposes of this Guideline, the term ‘human rights’ refers to human rights defined in the Universal Declaration of Human Rights (1948), the International Covenant on Economic, Social and Cultural Rights (1966), the International Covenant on Civil and Political Rights (1966) and two Optional Protocols attached to that international covenant. International Cyanide Management Code: Refers to a volunteering program designed in order to help producers and carriers of cyanide used in gold and silver mining industries and gold and silver mining in improvement of cyanide management practices, and to prove their compliance with the International Cyanide Management Code publicly. Assurance Engagement Standard 3000 (GDS 3000): This term refers to standards of assurance engagement other than independent audit or limited independent audit of historical financial information published by the Public Oversight, Accounting and Audit Standards Agency in reliance upon a Turkish translation of International Assurance Audit Standard (ISAE) 3000 “Assurance Engagements Other Than Audits or Reviews of Historical Financial Information” published by the International Federation of Accountants (IFAC). Know Your Counterparty Rule (KYC): Refers to a business process aimed to find out the truth in order to define and verify the identity of business relations and to clearly understand the nature and past of relations. Gold Extracted out of Ore: Refers to gold which is extracted from mines (medium and large-scale or labour-intensive and/or small-scale) and has never been previously refined. It means gold or gold-containing materials produced in any shape, form and concentration in a mine until it is entirely refined (995 or more) and transformed into a gold refinery product (bullion, granule, etc.) and sold. Laundering proceeds of crime: Refers to the process of hiding the origins of money obtained illegally for the legitimization of crime revenues. The money may be obtained by any criminal activities, also including drug trafficking, corruption and other types of fraud. Sustainable development: Refers to development that meets the present demands without compromising the ability to fulfill the demands of future generations. Financing of terrorism crime: Refers to collection and provision of funds to a terrorist or a terror organization, even if not associated with a certain criminal act, knowingly and wilfully, and with the malice intent of their full or partial use for acts defined and listed in Article 3 of the Law on Prevention of Financing of Terrorism no. 6415 dated 7/2/2013. World Heritage Site: Refers to sites which are considered to be of value culturally, historically, scientifically or otherwise selected by United Nations Educational, Scientific and Cultural Organisation (UNESCO) and protected legally by international conventions. 10/41 <!-- page 11 --> HALKA AÇIK SECOND PART

2. Measures Suggested for Mitigating Risks in Supply Chain Policies and Assessing Improvements 2.1 Security 2.1.1 Mitigating Security Risks Obligors by themselves or through professional units, joint working groups or other appropriate means, shall apply the suggested risk mitigating measures with the intention of performing the following activities:

1. To report all and any abusive and exploitation-based acts and practices occurring in supply chain to the public authority (e.g. ministry for mining) of the related country; and

2. To ensure the security in regions where mining activities are held to ransom or where taxes are illegally levied on mines, immediately the necessary steps should be taken to ensure that intermediaries and suppliers inform the parties or the public about payments made to law-enforcers and private security.

3. To support the development of intermediaries and suppliers in documenting of security requirementsand of payments made to law-enforcers and private security officers; and

4. In the course of procuring mines through Artisal and Small-scale Mining(ASM) Establishments, to ensure that all payments are made freely in proportion to the services provided, to support officialization of security agreements signed between EYMs as well as local government and law-enforcers and private security officers in cooperation with non- governmental and international organisations for determining and applying rules of engagement in accordance with the Voluntary Principles on Security and Human Rights, the United Nations Regulation on Codes of Conduct of Law Enforcement Officials and the United Nations Basic Principles on the Use of Force and Firearms by Law Enforcement Officials; and

5. To support creation of social forums for information sharing and transfer purposes; and

6. To support the establishment of a fund or a similar mechanism to pay law-enforcers and private security officers in consideration of their services; and

7. To partner with international and non-governmental organisations in order to support the development of competences of law-enforcers and private security officers assigned in mine sites in strict compliance with the Voluntary Principles on Security and Human Rights, the United Nations Regulation on Codes of Conduct of Law Enforcement Officials and the United Nations Basic Principles on the Use of Force and Firearms by Law Enforcement Officials. For more detailed directives, the Multilateral Investment Guarantee Agency, Voluntary Principles on Security and Human Rights: Application Tool Set for Large Establishments (2008), and the International Committee of the Red Cross – Training sources for armed police and security personnel, International Codes of Conduct and Ethical Principles for Private Security Service Providers (2010) documents may be referred to. 2.1.2 Suggested Indicators for Measuring Improvement Taking the qualifications of obligors into account, the following indicators may be used for measuring improvement in the course of mitigating security-related risks in the supply chain: 11/41 <!-- page 12 --> HALKA AÇIK a. Global Reporting Initiative, Sustainability Reporting Guidelines and Mining and Metals Sector Supplement (Version 3.0), HR8 indicator: “Percentage of security personnel trained in the organization’s policies or procedures concerning aspects of human rights that are relevant to operations.” For other indicator descriptions, information above may be referred to. For detailed directives on risk related to communities and women, collection of information and reporting of indicators may be referred to in the “Global Reporting Initiative (GRI), Sustainability Reporting Guideline and GRI Mining and Metal Sector Supplement (Version 3.0) document”. b. The percentage of money or precious metals (individual / total rates) illegally received from those involved in the production process by law enforcers and private security officers that are present in the mine sites or transport routes in light of the regulations, 2.2 Preventing EYMs Exposure to Negative Effects 2.2.1 Risk Mitigation The aim is to minimize the risk of exploitation of EYMs by supporting professionalization and formalization of EYMs through cooperatives, professional or other membership-based organizations of their countries of residence. For detailed information as to how this risk mitigation measure will be applied, the Responsible Jewelry Council (RJC), Standards Guideline, “COP 2.1.4 Artisal Mining and Small-scale Mining Establishments” document may be used to encompass also the applications aiming to support the community in a broader scale by purchasing as many products and services as possible from local sources, and to eliminate child employment through social participation, and to improve conditions of women in EYM communities through positive discrimination and incentive – support schemes and programs. 2.2.2 Suggested Indicators for Measuring Improvement Global Reporting Initiative, Indicator Protocols Set: Society, Mining and Metals Sector Supplement (Version 3.0), indicator MM8: “Number (and percentage) of […] operating sites where artisanal and small-scale mining (ASM) takes place on, or adjacent to, the site; the associated risks and the actions taken to manage and mitigate these risks” may be used. For details, please see information about the related indicator. Furthermore, for detailed guidance on collecting related information and reporting on indicators, including risks to communities and women, the following document may be referred to: “Global Reporting Initiative (GRI), Sustainability Reporting Guideline and Mining and Metal Sector Supplement (Version 3.0)” 2.3 Bribery and Fraudulent Misrepresentation of the Origin of Mines 2.3.1 Risk Mitigation 12/41 <!-- page 13 --> HALKA AÇIK Obligors may, for precious metals to be procured from the conflict-affected and high-risk areas, enter into cooperation with suppliers through joint working groups or other appropriate means in terms of compliance with responsible supply chain principles. 2.3.2 Suggested Indicators for Measuring Improvement Improvement indicators must be determined on the basis of the processes defined in the Guideline. For instance, indicators may contain the information declared at the post-refinery stage, the essence of information on the implemented supply chain transparency systems or document archiving and flows, the essence and form of supply chain risk assessment and management, and particularly verification of information produced by document archiving and flow and transparency systems, and participation of supplier company in competence trainings and/or other sectoral initiatives relating to supply chain compliance work. 2.4 Laundering Proceeds of Crime 2.4.1 Risk Mitigation Aside from complying with the provisions of the R Regulation on Measures Regarding Prevention of Laundering Proceeds of Crime and Financing of Terrorism promulgated in the Official Gazette edition 26751 on 09/01/2008, obligors must individually or through professional units, joint working groups or other appropriate means apply the risk mitigating measures suggested as follows with the intention of performing the following activities, in terms of suppliers, customers and transactions: a. To develop warning signals for suppliers, customers and transactions to detect the suspicious acts and activities, and b. To determine and confirm the identity of all suppliers, business partners and customers, and c. To report activities or behaviours of criminal suspicion to local, national, regional or international authorities. For detailed guidance, the Financial Action Task Force, Guidance on the Risk-based Approach to Combating Money Laundering and Terrorist Financing1 may be used for international applications in addition to MASAK (Financial Crimes Investigation Board) legislation. 2.4.2 Suggested Indicators for Measuring Improvement Improvement indicators must be determined on the basis of the processes defined in the Guideline. For instance, indicators may contain the supply chain policy, the information declared at the post-refinery stage, the essence and form of information on the implemented supply chain transparency systems or document archiving and flows, and particularly verification of information produced by document archiving and flow and transparency systems, and participation of supplier company in competence trainings and/or other sectoral initiatives relating to supply chain compliance work. 2.5 Transparency on Payments Made to States and Governments 1 Guidance on the risk-based approach to combating money laundering and terrorist financing, https://www.fatf-gafi.org/media/fatf/documents/reports/High%20Level%20Principles%20and%20Procedures.pdf 13/41 <!-- page 14 --> HALKA AÇIK 2.5.1 Risk Mitigation Obligors may alone or through professional units, joint working groups or other appropriate means apply the risk mitigation measures suggested as follows with the intention of performing the following activities: a. To give support to applications of the Extractive Industries Transparency Initiative 2, and b. To give support to public disclosure of all information separately on taxes, fees and royalties paid to states and governments for mineral extraction, trading and export activities in conflict-affected and high-risk areas, and c. To inform the related local and central authorities about probable weaknesses of income collection and monitoring, and to support on-the-job training activities to increase competences of these units for effective performance of their duties. 2.5.2 Suggested Indicators for Measuring Improvement Global Reporting Initiative, Indicator Protocols Set, Human Rights, Mining and Metal Sector Supplement (Version 3.0), EC1 indicator: “Direct economic value generated and distributed, including revenues, operating costs, employee compensation, donations and other community investments, retained earnings, and payments to capital providers and governments” may be used. For detailed guidance on other indicator descriptions and reporting of indicators, the following document may be referred to: Global Reporting Initiative, Sustainability Reporting Guidelines and Mining and Metals Sector Supplement (Version 3.0). 2 The Extractive Industries Transparency Initiative (EITI), https://eiti.org/standard/overview 14/41 <!-- page 15 --> HALKA AÇIK THIRD PART

3. Five-Step Application for Obligors 3.1 Step I: Foundation of Strong Corporate Management Systems Purpose: To ensure that the level of compliance of the existing situation of companies included in precious metals supply chain with responsible supply chain is determined, and that their management systems are structured in such manner to allow an effective determination of the compliance level of them. To determine the current level of compliance of the companies involved in the precious metal supply chain with regard to the responsible supply chain and to ensure that the management systems are structured in a way that allows an effective compliance level determination study. 3.1.1 General Recommendations for All Companies in the Precious Metals Supply Chain Including Obligors A) A supply chain policy is to be adopted and committed so as to identify and manage risks for precious metals of conflict-affected and high-risk areas. This policy which is valid for all companies in the supply chain, including obligors:

1. Must contain responsible supply chain joint principles and standards so that the company may assess itself, its activities and its relationship with suppliers based on risks of precious metals in conflict affected and high-risk areas, and must be compliant with standards described in supply chain policy document included in Part 4 of this Guideline; and

2. Must contain a comprehensible and consistent management process ensuring appropriate management of risks, and must ensure that the supply chain company adheres to the compliance steps and suggestions defined in the policy document given in Part 4 of this Guideline. B) Internal management systems are to be established for determining the compliance level of the current situation of supply chain. All companies in supply chain, including obligors:

1. Must give authorisation and responsibility to senior managers and executives with the required competence, knowledge and experience to determine the compliance level of the current situation of supply chain for auditing puposes; and

2. Must provide the required resources to support implementation and monitoring of this work; and

3. Must implement the organization and communication processes which will ensure delivery of all critical information, including the corporate policy document, to the related employees and suppliers, and must also organize training activities. Training modules developed by Companies Industry Programs or Institutionalized Mechanisms may be used; and

4. Must establish in-house accountability to determine the compliance level of the current situation of supply chain, and its application. C) A special system must be built for transparency, information collection and audit activities regarding precious metals supply chain.

1. The processes of determining the compliance level of the current situation of supply chain, and the findings detected therein, and the decisions taken in reliance thereupon must be recorded and documented in the company. This also contains, apart from the mentioned step, 15/41 <!-- page 16 --> HALKA AÇIK the additional tasks that may be performed to determine the compliance level of supply chains’ current situation regarding precious metals in the conflict-affected and high-risk areas (See Step II-3.2.1-(B)).

2. The continuity of internal inventory and transaction documentation system must be ensured to retroactively determine the precious metal inputs and outputs and/or support a document archiving and flow system (See Step III-3.1.1-(B)). This must cover the following: a) Keeping record of information about form, type and physical description of precious metals and precious metal-containing materials; and b) Identifying precious metal input and output weights and fineness by using the information given by supplier about weight and fineness of precious metals and precious metal- containing materials; and c) Grasping details of the supplier as well pursuant to “Know Your Counterparty” (KYC) principle within the frame of know-your-customer and international regulations and under the Regulation on Measures Regarding Prevention of Laundering Proceeds of Crime and Financing of Terrorism. promulgated in the Official Gazette edition 26751 on 09/01/2008 and other pertinent regulations of the Ministry and MASAK to prevent the laundering proceeds of crime and the financing of terrorism as per the national and international legislative instruments; and ç) Assigning different reference numbers to each of inputs and outputs; and d) Recording information about input, output, purchasing and sales dates.

3. As per KYC principle, apart from the information and documents specified in the regulations mentioned in Step I-3.1.1-(C)-2c above, the following details are also to be known and recorded: (i) Supplier and supplier’s supplier, and (ii) Legal, corporate structure and fields of activity of each supplier, and (iii) Information on natural persons, if any, directly or indirectly holding 25 percent or more of capital shares in each supplier.

4. In precious metals imports, all information regarding the import status and thereafter are required to be recorded, and to be kept in such manner to be accessible whenever requested. Such information must at least contain: a) Information as to how import is made (declaration, bank receipts, invoice documents, underwhich account name or entity the import is made, whether a payment is received for the import or not, and if a payment is made or will be made, by whom and how it is made and other details); and b) Details regarding the process until the final customer (if the precious metals are refined in Türkiye, information on refinery, contract signed with refinery, such shipping documents as invoice and waybill, and specifications, including quantity, of precious metals delivered and received, and other related information; and c) Information as to how the actual delivery is made (documents such as bank receipts, invoice and waybill, and all of the required KYC information, including communication data, of consignees, and information on persons or entities to whom delivery is made, and if delivery is made to persons or entities different from the persons or entities named in the contract, the reason thereof, and if the import is made under the account of other natural persons or legal entities, in which type of commercial activities they are engaged in, and with which companies they are related and affiliated in Türkiye, and whether they have separate legal personality in Türkiye, and their relations with foreign company from which the import is made, and detailed information as to whether precious metals included in supply chain in Türkiye are recorded in the subsequent taxation and accounting processes, and other related information); and ç) Whether the import is made under the account of another person or not, information on persons or entities to which at least 25 percent of precious metals at once or 50 percent or more of precious metals in total are delivered within 100 days following the import date (also 16/41 <!-- page 17 --> HALKA AÇIK including information as to how actual delivery is made, and as may be requested at the time of delivery). d) Aside from the documents and information detailed in the preceding paragraphs, obligors shall keep current information as to how the import is made, and on the process until the final customer, and the actual delivery, and a current summary containing the information referred to in subparagraph (d), and a current statement prepared to allow an audit in a short time, and to present it to the Exchange whenever requested. a. As far as possible, all payments and collections are to be made through the officialbanking channels. Purchasing in cash should be avoided to the maximum extent possible. If unavoidable, all kinds of cash purchasing transactions are to be supported by verifiable documents showing proof. b. Cooperation should be made with all official authorities completely and transparently in the precious metal transactions. Customs authorities must be permitted to access to any information about all cross-border shipments or other issues and subjects within their area of authorization. c. The information mentioned hereinabove must be kept in computer database media for a minimum period of eight years. D) The corporate relations with suppliers must be strengthened. Companies in supply chain must ensure that their own suppliers comply with a supply chain policy as part of the processes when determining compliance level of the current situation as described in Part 4 and other parts of this Guideline. To this end, the companies:

1. Must aim to build long-term relations with suppliers with the intention of establishing relationships on responsible sourcing; and

2. Must notify their suppliers about the corporate expectations so as to determine the current compliance level in the responsible supply chain of precious metals within the conflict- affected and high-risk areas in accordance with the provisions of Part 5 and this Part of the Guideline, and must particularly advise them that they are expected to determine and adopt a risk management strategy compliant with Step-III specified in this Guideline regarding the risks determined in the supply chain; and

3. Must include the supply chain policy set given in this Guideline in the written agreements and/or commercial contracts signed with suppliers to make sure that it is applicable and traceable; and

4. Must try to develop methods supporting the suppliers so that they comply with the company’s supply chain policies and to develop their performance; and

5. Must be bound by an effective risk management system which may also encompass measurable improvement planning for the suppliers, in cooperation with local and central authorities, international and non-governmental organisationsin order to mitigate risks if applicable. E) A complaint mechanism is to be established at the company and/or mine level. Depending on their positions in supply chain, the companies:

1. Must build an early warning mechanism by which they can express their concerns about the status of precious metal extraction, trading, handling and exporting activities of the related parties in conflict-affected and high-risk areas. This mechanism also enables the company to get information about the risks in supply chain, in addition to the company’s own information and risk assessments; and

2. Must build a mechanism allowing an application to be made directly to an external specialist or organization (like ombudsman) by themselves or in cooperation with other companies and organizations. 17/41 <!-- page 18 --> HALKA AÇIK 3.1.2 Special Recommendations for Companies in Precious Metals Supply Chain Including Obligors A. Medium and large-scale mining establishments and labour-intensive and small-scale mining establishments:

1. Must give a reference number to each gold dore bar or alluvial gold container and to similar outputs, and must attach or press this reference number on the related output so as to make sure that all falsification or modification attempts may be clearly seen and understood; and

2. Must take physical security measures to protect precious metals, such as using sealed shipping containers to make sure that any falsification or unpacking attempts are clearly noticeable during shipment. In conflict-affected and high-risk areas, such types of physical security measures must be verifiable by reliable and generally accepted third parties (such as customs authorities, independent auditors, Industry Programs or Institutionalized Mechanisms). B. Local exporters, recyclers and international traders of recyclable precious metals and precious metals extracted from mines (ore):

1. Must give a different reference number to all inputs and outputs depending on the type of precious metals, and must attach and/or press this reference number on the related outputs so as to make sure that all falsification or modification attempts may be clearly seen and understood; and

2. Must coordinate and support the physical security applications or measures used by other post-refinery companies. Any signs as to falsification of shipment must be immediately reported, and unsealing and shipping operations must be carried out only by duly authorized personnel; and

3. Must control whether all shipments are same with the types of precious metals notified by supplier or not, and must confirm the weight and quality data given by precious metal producer and/or freight company, and must keep a corporate record related to the confirmation. Probable inconsistencies between the initial shipment control results and the information given by freight company must be immediately notified to internal security department and to corporate bodies and authorities in charge of compliance, and then, the supply process must be halted until the inconsistency is remedied; and

4. Must physically separate and protect the inconsistent shipments that cannot be remedied; and

5. Must try to enter into direct agreements with labour-intensive and small-scale precious metal producers or their representatives with the intention of eliminating the precious metals supplied by intermediaries exploiting the labour-intensive and small-scale precious metal producers. C. Refineries:

1. Must give a different reference number to all inputs and outputs depending on the type of precious metals, and must attach and/or press this reference number on the related outputs so as to make sure that all falsification or modification attempts may be clearly seen and understood. These reference numbers must indicate all information, including the origin of precious metal and the supplier “KYC” information, collected about the input and output of subject precious metal and obtained in the course of work when determining compliance level; and

2. Must coordinate and support the physical security applications or measures used by other post-refinery companies. Any signs as to falsification of shipment must be immediately 18/41 <!-- page 19 --> HALKA AÇIK reported, and unsealing and shipment operations must be carried out only by duly authorized personnel; and

3. Must control whether all shipments are same with the types of precious metals notified by supplier or not, and must confirm the weight and quality data given by precious metal producer and/or freight company, and must keep a corporate record related to said confirmation; and

4. Probable inconsistencies between the initial shipment control results and the information given by freight company must be immediately notified to internal security department of refinery and to corporate bodies and authorities in charge of compliance, and then, the supply process must be halted until the inconsistency is remedied; and

5. Must physically separate and protect the inconsistent shipments that cannot be remedied; and

6. All precious metal outputs must be recorded and made identifiable with the following information (e.g. by physically pressing on gold products and/or by attaching to their packs to make sure that any falsification/deletion acts are clearly seen and understood), and the following information must be affixed or pressed on the related output so as to make sure that all falsification or modification attempts may be clearly seen and understood: a. Name and/or seal/logo of refinery; and b. Refining/production year, weight, calibration of fineness; and c. Unique reference number given to each output (serial numbers, electronic identification number or other applicable tools, etc.). D. All post-refinery companies (users of post-refinery precious metals or products made of precious metals, and manufacturers producing precious metal containing products):

1. Must request mine/refinery information from suppliers for all precious metal containing products and materials. Such information must either be directly acquired or through signs printed on refined precious metal products or be received from post-refinery product suppliers; and

2. If precious metal refineries are identified, must request the refineries to confirm that they are applying a policy for determining compliance level of the current situation of a supply chain which is in conformity with this Guideline; and

3. Must transfer and report to post-refinery customers the information for identifying previous refineries involved in the precious metal containing materials and products. 3.2 Step II: Determining and Assessing the Risks in Supply Chain Purpose: The aim is to determine and assess the risks of precious metal extraction, collection, trading, transportation and export activities in conflict-affected and high-risk areas. Companies included in precious metals supply chain must employ strong management systems to be implemented under Step-I to determine and assess the risks that precious metals produced or purchased by them in their own supply chain may contribute to conflicts or significant breaches of human rights. All companies may make use of joint ventures in order to follow the recommendations given in this part. However, their responsibility determining the compliance level of the current situation of their own supply chain is reserved. 19/41 <!-- page 20 --> HALKA AÇIK 3.2.1 Risk Assessment for Medium and Large-scale Mining Establishments and Labour-intensive and Small-scale Mining Establishments A) It is required to find out whether precious metal producer is extracting or transporting precious metals (“activities with a warning signal”) in conflict-affected and high-risk areas or not. For this purpose, general situation and conditions of origin and transportation route of precious metal must be examined in reliance upon evidences provided by reliable sources. In addition, efforts must be shown in good faith in order to reasonably determine the basis for explanations given in this Guideline regarding conflict-affected and high-risk areas.

1. If a precious metal producer can prove that it is by no means engaged in any mining or transportation activities in conflict-affected and high-risk areas as part of the information collected under Step-I, then, it is not required to carry out any additional work when determining the compliance level of the current situation of a supply chain. Management systems formed pursuant to and under Step-I must be continued and regularly reviewed.

2. If a precious metal producer concludes that it is engaged in mining or transportation activities in conflict-affected and high-risk areas, then, it must continue with Step II-3.2.1-(B). B) It is required to determine whether precious metal producer has the potential to purchase precious metals of conflict-affected and high-risk areas (e.g., gold of labour-intensive and small-scale mining establishments) or not. To this end:

1. All mine sites and/or mine smelting plants from which precious metal producer purchases, including EYM precious metals, must be determined.

2. “KYC” information gathered in Step-I about these suppliers must be reviewed, and additional information must be obtained about origin and transport route of other precious metals, as cited above, based on first-hand evidences and reliable sources of information.

3. With regards to other precious metals mined, maximum efforts must be shown in order to determine whether any one of “warning signals” listed and defined below exists in the supply chain or not. The following are warning signals in terms of origin and transport route of precious metals: • Precious metals being mined or transported through a conflict-affected or high-risk area; or • Precious metals imported from a country with limited known reserves, potential sources or expected production levels (e.g. gold volume imported from that country being incompatible with the known reserves or expected production levels therein); or • Precious metals imported from a country known for or reasonably suspected of being received from conflict-affected and high-risk areas; or • Precious metals being obtained from recyclable / scrap or mixed sources, and refined in conflict-affected and high-risk areas, or known or suspected to have been transported through such areas. For each of these above warning signals about the origin and transport routes, if the Legislation on Prevention of of Laundering Proceeds of Crime and Financing of Terrorism, anti-bribe legislation, customs inspections and other audit or surveillance related legislation are applied weakly, and/or if unofficial banking channels are used, or cash is used predominantly, then the risk increases. The following are warning signals for precious metals suppliers: 20/41 <!-- page 21 --> HALKA AÇIK • If suppliers or other known mining/refinery companies are actively operating in any one of the places having warning signals as specified above, or, holding capital shares or having an interest in any one of precious metals suppliers from any one of the places having warning signals in terms of origin and transport route of precious metals as stated above; or • If suppliers or other known mining/refinery companies are known to have supplied and transported precious metals from a place having a warning signal during the last 12 months; or • If precious metals are known or suspected to have beeen obtained from recyclable / scrap or mixed sources, or transferred or procured through conflict-affected and high-risk areas. Warning signals: Extraordinary or abnormal circumstances are determined based upon information collected in the course of Step-I and indicating the probable extraction, transportation and trading activities of precious metals contributing to conflicts or gross misconducts. a) If no warning signal is received or determined: If precious metals producer can determine, based on reliable evidence that such signals are not valid for its own supply chain, then, it is not necessary to determine the compliance level of the current status of an additional supply chain. In this case, the management systems built in Step-I must be sustained and regularly reviewed. b) If a warning signal is determined or there is lack of information: A precious metals producer which detects a warning signal in its supply chain or cannot exclude any one or more of these warning signals from its supply chain must continue with Step II-3.2.1-(C). C) Actions to be taken with regards to the existing or planned activities of the precious metals producer with warning signals are described as follows:

1. The work for determining the compliance level of the current situation of areas and suppliers with warning signals must be examined in depth. That is to say: a. Research reports and maps published by states or governments, international and non- governmental organizations and media, UN reports, sectoral literature relating to the effects of UN Security Council sanctions on precious metals extraction activities and the effects of them on conflicts, human rights and environmental damages in the country of origin, and other publications open to the public must be reviewed. b. Information must be exchanged and interviews must be held with local and central authorities, local non-governmental organisations, UN departments and local suppliers. Related questions of cooperating companies must be answered and their requests for clarifying the issues must be met. c. Whether mining/refinery companies have policies and management systems compliant with the Guideline, and if so, whether their policies and management systems are functional and operational must be determined.

2. Field assessment teams shall be appointed. Precious metals producers having business activities containing warning signals must appoint assessment teams to work in the field to produce information for precious metals extraction, trading, handling, refining and export activities. Though precious metals producers are individually responsible for collecting the required data, they may also jointly appoint such an assessment team by cooperating with mining/refinery companies or their customers supplying precious metals from these areas or operating in those areas or by getting support from an Industry Program or Institutionalized Mechanism. If it is not possible to appoint “joint” teams or if companies do not prefer to work 21/41 <!-- page 22 --> HALKA AÇIK jointly, then, each of the companies must itself perform the field assessments. Companies appointing assessment teams and other related parties: a) Must consider the following factors when appointing joint assessment teams in cooperation with other companies: sources provided for determining the size of the contributing company and the compliance level of the current status, opportunity of each company to access the information collected from the field, position of the company in the supply chain, and reliability when determining compliance level of the current status of the company (they may be determined by application of cross-checking the data provided by the company about all precious metals inputs). b) Must ensure that auditors are entirely independent from the audited activities and are by no means in a conflict of interests with them. The company auditors must be able to present objective and reliable reports by showing the maximum professional diligence. c) Must appoint specialists having the required information and skills in the following issues and areas, thereby ensuring that the required competence levels are accomplished: i) assessed operational contents (language capacities, cultural sensitivities, etc.); and ii) principles of risks related to conflicts (such as standards stipulated in this Guideline, and human rights, international humanitarian law, bribe, fiscal crimes, conflicts and their financiers, and transparency); and iii) type and form of the precious metals supply chain; and iv) standards and processes set down in the Guideline. d) Assessment teams must have access to the mine sites, intermediaries, collectors and freight companies under control or management of the company, and i) physically to all plants used for load transfer or relabeling purposes, also including those seated in other countries, and ii) to all books, records or other evidences of supply applications, and to tax/fee/royalty payment records and export documentation, and iii) to local logistic support and assistance, and iv) to security for itself and other information providers. e) If appropriate, must organize or support the organisation of community monitoring network and/or multilateral information units for flow of information to the assessment team, and must examine and make revisions "to interactive maps showing the locations of mine sites, armed groups, trading routes, closed roads and airports, and if possible, must itself create these maps.

3. In terms of Large-scale Mining precious metals activities (Large-scale Mining precious metals extracted by medium and large-scale mining establishments dealing with business activities containing warning signals or purchased from other sources), for determining probable risks, fact-based information must be obtained in respect of the conditions of precious metals extraction, processing, trading, handling, transportation and export activities.

4. In terms of Artisal and Small-scale Mining (ASM) precious metals activities (Labour- intensive (EYM) Mining precious metals extracted by EYM establishments through business activities containing warning signals or purchased from medium and large-scale mining establishments), fact-based information must be obtained in respect of the conditions of precious metals extraction, processing, trading, handling, transportation and export (if any) activities. Companies must take steps specified in Step III with the intention of helping labour- intensive and small-scale miners to form of a safe, transparent and verifiable precious metals supply chain. D) Risks in supply chain shall be assessed. Information collected or learned by the company regarding actual conditions in supply chain containing warning signals must be 22/41 <!-- page 23 --> HALKA AÇIK evaluated in whole. In the case of an inconsistency between information acquired by it and the following events and items, the company must consider and treat such inconsistency as a “risk”.

1. The company’s supply chain policy which is consistent with Part 4 of this Guideline, and

2. Information collected in tandem with Step-I of this Guideline in respect of the standards and processes of determining compliance level of the current situation of supply chain as envisaged in this Guideline, and

3. National laws of countries where the company is officially registered or its capital shares are offered to public, and countries where precious metals are extracted, transferred or re-exported/may be re-exported, and 4. Legal tools such as financing agreements, contractor agreements and supplier agreements regulating the business activities and relations of the company, and

5. International regulations regarding responsible supply chain, and other related international legislative instruments such as international recommendations and directives on human rights and on struggle against laundering proceeds of crime. 3.2.2 Risk Assessment for Local Exporters, Recyclers, International Traders of Precious Metals Mined or Recycled, and Refineries A) It is necessary to determine the origin of precious metals. Assessment of risk in supply chain starts with the origin of supplied precious metals. Different origins contain different types of risks and require different types of risk assessment. All assessments regarding the origin of precious metals must be established on reasonable and good faith efforts of the company based upon evidence collected under Step-I and other first-hand evidence (through relations with suppliers and desk-based researches) and evidence obtained from reliable sources. Local precious metals exporters, international precious metals traders and refineries must evaluate and validate the information provided by suppliers in proportion to available risks in order to be able to give correct decisions on origins of precious metals. The following criteria are valid for determining the origin of precious metals.

1. As for precious metals extracted out of mine, regardless of the size of ore mining plant, the origin of precious metal is the mine itself.

2. As for recyclable precious metals, the origin of precious metal is the place where it becomes recyclable. For instance, the place where a precious metal is sold for the first time to its recycler/refinery, or in other words, where precious metal is put into process for reuse in the precious metals industry to protect its metal value, determines its origin. The place where a precious metal is made recyclable must be examined in the course of determining compliance level of the current situation of refinery’s supply chain, to prevent probable false statements that may be made for hiding the origin of precious metal.

3. As for grandfathered stocks, if it may be confirmed with “a verifiable date” that precious metals have reached their currently available forms prior to 1 January 2012, it is not required to determine their origin. So as to make sure that the trading of the grandfathered stocks does not contradict with UN sanctions or decisions, and that crime revenues are not laundered through or as a result of sales of reserves in conflict-affected and high-risk areas, it should be checked whether there are “warning signals” described below, and if available, additional compliance work for suppliers should be initiated. B) It is necessary to identify the warning signals in supply chain. On the basis of the information available on origin of precious metals and the information (including “KYC” data and information) obtained in Step-I, companies must decide whether there are “warning 23/41 <!-- page 24 --> HALKA AÇIK signals” as specified below in supply chain process regarding stocks of precious metals extracted out of mine, recyclable or existing. The following are warning signals in terms of origin and transport route of precious metals: • Precious metals being extracted out of transported through a conflict-affected or high- risk area; or • Precious metals being imported from a country with limited known reserves, potential sources or expected production levels (e.g., precious metal volume imported and being incompatible with the known reserves or expected production levels of that country); or • Precious metals being imported from a country which is known for or reasonably suspected of being received from the same from conflict-affected and high-risk areas; or • Precious metals being known or suspected to have been obtained from recyclable / scrap or mixed sources, and refined in conflict-affected and high-risk areas. In these origins and transport routes containing such types of warning signals, if the legislation on prevention of laundering proceeds of crime, anti-bribe legislation, customs inspections and other audit or supervision related legislation are applied weakly and/or if unofficial banking channels are used or cash is used predominantly, then the risk increases. The following are warning signals in terms of suppliers of precious metals: • If suppliers or other known mining/refinery companies are actively operating in any one of the places having warning signals as specified above or holding capital shares or having an interest in any one of precious metals suppliers from any one of the places having warning signals in terms of origin and transport route of precious metals as stated above; or • If suppliers or other known mining/refinery companies are known to have supplied precious metals from the origin or along the transport route of a precious metal having a warning signal during the last 12 months then, the risk is higher. Warning signals: Extraordinary or abnormal circumstances are determined based upon information collected in the course of Step-I and indicating the probable extraction, transportation and trading activitiesof precious metals contributing to conflicts or gross misconducts. a) If no warning signal is received or determined: If local precious metals exporter, international precious metals trader or refinery can determine and demonstrate based on reliable evidence that such warning signals are not valid for its own supply chain, then, there is no need to perform the work for determining compliance level of the currentsituation of an additional supply chain for that specific supply chain. In this case, the management systems built in Step- I must be sustained and regularly reviewed. b) If a warning signal is determined or there is lack of information: A local precious metals exporter, international precious metals trader or refinery which detects warning signals in its supply chain or cannot exclude any one or more of these warning signals from its precious metals supply chain must continue with Step II-3.2.2-(C) hereinbelow. C) It is necessary to identify the conditions of existing and planned supply chain of the company carrying warning signals. 24/41 <!-- page 25 --> HALKA AÇIK

1. The work for determining compliance level of the current situation of areas and suppliers carrying warning signals must be examined in depth.

2. It is required to appoint and organize field assessment teams for precious metals extracted out of mines. Local precious metals exporters, international precious metals traders or refineries having the predetermined warning signals will in any case continue to be individually responsible for ensuring that the company collects correct information and data about the actual conditions of supply chain carrying warning signals. The entities listed above having warning signals in their supply chain must organise and appoint field assessment teams in order to collect information about mine extracting, trading, handling, refining and export conditions and suppliers. Mining/refinery companies may individually appoint the team themselves or act jointly and cooperate with other mining/refinery companies operating in the related areas or supplying precious metals through a sectoral or multilateral mechanism or initiative.

3. It should be determined whether the precious metal extracted out of mine is a Medium and Large-scale Mining precious metal or a Small-scale Mining precious metal.

4. As for recyclable precious metals, by giving priority to persons, places and operations carrying a higher risk, and by applying a risk-based approach, additional data and information must be collected about precious metals obtained from a recyclable precious metal supply chain carrying warning signals. As an important part of determining compliance level of the current situation of risk-based supply chain, the suppliers and transactions must be defined at each level, and the related records must be kept and safeguarded. Contents of such types of risk factors include, but are not limited to, the following: a. Value of transaction: For all types of recyclable precious metal operations and transactions outside conflict-affected or high-risk areas, starting with a transaction value of 15,000 US Dollars, a progressive compliance work proportional to the increasing amount must be adopted. However, operations performed in or around a mine site may also cover very small amounts. For this reason, all types of recyclable precious metal operations and transactions in conflict-affected or high-risk areas require intensive care and inspection, whatever its value is. b. Place of transaction: Precious metals are valuable also in small quantities and can be easily carried. Though there is no entirely risk-free place, some places are riskier for precious metals operations and transactions. i. Places where precious metal transport route and export cannot be compared as required with the declared position of origin, and ii. Places having easy access to competitor markets or processing plans close to the declared position of origin of precious metal, and iii. Places where the legislation on Prevention of laundering proceeds of crime and financing of terrorism, anti-bribe legislation, customs inspections and other audit or supervision related legislation are being applied weakly, and iv. Places having cash-based economy, where unofficial banking systems and channels are used. c. Material Type: The use of unprocessed recyclable precious metal as a tool in laundering of precious metals extracted out of conflict-affected and high-risk areas, like smelted recyclable precious metal, is a very rare situation. It is a process requiring a lot of phases and a high cost to upgrade the fineness of, and refine, precious metals produced with a high concentration in a conflict-affected area and transform them into marketable precious metals. That is why it is a very low probability to launder crime revenues with materials of low value. d. Extraordinary conditions: Consistency of precious metals to be recycled must be examined within the context. For instance, a sudden and unusual increase in the quantity of materials of high purity procured from a supplier or an area must be definitely explainable and 25/41 <!-- page 26 --> HALKA AÇIK justifiable. If the jewelry preferred in a country is predominantly 14 carat (58%), a statement that the quantity of recycled jewelry is 90% must absolutely be questioned. e. Supplier: Different recyclable precious metal suppliers generally cause risks of varying degrees in terms of activities similar to laundering proceeds of crime. For instance, recyclable precious metals produced in a plant duly controlled during production / processing operations will pose a lower risk than a collector which procures and supplies recyclable precious metals from many different sources. Existence of a material inconsistency between compliance processes suggested in this Guideline and practices of suppliers, or the supplier’s “being at a distinct and unexplainable geographical distance” in comparison to another supplier or counterparty may also be listed among other examples of high-risk factor.

1. As for the recyclable precious metals, the following information must be obtained and collected, to the extent possible, with regards to transactions requiring more inspections and to be more careful through desk-based researches, visits paid to plants of precious metal suppliers, random verification of purchasing records in proportion to risks, examination and assessment of purchasing transactions in further depth, and reference to national and international regulations and conventions pertaining to fight against laundering proceeds of crime and financing of terrorism. a. Whether there are production plants where scrap may be produced or not, and b. Whether a material capital share or financial turnover is held in jewelry enterprises belonging to private sector or not, and c. The reasonable approximate level of recyclable / scrap precious metal trade must be determined through plant visits and examination of documents, by also taking into account that the level will especially vary depending on the precious metal prices and economic conditions in the market. D) It is required to assess the risks in supply chain. Information obtained by determiningactual conditions containing warning signals in supply chain of the company must be assessed. The company must consider and treat it as a “risk”, in case of an inconsistency between information gathered and the following items.

1. The company’s supply chain policy standards which are consistent with Part 4 of this Guideline, and

2. The standards and processes of determining compliance level of the current situation of supply chain as envisaged in this Guideline, and

3. National laws of countries where the company is officially registered or its capital shares are offered to public (if any), and countries where precious metals are imported, transported and/or re-exported, and

4. Legal tools such as financing agreements, contractor agreements and supplier agreements regulating the business activities and relations of the company, and

5. Other related international legislative instruments pertaining to responsible supply chain, such as recommendations and directives on human rights and on struggle against laundering proceeds of crime. 3.2.3 Risk Assessment for Post-Refinery Companies A) Post-refinery Companies must determine the risks in their own supply chains by assessing the compliance work of refinery companies, serving as their suppliers, in the light of the Exchange’s responsible supply chain regulations. Refinery companies included in precious metal supply chain are required to be defined as clearly as possible and to the maximum extent. While precious metal refineries may be identified through demands of post-refinery supply 26/41 <!-- page 27 --> HALKA AÇIK chain, Post-refinery Companies must assess and confirm the statements of suppliers via risk- proportional steps. In some cases, there is a refinery company stamp pressed on bullion, coin, bar or other types of precious metal products of refineries.

1. If refineries can be identified, the process must be continued with the following Step II-3.2.3-(B), or

2. If refineries cannot be identified despite best efforts, the process must be continued with the following Step III-3.3.2. B) In order to check and determine whether warning signals in supply chain are identified by refineries or not, or whether this is reasonably required to be done or not, preliminary evidences must be collected when determining compliance level of the current situation of refinery. Decisions as to whether warning signals in supply chain are identified by refineries or not, or whether it is reasonably done or not, must be based on the company’s reasonable and good faith efforts regarding the evidence collected in Step-I or additional information (obtained through relations with suppliers or desk-based researches). So as to give reasonable decisions, the companies must compare the statements of suppliers to their external risk-proportional evidence and proof sources.

1. If the refinery cannot identify any warning signal: If a Post-refinery Company included in the precious metals supply chain can determine based on reliable evidence that a warning signal has not emerged for the subject refinery’s own supply chain, then, it is not required to perform additional work for determining compliance level of the currentsituation of supply chain specifically for that supply chain. In this case, management systems formed in Step-I must be continued and be regularly reviewed.

2. If the refinery identifies a warning signal or lack of information in its precious metal supply chain: A Post-refinery Company which identifies a warning signal in precious metal supply chain of its refinery or cannot exclude one or more warning signals from the precious metal supply chain must proceed with the following Step II-3.2.3-(C) as described under the heading below. C) The work for determining compliance level of the current situation of supply chain of refineries whose precious metal supply chain contains warning signals are required to be assessed, and their risks to be analyzed. For the purpose of a risk assessment, companies must decide whether refineries having warning signals in their supply chains conduct and complete according to recommendations given in this Guideline all stages and components of their work for determining compliance level of the current situation of responsible supply chain in respect of precious metals of conflict-affected and high-risk areas or not. Post-refinery Companies:

1. Must collect evidence about the precious metal supply chain compliance work and activities of refineries; and

2. Must review the information produced by any risk assessment team; and

3. Must verify the findings of the work for determining compliance level of the current situation of refinery through the supply chain policies described in this Guideline and the compliance processes for determining compliance level current situation of supply chain. Any logical inconsistency found between the applications of the company’s suppliers for determining compliance level of the current situation of them and the company’s supply chain policy must be accepted and considered by the company as a risk requiring certain measures and actions to be taken under Step-III (with reference to Part 5).

4. When auditing the compliance level of the current situation of the refineries according to standards set in this Guideline, the audit result must be analyzed. If it is determined that the compliance level of the current situation of refineries are not audited properly or there is a inconsistency with the standards and processes defined in this Guideline, then, the Post-refinery 27/41 <!-- page 28 --> HALKA AÇIK Companies must try to manage the risks according to Step-III and must opt to procure products only from refineries audited in accordance with Step-IV. 3.3 Step III: Designing and Implementing a Response Strategy to Detected Risks Purpose: The aim is to assess the detected risks and respond to them to prevent or reduce their possible negative effects. Companies may act jointly in order to fulfil the recommendations given in this part. However, given that each company will continue to be held individually liable for determining compliance level of the current situation of its responsible supply chains, they must make sure that the specific conditions of each of the companies are also taken into consideration in such joint work with the companies. 3.3.1 Risk Management for Obligors A) All findings must be reported to senior management by outlining the information collected and the existing and potential risks detected in supply chain risk assessment. B) Internal systems established for transparency, information collection and control activities with regards to precious metals supply chain under Step I-3.1.1-(C), as well as interaction with suppliers must be further developed. Obligors:

1. Must build a monitoring system to collect and safeguard various information mentioned in Step II-3.2.1-(C) and Step II-3.2.2-(C) with regards to all precious metal input and output in a supply chain containing warning signals; and

2. Must build proper physical security structures to detect inconsistent information given by suppliers about mine production and mine processing levels and their capacities or precious metal shipments; and

3. Must physically separate all shipments containing predefined risks related to conflicts and other significant breaches of human rights from others and must provide security and assurance for them all; and

4. Must incorporate into the commercial and/or written agreements signed with suppliers certain clauses allowing them to exercise sudden and spot controls in suppliers and to have access to the related documents; and

5. Must share with all parties in supply chain the following information collected and kept by assessment team for each precious metal input along supply chain: a. Origin of mine (as clearly as possible), and b. Locations where precious metals or precious metal containing materials are consolidated, mixed, crushed, milled, melted and refined; and c. Method of extraction (Artisal and Small-scale Mining (ASM) or medium and large- scale mining) and dates of concentration, smelting and refining; and ç. Weight and analyzed purity and fineness specifications (assayed quality); and d. Information on corporate structure, containing identity data, shareholding structure (also including the real beneficiary), and names of company managers and duly authorized officers, of all service providers and suppliers handling precious metals and positioned along the supply chain from origin of mine to refinery, as well as relations of these companies and their duly authorized officers with business world and administrative, political and military circles in conflict-affected and high-risk areas; and e. All kinds of taxes, fees and royalties paid to public authorities in relation with precious metals extraction, trading, transport and exportat activities; and 28/41 <!-- page 29 --> HALKA AÇIK f. All other payments made to public authorities in relation with precious metals extraction, trading, transport and export activities; and g. All payments made to security forces and private security officers or other armed groups along the whole supply chain starting from extraction of precious metals, providing that they are not prohibited by laws and regulations pertaining thereto; and ğ. How the precious metals are transported and processed for the sake of achievement of integrity with regards to security issues; and

6. The obligors must keep all information collected during the process of determining compliance level ready for access by auditors to comply with local or global Industry Programs or Institutionalized Mechanisms having the authorization to collect and process information about supply of precious metals from conflict-affected and high-risk areas. In absence of such types of programs or mechanism, the related information must be kept open for access by the relevant post-refinery companies. C) A risk management plan must be designed and implemented. Obligors must apply a supply chain risk management plan containing the responses given to risks defined in Step-II in accordance with Fourth Part of this Guideline. Obligors may manage their risks by maintaining their trading activities under measurable risk mitigation measures, or by temporarily suspending their trading activities in tandem with the existing measurable risk mitigation measures, or if risk reduction measures fail or are no more feasible, applicable or acceptable, by terminating their relations with the subject supplier. In order to determine and develop a risk management strategy, obligors:

1. Must review the supply chain policy document regarding precious metals of conflict- affected and high-risk areas or their own internal policies given in Part 4 of this Guideline; to decide whether risks identified above can be mitigated by maintaining, suspending or terminating relationship with suppliers; and

2. Must manage their risks that do not require terminating relationship with a supplier by using measurable risk mitigation methods. Measurable risk mitigation methods must aim to create a significant and measurable improvement within six months after the effective date of risk management plan. While developing a risk mitigation strategy, obligors: a. Must put and/or impose pressure on actors who may directly and most effectively mitigate the risks contributing to conflicts along the supply chain. Obligors may already have an actual or potential influence or leverage on other companies included in supply chain. Obligors must find the ways of building a constructive interaction with suppliers and other related parties and must try to achieve considerable and measurable developments for elimination of risks within six months following the effective date of risk management plan; and b. Must enter into negotiations and come to a mutual agreement with suppliers and the affected parties on the subject of measurable risk mitigation strategy in risk management plan. Measurable risk mitigation strategy must be adjusted according to certain suppliers of the company and their activities, and must clearly specify the performance objectives and goals desired to be achieved within six months following the effective date of risk management plan, and must contain quantitative and/or qualitative indicators to be used for measurement of improvement. Obligors must provide the affected parties with sufficient time for review and examination of risk assessment and risk management plan, and must take into consideration and must respond to probable questions, concerns or alternative suggestions on the subject of risk management; and c. If appropriate, must participate in or give support to Industry Programs and Institutionalized Mechanisms relating to responsible supply chain management, and 29/41 <!-- page 30 --> HALKA AÇIK must take into account both the social and economic effects of such types of initiatives in the developing countries and their effects on the existing internationally accepted standards. D) Risk management plan must be applied, and performing risk mitigation process must be monitored, and current situation must be reported to responsible senior managers, and in accordance with the risk management strategies suggested under this Step, if and to the extent the risk mitigation initiatives fail, the suspension or termination of relationships with the subject supplier must be considered. To the extent it is feasible, obligors must implement the risk mitigation plan and monitor and track the performance of this plan in cooperation and/or in due consultation with local and central authorities, other mining/refinery companies, international or non-governmental organizations, and affected third parties. For the purpose of monitoring of risk mitigation performance, obligors may build or organise joint monitoring network or give support to the building of them. E) For the risks required to be mitigated, if and when conditions change, it is required to perform additional situation and risk assessments. Determining compliance level of the current situation of responsible supply chain is a dynamic process which requires the continuous monitoring of risks. After application of a risk reduction strategy, the companies must repeat Step-II for an effective risk management. Furthermore, any change in supply chain of the company may require repetition of some steps for reduction or prevention of effects thereof. 3.3.2 Risk Management for Post-refinery Companies A) The findings must be reported to senior management by outlining the information collected and the existing and potential risks determined during supply chain risk assessment process. B) Special system established for transparency, information collection and audit activities for precious metals supply chain under Step I-3.1.1-(C) must be ensured to increase its interaction with suppliers. Both the special information reflecting the identity of refineries and updated regularly, and the findings used for determining compliance level of the existing situation as detected under Step II-3.2.3 must be included in these mechanisms. C) A risk management plan must be designed and applied. A supply chain risk management plan also containing the responses given by obligors to the risks identified in Step- II must be applied. This strategy will vary depending on whether the refineries in the supply chain are defined and identified or not. D) Risk management plan must be applied, and performance of risk mitigation process must be monitored, and current situation must be reported to responsible senior managers, and if and to the extent the risk mitigation initiatives fail, the suspension or termination of relations with the subject refinery, or the application as corrective actions of the recommendations for determining compliance level as described in this Guideline are required. E) For the risks required to be mitigated, or in the case of change of conditions, additional status and risk assessments are required to be made. Determining compliance level of the current situation of supply chain is a dynamic process which requires continuous monitoring of risks. Companies must repeat Step II for an effective risk management after application of a 30/41 <!-- page 31 --> HALKA AÇIK risk mitigationstrategy. Furthermore, any change in supply chain of the company may also require some new steps to be taken for mitigationor prevention of probable negative effects. 3.4 Step IV: Audit by Independent Third Parties for Determining Compliance Level of the Current Situation of Supply Chain of Obligors (Independent Assurance Report) Purpose: The aim is to implement independent third party audit to determine compliance level of the current situation of responsible supply chain of obligors regarding precious metals of conflict-affected and high-risk areas, and to support the obligors in developing various methods and ways through Institutionalized Mechanisms or Industry Programs. The contents of this part is not intend to create an audit standard, but only aims to set down some basic principles, scope, criteria and other fundamental data and information to be taken into account by these companies, Industry Programs or Institutionalized Mechanisms in independent third party audit to determine gcompliance level of the current situation of supply chain. 3.4.1 Assurance Audit Planning A) To determine compliance level of the current situation of responsible supply chain of obligors with regards to precious metals of conflict-affected and high-risk areas must be planned and audited by an independent third party. This audit must be conducted to cover the following scope, criteria, principles and activities and to obtain adequate audit evidences providing a reasonable assurance in connection therewith:

1. Audit Scope: Audit must encompass all activities and processes performed and all systems employed by obligors for determining compliance level of the current situation of responsible supply chain of obligors regarding precious metals of conflict-affected and high- risk areas. The audit also covers, but are not limited to, the policies and procedures conducted on the precious metals supply chain of obligor, the communications with actors involved in the precious metals supply chain, information disclosed to post-refinery companies about suppliers, document archiving and flow data and other information used for traceability, the Obligor’s risk assessments, also including field researches, as well as the Obligor’s strategies on risk management.

2. Audit Criteria: Benchmarks employed for assessment and measurement of compliance level of the current situation of responsible supply chain of obligors are this Guideline, and Borsa İstanbul Due Diligence Directive on Responsible Supply Chain of Precious Metals, Borsa İstanbul Directive on the Responsible Supply Chain Assurance Engagement, Borsa İstanbul Directive on Internal Control System and Borsa İstanbul Due-Diligence Principles of Precious Metals Intermediary Institutions and Refineries Metals.

3. Audit Principles: a) Independence: For audit neutrality, the whole audit team and if any, board of audit (“auditors”) must be entirely independent from Obligors and their affiliated companies, licensees, contractors and suppliers and from companies entering into cooperation in joint audit. As a matter of fact, this principle particularly means that there must be no conflict of interests (in the form of capital, debt or guarantee), also including commercial and financial relationships, between auditors and audited party, and that the audited company and/or other 31/41 <!-- page 32 --> HALKA AÇIK supply chain actors assessed accordingly must not never have offered any services in the course of design, production and determining compliance level of the current situation of responsible supply chain within the last 24 months prior to the date of signature of audit contract. This independence is maintained throughout the audit period and the period covered by the information which constitute the audit subject. b) Competence: Auditors must have special competencies, and personal attributes and qualifications needed for completion of independent third-party audit. Audit firms refer to the Independent Audit Regulation and the Responsible Supply Chain Assurance Engagement Directive promulgated in the Official Gazette edition 28509 on 26/12/2012 for detailed conditions relating to auditor competencies. Competencies relating to the scope of audit contain, but are not limited to, the following: i. Audit principles, procedures and techniques, and ii. Principles, procedures and techniques for determining compliance level of the current situation of supply chain, and iii. Precious metals supply applications and precious metals supply chains, and iv. Social, cultural and historical circumstances, including language skills and cultural sensitivities for performing audit activities, of the precious metals extraction or transport areas affected from conflicts, and v. International regulations and instruments, including supply chain policy document, regarding mine sites of conflict-affected and high-risk areas. c) Accountability: An Industry Program or Institutionalized Mechanism must regularly review and monitor the competencies of auditors for performing audit in accordance with audit program, purposes, scope and criteria on the basis of audit program records.

4. Audit Activities: 1) Audit preparation: Audit objectives, scope, language and criteria must be clearly notified to all auditors, and nothing should be left ambiguous between auditee and auditors before beginning audit activities. Auditors must determine the feasibility of the audit by considering the available time, sources and information and the cooperation of related parties. 2) Onsite research: Auditors must, before starting their onsite research, prepare an audit plan and its preliminary work documents. Auditors must collect more evidence and and verify the disclosed information by interviewing the related parties (including interviews held with management and assessment teams), making observations and reviewing the documents. Onsite research must cover: i. The plants and fields where obligors carry out their work to determine compliance level of the current situation of responsible supply chain of obligors with regards to precious metals of conflict-affected and high-risk areas, and ii. A sample taken from suppliers of obligors, to cover also the precious metals producers, local exporters and international precious metals traders, as may be needed pursuant to GDS 3000 Audit standard, and iii. Negotiations held with assessment teams to examine verifiable, reliable and current information production standards and methods, which may also be held by remote communication means, and 32/41 <!-- page 33 --> HALKA AÇIK iv. Negotiations held with local and central government authorities and if available, UN expert groups and UN peacekeeping missions and local non-governmental organisations, as determined by auditor in compliance with the conditions and risks for the precious metals supply chain. 3) Document Review: All document templates produced as a part of the applications of obligors for determining compliance level of the current situation of responsible supply chain of obligors with regards to precious metals of conflict-affected areas must be reviewed “in order to find out whether they are in conformity with the system’s audit criteria”. This review contains, but is not limited to, documents in supply chain internal control (sample of archive and flow documents and payment records), data on communications with suppliers, terms and conditions of contracts, documents of information disclosed to post-refinery companies, and documents relating to the Obligor’s risk assessments (including all records relating to business partners and suppliers, and interviews held and field analyses performed) and risk management strategies (such as agreements signed with suppliers with regards to improvement indicators). Documents must be reviewed by auditors by random sampling method during onsite researches. The selected sample must take into consideration the risks fo suppliers and/or precious metals supply chain in terms of peaks and troughs of the year in business cycle, and volume of materials procured from each supplier. The reviewed documents must encompass not only samples received from each supplier, but also samples regarding probable rises in the risk level related to business partners, suppliers or countries of origin of precious metals. If the auditor detects some suspicious activity as part of thecompliance measures and actions of Obligors, then, the sample size must be increased. 4) Audit Results: Based on the evidences collected, auditors must generate findings detecting whether the applications of obligors for determining compliance level of the existing situation of responsible supply chain of obligors with regards to precious metals of conflict- affected and high-risk areas are in conformity with the recommendations given in this part of this Guideline or not. Auditors must make recommendations in their audit reports for further development of the applications of obligors determining compliance level of the current situation of supply chain. Auditors must further prepare and issue a summary audit report (Independent Assurance Report) to be published pursuant to and under Step-V. 3.4.2 Performing Audit in Accordance with Audit Planning Audit is to be performed in accordance with the audit scope, criteria, principles and activities described in the preceding paragraphs. All actors in the supply chain must cooperate for the compliance of audit with the aforementioned components. This is suggested to be made through Industry Programs or Institutionalized Mechanism to conduct all or some of the following activities:

1. Declaring auditors that meets the required conditions, and

2. Follow-up of audit program, including the regular monitoring and reviewing the skills of auditors to perform the audit so that they conform with the audit program, and

3. Publishing of summary audit reports of Obligors by taking into account corporate confidentiality and other competition or security considerations. A summary audit report must contain the following information: a. Information about Obligors, audit date and audit period, and b. Audit activities and methodology as further defined in Step IV 3.4.1 (4), and 33/41 <!-- page 34 --> HALKA AÇIK c. Audit results defined in Step IV 3.4.1 (4) in respect of each step covered by this Guideline.

4. Specific recommendations for all Obligors: a. Right of access to the corporate premises, and its records or documents regarding its applications to determine compliance level of the current situation of the related supply chain, shall be granted in accordance with this Guideline. b. Communications and logistics with freight companies and suppliers selected by audit team must be facilitated, and negotiations must be held with related people designated by the auditor. c. If site visits are to be made to suppliers, they must be supported in logistics and communications.

5. Specific recommendations for all post-refinery companies: To increase the efficiency in implementing this Guideline, the Post-refinery Companies are recommended to participate in and support the process of audit by an independent third party of the work for determining compliance level of the current situation of supply chain of Obligors, and to do this via Industry Programs. This activity may also contain the definition of audit standards compliant with recommendations provided in this Guideline. Small and medium-scale enterprises are suggested to participate in or cooperate with such types of sectoral organisations. 3.5 Step V: Annual Reporting for Determining Compliance Level of the Current Situation of Supply Chain Purpose: To build trust in the public regarding measures taken by companies, the aim is to inform the public to determine compliance level of the current situation of responsible supply chain oin the precious metals of conflict-affected and high-risk areas. By prioritizing corporate confidentiality and other competitive or security concerns, it is required to ensure that additional information to determine compliance level of the current situation of responsible supply chain with regards to the precious metals of conflict-affected and high-risk areas is reported on yearly basis or is integrated into their annual sustainability or corporate responsibility reports. These reports must cover the following items. A) For all Obligors:

1. Company Management Systems: Steps taken for implementing suggestions in Step-I of this Guideline must be reported. In this part, companies must set forth their policy to determine compliance level of the current situation of their supply chain, and must describe the managerial structure in charge of compliance work and initiatives of the company and name the person who is directly responsible, and must explain the audit, transparency and information collection systems (in-house) relating to the precious metals supply chain according to Step-I (C) and Step-III (B), and must emphasize how these systems are operated within the reporting period and how they strengthen the company’s compliance efforts. The company must further define its database and record keeping system, and describe the methods to identify all suppliers down to the origin of mine, and share along the whole supply chain the information collected about compliance. At the same time, information on payments made to public authorities must 34/41 <!-- page 35 --> HALKA AÇIK also be shared within the frame of the Extractive Industries Transparency Initiative (EITI) criteria.

2. Company risk assessment in supply chain: Steps taken to implement Step-II must be reported. In reporting, the companies must describe how the company defines the operations with warning signals and other warning signals in its supply chain (also including the verification of supplier statements in proportion to risk), and must disclose the warning signals designated in supply chain, and must explain the steps taken for determining actual conditions of these operations with warning signals and the supply chains. They must specify the information, methods and applications produced by the field assessment team, and must disclose to public the actual or potential risks detected. For clarity, companies must not report the risks detected for their potential suppliers with which they have not yet collaborated.

3. Risk management: Steps taken for implement Step-III must be reported. In this part, companies must describe how their internal control systems such as document archiving and flow chain or traceability systems are strengthened in order to collect and keep reliable and current information about precious metals supply chains with warning signals, through such means as supervision chain and traceability. Companies must give a summary of risk reduction strategy included in their risk management plan, and clarify competence trainings (if any), and other steps taken for management of risks, also including the participation of the affected parties, and must make public the steps taken by the company in order to monitor and follow up the risk reduction performance, and examples of them, as well as the results of follow-up made after 6 months for assessment of considerable / measurable development. Consistently with Part 5, the number of examples when the relations of the company with its suppliers and/or supply chains are broken must also be stated without disclosing the identity of suppliers, except for the cases mandated otherwise by the applicable laws pertaining thereto. B) For Refineries: In addition to the information mentioned above, refineries:

1. Audits: Must publish their summary audit reports by taking into account corporate confidentiality and other competitives or security concerns. Summary audit report must contain the following information: a. Information on refinery, date of audit, and b. If any Industry Program or Institutionalized Mechanism has not been published the audit activities and methodologies in accordance with this Guideline and as described in Step- IV 3.4.2, the audit activities and methodologies as further defined in Step-IV 3.4.1 (4), and c. Results of audit defined in Step-IV 3.4.1 (4) in connection with each step envisaged in this Guideline. C) For all post-refinery companies included in supply chain of the obligors:

1. Company Management Systems: It is the report relating to steps taken for application of Step-I. In this report, companies must set forth the company’s policy to determine compliance level of the current situation of its supply chain, and must describe the structure of responsibilities regarding compliance in the company, and must name the person who is directly responsible in the company. They must further describe the audit systems established and employed for precious metals supply chain, and how these systems are operated, and how they have strengthened the company’s compliance efforts within the reporting period, and must introduce the company’s database / record keeping system. 35/41 <!-- page 36 --> HALKA AÇIK

2. Risk assessment: It is the report related to steps taken for implementing Step-II. In this report, companies must state the steps taken for identification of refineries included in supply chain, and share the assessments regarding implementations to determine compliance level of the existing situation of supply chain, and describe the methods used by the company for its supply chain risk assessment, and make public the actual or potential risks detected.

3. Risk management: It is the report related to steps taken for implementing Step-III. In this report, companies must describe the summary strategy of risk management plan aimed at risk mitigation, and capacity trainings, if any, and steps taken for management of risks, including the participation of parties affected. Companies must make public the steps taken by the company in order to monitor and follow up the risk mitigation performance, and examples of them, as well as the results of follow-up made after 6 months for assessment of considerable / measurable development. FOURTH PART

4. Supply Chain Policy Document for Responsible Supply Chain of Precious Metals from Conflict-affected and High-risk High-Risk Areas 4.1 Purpose of Document: This document aims to common reference for the parties involved in all stages of the precious metals supply chain. The companies are suggested to integrate this policy model into their corporate social responsibility, sustainability or other policy applications. 4.2 Document Text: A sample text is given below: Policy Document Being aware of our responsibility to mitigate the risks of material negative effects with regards to extracting, trading, processing and exporting of mines in conflict-affected and high-risk areas, and to show respect to human rights in these areas, and not to contribute to conflicts , and with the intention of creating a common reference for conflict-sensitive sourcing practices ensuring suppliers’ risk awareness during the whole process from mine extraction to end user delivery, we hereby agree and undertake to adopt the following policies, share them over a wide area, inform the related parties about the policy and incorporate them into our agreements and/or contracts with suppliers. We also agree to refrain from any of actions that may lead to the financing of conflicts and to comply with UN sanctions and resolutions, and domestic laws (if any) in compliance with the resolutions.

1. About Material Abuses of the Extraction, Transport or Trade of Mines: While supplying products from conflict-affected and high-risk areas or performing our business activities therein, we shall not show tolerance to perpetrators of any one of the following crimes, and shall not derive any profit or benefit therefrom, and shall not give support to them: i. Any forms of torture, cruelty and inhuman / derogatory treatments, and ii. Any forms of forced labour which may be in the form of compulsory labour with a threat and involuntary work, and iii. Worst forms of child labour, and iv. Other intensive breaches of human rights like extensive sexual violence, and 36/41 <!-- page 37 --> HALKA AÇIK v. War crimes and other severe international humanitarian law breaches, and crimes against humanity and genocide.

2. About Risk Management of Material Misconducts, Abuses and Breaches: We shall immediately suspend or terminate our business relationships with upstream supplier detected to pose a severe risk of supplying precious metals from any parties perpetrating the material misconducts, abuses and breaches defined in first paragraph hereof or to be related to or affiliated with such parties.

3. About Direct or Indirect Support to Non-state Armed Groups: We shall not show any tolerance to direct or indirect support to non-state armed groups through the extraction, transport, trade, processing or export of mines. “Direct or indirect support” to non-state armed groups through extraction, transport, trade, processing or exporting of mines includes (but is not limited to) procuring mines from, making payments to, or providing any logistical support or equipment to the following non-state armed groups or their collaborators/ affiliates: i. Illegally keeping under control, the mine sites or transport routes, mine trading points and production actors in supply chain and/or ii. Illegally racketeering or levying taxes at points of access to mine sites, along mine transport routes or at mine trading points and/or iii. Illegally levying taxes on or racketeering intermediaries, export firms or international traders.

4. About Risk Management of Direct or Indirect Support to Non-state Armed Groups: We shall immediately suspend or terminate our business relationships with suppliers detected to pose a severe risk of supplying precious metals from any parties giving direct or indirect support to non-state armed groups as defined in third paragraph hereof or to be related to or affiliated with such parties.

5. About Law Enforcers and Private Security Officers: i. Pursuant to tenth paragraph of this 4th part, we hereby agree and undertake not to give any direct or indirect support to public or private security forces which illegally keep under control the mine sites, transport routes, mine trading points and production actors in supply chain, or illegally racketeer or levy taxes at points of access to mine sites, along mine transport routes or at mine trading points or illegally levy taxes on or racketeer intermediaries, export firms or international traders. ii. We acknowledge and accept that the duties of public or private security forces assigned at mine sites, around mine sites and/or along the transport routes must only be focused on ensuring the enforcement of laws, including, but not limited to, protection of human rights, and provision of security of mine workers, equipment and facilities, and protection of mine sites or transport routes against illegal mine extraction or trading activities and operations. iii. If we or any other company included in our supply chain make an agreement with public or private security forces, we hereby agree and undertake to ensure that said security forces act in compliance with the Voluntary Principles on Security and Human Rights. Particularly we shall take the required steps and adopt the required surveying / audit policies in 37/41 <!-- page 38 --> HALKA AÇIK order to make sure that security units or personnel known to be responsible for breaches of human rights are not assigned or appointed thereinfor. iv. We shall establish communication with local and central authorities, international and non-governmental organizations to contribute to the solutions for development of transparency, proportionality and accountability in payments made to public security forces for security, and shall take the required steps for giving support to them. v. We shall enter into cooperation with local authorities, international and non- governmental organizations in order to prevent or minimize the probable negative effects on vulnerable groups, particularly artisan miners, of availability of public or private security forces in mine sites where mines included in supply chain are extracted through labour-intensive and small-scale establishments, and shall give support to their efforts in relation therewith.

6. About Risk Management of Law Enforcers and Private Security Officers: In accordance with the position of the Company in the supply chain, where risks born out of security forces, we shall immediately develop and implement a risk management plan together with suppliers and other relevant parties with a view to preventing or mitigating the risks emerging from direct or indirect support of security forces and private security officers as defined in fifth paragraph of this 4th Part. In such circumstances, if the risks cannot be diminished within six months following the date of adoption of risk management plan, we shall suspend or terminate our relations with upstream supplier. Also, if we identify a risk regarding operations and activities against eighth and ninth paragraphs of this 4 th Part, we shall respond in the same way.

7. About Bribery and Misstatement of Origin of Mines: We shall by no means and in no event offer, give or solicit bribe with the intention of hiding or misguiding the origin of mines, or misleading the general public about taxes, fees, duties and royalties paid to governments regarding extraction, trade, processing, transport and export of mines.

8. About laundering proceeds of crime: If we have serious suspicions as to laundering proceeds of crime in relation with or through extraction, trade, processing, transport and export of mines carried out by means of illegal taxation or squeezing of money at mine sites, along transport routes or at places where mines and metals are traded by mining/refinery companies, then, we shall give support to efforts and steps aiming to prevent such activities of Laundering proceeds of crime thereat.

9. About Payment of Taxes, Fees and Royalties to States and Governments: We hereby agree and undertake to make sure that all taxes, fees and royalties in respect of extraction, trade and export of mines in conflict-affected and high-risk high-risk areas are paid directly to states and governments, and to share with general public all such types of payments in accordance with the principles set down in the Extractive Industries Transparency Initiative (EITI) and in line with the position of our company in the supply chain. 38/41 <!-- page 39 --> HALKA AÇIK

10. About Risk Management of Bribery, Fraaudullent Misrepresentation of the Origin of Mines, Laundering Proceeds of Crime, and Misstatement of Taxes, Duties, Fees and Royalties Paid to States and Governments: We hereby agree and undertake to establish the required communications with suppliers, local or central governmental authorities, international organisations, non-governmental organisations and affected third parties for development and monitoring of performance related to prevention or reduction of negative effects by means of appropriate steps to be taken in reasonable timeframes, in line with the position of our company in the supply chain. If our risk mitigation initiatives fail, we shall suspend or terminate our relations with upstream supplier. FIFTH PART

5. Detection, Reporting and Sanctions of Responsible Supply Chain Non- Conformities 5.1 Obligors’ Appointment of Internal Control and Supply Chain Compliance Officer and Compliance Process 1) It is required to build and organize an effective internal control system covering both an organization plan to be applied by obligors and all principles and procedures pertaining thereto with the intention of ensuring that all business affairs and operations of obligors, also including their decentral organisation units, are performed regularly, efficiently and effectively in accordance with management strategy and policies and within the frame of the applicable rules and laws, and that integrity and reliability of their accounting and recording system are protected, and information included in data system is acquired accurately and on time, and that a documentation and recording system is created, backed up and maintained, and that probable errors, frauds and misconducts are prevented and detected. To this end, the Obligors are required to appoint an internal control and supply chain compliance officer. Terms and conditions pertaining thereto are included in Borsa İstanbul Due Diligence Directive on Responsible Supply Chain of Precious Metals, Borsa İstanbul Directive on the Responsible Supply Chain Assurance Engagement, Borsa İstanbul Directive on Internal Control System and Borsa İstanbul Due-Diligence Principles of Precious Metals Intermediary Institutions and Refineries Metals. 5.2 General Principles of Responsible Supply Chain Assurance Engagement Activities The procedures and principles, and other terms and conditions, relating to audit by an independent third party of the work and efforts of the Obligors, being a member of Borsa İstanbul Precious Metals Market, for compliance with “the Responsible Supply Chain Compliance Directive, the Directive on Internal Control System and Compliance Principles of Precious Metals Intermediary Institutions and Refineries, and this Guideline” with regards to precious metals of conflict-affected and high-risk areas, and relating to authorization of independent audit firms for this audit, and reporting of audit results, are included in the Responsible Supply Assurance EngagementDirective. 39/41 <!-- page 40 --> HALKA AÇIK 5.3 Sanctions If obligors detect a trading activity which should be out of the responsible supply chain or a breach of law, then, Borsa İstanbul takes and applies measures and sanctions referred to in the applicable laws pertaining thereto. If such trading activity or breach of law is covered by the laws under responsibility of other organizations or units, then, the related organizations or units are informed by the Exchange. Application of certain measures or sanctions by Borsa İstanbul does not preclude other authorized regulatory bodies to take measures and apply sanctions. SIXTH PART

6. Miscellaneous and Final Provisions 6.1. Compliance with Guideline on Voluntary Basis All actors of supply chain, other than obligors, and all other actors that may be deemed fit by the Exchange may voluntarily take part in the work and initiatives for compliance with this Guideline. If compliance with the Guideline is confirmed and verified in accordance with the procedures and principles set down in this Guideline and its exhibits, then, companies which voluntarily take part in the work and initiatives for compliance with this Guideline are made public in Borsa İstanbul’s corporate website under a separate heading. 6.2. Other Provisions All and any matters on which this Guideline remains silent shall be governed by and construed according to the provisions of the Responsible Supply Chain Compliance Directive, the Responsible Supply Chain Assurance Audit Directive, and the Directive on Internal Control System and Compliance Principles of Precious Metals Intermediary Institutions and Refineries pertaining thereto. 40/41 <!-- page 41 (table kept in page layout) --> ```text HALKA AÇIK TURKISH – ENGLISH TERMS English meanings and abbreviations of some terms used in the Guideline: TURKISH ENGLISH Muaf Kıymetli Maden Stokları Grandfathered Stocks Orta ve Büyük Ölçekli Madencilik Medium and Large-Scale Mining - LSM Küçük Ölçekli Madencilik Artisanal and Small-scale Mining- ASM Kara Para Aklamanın Önlenmesi ve Anti-Money Laundering and Counter Terörizmin Finansmanı ile Mücadele Terrorist Financing - AML-CFT Düzenlemeleri Siyasi Nüfuz Sahibi Kişiler Politically Exposed Person - PEP Uluslararası Güvence Sözleşmeleri International Standard on Assurance Standartları Engagements -ISAE İş Yaptığınız Tarafı Tanıma Kuralı Know Your Counterparty-KYC Uygun Teslimat Good Delivery Doğal Kaynakları Çıkarma Endüstrisi The Extractive Industries Transparency Şeffaflık Girişimi Initiative (EITI) 41/41  ```