Borsa İstanbul Directive on the Responsible Supply Chain Assurance Engagement (31.YÖN.05)

ARTICLE 1 – (1) The purpose of this Directive is to regulate and set down the procedures and principles relating to audit by an independent third party of compliance of the precious metals intermediary institutions, being a member of Borsa İstanbul Precious Metals Market, and the refineries established in Türkiye and included in the List of Refineries, with Borsa İstanbul A.Ş. Directive on the Responsible Supply Chain Assurance Engagement, Borsa İstanbul Precious Metals Responsible Supply Chain Due Diligence Guideline, and Borsa İstanbul Directive on Internal Control System and Compliance Principles of Precious Metals Intermediary Institutions and Refineries, and announcement of independent audit firms meeting the required conditions sought for this activity, and reporting of audit results. (2) This Directive does not constitute a separate audit standard. Thus, auditors are essentially required to conduct audit in accordance with Assurance Engagement Standard 3000 Assurance Engagements Other Than Audits or Reviews of Historical Financial Information ### Scope

ARTICLE 2 – (1) The provisions of this Directive are applicable on precious metals intermediary institutions, being a member of Borsa İstanbul Precious Metals Market, and the refineries established in Türkiye and included in the List of Refineries. (2) Precious metals traded in Borsa İstanbul Precious Metals Market are covered by this Directive. (3) Responsible supply chain assurance engagement activities covered by this Directive are to be carried out by authorized independent audit firms meeting the conditions specified in this Directive and included in the List of Independent Audit Firms published by the Exchange, from among those authorized as PIE (Public Interest Entities) by the Public Oversight Accounting and Auditing Standards Authority. (4) If gold investment products (ingots, bars, bullions, coins and processed gold in sealed containers) and silver, platinum and palladium kept in the form of bullions in vaults of banks or central banks, or in exchanges and refineries have a verifiable date prior to January 1, 2012, there is no need to investigate and determine their origin. These exempted stocks also contain stocks kept by a third party in the name of the aforementioned institutions. (5) All precious metal containing materials, including precious metals extracted from accepted mines, or recycled, or accepted by refinery, during the audit period for the purpose of refining of precious metals are in the scope of responsible supply chain assurance engagement. (6) Materials which contain a low rate of precious metals or of which the probability of procurement from Conflict-Affected and High-Risk Areas (CAHRAs) is low or of which risk to cause other abuses of human rights that may occur in the supply chain is low due to their high processing requirements are exempted from responsible supply chain assurance engagement. In addition, together with copper sulphide and oxide ore, they also contain some inferior quality sub-industry products such as furnace flue dust, spent crucible and floor sweepings or residues from refining processes of other mines. 4/26 <!-- page 5 --> HALKA AÇIK (7) With respect to supply chain compliance report and Independent Assurance Report to be issued under this Directive, the pertinent provisions of the Law on Prevention of Laundering of Criminal Revenues no. 5549 dated 11/10/2006, and the Regulation on Measures for Prevention of Laundering of Criminal Revenues and Financing of Terrorism, promulgated in the Official Gazette edition 26751 on 09/01/2008, and the Regulation on Program of Compliance with Obligations Regarding Prevention of Laundering of Criminal Revenues and Financing of Terrorism, promulgated in the Official Gazette edition 26999 on 16/09/2008, are, however, reserved. ### Grounds

ARTICLE 3 – (1) This Directive is prepared and issued in reliance upon provisions of the Regulation on Operating Principles of Precious Metals Exchange Intermediary Institutions and on Foundation of Precious Metals Intermediary Institutions promulgated in the Official Gazette edition 26528 on 21/05/2007 and the Communiqué on Precious Metals Standards and Refineries (Communiqué no. 2006/1) promulgated in the Official Gazette edition 26350 on 18/11/2006. (2) Borsa İstanbul A.Ş. Directive on the Responsible Supply Chain Assurance Engagement, Borsa İstanbul Precious Metals Responsible Supply Chain Due Diligence Guideline, Borsa İstanbul Responsible Supply Chain Assurance engagement Directive and Directive on Internal Control System and Compliance Principles of Precious Metals Intermediary Institutions and Refineries are as a whole the components of Borsa İstanbul precious metals responsible supply chain compliance program. ### Definitions and Abbreviations

ARTICLE 4 – (1) For the purposes and in the context of this Directive: a) “Decree No. 32” stands for the Decree No. 32 on Protection of Value of Turkish Currency, promulgated in the Official Gazette edition 2/249 on 11/08/1989; and b) “Action plan” refers to a plan involving actions aiming to correct the findings determined by independent auditor and included in management report; and c) “List of Independent Audit Firms” refers to a list of Independent Audit Firms meeting the conditions sought for and determined by the Exchange chosen from among those authorized as PIE (Public Interest Entities) by the Public Oversight Accounting and Auditing Standards Authority; and ç) “Independent Assurance Report” refers to a report also containing the results of audit relating to supply chain compliance report and issued by Authorized Independent Audit Firms as a result of audit performed in accordance with Assurance engagement Standard 3000 Assurance engagements Other Than Independent Audit or Limited Internal Audit of Historical Financial Information published by the Public Oversight Accounting and Auditing Standards Authority; and d) “Ministry” stands for the Ministry of Treasury and Finance; and e) “Independent Audit Standards (IASs)” refers to independent audit standards which are issued and put into force by the Public Oversight Accounting and Auditing Standards Authority and are in harmony with the international standards; and f) “Exchange” and “Borsa İstanbul” stands for Borsa İstanbul A.Ş.; and g) “Auditor” and “Responsible supply chain auditor” refers to an auditor conducting the responsible supply chain assurance engagement; and 5/26 <!-- page 6 --> HALKA AÇIK ğ) “Verifiable date” refers to a date which can be verified by examination of physical date labels on products and inventory lists; and h) “Dore bar” refers to a bullion containing gold, silver and other precious metals, produced out of ore, and not subjected to any refining process; and ı) “GDS 3000” stands for Assurance engagement Standard 3000 Assurance engagements Other Than Independent Audit or Limited Internal Audit of Historical Financial Information published by the Public Oversight Accounting and Auditing Standards Authority; and i) “CEO” stands for Borsa İstanbul A.Ş. Chief Executive Officer; and j) “Granule” refers to very tiny globules comprised of gold, silver, platinum and palladium; and k) “Internal control and supply chain compliance officer” refers to an officer having the minimum qualifications and authority sought for in the regulations issued by the Exchange and employed by precious metals intermediary institutions and refineries; and l) “Public Interest Entities” (PIE) refers to publicly-held companies, banks, insurance, reassurance and pension companies, factoring companies, financing companies, financial leasing companies, asset management companies, pension funds, issuers and capital market institutions as defined in the Capital Markets Law no. 6362 dated 6/12/2021, and other institutions and entities included in this category by the Public Oversight Accounting and Auditing Standards Authority as they are of particular concern to general public according to their activity areas, transaction volumes, number of employees and similar other criteria; and m) “KGK” stands for the Public Oversight Accounting and Auditing Standards Authority; and n) “Precious metals intermediary institution” refers to precious metals intermediary institutions, banks, authorized institutions, joint-stock companies engaged in production or trade of precious metals, and Turkish branches of companies residing abroad, which are permitted by the Ministry to actively operate in the Exchange as a member, and deal with trading in their own name and account, or in the name and account of others, or in their own name and in the account of others, and the operating principles of which are regulated by a Regulation; and o) “Control” refers to the whole set of policies, procedures, applications and organizational structures applied in respect of the responsible supply chain processes and aiming to establish an adequate level of assurance regarding achievement of business objectives, and prevention, detection and correction of undesired events; and ö) “Mines” or “Precious metals” refers to precious metals of any kind and type as further defined in the Decree No. 32; and p) “Refining” refers to conversion of gold, silver, platinum and palladium in scrap form or produced out of ore into internationally accepted standards through purification with certain techniques; and r) “Refinery” refers to refineries established in Türkiye and included in the List of Refineries issued by the Exchange within the frame of the Communiqué and other relevant regulations of the Ministry; and s) “List of Refineries” refers to a list issued and announced by the Exchange in respect of refineries the bars, bullions and granules of which are tradable in the Exchange; and ş) “Responsible supply chain assurance engagement” or “assurance engagement” refers to a process wherein the compliance of obligors with Borsa İstanbul A.Ş. 6/26 <!-- page 7 --> HALKA AÇIK Directive on the Responsible Supply Chain Assurance Engagement, Borsa İstanbul Precious Metals Responsible Supply Chain Due Diligence Guideline, and Borsa İstanbul Directive on Internal Control System and Compliance Principles of Precious Metals Intermediary Institutions and Refineries is audited by an independent third party in accordance with GDS 3000, and at the end, an Independent Assurance Report is prepared and issued pursuant to this Directive; and t) “Nonstandard unprocessed precious metals” refers to precious metals in the form of bullion, bar, dore bar, granule, powder or scrap with a purity lower than the lowest purity fineness specified in the Communiqué; and u) “Standard unprocessed precious metals” refers to unprocessed gold, platinum and palladium in the form of bars or bullions, and unprocessed silver in the form of bars, bullions or granules, having the lowest purity fineness specified in the Communiqué; and ü) “Communiqué” stands for the Communiqué on Precious Metals Standards and Refineries (Communiqué no. 2006/1) promulgated in the Official Gazette edition 26350 on 18/11/2006; and v) “Supply chain” refers to a system encompassing all activities, organizations, actors, technologies, information, sources and services included in the process of transport of precious metals from sources to end consumers thereof; and y) “Supply chain compliance report” or “compliance report” refers to a report which is prepared by the obligor within the procedures and principles regarding precious metals responsible supply chain as determined by the Exchange according to international criteria with a prior consent of the Ministry, and which indicates the compliance of all operations covering the related reporting period with the aforesaid procedures and principles; and z) “Due Diligence Guideline” stands for Borsa İstanbul Precious Metals Responsible Supply Chain Due Diligence Guideline; and aa) “Compliance Directive” stands for Borsa İstanbul A.Ş. Directive on the Responsible Supply Chain Assurance Engagement; and bb) “Member” refers to precious metals intermediary institutions duly authorized by the Exchange to trade in the Precious Metals Market from among institutions mentioned in first paragraph of Article 24 of the Regulation on Foundation, Activity, Working and Audit Principles of Exchanges and Market Operators promulgated in the Official Gazette edition 28712 on 19/07/2013; and cc) “Authorized independent audit firms” refers to independent audit firms which meet the conditions listed in this Directive from among the companies authorized as PIE by the Public Oversight Accounting and Auditing Standards Authority and are defined and named so in the “List of Independent Audit Firms” published by the Exchange; and çç) “Management report” refers to a report which is addressed to obligors audited by an authorized independent audit firm and contains details about the assurance findings, as well as an action plan; and dd) “Management system” refers to management processes and documentation collectively offering a systematic framework to ensure that the duties are fulfilled and performed accurately, consistently and in such manner to procure achievement of the desired results and assuring a continuous rise in the performance; and ee) “Regulation” stands for the Regulation on Operating Principles of Precious Metals Exchange Intermediary Institutions and on Foundation of Precious Metals 7/26 <!-- page 8 --> HALKA AÇIK Intermediary Institutions promulgated in the Official Gazette edition 26528 on 21/05/2007; and ff) “Obligor/Obligors” refers to both precious metals intermediary institutions that are members of the Exchange holding an operating license received pursuant to the Regulation on Operating Principles of Precious Metals Exchange Intermediary Institutions and on Foundation of Precious Metals Intermediary Institutions, and refineries established in Türkiye and declared to the Borsa İstanbul Refinery List pursuant to the Communiqué on Precious Metals Standards and Refineries. (2) Any reference made in the body of this Directive to supply chain, supplier or suppliers shall be construed so as to encompass the customers, suppliers, agencies and intermediaries, and other related institutions involved in supply of precious metals to members or refineries as well. ### Conflict-Affected and High-Risk Areas (CAHRAs)

ARTICLE 5 – (1) The provisions of the Compliance Directive shall be enforceable for High-Risk Regions Affected from Conflicts. ### Precious Metals Extracted from Mines and Recycled Mines

ARTICLE 6- (1) Precious metals extracted from mines and recycled mines shall be construed as clearly defined in the Compliance Directive. ### Universal Declaration of Human Rights and World Heritage

ARTICLE 7- (1) For the purposes of this Directive, the term “human rights” covers all human rights defined in the Universal Declaration of Human Rights (1948), the International Covenant on Economic, Social and Cultural Rights (1966), the International Covenant on Civil and Political Rights (1966) and two Optional Protocols attached to the latter. (2) “World Heritage Site” is the name given by the United Nations Educational, Scientific and Cultural Organization to the sites selected due to being significant in cultural, historical, scientific or other terms and protected by and under international conventions. These sites are accepted to be significant for collective interests of humanity. (3) Members and refineries cannot procure precious metals from a site included in the World Heritage Site list, and are required to take the required actions and measures. This principle is valid also for precious metals, which come out during extraction of such metals as copper from mines. SECOND CHAPTER General Principles Regarding Responsible Supply Chain Assurance Engagement Activities ### Purpose and Scope of Responsible Supply Chain Assurance Engagement

ARTICLE 8 – (1) Purpose of responsible supply chain assurance engagement is to come to a conclusion as to compliance of the activities of obligors within the supply chain management and operations relating to precious metals of Conflict-Affected and High-Risk Areas (CAHRAs) and their controls established as a part of responsible supply chain with Borsa İstanbul A.Ş. Directive on the Responsible Supply Chain Assurance Engagement, Borsa İstanbul Precious Metals Responsible Supply Chain Due Diligence Guideline, and Borsa İstanbul Directive on Internal Control System and Compliance Principles of Precious Metals Intermediary Institutions and Refineries, and thereafter, to issue a report also containing the results of engagement regarding the supply chain compliance report. (2) Responsible supply chain auditor determines the system, activity and risk management and control mechanisms to be examined as a part of responsible supply chain, 8/26 <!-- page 9 --> HALKA AÇIK with a risk-based point of view, on the basis of materiality criterion, and in accordance with a written plan. (3) Responsible supply chain auditor makes sure that the scope of audits determined within the framework of materiality criterion is arranged so as to obtain adequate audit evidence for providing a reasonable assurance as for the results of audit to be conducted as per this Directive. ### Materiality and Audit Risk

ARTICLE 9 – (1) Materiality is a subject matter based on professional knowledge and experience, and means the assessment of effects exerted or that may be exerted on the responsible supply chain of the audited obligor by errors, omissions, breaches of procedures, and unlawful acts which result or may result from monitoring and control weaknesses and control deficiencies, or by breaches of other principles set forth in Borsa İstanbul A.Ş. Directive on the Responsible Supply Chain Assurance Engagement, and Borsa İstanbul Directive on Internal Control System and Compliance Principles of Precious Metals Intermediary Institutions and Refineries. (2) In responsible supply chain assurance engagement, the materiality concept may be used for audit planning, concentration of audit on the required areas, and evaluation and reporting of findings. Integrity, consistency, reliability and if needed, confidentiality of data considered to be sensitive for the auditee, and continuity of activities, and responsible supply chain applications are the fundamental elements required when considering for the materiality concept. (3) Audit risk stands for the probability of failure of responsible supply chain audit to give correct results due to the following risks: a) Structural risk: Refers to the existence of at least one considerable control deficiency of the obligor due to lack of control. b) Control risk: Refers to the risk of failure of the obligor to prevent, detect, reveal or correct on time at least one considerable control deficiency due to non-functionality of control as required. c) Detection risk: Refers to the risk of failure of the responsible supply chain auditor to detect and find out at least one considerable control deficiency of the obligor. (4) Significant or considerable control deficiency risk: It refers to existence of at least one considerable control deficiency of the obligor. Material or considerable control deficiency risk arises out of structural risk and control risk. (5) Responsible supply chain auditor uses appropriate audit techniques to reduce the detection risk in areas of high material or considerable control deficiency risk to diminish the audit risk to a reasonable level. ### Classification of Findings

ARTICLE 10 – (1) Responsible supply chain auditor uses the following criteria in classification, according to the materiality concept, of the control weaknesses and deficiencies covered by the findings of its audits and inspections. a) Control Weakness: It refers to the failure of design or operation of the control, making it impossible to prevent and detect the faults on time. Even if small deviations are detected with the compliance related standards, the audited obligor may be considered and treated as ‘compliant’ under Borsa İstanbul A.Ş. Directive on the Responsible Supply Chain Assurance Engagement. Control weaknesses are not required to be included in supply chain compliance report. Small or administrative inconsistencies which may be remedied and corrected by the obligor in a short time may not be reported as audit findings. Failure of the obligor to correct and remedy the findings categorized as control weaknesses in an adequate time may lead to reclassification of the related findings as considerable control deficiency. Control weaknesses may potentially be found in the required diligence to be shown by precious metals supplier as 9/26 <!-- page 10 --> HALKA AÇIK the counterparty in precious metals supply chain management system, or in the scope of trade of precious metals, or in other processes mentioned in the Compliance Directive. The following events may be considered as examples of control weaknesses: 1) Occasional problems associated with the obligor’s control system, policies, procedures, processes and applications; and 2) Rare problems faced in the processes of collection of documents related to precious metal suppliers examined in the course of supply chain; and 3) Failure to receive the documents fit to the kind of transaction from counterparties categorized in low risk group in spite of requests; and 4) Any problem which may be considered to be of low risk in terms of integrity of the Supply Chain. b) Considerable Control Deficiency: It is defined as a non-negligible deficiency arising out of a combination of factors inluding a control weakness or several control weaknesses which may adversely affect the integrity, consistency, reliability and confidentiality of data and the continuity of activities of the obligor. Considerable control deficiencies may potentially be identified in the diligence required to be shown by precious metals supplier as the counterparty in precious metals supply chain management system, or in the scope of trade of precious metals, or in other processes mentioned in the Compliance Directive. The following events may be considered as examples of considerable control deficiencies: 1) Failure of the obligor to document its policies and procedures in writing; and 2) Obligor’s various non-conformities in the supply chain, policies, procedures, processes and applications with the requirements under the related applicable laws; and 3) Existence of several interrelated problems arising out of the same reason in the performance of the obligor’s precious metals supply chain systems, policies, procedures, processes and applications; and 4) Frequently faced problems in the processes of collection of documents relating to the precious metal suppliers examined in the course of supply chain; and 5) Problems faced in the obligor’s inventory control mechanism; and 6) Existence of documents which are requested within the sample set as per the laws, but could not be obtained. c) Significant Control Deficiency: It refers to combination of one or more control deficiencies which probably prevents or impedes the correction of a significant mistake in the auditee’s periodical reports or which have material negative impact on ensuring the integrity, consistency, reliability, continuity and if needed, confidentiality of the processes conducted within the obligor organization and of information relating to said processes. Significant control deficiencies may potentially be identified in the attention and diligence required to be shown by precious metals supplier as the counterparty in precious metals supply chain management system, or in the scope of trade of precious metals, or in other processes mentioned in the Compliance Directive. The following events may be considered as examples of significant control deficiencies: 1) Lack of responsible supply chain applications, or existence of a repetitive systematic mistake in the precious metals supply chain systems, policies, procedures, processes and applications, or failure in design of any controls; and 2) Failure of the obligor to detect and assess the risks in its precious metals supply chain, or to regularly revise its risk assessments, or to report its risk assessment results to senior management; and 3) Failure of the obligor to detect the Conflict-Affected and High-Risk Areas (CAHRAs) in its precious metals supply chain, or non-applicability of the risk reduction strategy of the obligor; and 10/26 <!-- page 11 --> HALKA AÇIK 4) Failure to systematically request and collect the documents relating to the precious metal suppliers examined in the course of supply chain; and 5) Failure to systematically request and collect the documents relating to the precious metal processes; and 6) Inadequate documentation (transaction records, inaccurate transaction records which cannot be confirmed by the counterparty, etc.) affecting any transaction in the supply chains relating to precious metals supplied from high-risk regions. d) Nonconformities which jeopardize and risk the reliability and integrity of Borsa İstanbul systems are subjected to zero tolerance policy and are not tolerated. In the case of detection of any noncompliance with zero tolerance policy, this noncompliance is reported by auditor to the obligor’s senior management and notified to the Ministry and the Exchange within 24 hours. Each of the following nonconformities is accepted and treated as a zero tolerance state: 1) Prevention by obligors of the auditor’s audit works in full or in part; and 2) Detection of precious metal containing materials associated with armed conflicts, severe abuses of human rights, financing of terrorism, or laundering of criminal revenues; and 3) Attempt of obligors to affect the results of assessment by offering a bribe or by similar other illegal and/or unethical ways or acts; and 4) Evidences proving that the documents relating to precious metals supply chain are falsified by obligors or within the knowledge or with a prior consent of obligors; and 5) Noncompliance of obligors with national laws and regulations or their environment, sustainability and corporate governance responsibilities; and 6) Intentional misstatements/misrepresentations given by obligors to auditor; and 7) Existence of any transaction or action jeopardizing the reliability or integrity of the Ministry or Borsa İstanbul systems. ### Efficiency, Adequacy and Compatibility

ARTICLE 11 – (1) The design of a control may be accepted to be efficient if and only to the extent there is no deficiency in the design of that control or even if there is any, the design deficiency does not lead to any significant control deficiency. (2) The operation of a control may be accepted to be efficient if and only to the extent there is no deficiency in the operation of that control or even if there is any, the operation deficiency does not lead to any significant control deficiency. (3) Efficiency of controls means that within the frame of materiality principle, all of the audited controls have efficient designs, and these controls are designed to produce the results expected from them within the frame of business objectives and to eliminate the probable risks that may be exposed. (4) Efficiency of controls means that within the frame of materiality principle, all of the audited controls have efficient operations, and these controls are designed to perform the functions and to achieve the control objectives expected from them. (5) Compatibility of responsible supply chain controls means that within the frame of materiality principle, all of the audited controls are compliant and compatible with the related regulations and standards. Relations between Responsible Supply Chain Assurance Engagement and ### Independent Audit of Financial Statements

ARTICLE 12 – (1) Independent audit of financial statements and responsible supply chain assurance engagement are planned and applied with an interactive approach since they cover elements which may affect the scope and results of each other. However, independent audit of financial statements and responsible supply chain assurance engagement are not required to be conducted by the same firm. 11/26 <!-- page 12 --> HALKA AÇIK (2) In the event that the auditor’s conclusion derived out of responsible supply chain assurance engagement is “conditional”, “adverse” or “disclaimer of an opinion”, both the audit results and the findings underlying such results are reported in writing to the independent auditor involved in independent audit of financial information. The liability of reporting belongs to board of directors of the obligors. (3) The information and documents requested by the independent auditor involved in independent audit of financial statements in respect of responsible supply chain and its audit for use in its independent audit works are essentially required to be provided by responsible supply chain auditor to independent auditor. ### Assessment Regarding Internal Control and Internal Audit System

ARTICLE 13 – (1) The works carried out by responsible supply chain auditor within the frame of materiality criterion in the organization of internal control and internal audit systems of the audited obligors solely with respect to the precious metals supply chain are guided by the provisions of BDS 315 Standard for Determination of Material Mistake Risks by Knowing the Enterprise and its Environment and BDS 610 Standard for Use of Internal Auditor Works. THIRD CHAPTER Conditions of Engagement in Responsible Supply Chain Assurance Engagement Activities ### Qualifications Sought for in Firms to be Authorized

ARTICLE 14 – (1) Authorized independent audit firms are required: a) to be among the firms authorized as PIE by the Public Oversight Accounting and Auditing Standards Authority; and b) to be authorized to deal with independent audit activities in capital markets by the Capital Markets Board; and c) to employ an adequate number of auditors, not being less than two, having adequate qualifications for conduct of responsible supply chain assurance engagement activities. ### Qualifications Sought for in Responsible Supply Chain Auditor

ARTICLE 15 – (1) Auditors, other than assistant auditors, to be assigned for responsible supply chain assurance engagement are required: a) to have graduated from at least four-years’ undergraduate program of universities or foreign higher education establishments accepted to be equivalent by the official authorities; and b) to have adequate professional knowledge for responsible supply chain assurance engagement and at least three-years’ professional experience in audit field; and c) not to have been adjudged bankrupt, or convicted of any disgraceful offences; and ç) not to be permanently banned from engagement in independent audit activities due to their responsibilities detected in independent audit activities causing the cancellation of authorization in companies whose independent audit authorization is cancelled pursuant to the capital markets laws and regulations or other applicable legislation pertaining thereto, and as for those who are temporarily banned from engagement in independent audit activities, the banning decision must have been revoked by the banning authority at the end of its duration; and d) not to be any one of the employees held liable for cancellation or deletion in the companies any one or more of the activity authorization certificates of which are cancelled or in the precious metals intermediary institutions the activity license of which is cancelled under the Regulation or in companies which are deleted from the List of Refineries by the Exchange, and not to serve as president of board of directors, general manager, authorized signatory or 12/26 <!-- page 13 --> HALKA AÇIK internal control and supply chain compliance officer in the companies cited above during the period of actions of cancellation or deletion; and e) not to be subject to a verdict of conviction due to breach of the repealed Capital Markets Law no. 2499 and the Capital Markets Law no. 6362; and f) To be resident in Türkiye; and g) Not to be banned to trade in capital markets within the frame of the applicable laws and regulations pertaining thereto; and ğ) To work on fulltime basis in their independent audit firm. (3) For the purposes of this article, adequate professional knowledge for responsible supply chain independent audit means to have the following knowledge: 1) Knowledge about precious metal refining, trade and markets; and 2) Information about principles, procedures and techniques of due diligence guidelines and programs, particularly the Due Diligence Guideline; and 3) Understanding the precious metals supply chain practices and precious metals supply chains; and 4) Knowledge about foreign exchange laws and regulations and about enforcement of them; and 5) Knowledge about regulations and best practices regarding prevention of laundering of criminal revenues and financing of terrorism. ### Application to Exchange and Publishing in the List

ARTICLE 16 – (1) Independent audit firms who want tto engage in responsible supply chain assurance engagement activities file an application to the Exchange with the following information and documents: a) Detailed curriculum vitae of responsible supply chain auditors to be assigned in responsible supply chain assurance engagement activities, containing their professional experience, license certificates, audit trainings , audit works and activities (if any), and job duties assumed in these audit works and activities, and statement of residence address, and statements verifying that they do not have any previous criminal records, are not adjudged bankrupt, and have adequate professional knowledge, and one copy of each of diplomas or graduation certificates relating to undergraduate and/or postgraduate study programs, duly approved by the official authorities; and b) One copy of each of the certificates verifying the training courses received or given in regard to the precious metals supply chain and audit; and c) A list of audit staff to be assigned in responsible supply chain assurance engagements by their job duties and positions; and ç) A written commitment letter to retire from audit service in the case of termination of their independence at any time during responsible supply chain assurance engagement activities; and d) In the case of a legal affiliation or relation with another company headquartered abroad, a copy of the agreement signed with that company; and e) A statement that a professional liability insurance will be taken out in order to meet and compensate the damages that may arise out of responsible supply chain assurance engagement activities. (2) If an independent audit firm filing an authorization application for responsible supply chain assurance engagement activities is found eligible by the Exchange as a result of evaluation of the information and documents listed in the first paragraph, it is announced in the List of Independent Audit Firms in the Exchange’s corporate website. (3) The Exchange may request additional information and documents from the applicant, if deemed necessary at any time during evaluation of applications. Information and documents determined to be lacking or additionally requested by the Exchange are required to be delivered 13/26 <!-- page 14 --> HALKA AÇIK to the Exchange within maximum one month following the date of notification to the applicant. In case of non-delivery thereof by the end of said time, the application of the related applicant is cancelled. (4) The conditions to grant authorization for responsible supply chain assurance engagement activities under this Directive, are required to be continuously fulfilled. The Exchange may, if deemed necessary, check whether these conditions are fulfilled or not. (5) The Exchange takes a decision about applications of independent audit firms who want to engage in responsible supply chain assurance engagement activities within 30 days following submission of the required information and documents to the Exchange, and notifies its decision to the related independent audit firms. (6) If submitted information or documents are incomplete or if additional information and documents are required, the applicant is informed within 10 business days following the date of application, and is asked to complete the requirements within a certain period of time determined by the Exchange. In this case, the duration stated in the fifth paragraph for the incomplete information and documents begins as of the date of submission to the Exchange. ### Delisting of Independent Audit Firms

ARTICLE 17 – (1) In case of detection of any one of the following non-conformities by KGK (the Public Oversight Accounting and Auditing Standards Authority) or the Exchange, the related independent audit firm is removed from the List of Independent Audit Firms by the Exchange either permanently or temporarily for a period of up to two years by considering the type and materiality of non-conformities: a) Loss of any one of the conditions and qualifications sought for in the firms to be authorized as listed in Article 14; or b) Non-compliance with the principles and rules listed in Article 26 of the Independent Audit Regulation promulgated in the Official Gazette edition 28509 on 26/12/2012; or c) Audit plan and working papers and other supportive information and documents are not sufficient for proving the audit work; or ç) Assigning auditors that are not in the responsible supply chain independent audit staff or in the responsible supply chain independent audit agreement for the Exchange audits; or d) Failure in obtaining the required audit proofs due to use of inappropriate audit techniques; or e) When the authorized independent audit firm fails to prove that it is not faulty in identifying issues, and in case of the Exchange’s detection of these failures which may adversely affect the protection of assets of the audited obligors, or performance of activities in compliance with the applicable laws, or reliability and integrity of the responsible supply chain implementation, or acquisition of information on time, when performing responsible supply chain assurance engagement; or f) Responsible supply chain audit team’s non-compliance with ethical principles as integrity, neutrality, professional competence and diligence, independence, reliability and professional conduct in the course of its responsible supply chain assurance engagement work; or g) Failure to notify or failure to submit the obligatory information and documents fully, accurately and on time as requested by the Ministry, the Exchange or designees of the Exchange; or ğ) Issuance of an erroneous, incomplete, misleading and untrue responsible supply chain Independent Assurance Report; or h) Failure in taking out a professional liability insurance to cover also the responsible supply chain assurance engagement. (2) Non-conformities justifying temporary or permanent removal from the list are to be announced separately by the Exchange. 14/26 <!-- page 15 --> HALKA AÇIK (3) Before being delisted temporarily or permanently, the relevant authorized independent audit firm and/or responsible supply chain auditor is asked to give its defence. The relevant firm or auditor is deemed to have waived from its right of defence in case of failure in giving a defence within 30 days following the date of delivery of a notice containing request of defence. (4) Delisting of an authorized independent audit firm does not construe as withdrawal or cancellation of its independent audit authorization as well. However, if KGK imposes sanctions on an authorized independent audit firm such as suspension of its operating license or cancellation of operating license, then, the relevant independent audit firm is deemed to have automatically been delisted without further actions. ### Ethical Principles for Authorized Firms and Auditors

ARTICLE 18 – (1) Ethical Rules for Independent Auditors (also including the Independence Standards) published by KGK are applicable in terms of ethical principles to be complied by the authorized responsible supply chain independent audit firms and responsible supply chain auditors. FOURTH CHAPTER Obligations and Audit Methodology in Responsible Supply Chain Assurance Engagement Activities ### Obligations of Auditees

ARTICLE 19 – (1) Audited obligors are under obligation to make and keep their document flow, document record order and all of their structures and systems within responsible precious metals supply chain ready and appropriate for audit. (2) Audited obligors are obligated to furnish information and document that may be requested by responsible supply chain auditor for responsible supply chain assurance engagement purposes. (3) Obligors, if there is any, deliver a copy of internal audit reports requested by responsible supply chain auditor and a copy of reports prepared by internal control and supply chain compliance officers to the auditor. Responsible supply chain auditor and audited obligors take the required measures for cooperation between independent auditors and internal control and supply chain compliance officers. Audited obligors ensure that internal auditors and internal control and supply chain compliance officers give timely answers and clarify the questions that may be asked by auditors of the authorized firm. (4) It is the responsibility of audited obligor’s board of directors to establish the coordination between responsible supply chain auditors and directors, and personnel of audited obligor, to ensure that the findings are shared with the related persons. (5) For each year, audited obligors shall prepare and issue a supply chain compliance policy and a report proving compliance of the transactions covering the reporting period with these policies, and to present to responsible supply chain auditor a supply chain compliance report approved by their board of directors. In addition, supply chain compliance report is also published in the corporate website of audited obligors. ### Contents of Supply Chain Compliance Report

ARTICLE 20- (1) Supply chain compliance report shall contain the information listed below: a) Trade name of obligor, and b) Reported calendar year, and c) Summary of activities performed during the related period for proof of compliance, and 15/26 <!-- page 16 --> HALKA AÇIK ç) A statement of compliance with each step of the five-step approach described in Borsa İstanbul A.Ş. Directive on the Responsible Supply Chain Assurance Engagement, and d) A management statement relating to compliance with Borsa İstanbul A.Ş. Directive on the Responsible Supply Chain Assurance Engagement. (2) Obligors must, in the statement to be provided pursuant to subparagraph (ç) of first paragraph of this Article, make assessments and present a general “Yes” or “No” final declaration. If obligors declare their full compliance with each of the five steps described in Borsa İstanbul A.Ş. Directive on the Responsible Supply Chain Assurance Engagement, they must give “Yes” answer to general compliance. However, if obligors declare their “non- compliance” with at least one of the steps, they must give “No” answer to general compliance. Where an obligor shows only “partial” non-compliance with any one of the five steps and believes that it must generally remain in compliance, a “Yes” answer is added to the general compliance and declare the causes. (3) A “Yes” answer given by obligors regarding the result in terms of general compliance does not construe as their absolute compliance with the requirements and provisions of Borsa İstanbul Responsible Supply Chain Directive and Due Diligence Guidelines. (4) Obligors are under obligation to keep a List of Countries of Origin for each kind of ores, nonstandard unprocessed precious metals and refined precious metals. The List of Countries of Origin indicates the country of origin, quantity and kind (in three groups, namely ore, nonstandard and refined) of precious metals. The List of Countries of Origin is required to be sent to the Ministry and the Exchange, but may not be made public. (5) Audited Obligors decide and implement their commitments regarding solution of the findings set down in Independent Assurance Report with an action plan thereof. Board of directors of the related audited obligor is responsible for ensuring that the action plan is carried out and all commitments given in the action plan are fulfilled timely and completely. (6) The provisions of special laws and regulations pertaining to the fields of activity of audited obligors are, however, reserved. ### Obligations of Authorized Independent Audit Firms and Auditors

ARTICLE 21 – (1) Responsible supply chain auditors are obliged to comply with the professional and ethical principles required by their profession, aside from their duties and responsibilities listed in GDS 3000, and to prepare, submit to auditee, and apply an audit plan within the frame of professional scepticism and by taking into account the risks and weaknesses that may be included within the supply chain, and not to accept the statements and declarations of managers as adequate audit evidences, and to prepare and issue an audit report. Furthermore, audit firms and auditors are also under obligation to inform KGK about the audit contracts and their revisions, and auditor reports. (2) Responsible supply chain auditor is further obligated to keep the auditee’s managers and if any, its audit committee informed in writing at all stages about the errors, mistakes and frauds detected in audit. (3) Authorized independent audit firm is liable to prepare and issue a management report pursuant to and under Article 22 of this Directive. (4) Any changes in documents and statements mentioned in Article 16 of this Directive are required to be notified to the Exchange in writing within six business days thereafter. Changes in audit staff members are also reported to the Exchange, together with reasons thereof. (5) Authorized independent audit firms are further liable to ensure that responsible supply chain auditors employed by them continuously participate in training programs. (6) If responsible supply chain assurance engagement activities reveal any transactions that do not comply with the applicable laws and regulations, or any developments which may lead to adverse results, or nondisclosure of an opinion thereof, then, even if they are corrected by audited obligors, responsible supply chain auditor is to report such transactions to the 16/26 <!-- page 17 --> HALKA AÇIK Ministry and the Exchange in writing within ten business days following the date they are detected. Cases that constitute a crime are urgently reported to the official authorities and separately, the Exchange is also informed in writing. (7) Responsible supply chain auditor immediately informs in writing or verbally the audited obligors or their managers about any events deemed important, including, but not limited to, the following events, which are found out during responsible supply chain assurance engagement: a) Overall approach and scope of responsible supply chain assurance engagement, also including probable restrictions and additional works; and b) Inconveniences of policy-making process, problems in policy applications, or changes in policy applications, which have or may have a material effect on supply chain; and c) Uncertainties which may cast doubts on continuity of activities of audited obligors; and ç) Disagreements with managers of audited obligors on issues or matters which may materially affect responsible supply chain or Independent Assurance Report; and d) Material weaknesses and risks contained in supply chain. (8) Where information is given verbally, responsible supply chain auditor includes the issues or matters reported as above and the answers received in its working papers. (9) Responsible supply chain auditors are under obligation to keep in good faith and without changing the documents entrusted to them by the related persons within the frame of responsible supply chain assurance engagement for the period of time they are needed for their auditing, and to return them upon completion of their work. Copies of the documents which constitute audit evidence are kept by the authorized institution. (10) Authorized independent audit firms and responsible supply chain auditors are required to take all precautions to protect any data categorized as secret according to the applicable laws and regulations and they acquire in the course of their responsible supply chain assurance engagement activities within their organization, and are not allowed to disclose such information and data to any third parties other than the legally authorized persons or entities, or to use them directly or indirectly in their own interests or in interests of third parties. (11) In the case of audited obligors’ failure to submit to responsible supply chain auditors any information and documents related to responsible supply chain assurance engagement, such failure is urgently reported by authorized independent audit firm to the Exchange. (12) Authorized independent audit firm is under obligation to take out and buy a professional liability insurance to cover all the risks that may arise out of responsible supply chain assurance engagement. (13) Authorized independent audit firm is also under obligation to send to the Ministry, KGK and the Exchange or to present to authorized audit personnel of the Ministry, KGK and the Exchange, upon demand, all kinds of information and documents regarding audit works and all of the working papers to be issued by responsible supply chain auditors employed by it thereinfor. (14) Authorized independent audit firms are obliged to prepare and issue directives for implementation duly approved by their own board of directors by using Independent Audit Standards (IAS) with regard to the guiding provisions relating to assurance engagement thereof. The Exchange is authorized to guide the implementation of the guiding provisions of IASs pertaining to assurance engagement. (15) Responsible supply chain auditors are not allowed to serve as chairperson or member of board of directors, general manager, deputy general manager, authorized signatory, internal control and supply chain compliance officer or in other job positions holding material and significant decision making powers or responsibilities in any one of the obligors where they are actually involved in responsible supply chain independent audit process during the last two years or in their affiliates or subsidiaries. 17/26 <!-- page 18 --> HALKA AÇIK ### Management Report

ARTICLE 22 - (1) Management report is to be prepared and issued by authorized independent audit firm and addressed to audited obligors. Management report is not required to be made public. Management report contains details about assurance findings and suggested actions, and is required to be prepared within maximum one month after the Independent Assurance Report is published, in such manner to contain the following details: a. Trade name of obligors, and b. Reporting period subject to assurance, and c. Professional qualifications of assurance team, and ç. Verification of independence of auditor, and d. Assurance scope and assurance level, and e. Summary of assurance procedures, and f. Material or natural limitations or uncovered parts, and g. Assurance observations, findings and suggestions for improvement, and ğ. Corrective action plan of obligors, and specific observations relating to progress of implementation thereof, and h. Assurance results (or a reference made to results in Independent Assurance Report), and ı. List of countries of origin for extracted and recycled precious metals, also including quantities (in kg unit) obtained from each source (within the framework specified as an obligation in this Directive), and i. Which elements are actually covered and tracked by the scope of supply chain of obligors, and in which details, and j. Other related information. ### Action Plan

ARTICLE 23 - (1) Considerable control deficiencies, significant control deficiencies or non-conformities to zero tolerance policy are required to be reported in action plan. Action plan is prepared by responsible supply chain auditor. Compliance deviations are included in the action plan as determined by independent auditor in management report. Auditors review the action plan, and assess whether action plan contains all relevant information or not, and whether it is completed in accordance with the requirements or not, and review the implementation of corrective actions and activities determined in the previous period, and if they detect any non- conformity (non-conformities relating to considerable control deficiencies, significant control deficiencies, zero tolerance policy) as a part of assurance procedures, they immediately share such finding with the obligors so that they can start to take and implement a corrective action. (2) Contents reported in action plan must be coherent to and consistent with responsible supply chain compliance report. (3) If obligors have significant control deficiencies, responsible supply chain auditor is, if deemed necessary, required to perform a follow-up audit with a view to provide a reasonable assurance within ninety days following the date the compliance report is issued and published. Scope of follow-up audit is the action plan. Auditor must publish a separate Independent Assurance Report thereinfor. (4) If corrections needed for significant control deficiencies cannot be done sufficiently, or if the second follow-up assessment reveals that actions with regard to significant control deficiencies have not yet been completed, then, these events are reported in writing by responsible auditor to the Ministry and the Exchange as soon as possible thereafter. ### Responsible Supply Chain Assurance Engagement Agreement

ARTICLE 24 – (1) Obligors are required to sign a responsible supply chain assurance engagement agreement with authorized independent audit firm hired for performing responsible supply chain assurance engagement, within the initial four months of the period of audit. The 18/26 <!-- page 19 --> HALKA AÇIK provisions of IAS 210 Agreeing the Terms of Audit Engagements provide guidance in respect of responsible supply chain assurance engagement agreement. (2) If responsible supply chain assurance engagement agreement cannot be signed by the end of the first four months of the audit period for any reason, the matter is reported to the Exchange in the first business day following the date of occurrence thereof at the latest. (3) In determining the maximum period of responsible supply chain assurance engagement services to be provided by independent audit firm to obligors, the provisions of second paragraph of Article 400 of the Turkish Commercial Code no. 6102 dated 13/1/2011, and of subparagraph (ç) of first paragraph of Article 26 of the Independent Audit Regulation promulgated in the Official Gazette edition 28509 on 26/12/2012 are applied. (4) Authorized independent audit firms are required to report to KGK and the Exchange within maximum six business days all of the responsible supply chain assurance engagement agreements signed by them. (5) Upon termination of a responsible supply chain assurance engagement agreement signed between authorized independent audit firms and obligors, such termination is required to be reported to the Exchange, together with reasons thereof. (6) In case of termination, the authorized independent firm is under obligation to transfer and deliver its working notes and all required information to its successor authorized firm, and to duly report it to the Exchange. ### Audit Plan

ARTICLE 25 – (1) The provisions of IAS 300 Standard on Planning of Independent Audit of Financial Statement provide guidance to the process of planning of responsible supply chain assurance engagement. ### Audit Evidence, Techniques, Sampling and Control Test

ARTICLE 26 – (1) The provisions of International Standard on Auditing 500 Audit Evidence and International Standard on Auditing 530 Audit Sampling, provide guidance for audit evidences, techniques and sampling. (2) Responsible supply chain auditor determines the scope of to-be-tested controls by taking the materiality principle into account and to provide a reasonable assurance as to efficiency, adequacy and compliance of responsible supply chain of the control set to be tested, and all of the controls on that system. (3) In order to conclude that responsible supply chain controls are effective, adequate and compliant, the efficiency and compliance of the design and operation of all controls subjected to inspection are required to be tested. (4) With a view to reducing the audit risk to a reasonable level, responsible supply chain auditor details the tests, expands the sample volume, and increases adequacy and reliability levels of their evidences in such manner to reduce the risk of determining in areas where the material or considerable control efficiency risk relating to the tested controls is high. (5) In determining the scope of tests relating to controls, responsible supply chain auditor takes into consideration control characteristics as frequency of application of the related control, trusted period in terms of being active, and expectation of deviation in controls. (6) Responsible supply chain auditor cannot decide the efficiency, adequacy and compliance of a control only with audit evidences obtained by using only the information collection technique. (7) Responsible supply chain auditor determines the duration to be taken into consideration in testing of a control to decide on the whole audit period. FIFTH CHAPTER Principles of Reporting Responsible Supply Chain Independent Audit Results 19/26 <!-- page 20 --> HALKA AÇIK ### Findings to be Included in Independent Assurance Report

ARTICLE 27 – (1) Responsible supply chain auditor reports control weaknesses, considerable control deficiencies, significant control deficiencies and nonconformities to zero tolerance policy by supporting them with adequate and appropriate audit evidences. (2) In expressing their determinations, responsible supply chain auditor gives details of these findings to the excent required by audit purposes. (3) Findings defined as control deficiencies are reported in writing to managers of obligors audited by responsible supply chain auditor. Responsible supply chain auditor includes in their Independent Assurance Report a statement verifying that the findings are reported to managers of obligors audited by them, and also the number of control deficiencies determined on the basis of control objectives. (4) Responsible supply chain auditor evaluates in Independent Assurance Report all findings identified in the past and yet not remedied in the report of the previous period. In the Independent Assurance Report, the auditor also includes the recent status of these findings, their progression or not, and whether the audited obligors are acting in compliance with the committed action plan or not. (5) If responsible supply chain auditor concludes that any one or more of frauds, breaches of laws, breaches of contracts, misconducts, double entry system or duplicate information systems, the auditor states their opinion in the Independent Assurance Report. These findings are urgently reported in writing by responsible supply chain auditor to the Ministry and the Exchange as well. (6) Independent Assurance Report must also contain the audit results regarding supply chain compliance report. ### Opinions of Audited Obligors

ARTICLE 28 – (1) Responsible supply chain auditor also includes the opinions of obligors in the Independent Assurance Report regarding the identified deficiencies, and if any, their planned revisions and probable consequences. (2) Responsible supply chain auditor includes in the Independent Assurance Report the opinions of obligors regarding the findings determined in the past and yet not corrected in the report of the previous period, and correction of these weaknesses and deficiencies carried out. (3) Responsible supply chain auditor also includes in the Independent Assurance Report the cases wherein the audited obligors cannot express their opinions or refuse to express their opinions, together with the reasons thereof. ### Outcome Assessment of Findings

ARTICLE 29 – (1) Responsible supply chain auditor interprets audit objectives, audit findings and audited obligors’opinions and includes these assesments with the auditor’s inferences and opinions in the Independent Assurance Report. Responsible supply chain auditor also comments on how the findings of audit should be understood and interpreted in the Independent Assurance Report. (2) If responsible supply chain auditor does not agree with opinions of the audited obligors or believes that the planned actions are not appropriate, it is to be stated separately in the outcome assessment. If responsible supply chain auditor agrees with opinions of the audited obligors, the auditor makes the required corrections in the Independent Assurance Report. (3) If the audited obligors state any correction of finding to responsible supply chain auditor before the date of the Independent Assurance Report, then, to verify the statement of auditee, responsible supply chain auditor analyzes the recent status of that finding only once for each of those findings. If responsible supply chain auditor draws a conclusion that the finding is remedied, then the correction is stated in the outcome assessment section of the auditor’s report. 20/26 <!-- page 21 --> HALKA AÇIK (4) Responsible supply chain auditor also includes the findings identified in the past and not yet remedied in the report of the previous period in the outcome assessment section of their report. The satus of the finding in the form of “continued”, “partially corrected” or “corrected”, along with the compliance of the audited obligor to the action plan of the solution of the findings, are given in the Independent Assurance Report. ### Independent Assurance Report

ARTICLE 30 – (1) Independent Assurance Report contains a conclusion derived by responsible supply chain auditor about the audited supply chain. (2) The conclusion of audit clearly states whether responsible supply chain and all of the controls and measures applied on the system are effective, adequate and compliant or not. ### Formation of Assurance engagement Results

ARTICLE 31 – (1) Persons authorized to sign the Independent Assurance Report express a positive result if the audit does not reveal any significant control deficiency and if responsible supply chain auditor does not face any restriction or prevention in the course of the audit work. (2) Persons authorized to sign the Independent Assurance Report express a qualified result if: a) the audit reveals at least one significant control deficiency, but nevertheless they believe that such deficiency does not affect the whole or a great part of responsible supply chain of the audited obligors, or b) they fail to acquire adequate information about a newly established system or the existence of any problem restricting the audit activities, though not important enough to avoid expressing an audit result. (3) As a result of assessment of significant control deficiencies detected individually or together, persons authorized to sign the Independent Assurance Report express an adverse result if: a) they conclude that such deficiencies affect the whole or a great part of supply chains of the obligors, or b) a significant control deficiency is determined in the audit conducted by responsible supply chain auditor, and the deficiency is incompletely or inaccurately reported in compliance report or is not reported at all. (4) Persons authorized to sign the Independent Assurance Report may refrain from expressing a result on responsible supply chain if they fail to collect adequate and appropriate evidence for an audit result or if they believe that uncertainties and limitations faced in the auditing process are important enough to prevent the expression of a result. In the case of refraining from expressing a result, the report shall contain the auditor’s reasons for refraining from expressing a result. ### Main Elements of Independent Assurance Reports

ARTICLE 32 – (1) Independent Assurance Report is prepared and issued by auditor, and this report describes the details of results of responsible supply chain assurance engagement. When made public, the Independent Assurance Report must be accompanied by a copy of compliance report even if published previously. This report is published in the corporatewebsite of obligors. (2) Independent Assurance Report to be prepared by independent auditor contains such information as date of audit, audit period, audit activities and methodology, audit results and mandatory GDS 3000 statements. Furthermore, Independent Assurance Report also contains a statement of auditor as to whether supply chain compliance report demonstrates the compliance of activities carried out throughout the related calendar year with the pertinent regulations and standards or not, and as to whether the overall conclusion of the report is fairly stated or not, as well as a statement of auditor verifying that he satisfies and meets the conditions of competence. 21/26 <!-- page 22 --> HALKA AÇIK ### Finalizing and Publishing of Independent Assurance Report

ARTICLE 33 – (1) Independent Assurance Report of obligors becomes final only when it is signed by the responsible auditor. Independent Assurance Report is delivered to boards of directors of the audited obligors within a reasonable time after its date of finalization. After receiving, Independent Assurance Report is sent by boards of directors of the audited obligors to the Ministry and the Exchange, together with a decision of board of directors verifying that the report is accepted. (2) Independent Assurance Report is required to be published in corporate website of audited obligors and to be separately sent to the Ministry and the Exchange by the end of June following the end of the related audit period. SIXTH CHAPTER Exchange’s Audit Mandate, Sanctions, Effective Date and Enforcement ### Exchange’s Audit Mandate and Sanctions

ARTICLE 34 – (1) If supply chain compliance report is not prepared and issued by the audited member, or an adverse result is expressed in the conclusion part of Independent Assurance Report, or in case of refraining from expressing a result and/or non-performing an independent audit, then, the sanctions required as per the Exchange regulations are applied on the related audited member. In this case, the related obligor’s operating license cancelled by the Ministry in accordance with provisions of the Regulation pertaining thereto. (2) If supply chain compliance report is not prepared and issued by a refinery, or an adverse result is expressed in the conclusion part of Independent Assurance Report, or in case of refraining from expressing a result and/or non-performing an independent audit, then, the related refinery is delisted by the Exchange from the Borsa İstanbul Refinery List. (3) Depending upon the kind and significance of nonconformities detected as a result of inspections conducted by the Exchange, regardless of the results of Independent Assurance Report, the required sanctions, including, but not limited to, cancellation by the Exchange of authorization of the related obligor to trade in the relevant markets, market segments and platforms and delisting from the List of Refineries, are imposed by the Exchange. (4) For clarification of the issues deemed fit, the Ministry and the Exchange may direct questions to authorized independent audit firms and obligors, or request explanations, or request audit work papers and other documents, or perform onsite audits. ### Absence of Provisions

ARTICLE 35 – (1) All matters on which this Directive has no provisions or is not clear shall primarily be governed by and subject to the provisions of Borsa İstanbul A.Ş. Directive on the Responsible Supply Chain Assurance Engagement pertaining thereto. (2) The CEO is authorized to take decisions, and guide and regulate the enforcement, within the frame of the relevant regulations, on all matters on which this Directive has no provisions or is not clear. Provisional Articles PROVISIONAL ARTICLE 1 – (1) For compliance report and Independent Assurance Report covering the year 2021, the period between 1/7/2021 and 31/12/2021 is accepted as the reporting period. (2) The conditions set down in paragraph 3 of Article 15 of this Directive are not sought for in auditors to be assigned for independent audit activities for the year 2021. (3) In order for independent audit firms assigned for independent audit activities for the year 2021 to be included in the list of authorized independent audit firms, at the time of application to be filed to the Exchange under Article 16 of this Directive, a condition of statement verifying that a professional liability insurance cover will be taken out for 22/26 <!-- page 23 --> HALKA AÇIK indemnification of losses or damages that may arise out of responsible supply chain independent audit is not sought for. In respect of independent audit firms to be assigned for independent audit activities for the year 2021, the provisions of subparagraph (h) of first paragraph of Article 17 and twelfth paragraph of Article 21 of this Directive are not applied and are not sought for. (4) Solely for 2021 audits of refineries established in Türkiye, independent assurance reports issued by an authorized independent audit firm included in the list of authorized independent audit firms of foreign responsible supply chain programs verifying that the subject refinery performs its business activities in accordance with said programs are also acceptable by the Exchange if and when deemed fit. Refineries are required to submit such requests and detailed explanations of them by no later than 1/3/2022, with a petition and if any, a supply chain compliance report and an Independent Assurance Report. In this case, the Exchange decides separately for each application whether the provisions pertaining to management report, list of countries of origin, and follow-up audit will be applied thereon or not. ### Effective Date

ARTICLE 36 – (1) This Directive shall become effective as of 05/03/2021. ### Enforcement

ARTICLE 37 – (1) The provisions of this Directive shall be enforced and executed by the CEO. Revisions First Revision On 02/06/2021, Articles 14 and 16 of this Directive have been revised and amended as shown below, and the new texts have been inserted in the Directive. 23/26 <!-- page 24 --> HALKA AÇIK On 02/06/2021, by the 1st Revision, the following revisions and amendments are made in the Directive. Former Text New Text Conditions Sought for in Firms to be Authorized Conditions Sought for in Firms to be Authorized

ARTICLE 14 – (1) Authorized independent audit firms are required: ARTICLE 14 – (1) Authorized independent audit firms are required: a) to be among the firms authorized as Organizations Interesting The a) to be among the firms authorized as Organizations Interesting The Public Benefit by the Public Oversight Accounting and Auditing Public Benefit by the Public Oversight Accounting and Auditing Standards Authority; and Standards Authority; and b) to employ an adequate number of responsible supply chain b) to be authorized to deal with independent audit activities in auditors, not being less than two, having adequate qualifications for capital markets by the Capital Markets Board; and conduct of responsible supply chain assurance engagement activities. c) to employ an adequate number of auditors, not being less than c) to have adequate technical equipments, documentation and two, having adequate qualifications for conduct of responsible supply recording systems. chain assurance engagement activities. Application to Exchange and Publishing in the List Application to Exchange and Publishing in the List

ARTICLE 16 – (1) Independent audit firms wishing to engage in ARTICLE 16 – (1) Independent audit firms wishing to engage in responsible supply chain assurance engagement activities file an responsible supply chain assurance engagement activities file an application to the Exchange with the following information and application to the Exchange with the following information and documents: documents: a) Detailed curriculum vitae of responsible supply chain auditors to be a) Detailed curriculum vitae of responsible supply chain auditors to assigned in responsible supply chain assurance engagement activities, be assigned in responsible supply chain assurance engagement activities, containing their professional experience, license certificates, trainings containing their professional experience, license certificates, trainings received in respect of audit, audit works and activities (if any) received in respect of audit, audit works and activities (if any) participated participated by them, and job duties assumed in said audit works and by them, and job duties assumed in said audit works and activities, and activities, and statement of residence address, and statements verifying statement of residence address, and statements verifying that they do not that they do not have any previous criminal records, are not adjudged have any previous criminal records, are not adjudged bankrupt, and have bankrupt, and have adequate professional knowledge, and one copy of adequate professional knowledge, and one copy of each of diplomas or 24/26 <!-- page 25 --> HALKA AÇIK each of diplomas or graduation certificates relating to undergraduate graduation certificates relating to undergraduate and/or postgraduate study and/or postgraduate study programs, duly approved by the official programs, duly approved by the official authorities; and authorities; and b) One copy of each of the certificates verifying the training courses b) One copy of each of the certificates verifying the training courses received or given in regard to the precious metals supply chain and audit; received or given in regard to the precious metals supply chain and and audit; and c) A list of audit staffs to be assigned in responsible supply chain c) A list of audit staffs to be assigned in responsible supply chain assurance engagements by their job duties and positions; and assurance engagements by their job duties and positions; and d) In the case of a legal affiliation or relation with another company d) Information and documents verifying that they have adequate headquartered abroad, a copy of the agreement signed with that other technical equipment, documentation and recording systems, company; and e) A statement that a professional liability insurance will be taken out e) In the case of a legal affiliation or relation with another company in order to meet and compensate the damages that may arise out of headquartered abroad, a copy of the agreement signed with that other responsible supply chain assurance engagement activities. company; and f) A statement that a professional liability insurance will be taken out (2) If an independent audit firm filing an application for authorization for in order to meet and compensate the damages that may arise out of responsible supply chain assurance engagement activities is found eligible responsible supply chain assurance engagement activities. by the Exchange as a result of evaluation and review of the information and documents listed in the first paragraph, it is announced in the List of (2) For determination of professional and technical competences Independent Audit Firms in the Exchange’s internet website. of an independent audit firm filing an application for authorization for responsible supply chain assurance engagement activities on the basis of evaluation and review of the information and documents listed in the first paragraph, on onsite inspection is conducted by the Exchange. If, as a result of this onsite inspection, it is believed that it is competent enough to deal with the said fields of activity, it is 25/26 <!-- page 26 --> HALKA AÇIK announced in the List of Independent Audit Firms in the Exchange’s internet website. 26/26