Know Your Customer Objectives Identity customers who maintain

Know Your Customer

Objectives • • Identity customers who maintain accounts and/or relationships with State Street. Manage and mitigate AML, Sanctions, Compliance, Operational, Reputational, and Strategic risks a customer poses throughout the customer lifecycle. Conduct Customer Identification Program (CIP), Customer Due Diligence (CDD), Simplified Due Diligence (SDD), and Enhanced Due Diligence (EDD), wherever appropriate on customers and their Ultimate Beneficial Owners (UBOs) and related parties. Determine the AML Customer Risk Rating (CRR) for new and existing customers and when to apply enhanced due diligence for those customers who are deemed High Risk. Comply with Sanctions regulations and report instances of suspicious activity. Cooperate with regulatory and law enforcement authorities in criminal investigations, prosecutions, and forfeiture actions relating to AML, Sanctions or other criminal activities. Maintain proper records for five years. Page 6 of Participant Guide

Lessons • • • Lesson 1: Know Your Customer Lesson 2: Customer Identification Program Lesson 3: Customer Due Diligence Lesson 6: Enhanced Due Diligence Lesson 7: Ongoing Reviews

Lesson 1: Know Your Customer • • • Know Your Customer Components Consequences of Non-Compliance First, Second, and Third Lines of Defense Customers at State Street Accounts Customer Types Customer Translation Table Completing KYC New and Existing Customers Know Your Customer Lifecycle and Escalation Opening an Account Overview of the AML Toolkit Page 9 of Participant Guide

Know Your Customer Components Customer Identification Program (CIP) This process allows the First Line of Defense to collect and verify a customer’s identification information before the customer is onboarded Customer Due Diligence (CDD) This process allows the First Line of Defense to assess the AML and Sanctions risk associated with the customer Enhanced Due Diligence (EDD This process provides for a closer review of High-risk customers Page 10 of Participant Guide

Consequences of Non-Compliance State Street Employees o Monetary fines (in millions of dollars) o Prison sentences (10 to 30 years) State Street o Monetary fines (in millions of dollars) o Reputational damage o Cease and desist orders (Likely to weaken the solvency/earnings of the financial institution (FI)) Page 11 of Participant Guide

First, Second, and Third Lines of Defense Who are They Responsibilities First Line of Defense Business Unit and AML KYC Co. E (Shared Services) Ensure ongoing compliance Perform routine verification and provide up to date information on AML and Sanctions key risks and control indicators Second Line of Defense AML Compliance Perform Real Time Monitoring Conduct Ex Post Surveillance Third Line of Defense Corporate Audit Conduct independent and regular reviews of State Street’s Global AML and Sanctions Programs Page 12 of Participant Guide

First, Second, and Third Lines of Defense (Contd. ) India • • • Global Ops USIS IIS WMS Global Credit Services IMS SSGM SSGX SSIA Finance GS-APAC SSg. A Poland • AIS • GS-EMEA • SSGM Page 12 of Participant Guide

Customers at State Street Non-Individuals Once the Customer has been identified, additional parties also need to be identified. Ultimate Beneficial Owners (UBOs) Controlling Parties Associated Third Parties Pages 13 and 14 of Participant Guide

Account An account is a formal banking or brokerage relationship established to provide or engage in services, dealings, or other financial transactions Page 15 of Participant Guide

Customer Types Bank (Foreign and Domestic) Pension Plans Charities, Religious Group and Non-Profit Personal Investment Vehicle/ Personal Holding Company/ Personal Investment Company Private Company Foundations/Endowments Government, Government Agency and Central Bank/Monetary Authority Hedge Fund, Private Equity and Venture Capital Fund (Closed-Ended) Individual - Citizen/ Non-Citizen Public Company Insurance Company Sovereign Wealth Funds (SWF) Investment Advisor (Regulated) Supra National Organization Investment Advisor (Unregulated) Trusts (Corp & Individual) Money Service Businesses (MSB) University, Hospital and University or Hospital Foundation Mutual Funds Securities & Commodities (Broker/Dealer) Special Purpose Vehicle Pages 17 to 19 of Participant Guide

Customer Translation Table Pages 20 of Participant Guide

Completing KYC varies depending on whether the customer is New or Existing New customer A new customer is a Non. Individual or an Individual contracting with State Street for the first time Existing customer An existing customer is a Non-Individual or an Individual who currently holds a contract with State Street Page 21 of Participant Guide

New and Existing Customers Account Holder o Non-Individual or Individual for which the account is opened Account Related CDD Sub-Account o Expected account activity o Identification of all nominal owners of the account o The purpose for opening the account o Whether the relationship will be used as a Payable Through Account o Whether the relationship will be used for Nested Accounts o Sub-Accounts are often used to compartmentalize Master Accounts allowing for more detailed recordkeeping and organization o Sub-Accounts used to support internal or customer's operational purposes have no AML obligations under the Global AML Policy Page 20 of Participant Guide

Know Your Customer Lifecycle New Customers and Accounts • CIP, CDD, CRR, and EDD, if applicable, must be conducted prior to opening an account and rendering services New Customer and Account Holder as Separate Legal Entities • CIP, CDD, AML CRR, and EDD, if applicable, must be conducted prior to opening an account and rendering services New Account Existing Customer Same as Account Holder • CDD, AML CRR, and EDD, if applicable, must be completed within 30 calendar days of account opening Existing Customer Different from Account Holder • CDD, AML CRR, and EDD, if applicable, must be performed at both the customer and account level within 30 calendar days of account opening Existing Customer New Sub-Account • Full KYC is only required when the master and subaccount are different legal entities and have different ultimate beneficial ownership • In instances where CDD is required for a sub-account, CDD, EDD (if applicable), and AML CRR must be completed within 30 calendar days of account opening. Page 20 of Participant Guide

Know Your Customer Escalation Plan a remediate, if within 30 calendar days of account opening there is still outstanding information required to complete CIP, CDD or EDD, Plan to terminate the customer (including termination date, if after 60 calendar days of account opening, there is still outstanding information required to complete the CDD or EDD process KYC Lifecycle Timeline Report to the AML Compliance Financial Intelligence Unit (FIU) all accounts with incomplete CDD or EDD after 60 calendar days from account opening for consideration of SAR filing. Pages 21 and 22 of Participant Guide

Opening an Account Custody Relationship/Account Bank Account Services Rendered No later than the day prior to the first transaction date on the account, it is considered an open “live” account. Once an account is ready to transact or is capable of receiving a deposit, it is considered an open “live” account. The date the contract has been signed, or After the first service has been provided to the customer. Pages 24 and 25 of Participant Guide

Overview of the AML Toolkit Global AML and Sanctions Policies Risk Forms (EDD Customer Profile and the Low/Medium and High Periodic Review Forms) Global AML and Sanctions Business Unit Standard Operating Procedures Components Customer Translation Table AML CRR KYC Platform KYC Requirements Matrix Pages 26 and 27 of Participant Guide

Summary • • • KYC is comprised of the following three components: CIP, CDD, and EDD. State Street has no tolerance for breaches within its AML and Sanctions Programs. To support the activities within the TOM, the First, Second, and Third Lines of Defenses have been formed. A customer is a person contracting directly with State Street for the provision of products and services. A customer can be either a Non-Individual or an Individual. An "account" is a formal banking or brokerage relationship established to provide or engage in services, dealings, or other financial transactions. Once the customer and the account have been identified, we need to determine the customer type. Completing KYC varies depending on whether the customer is New or Existing. The relationship with the customer begins when the account is opened and services are rendered. There are three types of established relationships within State Street: Custody Relationship/Account, Bank Account, and Services Rendered. The AML KYC Toolkit comprises: Global AML & Sanctions Policies, Global AML and Sanctions Business Unit Standard Operating Procedures, Customer Translation Table, KYC Requirements Matrix, KYC Platform, AML CRR, and Risk Forms (EDD Customer Profile and the Low/Medium and High Periodic Review forms).

Lesson 2: Know Your Customer • Customer Notice (US Customers Only) • Required Information for Customer Identification • Customer Identification Program Exemptions and Simplified Due Diligence • Customer Verification • Material Discrepancies Page 28 of Participant Guide

Customer Notice (US Customers Only) The customer notice should/will be: Available in various forms depending on the manner in which the customer opens an account. Adequate if the Business Unit gives a general description of the identification requirements. Adequate if the Business Unit provides it in a way that is reasonably designed to ensure that customers can see it or know about it before opening an account. Page 29 of Participant Guide

Required Information for Customer Identification Non-Individual • Full Business or Legal Entity Name (Contracting Party) • Physical Address and Country • Identification number • • Individual (WMS Only) Controlling Party and Associated Third Party UBOs • • Name Date of Birth Physical Address and Country Identification number • Name • Date of Birth (for individuals) • Job Title Name Address, including Country Date of Birth ID number Pages 30 to 32 of Participant Guide

Customer Identification Program Exemptions and Simplified Due Diligence A CIP exemption, often referred to as Simplified Due Diligence (SDD), is a reduced form of due diligence in specific circumstances only, and is considered appropriate for certain customers where the money laundering or terrorist financing risk is deemed to be lower. Pages 33 and 34 of Participant Guide

Customer Verification Documentary Methods that rely on verifying the customer’s identity through the inspection of physical documents. Non-Documentary Methods that rely on verifying the customer’s identity through the collection of customer information using non-documentary sources, for example: • Banker’s Almanac • Bloomberg • Bureau Van Dijk – ORBIS Pages 35 to 40 of Participant Guide

Material Discrepancies Resolving Discrepancies AML KYC Co. E (Shared Services) may use one or more of the following steps to resolve such material discrepancies before the customer’s account is opened Escalating Discrepancies If the material discrepancy cannot be resolved and verification cannot be completed, the customer’s account cannot be opened and the matter must be considered by AML Compliance for suspicious activity reporting. Page 41 of Participant Guide

Summary • • • All Business Units are required to provide U. S. customers with adequate notice that State Street is requesting information to verify their identity. The Business Unit must obtain and retain minimum identification information from each: new customer seeking to open an account, or new person being added to an existing customer’s account, before the account is opened and services are rendered, and for an existing customer seeking to open a new account. A CIP exemption, often referred to as SDD, is a reduced form of due diligence in specific circumstances only, and is considered appropriate for customers where the money laundering or terrorist financing risk is deemed to be lower. After the Business Units gather the necessary information and documents, AML KYC Co. E (Shared Services) must verify the identity of a customer through documentary or non-documentary means, or through a combination of both to form a reasonable belief that it knows the true identity of the customer. In the course of verifying the identity of a customer, material discrepancies may arise between information obtained from the customer and information obtained during the verification process.

Lesson 3: Customer Due Diligence • Standard CDD: Purpose of an Account • Standard CDD: Building Customer’s Anticipated Activity Profile • Standard CDD: Source of Funds • Standard CDD: Source of Wealth • Standard CDD: Screening • Targeted CDD: Customer Finances • Customer Risk Rating Page 43 of Participant Guide

Standard CDD: Purpose of an Account Gather information about the customer’s anticipated activity 1 Complete the applicable CDD process requirements and include the customer’s account profile in the customer’s KYC file in the customer database system Business Units 4 Ensure that information required is commensurate with the risk associated with the products and services to be delivered and/or the customer segment 2 Include details of what products and services are being provided to the customer and intended use of the product 3 Page 44 of Participant Guide

Standard CDD: Building Customer’s Anticipated Activity Profile Before the customer’s account opening process is complete, the Business Unit must collect information to cover: Anticipated Account Activity Source of Funds Source of Wealth • Reflect higher risk activities that are expected • Transactions that are not routine (i. e. , a one-time transaction as a result of the sale of a property or a loan disbursement) Page 45 of Participant Guide

Standard CDD: Source of Funds Non. Individual Transactions Non. Individual/ Individual Documents Individual Transactions To establish the source of funds that are involved in the proposed relationship or occasional transaction. Pages 46 and 47 of Participant Guide

Standard CDD: Source of Wealth In order to evaluate the source of a customer’s wealth, the Business Unit should gather information relevant to the manner in which the customer’s assets were obtained. This is the accumulation of the customer’s net worth which includes, in part, the funds held by State Street. Non. Individual Documents Non. Individual Transactions Individual Documents Individual Transactions Pages 48 to 51 of Participant Guide

Standard CDD: Screening • Global, Local, and State Street Sanctions Lists • World Check Iran Economic Interest Database (IEI Database) • AML Compliance Counterparty AML Watch List • Negative news Search (through World Check or another vendor) • PEP • Financial Crimes Enforcement Network (Fin. CEN) Section 311 Special Measures Pages 52 to 56 of Participant Guide

Standard CDD: Sanctions (Contd. ) Sanctions Screening • Global, Local, and State Street Sanctions Lists • World Check IEI Database • AML Compliance Counterparty AML Watch List Pages 52 to 56 of Participant Guide

Standard CDD: Negative News (Contd. ) Negative News All customers, UBOs and any other related and specified controlling parties, and associated third parties must be screened for negative news items, and once analyzed, should be designated as relevant or non-relevant. Pages 52 to 56 of Participant Guide

Standard CDD: Politically Exposed Person (PEP) (Contd. ) Politically Exposed Person (PEP) In order to meet its regulatory obligations State Street is required to identify customers, and nominal or UBOs, who are PEPs may generally be viewed as High-risk customers Pages 52 to 56 of Participant Guide

Standard CDD: Fin. CEN Section 311 Special Measures (Contd. ) • • Fin. CEN Section 311 Special Measures • • • Recordkeeping on and reporting of certain transactions Collection of information relating to beneficial ownership Collection of information relating to certain payable-through accounts Collection of information relating to certain correspondent accounts Prohibition or conditions on the opening or maintaining of correspondent or payablethrough accounts Pages 52 to 56 of Participant Guide

Targeted CDD: Customer Finances Separate Annual Report • • • Name of external auditors Evidence of audit The most recent audited financial statements, within the last two years Jurisdictional equivalent to audited financials Justification/attestation, approved by AML Compliance, for lack of information Annual Report Consolidated into Parent Report There may be circumstances where the customer is either a wholly or majority owned subsidiary or a Branch, that does not have its own separate annual report, but has their financial information consolidated into its Parent's report and accounts. In these circumstances, the Parent’s consolidated report and accounts should be used, provided these are audited by a reputable auditor appropriate for the size and nature of the customer. Page 57 of Participant Guide

Customer Risk Rating Pages 58 and 59 of Participant Guide

Summary • • • Within CDD, there are certain tasks that need to be completed for all customers, no matter what the Customer Type. We refer to this as Standard CDD. The Business Unit will accept only those customers whose source of funds and source of wealth can be reasonably established to be legitimate. In order to evaluate the source of a customer’s wealth, the Business Unit should gather information relevant to the manner in which the customer’s assets were obtained. The third step in CDD is when the Business Unit conducts screening prior to opening the customer’s account. Negative news can be classified as relevant negative news and non-relevant negative news. Section 311 of the USA PATRIOT Act (Section 311) grants the Secretary of the Treasury the authority, upon finding that reasonable grounds exist for concluding that a foreign jurisdiction, foreign FI, class of transaction, or type of account is of “primary money laundering concern, ” to require domestic FIs and financial agencies (such as banks) to take certain “special measures” against the entity identified as a primary money laundering concern. In order to meet its regulatory obligations, State Street is required to identify customers who are PEPs. Once all the customer information is gathered from the customer, the Business creates a Separate Annual Report and Consolidated Annual Report. After all of the necessary information has been obtained from the Business Unit, KYC Shared Services risk rates the customer to assess the AML Risk of conducting business with this customer.

Lesson 6: Enhanced Due Diligence • • • Required and Triggered Enhanced Due Diligence First Line of Defense Responsibilities General Enhanced Due Diligence Requirements Source of Wealth Site Visits PEP Identification Enhanced Due Diligence Customer Profile Form Risks and Mitigants Record Retention How to conduct PEP Identification How to conduct EDD Pages 118 of Participant Guide

Required and Triggered Enhanced Due Diligence Triggered EDD Required EDD is critical to identify a High-risk customer’s anticipated transactions. Customer accounts not subject to EDD requirements at the time of account opening may later become subject to EDD requirements. EDD is always required for customers rated High and for the customers types, regardless of their AML CRR. Pages 119 of Participant Guide

First Line of Defense Responsibilities Investigative and analytic due diligence with respect to High-risk customers Reviewing transactions of existing customers as identified through the High-risk review process Pages 120 of Participant Guide

General Enhanced Due Diligence Requirements For UBOs, the First Line of Defense collects information on beneficial owners with ten percent (%) (for High-risk) or more ownership of the entity, based on State Street's policy requirements, through documentary means. This includes Name Address including country 1 2 Date of birth 3 ID number 4 Pages 121 of Participant Guide

Source of Wealth Ownership of a business Employment or professional practice Inheritance Investments Pages 122 to 124 of Participant Guide

Site Visits The Business Unit AML Officer performs site visits at the customer’s primary place of business at the onset of the relationship and annually thereafter Trigger Events A site visit may be trigged by events identified by the First Line of Defense and escalated to the Business Unit AML Officer, or directly by concerns raised through processes within AML Compliance. Report Requirements Details of site visits are recorded, which at a minimum must include: Date of the site visit, Customer name and location, Names of all parties who attended the meetings, Subject of such meetings, Outcomes of the meetings Description of the business location , Identified risk factors Key Elements The key elements of site visits remain a confident understanding of the: Customer, Personnel associated with it, AML Program and controls Operations that are in line with what would be expected Pages 125 and 126 of Participant Guide

PEP Matches PEP Identification In the event that a match occurs, AML KYC Co. E (Shared Services) must review the match and eliminate any false potential name matches. EDD for PEPs When it has been determined that a customer is or has a PEP associated with it, additional KYC must be performed on the PEP. The information, data and/or documentation required to complete the additional KYC is detailed in the KYC Requirements Matrix. Pages 127 and 128 of Participant Guide

Enhanced Due Diligence Customer Profile Form Pages 129 of Participant Guide

Risks and Mitigants Enhanced transaction monitoring Examples of potential mitigants that may be used for monitoring High-risk customers: Documenting existing relationships Repute and/or verification of customer directors Site visits Ongoing screening of key principles, Ultimate Beneficial Owners (UBOs) outside of automated sanctions screening Pages 130 of Participant Guide

Record Retention As a requirement, all customer facing businesses, support functions, and control functions must maintain records of a customer’s identity, transactions, and other significant records. AML records must be maintained for a minimum of five years (from the end of the customer relationship in the case of identity records) or longer, if local regulation requires. Pages 131 of Participant Guide

Summary • • • A High-risk customer’s activities should be reviewed more closely at the time the account is opened and more frequently throughout the term of the relationship. After completing CDD and determining that the customer is High-risk or the customer type requires mandatory EDD, AML KYC Co. E (Shared Services) must perform EDD. To better understand the risks posed by a customer who requires EDD, the Business Unit obtains additional information about the customer, UBOs, and any other related and specified controlling parties and associated third parties. AML KYC Co. E (Shared Services) uses the KYC Requirements Matrix to determine what information, data, and/or documentation is required by customer type and jurisdiction. The information collected to determine a customer’s source of wealth will differ depending on whether the wealth is acquired through ownership of a business, employment or professional practice, inheritance, and investments. Source of wealth can be either Reasonable or Unreasonable. Site visits are an important part of the EDD process for MSBs, and other customer types, to confirm the veracity of the information provided by the customer. PEPs may be identified through the checks against local or regional lists, which are conducted at the time the customer’s account is opened. When it has been determined that a customer is or has a PEP associated with it, additional KYC must be performed on the PEP. Unique mitigants are based on the situation and circumstances specific to each customer and may consist of one or more controls. AML records must be maintained for a minimum of five years.

Lesson 7: Ongoing Reviews • • Periodic Reviews Event Driven Reviews Examples of Trigger Events Suspicious Activity Transaction Monitoring Sanctions screening Sanctions Licenses Board and Senior Management Reporting Pages 138 of Participant Guide

Periodic Reviews High-risk Customer Every year; the first review should be scheduled after six months from the date in which the entity’s status in the KYC Platform reflects “complete. ” Medium-risk Customer Every two years Low-risk Customer Every three years Pages 139 of Participant Guide

Event Driven Reviews An event is any activity that could negatively impact the overall AML and/or Sanctions risks associated with the customer. The Business Unit identifies an event through: Manual monitoring 1 Information provided by the customer or from other sources 2 Pages 145 of Participant Guide

Examples of Trigger Events For customers who were Low or Medium-risk and have become High-risk The First Line of Defense conducts EDD and obtains the required signoffs from AML Compliance, Money Laundering Reporting Officer (MLRO) (where applicable), and the Business Unit Chief Operating Officer, equivalent and/or delegate. For customers who were High-risk and have become Low or Medium-risk The First Line of Defense conducts CDD. Moving to a lower risk rating requires signoffs from AML Compliance MLRO (where applicable), and the Business Unit Chief Operating Officer, equivalent and/or delegate. For customers who were Low-risk and are now considered Medium-risk, and for customers who were Medium-risk and are now considered Low-risk The First Line of Defense obtains approval from the Business Unit Chief Operating Officer, equivalent and/or delegate. Pages 146 of Participant Guide

Suspicious Activity Suspicious activities are defined in several ways and can involve funds derived from illegal activities: Designed to evade AML regulatory requirements Intended or conducted to hide or disguise funds or assets derived from illegal activities These activities may include: Incoming/outgoing wires Journals of funds and securities Deposits, withdrawals, and/or asset movements Pages 147 and 148 of Participant Guide

Transaction Monitoring Automated Monitoring The AML Compliance Financial Intelligence Unit (FIU) uses a Windows® based desktop application to monitor customer account activity for the purpose of determining whether abnormal transaction patterns are present. Manual Monitoring The Business Unit identifies suspicious behaviors by conducting manual monitoring of customer and account related activity. Pages 149 and 150 of Participant Guide

Employee Identification and Escalation of Suspicious Customer Behavior Accelerating periodic or event-driven reviews Limiting account activity of customers who have been investigated Increasing monitoring on further account activity Suspending payments Closing an account(s)/terminating the customer relationship Pages 151 and 152 of Participant Guide

Sanctions Screening Ongoing Sanctions screening is automated and performed by OFAC/Sanctions Central Monitoring, and is mainly focused on existing customer screening and third party screening. Matches Sanctions Clearing Escalation Process Exception Reports Pages 153 to 158 of Participant Guide

Sanctions Licenses General Licenses Specific Licenses Authorizes a particular type of transaction for a class of persons without the need to apply for a license. A written document issued by the governmental authority to a particular person or entity, authorizing a particular transaction in response to a written license application. Pages 159 and 160 of Participant Guide

Board and Senior Management Reporting AML and Sanctions reporting to the board supports State Street’s AML and Sanctions Compliance Program that: Outlines the governance structure, policies, procedures, and standards of State Street. Ensures compliance with all relevant laws, codes, rules, regulations, and standards of good business practice Pages 159 and 160 of Participant Guide

Summary • • In accordance with State Street’s Global AML Policy, AML KYC Co. E (Shared Services) conducts risk-based periodic reviews on all customers to ensure the KYC information is accurate and revises the customer’s risk rating, if appropriate. An event driven review may be warranted before the next scheduled periodic review. During the course of business, all State Street employees must be vigilant in the fight against money laundering and terrorist financing. AML Compliance FIU monitors account activity for unusual size, volume, pattern, or type of transactions, taking into account risk factors and red flags that are appropriate to each Business Unit. Ongoing Sanctions screening is automated and performed by OFAC/Sanctions Central Monitoring. The First Line of Defense is responsible for gathering relevant AML and Sanctions data for senior management and board reporting. AML Compliance maintains a list of Key Risk Indicators (KRIs) and Key Performance Indicators (KPIs), which it collects from the First Line of Defense.