gleifpdf/22

@, Protecting digtal st Service Level Agreement (SLA)

Table of Contents 1 Service Level Agreement GlOSSary.....ccccceeecerreirieenierenecrrencreencsranseeennsees 3 2 GLEIF Services - Service Descriptions ......cccccceveieeeceenereeencrenreecseecenscencennees 7 D R O 10 I Yool o =T [ =1 o] o PP RUPRURTRRY 2.2 LOU Annual Accreditation Verification .......ccccccceeeeeiiiiiiiieiieeieeeeee e 9 2.3 Upload LEI & LE-RD Fil€S .....uuuivieeieciiiieeeeccciiieeeeeeeciteeeeeeecvvneeeeesesnnneeeeeeesnneneeeees 11 2.4 Check fOr DUPIICAtES ...ueiiiiririeiieeiesiiee et stee e e e srareeee s sasbeeesesssasnnneeeses 12 2.5 Trigger LEl management transfer......ccccovviiviiiieiiiiiiecie s seivieee s esiiieeeee e 13 2.6 LOU Communications Portal........cccccoiievieeeiieiie e cccvinvieeeeeeee e e e e e e e e ennns 14 D A o o [ I T 4 PRPUPUURPPRURRR: o 2.8 Data Governance Pre-Check ......cccciuiiueieeeeeeiieeie e cccccciievieeieeeeeeeeeeeeeeeenseennnens 17 3 The LOU Services — Service Descriptions.....ccccccceeeeecerencrencernecrennrenneeenee. 18 3.1 1SSUE NEW LED .ot sse v s s eevnsnsnssesnennnes 20 3.2 Maintain Legal Entity EVENTS.....cciiiiiiiiiiiiiiciiiece e snnne e ssnnneeee s 24 3.3 Challenge LEI Data........cuiieviiiiiieeee ettt sire e ee s ssanveeee s s savsnaeeessinnaeeeees 27 3.4 Transfer of LEISANd LE-RD .......ccoooeoieceteeieeeeee e esevnnnrneeneeeeeneeeeeeeeees 29 3.5 ReNEWAIS OF LEIS....uuiuiiiiieiieieeie ettt ee e ecvrrnesneseseeeeeeeeeeeeees 31 4 Monitoring and Service Level Breaches.......c.cccceeereeniirreeccreeiceenncereenen. 35 4.1 Service Level calculation and monitoring.........ccccceevevviieeeeiiisiiie e esiiieee e essiieens 35 4.2 Maintenance windows at GLEIF...........c.cccooiiiiiiiiiiie e eeccccccrrerreeeeee e ee el 38 4.3 Service LeVel BreaChEs .....uuuuiiiiieiie ettt ee e e e e et raesaeeeeeeeeeeeees 38 4.4 Escalation Management.....ccccciriiieiiiniiiie e eriieee s esiiieeee s siinsee e e s snaneeeesnnnnneees 39 45 Termination. ..o e e srri s seseaai s s s saesennesssessennnneees B0 /N I S or-1F- [ o] o I O] o - [ o1 £SO PPSPRRRRRY” 10 5 Incident Management.........cccoireeiieniiinniieeiiineiiinnieninnecsennesesesnesssseeee 41 5.1 MajJor INCIAENT...ciiiiiiiiiieee ettt srre e s sssrareeee s s sansneesessnnneneeeees D2 6 complaints............................................................................................43 7 GLEIF Code of Conduct in case of a disaster.......cccceeeerrrunncirrrrnnnicrrennnenn. . 44 8 SLA Reports.........................................................................

..................46 9 Change of Service Levels .......cceeeucirreeiiieeiiienciienineencnrenesenncesnnsenennneensd 7 Service Level Agreement (SLA) Page 2 of 47 @ Public Version 2.1 2022-03-31_MA-Appendix-06-SLA_v2.1.docx 2022-03-31

2.3 Upload LEI & LE-RD Files Name Upload LEI & LE-RD Files Tag Line Interface for local operating units to upload LEI & LE-RD. Description Via an interface the LOUs are required to upload the LElI & LE-RD files to the Global LEI Repository daily. Data is represented in the Common Data File Formats. Details will be clarified in Implementation Notes. The interface provides quality gates for testing of the data. Files or records not passing the quality tests will be rejected. Essential Tasks o Provide upload interface ¢ Contact the LOU in case of rejections o Provide and process quality checks o Incorporate the LEl and LE-RD, uploaded by the LOU, after passing the quality tests, into the Global LEI Repository o Ensure that the LEl and LE-RD uploaded by the LOU and incorporated into the GLEIF Concatenated File is a true and authentic copy of the LEl as issued and of the LE-RD as provided by the LOU ! Access Group(s) Accredited local operating units The LOU Tasks o Send data in Common Data File Format Availability 99,9 % (Monday — Sunday 00:00 — 24:00) Processing Time Within 1 hour upon arrival Workload Limit 30 concurrent (i.e. within 1 minute) file uploads with an average file size up to 20 megabytes (zipped) Exception In case the Continuity process is invoked (ref. chapter 7) 1 The LOU takes note, understands and accepts that incorporation of the LEl and LE-RD as issued and provided respectively by the LOU into the Global LEI Repository, and publishing those, entails no responsibility or liability whatsoever of GLEIF for the LEl and the LE-RD as such, i.e. regarding their validity, completeness, accurateness, uniqueness and authenticity. Service Level Agreement (SLA) Page 11 of 47 @ Public Version 2.1 2022-03-31_MA-Appendix-06-SLA_v2.1.docx 2022-03-31

2.4 Check for Duplicates Name Check for Duplicates Tag Line Technical interface to allow GLEIF and the LOU to check for duplicate LEl and LE-RD data prior to finally issuing a New LEL. Description In order to support the local operating units, GLEIF provides the appropriate and mandatory processes and a technical interface for local operating units to check the LEl and LE-RD data for duplicate entries. The LOU follows the required steps prior to assigning a valid LEI code to a Legal Entity. Details will be clarified in an Implementation Note. Essential Tasks o Provide technical interface to check for Duplicates ¢ Automatically inform about check result Access Group(s) Accredited local operating units The LOU Tasks o Perform check for Duplicates o Evaluate check result Availability 99,9 % (Monday — Sunday 00:00 — 24:00) Processing Time <1 minute Workload Limit 500 requests in total within the same minute Exception In case the Continuity process is invoked (ref. chapter 7) Service Level Agreement (SLA) Page 12 of 47 @ Public Version 2.1 2022-03-31_MA-Appendix-06-SLA_v2.1.docx 2022-03-31

2.5 Trigger LEl management transfer

Name Trigger LEI management transfer

Tag Line Trigger the porting of all LEI & LE-RD from one local operating unit to another local operating unit or GLEIF in certain cases.

Description GLEIF triggers a transfer of the management authority for one or more LEls from the LOU when the LOU is either unable or unauthorized to provide service, or at the expiry of the Master Agreement. Details will be clarified in an Implementation Note.

In the case that a Legal Entity triggers the transfer of its own LEls, GLEIF and this service are not involved.

Essential Tasks o Trigger LEl management transfer * Monitor open transfer instances

Access Group(s) Accredited local operating units

The LOU Tasks o Cooperate in transfer management

Completeness No LEls are left without any operating managing LOU for more than 48 hours during GLEIF business days.

In case of force majeure, GLEIF shall trigger this process within 48 hours during GLEIF business days, given the impacted LOU stops LEI file daily upload and does not provide business as usual confirmation.

Workload Limit 4 concurrent LOUs

Exception In case the Continuity process is invoked (ref. chapter 7)

Service Level Agreement (SLA) Page 13 of 47 @ Public Version 2.1 2022-03-31_MA-Appendix-06-SLA_v2.1.docx 2022-03-31

2.6 LOU Communications Portal

Name LOU Communications Portal

Tag Line A central web-based communication portal for all communications between GLEIF and LOU.

Description This service provides a central location for accessing LOU-Only information where LOUs can share information and experience among themselves regarding LEI Services. It also provides the master source for all the information related to the LOUs.

The functionalities provided within this service are a shared calendar for all LOUs, a repository of information, a common platform to raise questions / request feedback, and a web interface for Service Level Agreement (SLA) reporting. Essential Tasks Register an account for the Communication Portal: e Provide registration to Portal o Verify registration authority * Manage registration information * Provide possibility to change password / get new password ¢ Send access information o Verify email addresses o Archive registration information until deregistration Provide Calendar & Events: o Collect internal GLEIF, local operating unit and GLEIS events o Edit and update the calendar * Provide and maintain local operating unit calendar & events * Manage subscriptions to provide local operating unit calendar updates ¢ Provide numbered messages ¢ Provide a platform for LOUs to communicate among themselves ¢ Provide a means for receipt of feedback and discussion on different topics Provide a repository for LOU related information, in order to: ¢ Share documentations related to LOU Accreditation and LOU Annual Accreditation Verification between an LOU (applicant, candidate or accredited) and GLEIF o Collect LOUs information in the portal o Share GLEIF contact information with LOUs ¢ Exchange certain information among LOUs Service Level Agreement (SLA) Page 14 of 47 GLEIF Public Version 2.1 @ 2022-03-31_MA-Appendix-06-SLA_v2.1.docx 2022-03-31

For the accredited LOUs additional functionalities are available such as: o Access to electronic Invoices (see Appendix 07, Payments) o Access to SLA reports o SLA web interface to incorporate defined service level data Access Group(s) o Accredited local operating units o Candidate local operating units The LOU Tasks o Enter valid registration information o Periodically review list of Authenticated users for the LOU and confirm the Authenticated users' access and access roles o Deliver upcoming events to GLEIF o Subscribe to local operating unit calendar updates o Unsubscribe in case local operating unit calendar updates are not needed anymore o Subscribe to numbered messages o Unsubscribe to numbered messages o Collate LOU service level data and submit it for SLA Report. ¢ Review uploaded SLA report and provide feedback if applicable o Check electronic LOU invoices provided Availability 97,7 % (Monday — Sunday 00:00 — 24:00) Processing Time o To register an account within one GLEIF business day Workload Limit 20 queries per GLEIF business day Exception In case the Continuity process is invoked (ref. chapter 7) Service Level Agreement (SLA) Page 15 of 47 @ Public Version 2.1 2022-03-31_MA-Appendix-06-SLA_v2.1.docx 2022-03-31

2.7 Code Lists Name Code Lists Tag Line Maintain code lists referenced in Common Data File Formats Description This service provides a standard process for identifying and incorporating updates to code lists in the Common Data File (CDF) formats. Examples of code lists include the Registration Authority list referenced for the Registration Authority and Validation Authority fields of LEI CDF file format and the Entity Legal Form code list (ISO Standard 20275) referenced for the Legal Form field of LEI CDF file format. It also includes the Corroboration Compliance List code list, that provides information about the minimum expected corroboration level of an LEl corresponding to the declared ELF code as a legal form. Breach is defined, when an LEI declares a lower corroboration level than expected. Essential Tasks GLEIF o Collect feedback from stakeholders on code lists (if applicable) o Decide if the change is appropriate (if applicable) © Assess data quality program to ensure changes to code lists are incorporated o Update GLEIF databases for correct representation of current and past code lists * Update website and other GLEIF communications with changes in code lists o Provide code lists in on-line master datasource Access Group(s) Accredited local operating units and Public The LOU Tasks o Appropriate use of the code lists in the relevant CDF fields (e.g. including reserved codes ‘8888’ and ‘RA888888’, to be used only after a request for addition has been sent to GLEIF) o Propose updates to the code lists Availability GLEIF Website 99,9 % (Monday — Sunday 00:00 — 24:00) Workload Limit 100 concurrent (i.e. within 1 minute) codelist downloads with an average file size up to 1 megabyte Exception In case the Continuity process is invoked (ref. chapter 7) Service Level Agreement (SLA) Page 16 of 47 @ Public Version 2.1 2022-03-31_MA-Appendix-06-SLA_v2.1.docx 2022-03-31

2.8 Data Governance Pre-Check

Name Data Governance Pre-Check

Tag Line A facility to allow the LEl issuers to perform data quality checks on LEI Record Sets prior to publication of newly issued or updated LEls into the Global LEI System.

Description In order to improve the overall data quality in the Global LEI System, GLEIF provides the LEl issuers a facility to evaluate the data quality on LEI Record Sets prior to publication into the Global LEI Repository.

The facility provides the result of the assessment and delivers the exact reason for the failures. This enables the LEl issuers to remediate potential issues in a timely and efficient manner.

In scope are new and to be updated LEI Record Sets. The LEl issuers can use the facility unlimited times for the same LEI Record Set. Both an API and a user-friendly graphical user interface (GUI), which enables the manual usage of the Pre-Check facility, are provided.

Essential Tasks o Provide API to Data Governance Pre-Check ¢ Provide user-friendly GUI for easy usage of the Data Governance

Pre-Check * Automatically inform about check results and failure reasons

Access Group(s) e APl and GUI in production: accredited LOUs o Test APl and GUI: accredited and candidate LOUs

The LOU Tasks ¢ Send new or changed LEI Record Set to the facility prior to

publication ¢ Remediate check failures

Availability API: 99,9 % (Monday — Sunday 00:00 — 24:00) GUI: 97,7 % (Monday — Sunday 00:00 — 24:00)

Processing Time < 3 seconds per request

Workload Limit 1000 requests in total within the same minute

Exception In case the Continuity process is invoked (ref. chapter 7)

Service Level Agreement (SLA) Page 17 of 47 @ Public Version 2.1 2022-03-31_MA-Appendix-06-SLA_v2.1.docx 2022-03-31

3 The LOU Services — Service Descriptions The services of the LOU set out in this Service Level Agreement are all related to the issuance of New LEls and maintenance of LEls and related LE-RD, and transmission of all LEI and LE-RD to GLEIF. The credibility and trust of the public in the GLEIS is deeply anchored to the credibility and trust in the LEls and LE-RD and the transmission of this information to GLEIF. As agreed in Section 22 of the Master Agreement, LEls and related LE-RD must be correct, complete, accurate, unique and true LEls and LE-RD not only when they are issued, but throughout the life of the LEI (e.g. in the course of updating Legal Entity Events and managing challenges, transfers, and renewals). The LEI and the related LE-RD collected about, or collected from, the Legal Entity, or created by the LOU in the course of issuance, transfer, and maintenance of the LEIl, must be uploaded to GLEIF accurately and reliably, and by performing the LOU Services set out in this chapter. To ensure compliance with its Core Duties, the LOU shall provide means and processes for improving operational quality and performance. The LOU is responsible that the third party has such processes as well. The following table shows the service levels that are applicable for all LOU services. Data Governance 100% of all new and updated LEI Record Sets shall be evaluated via Pre-Check Completeness Data Governance Pre-Check. The assessment must be performed in no more than 4 calendar days (i.e. in no more than 96 hours) before the upload to GLEIF. Data Quality Failure Age Failed Data Quality Checks must be remediated within 60 calendar days Jurisdiction Compliance There shall be no LEls in status ISSUED outside accredited jurisdictions LOU Annual Accreditation LOUs must complete any required remediation action based upon Verification - Remediation | the LOU Annual Accreditation Verification follow up schedule, as of Findings listed in the LOU Annual Accreditation Verification report. Number of New Duplicates =0 Required Quality Rate = 100% each calendar day — up to 7 calendar days granted per calendar month Expected Quality Rate > 99% each calendar day — up to 7 calendar days granted per calendar month Service Level Agreement (SLA) Page 18 of 47 @ Public Version 2.1 2022-03-31_MA-Appendix-06-SLA_v2.1.docx 2022-03-31

Excellent Quality Rate > 98% each calendar day — up to 7 calendar days granted per calendar month Upload Failure Rate =0% The LOU performs the following services to comply with its Core Duties. Service Level Agreement (SLA) Page 19 of 47 @ Public Version 2.1 2022-03-31_MA-Appendix-06-SLA_v2.1.docx 2022-03-31

3.1 Issue New LEI e Description The LOU provides the means for a Legal Entity to request an LEI. R Essential Tasks o Verify the Legal Entity is from a Country the LOU has been accredited for (jurisdiction check). o Provide and execute a contract with the Legal Entity applying for and holding the LEI. This contract must comply with the requirements of Appendix 05. ¢ Publish to its website information helping a Legal Entity apply for an LEI (see Website Requirements in the Accreditation Checklist referenced in the Accreditation Manual, Appendix 02). ¢ Provide an interface or mechanism for the Legal Entity to apply for an LEI e Maintain procedures for verifying via an authoritative source the accuracy of the LE-RD supplied by the Legal Entity e Maintain procedures for verifying the existence and eligibility of the entity applying for the LEI o Verify the individual signing the application and any pertaining documents is duly empowered to submit such application in the name and on behalf of the Legal Entity o Ensure an up-to-date list of authoritative sources used for Verification is maintained, accessible and usable at all times with no restrictions o Verify the existence of the entity applying for the LEI o Validate the LE-RD o Verify via the applicable authoritative source, as submitted in the Accreditation Documentation (Appendix 04), the accuracy of the LE-RD supplied in the LEl request; Transliterate in roman characters (as applicable) o Perform automated data checks or data edits of specific fields per the Common Data File Formats ¢ Inform the Legal Entity about any missing or wrong entries o Check for Duplicates o Make use of Service 2.4, and if Duplicate is reported o Contact another local operating unit o Contact the applicant for the LEl or Legal Entity Service Level Agreement (SLA) Page 20 of 47 GLEIF Public Version 2.1 @ 2022-03-31_MA-Appendix-06-SLA_v2.1.docx 2022-03-31

1 Service Level Agreement Glossary Note: All definitions of terms in the Master Agreement are valid also for the Service Level Agreement and prevail

Access Groups Allowed customers of the service.

Application Programming | The Application Programming Interface (API) is a computing interface

Interface (API) which defines interactions among software intermediaries.

Attended Service Time of reachability of GLEIF support on business days.

Operating Time

Authenticated Local operating units that have subscribed to the restricted GLEIF section on gleif.org and have a login name and a password.

Availability Ability of a service to perform its agreed function when required.

Calendar days Calendar days means every day on the calendar, including weekends and public holidays.

Complaint A written, formal expression of dissatisfaction from LOU’s Relations Manager/authorized signatory related to GLEIF services and relevant requirements.

Customer Portal Portal for LOUs to perform defined processes.

Data Quality Campaign Complete, planned course of actions formulated to achieve defined data quality objectives.

Data Quality Checks The definition of (series of) rules, usually in a form of if-then-else conditions, that a data record must fulfill in order to achieve certain data quality criteria and maturity levels.

Data Quality Failure A pair of a LEI Record Set and a Data Quality Check, where the LEI Record Set does not fulfill the described rules.

Data Quality Rule Setting | A set of defined Data Quality Checks to establish a transparent and objective benchmark to assess the level of data quality within the Global LEI System. Please refer to the GLEIF website for the current version of the Rule Setting.

Description Detailed description that also identifies the service interface and its outcomes.

Disaster Extraordinary situation where widespread human, material, economic

Service Level Agreement (SLA) Page 3 of 47 @ Public Version 2.1 2022-03-31_MA-Appendix-06-SLA_v2.1.docx 2022-03-31

e Contact GLEIF o Issue the LElI in compliance with ISO 17442 along with the pertaining LE-RD, and in accordance with the current Data Quiality Rule Setting. o Process or receive payment for the New LEI ¢ Inform the LEl applicant of the application result o Upload to GLEIF the New LEl and all LE-RD collected from the Legal Entity or created by the LOU before bulk transmission or publication to another third party, where however transmission to the Legal Entity and normal publication to the LOU website (as agreed in in the Accreditation Documentation Appendix 04) are permitted o Accept and without undue delay process applications for an LEI ¢ The related facility shall be kept available to the public at least 99.9% of the time each month Examples of Third Party Registration o Publish to its website information helping a Assistance Agent Legal Entity apply for an LEI with the LOU o Collect and transmit to the LOU the information required to verify the existence of the entity applying for the LEI o Contact the applicant for the LEIl or the Legal Entity requesting it explain why there is a Duplicate (if applicable) o Process or receive secure payment for the New LEI ¢ Inform the Legal Entity of application status Validation * Provide and execute a contract with the Legal Agent Entity applying for and holding the LEI. This contract must comply with the requirements of Appendix 05 (e.g. by referencing the LOU’s terms & conditions for the issuance of LEls). ¢ Maintain procedures for verifying via an authoritative source the accuracy of the LE-RD supplied by the Legal Entity o Ensure an up-to-date list of authoritative sources used for Verification is maintained, accessible and usable at all times with no restrictions ¢ Maintain procedures for verifying the existence and eligibility of the entity applying for the LEI o Maintain procedures for verifying the individual Service Level Agreement (SLA) Page 21 of 47 @ Public Version 2.1 G 2022-03-31_MA-Appendix-06-SLA_v2.1.docx 2022-03-31

signing the LEI application is duly empowered todo so o Verify the individual signing the application and any pertaining documents is duly empowered to submit such application in the name and on behalf of the Legal Entity « Verify the existence of the entity applying for the LEI ¢ Validate the LE-RD o Verify via an applicable authoritative source, the accuracy of the LE-RD supplied in the LEI request ¢ Inform the Legal Entity about any missing or wrong entries o Inform the Legal Entity on the application result Others ¢ Provide an interface or mechanism for the Legal Entity to apply including automated data checks or data edits in the collection of Legal Entity application information * Provide data collection or aggregation services from the authoritative sources agreed upon with the LOU o Transliterate in roman characters (as applicable) o Make use of Service 2.4, and if Duplicate is reported o Contact another local operating unit o Contact the applicant for the LEI, Validation Agent or Legal Entity o Contact GLEIF ¢ Upload the New LEIl and associated LE-RD to GLEIF Essential Tasks excluded o Editorial access to all LEls and LE-RD with the LOU prefix at all from Third Party Services times ¢ Maintain a procedure for monitoring and updating a list of reliable sources to validate LE-RD, as submitted in the Accreditation Documentation (Appendix 04), and approved by GLEIF Service Level Agreement (SLA) Page 22 of 47 GLEIF Public Version 2.1 @ 2022-03-31_MA-Appendix-06-SLA_v2.1.docx 2022-03-31

Completeness Duplicates - Levell before being uploaded to GLEIF Service Level Agreement (SLA) Page 23 of 47 @ Public Version 2.1 2022-03-31_MA-Appendix-06-SLA_v2.1.docx 2022-03-31

3.2 Maintain Legal Entity Events

Name Maintain Legal Entity Events

Tag Line The LOU maintains the LEI data for Legal Entity Events reported by

the Legal Entity.

Description The LOU provides an interface or a mechanism for Legal Entities to

update their LE-RD managed by the LOU. The LOU verifies all Legal Entity Events updates requested by the Legal Entity via an authoritative source. For those changes verified by the LOU, the LOU ensures the changes are promptly incorporated into the LE- RD. The LOU uploads the updated LEI record to GLEIF by using Service 2.3.

Essential Tasks o Provide an interface or mechanism for the Legal Entity to update LE-RD including means for automated data checks or data edits

e Maintain procedures for verifying the individual requesting the change is duly empowered to do so

o Verify the individual requesting the change is duly empowered to do so on behalf of the Legal Entity

e Maintain procedures for verifying via an authoritative source the accuracy of the reported Legal Entity Events

o Ensure an up-to-date list of authoritative sources used for Verification is maintained, accessible and usable at all times with no restrictions

• Validate the LE-RD

o VERIFY via the applicable authoritative source, as submitted in the Accreditation Documentation (Appendix 04), the accuracy of the Legal Entity Events change; Transliterate in roman characters (as applicable)

¢ Inform the Legal Entity of the updated LE-RD

o Upload to GLEIF, using Service 2.3, the updated LE-RD collected from the Legal Entity or created by the LOU before bulk transmission or publication to another third party excluding the Legal Entity and normal publication to the LOU website as informed in in the Accreditation Documentation (Appendix 04)

o Accept and without undue delay initiate the process to implement updates provided by a Legal Entity regarding its LEI managed by the LOU

¢ The related facility shall be kept available to the public at least

Service Level Agreement (SLA) Page 24 of 47 @ Public Version 2.1 2022-03-31_MA-Appendix-06-SLA_v2.1.docx 2022-03-31

99.9% of the time each month Examples of Third Party Registration Agent * None Assistance Validation Agent ¢ Provide an opportunity for the Legal Entity to update LE-RD

e Maintain procedures for verifying the individual requesting the change is duly empowered to do so

o Verify the individual requesting the change is duly empowered to do so on behalf of the Legal Entity

e Maintain procedures for verifying via an authoritative source the accuracy of the reported Legal Entity Events

• Validate the LE-RD

o Verify via the applicable authoritative source the accuracy of the Legal Entity Events change

¢ Inform the Legal Entity of the updated LE-RD

o Accept and without undue delay initiate the process to implement updates provided by a Legal Entity regarding its LEI

¢ Inform the Legal Entity of updated LE-RD

Others o Transliterate in roman characters (as applicable)

• Provide data collection or aggregation services from the authoritative sources agreed upon with the LOU

o Upload the changed LE-RD to GLEIF

Essential Tasks excluded o Editorial access to all LEls and LE-RD with the LOU prefix at all from Third Party Services times e Maintain a procedure for monitoring and updating a list of reliable sources to validate LE-RD, as submitted in the Accreditation Documentation (Appendix 04), and approved by GLEIF ¢ Ensure an up-to-date list of authoritative sources used for Service Level Agreement (SLA) Page 25 of 47 @ Public Version 2.1 2022-03-31_MA-Appendix-06-SLA_v2.1.docx 2022-03-31

Verification is maintained, accessible and usable at all times with no restrictions Access Group(s) Legal Entities via the LOU Terms & Conditions Service Level Agreement (SLA) Page 26 of 47 @ Public Version 2.1 2022-03-31_MA-Appendix-06-SLA_v2.1.docx 2022-03-31

3.3 Challenge LEI Data

Name Challenge LEI Data

Tag Line Challenge the data of any LEI and legal entity reference data (LE- RD) of the Global LEI repository on the GLEIF website.

Description GLEIF provides a mechanism for any third party to challenge the data of any LEl and LE-RD of the Global LEI repository. A data challenge that is submitted for a specific LEI (or LE-RD) will be forwarded to the corresponding managing LEl issuer. The actual resolution of data challenges is a service provided by the LEl issuer. Different challenges can be submitted, which the challenging user must specify alongside evidence and an optional comment. The available types are:

• Legal Entity business card details
• Legal Entity relationship details
• LEl code Essential Tasks o Review and respond to LEI or LE-RD challenges transmitted by GLEIF

¢ Research the content of the challenge and verify the challenge via the applicable authoritative source, as submitted in the Accreditation Documentation (Appendix 04); Transliterate in roman characters (as applicable)

o Ensure an up-to-date list of authoritative sources used for Verification is maintained, accessible and usable at all times with no restrictions

¢ Inform the Legal Entity of verified challenges and of challenges which have failed Verification

¢ Upload to GLEIF the updated LE-RD collected from the Legal Entity or created by the LOU (if applicable) before bulk transmission or publication to another third party excluding the Legal Entity and normal publication to the LOU website as informed in in the Accreditation Documentation (Appendix 04) or inform GLEIF that no change is to be made

Examples of Third Party Registration * None

Assistance Agent

Service Level Agreement (SLA) Page 27 of 47 @ Public Version 2.1 2022-03-31_MA-Appendix-06-SLA_v2.1.docx 2022-03-31

Validation Agent | Inform the Legal Entity of verified challenges and of challenges which have failed Verification Research the content of the challenge and verify the challenge via an authoritative data source (if applicable) ¢ Ensure an up-to-date list of authoritative sources used for Verification is maintained, accessible and usable at all times with no restrictions Others * Provide data collection or aggregation services from the agreed upon authoritative sources ¢ Upload the adjusted LEI record to GLEIF (if applicable) o Transliterate in roman characters (as applicable) Essential Tasks excluded o Editorial access to all LEls and LE-RD with the LOU prefix at all from Third Party Services times o Review and respond to GLEIF relative to LEI or LE-RD challenges e Maintain a procedure for monitoring and updating a list of reliable sources to validate LE-RD, as submitted in the Accreditation Documentation (Appendix 04), and approved by GLEIF Access Group(s) o GLEIF Processing Time 15 calendar days Service Level Agreement (SLA) Page 28 of 47 @ Public Version 2.1 2022-03-31_MA-Appendix-06-SLA_v2.1.docx 2022-03-31

3.4 Transfer of LEls and LE-RD

Name Transfer of LEIs and LE-RD

Tag Line The LOU participates in and enables transfers of LEls and LE-RD from or to another local operating unit.

Description The LOU on behalf of a Legal Entity can notify another local operating unit of a request to transfer LEl management. Both local operating units follow the required steps to complete the transfer.

Essential Tasks o Provide and execute a contract with the Legal Entity for holding

the LEI. This contract must comply with the requirements of Appendix 05. e Maintain procedures for verifying the individual requesting the LEI transfer is duly empowered to do so o Verify the individual requesting transfer is duly empowered to do so on behalf of the Legal Entity * Validate the LE-RD o Verify via the applicable authoritative source, as submitted in the Accreditation Documentation (Appendix 04), the accuracy of the LE-RD; Transliterate in roman characters (as applicable) o Ensure an up-to-date list of authoritative sources used for Verification is maintained, accessible and usable at all times with no restrictions o Keep the Legal Entity informed (as applicable) o Upload to GLEIF, using Service 2.3, the LEl and its changed LE- RD collected from the Legal Entity or created by the LOU before bulk transmission or publication to another third party excluding the legal entity and normal publication to the LOU website as informed in in the Accreditation Documentation (Appendix 04) ¢ Participate in and enable transfers of one or several LEI(s) and LE-RD from or to another local operating unit on request of the Legal Entity, a local operating unit on behalf of a Legal Entity, or the GLEIF o The transfer of an LEl and related LE-RD as Sending LOU shall be performed in 4 LOU business days o The transfer the LEIl and related LE-RD as Receiving LOU shall be Service Level Agreement (SLA) Page 29 of 47 @ Public Version 2.1 2022-03-31_MA-Appendix-06-SLA_v2.1.docx 2022-03-31

performed in 3 LOU business days ¢ Once transferred, the LOU shall unpublish the LEIl and related LE-RD within 1 LOU business day from when the transferred LEI is displayed as “ISSUED” on GLEIF search facility Examples of Third Party Registration * None Assistance Agent Validation o Keep the Legal Entity informed Agent .

g ¢ In case of termination of validation agent contract with the LOU or client consent with the Legal Entity, initiate the transfer to the LOU

Others o Verify the individual requesting transfer is duly empowered to do so on behalf of the Legal Entity o Provide data collection or aggregation services from the agreed upon authoritative sources * Validate the LE-RD « Verify via an authoritative source the accuracy of the LE-RD; Transliterate in roman characters (as applicable) ¢ Upload the adjusted LEI record to GLEIF (if applicable) Essential Tasks excluded o Editorial access to all LEI and LE-RD with the LOU prefix at all from Third Party Services times e Maintain procedures for verifying the individual requesting the LEI transfer is duly empowered to do so e Maintain a procedure for monitoring and updating a list of reliable sources to validate LE-RD, as submitted in the Accreditation Documentation (Appendix 04), and approved by GLEIF ¢ Ensure an up-to-date list of authoritative sources used for Verification is maintained, accessible and usable at all times with no restrictions Access Group(s) o Legal Entities to LOU which manages their LEI o Validation Agents to the LOU which manages the LEI o Accredited local operating units Service Level Agreement (SLA) Page 30 of 47 @ Public Version 2.1 2022-03-31_MA-Appendix-06-SLA_v2.1.docx 2022-03-31

or environmental losses have occurred which exceeded GLEIF’s ability to respond and recover using its own resources.

Duplicate Either one LEI code exists more than once, or one Legal Entity has more than one LEI.

Duplicate Rate Shows how many Duplicates exist at the end of a month based on the Global LEI Repository.

Essential Tasks Essential Tasks that are required to be performed by the service provider to deliver the agreed service.

Essential tasks excluded Essential tasks that must not be delegated to a Third Party Service

from Third Party Services | provider, unless otherwise agreed in Appendix 13.

Examples of Third Party The LOU may use Third Party Services to assist with its Essential Tasks

Assistance but remains unrestrictedly responsible and liable for the execution of Essential Tasks. Subject to GLEIF’s approval which is set out in Appendix 14.

Excellent Quality Rate The rate of LEI records that fulfill the excellent quality checks = maturity level 3 checks as defined in the Data Quality Rule Setting.

Exception Extraordinary situations, that will not be considered for the calculation of a service level.

Expected Quality Rate The rate of LEI records that fulfill the expected quality checks = maturity level 2 checks as defined in the Data Quality Rule Setting.

GLEIF business day Business day in Frankfurt am Main, Germany (Monday — Friday).

GLEIF Concatenated File File generated daily by GLEIF which aggregates all files from all LOUs. It contains all LEIl issues to legal entities and related LEI reference data.

Graphical User Interface The Graphical User Interface (GUI) is a form of user interface that

(GUI) allows users to interact with applications and electronic devices.

Legal Entity Event An event initiated by a Legal Entity that affects the securities (equity or debt) issued by that Legal Entity, and/or any other event that affects the LE-RD such as mergers, spinoffs, change of incorporation, domicile, etc. It was previously referred to as Corporate Action.

LEl Record Set An XML data record in CDF format describing one Legal Entity, including its related relationship information.

LOU Local Operating Unit, also referred as LEl issuer.

Service Level Agreement (SLA) Page 4 of 47 @ Public Version 2.1 2022-03-31_MA-Appendix-06-SLA_v2.1.docx 2022-03-31

3.5 Renewals of LEls Name Renewals of LEls Tag Line The LOU facilitates, at least annually, the renewal of the LEl and a reconfirmation of its LE-RD by the Legal Entity. Description The LOU provides an interface or a mechanism for the Legal Entity to renew at least annually. The Legal Entity must formally apply for renewal. The LOU ensures notification to the Legal Entity at least 6 weeks prior to the renewal. Given the Legal Entity has not successfully completed the renewal process at the renewal date, the LOU ensures the status of the LEI is adjusted to indicate the LEl is lapsed (as defined in the Common Data File Format) on the next calendar day. The LOU requires the Legal Entity to confirm that any and all data provided in the preceding year are still valid or to supply changed data. Essential Tasks o Ascertain the contract with the Legal Entity holding the LEI. This contract must comply with the requirements of Appendix 05 (e.g. by referencing the LOU’s terms & conditions for the issuance of LEIs). ¢ Notify Legal Entity of upcoming renewal requirements o Provide an interface or mechanism for the Legal Entity to renew e Maintain procedures for verifying the individual requesting the LEl renewal is duly empowered to do so o Verify the individual requesting renewal is duly empowered to do so on behalf of the Legal Entity * Validate the LE-RD o Verify via the applicable authoritative source, as submitted in the Accreditation Documentation (Appendix 04), the accuracy of the LE-RD; Transliterate in roman characters (as applicable) o Ensure an up-to-date list of authoritative sources used for Verification is maintained, accessible and usable at all times with no restrictions e Maintain procedures for verifying via an authoritative source the LE-RD supplied by the Legal Entity Service Level Agreement (SLA) Page 31 of 47 @ Public Version 2.1 2022-03-31_MA-Appendix-06-SLA_v2.1.docx 2022-03-31

o Perform automated data checks or data edits of specific fields ¢ Inform the Legal Entity about any missing or wrong entries o Make use of Service 2.4, and if Duplicate is reported o Contact another local operating unit o Contact the Legal Entity o Contact GLEIF o Upload the changed LE-RD to GLEIF e Process or receive payment for the renewal o Adjust the LEI status as applicable to recognize renewal or non- renewal ¢ Inform the Legal Entity of renewal or non-renewal status ¢ Upload to GLEIF the changed LE-RD collected from the Legal Entity or created by the LOU before bulk transmission or publication to another third party excluding the legal entity and normal publication to the LOU website as informed in in the Accreditation Documentation (Appendix 04) ¢ Collect and maintain metrics of data quality demonstrating the LOU notifies the Legal Entity of pending renewal requirements and accepts and without undue delay processes the renewal ¢ The related facility shall be kept available to the public at least 99.9% of the time each month Examples of Third Party Registration » None Assistance Agent Validation ¢ Notify the Legal Entity of upcoming renewal Agent requirements o Ascertain the contract with the Legal Entity holding the LEI. This contract must comply with the requirements of Appendix 05 (if applicable). o Provide a procedure to renew the LEI for the Legal Entity o Verify the individual requesting renewal is duly empowered to do so on behalf of the Legal Entity Service Level Agreement (SLA) Page 32 of 47 @ Public Version 2.1 2022-03-31_MA-Appendix-06-SLA_v2.1.docx 2022-03-31

» Validate the LE-RD o Verify via the applicable authoritative source the accuracy of the LE-RD e Maintain procedures for verifying the individual requesting the LEI renewal is duly empowered to do so e Maintain procedures for verifying via an authoritative source the LE-RD ¢ Inform the Legal Entity about any missing or wrong entries ¢ Inform the Legal Entity of renewal or non- renewal status ¢ Ensure an up-to-date list of authoritative sources used for Verification is maintained, accessible and usable at all times with no restrictions Others ¢ Provide an interface or mechanism for the Legal Entity to renew including automated data checks or data edits in the collection of updated Legal Entity information * Provide data collection or aggregation services from authoritative sources ¢ Transliterate in roman characters (as applicable) o Make use of Service 2.4, and if Duplicate is reported o Contact another local operating unit o Contact the applicant for the LEI, Validation Agent or Legal Entity o Contact GLEIF o Upload the changed LE-RD to GLEIF o Process or receive payment for the renewal o Upload the changed LE-RD to GLEIF o Collect and maintain metrics of data quality demonstrating the LOU notifies the Legal Service Level Agreement (SLA) Page 33 of 47 @ Public Version 2.1 2022-03-31_MA-Appendix-06-SLA_v2.1.docx 2022-03-31

Entity of pending renewal requirements and accepts and without undue delay processes the renewal Essential Tasks excluded o Editorial access to all LEI and LE-RD with the LOU prefix at all from Third Party Services times o Adjust the LEI status as applicable to recognize renewal or non- renewal Access Group(s) o Legal Entities to the Validation Agent or the LOU which manages their LEI Service Level Agreement (SLA) Page 34 of 47 @ Public Version 2.1 2022-03-31_MA-Appendix-06-SLA_v2.1.docx 2022-03-31

e e e 4 Monitoring and Service Level Breaches The Service Levels ensure the required high quality of the GLEIS. It is therefore essential to closely monitor the achievement of the agreed Service Levels. Dependent on the service, the LOU and GLEIF have to monitor and report the Service Level metrics. 4.1 Service Level calculation and monitoring The following tables show the formulas on how to calculate the service levels committed by GLEIF and LOU services respectively. GLEIF Service Level calculations: Availability Tmonth @ — T non availability® 100 GLEIF Webserver L —— x Tmonth® (1) Minutes in the month (2) Minutes in the month when the service was not available (excluding planned maintenances) The difference is calculated considering calendar days Processing Time for Z(EndResponse(l) _ StartRequest™) GLEIF Data Gg{ernance “Data Governance Pre- ] x100 Pre-Check facility Check” Z(Requests)(3) (1) Time stamp when reply has been provided (2) Time stamp when request has been submitted The difference is calculated considering calendar days (3) Number of requests received in the month Processing Time for o © GLEIF Check for “Check for Duplicates” Z(E”dR“p"”se ~ StartRequest ) x100 Duplicates facility Z (Requests)(3) (1) Time stamp when reply has been provided (2) Time stamp when request has been submitted The difference is calculated considering calendar days (3) Number of requests received in the month Processing Time for “ & Z(EndResponseBD(l) - StartRequestBD(z)) LOU Annual ~« ‘) x100 Accreditation Z(Requests)(3) . . Verification (1) Time stamp when reply has been provided (2) Time stamp when request has been submitted The difference is calculated considering GLEIF business days (3) Number of requests received in the month Frgcessmg 'I"me for Z(EndResponse(l) _ StartRequest®) GLEIF Customer Portal incidents priority 1 ———————"]x100 chosed incidents priority 1 (1) Time stamp when reply has been provided (2) Time stamp when request has been submitted The difference is calculated considering calendar days during GLEIF business days (3) Number of requests received in the month Prgcessmg 'I"me for Z(EndResponseBD(l) _ StartRequestBp™) GLEIF Customer Portal incidents priority 2 — ] x100 chosed incidents priority 2 (1) Time stamp when reply has been provided Service Level Agreement (SLA) Page 35 of 47 GLEIF Public Version 2.1 2022-03-31_MA-Appendix-06-SLA_v2.1.docx 2022-03-31

(2) Time stamp when request has been submitted The difference is calculated considering GLEIF business days (3) Number of requests received in the month Frgcessmg 'I"me for Z(EndResponseBD(l) _ tartkequestsn®) GLEIF Customer Portal incidents priority 3 — ] x100 chosed incidents priority 3 (1) Time stamp when reply has been provided (2) Time stamp when request has been submitted The difference is calculated considering GLEIF business days (3) Number of requests received in the month frocessmg T|'me'for Z(EndResponseBD(l) _ StartRequestBp®™) GLEIF Customer Portal LOU Accreditation — ——————x100 Applicant Z(RequestS)(3) H H " documentation review (1) Time stamp when reply has been provided (2) Time stamp when request has been submitted The difference is calculated considering GLEIF business days (3) Number of closed applicant documentation reviews in the month frocessmg T|'me'for Z(EndResponse(l) _ Startrequest®) GLEIF Customer Portal LOU Accreditation — =—————x100 Candidate Z (Requests)® H H ” documentation review (1) Time stamp when reply has been provided (2) Time stamp when request has been submitted The difference is calculated considering calendar days (3) Number of closed candidate accreditation documentations in the month frocessmg Tlmg fo'r Z(EndResponseBD(l) _ StartRequestBp®) GLEIF Communications LOU Communications ————|x100 Portal Portal” - Register an Z(RequestS)“) account (1) Time stamp when reply has been provided (2) Time stamp when request has been submitted The difference is calculated considering GLEIF business days (3) Number of closed requests in the month Pro'cessmg Time for Z (EndResponse® — StartRequest®) GLEIF Customer Portal ”Trlgger LEI —_— Management Transfer” ZTmnSfers @ (1) Time stamp when the activity ended (2) Time stamp when the activity started The difference is calculated considering GLEIF business days (3) Number of transfers requests received in the month frocessmg Time for Z(EndResponse(l) _ StartRequest™) GLEIF Upload Facility Upload LEI & LE-RD ————"—"—]x100 Files” ZUploads ® (1) Time stamp when reply has been provided (2) Time stamp when request has been submitted The difference is calculated considering calendar days (3) Number of upload requests received in the month Service Level Agreement (SLA) Page 36 of 47 GLEIF Public Version 2.1 2022-03-31_MA-Appendix-06-SLA_v2.1.docx 2022-03-31

LOU Service Level calculations: Check for Duplicates , GLEIF Concatenated File Z (New issued LEIs verifed via Check for Duplicates) Completeness - — —|x100 X Z(New issued LEIs) Data Governance Pre- Z(New or updated prechecked LEIs ) GLEIF Data Gg{ernance Check Completeness =—————"—"—1x100 Pre-Check facility Z(New or updated LEIS)(Z) & (1) Number of LEIs in scope that have an entry with the same fingerprint (") in the Pre-Check logs GLEIF Concatenated File as in the LEl uploaded to GLEIF, and having been uploaded to GLEIF within the requested number of calendar days since the execution of the Pre-Check. (2) Number of LEIs uploaded to GLEIF with a different fingerprint than last date. These are the LEls in scope for the metric. (*) Please refer at the end of this table Data Quality Failure o GLEIF Concatenated File A ZData Quality Failures existing consecutively for more than 60 calendar days ge (1) No LEI should fail the same check consecutively for more than the requested number of calendar days Excellent Quality Rate Z(LEI records fulfilling excellent quality) GLEIF Concatenated File ] x100 Z(LEI Records within the LOU) The rate is calculated daily Service level = Number of calendar days the Quality Rate achieved the target Expected Quality Rate GLEIF Concatenated File Z (LEI record fulfilling expected quality) ] x100 Z(LEI Records within the LOU) The rate is calculated daily Service level = Number of calendar days the Quality Rate achieved the target Jurisdiction Compliance o GLEIF Concatenated File ZLEI(S) outside accredited jurisdictions (1) Only LEIs having Registration Status equal to ISSUED will be taken into account. For each LEI: - If the “General Category” (CDF field Entity.EntityCategory) = FUND and the LEI has been issued or renewed after 01/04/2022, then the LEl jurisdiction (as in CDF field Entity.Legallurisdiction) should be part of the accredited “FUND” jurisdictions. - In case the General Category = BRANCH, the country listed in the legal address (CDF field Entity.LegalAddress.Country) will be compared with the accredited “non FUNDs” jurisdictions. - For all the other LEIs, the LEI Issuer should be accredited for that jurisdiction (reference, list of accredited “non-FUND” jurisdictions). Number of New o GLEIF Concatenated File Duplicates ZDuplicates (1) Number of introduced duplicates in the referring month. Of the LEls involved in a duplication, the breach is ascribed to the newly issued LEI if the duplication occurred within 150 calenda

r days from the upload date of the newer issued LEl and the Check for Duplicates listed possible duplicates for the LEI. LOU Annual GLEIF Customer Portal Accreditation Number of expired finding remediations Verification — Remediation of Findings Service Level Agreement (SLA) Page 37 of 47 GLEIF Public Version 2.1 2022-03-31_MA-Appendix-06-SLA_v2.1.docx 2022-03-31

Processing Time for 3 EndResponsend” startrequesisn®) GLEIF Customer Portal “Challenge LEI Data” —————]x100 Z (Closed challenges)(3) (1) Time stamp when reply has been provided (2) Time stamp when request has been submitted The difference is calculated considering calendar days (3) Number of closed challenges LEls in the month Required Quality Rate . Wt records fulfitling required quaity) GLEIF Concatenated File = |x100 Z(LEI Records within the LOU) The rate is calculated daily Service level = Number of calendar days the Quality Rate achieved the target Upload Failure Rate Z(Dayswithcomplete setoffilessucessfullyuploaded) GLEIF Upload FaCIIIty (CDF format (W) x100 alendar days in the mont compliance) 4 (*) A fingerprint (type of hashsum) is generated for each LEI Record Set. Fingerprints will not take into account the fields LastUpdateDate, InitialRegistrationDate, LegalEntityEventRecordedDate (when applicable) and all extensions. Also, the header information for RecordCount, ContentDate, FileContent, NextVersion and all extensions will be excluded. Lapsing LEls, i.e. records that are updated in only in RegistrationStatus from ISSUED/PUBLISHED to LAPSED, will be excluded from the scope for the Data Governance Pre-check Completeness service level target. 4.2 Maintenance windows at GLEIF GLEIF’s website and Global LEI Repository operate 24/7/365 without regular maintenance windows. In case of exceptional maintenance windows GLEIF will announce them, whenever possible and on a best effort’s basis, two weeks ahead via email and/or via LOU Communications Portal. 4.3 Service Level Breaches In case of Service Level breaches, the timely finding of a sustainable remediation is of predominant importance for GLEIF and the LOU. Based on the results of the monthly SLA Reports, which are created and distributed by GLEIF, when Service Level breaches occur the steps as for “4.2.1 Escalation Management” must be followed. Service Level Agreement (SLA) Page 38 of 47 @ Public Version 2.1 2022-03-31_MA-Appendix-06-SLA_v2.1.docx 2022-03-31

4.4 Escalation Management S == <=~ k»\/ e —

Escalation Level 1

Whenever a breach is detected, an escalation is opened and the GLEIF Business Relations Manager

contacts the relevant Escalation Level 1 counterpart to notify them about the occurred Service Level

breach(es).

The LOU analyses the ascribed Service Level Breach(es) and, if not otherwise granted, within three

LOU business days provides GLEIF with the breach root cause and an effective remediation plan.

The LOU must demonstrate the remediation latest by the second available SLA report after the

escalation notification.

If both, the target SLA report and the following one, show that the remediation was successful, the

Escalation Level 1 is closed.

Escalation Level 2 will be triggered:

¢ In case the LOU has not provided GLEIF with the breach root cause and an effective remediation plan within 3 LOU business days.

o If the Escalation Level 1 has been not remediated as required.

• When a breach, that has been already managed via an Escalation Level 2 or higher, occurs again within the following 2 months after the escalation closure. In this case the escalation is opened directly as level 2, and the LOU must demonstrate the remediation by the next available SLA report after the escalation notification. If the occurred breach cannot be remediated to get a clean report in the same month (e.g. the service level is breached already), remediation is expected for the next month. GLEIF can exceptionally extend the remediation time in its sole but reasonable discretion upon request, and having received a complete and thorough explanation.

Escalation Level 2

Whenever an Escalation Level 2 is triggered, GLEIF’s Escalation Level 2 contact (or deputy) notifies

the Escalation Level 2 counterpart that Escalation Level 2 has been triggered.

In case the Escalation Level 2 is triggered from an exhausted level 1 (i.e. not because of a recurrent

breach), the LOU must demonstrate the remediation by the next available SLA report after the

escalation notification. GLEIF can exceptionally extend the remediation time in its sole but reasonable discretion upon request, and having received a complete and thorough explanation. Service Level Agreement (SLA) Page 39 of 47 @ Public Version 2.1 2022-03-31_MA-Appendix-06-SLA_v2.1.docx 2022-03-31

If both the target SLA report and the following one show that the remediation was successful, Escalation Level 2 is closed. Escalation Level 3 will be triggered in case Escalation Level 2 is not remediated as required. Escalation Level 3 Whenever an Escalation Level 3 is triggered, GLEIF’s Escalation Level 3 contact notifies the Escalation Level 3 counterpart requesting the breach root cause is understood and a final effective remediation plan. The counterpart implements a sustainable remediation and GLEIF’s Escalation Level 3 contact (or deputy) closes the Escalation when both the target SLA report and the following one show that the remediation was successful. If the remediation has not occurred within the expected timeframe and stability, or an effective remediation plan is not submitted, GLEIF may verify the LOU Internal Controls pursuant Master Agreement — chapter XI (on-site audit). GLEIF will make every possible effort to provide at least four weeks’ notice to the LOU. As a result of the on-site audit, GLEIF provides the LOU with a list of findings that must be remediated in the agreed timeframe and, in any case, within no more than 90 calendar days. GLEIF reserves the right to proceed with a further audit in order to verify the effective remediation of the listed findings. In case the LOU failed to remediate the ascribed audit findings by the requested timeframe, or the same breach occurs in the next two reports from the audit conclusion, GLEIF in its sole but reasonable discretion reserves the right to suspend the LOU’s accreditation as a whole or in parts, that might imply the LOU not to be able to issue new LEls in any or all accredited jurisdictions until further notice. It is the LOU’s obligation to provide immediately a notice to their customer on their website on the suspended rights to issue LEls. Also, a further on-site audit or the trigger of section 4.5 “Termination” can be initiated by GLEIF. Whenever an on-site audit is triggered, LOU bears the related costs. 4.5 Termination If the audit findings are not effectively remediated in the requested timeframe, GLEIF may terminate the Agreement pursuant to Chapter Xll. C of the Master Agreement. 4.6 Escalation Contacts The escalation contacts are listed in the relevant section of the LOU Communications Portal. It is expected the Escalation Level 2 contacts to be at managerial level, and the Escalation Level 3 contacts at “C” level or equivalent (e.g. President, General Director). Each escalat

ion contact should mention an assigned deputy. Each LOU has the responsibility to keep their escalation contacts up-to- date. Service Level Agreement (SLA) Page 40 of 47 @ Public Version 2.1 2022-03-31_MA-Appendix-06-SLA_v2.1.docx 2022-03-31

LOU Annual Accreditation | The activities GLEIF undertakes to ensure that remediation actions Verification Remediation | have been taken by the LOU to successfully address the findings of Findings reported in the AAV report. The nature of the remediation and the timeframe depend on the findings and are defined on a case-by-case basis by the GLEIF Accreditation Analyst. LOU business day Business day according to local LOU business calendar. LOU Tasks Activities of the LOU in a GLEIF service to assure service delivery. Name Name of the service, using verbs to indicate actionable items. Maturity Level The Maturity Levels define the evolution of improvements in processes associated with what is measured. Each Data Quality Check is associated to a Maturity Level and the link between Maturity Level and Quality Rate in the SLA is the following: o Level 1, in the SLA is corresponding to ‘Required Quality’ o Level 2, in the SLA is corresponding to ‘Expected Quality’ o Level 3, in the SLA is corresponding to ‘Excellent Quality’ Other Service Providers This is an example of a Third Party Service Provider. Please see Appendix 14. Processing Time Time of all involved parties (if not stated otherwise) to fulfill a service request. Recovery Time Objective | The maximum amount of time allowed to resume an activity, recover (RTO) resources, or provide products and services after a disaster has occurred. Registration Agent This is an example of a Third Party Service provider. Please see Appendix 14. Required Quality Rate The rate of LEI records that fulfill all required quality checks = maturity level 1 checks as defined in the Data Quality Rule Setting. Response Time Defines the maximum time to respond to a service request. Service Continuity The process responsible for recovery of GLEIF vital business functions Process in the event of a disaster. Service Level Commitment based on Service Level requirements. Ensures that the service is able to meet the GLEIS objectives. Service Transfer Point The definition of the system where the service is delivered to measure the accordant Service Level. Tag Line A short description that summarizes the service. Service Level Agreement (SLA) Page 5 of 47 @ Public Version 2.1 2022-03-31_MA-Appendix-06-SLA_v2.1.docx 2022-03-31

5 Incident Management GLEIF has implemented the incident management process based on ISO 20000 standard to be able to restore disrupted services back to normal operations to meet service levels. The disrupted service is required to be back to normal operation as quickly as possible with minimal impact on business operations. In the event that an incident on any GLEIF service occurs, the incidents are processed by GLEIF’s service desk, and specialists are assigned to restore agreed services. When the service is fully recovered, the incident is closed. Incidents are to be reported via an email to servicedesk@gleif.org by LOUs. Incidents are prioritized based on the Impact-Urgency Matrix_depending on the service affected. Processing time is targeted as service level for the following priorities: o Priority 1: 24 hours (during GLEIF business days) o Priority 2: 2 GLEIF business days o Priority 3: 3 GLEIF business days Attended service operating time is Mo-Fr: 09.00 — 17.00 CET GLEIF business days. Impact-Urgency Matrix The Impact-Urgency Matrix shows which services are treated with which Priority. Impact — measures the effect of an incident based on the functionality of the service. Urgency - measures the criticality, which indicates the speed of resolving an incident. Priority - is derived from Impact and Urgency. Urgency 3 - Low 2 — Medium 1-High Supporting Services Enhancing Services Core Services o g Specific functionality = | unavailable 5 5 e ~ 35 | Partial Service £ < | unavailable ® ' £ | Full Service unavailable Service Level Agreement (SLA) Page 41 of 47 @ Public Version 2.1 2022-03-31_MA-Appendix-06-SLA_v2.1.docx 2022-03-31

Urgency classification L LOU Annual Accreditation L LOU Accreditation o Application: Customer Portal Verification Challenge LEI Data Check for Duplicates Code Lists LOU Communications Portal . Trigger LEI Management Upload LEI & LE-RD Files Transfer Data Governance Pre-check Priority Level Definition The following table shows the priority level definition for an incident. A resolution target is set for each Priority. 1 Hich Core Services are inaccessible, interrupted, or 24 hours (during GLEIF i 8 unusable. business days) 2 Medium Enhancing Services are unusable or hard to use. | 2 GLEIF business days 3 Low Support Services are unusable or hard to use. 3 GLEIF business days 5.1 Major Incident A “Major Incident” is a type of incident, that occurs when all or major parts of the core services are affected by disruption. The resolution time in case of a major incident is 1 hour during GLEIF business days. Service Level Agreement (SLA) Page 42 of 47 @ Public Version 2.1 2022-03-31_MA-Appendix-06-SLA_v2.1.docx 2022-03-31

6 Complaints Complaints are handled via the defined process “LOU feedback”. LOUs can submit their complaints via Customer Portal or by communicating with their Business Relations Manager. Service Level Agreement (SLA) Page 43 of 47 @ Public Version 2.1 2022-03-31_MA-Appendix-06-SLA_v2.1.docx 2022-03-31

7 GLEIF Code of Conduct in case of a disaster

In the extraordinary circumstances GLEIF is affected by a disaster:

1. GLEIF informs the LOUs in the shortest possible time via LOU Communication Portal (if available, or by using any other possible means e.g. email or telephone) and invokes the Service Continuity Process

2. Insuch a situation and until full recovery occurred, the following RTOs and targets are effective:

Check for Duplicates <2 GLEIF Availability: 97.5 % business days Processing time < 1 min Code Lists < 1 calendar Availability: 95 % (GLEIF Website) month Data Governance Pre-Check | <2 GLEIF API: business days Availability: 97.5 % Processing time £ 3 sec GUI: Availability: 95 % Processing time £ 1 min LOU Accreditation < 1 calendar Availability: 95 % (GLEIF Website) month Availability: 95 % (Customer Portal) Processing Time to review applicants’ documentation: 60 days Processing Time to review candidates’ documentation: 4 months LOU Annual Accreditation < 1 calendar Availability: 95 % (Customer Portal) verification month Processing Time to review LOU submitted documentation: 60 days LOU Communications Portal | <2 GLEIF Availability: 95 % business days Processing Time to register an account: 3 days Trigger LEl management <2 GLEIF No LEls are left without any operating transfer business days managing LOU for more than 4 business days In case of force majeure, GLEIF shall trigger this process within 4 business days given the impacted LOU stops LEI file daily upload and Service Level Agreement (SLA) Page 44 of 47 @ Public Version 2.1 2022-03-31_MA-Appendix-06-SLA_v2.1.docx 2022-03-31

does not provide business as usual confirmation Upload LEI & LE-RD Files <2 GLEIF Availability: 97.5 % business days Processing time: Within 1 hour upon arrival Same workload limits as during business as usual apply. Service Level Agreement (SLA) Page 45 of 47 @ Public Version 2.1 2022-03-31_MA-Appendix-06-SLA_v2.1.docx 2022-03-31

8 SLA Reports GLEIF provides monthly SLA Reports to the LOU by the 10" GLEIF business day of the following month. In case of Service Level breaches GLEIF initiates escalation management. Service Reports Definition Contents Report parameters according to SLA Reporting period Monthly Reporting Reports are made available through LOU Communications Portal Obligation According to SLA Language English Filing 10 years Service Level Agreement (SLA) Page 46 of 47 @ Public Version 2.1 2022-03-31_MA-Appendix-06-SLA_v2.1.docx 2022-03-31

9 Change of Service Levels Chapter XllII of the Master Agreement applies. Service Level Agreement (SLA) Page 47 of 47 @ Public Version 2.1 2022-03-31_MA-Appendix-06-SLA_v2.1.docx 2022-03-31

Update Frequency How often a request for service will occur in a given period of time.

Upload Failure Rate The rate of LEI records that could not be successfully uploaded (due to false formats etc.).

Validation Ensures complete, reasonable, sensible data within acceptable boundaries. To check data that is being entered.

Validation Agent The Validation Agent is an organization that obtains and maintains Legal Entity Identifiers (LEls) for its clients in cooperation with accredited LEl issuers by leveraging their business as usual client identification procedures in Know Your Customer (KYC) and client onboarding processes.

Verification Entered data matches exactly the validation source.

Workload Limit A measure of the volume of work that the GLEIF services apply to.

Service Level Agreement (SLA) Page 6 of 47 @ Public Version 2.1 2022-03-31_MA-Appendix-06-SLA_v2.1.docx 2022-03-31

2 GLEIF Services - Service Descriptions

The following services listed below are delivered by GLEIF, applying GLEIF’s Information Security Policy.

For all of them, the attended service operating time will be from Monday to Friday between

09.00 — 17.00 GLEIF business days. Also, the response time to service requests issued by Customers generally is within one GLEIF business day upon submission.

2.1 LOU Accreditation

Name LOU Accreditation

Tag Line Entities desiring to become local operating units must seek Accreditation by GLEIF.

Description In order to support the integrity of the GLEIS, an extensive vetting process is in place to ensure that local operating units reflect and incorporate the vision and internal control requirements of GLEIF within their operations.

The Accreditation Manual and Accreditation Checklist (Appendix 02) can be downloaded from GLEIF’'s website.

Essential Tasks e Provide Accreditation Manual and Accreditation Checklist and

other supporting materials and forms

o Evaluate readiness of Applicant LOU based on the Accreditation Plan

o Set up of Non-Disclosure Agreement / Master Agreement contract

• Provide up to support calls per phase

© Assess Accreditation Documentation from Candidates for compliance with expected standards

o Provide transactional LEI test cases to the Candidate LOU and assess performance

o Assess use of authoritative sources

¢ Ensure integrity and availability of historical LEI information

o Issue Accreditation Certificate

o Publish Accreditation Certificate on GLEIF website

¢ Provide and maintain on GLEIF website the list of all LOUs currently accredited

Access Group(s) o Applicant LOU

Service Level Agreement (SLA) Page 7 of 47 @ Public Version 2.1 2022-03-31_MA-Appendix-06-SLA_v2.1.docx 2022-03-31

¢ Candidate LOU The Applicant/Candidate © Read Accreditation Manual LOU Tasks Develop Accreditation Plan and other required documentation and forms » Sign Non-Disclosure Agreement / Master Agreement o Complete Accreditation Checklist with supporting documents o Participate in support calls with GLEIF o Deliver Accreditation Documentation and data testing results o Remediate areas of non-compliance as required o Publish Accreditation Certificate on own website o Candidate to provide the requested material in no more than 6 months from the date of the Master Agreement signature Availability 99.9 % (Monday — Sunday 00:00 — 24:00) for GLEIF Website 97,7 % (Monday — Sunday 00:00 — 24:00) for Customer Portal Processing Time Applicant documentation review: Review Accreditation Plan submission within 45 GLEIF business days of receipt of full set of materials Candidate documentation review: Review Candidate submission within 3 months of receipt of complete set of materials Workload Limit 15 concurrent instances Exception In case the Continuity process is invoked (ref. chapter 7) Service Level Agreement (SLA) Page 8 of 47 @ Public Version 2.1 2022-03-31_MA-Appendix-06-SLA_v2.1.docx 2022-03-31

2.2 LOU Annual Accreditation Verification

Name LOU Annual Accreditation Verification

Tag Line GLEIF’s process of re-verification of the LOU compliance with expected internal controls within its LEI operations.

Description GLEIF will request from the LOUs certain documentation and evidence of compliance with expected internal controls which need to be in place for an accredited LOU to be operational. This exercise is based upon the current status of internal controls that were verified as part of the LOU’s initial Accreditation and as amended in the event under the Accreditation Change Process.

The LOU Annual Accreditation Verification process is executed on or after the anniversary date of the LOU’s date of accreditation as documented on their accreditation certificate. See Appendix 10. Using a template provided by GLEIF, the LOU verifies the status of each processing area as mentioned in the Accreditation Checklist. For areas where significant changes have occurred, the LOU documents the nature and extent of the changes and how it/they effected LEI processing. Supporting documentation must be provided as additional information regarding the change(s).

GLEIF reviews this information and assesses the overall impact of any changes noted in the internal controls. GLEIF determines if the changed internal controls still meet the required control standard and advises the LOU as to whether any remediation action is required.

Essential Tasks o Provide LOU Annual Accreditation Verification questionnaire and

other review materials ¢ Review and evaluate LOU self-assessment ¢ Confirm adequate levels of compliance with expected controls exists and/or document required remediation activities © Ensure that any remediation activities are completed in a timely and complete manner e Maintain on GLEIF website the list of all LOUs currently accredited * Yearly by the following 3 months after the anniversary date of LOU accreditation, GLEIF will trigger an LOU Annual Accreditation Verification. The scope of the LOU Annual Accreditation Service Level Agreement (SLA) Page 9 of 47 @ Public Version 2.1 2022-03-31_MA-Appendix-06-SLA_v2.1.docx 2022-03-31

Verification will be always the last operational year from the anniversary date. Access Group(s) Accredited local operating units The LOU Tasks ¢ Download the designated annual verification materials from gleif.org when instructed o Provide completed Accreditation Verification questionnaire (self- assessment) noting all changes in its internal controls within its LEl operations ¢ Provide supporting documentation for any process changes noted o Review GLEIF evaluation results with GLEIF o Complete any required remediation activities based upon a mutually agreed schedule ¢ The LOUs having performed at least the LOU Annual Accreditation Verification once and having 9 clean SLA reports (no breaches) in the last operating year, could be requested to perform the LOU Annual Accreditation Verification with a reduced scope. The decision is at the sole discretion of GLEIF Availability 97,7 % (Monday — Sunday 00:00 — 24:00) for Customer Portal Processing Time GLEIF shall review the LOU submitted documentation within 30 GLEIF business days of receipt of the complete set of documents Workload Limit 20 concurrent instances Exception In case the Continuity process is invoked (ref. chapter 7) Service Level Agreement (SLA) Page 10 of 47 @ Public Version 2.1 2022-03-31_MA-Appendix-06-SLA_v2.1.docx 2022-03-31