Common use of MEMO ON INFORMATION SAFETY REQUIREMENTS WHEN USING CLIENT Clause in Contracts

MEMO ON INFORMATION SAFETY REQUIREMENTS WHEN USING CLIENT. BANK SYSTEM (compulsory for the persons who have the right to impose an Advanced Electronic Signature and/or Simple ES on payment documents and/or sign Certificate Requests on behalf of the Client, as well as for the persons responsible for the operation and administration of the computer(s) with the installed software Client-Bank System). The effectiveness and security of using the Client- Bank System to a large extent depends on the strict observance of information security requirements when operating the system. By providing the specified service, the Bank has created a convenient technology that provides reliable protection of company payments, provided that unauthorized access of third parties to the installed Client- Bank System, secret keys and security passwords, is prevented. The reasons for unauthorized access may be the direct physical access of unauthorized persons to the computer with installed Client- Bank System, computer can pick up viruses and Trojan programs. Factors contributing to the compromise of secret keys are the abandonment of the media with secret keys in computer USB ports by the end of work or the permanent storage of secret keys on its hard disk. For its part, the Bank takes all measures to prevent the potential threats to information security and recommends that the following safe working rules within the Client-Bank System should be followed: Basic rules: 1. Limit the access of third parties to the computer You are using for working with Client-Bank System. Ensure the security of the room where it is installed. 2. Limit the access of third parties to the mobile phone which is used for receiving one-time OTP-codes. Do not tell anyone one-time password. Remember that Bank’s managers can’t motivate/push Client to inform somebody about passwords, codes, requisites of payments etc, give recommendations about making payments for the benefit of third parties. Note! Bank doesn’t recommend to use mobile phone numbers without signing agreement with mobile service operator for receiving one-time OTP-codes. 3. Provide secure storage for the Secret Keys on external media (token, etc.). Do not store the Secret Key files on your computer's hard drive. Immediately after the operations with Secret Keys, disconnect their media from the computer, do not leave them permanently connected to the computer. 4 Use two signatures (two keys) from two separate computers to sign payment documents. 5. Periodically monitor the status of your current accounts (at least 1 time daily), even if You personally do not perform any payment transactions in Client-Bank System. 6. Use only licensed software from trusted sources. 7. Use antivirus software and perform timely installation of antivirus database updates. 8. Provide timely installation of operating system security updates (it is not recommended to use operating systems that the developer does not support (for example, Microsoft Windows 98, Microsoft Windows 2000, Microsoft Windows XP, etc.). 9. Activate the access filtering mode to the Client-Bank System by the IP address - the regular function of the Client- Bank System. Your IT administrator should contact the System Support Service to receive detailed information on activating the access filtering by IP address and making the appropriate settings. 10. Do not use a computer with installed Client-Bank System to view non-work-related Internet resources; do not visit sites with questionable content, which often are sources of malware spreading (user may not notice the damages incurred). 11. Do not install nor store suspicious files that were obtained from unreliable sources downloaded from unknown Web- sites, sent by email, etc. Such files have to be immediately deleted. If you need to download a file, be sure to check it with an antivirus program before using. Auxiliary rules:

MEMO ON INFORMATION SAFETY REQUIREMENTS WHEN USING CLIENT. BANK INTERNET BANKING SYSTEM "OTP ONLINE" (compulsory for the persons who have the right to impose an Advanced Electronic Digital Signature and/or Simple ES on payment documents and/or sign Certificate Requests on behalf of the Client, as well as for the persons responsible for the operation and administration of the computer(s) with the installed software Client-Bank SystemInternet Banking System "OTP ONLINE"). The effectiveness and security of using the Client- Bank System Client-Internet Banking system "OTP Online" to a large extent depends on the strict observance of information security requirements when operating the system. By providing the specified service, the Bank has created a convenient technology that provides reliable protection of company payments, provided that unauthorized access of third parties to the installed Client- Bank SystemClient-Internet Banking Systems "OTP Online", secret keys and security passwords, is prevented. The reasons for unauthorized access may be the direct physical access of unauthorized persons to the computer with installed Client- Bank SystemClient-Internet Banking System "OTP Online", computer can pick up viruses and Trojan programs. Factors contributing to the compromise of secret keys are the abandonment of the media with secret keys in computer USB ports by the end of work or the permanent storage of secret keys on its hard disk. For its part, the Bank takes all measures to prevent the potential threats to information security and recommends that the following safe working rules within the Client-Bank Internet Banking System "OTP Online" should be followed: Basic rules: 1. Limit the access of third parties to the computer You are using for working with Client-Bank SystemInternet Banking System "OTP Online". Ensure the security of the room where it is installed. 2. Limit the access of third parties to the mobile phone which is used for receiving one-time OTP-codes. Do not tell anyone one-time password. Remember that Bank’s managers can’t motivate/push Client to inform somebody about passwords, codes, requisites of payments etc, give recommendations about making payments for the benefit of third parties. Note! Bank doesn’t recommend to use mobile phone numbers without signing agreement with mobile service operator for receiving one-time OTP-codes. 3. Provide secure storage for the Secret Keys on external media (token, etc.). Do not store the Secret Key files on your computer's hard drive. Immediately after the operations with Secret Keys, disconnect their media from the computer, do not leave them permanently connected to the computer. 4 Use two signatures (two keys) from two separate computers to sign payment documents. 5. Periodically monitor the status of your current accounts (at least 1 time daily), even if You personally do not perform any payment transactions in Client-Bank System. 6. Use only licensed software from trusted sources. 7. Use antivirus software and perform timely installation of antivirus database updates. 8. Provide timely installation of operating system security updates (it is not recommended to use operating systems that the developer does not support (for example, Microsoft Windows 98, Microsoft Windows 2000, Microsoft Windows XP, etc.). 9. Activate the access filtering mode to the Client-Bank System by the IP address - the regular function of the Client- Bank System. Your IT administrator should contact the System Support Service to receive detailed information on activating the access filtering by IP address and making the appropriate settings. 10. Do not use a computer with installed Client-Bank System to view non-work-related Internet resources; do not visit sites with questionable content, which often are sources of malware spreading (user may not notice the damages incurred). 11. Do not install nor store suspicious files that were obtained from unreliable sources downloaded from unknown Web- sites, sent by email, etc. Such files have to be immediately deleted. If you need to download a file, be sure to check it with an antivirus program before using. Auxiliary rules:

MEMO ON INFORMATION SAFETY REQUIREMENTS WHEN USING CLIENT. BANK SYSTEM (compulsory for the persons who have the right to impose an Advanced Electronic Signature and/or Simple ES on payment documents and/or sign Certificate Requests on behalf of the Client, as well as for the persons responsible for the operation and administration of the computer(s) with the installed software Client-Bank System). The effectiveness and security of using the Client- Bank System to a large extent depends on the strict observance of information security requirements when operating the system. By providing the specified service, the Bank has created a convenient technology that provides reliable protection of company payments, provided that unauthorized access of third parties to the installed Client- Bank System, secret keys and security passwords, is prevented. The reasons for unauthorized access may be the direct physical access of unauthorized persons to the computer with installed Client- Bank System, computer can pick up viruses and Trojan programs. Factors contributing to the compromise of secret keys are the abandonment of the media with secret keys in computer USB ports by the end of work or the permanent storage of secret keys on its hard disk. For its part, the Bank takes all measures to prevent the potential threats to information security and recommends that the following safe working rules within the Client-Bank System should be followed: Basic rules: 1. Limit the access of third parties to the computer You are using for working with Client-Bank System. Ensure the security of the room where it is installed. 2. Limit the access of third parties to the mobile phone which is used for receiving one-time OTP-codes. Do not tell anyone one-time password. Remember that Bank’s managers can’t motivate/push Client to inform somebody about passwords, codes, requisites of payments etc, give recommendations about making payments for the benefit of third parties. Note! Bank doesn’t recommend to use mobile phone numbers without signing agreement with mobile service operator for receiving one-time OTP-codes. 3. Provide secure storage for the Secret Keys on external media (token, etc.). Do not store the Secret Key files on your computer's hard drive. Immediately after the operations with Secret Keys, disconnect their media from the computer, do not leave them permanently connected to the computer. 4 Use two signatures (two keys) from two separate computers to sign payment documents. 5. Periodically monitor the status of your current accounts (at least 1 time daily), even if You personally do not perform any payment transactions in Client-Bank System. 6. Use only licensed software from trusted sources. 7. Use antivirus software and perform timely installation of antivirus database updates. 8. Provide timely installation of operating system security updates (it is not recommended to use operating systems that the developer does not support (for example, Microsoft Windows 98, Microsoft Windows 2000, Microsoft Windows XP, etc.). 9. Activate the access filtering mode to the Client-Bank System by the IP address - the regular function of the Client- Bank System. Your IT administrator should contact the System Support Service to receive detailed information on activating the access filtering by IP address and making the appropriate settings. 10. Do not use a computer with installed Client-Bank System to view non-work-related Internet resources; do not visit sites with questionable content, which often are sources of malware spreading (user may not notice the damages incurred). 11. Do not install nor store suspicious files that were obtained from unreliable sources downloaded from unknown Web- sites, sent by email, etc. Such files have to be immediately deleted. If you need to download a file, be sure to check it with an antivirus program before using. Auxiliary rules:

MEMO ON INFORMATION SAFETY REQUIREMENTS WHEN USING CLIENT. BANK SYSTEM (compulsory for the persons who have the right to impose an Advanced Electronic Signature and/or Qualified ES and/or Simple ES on payment documents and/or sign Certificate Requests on behalf of the Client, as well as for the persons responsible for the operation and administration of the computer(s) with the installed software Client-Client- Bank System). The effectiveness and security of using the Client- Bank System to a large extent depends on the strict observance of information security requirements when operating the system. By providing the specified service, the Bank has created a convenient technology that provides reliable protection of company payments, provided that unauthorized access of third parties to the installed Client- Bank System, secret keys and security passwords, is prevented. The reasons for unauthorized access may be the direct physical access of unauthorized persons to the computer with installed Client- Bank System, computer can pick up viruses and Trojan programs. Factors contributing to the compromise of secret keys are the abandonment of the media with secret keys in computer USB ports by the end of work or the permanent storage of secret keys on its hard disk. For its part, the Bank takes all measures to prevent the potential threats to information security and recommends that the following safe working rules within the Client-Bank System should be followed: Basic rules: 1. Limit the access of third parties to the computer You are using for working with Client-Bank System. Ensure the security of the room where it is installed. 2. Limit the access of third parties to the mobile phone which is used for receiving one-time OTP-codes. Do not tell anyone one-time password. Remember that Bank’s managers can’t motivate/push Client to inform somebody about passwords, codes, requisites of payments etc, give recommendations about making payments for the benefit of third parties. Note! Bank doesn’t recommend to use mobile phone numbers without signing agreement with mobile service operator for receiving one-time OTP-codes. 3. Provide secure storage for the Secret Keys on external media (token, etc.). Do not store the Secret Key files on your computer's hard drive. Immediately after the operations with Secret Keys, disconnect their media from the computer, do not leave them permanently connected to the computer. 4 Use two signatures (two keys) from two separate computers to sign payment documents. 5. Periodically monitor the status of your current accounts (at least 1 time daily), even if You personally do not perform any payment transactions in Client-Bank System. 6. Use only licensed software from trusted sources. 7. Use antivirus software and perform timely installation of antivirus database updates. 8. Provide timely installation of operating system security updates (it is not recommended to use operating systems that the developer does not support (for example, Microsoft Windows 98, Microsoft Windows 2000, Microsoft Windows XP, etc.). 9. Activate the access filtering mode to the Client-Bank System by the IP address - the regular function of the Client- Bank System. Your IT administrator should contact the System Support Service to receive detailed information on activating the access filtering by IP address and making the appropriate settings. 10. Do not use a computer with installed Client-Bank System to view non-work-related Internet resources; do not visit sites with questionable content, which often are sources of malware spreading (user may not notice the damages incurred). 11. Do not install nor store suspicious files that were obtained from unreliable sources downloaded from unknown Web- sites, sent by email, etc. Such files have to be immediately deleted. If you need to download a file, be sure to check it with an antivirus program before using. Auxiliary rules:: 12.Restrict Internet access from the workplace, which uses the Client-Bank System, with only the necessary range of trusted resources (banks, counteragents, etc.). 00.Xx not work with the Client-Bank System under an account with extended rights in the operating system (for example, "Administrator"). 14.Disconnect the Guest account, exclude the auto-login mode on the operating system when downloading. 15. When working with the Client-Bank System use passwords that meet the following requirements: - the password to log into the Client-Bank System and security passwords for secret keys have to be set different from all other passwords You are using; - choose passwords of sufficient length (not less than 6 characters), but which you can remember (it is strongly not recommended to recover passwords);

MEMO ON INFORMATION SAFETY REQUIREMENTS WHEN USING CLIENT. BANK SYSTEM (compulsory for the persons who have the right to impose an Advanced Electronic Signature and/or Simple ES on payment documents and/or sign Certificate Requests on behalf of the Client, as well as for the persons responsible for the operation and administration of the computer(s) with the installed software Client-Bank System). The effectiveness and security of using the Client- Bank System to a large extent depends on the strict observance of information security requirements when operating the system. By providing the specified service, the Bank has created a convenient technology that provides reliable protection of company payments, provided that unauthorized access of third parties to the installed Client- Bank System, secret keys and security passwords, is prevented. The reasons for unauthorized access may be the direct physical access of unauthorized persons to the computer with installed Client- Bank System, computer can pick up viruses and Trojan programs. Factors contributing to the compromise of secret keys are the abandonment of the media with secret keys in computer USB ports by the end of work or the permanent storage of secret keys on its hard disk. For its part, the Bank takes all measures to prevent the potential threats to information security and recommends that the following safe working rules within the Client-Bank System should be followed: Basic rules: 1. Limit the access of third parties to the computer You are using for working with Client-Bank System. Ensure the security of the room where it is installed. 2. Limit the access of third parties to the mobile phone which is used for receiving one-time OTP-codes. Do not tell anyone one-time password. Remember that Bank’s managers can’t motivate/push Client to inform somebody about passwords, codes, requisites of payments etc, give recommendations about making payments for the benefit of third parties. Note! Bank doesn’t recommend to use mobile phone numbers without signing agreement with mobile service operator for receiving one-time OTP-codes. 3. Provide secure storage for the Secret Keys on external media (token, etc.). Do not store the Secret Key files on your computer's hard drive. Immediately after the operations with Secret Keys, disconnect their media from the computer, do not leave them permanently connected to the computer. 4 Use two signatures (two keys) from two separate computers to sign payment documents. 5. Periodically monitor the status of your current accounts (at least 1 time daily), even if You personally do not perform any payment transactions in Client-Bank System. 6. Use only licensed software from trusted sources. 7. Use antivirus software and perform timely installation of antivirus database updates. 8. Provide timely installation of operating system security updates (it is not recommended to use operating systems that the developer does not support (for example, Microsoft Windows 98, Microsoft Windows 2000, Microsoft Windows XP, etc.). 9. Activate the access filtering mode to the Client-Bank System by the IP address - the regular function of the Client- Bank System. Your IT administrator should contact the System Support Service to receive detailed information on activating the access filtering by IP address and making the appropriate settings. 10. Do not use a computer with installed Client-Bank System to view non-work-related Internet resources; do not visit sites with questionable content, which often are sources of malware spreading (user may not notice the damages incurred). 11. Do not install nor store suspicious files that were obtained from unreliable sources downloaded from unknown Web- sites, sent by email, etc. Such files have to be immediately deleted. If you need to download a file, be sure to check it with an antivirus program before using. Auxiliary rules:

MEMO ON INFORMATION SAFETY REQUIREMENTS WHEN USING CLIENT. BANK SYSTEM (compulsory for the persons who have the right to impose an Advanced Electronic Signature and/or Qualified ES and/or Simple ES on payment documents and/or sign Certificate Requests on behalf of the Client, as well as for the persons responsible for the operation and administration of the computer(s) with the installed software Client-Client- Bank System). The effectiveness and security of using the Client- Bank System to a large extent depends on the strict observance of information security requirements when operating the system. By providing the specified service, the Bank has created a convenient technology that provides reliable protection of company payments, provided that unauthorized access of third parties to the installed Client- Bank System, secret keys and security passwords, is prevented. The reasons for unauthorized access may be the direct physical access of unauthorized persons to the computer with installed Client- Bank System, computer can pick up viruses and Trojan programs. Factors contributing to the compromise of secret keys are the abandonment of the media with secret keys in computer USB ports by the end of work or the permanent storage of secret keys on its hard disk. For its part, the Bank takes all measures to prevent the potential threats to information security and recommends that the following safe working rules within the Client-Bank System should be followed: Basic rules: 1. Limit the access of third parties to the computer You are using for working with Client-Bank System. Ensure the security of the room where it is installed. 2. Limit the access of third parties to the mobile phone which is used for receiving one-time OTP-codes. Do not tell anyone one-time password. Remember that Bank’s managers can’t motivate/push Client to inform somebody about passwords, codes, requisites of payments etc, give recommendations about making payments for the benefit of third parties. Note! Bank doesn’t recommend to use mobile phone numbers without signing agreement with mobile service operator for receiving one-time OTP-codes. 3. Provide secure storage for the Secret Keys on external media (token, etc.). Do not store the Secret Key files on your computer's hard drive. Immediately after the operations with Secret Keys, disconnect their media from the computer, do not leave them permanently connected to the computer. 4 Use two signatures (two keys) from two separate computers to sign payment documents. 5. Periodically monitor the status of your current accounts (at least 1 time daily), even if You personally do not perform any payment transactions in Client-Bank System. 6. Use only licensed software from trusted sources. 7. Use antivirus software and perform timely installation of antivirus database updates. 8. Provide timely installation of operating system security updates (it is not recommended to use operating systems that the developer does not support (for example, Microsoft Windows 98, Microsoft Windows 2000, Microsoft Windows XP, etc.). 9. Activate the access filtering mode to the Client-Bank System by the IP address - the regular function of the Client- Bank System. Your IT administrator should contact the System Support Service to receive detailed information on activating the access filtering by IP address and making the appropriate settings. 10. Do not use a computer with installed Client-Bank System to view non-work-related Internet resources; do not visit sites with questionable content, which often are sources of malware spreading (user may not notice the damages incurred). 11. Do not install nor store suspicious files that were obtained from unreliable sources downloaded from unknown Web- sites, sent by email, etc. Such files have to be immediately deleted. If you need to download a file, be sure to check it with an antivirus program before using. Auxiliary rules: