Common use of MEMO ON INFORMATION SAFETY REQUIREMENTS WHEN USING CLIENT Clause in Contracts

MEMO ON INFORMATION SAFETY REQUIREMENTS WHEN USING CLIENT. BANK SYSTEM (compulsory for the persons who have the right to impose an Advanced Electronic Signature and/or Simple ES on payment documents and/or sign Certificate Requests on behalf of the Client, as well as for the persons responsible for the operation and administration of the computer(s) with the installed software Client-Bank System). The effectiveness and security of using the Client- Bank System to a large extent depends on the strict observance of information security requirements when operating the system. By providing the specified service, the Bank has created a convenient technology that provides reliable protection of company payments, provided that unauthorized access of third parties to the installed Client- Bank System, secret keys and security passwords, is prevented. The reasons for unauthorized access may be the direct physical access of unauthorized persons to the computer with installed Client- Bank System, computer can pick up viruses and Trojan programs. Factors contributing to the compromise of secret keys are the abandonment of the media with secret keys in computer USB ports by the end of work or the permanent storage of secret keys on its hard disk. For its part, the Bank takes all measures to prevent the potential threats to information security and recommends that the following safe working rules within the Client-Bank System should be followed: Basic rules: 1. Limit the access of third parties to the computer You are using for working with Client-Bank System. Ensure the security of the room where it is installed. 2. Limit the access of third parties to the mobile phone which is used for receiving one-time OTP-codes. Do not tell anyone one-time password. Remember that Bank’s managers can’t motivate/push Client to inform somebody about passwords, codes, requisites of payments etc, give recommendations about making payments for the benefit of third parties. Note! Bank doesn’t recommend to use mobile phone numbers without signing agreement with mobile service operator for receiving one-time OTP-codes.

MEMO ON INFORMATION SAFETY REQUIREMENTS WHEN USING CLIENT. BANK SYSTEM (compulsory for the persons who have the right to impose an Advanced Electronic Signature and/or Qualified ES and/or Simple ES on payment documents and/or sign Certificate Requests on behalf of the Client, as well as for the persons responsible for the operation and administration of the computer(s) with the installed software Client-Client- Bank System). The effectiveness and security of using the Client- Bank System to a large extent depends on the strict observance of information security requirements when operating the system. By providing the specified service, the Bank has created a convenient technology that provides reliable protection of company payments, provided that unauthorized access of third parties to the installed Client- Bank System, secret keys and security passwords, is prevented. The reasons for unauthorized access may be the direct physical access of unauthorized persons to the computer with installed Client- Bank System, computer can pick up viruses and Trojan programs. Factors contributing to the compromise of secret keys are the abandonment of the media with secret keys in computer USB ports by the end of work or the permanent storage of secret keys on its hard disk. For its part, the Bank takes all measures to prevent the potential threats to information security and recommends that the following safe working rules within the Client-Bank System should be followed: Basic rules: 1. Limit the access of third parties to the computer You are using for working with Client-Bank System. Ensure the security of the room where it is installed. 2. Limit the access of third parties to the mobile phone which is used for receiving one-time OTP-codes. Do not tell anyone one-time password. Remember that Bank’s managers can’t motivate/push Client to inform somebody about passwords, codes, requisites of payments etc, give recommendations about making payments for the benefit of third parties. Note! Bank doesn’t recommend to use mobile phone numbers without signing agreement with mobile service operator for receiving one-time OTP-codes.

MEMO ON INFORMATION SAFETY REQUIREMENTS WHEN USING CLIENT. BANK INTERNET BANKING SYSTEM "OTP ONLINE" (compulsory for the persons who have the right to impose an Advanced Electronic Digital Signature and/or Simple ES on payment documents and/or sign Certificate Requests on behalf of the Client, as well as for the persons responsible for the operation and administration of the computer(s) with the installed software Client-Bank SystemInternet Banking System "OTP ONLINE"). The effectiveness and security of using the Client- Bank System Client-Internet Banking system "OTP Online" to a large extent depends on the strict observance of information security requirements when operating the system. By providing the specified service, the Bank has created a convenient technology that provides reliable protection of company payments, provided that unauthorized access of third parties to the installed Client- Bank SystemClient-Internet Banking Systems "OTP Online", secret keys and security passwords, is prevented. The reasons for unauthorized access may be the direct physical access of unauthorized persons to the computer with installed Client- Bank SystemClient-Internet Banking System "OTP Online", computer can pick up viruses and Trojan programs. Factors contributing to the compromise of secret keys are the abandonment of the media with secret keys in computer USB ports by the end of work or the permanent storage of secret keys on its hard disk. For its part, the Bank takes all measures to prevent the potential threats to information security and recommends that the following safe working rules within the Client-Bank Internet Banking System "OTP Online" should be followed: Basic rules: 1. Limit the access of third parties to the computer You are using for working with Client-Bank SystemInternet Banking System "OTP Online". Ensure the security of the room where it is installed. 2. Limit the access of third parties to the mobile phone which is used for receiving one-time OTP-codes. Do not tell anyone one-time password. Remember that Bank’s managers can’t motivate/push Client to inform somebody about passwords, codes, requisites of payments etc, give recommendations about making payments for the benefit of third parties. Note! Bank doesn’t recommend to use mobile phone numbers without signing agreement with mobile service operator for receiving one-time OTP-codes.