Wolfsberg Group Co rres ponden t 8ank1ng Due Diligence Questionnaire {CBDOQ) V1 2

the Wolfsberg

Group

Fin:incial Institution Name:

Loc atlcn (Country).

I ONB Bank ASA (984 851 006)

Oslo, NORWAY

/uhe questionnaire is required to be answered on a Legal Entity {LE} Level. This means the Financial Institution w ·NN answer the questionnaire at an nenate parent I head office & subsidiary level for which any branches would be considered covered by that parenUsubsidiary OOQ. This questionnaire

khould not cover more than one LE. Each question in the OOQ will need to be addressed from the perspective of the LE and on behalf of all of its ~ranches. If a response for the LE differed for one of its branches this needs to be highlighted and delai! regarding this difference captured at lhe end of rach subsection. If a branch business activity (products offered, client base etc.j is significantly different than its head office, the branch should complete ~ separate questionnaire.

r,o# Question 8 . w ) r ~- ENTJTY & OWNERSHIP

[ un legal Name DNB Bank ASA This questionnaire applies to DNB Bank ASA. its branches. and each of us majonty-owned subsidiaries

2 r\ppend a Hsi of qr mr yz) s which are covered by DNB Bank ASA Denmark Branch(DK), ONB Bank ASA. f,hal F,nland(FI), DNB Bank ASA his ouesncnna.re F,hale Deulschland(DE), ONB Bank ASA. f,l,al Sverige(SE). ONB Bank ASA London Branchs

(GB), ONB Bank ASA New York Branch(US).DNB Sank ASA Shanghai Branch CN). ONB Bank ASA Singapore Branch(SG). ONB Cayman lslands(KY) ONB Serv.ceaent Riga

O ull legal (A.egrstered) Address Omnnmg Eulerruas Gale 30. NO-Oi91 Oslo, Norway

4 -uu Pnmary Business ACdress 1·R oeerent from Oronrunq Eufemias Gate 30, NO-0191 Oslo. Norway ~bove)

s Date of Entity 1r'\COrporat1onl estabhshrnent The legal entity ONB Bank ASA was founded 10.09 2002 in connecnons with the merger of DnB and GienS1dige NOR However. lhe bank's activity goes back to the 1822 when !he predecessor Christiania Sp.are bank was founded.

6 pelect type of ownership and append an JY-nersh1p chart 1f available

6a ubhcty Traded (25% of shares publicly traded) No

6 a1 f Y. indicate the exchange traded on and lick.er ymbo'

6b ~ember Ownedf Mutual ~i ;

6c f,JOvemment er Slate Owned by 25% or more .. o 6d _nvately Owned es / F[ f Y. provide details of shareholders or u!limaie

peoencat owners wllh a holding of 10% or more ON8 ASA owns 100% of ONB Bank ASA.

-.,------ [(o of the Entity's toial shares composed of bearer r-t"lares 0 %, the company does not issue bearer snares.

8 uces the Entity. or any ot us branches. operate

w under an Offshore Banking license (DBL)? Yes

Ba i Y, orovfde the name of the relevant branchfes ONB Cayman Islands ~hich operate unce- an OBL DNB has for a number of years held an Offshore Banking License in Cayman Islands A controlled

wind-down of cuslorner activity is planned. but the license will still be 1n use for internal DNB activity.

9 jvarne of or1mary financial regulator f supervisory ~1..thor1ly Norwegian Financ.a! Supervisory Authority (NFSA)

httpsl/www finans:ilsynet.no/en/

[ f rovide legal t.nt1ly ldenhfier (LEI) ·t available

549300GKFGORYRRQ ld 14

(s) Tl-o 'No,ts:bcrg Cho u p t:f [ ! CBODO vr 2

Wolfsberg Group Correspondenl 83nking Due Diligence Oues1,onna1re (CBODQ) V1 2

11 Provide the full 1egal name of the ultimate parsn ONB ASA (Own100 o(o ot the shares 1n DNB Bank ASA (if differenl from the Entity ccmptetma the ODO} Norwegian Govemment/Mtnistry of Trade. Industry and Fisher,es owns 34% of DNB ASA DNB

Savings Bank Foundation owns 9%, Folketrygd- fondet owns 6.17% No more owns more than 5'% each There 1s no UBO in DNB ASA

[ " Juosocnoo of licensing authority and regulator of ultimate parent Norway

Norwegian F1Mnciai Supervisory Authcr,ty (NFSA)

13 Select the bustness areas applicable to the Ent.\Y

13 a Reta1t Bankina Yes

13 b Private 8ankina / Weatih Manaaement Yes 13 C Commercial Bankinn Yes 13 d Transactional Bankina Yes 13 e Investment Bankino Yes

13 f Financial Markels Tradinc Yes

13 a Securities Services/ Cuslodv Yes 13 h Broker/Dealer Yes 13 · Multilateral Oeve\ocment Bank No 13 _ Other NA

14 Does the Entity have a significant {10% or more) ofishore customer base. either by number of customers er by revenues (where oH- No shore means not domiciled 1n t z) 1urisdict1on '"'""'" '""' are bemo orovided'r ?

14 a If Y. provide details of the country and%

15 Select the ctosest value. 15 a Number of emp!ovees 5001-10000 15 b Total Assets Greater than [ df f million 16 Confirm that all responses provided ·+ the

above Section ENTITY & OWNERSHIP are Yes representative or all the LE.'s branches

16 a If N c!anfy which qveslions the difference/s relate to and the branch/es that this applies to. f / s ONB Bank ASA 1s owned 100% oy ONB ASA wh1cii is a publ·cly !isted company on Oslo Stock

Exchange (OSEBX) ISIN· N00010031479 {Ticker ONB} owned 34% oy the Norwegian government (as an 1rwestment stake)

16 b If appropriate, provide an-., additional information/ ccntext to the answers m this section

~T'le Wc'fsberg Greve 2018 0age " CBDDO V!.2

Wolrsbe,g Group j o rr ) s p o +F)+t ! h[+L·+0 ; u ) ; ht ·E)+y) I u ) s t ·o ++m·r ) (CBDDQ) Vl.2

2. PRODUCTS & SERVICES 17 Does the Entity offer the following products and

services· [o3 Corresoondenl Sankinn Yes 17 a1 tfY [o m" Does the E nlily offer Correspondenl Banking

Yes services 10 demesne banks? [o • O Does the Entity allow domestic bank clients to No nrovrde downstream relanonstuos? [o a4 Does lhE? Entity have processes and procedures

tn place to 1denlfty downstream retauor-stuos Yes wnh domestic banks?

[o a5 Does !he Entity offer correspondent banking Yes services to sorercn Banks? 17 a6 Does the Enti!y allow downstream relalionsh1ps

Yes with Fore10n Banks? 17 a7 Does the Entity have processes and procedures

m place ta identify downstream retauonsmcs Yes with Foreign Banks?

[o as Does the Entity offer correspondent banking No services to reoutated MSBs/MVTS?

17 a9 Does the Entity allow downstream relauonsntps No w;th MSBs/MVTS?

[o a10 Does the Entity have processes and procedures in place to Identify downstream relationships Yes w1lh MSB IMVTS?

17 b Private Ban'-<ing (domestic & international) Yes 17 C Trade Fmance Yes [o F Pavabte Throuah Accounts No 17 e Stored Value Instruments No [o f Cross Border Bulk Cash Oeliverv No 17 a Oomestrc Bulk Cash Oehverv No 17 h International Cash Letter No 17 · Remote Deoosit Capture No [oG Vir1ual /Oia1tal Currencies l..lf\ 17 k Low Price Securities No 171 Hold Mail No 17 m Cross Border Remittances Yes 17 n Service to walk-in customers (non-account Yes holders) 17 o Soonsodna Private ATMs No 17 p Olher high risk products and services ider.hfied

by the Entity NA

18 Confirm that a!I responses provrced in the above Section PRODUCTS & SERVICES are No recreseotaeve of all the LE's branches

18 a If N. clarify which Questions the d1fference/s 17a.17a2. 17a4.17a5, 17a6.17a7. 17a10. 7b, 17c, 17m, 17nThese products are not offered ,n all branches relate 10 and the branch/es that this applies lo

18 b If appropriate. provide any additional mlorrnatron I context to the answers 1n lhrs \7 n. Service to walk-in customers 1s only offered 1n our branches on Oslo Airport. and is only related section to currency exchange services.

<9The wousberq Group 2018 Page 3 csocov- 2

Wolf5berg Group Corresccneeot Ban king Due Oiligenc@ Ques lionnaire (CBOOO) V1.2

3. AML CTF & SANCTIONS PROGRAMME 19 Does the Entity have a programme lhat sets

minimum AML, CTF and Sanctions standards reoardmo the followirvi comconents:

19 a Appointed Officer with sufficient No excerience/exnertise

19 ~ Cash Raoortinc Yes 19 C CDD Yes 19 d EDD Yes 19 e Beneficial Ownershio Yes 19 I lndeoendent T esnnc Yes 190 Periodic Review Yes 19 h Pohcies and Procedures Yes 19 i Risk Assessment Yes 19 i Sanctions Yes 19 k PEP Screeninc Yes 19 I Adverse Information Screenino Yes 19m Susoicious Activ1tv Renortinn Yes 19 n Trainina and Education Yes 19 0 Transaction Monitcrina Yes 20 How many full lime employees are In the

Entity's ArJL, CTF & Sancllons Comphance SO•Oeoartrnent?

21 Is the Enlily's AML, CTF & Sanctions po(icy approved at least annually by the Board or Yes eauivalent Senior Mananement Committee?

22 Does lhe Board or equivalent Senior Management Committee receive regular Yes reporting on the status of lhe AML. CTF & Sancnons oroorarnme?

23 Does !he Entity use lhird parties to carry out any components of its AML. CTF & Sanctions No

I orcoramme? 23 a If Y, provide further details ONB holds downstream ccrresoonoent ban1<rng with 99 smaller Noiweg1an and 3 Swedish

banks The due diligence of their customer is handled by !he downstream bank. but 1s supervised by DNB.

24 Confirm Iha! all responses provided 1n lhe above Section AML. CTF & SANCTlONS Programme Yes tare Reoresentative of au tho I ►'c branches

24 a If N_ clarify which questions lhe drtlerence/s relate to and the branch/es that this applies to

24 b If appropnate. provide any additional lnformatron I context to the answers In this secnon.

© The. Wolfsbe<g Group 20l8 Page. '1 CBODQ vr 2

Wolfsberg Group Correspondenl Ban lo.: in g Due 01l1gcnce Ouesttonnarre (CBDDQ) Vl 2

4. ANTI BRIBERY & CORRUPTION 25 Has the Entity documented policies and

procedures consistent with aopncabie ABC regulations and requiremen{s to {reasonably) Yes prevent. detect and report bribery and corruption?

26 Does the Enlity have an enterprise wide programme that sets minimum ABC standards? Yes

27 Has the Entity appointed a designated officer or officers with sufficient expenence/expernse

Yes responsible fo, coordinating the ABC programme?

28 Does the Enflty have adequate staff with appropnate levels of experience/expertise 10 Yes implement lhe ABC programme?

29 ls the Entity·s ABC programme applicable to

29 a Joint venlures Yes 29 b Third parties acting on behalf of the Entity Yes 30 Does the Entity have a global ABC pohcy !hat:

30. Prohibits the givir.g and receiving of bnbes? This includes promising. offenng, giving. scl.crtatron or receiving of anything of value. Yes directly or mdirectly. 1f rm properly intended lo infiuer.ce action or obra.o an advantage

30 b Includes enhanced requirements regarding interaction with public officials? Yes

30 C Includes a prohibition against the fals1ficahon of books and records (this may be wilhrn the ABC

Yes policy or any other pohcy applicable 10 the Legal Entity)?

31 Does the Entity have controls 1n place to monitor the effectiveness of their ABC Yes programme?

32 Does the Entity's Board or Seruor Management Ccwneee receve regular ~.anagement Yes Information on ABC matters?

33 Does the Entity perform an Enterprise Wide ABC nsk assessment? Yes

33 a Jf Y select the frequency 12 Months 34 Dees the Entity have an ABC residual risk rating

that is the net result of lhe controls Yes effectiveness and the rnherent nsk.

assessment?

Page 5 CBODOV1 2

Wolfsber9 Group Correspondent 0:in king Due Oihgence Ques tionnaire {CBODQ) V1 2

M -·6oesthe Er'lw°y:s ABC EWRA cover !he Irherem 'isk components detaned below

IJS a 'cotential riatul1ty created by intermedianes and \ Yes bt~.er tt-1rd-oany prov1de1s as apprcperate

fls b crrupucn nsks associated wilh the countries ~ rdustnes 1n which !he Enuty does business. Yes ~irectlv or tnrouch m1e,med1aries

5"5 C raosecnons. products or services. ,eluding hoselhat involve state-owned or state-corarcueo Yes

' entities or puo11c officials

5d }:orruption ris~s associated with gifts and hosprtahty ti1nngMHernships, chantabre Yes bcoanoos and pohtrcal corwibuhons

:15. hanges in business acfivares Iha! may hiaterr.;lly increase the Entity's corruption risk Yes

~6 Does me Ent11y·s mteroa! audit function or other ooeoeoceor third oartv cover ABC Polices and Yes Procedures? ...

07 bees the Ent ty provide mandator1 ABC Haining 0

61. Board and Senior Committee Management Yes

137 b s1 Line of Defence Yes

07 C t2nd L;r.e of Defence Yes

~7 d Ord Line of Defence Yes

tire t3rd parties !o Nhich specfic comoharce activities

I SubJect 10 ABC nsk have been outsourced

No

i' f Non-employed wor cers as appropriate ccntractorsfconsu1taNs)

Yes

I i

rs Poes the En11ty o<ov,de ABC \raining !hat is ;1argeled to speolic -o.es . respons.tnriues and

Yes .acuviues? I

9 Eonfirm tha~ all eesconses provided in the above ~ecbon Anh Bnbery & Ccrrvpuon are

Yes epresentauve of a!I ;tie LE's branches

09 a f N, clarify wliich quest.cos tne difference/s elate to and the branchtes that tbts applies !O

09 b I appropnate. orov,de any additional 1nforrna!1on context lo the answers in this section.

~.) i'"lo W:ilfsoorg Group 2018 Page 6 CBDOD V\.2

Wolfs berg Group Ccnesponcenr Banking Due Diligence Questionnaire (CBODOJ Vl.2

5 POLICIES & PROCEDURES 4() Has the Enhty docurnerueo pOlicies and

procedures consistent with applicable AML. CTF & Sanctions regulations and requirements to reasonabl , orevent cetect and r-- ·-·

40 a Monev laundenno Yes 4-0 b Terronst financing Yes 4() C Sanctions violations Yes 41 Are the Enhty's policies and procedures

Yes oocateo at teasl annuallv? 42 Are the Entity's policies and procedures gapped

acamsvcomoareo to:42 a US Standards Yes 42 al If Y, does the Enl1ty retain a record of the

Yes results? 42 b EU Standards Yes 42 bl If Y. does the Entrty retain a record of the

Yes results? 43 Does the Enl1ty t-<ave policies and procedures

lhal

43 a Prctublt the opening and keeping of anonymous and ficlitious named accounts Yes

43 b Protubtt the opening and keeping of accounts for unlicensed banks and/or NBFls Yes

43 C Prohibrt dealfng with other entities that provide banking services ;o unlicensed banks Yes

43 d Prohibit accourus/retauoosnips wIlh sheli banks Yes

43 e Prohibit dealing with another entity that provides services to shell banks Yes

43 f Prohibit opening and keeping of accounts for Section 311 designated entities Yes

43 g Prohibit opening and keeping of accounts for any of unlicensed/unregulated remittance agents, exchanges houses. casa de cambio, Yes bureaux de change or money transfer agenls

43 h Assess the risks of relationships with PEPs. including !heir family and close associates Yes

43 i Define escalation processes for financial crime risk issues Yes

43 j Define the process. where appropriate, for terminating existing customer re!alionships due Yes to financial crime nsk

43 k Specify how polenlia!ly suspicicus activity identified by employees Is to be escalated and Yes irwesl1gated

43 I Outline the processes regarding screening for sanctions. PEPs and negative media Yes

43 m Ou!tine the processes for the maintenance of internal "watchhsts" Yes

44 Has the Enlily defined a risk tolerance statement or srrrnlar document which defines a Yes risk boundary around their business?

45 Does the Entity have a record retention procedures that comply wilh apphcable laws? Yes

45 a If Y. what is the retenfion period? 5 Years or more

46 Confirm that all responses provided in the above Secuon POLICIES & PROCEDURES are Yes represeruatrve of all the LE's branches

46 a !f N. clanfy which quesucns the difference/s relate to and the branch/es that this applies to

46 b If appropriate. provide any add1tiona! information I context to the answers in this section

© The Wolfsberg Groep 201!3 Page 7 CBDDQV1 2

Wotfsberg Group Correspondent Banking Due Diligence Queslionnaire (CBOOQ) V1.2

6. AML CTF & SANCTIONS RISK ASSESSMENT 47 Does the Entity's AML & CTF EWRA cover the

inherent risk components detailed below

47 a Client Yes

47 b Product Yes

47 C Channel Yes

47 d Geog1aphy Yes

48 Does !he Entity's AML & CTF EWRA cover the controls effectiveness componen!s detailed below

48 a Transacl•on Monitoring Yes

48 b Customer Due Odigence Yes

48 C PEP Identification Yes

48 d Transaction Scresmno Yes 48. Name Screen,ng against Adverse Media &

Negative News Yes

48f Training and Education Yes

48 g Governance Yes

48 h Managernenl Information Yes

49 Has the Entity's AML & CTF EWRA been completed in the last 12 mcn1hs? Yes

49 a If N, provide the date when the last AML & CTF EWRA was completed

50 Does the Entity's saocuor-s EWRA cover the mherent nsk. components detailed below·

50 a Client Yes

50 b Product Yes

50 C Channel Yes

50 d Geography Yes

51 Dees !he Entity's Sanctions EWRA cover the controls effectiveness components detailed below:

51 a Customer Due Diligence Yes

51 b Transaction Screening Yes

51 C Name Screening Yes 51 d List Management Yes

51 e Training and Education Yes

51 f Governance Yes

51 g Managemenl Information Yes

52 Has the Entity's Sanctions EWRA been completed in the last 12 months? Yes

52 a If N. provide the date when lhe last Sar.ctions EWRA was compleled

53 Confirm that all responses provided 1n the above Section AML. CTF & SANCTIONS RISK ASSESSMENT are representative of all the Yes

LE·s branches

53 a If N, clarify which questions thedifferencefsrelate to and the branch/es that this applies 10.

53 b If appropriate. provrde any additional information/ context to the answers 1n this section.

© The Wotfstlefg Group 2018 Peqe 8 csooo vi.z

Wolfsbe: rg Group Com~spondent Banking Due Diligence Quesliorin afre (CBODQI V~ 2

7 KYC COD and EDD 54 Does the Entity verify the 1denlity of the

customer? Yes

55 Oo lhe Entily°s pohcces and procedures set out when CDO must be completed, e g at the time Yes of onboardir,g or within 30 days

56 Which of the following does the Entity gather and rela n when conducting COD? Select all !hat apply

56 a Ownership structure Yes 56 b Customer idenflficat1on Yes 56 C Expec!ed activity Yes 56 d Nature of business/employment Yes

56 e Product usage Yes 56 f Purpose and nature of relatrcnship Yes 56 g Source of funds Yes 56 h Source ;:,f wealth Yes 57 Are each of the fot!ow1ng identified

57 a Ullimate benefrciat ownership Yes 57 a1 Are ultimate beneflcal owners verified? Yes 57 b Authorised signatories (where applicable} Yes 57 C Key controllers Yes 57 d Other relevant parties

58 Whal is lhe Entily's rmnimum (lowest} threshold applied to benef:c1al ownership Ident1fication ? 10%

59 Does the due drligence process result in easterners receivmq a risk classikatfon?

Yes

60 If Y, what factors/crttena are used to determine the customer's nsk ciassificalion? Select an \hat apply·

60 a Product Usage Yes 60 b Geography Yes 60 C Business Type/Industry Yes 60 d Legal Ent,ty type Yes 60 e Adverse tnforrnanon Yes 60 f Other (specify)

Complexly of ownership structure, Source of fond

9 The Wolfsberg Group 2018 Page 9 csooo v- 2

Wolfs-berg Group Correspondent Banking Due Diligence Questionnaire ICBDDQ J V\.2

61 Does the Enl1ty have a risk based approach lo screening customers for adverse Yes media/negative news?

62 !f Y, is this at

62 a On boarding Yes

62 b KYC renewal Yes

62 C Trigger event Yes

63 What 1s the method used by the Entity la screen fer aove-se media I negative news?

63 a Automated Yes

63 b Manual Yes

63 C Combination of automated and manual Yes

64 Does the E nt1ty have a nsk based approach to screening customers and connected parties to deterrmoe whether they are PEPs or controHed Yes by PEPs?

65 If Y, is this at·

65 a Onboarding Yes

65 b KYC reoewa' Yes

65 C Trigger event Yes

66 What is the method used by the Entity to screen PEPs?

66 a Automated Yes

66 b Manual Yes

66 C Comb.naucn of automated and manual Yes

67 Does the Entity have pone.es, procedures and orocesses to review and esca ale potenhal matches from screening cuslomers and connected parties to determme whether !hey Yes are PEPs. er conlrotled by PEPs?

68 Does lhe Entity have a process !o review and update customer mformar1on based on

68 a KYC renewal Yes

68 b Trigger event Yes

69 Does the Entity maintain and report metncs an current and past periodic or trigger event due

Yes diligence reviews?

'VThe wo1r~oecg G1oup 2018 Page 10 csooo v, 2

Wolfsberg Group Correspondent 83nklng Que Diligence Quutoonn,we (CBODQ) V1 2

(70 From the hst below. which calegories of customers or mdustnes are suoject to EDD and/ or are restncted, or prohibited oy the Entuv's FCC programme?

70 a Non-account customers Proh bned 70 b Offshore customers EDD & Restr1cted on a risk based approach 70 C Shell banks Proh1b1ted 70 d MVTSI MSB customers EDD on a risk based approach 70 e PEPs EDD on a risk based approach 70 f PEP Related EOO on a rrsk based approach 70 g PEP Close Associate EDD on a risl( based approach 70 h Correspondent Banks EDD an a risk based approach 70 h1 If EDD or EDD & Rssrrtcted. dces the EDD

assessment contain the elements as set ou! In the Wolfsberg Correspondent Banking Yes Ponc.otes 2014?

70 i Arms. defense. rrulrtary EDD & Restricted on a risk based approach 70 j Alamrc power P1ohib1ted 70 k Extractive 1ndus1r,es EDD & Restncted on a risk based approach 70 I Precious metals and stones Prohib ted 70-m UnreguI21ed cnaones EDD Of"'I a risk oased approach 70 n Regulated charities EDD on a risk based approach 70 O jRed !rght business f Adult entenainment P<0/",1b led 70 p Non-Goverrunen! Organisations EDD on a risk based approacn 70 q Vinual currencies EDD on a nsk based approach 70 r Marijuana Pror'1bited 70 s Embassies/Consulates EDD on a risk based approach 70 t Gambling EDD & Restncted on a risk based approach 70 u Paymenl Servrce Provider EDD & Restricted on a risk based approach 70 s Other (specify)

71 If restricted prov-ce details of the Arms. defense m11ttary- Norwegian qovernmentat owned compan,es only Virtual currencies Only . restriction small private investment Gambling Norwegian Governmenrar controlled {Sla!e Monopoly) cornoarues only Payment Servrce Provider License from FSA only Alt are suotect to EDD.

72 Does the Entity perform an add1honaI control or quality review en clients subject to EDD? Yes

73 Confirm !hat all responses proviced 1n the above Section KYC, COD ard EDD are Yes representative of all the LE's branches

73 a ff N. clanfy which cuesucns the difference/s retate to and the branchtes thal ihis apphes to

73 b If appropriale, provide any additional information I context :o the answers rn th,s section

:i The: WolfsDerg Group 2018 Page:' CBDDQ Vl 2

Wolfsberg Group Correspondent Banking Cue 011igence Questionnar,e (CBOOO) 111. 2

8. MONITORING & REPORTING 74 Does the Entity have risk based policies,

procedures and monitonng processes for the identification and repartIng of suspicious Yes activity?

75 Whal is the method used by the Entity lo monitor lransactions for suspicious acliv1hes?

75 a Automated Yes

75 b Manual Yes

75 C Comb.nation of automated and manual Yes

76 1f manual or combination selected specify what Manual control of transactions for a period specified 1n the risk based EDD type of transactions are monilored manually

77 Does the Entity have regulatory requirements to report currency lransactions? Yes

77a If Y. does the Entily have coheres procedures andprocesses to comply with currency Yes reporting requirements?

78 Does the Entity have coheres. procedures and processes to review and escalate matters arising from the monitonng of customer Yes transactions and acuvity?

79 Confirm that all responses provided in the above Section MONITORING & REPORTING are represeoranve of all the LE's branches Yes

79 a If N, clanfy which questions !he d,fference/s relate to and the branch/es that this applies to

79 b If appropriate, provide any additmnal informat10:1 / context to lhe answers in this section

9. PAYMENT TRANSPARENCY 80 Does the Entity adhere to the Wolfsberg Group

Payment Transparency Standacds? Yes

81 Does the Entity have oolicles. procedures and processes to [reasonably} comply with and have controls in place to ensure comphance with

81 a FATF Recommendation 16 Yes

81 b Local Regulations Yes

81 bl Speofy lhe regulation The Norwegian Money Laundenng Act of June 1st 2018 https://lovdata .no/dokumenVN Ulov/20 18-06--01-23

81 C If N. explain

82 Does the Entity have processes In place to respond to Request For Information (RF ls) from other ennues In a timely manner? Yes

83 Does the Entity have controls to support the mclusron of required and accurate origmator mfcrrnatron in international payment messages? Yes

~The WOltsbe<g Grove 2018 Page 12 C80DQV1 2

Wolfsberg Group Conesccocem Bankmg Due, O lllgenct-Oucsllonn., ,e (CBOOQ} V1.2

84 Does the Enlify have controls to support the inclusion of required beneficiary In internaiional payment messages? Yes

85 Confirm that all responses provided in the aboveSection PAYMENT TRANSPARENCY are represenrahve of au the LE·s branches Yes

85 a lf N. clarify which questions the ditterence/s relate lo and the branch/es that this applies to

85 b If appropnate. provide any additional informa!ion I context to the answers in this section

10. SANCTIONS 86 Does the Entity have a Saoctrons Policy

approved by management regarding compliance with sanctions law applicable to the Entity, including with respect its busmess Yes conducted with, er through accounts held at foreign financial mstttutions?

87 Does the Enlity have policies. procedures, or other controls reasonably designed to prevent the use of another entity's accounts or services in a manner causing the other enl!ly to violate sanctions probibutcns applicable to the other Yes enllly (;nclud1ng crotnbmcns within the other entity's local jurisdiction)?

88 Does the Entity have policies. procedures or other controls reasonably designed to prohibit and/or detect actions taken to evade apotcaote sanctions proh1b1tions, such as stripping. or the

Yes resubrnrssron and/or masking. of sanctions relevant information 1n cross border transactions?

89 Does lhe Entity screen its customers. rnc!uding beneficial ownersh•p information collected by the Entity, during onboarding and regularly Yes thereafter against Sar.clions Lists?

90 What is the method used by 1ne Entity?

90 a Manual Yes 90 b Automated Yes 90 C Combinalion of Automated and Manual Yes 91 Does the Entity screen all sanctions relevant

dala. including at a minimum. entity and Jocatron mtcrmanon contained in cross border Yes transactions against Sanctions lists?

92 What is the method used by the Entity? 92 a Manual Yes 92 b Automated Yes 92 C Combination Aulcmaled and Manual Yes 93 Select lhe Sanctions Lists used by the

Entity in its sanctions screening processes.

93 a Consolidated Un,ted Nations Security Council Sanctions Lisi (UN) Used for screening customers and beneficial owners and for filtering l<ansaclional data

93 b United States Department of the Treasury's Office of Foreign Assets Conlrol (OFAC) Used for screening customers and beneficial owners ar.d for Mtenng transactional data

93 C Office of Financial Sanctions imotementauon HMT(OFSI) Used for screening customers and beneficral owners and for f1lterrng transactlonal data

93 d European Union Consolidated List (EU) Used for screening customers and beneficial owners and for liltenng transactional data

93 e Lists maintained by other G7 member countrres

Y The Wottsbetg Groep 2018 Page 13 CBDDQ V1 2

Wolfsbetg Gt0 up Correspondent Banking Due Diligence Ouestionnafre (CSOOOI V12

93 f Other (spec;fy)

Local lists 1n Norway China and Singapore 92a: Manual control of an transactions for a period specified risk based EDD

94 When new entities and natural persons are added lo sanctions lists, how many business Same day to 2 days days before the Enlity updates its lists?

95 When updates or additions to the Sanctions Lists are made, how many business days before the Entity updates their active manual and J or automated screening system against.

95 a Customer Data Same day

95 b Transactions

Same day

96 Does the Entity have a physical presence. e.g , branches. sucsrdianes. or represeruatrve offices located 1n countnes/regions agaIns1 which UN. No OFAC, OFSt, EU and G7 member countries have enacted comprehensive junsdlctton-based Sancuons?

97 Confirm that all responses provided in the above Section SANCTIONS are represenlahve Yes of alt the LE's branches

97 a If N. clarify which questions the d1fference/s relate to and the branch/es that this applies to

97 b If appropriate. provide any add1Honal information / context to the answers 1n this section

11. TRAINING & EDUCATION 98 Does the Entity provide mandatory training.

which Includes

98 a Identification and reporling of transactions 10 government authorities Yes

98 b Examples of different forms of money laundering. terrorist financing and sanctions viotations relevant for the types of products and Yes services offered

98 C Internal policies for controlling money Iaundennq. terrorist financing and sanctions Yes violations

98 d New issues that occur in !he market, e g , significant regulatory actions or new regulations Yes

98 e Conduct and Culture Yes

99 Is the above mandatory training provided to ·

99 a Board and Senior Committee Management Yes

99 b tst Lir:e of Defence Yes

99 C 2nd Line of Defence Yes

99 d 3rd Line of Defence Yes

99 e 3rd parties to which specific FCC acHvities have been outsourced No

99 f Non-employed workers (conlractors/consultants) Yes

100 Does !he En!ity provide AML. CTF & Sanctions \raining Iha! 1s targeted to specific rotes, resoonsrbmtres and high rrsk products. services Yes and act'v.tres?

~ The Woltsberg Group 2018 Page M CBDDO V1 2

Wolfsberg Group Correspondent Bclnking Due Oillgence Oueslionnaue (CBOOQ) V1 2

101 Dees !he Entity provide customised training for AML, CTF and Sancltons staH? Yes

102 Confirm that all responses provided in !he abcvaSecnon TRAINING & EOUCAT!ON are

Yes reoreseorauve of au the LE's branches

102 a If N, clarify which questrons the difference/s relate to and the branch/es that this applies to

102 b If appropriate. provide any addihonal mtormahon / context to the answers 1n this section.

12. QUALITY ASSURANCE /COMPLIANCE TESTING 103 Are the Entity's KYC processes and documents

subject to quahty assurance 1esting? Yes

104 Does the En!tty have a program wide nsk based Compuance Testing process (separate lo the independent Audit function)? Yes

105 Confirm that all responses provrded rn the above Section QUALITY ASSURANCE / COMPLIANCE TESTING are represenlative ol Yes all the LE's branches

105 a If N. clarify which quesnons the differer.eels relate to and the branch/es that !hrs applies to

105 b If appropriate. provide any additional mfo,mation I contexl to the answers in this section.

13. AUDIT 106 In addition to inspeclions by the government

supervisors/regulators. does the Entity have an internal audit function. a testmg function or other independent third party, or both, that Yes assesses FCC AML, CTF and Sanctrons polrcres and practices on a regular basrs?

107 How often is the Entity audited on 11s AML. CTF & Sanctions programme by !he following

107 a Internal Audi! Department Componenl based reviews

107 b External Third Party Component based reviews

© The Wo!fsberg G1oup 2018 Page 15 CBODQ V1 2

Wolfsber9 Group Corrupondent 3anking Due 01hgence Oues11onna1re (CBDOO) Vt 2

108 Does 1he internal avdrt Iuncucn or Olher independent lhird party cover :ne following areas

108 a AML CTF & Sanctions policy and wocedures Yes

I 108 b KYC f COD i EDD and underlying Iv., methcoctoqres

108 C Transactior Monitoring Yes

108 d Transaclior Screening 1n,;l:;ding for sanct'ons Yes

108 e Name Screenirg & List Management Yes

108 f Tra1n1ng & EdJcatior, Yes

108 g Technology Yes

108 h 1 Governance Yes

108 1 Reportmq/Metrics & Management lnfo-rnation Yes

108 j Suspioous Act1vrly Filing Yes

108 k !Enterprise Wide Risk Assess-neot Yes

108 I [Other (spec,fy)

109 Are adverse findings from internal&. externat audit tracked 10 ccmctehon and assessed for

Yes adequacy and comp eteness?

110 Confirm Iha! all responses provided 111 1he aooveSecuon.Atrtn" are renresertanve of 31! Yes the LE's branches

noa If N. clarify •Nhich quesuons the difference/s relate to and the brar,ch/es that th.s apphes to

110 b If appropriate, provide any additional information I context to !he answers 1r. ihis section.

i'

J l'ie \/IJolfsbErg Group 2018 Page 16 CBODOV\2

Wolfsberg Group Correspondent Banking Due Diligence Questionnaire (CBDDQ) Vl.2

Declaration Statement

Wolfsberg Group Correspondent Banking Due Diligence Questionnaire 2018 (CBDDQ V1 .2)

Declaration Statement (To be signed by Global Head of Correspondent Banking or equivalent position holder AND Group Money Laundering Prevention Officer, Global Head of Anti- Money Laundering, Chief Compliance Officer, Global Head of Financial Crimes Compliance OR equivalent)

DNB Bank ASA (Bank name) is fully committed to the fight against financial crime and makes every effort to remain in full compliance with all applicable financial crime laws, regulations and standards in all of the jurisdictions in which it does business and holds accounts.

ON B Bank ASA (Bank name) understands the critical importance of having effective and Sustainable controls to combat financial crime in order to protect its reputation and to meet its legal and regulatory obligations

D NB Bank ASA (Bank name) recognises the importance of transparency regarding parties to transactions in international payments and has adopted/is committed to adopting these standards.

DN B Bank ASA (Bank name) further certifies it complies with/is working to comply with the Wolfsberg Correspondent Banking Principles and the Wolfsberg Trade Finance Principles. The information provided in this Wolfsberg CBDDQ will be kept current an{Uf~I ~ ~dateq n~,~~frequently than on an annual basis.

UN ts t)anK /-\::JP. (Bank name) commits to file accurate supplemental information on a timely basis.

1,6 ST GI./) l\jo RD l10 r, P (Global Head of Correspondent Banking or equivalent), certify that I have read and understood this declaration, that the answers provided in this Wolfsberg CBDDQ are complete and ccw.;\~ ~ ho~stJ:,liJi~f, and that I am authorised to execute this declaration on behalf of UN ts t)anK A"::JP-. (Bank name)

H C6t E t+ A:€te., 1-()I, KR \6Tl06 F R,QcR.H-ot....l(MLRO or equivalent), certify that I have read and understood this declaration, that the answers provided in this Wolfsberg CBDDQ are complete and correct to my honest belief, and that I am authorised to execute this declaration on behalf of (Bank name)

. ~- / _!j/, J O ttEGrE 1-M6zfJ•0 · . , .

~. _,., '_ vfa1'7 7 / I I C:1~-.0D'\h. ;'\r-'\k_ rtAr0_"-61e:::t(_('tLCO)

~- ~~. ature & Date (00/MM/YYYY)) rcR.l<SDNE: F R.US~t\,.ow - 6ll..-OD!\t.... rV--\. !--.. w "'0---\A:~t:.. orrlteR_

Y\o_ c[!,J-tf-19 {zw~ tJQ.,h'\fb Y lff O<U:io<f (Signature & Date (DD/MM/YYYY)) k:,Te..-~ o e N oe.,oroQ.p

G..t-..,0GA-1....... t+-E::A-D () ~Col2.R-E~po r{()-E,rJ T -8 Arv'GiNf.J..

© The Wolfsberg Group 2018 Page 17 CBDDQ Vl.2