2005. Notified this 23th Day of November 2004. Thirachai Phuvanatnaranubala (Mr. Thirachai Phuvanatnaranubala) Secretary-General The Office of the Securities and Exchange Commission Risk Disclosure

such change to the SEC Office within seven days from the effective date of the change specifying therein the effective date of such change. Clause 3. The SEC Office shall notify the derivatives business

of the Information Technology of a Securities Company. 2. Segregation of Duties. 3. Physical Security. 4. Information and Network Security. 5. Change Management. 6. Backup and IT Contingency Plan. 7

incidents which may cause major operational disruptions Notified this 21st day of October 2016. (Mr. Rapee Sucharitakul) Secretary-General Office of Securities and Exchange Commission Appendix Division 1

which satisfies the need of the users, and it shall communicate the development or change to all concerned persons for acknowledgement in order to be able to operate it correctly. Clause 8. The securities

foreign country, there shall be consideration on change or uncertainty regarding economic, political, social and legal issues of the foreign country as well as the complexity in business continuity

use of IT assets ; (3) in case of any change to the responsible person or unit, protection roles and responsibilities to relevant IT assets should be reviewed. Clause 16 IT assets associated with

written by such board of directors. In case of any material amendment, change or modification to such policy and plan, intermediaries shall comply with the requirement set out in the first paragraph (1) or

board to be in charge of the implementation of the business continuity management policy. In case of any material amendment, change or modification to the business continuity plan, the securities company

the qualifications under Clause 3(6), (7), (8) and (9) as provided in the application except where there is any difference in detail to the extent that it will not materially change the qualifications