UNOFFICIAL TRANSLATION Readers should be aware that only the original Thai text has legal force and that this English translation is strictly for reference. 30 Notification of the Office of the Securities and Exchange Commission No. Nor Por. 3/2559 Re: Guidelines for Establishment of Information Technology System ______________________ Whereas the Notification of the Capital Market Supervisory Board No. Tor Thor. 35/2556 Re: Standard Conduct of Business, Management Arrangement, Operating Systems...

undisclosed except in the case of disclosure by virtue of law or for the benefit of the financial institution system or the public; (e) members shall not help or support fraudulently any act deemed to be an

those mentioned above, penetration testing shall be carried out at least once every six years. (b) carry out vulnerability assessments with all critical information systems at least once a year and upon

suit the market needs and to serve customers better. In addition, this will help reduce personnel training costs for securities companies which regularly organize in-house training. 3. Duration of

prior approval from the Office, which will help facilitate their business operation.

accordance with the Good Corporate Governance Guidelines for listed companies in 2017 to support assessments such as Corporate Governance Report, ASEAN CG Scorecard and the Shareholders’ Meeting Quality

order of importance; 6.3.3 The Company may disclose action in other matters in accordance with the corporate governance principles in preparation for assessments, for example, Corporate Governance Report