Appendix 3 — Closure review timeframes The below tables define the timeframes of the closure review procedures in the various scenarios (DCOlICO review required. GA validation required). Rwandalion coenvattaid I FoOng ounorpespases Ream ea Lvascesal ROMS I And abate mono! 'tonna germ' Finding 7 aiget Dart &tea set lo Towed by lits.weiricie =Fasoao.". OCOS # Cc's es( ofirontlie b Te Dade% 7W lore-tee, 'elks*: t'('4- fesIthv. so's?, ;net wee t [ix/v*10010f O'ne pray TON OM Validation completed &anus sal to 'Qos44 by 0, oup Amer Appendix 4 — Local deviation to Group Audit validation requirements The below tables define deviations to the minimum standards for GA validation diven by local regulatory requirements. Regulator Chita (CBIRS) Taiwan (various) Snooper. (MAS) Requirement for validation 3 year - regulatory findings 2 years - regulatory findings 1 year - regulatory findings Treatment Standalone GA validation might be required a Ihe audit cycle for the related process and location is longer US (FRB) 90 days - regulatory findings South Korea (FSS) 2 - 6 months after regulatory report issuance - regulatory findings only When validation is requested by the regulator. Regulatory Findings must be validated within 12 months of closure Regulatory Findings must be validated before the Siding is reported to the regulator as closed Ukraine (NBU) Hungary (NBH) Poland (Polish FSA) Ad hoc /as and when needed For internal use only Page 12 og 12 CONFIDENTIAL - PURSUANT TO FED. R. CRIM. P. 6(e) DB-SDNY-0042471 CONFIDENTIAL SDNY_GM_00188655 EFTA01356563