THOMAS MURRAY RISK RATING REPORTS – STRUCTURE AND CONTENT AND METHODOLOGY CAIRO October 2011

© 2011 Thomas Murray Ltd. Page 2 PRIVATE AND CONFIDENTIAL Agenda Why TM has developed Risk Reports? Risks Assessed Risk Weights Risk Factors

© 2011 Thomas Murray Ltd. Page 3 PRIVATE AND CONFIDENTIAL Investor Exposure TM CSD Risk – Why TM Risk Reports are required?

© 2011 Thomas Murray Ltd. Page 4 PRIVATE AND CONFIDENTIAL Risk Definitions Asset Commitment Risk - The period of time from when control of securities or cash is given up until receipt of counter value. Liquidity Risk - The risk that insufficient securities and or funds are available to meet commitments; the obligation will be covered some time later. Counterparty Risk - The risk that a counterparty (i.e., a participant) will not settle its obligations for full value at any time. Asset Servicing Risk - The risk that a participant may incur a loss arising from missed or inaccurate information provided by the depository, or from incorrectly executed instructions, in respect of corporate actions and proxy voting. Financial Risk - The ability of the CSD to operate as a financially viable company. Operational Risk - The risk that deficiencies in information systems or internal controls, human errors or management failures will result in losses. Risks Assessed

© 2011 Thomas Murray Ltd. Page 5 PRIVATE AND CONFIDENTIAL CSD Services CSD Risk changes as they move up the value chain

© 2011 Thomas Murray Ltd. Page 6 PRIVATE AND CONFIDENTIAL Risk Definitions Two New Risks Asset Safety Risk - The risk that assets held in custody at the CSD may be lost or misappropriated, either due to a default or an omission, misuse, or breakdown of controls (legal, operational or other). Governance & Transparency Risk - The risk that losses will occur due to poor governance and management arrangements and inadequate disclosure of information.

© 2011 Thomas Murray Ltd. Page 7 PRIVATE AND CONFIDENTIAL Overall Risk Average Rating - ACSDA Average Rating – EU/EEA Average Rating – Eurasia Average Rating – Asia Pacific Average Rating – Africa Average Rating – Middle East Key Issues The Overall Risk rating is a weighted average of the other six risk types. The risks are divided into 3 groups; Settlement, CSD Operation and Asset Servicing and each group is given equal weighting. Settlement group comprises of Asset Commitment, Liquidity and Counterparty Risk. CSD Operation comprises Financial and Operational Risks. The weights can vary depending on the degree to which the CSD undertakes Asset Servicing activities. The weights will need to be revised with the inclusion of Asset Safety and Governance & Transparency Risks. AAA AA+ AA AA- A+ A A- BBB BB B CCC CC C Rating Risk Weights

© 2011 Thomas Murray Ltd. Page 8 PRIVATE AND CONFIDENTIAL Risk Weights

© 2011 Thomas Murray Ltd. Page 9 PRIVATE AND CONFIDENTIAL Asset Commitment Risk Risk Factors Asset commitment risk is a quantitative measurement of the asset commitment period for every type of settlement process Most depositories have different ways of settling transactions, which could depend on place of trade execution (e.g. on-exchange or OTC), different markets, choice of processing cycle (Batch or real- time) or even asset class The weighting given to each process is determined by the value percentage of transactions going through each settlement process. AAA AA+ AA AA- A+ A A- BBB BB B CCC CC C Rating Average Rating - ACSDA Average Rating – EU/EEA Average Rating – Eurasia Average Rating – Asia Pacific Average Rating – Africa Average Rating – Middle East

© 2011 Thomas Murray Ltd. Page 10 PRIVATE AND CONFIDENTIAL Liquidity Risk AAA AA+ AA AA- A+ A A- BBB BB B CCC CC C Rating Risk Factors The settlement processing model adopted by a CSD usually follows either Gross or Net settlement. The number of settlement cycles and the netting efficiency of the processing is a key component in assessing the effectiveness of the settlement model. The appropriate fails management regime operated by the CSD hinges around the range and timing of approaches used, factored by the actual settlement rate The ability of clients to access credit facilities is critical to their ability to provide timely funding of a trade Securities borrowing and lending (SBL) provides for securities shortfalls. Matching processes in the market for CSD settled transactions assess both client side matching and market side matching and are given equal weighting. Also take into account the registration arrangement and the proportion of securities on issue held within the CSD. Average Rating - ACSDA Average Rating – EU/EEA Average Rating – Eurasia Average Rating – Asia Pacific Average Rating – Africa Average Rating – Middle East

© 2011 Thomas Murray Ltd. Page 11 PRIVATE AND CONFIDENTIAL Counterparty Risk AAA AA+ AA AA- A+ A A- BBB BB B CCC CC C Rating Risk Factors The most important principle to control counterparty risk is the use of Delivery versus Payment (DVP) settlement; which is the interdependent transfer of securities against cash. Participants should have minimum capital requirement specified and appropriate technical resources. Some surveillance should be undertaken on participants activities and their exposure levels. The ability to manage a default is assessed in terms of the structure and financial resources available to guarantee all open obligations of the party that has defaulted (a guarantee fund). Where a CCP is available, these are assessed as the ultimate counterparty in a market Average Rating - ACSDA Average Rating – EU/EEA Average Rating – Eurasia Average Rating – Asia Pacific Average Rating – Africa Average Rating – Middle East

© 2011 Thomas Murray Ltd. Page 12 PRIVATE AND CONFIDENTIAL Asset Servicing Risk Average Rating - ACSDA Average Rating – EU/EEA Average Rating – Eurasia Average Rating – Asia Pacific Average Rating – Africa Average Rating – Middle East AAA AA+ AA AA- A+ A A- BBB BB B CCC CC C Rating Risk Factors Asset servicing is undertaken to various degrees by CSDs Where the CSD is not involved in executing voluntary corporate actions or does not play a primary role in asset servicing, the weighting of this risk is reduced. There are two key focal points to this risk – the first involves the collection and dissemination of information and the second is the receipt and execution of instructions. There are other areas such as proxy voting and other related services eg tax services that are also included where these are (rarely) pursued by the CSD.

© 2011 Thomas Murray Ltd. Page 13 PRIVATE AND CONFIDENTIAL Financial Risk Average Rating - ACSDA Average Rating – EU/EEA Average Rating – Eurasia Average Rating – Asia Pacific Average Rating – Africa Average Rating – Middle East AAA AA+ AA AA- A+ A A- BBB BB B CCC CC C Rating Risk Factors Capital adequacy is an important criteria in ensuring the financial stability of a company. Profitability and revenue generation is assessed over a 5 year period. The strength and quality of ownership of the CSD becomes increasingly important were the CSD to be under duress. The standard of liability a depository assumes in relation to any claims against it by participants who may have suffered losses due to the actions or omissions of the CSD. The primary way a CSD can cover any claims is through acquiring adequate insurance. Another avenue of funds is through secured credit lines Also examine outstanding investments by the CSD in infrastructure (building, computer systems etc.)

© 2011 Thomas Murray Ltd. Page 14 PRIVATE AND CONFIDENTIAL Operational Risk Average Rating - ACSDA Average Rating – EU/EEA Average Rating – Eurasia Average Rating – Asia Pacific Average Rating – Africa Average Rating – Middle East AAA AA+ AA AA- A+ A A- BBB BB B CCC CC C Rating Risk Factors Identification of the risks and the key controls used to manage those risks. Documented procedures are required for all processes. All operations including IT operations should be subject to both internal and external audit. Appropriate DRP and BCP arrangements that have been fully and regularly tested are essential. Automation of processes reduces the risk of manual errors. Reporting arrangements to clients is also taken into account. Staff training helps manage risks when manual intervention is required.

© 2011 Thomas Murray Ltd. Page 15 PRIVATE AND CONFIDENTIAL Asset Safety Risk Segregation of Securities Legal Conventions Forms of Securities Liens Reconciliation and Audit Account Control Cash Deposits Risk Factors

© 2011 Thomas Murray Ltd. Page 16 PRIVATE AND CONFIDENTIAL Governance & Transparency Risk Board Arrangements Establishment of Risk Management Disclosure of Corporate Information Disclosure of Statistical Information User Group Arrangements Risk Factors

© 2011 Thomas Murray Ltd. Page 17 PRIVATE AND CONFIDENTIAL CSD Public Rating Operational Risk Ratings Rating AAA AA+ AA AA- A+ A A- BBB BB B CCC CC C Less importantImportant Critical Established procedures Identification of key controls Operational Audit Processing Reporting Disaster Recovery procedures Business Continuity Plan Staff training Indicates likely direction of any change in this factor. O1 O2 O8 O1 O2 O3 O4 O5 O6 O7 O8 O3 O5 Comparative Chart Average Americas - TM Proprietary Rating Average Eastern Europe – TM Proprietary Avge West Euro – TM Proprietary Avge Asia Pac – TM Proprietary Average Africa – TM Proprietary Avge Mid East – TM Proprietary S Public Rating CSD O4 O6 O7 O4 Example