NYSE Blue Security Concerns for Offset Registries July 26, 2011 © NYSE Blue. All Rights Reserved.

Security Framework for an Offset Program Registry Technology Know Your Client Procedures Program Legal & Operational Rules Training on User Best Practices Thank you Joel and good morning everyone; I just want to take a moment to congratulate Joel, Gary, and the whole CAR team for the recognition they’ve gotten over the course of the last few months. Having worked with this wonderful group of people for now over 3 years ….. I can tell you they deserve the appreciation! When Joel called and asked me to speak about registry security….I had 2 reactions.. 1. oh boy, how am I going to make this one interesting! 2. with my luck there will be a hacker in the audience who makes it his life mission to prove me wrong But seriously,there is a good story to tell about the security framework CAR has in place. That’s because long before the European issues broke….well over 2 years ago, Car was committed to working with then APX / NYSE Blue in creating a rigorous security framework for the registry. Since carbon is essentially unregulated, this security framework is not just about technology. -- although that is certainly important There are no regulators involved so CAR needs to include It also includes: know your client procedures, … proper operating rules;.. And informing users about best practices in using the registries. All of these things play an integrated role

Registry Technology Encrypted connection (HTTPS) Disable user ID upon 3 incorrect logins Ongoing vulnerability testing for registry Later this year, introduction of two-factor authentication

Know Your Client Procedures Identify clients and ascertain relevant information about their businesses Request copies of documents confirming identity of legal entity organization documents, memorandum of incorporation, bank accounts, utility bills Become familiar with the principals and ask for identification documents such as drivers license, passports, and birth certificates Review marketing materials and business plan Perform OFAC / AML checks to ensure entities not found on Terrorist Watch lists. Monitor activity to ensure it matches the company profile

Program Legal & Operational Rules Omnibus accounts Only a regulated entity can maintain an omnibus account (and these regulated entities must show proof of proper KYC procedures) Certain unregulated entities can be given the ability to maintain omnibus accounts Retail Marketers Retirement of greater than 99 credits on behalf of a client must be done in an specific client sub-account Retirement of greater than 99k credits on behalf of a client must be made public

Registry User Best Practices Use latest anti-virus protection programs Update contact information for users/logins to their account Perform weekly/monthly account reviews to ensure data is correct Users should not access The Reserve from public locations where others could capture their confidential information. Users should pay close attention to the registry notifications for transfer confirmations.