Third Party Due Diligence Policy and Procedures

May 2026 | Version 2.0

PREAMBLE

In today’s globally connected world, our reputation is as equally important as the quality of our products and services. In this vein, we need to be vigilant about protecting our brand, which includes carefully vetting third parties with whom we do business.

Third parties in a modern supply chain are incredibly diverse and can include anything from suppliers, distributors, agents, advisors, consultants, and even customers. Historically, companies have rarely been held accountable for the actions of their business partners. However, this has changed with social media reporting on misconduct as well as governments around the world passing and enforcing an ever-expanding list of laws that hold companies accountable for those acting on their behalf and with whom they transact as customers or suppliers.

We recognize that third parties are essential to our success. However, we also recognize that who we engage with reflects who we are as a company. Therefore, we need to be certain that we only deal with third parties who are reputable and are prepared to apply the same standards of business conduct as we do ourselves. To paraphrase Warren Buffett, ‘it can take a lifetime to build a good reputation, but only a matter of seconds to destroy it’.

APPLICABILITY

This Third-Party Due Diligence Policy and Procedures (the “Policy”) is applicable to DEA TopCo LP and DEA TopCo II LP, and all their direct and indirect, wholly owned and/or controlled, subsidiaries (“Digital Edge” or the “Company”) and their business operations globally, including all employees (including contract and temporary employees), directors, officers, and board members (“Company Personnel”). Digital Edge will use reasonable efforts to ensure its joint venture companies adopt this Policy or a similar policy which is consistent with the guidelines and procedures set forth herein.

Terms used in this Policy but not otherwise defined shall have the meanings ascribed to them in Schedule A.

Before entering into a relationship or renewing an existing relationship with a Third Party, a Sponsor must comply with requirements of this Policy. Violations of this Policy will result in disciplinary action by the Company, which may include termination of the Sponsor’s employment with the Company, and the termination of the Company’s engagement with the Third Party.

PURPOSE

The objective of this Policy is to ensure an appropriate level of due diligence is undertaken in respect of all Third Parties with whom the Company intends to engage in a business relationship, prior to engaging in that business relationship. This is to promote compliance by Digital Edge with our obligations under various laws, rules, and regulations as well as our Company policies, including our Code of Conduct, Global Trade Sanctions Policy, Anti-Money Laundering Policy, Anti-Bribery & Anti-Corruption Policy.

The type and robustness of the due diligence to be performed under this Policy will vary depending on the Level and Risk Rating of a particular Third Party. Due diligence may include informing these Third Parties (and associated companies) of this Policy, meeting with them to better assess their character, making commercially reasonable inquiries into their reputation and past conduct, financial checks, conducting background screenings and watch list checks, and obtaining compliance certifications from the Third Party.

THIRD PARTIES SUBJECT TO THIS POLICY

All Third Parties are subject to this Policy. Depending on the category of the Third Party (and their associated Risk Rating), different levels of due diligence and procedures will be required to be followed under this Policy. Each category of Third Parties is more fully described below.

Level 1 Third Parties

A Level 1 Third Party is a Third Party who is likely to engage directly or indirectly with another party (e.g., custom officials, government officials, end-users or other third parties) on our behalf or in connection with the performance of their contractual duties with Digital Edge.

To determine whether a Third Party is a “Level 1” Third Party, Sponsors should ask and answer the following questions:

(a) Will the Third Party perform services on behalf of Digital Edge or be authorized to represent Digital Edge vis-à-vis other third parties?

(b) Is it reasonable to expect that the Third Party will come into contact with government officials when representing or performing services on behalf of Digital Edge?

(c) Will the Third Party be able to influence decisions or the conduct of other unrelated third parties for the benefit of Digital Edge?

A positive answer to any of the foregoing questions will result in the Third Party being classified as a Level 1 Third Party and subject to a more detailed review under this Policy. In practice, the following Third Parties are usually considered to be Level 1 Third Parties:

Level 2 Third Parties

A Level 2 Third Party, on the other hand, is a Third Party who deals only with Digital Edge in the performance of their contractual duties. Such parties typically include:

ON-BOARDING OF A THIRD PARTY | THE PROCESS

The on-boarding and management of Third Parties requires the identification, assessment, mitigation, and monitoring of the risks associated with the engagement of Third Parties. The level of due diligence undertaken will depend on the category of Third Party (i.e., Level 1 or Level 2) as well as their Risk Rating (i.e., Very Low/Low, Medium, or High or Very High Risk), and any potential Red Flag which may be uncovered during the Due Diligence process. The level of Due Diligence may change as more information is discovered during the Due Diligence process, but generally consists of:

a) Basic Due Diligence

b) Mid-Level Due Diligence

c) Enhanced Due Diligence

The following steps explain the process and procedures to be followed by a Sponsor in respect of onboarding a Third Party and conducting a risk-based due diligence thereon. While the process is largely automated through the Company’s Third-Party GAN Integrity Due Diligence Platform (the “Platform”), a number of steps of the process may be required to be performed outside of the Platform by either the Sponsor or the Legal/ Compliance Department depending on the Risk Rating of the Third Party.

Step 1 | Third Party Registration and Pre-Classification

A Sponsor must register the Third Party in the Platform. When registering the Third Party in the Platform, the Sponsor will be required to input the full legal name, registered address, location of the third party and type of proposed engagement. Furthermore, the Sponsor will be required to classify the Third Party as either a Level 1 or Level 2 Third Party based on the commercial relationship between Digital Edge and the Third Party (see pages 3 and 4 of this Policy). If the Sponsor has any doubt as to the classification, they should contact the Legal/Compliance Department for assistance. The outcome of this exercise will be used to select the appropriate workflow with respect to that Third Party. Please note the workflow will automatically be selected by the Platform based on the registration process of the Third Party.

Step 2 | Risk Assessment

Next the Sponsor, in some cases, in coordination with the Legal/Compliance Department, must classify the initial Risk Rating of the Third Party as either “very low”, “low”, “medium”, “high” or “very high” risk. This step will indicate the risk-adjusted efforts required for each step of the due diligence and management of the Third Party (i.e., due diligence, decision making, contracting, and monitoring). The Platform will largely assist in this exercise as follows:

Level 2 Third Parties

The initial Risk Rating of all Level 2 Third Parties is presumed to be ‘Low Risk’ unless the results of the automated Vantage Screening undertaken by the Platform discovers any unresolved Red Flags, in which case, the Sponsor should escalate the matter to the Legal/ Compliance Department for further review. The Platform allows the Sponsor to redirect the Third Party to the Legal/Compliance Department after the results of the Vantage Screening have been received. The Legal/Compliance Department may reclassify the Risk Rating of the Third Party to either medium, high, or very high-risk, which will require additional Due Diligence to be performed in respect of the Third Party.

Level 1 Third Parties

The initial Risk Rating of a Level 1 Third Party will be determined by the Platform after the Sponsor completes an Internal Questionnaire. The Internal Questionnaire will be made available in the Platform after the Sponsor registers a Level 1 Third Party. Please note the Sponsor will have the ability to assign the Internal Questionnaire to another employee who may be more familiar with the Third Party and services to be provided. The Internal Questionnaire will ask the Sponsor (or employee) a series of questions which are common Risk Indicators, which if present, will heighten the potential risk of corruption. Once the Internal Questionnaire is completed by the Sponsor (or employee), the Platform will automatically assign an initial Risk Rating to the Level 1 Third Party and pre-select an appropriate workflow. The workflow will vary depending on the Risk Rating assigned to the Third Party.

The Internal Questionnaire may require the Sponsor (or other employee) to undertake quick review of the Third Party’s website to determine a few factual matters before answering the same (e.g., address, registered address, country of formation, whether it is publicly listed (if so, on what Exchange), whether there is any Government Ownership, etc.). This information can typically be found on the Third Party’s website under the link “Investor Relations” or “About Us”.

The intent of the Third-Party Risk Assessment is to ensure proper allocation of Company resources and management focus on those ‘risks’ that matter most to the Company. Please note that the initial Risk Rating does not mean the Third Party to which it relates is corrupt or is likely to commit corruption. Rather, it suggests that the engagement presents a higher potential for corruption, necessitating Digital Edge to undertake a more robust review of the engagement to identify and mitigate any potential issues which may arise during the due diligence and engagement of the Third Party.

Step 3 | Due Diligence

Once the Third Party’s initial Risk Rating has been determined by the Platform, the next step is to perform the appropriate level of due diligence in respect of the Third Party.

For all Third Parties with a Risk Rating of Very Low or Low Risk, the Platform will automatically undertake Vantage Screening which will consist of negative Internet searches and database checks. All Red Flags identified through the Vantage Screening must be referred to the Legal/Compliance Department for further consideration and potential re-rating of the initial Risk Rating of the Third Party. If no unresolved Red Flags are identified, the Third Party will be sent directly to the Final Evaluation stage for approval (or disapproval) by the Sponsor (see Step 4 below).

For all other Third Parties (i.e., those with a Risk Rating of Medium, High and Very-High Risk), a more thorough data collection and investigation will be required. These Third Parties will be required to complete a Third-Party Due Diligence Questionnaire which will be generated by and sent to the Third Party through the Platform via a weblink. The Third Party will complete the questionnaire by clicking the link and using the Platform’s web-based portal. Once the Third Party has completed the online questionnaire, the Platform will automatically generate an additional Risk Rating recommendation based on the answers to the questions in the questionnaire. Depending on the initial Risk Rating, the Legal/Compliance Department will need to reassess the Risk Rating based on the recommended Risk Ratings and any Red Flags identified through the Third-Party Due Diligence Questionnaire. Upon reassessment, a Vantage Screening will be conducted automatically by the Platform, and the results will be provided to the Legal/Compliance Department for further review. Coupled with the results of the Internal Questionnaire, the Third-Party Due Diligence Questionnaire and the Vantage Screening report, the Legal/Compliance Department will determine the appropriate level of additional Due Diligence required to be undertaken in respect of the Third Party. The higher the Risk Rating/ number of Red Flags, the more detailed and robust the additional Due Diligence will be required. This could include additional internet research, reference checks and/or engaging the Company’s third-party due diligence provider (e.g., Control Risks) to undertake an independent Enhanced Due Diligence review. The costs associated with any independent Enhanced Due Diligence review will be borne by the business unit requesting the engagement of the Third Party. The Legal/Compliance Department will consult with the Sponsor prior to engaging Control Risks to perform the additional Due Diligence.

The minimum due diligence activities that must be undertaken for each Third Party with a very low, low, medium, high, or very-high Risk Rating is set forth in Schedule B to this Policy.

Red Flags

It is important to recognize that the due diligence process may be an iterative one, requiring the Sponsor and/or the Legal/Compliance Department to return to the data collection process before approval is sought if problematic issues are identified in the verification and validation phase, or if potential Red Flags are discovered.

Where a Red Flag has been identified through the due diligence process and remains unresolved during the Final Evaluation stage of the Due Diligence process, mitigating and monitoring measures (if available) must be proposed by the Legal/Compliance Department in consultation with the Sponsor to address the associated Risks presented by the Red Flag. The mitigation and/or monitoring measures must be documented in the Platform and assigned to the appropriate individual for completion. The Legal/Compliance Department should ensure that all identified Red Flags have either been resolved (i.e., no longer exist) or mitigated before moving to the final approval process (i.e., Step 4 below).

Step 4 | Decision-Making

Final Evaluation

At the conclusion of the due diligence process, the results of the Due Diligence must be documented in the Platform, and a recommendation must be made by the Sponsor or Legal/Compliance Department (as applicable) on whether to proceed with the engagement of the Third Party. This recommendation will be documented in the Platform.

For all Third Parties who continue to be classified as ‘Very Low or Low-Risk’, the Sponsor will be required to complete the Final Evaluation, certifying:

• The type and final risk classification of the Third Party.
• That appropriate Due Diligence has been completed.
• That any Risks and/or Red Flags identified in the due diligence have either been resolved or mitigated.
  • Any exceptions should be noted on the Final Evaluation along with any proposed mitigation measures and monitoring activities as agreed with Legal/Compliance Department.
• The Sponsor’s recommendation to proceed with the engagement of Third Party.

For all other Third Parties (e.g., Medium, High and Very High Risk Third Parties), the Legal/Compliance Department will be required to perform the Final Evaluation in consultation with the Sponsor, documenting:

• The type and final risk classification (i.e., medium, high or very high risk);
• That appropriate Due Diligence has been completed.
• That any Risks and/or Red Flags identified in the due diligence have either been resolved or mitigated.
  • Any exceptions should be noted on the Final Evaluation along with any proposed mitigation measures and monitoring activities as agreed with Legal/Compliance Department.
• Recommendation on whether to engage the Third Party.

The Sponsor can only proceed with the on-boarding of a Third Party if the Third Party has been “Approved” in the Platform. Any Third Party “Rejected” in the Platform shall not be engaged by the Company and/or the Sponsor on behalf of the Company.

Any due diligence that has been concluded may later be used by other Sponsors (from the same or another division or unit), provided that (i) the category of engagement remains substantially the same (e.g., Level 1 or Level 2) (ii) the due diligence is not older than 3 years for Very Low or Low Risk Third Parties, or 2 years for Medium Risk Third Parties, or 1 year for High / Very High Risk Third Parties, and (iii) there are no grounds to believe that the Risk Rating of the Third Party has increased.

A new due diligence (i.e., re-vet) may be conducted for any Third Party that failed to be approved in the Platform only if there are reasonable grounds to believe that the risk associated with the Third Party has decreased either by change in circumstances or a change in the Company’s Internal Controls which would mitigate the risks.

Step 5 | Post Approval Process Contracting

A Third Party can only be engaged by, and receive payment from, Digital Edge if its engagement is approved in the Platform (see Step 4) and a written contract or another form of written document with a similarly legally binding effect (hereafter an “Agreement”) is entered into between the Third Party and Digital Edge.

The Agreement must clearly describe the subject matter of the contract (e.g., products purchased and/ or services to be performed) and the terms of remuneration. In addition, clauses that address the following concepts must also be included in each Agreement with a Third Party:

• An unequivocal statement that the Third Party will not promise, offer, pay, cause to pay, accept payment or induce payment or take any action that could be considered a bribe, and such action will be grounds for immediate termination.
• An unequivocal agreement by the Third Party to comply with the law, including laws related to bribery and corruption (such as the US Foreign Corrupt Practices Act and UK Bribery Act and other applicable ABC Laws).
• No sub-contracting of the services without Digital Edge’s prior written consent.¹
• No assignment of the Agreement without Digital Edge’s prior written consent.
• Obligation to inform Digital Edge of any Material Change in the structure of the Third Party.
• The right to terminate the Agreement upon occurrence of any of the following events (to the extent permitted under local law):
  • If the Third Party breaches the “Compliance with Law” section;
  • In the event of any material omission or misrepresentation of information provided by the Third Party in the due diligence process (if applicable); and
  • In the event of a material delay (at least thirty days) in providing, or failure to provide, a Compliance Confirmation (if applicable).

For Third Parties that pose a High Risk, the following additional concepts should be included in the Agreement:

• Right to audit the Third Party (if required by the Legal/Compliance Department).
• Refusal by the Third Party to be audited may result (subject to local law) in immediate termination of the Agreement by Digital Edge.
• Responsibility to deliver during the term of the Agreement a Compliance Confirmation for each calendar year during the contract term.
• Responsibility to provide appropriate ABC training to its personnel, but at a minimum the personnel engaged in the provision of goods and services to Digital Edge.

Legal counsel shall have the authority to draft their preferred contract language which adequately addresses all or substantially all of the above concepts. Furthermore, some of these concepts may be covered by incorporating the Digital Edge Business Partner Code of Conduct (the “Code”) into the agreement with the Third Party and therefore do not require a separate contractual obligation to the extent the Third Party has agreed to incorporate and adhere to the Code.

Any deviation from the foregoing requirements requires the prior approval of the Company’s Head of

¹ Any subcontracting of the services contracted by Digital Edge is subject to prior written approval of the Head of Legal and Compliance. The risk classification of the Third Party shall also apply to its sub-contractor. Clauses that are materially equivalent to those that have been inserted into the Agreement with the Third Party should be included in the contract between the Third Party and its sub-contractor. The requirements relating to sub-contracting also apply to any assignment of rights or obligations by the Third Party.

Legal and Compliance or his/her designee.

Step 6 | Monitoring

All Third Parties approved in the Platform will be continuously monitored via the Vantage Screening tool in the Platform. Both the Sponsor and Legal/Compliance Department will be notified of any new Red Flag identified by the Vantage Screening tool in respect of the Third Party. Furthermore, the Sponsor should continually monitor the Third Party to detect any reason for concern from a compliance perspective (e.g., comments made by the third party during the performance of the engagement which could imply corruption has occurred, rumors about the integrity of the Third Party, whistleblower complaints received about the Third Party, etc.) and notify the Legal/Compliance Department as soon as reasonably practicable.

(a) Event-Triggered Monitoring Activities:

In instances where there is a change in circumstances (e.g., a Material Change to the structure of a Third Party or newly identified Red Flags), the impact on the decision to continue to engage the Third Party and any possible mitigating and monitoring measures must be assessed by the Sponsor and Legal Department. The Third Party’s due diligence file in the Platform must be updated accordingly. This requires that the Sponsor work closely to inform the Legal Department of any relevant information that they become aware of that may have a negative impact on the risk classification of the Third Party.

(b) Renewal of the Due Diligence:

The due diligence process in respect of a Third Party must be renewed at least once every:

a. 3 years for Very Low and Low Risk Third Parties;

b. 2 years for Medium Risk Third Parties; and

c. 1 year for High and Very High Risk Third Parties.

The Platform will notify both the Sponsor and the Legal Department when it is time to renew the due diligence process in respect of each Third Party. Without limiting the foregoing, prior to renewing an Agreement with any Third Party, a Sponsor should ensure the most recent due diligence carried out by the Company for that Third Party is not older than 3 years for Very Low or Low Risk Third Parties, or 2 years for Medium Risk Third Parties, or 1 year for High / Very High Risk Third Parties; otherwise, a new due diligence process will need to be undertaken by the Sponsor prior to renewing the Agreement (even if it contains an auto-renewal clause).

(c) Pre-Defined Monitoring Activities:

Each High- and Very High-risk and some Medium-risk Third Parties (as determined by the Legal Department), shall provide to the Company an annual “Compliance Confirmation” in the form set forth in Annexure 1. The Sponsor shall be responsible for obtaining the Compliance Confirmation from the Third Party and uploading it to the Platform.

Step 7 | Record Keeping

Documentation related to the engagement of the Third Party must be uploaded and retained in the Platform to demonstrate that Digital Edge has taken reasonable precautions to avoid involvement in corrupt activities or with corrupt actors by providing evidence of credible due diligence, decision making, contracting, and monitoring. Sponsors should retain copies of all files and documents prepared and approved in accordance with this Policy and send copies thereof to the Legal Department / Compliance Department for proper storage in accordance with the Company’s Records Management Policy.

TIMELINES

A Very Low to Low-Risk Third Party Due Diligence will typically take less than a day to complete.

A Medium, High and Very High Risk Third Party Due Diligence will normally take 5 business days to complete upon the receipt of all required due diligence documentation.

If the Legal Department determines that a particular Third Party requires an independent Enhanced Due Diligence to be performed, such a review will normally take 3 to 4 weeks to complete. The costs associated with an Enhanced Due Diligence will be charged to the respective business unit seeking to engage the Third Party.

Please note that if Red Flags are revealed during each of the foregoing due diligence processes, a longer time can be expected for the resolution of the Red Flags.

ROLES AND RESPONSIBILITIES

The Sponsor has ultimate responsibility for managing and mitigating risks associated with the Third Party and must:

• Confirm the legitimate need for the goods and/or service provided by the Third Party.
• Make an assessment as to the category of the Third Party (i.e., Level 1 or Level 2).
• Answer the Internal Questionnaire for all Level 1 Third Parties as truthfully and as fully as possible.
• Perform all Low-risk Basic Due Diligence and notify the Legal/Compliance Department of any potential Red Flags.
• Prepare and send the Third-Party Due Diligence Questionnaire to all Medium, High and Very High-risk Third Parties via the Platform.
• Ensure that the Legal/Compliance Department is provided with all necessary information to fulfill the requirements outlined in this Policy.
• Prepare and complete the Final Evaluation for all Low-risk Third Parties.
• Ensure all approvals are received prior to engaging the Third Party.
• Ensure that a Third Party does not begin work until the due diligence process is complete and the Third Party is approved via the Platform, and an Agreement is entered into between Digital Edge and the Third Party.
• Keep a completed and updated due diligence file on each Third Party engaged by Sponsor and ensure final copies are uploaded to the Platform and any documents received outside of the Platform are sent to the Legal/Compliance Department for review and proper storage.
• Monitor the Third Party in adherence to the Agreement and ensure that payments to the Third Party are consistent with service delivery and terms and conditions of the Agreement.
• Ensure any mitigation measures assigned to the Sponsor are completed within the allocated timeframes, if any.
• Monitoring and performing any subsequent assessments after the Third Party has been engaged as required by this Policy.

The Legal/Compliance Department is responsible for:

• Performing all Medium, High and Very High-risk Third-Party due diligence (or ensuring that it is performed by a qualified third-party vendor).
• Preparing the Final Evaluation for all Medium, High and Very High-risk Third Parties.
• Supporting the Sponsor, and other parties, in making an informed decision about the engagement of the Third Party.
• Monitoring and performing any subsequent assessments after the Third Party has been engaged as required by this Policy.

QUESTIONS AND REPORTING

You have an obligation to Digital Edge and your colleagues to help maintain our high ethical business standards. If you have questions or are concerned about any aspect of our business or this Policy, you may contact:

Head of Legal and Compliance: Joe.b@digitaledgedc.com

Compliance Officer: manish.sansi@digitaledgedc.com

DIGITAL EDGE IS COMMITTED TO NON-RETALIATION

Digital Edge will not impose sanctions or permit retribution against a person who promptly reports information of violations, or participates in an investigation of a suspected violation, and who has not himself or herself engaged in such conduct. Any employee who reports a potential violation or raises a compliance concern in good faith is doing the right thing and may do so without fear of retaliation. Digital Edge will take prompt disciplinary action against any employee who retaliates against you, up to and including termination of their employment.

INVESTIGATION AND APPELLATE MECHANISM

To investigate any violation of this Policy, the procedure laid out in the Company’s Code of Conduct Policy shall be followed. An Employee may appeal against any determination made under this Policy in accordance with the procedure prescribed in the Code of Conduct Policy. Any decision under this appeal shall be deemed final and non-appealable.

Schedules

Schedule A. Definitions

Schedule B. Due Diligence Processes and Procedures Schedule C. Decision Making – Responsibilities Schedule D. Key Risk Indicators and Common Red Flags

Annexures

1. Compliance Confirmation (Third Party to complete annually)

SCHEDULE A

DEFINITIONS

ABC Laws means all Applicable Laws pertaining to the prohibitions of corruption and bribery, including without limitation to the U.S. Foreign Corrupt Practices Act, U.K. Bribery Act and/or OECD Convention on Combating Bribery of Foreign Public Officials.

Applicable Laws means all laws, legislation, regulations, or binding rules or requirements of any relevant Governmental Authority that are applicable to the procurement, provision and use of any part of the services or products to be provided to Digital Edge.

Company Personnel means directors, officers, managers, and employees of DEA TopCo LP and DEA TopCo II LP and their wholly owned and/or controlled direct and indirect subsidiaries.

Compliance Confirmation means the form so entitled in which an approved Third Party attests to their compliance with relevant laws, including ABC Laws, and confirms the validity of the information collected as part of the due diligence process.

Final Evaluation means the final step in the due diligence process in which the Sponsor and/or Legal/Compliance Department either approves or rejects the engagement of a Third Party based on all of the information collected during the due diligence of a Third Party, and sets forth the proposed mitigation measures, if any, to address any Red Flags identified during the process.

Governmental Authority means any governmental or quasi-governmental body of competent jurisdiction, whether foreign or domestic or local or federal, including any department, agency, commission, bureau or other administrative or regulatory bodies, courts, public utilities, and communications authorities.

Government Official means (i) any individual or entity employed by or acting on behalf of a government, government-controlled agency or entity or public international organization, (ii) any political party, party official or candidate, (iii) any individual or entity that holds or performs the duties of an appointment, office or position created by custom or convention or (iv) any individual or entity that holds himself, herself or itself out to be the authorized intermediary of any of the foregoing, and includes any immediate family member (meaning a spouse, dependent child, parent or household member) of any of the above.

Internal Controls means a set of policies and procedures and other measures put in place by Digital Edge and/or the Third Party to safeguard the company’s assets, promote accountability, increase efficiency, and prevent fraudulent behavior, and ensure that the company or its associates complies with all Applicable Laws, including those relating to anti-bribery and anti-corruption. Examples of internal controls include:

• Financial controls, e.g., expense reimbursement policies, segregation of duties, checks and balances, cash controls, delegation of authorities, documentation.
• ABC Policies and Procedures. Companies should make sure to document and communicate policies pertaining to bribery and corruption to the entire employee population in an easily understood language and platform.
• Practices and procedures for important policies. Each policy should have a corresponding practice and documentation procedure. This could be as simple as an employee reimbursement form. The practice of using forms acts as a control and helps to remind employees of the moral implications of engaging in improper activities.
• Training. Employees and relevant third parties should be trained in respect of the applicable policies and procedures and given the importance of ABC, should be repeated on a regular basis (e.g., at least annually).
• Whistleblowing. Companies should have a mechanism for employees and third parties to report suspected unethical or illegal activities of third parties.

Red Flag means any information that indicates an increased risk of corruption or another potential issue with a Third Party, such as any undesirable characteristic that pertains to the Third Party’s ownership, business structure, or relationships and/or compliance with laws. Common types of Red Flags are highlighted in Schedule D of this Policy.

Risks are broadly defined to mean the “effect of uncertainty on objectives”. In the context of this Policy, Risks correspond to the presence of potential Red Flags and Risk Indicators, which could be an indication of either corruption or the likelihood that corruption could occur in respect of a Third Party’s activities on behalf of Digital Edge.

Risk Assessment is a systematic process of evaluating the potential Risks or hazards that may be involved in an activity or undertaking which could create an enabling environment for corruption.

Internal Questionnaire means the form so entitled which the Sponsor is required to answer for all Level 1 Third Parties.

Risk Indicator means the broad contextual factors which make bribery or corruption more likely to occur, such as country of operation or type of relationship between the parties (e.g., agency or reseller). Common Risk Indicators are highlighted in Schedule D of this Policy.

Risk Rating means the classification of potential Risks and their potential impact on the business of Digital Edge in terms of reputational or economic damage.

Sanction Laws means all Applicable Laws relating to sanctions or laws and regulations in force from time to time, including trade and economic sanctions maintained by the Treasury Department’s Office of Foreign Assets Control (OFAC), the United Nations Security Council, the European Union, His Majesty’s Treasury of the United Kingdom, and the relevant authorities of the jurisdictions in which Digital Edge operates and any other U.S. enabling legislation or executive order relating thereto.

Sponsor means the Company Personnel who requests or sponsors the engagement of a Third Party and who is responsible for the business impact of such engagement. Generally speaking, a Sponsor should be at the level of E-3 and above to ensure appropriate seniority in respect of the engagement and management of the Third-Party relationship.

Third Party Due Diligence Questionnaire means the form so entitled which is required to be completed by all medium, high and very high-risk Third Parties which is designed to assist the Sponsor and/or Legal/Compliance Department to undertake further risk assessment and/or due diligence on the Third Party.

SCHEDULE B

DUE DILIGENCE PROCESS AND PROCEDURES

Step 3 | Due Diligence

The following due diligence activities must be completed in respect of all Level 1 and Level 2 Third Parties:

* The Legal/ Compliance Department may use external vendors that may provide the activities listed above for High Risk and Very High Risk Third Parties.

SCHEDULE C

DECISION MAKING PROCESS

Step 4 | Decision Making

For Third Parties with a Very Low / Low-Risk rating, the Sponsor is responsible for deciding whether to engage the Third Party based on the results of the Due Diligence. For all Third Parties that are classified as Medium risk, the Legal/Compliance Department is responsible for deciding to engage the Third Party in consultation with the Sponsor. For Third Parties that are classified as High Risk or Very High Risk, the HEAD OF LEGAL AND COMPLIANCE or CFO is responsible for approving the engagement in consultation with the Legal/Compliance Department and the Sponsor’s CxO.

The decision matrix is set forth below:

SCHEDULE D

KEY RISK INDICATORS AND COMMON RED FLAGS

Below are key Risk Indicators and common Red Flags. This is not an exhaustive list, and Sponsors and the Legal/Compliance Department should consider the specific Third Party and the context of each Due Diligence exercise in identifying potential risks and Red Flags.

A. KEY RISK INDICATORS

Geographic location

High-risk factors: The geographic location where the third party resides and/or operates (as per the contract) is:

• A country with a Corruption Perception Index score of 50 or below (see Transparency International’s Corruption Perceptions Index)
• A jurisdiction known to have high levels of bank secrecy and presents a high risk for facilitating illicit financial flows (see for example the Tax Justice Network’s Financial Secrecy Index)
• A jurisdiction that encourages or requires organizations to hire local agents to transact business for the government.

Industry

High-risk factors:

• The industry with which the third-party conducts business transactions is perceived to present a high risk for corruption (see for example the OECD Foreign Bribery Report (Transparency International’s Bribe Payers Index was discontinued)).
• The third party belongs to an industry with a history of anti-corruption enforcement scrutiny (e.g., oil & gas, logistics, mineral extraction, and construction industries).

Background and identity of the third party

High-risk factors:

• Initial Internet searches and use of news services have revealed significant problems related to the third party’s reputation for integrity.
• The third party, or any of its senior officials, has previously been subject to regulatory action or legal proceedings because of alleged breaches of anti-corruption laws (even if no penalties were imposed).
• The third party, or any of its senior officials, appears on a denied parties/persons list due to national or international sanctions or past misconduct.
• The third party has little or no experience in the relevant industry sector and/or is unknown to the organization.

Connection with government officials or entities

High-risk factors:

• The third party, in the course of doing work for Digital Edge, will have frequent interaction with government officials (including customs officials), governmental agencies or government-

controlled entities.

• The third party is wholly or partly (directly or indirectly) owned by a government official/entity or has direct or indirect links with government officials/entities.
• The third party has previously worked for government or is connected with the political elite.

Compensation structure of the proposed arrangement

High-risk factors:

• The third party’s compensation is to be based on performance (i.e., success fees, bonus fees and other contingency fees).
• The third party requires payment by unusual means (e.g., deviating from standard practice, use of multiple accounts, upfront payments, split into small amounts, in cash or similar,in a country or currency that is different from that of the third party’s domicile or the country where the work will be performed).
• The third party’s compensation is to take the form of a political or charitable contribution.

Additional factors related to the scope of the services to be rendered:

High-risk factors:

• The third party’s role is to enhance the organization’s chances of winning commercial and/or government contracts.
• The third-party requests discretionary authority to handle local matters alone.

Selection of the third party

High-risk factors:

• The third party was recommended by a customer.
• The retention of this specific third party was encouraged or required by a government official.
• In some countries, the line between private and public enterprises is blurred, and it might not be obvious that an enterprise is a government-controlled entity. Pursuant to international standards, persons working for these enterprises are considered foreign public officials.

B. COMMON RED FLAGS

The following sets forth typical examples of Red Flags discovered during due diligence. Digital Edge is committed to investigating Red Flags and resolving them through a variety of techniques, including reviewing additional information, conducting further inquiries, analyzing information, and developing a sufficient record of information and analysis to support resolution of specific Red Flags. The goal of this Policy is to identify and mitigate any risk that a Red Flag may pose to Digital Edge’s business operations.

Please note that this list is not meant to be exhaustive and that other circumstances, especially taken as a whole, may constitute sufficient red flags requiring further examination.

Ties to Government

• Family or business ties to government officials or employees.
• Large or frequent political contributions.
• A government official or employee recommended the Third Party.
• References to political or charitable donations as a way of influencing official action.
• Large sales to government agencies with unusually high unit price and low frequency.

Questionable Circumstances

• Refusal to cooperate with due diligence or refusal to make representations and warranties in the agreement.
• The Third Party is not in compliance with local law.
• Suspicious statements such as needing money to “get the business” or “make the necessary arrangements.”
• Submitting invoices or requesting payment with suspicious entries or under suspicious circumstances.
• Bankruptcies, default on obligations, civil suits alleging fraud, property seizures, criminal, or regulatory issues.

Unusual Compensation

• Requests for a commission or other payment substantially above the market rate or requests a substantial up-front payment.
• Requests for payments in cash or in checks payable to cash or bearer.
• Requests that payment be made through a third party or in a third country.
• Refusal to properly document expenses.

Poor Reputation

• Reputation for unethical conduct.
• The country in which the Third Party is based, or where the business with Digital Edge will be conducted, has a reputation for corruption.

Insufficient Capabilities

• The Third Party is not expected to perform substantial work.
• The Third Party lacks the staff, facilities, or expertise to perform substantial work.
• The Third Party lacks relevant industry/technical experience.

Potential Sanctions Issues

• The Third Party identity is not clear.
• The Third Party is usually involved in military-related business.
• The Third Party or their address is similar to one of the parties listed in the OFAC sanctioned entity list.
• The Third Party or purchasing agent is reluctant to offer information about the end-use of the goods.

ANNEXURE 1

COMPLIANCE CONFIRMATION FORM

At Digital Edge, we expect our business partners to act within the bounds of all applicable laws, rules, and regulations. Specifically, business partners must conduct their activities in full compliance with the anti-corruption and anti-bribery laws of the country, or countries, in which they are operating and with the United States Foreign Corrupt Practices Act, the UK Bribery Act, and the principles of the OECD Convention on Combating Bribery of Foreign Public Officials.

Business partners may not directly or indirectly through a third party, pay, offer, promise to pay, or receive bribes, kickbacks or facilitating payments from any individual, whether that individual is a public official or a private party. A public official is any person who is paid with government funds. This includes individuals who work for a local, state/provincial, or national government, or a public international organization, as well as employees of public (government-owned or operated) schools and state-owned enterprises. Employees at such organizations are considered public officials regardless of title or position.

Business Partners engaged by Digital Edge are also prohibited from providing gifts, meals, entertainment or anything of value to any person or entity in connection with Digital Edge business unless it is provided in accordance with Digital Edge’s policies, including its Business Partner Code of Conduct and its Gifts & Entertainment Policy.

Bribes

A bribe is offering or giving anything of value to any person for the purpose of obtaining or retaining business or securing an improper advantage. Anything of value includes cash, cash equivalents, meals, or entertainment, and may also include a promise or other intangible benefit.

Kickbacks

A kickback is a payment or anything of value given to individuals after a transaction, typically for providing a discount or arranging high volume in a sales agreement.

Facilitating Payments

Facilitating payments are small payments to a public official to expedite or secure the performance of routine, nondiscretionary government action. These types of payments are typically demanded by low-level officials in exchange for providing a service to which you are entitled even without the payment.

Money Laundering

Business partners may not engage in or assist others in concealing illicit funds or money laundering activities. The following are sample indicators of money laundering that merit further investigation by business partners:

• Attempts to make large payments in cash.
• Payments by someone who is not a party to the contract.
• Requests to pay more than provided for in the contract.
• Payments made in currencies other than those specified in the contract.
• Payments from an unusual, nonbusiness account

Trade Restrictions, Export Controls, and Customs

All transactions must comply with United States export and customs laws and additional export and customs laws in the countries where business is being conducted. Business partners whose business activities involve the sale or shipment of products, technologies, or services across international borders must understand and ensure compliance with all laws or restrictions that apply in connection with those activities.

Furthermore, we are committed to complying with all Sanction Laws applicable to our business activities. We do not participate in transactions or engage in conduct designed or intended to evade or facilitate a breach of applicable Sanction Laws. We do not conduct business in, or involving any, embargoed territory or sanctions targets. We do not conduct business that would violate any applicable trade controls or anti-boycott laws. We do not engage in any sanctionable activity that could result in the designation of Digital Edge as a sanctions target. We only do business with business partners who commit to adhering to the foregoing principles.

For purposes of this Compliance Confirmation:

“Government Official” includes any official or employee of a government agency, regulatory authority or entity owned or controlled by the government, any political candidate or member of a political party, and any official or employee of a public international organization (e.g., United Nations, World Bank). For purposes of this Certification, an “immediate family member” means an individual’s spouse, parents, children, and siblings and the spouses of his or her parents, children, and siblings.

“Sanctioned Countries/Jurisdictions” means Cuba, Iran, North Korea, Syria, the Crimea region of Ukraine, the so-called Donetsk People’s Republic and Luhansk People’s Republic regions of Ukraine, and any other country or territory that is the subject of comprehensive Sanction Laws from time to time.

“Sanction Laws” means all applicable laws relating to sanctions or laws and regulations in force from time to time, including trade and economic sanctions maintained by the Treasury Department’s Office of Foreign Assets Control (OFAC), the United Nations Security Council, the European Union, His Majesty’s Treasury of the United Kingdom, and the relevant authorities of the jurisdictions in which Digital Edge operates and any other U.S. enabling legislation or executive order relating thereto.

CERTIFICATION:

We, the undersigned, acting and certifying on behalf of ourselves and our affiliates, subsidiaries, agents, subcontractors, representatives, and employees, hereby certify that we have received and read, understand, and will comply with Digital Edge Business Partner Code of Conduct (the “Code”).

We hereby further certify that we have made ourselves familiar with all anti-bribery and anti-corruption laws applicable in the jurisdictions in which we engage in business on behalf of Digital Edge, including but not limited to the United States Foreign Corrupt Practices Act, the UK Bribery Act, and the Organization for Economic Cooperation and Development Convention.

We understand and acknowledge that at all times, in connection with the services provided on behalf of Digital Edge, we are required to comply with the Code and all applicable anti-bribery and anti-corruption laws, and that we have implemented adequate procedures to do so, including by doing our own due diligence on our affiliates, subsidiaries, agents, subcontractors, representatives, and employees who will work on behalf of Digital Edge and by communicating to them the requirements set out in the Code.

We certify that, to the best of our knowledge, neither we nor any of our affiliates, subsidiaries, agents, subcontractors, representatives, or employees, either directly or indirectly through others, in connection with the services provided on behalf of Digital Edge, is now or has been engaged in any activity which might violate the Code, or any applicable anti-bribery or anti-corruption laws, nor made any facilitation payments.

We confirm and attest to strict compliance with all other applicable laws, rules, regulations and decrees, whether national, regional, local or otherwise, of the area or areas in which we or any of our affiliates, subsidiaries, agents, subcontractors, representatives, or employees, either directly or indirectly through others, act in connection with the services provided on behalf of Digital Edge.

We further confirm and attest that all certifications, representations, warranties, and information provided to Digital Edge as part of its Third-Party Due Diligence Process remain complete, current, and accurate. If subsequent developments cause any such certifications, representations, warranties, or information to no longer be complete, current, and accurate, we will promptly so advise Digital Edge.

We further confirm and attest that we have complied with all Sanctions Laws and are not a Sanctions Target (being any person or entity that is the subject or target of Sanction Laws). We further confirm that we have not and will not transact any business or activities or provide services in connection with our association with Digital Edge, that directly or indirectly involve or benefit any person or entity located in a Sanctioned Country/Jurisdiction or, with any jurisdiction, state, entity, vessel or individual, designated as a sanctioned entity.

We further agree that if we determine that we have acted in contravention of this Certification in connection with the services provided on behalf of Digital Edge, we shall promptly notify Digital Edge in writing of the specifics of such actions.

SIGNED this day of , 20 .