Environmentally friendly and trusted market infrastructure

FN-EX-550a.3

A market’s effective functioning and appeal are determined by its infrastructure , which should ensure high-quality and accessible information for end-users, brokers, and investors; reliable barriers to deter market manipulation and conflicts of interest; smoothly operating IT systems; and the ability to process substantial flows of information between issuers and providers of capital.

Cybersecurity is an integral part of Moscow Exchange Group’s risk management strategy and system. Measures taken to enhance information security ensure that the quality of management systems and the reliability of infrastructure are in line with global best practices.

This section describes measures that Moscow Exchange Group takes to ensure business continuity, including the reliability of information, data confidentiality, availability of operations, and information security.

Moscow Exchange Group’s objectives and the UN Sustainable Development Goals

• SDG 9.b Ensure sustainable financial infrastructure

Risk management

3-3 2-24

The overall risk management system aims to guarantee reliable infrastructure.

In 2024, Moscow Exchange Group adopted Risk Management System Development Strategy for 2025-2028 and corresponding roadmap to implement, which sets out key performance indicators, risks, and preventive actions, including those specifically aimed at information security risks.

The Group’s progress towards achieving the goals and objectives established in the strategy is monitored regularly: status reports are submitted to collegial executive bodies for review. We also use KPIs to assess the effectiveness of the risk management system.

As part of the Strategy and Roadmap, Moscow Exchange has implemented an approach to determining its risk appetite. The component risks carry equal weight and are deemed to be material for the Group and all its companies.

ESG risk management

2-24

The expectations and interests of the Group’s stakeholders align with Moscow Exchange Group’s high level of preparedness for new ESG risks and opportunities. Approaches to identifying priorities and opportunities are determined based on the company’s strategic goals and objectives.

By analyzing key sustainability trends, risks, and opportunities at an early stage, the company can enhance its strategic performance. Prioritizing key economic, environmental and social issues as risks and opportunities is an integral part of Moscow Exchange Group’s operations and internal processes.

201-2

Climate-related risk management

In 2024, Moscow Exchange continued to develop the climate risk and capacity management process in line with the TCFD Recommendations.

The following climate risk and opportunity management tools are regularly used:

• assessment of the risks and opportunities associated with climate change;
• training employees to anticipate likely events and threats

The short-term horizon (12 months) includes an annual review of transitional and physical climate-related risks, as well as regular monitoring of the conditions and legal framework for identifying them. Moscow Exchange incorporates international practices for identifying and assessing climate-related risks into its operations. In the reporting year, all the tasks and goals set for the Moscow Exchange Group within the framework of the climate.

In the reporting year, all the tasks and goals set for the Moscow Exchange Group within the framework of the climate:

• Building a system for managing risks and opportunities related to sustainable development.

Moscow Exchange Group is expanding its partnerships with various institutions in order to disseminate knowledge and expertise. It is developing models for identifying and assessing climate-related risks. For more details on the Group’s approaches to implementing TCFD initiatives, please refer to the ‘Climate Agenda’ section.

Emerging risks are identified systematically, and the business units responsible for managing the risks detected are designated during the identification phase. For each risk, a management strategy and mitigation measures are developed in accordance with the risk management system. Each risk is controlled and monitored.

Information security

FN-EX-550a.3

Moscow Exchange Group implemented its information security programme for the years 2021-2024. The projects under way will help to maintain the Group’s development pace and level of reliability.

The Group’s companies have electronic and computer crime and personal liability insurance policies to mitigate operational and information security risks.

In 2024, MOEX there was no failures that led to the suspension of trading due to implementation of information threat risks

Robust IT infrastructure

As part of the software and hardware updates programme, multiple tests of equipment and software from Russian providers were carried out, providing MOEX with a large number of reliable suppliers for further system development tasks.

FN-EX-550a.1

In 2024, the trading and clearing system experienced five brief outages:

1. On February 13, 2024, the trading and clearing system (TCS) malfunctioned, leading to a trading halt on the Stock Market from 1:58 PM to 3:25 PM, lasting 87 minutes.
2. On February 14, 2024, another TCS malfunction caused a trading halt on the Stock Market from 10:36 AM to 11:16 AM, lasting 40 minutes.
3. On August 14, 2024, the TCS issue led to a trading halt on the Stock Market from 4:18 PM to 5:13 PM, lasting 55 minutes.
4. On November 7, 2024, the TCS malfunction resulted in the postponement of the start of trading on the Stock Market from 9:50 AM to 11:35 AM, lasting 105 minutes.
5. On November 19, 2024, the TCS issue caused a trading halt on the Derivatives Market from 4:18 PM to 4:32 PM, lasting 14 minutes.

Infrastructural reliability remained at 99.95%.

Data governance activities:

• development of the previously implemented operational model for data quality management to minimise risks (reputational, regulatory, operational) and increase the level of satisfaction of business users with data services;
• development of flexible methodologies for testing and implementing data monetisation tasks.

Access to products and services

FN-EX-550a.3

Moscow Exchange continues to provide investors and market participants with equal and unhindered access to its products.

Finuslugi.ru

The Group continues to develop the Finuslugi personal finance platform by connecting new financial service providers and expanding its product line. In the future, new types of people’s bonds, loans and other products from banks, asset managers and insurance companies will become available on the platform.

The year 2024 saw the following significant updates to the Finuslugi platform:

• The first issues of people’s bonds were launched in Krasnoyarsk, Tomsk, and Ulyanovsk regions.
• A pilot issue of DLT instruments (Digital Financial Assets, DFA) for individual investors was conducted, with employees of Moscow Exchange acting as investors. This is the first DFA issuance for individual investors in the market, implemented in collaboration with an exchange operator, an information system operator (OIS), and the “Finuslugi” platform.
• The mobile app now allows users to top up their brokerage accounts and trade exchange instruments. This pilot project is being implemented in collaboration with the company “Finam.”
• Clients of “Finuslugi” now have the opportunity to purchase shares of mutual investment funds (MIF) online within a unified interface.

Information security highlights:

• the Information Security Strategy for 2024–2028 was approved
• RUB 0 in financial losses resulting from failures of the information security system and cybersecurity;
• no breaches involving personal data leakage or disclosure of confidential information.

Plans for 2025

In 2025, Moscow Exchange plans to:

• review the supply chain and software and hardware updates;
• adapt the technological landscape and infrastructure to the revised strategy;
• introduce new risk management tools, including systems that incorporate machine learning and scenario analysis;
• train staff on anticipating probable events and threats;
• analyze financial and non-financial risks integrated in the risk map.