KATILIM FİNANS KEFALET A.Ş. INFORMATION SECURITY POLICY

The information security principles and policies, which cover the protection of information assets related to all activities and business processes carried out within Katılım Finans Kefalet A.Ş. and ensure their security and integrity, and which are accessible to all employees and stakeholders, are determined by the Board of Directors. Efforts towards the sustainability and improvement of the established principles and policies are likewise supported by the Board of Directors.

All business units and employees of the Institution act in accordance with the ISO 27001 Information Security Management System Standard and contribute to its continuous improvement.

In order to meet the information security requirements arising from the national and sectoral regulations to which it is subject, from fulfilling the requirements of the relevant legislation and standards, from meeting its contractual obligations and from its corporate responsibilities towards internal and external stakeholders, Katılım Finans Kefalet A.Ş. undertakes:

. To protect the confidentiality, integrity and availability of information assets,

. To assess and manage risks that may arise regarding its own information assets and those of its stakeholders,

. To reduce the impact of information security threats to business/service continuity, and to provide its services as quickly as possible and without interruption in compliance with all legal regulations
   and contracts related to information security,

. To allocate resources for, establish, operate and continuously improve the system in a manner that fulfils the requirements of the ISO 27001 Information Security Management System Standard,

. To establish the controls required for the operation and continuity of the Information Security Management System and to ensure their supervision through
    sub-policies, procedures and instructions linked to this policy,

. To protect the reliability and image of the Institution,

. To establish the systems necessary to manage information security breaches, to take appropriate measures to prevent their recurrence, and to apply the sanctions deemed necessary
   in the event of an information security breach,

. To provide training that develops competencies when deemed necessary in order to increase information security awareness,

. To guarantee compliance with all relevant legal regulations in the field of information security and with requirements arising from contracts,

. To apply information security requirements as an integral part of corporate business processes,

. To implement this policy and to ensure that it is accessible to all relevant stakeholders.

The Katılım Finans Kefalet A.Ş. Information Security Policy is, as a rule, reviewed by the Institution once a year. Where necessary, the Policy is reviewed to ensure its suitability, accuracy and effectiveness, and any amendments are submitted to the Board of Directors for approval.