1. ENTITY & OWNERSHIP - BNP Paribas

Wolfsberg Group Financial Crime Compliance Questionnaire (FCCQ) v1.0Financial Institution Name:Location (Country) :No #BNP PARIBAS16, Boulevard des Italiens - 75009 Paris FRANCEQuestionAnswer1. ENTITY & OWNERSHIP1Full Legal nameBNP PARIBAS SA2Append a list of branches which are covered bythis questionnaire3Full Legal (Registered) Addresscf attached document16, Boulevard des Italiens - 75009 Paris FRANCE4Full Primary Business Address (if different fromabove)5Date of Entity incorporation / establishment6Select type of ownership and append anownership chart if availablePublicly Traded (25% of shares publicly traded)If Y, indicate the exchange traded on and tickersymbol23 Sept. 19666a6 a16b6c6d6 d1Member Owned / MutualGovernment or State Owned by 25% or morePrivately OwnedIf Y, provide details of shareholders or ultimatebeneficial owners with a holding of 10% or more7% of the Entity's total shares composed of bearershares8Does the Entity, or any of its branches, operateunder an Offshore Banking License (OBL) ?YesBourse de Paris - Euronext ParisNoNoYes87%Yes8aIf Y, provide the name of the relevant branch/eswhich operate under an OBLBNPP SA Labuan Branch ( Malaysia) - BNPP SA Manille Branch (Philippines) - BNPP SA Offshore Banking TaipeiBranch ( Taiwan) The Wolfsberg Group 2018Page 1FCCQ V1.0

Wolfsberg Group Financial Crime Compliance Questionnaire (FCCQ) v1.02. AML, CTF & SANCTIONS s the Entity have a programme that setsminimum AML, CTF and Sanctions standardsregarding the following components:Appointed Officer with sufficient experience /expertiseCash ReportingCDDEDDBeneficial OwnershipIndependent TestingPeriodic ReviewPolicies and ProceduresRisk AssessmentSanctionsPEP ScreeningAdverse Information ScreeningSuspicious Activity ReportingTraining and EducationTransaction MonitoringIs the Entity's AML, CTF & Sanctions policyapproved at least annually by the Board orequivalent Senior Management Committee?Does the Entity use third parties to carry out anycomponents of its AML, CTF & Sanctionsprogramme?If Y, provide further esNoNo# 10)Procedures must be kept up-to-date on a regular basis. In the absence of a specified time frame, the defaultreview period is 36 months from the validation date.However, a procedure may be reviewed and updated at anytime should events or circumstances demand it.#11) except for some AML tools or training modules3. ANTI BRIBERY & CORRUPTION12Has the Entity documented policies andprocedures consistent with applicable ABCregulations and requirements to [reasonably]prevent, detect and report bribery and corruption?Yes131414 a14 b14 c14 d14 eDoes the Entity's internal audit function or otherindependent third party cover ABC Policies andProcedures?Does the Entity provide mandatory ABC trainingto:Board and Senior Committee Management1st Line of Defence2nd Line of Defence3rd Line of Defence3rd parties to which specific compliance activitiessubject to ABC risk have been outsourcedYesYesYesYesYesNot Applicable14 fNon-employed workers as appropriate(contractors / consultants) The Wolfsberg Group 2018NoPage 2FCCQ V1.0

Wolfsberg Group Financial Crime Compliance Questionnaire (FCCQ) v1.04. POLICIES & PROCEDURES1515 a15 b15 c1616 a16 bHas the Entity documented policies andprocedures consistent with applicable AML, CTF& Sanctions regulations and requirements toreasonably prevent, detect and report:Money launderingYesTerrorist financingYesSanctions violationsYesDoes the Entity have policies and proceduresthat:Prohibit the opening and keeping of anonymousand fictitious named accountsProhibit the opening and keeping of accounts forunlicensed banks and / or NBFIs16 cProhibit dealing with other entities that providebanking services to unlicensed banks16 dProhibit accounts / relationships with shell banks16 eProhibit dealing with another Entity that providesservices to shell banks16 fProhibit opening and keeping of accounts forSection 311 designated entities16 gProhibit opening and keeping of accounts for anyof unlicensed / unregulated remittance agents,exchanges houses, casa de cambio, bureaux dechange or money transfer agentsYesYesYesYes16 hAssess the risks of relationships with PEPs,including their family and close associates16 iDefine escalation processes for financial crimerisk issues16 jSpecify how potentially suspicious activityidentified by employees is to be escalated andinvestigatedOutline the processes regarding screening forsanctions, PEPs and negative media16 k17YesYesYesYesYesYesYesHas the Entity defined a risk tolerance statementor similar document which defines a riskboundary around their business?Yes1818 aDoes the Entity have a record retentionprocedures that comply with applicable laws?If Y, what is the retention period? The Wolfsberg Group 2018Yes5 years or morePage 3FCCQ V1.0

Wolfsberg Group Financial Crime Compliance Questionnaire (FCCQ) v1.05. KYC, CDD and EDD19Does the Entity verify the identity of thecustomer?20Do the Entity's policies and procedures set outwhen CDD must be completed, e.g. at the time ofonboarding or within 30 daysYes21 aWhich of the following does the Entity gather andretain when conducting CDD? Select all thatapply:Ownership structure21 bCustomer identification21 cExpected activity21 dNature of business / employment21 eProduct usage21 fPurpose and nature of relationship21 gSource of funds21 hSource of wealth22Are each of the following identified:22 aUltimate beneficial ownership22 a1Are ultimate beneficial owners verified?22 bAuthorised signatories (where applicable)22 cKey controllers22 dOther relevant parties23Does the due diligence process result incustomers receiving a risk classification?24Does the Entity have a risk based approach toscreening customers and connected parties todetermine whether they are PEPs, or controlledby PEPs?25Does the Entity have policies, procedures andprocesses to review and escalate potentialmatches from screening customers andconnected parties to determine whether they arePEPs, or controlled by ctors, guarantors, parent companies, legal representatives of individualsYesYesYes26Does the Entity have a process to review andupdate customer information based on:26 aKYC renewal26 bTrigger event27From the list below, which categories ofcustomers or industries are subject to EDD and /or are restricted, or prohibited by the Entity's FCCprogramme?Non-account customersProhibitedOffshore customers27 a27 bYesYesEDD on a risk based approach The Wolfsberg Group 2018Page 4FCCQ V1.0

Wolfsberg Group Financial Crime Compliance Questionnaire (FCCQ) v1.027 cShell banks27 dMVTS/ MSB customers27 ePEPs27 fPEP Related27 gPEP Close Associate27 hCorrespondent Banks27 h127 iIf EDD or EDD & Restricted, does the EDDassessment contain the elements as set out inthe Wolfsberg Correspondent Banking Principles2014?YesArms, defense, military27 jAtomic power27 kExtractive industries27 lPrecious metals and stones27 mUnregulated charities27 nRegulated charities27 oRed light business / Adult entertainment27 pNon-Government Organisations27 qVirtual currencies27 rMarijuana27 sEmbassies / Consulates27 tGambling27 uPayment Service Provider27 vOther (specify)28If restricted, provide details of the restrictionProhibitedEDD on a risk based approachEDD on a risk based approachEDD on a risk based approachEDD on a risk based approachEDD on a risk based approachEDD on a risk based approachEDD on a risk based approachEDD on a risk based approachEDD on a risk based approachEDD on a risk based approachEDD on a risk based approachProhibitedEDD on a risk based approachEDD & Restricted on a risk based approachProhibitedEDD on a risk based approachEDD & Restricted on a risk based approachEDD & Restricted on a risk based approachUnregulated cryptocurrency platforms, gambling and MSB not licensed. The Wolfsberg Group 2018Page 5FCCQ V1.0

Wolfsberg Group Financial Crime Compliance Questionnaire (FCCQ) v1.06. MONITORING & REPORTING29Does the Entity have risk based policies,procedures and monitoring processes for theidentification and reporting of suspicious activity?30What is the method used by the Entity to monitortransactions for suspicious activities?30 aAutomatedYesNo30 bManualNo30 cCombination of automated and manualYes31Does the Entity have regulatory requirements toreport currency transactions?31 aIf Y, does the Entity have policies, proceduresand processes to comply with currency reportingrequirements?32Does the Entity have policies, procedures andprocesses to review and escalate matters arisingfrom the monitoring of customer transactions andactivity?NoYes7. PAYMENT TRANSPARENCY33Does the Entity adhere to the Wolfsberg GroupPayment Transparency Standards?34Does the Entity have policies, procedures andprocesses to [reasonably] comply with and havecontrols in place to ensure compliance with:34 aFATF Recommendation 1634 bLocal Regulations34 b1Specify the regulationYesYesYesFrance for the Head Office34 cIf N, explain The Wolfsberg Group 2018Page 6FCCQ V1.0

Wolfsberg Group Financial Crime Compliance Questionnaire (FCCQ) v1.08. SANCTIONS35Does the Entity have policies, procedures orother controls reasonably designed to prohibitand / or detect actions taken to evade applicablesanctions prohibitions, such as stripping, or theresubmission and / or masking, of sanctionsrelevant information in cross border transactions?Yes36Does the Entity screen its customers, includingbeneficial ownership information collected by theEntity, during onboarding and regularly thereafteragainst Sanctions Lists?37Select the Sanctions Lists used by the Entity in itssanctions screening processes:37 aConsolidated United Nations Security CouncilSanctions List (UN)37 b37 c37 dUnited States Department of the Treasury'sOffice of Foreign Assets Control (OFAC)Office of Financial Sanctions ImplementationHMT (OFSI)YesUsed for screening customers and beneficial owners and for filtering transactional dataUsed for screening customers and beneficial owners and for filtering transactional dataUsed for screening customers and beneficial owners and for filtering transactional dataEuropean Union Consolidated List (EU)Used for screening customers and beneficial owners and for filtering transactional data37 eOther (specify)French sanctions lists are "used for screening customers and beneficial owners and for filtering transactional data"group-wide ; other lists are used as applicable to BNP Paribas locally38Does the Entity have a physical presence, e.g.,branches, subsidiaries, or representative officeslocated in countries / regions against which UN,OFAC, OFSI, EU and G7 member countries haveenacted comprehensive jurisdiction-basedSanctions?No9. TRAINING & EDUCATION39Does the Entity provide mandatory training, whichincludes :39 aIdentification and reporting of transactions togovernment authorities39 bExamples of different forms of money laundering,terrorist financing and sanctions violationsrelevant for the types of products and servicesoffered39 cInternal policies for controlling money laundering,terrorist financing and sanctions violations39 dNew issues that occur in the market, e.g.,significant regulatory actions or new regulations40Is the above mandatory training provided to :40 aBoard and Senior Committee Management40 b1st Line of Defence40 c2nd Line of Defence40 d3rd Line of Defence40 e3rd parties to which specific FCC activities havebeen outsourcedNon-employed workers (contractors /consultants)YesYesYes40 fYesYesYesYesYesYesNot ApplicableNo10. AUDIT41In addition to inspections by the governmentsupervisors / regulators, does the Entity have aninternal audit function, a testing function or otherindependent third party, or both, that assessesFCC AML, CTF and Sanctions policies andpractices on a regular basis?Yes The Wolfsberg Group 2018Page 7FCCQ V1.0

Aug 10, 2019 · cf attached document 3 Full Legal (Registered) Address 16, Boulevard des Italiens - 75009 Paris FRANCE 4 Full Primary Business Address (if different from above) 5 Date of Entity incorporation / establishment 23 Sept. 1966 6 Select type of ownership and append an ownership chart if availabl