EFTA01371261.pdf

Compliance with DB's corporate standards is monitored regionally by Regional Business Continuity Council reporting on a quarterly basis through the Global Business Continuity Council. Crisis Management & Implementation DB's Information & Resilience Risk Management division ensures that DB has a clearly defined, documented and tested crisis management process for assessing, escalating and managing any business disruption that may affect DB's ability to continue its critical business operations. This includes a crisis contact and escalation process which is tested on a regular basis. In addition, DB's BCPs are designed to be implemented in response to varying levels of business disruptions. The nature of the business disruption will affect whether all or only parts of our plans are executed. Business Continuity Recovery Solutions DB has a broad recovery program in place to deal with the impact of incident or crisis. The Bank has a number of customized recovery solutions designed to facilitate the quickest possible resumption of work for the critical businesses and support functions. Examples of these are: - Alternate Sites DB has self-managed, dedicated standby facilities. These recovery sites provide dedicated recovery seats and infrastructure to provide for the needs of the business. Additionally, DB retains recovery sites contractually through service providers who concentrate on business resiliency. All recovery sites are physically separated from normal business locations to prevent both sites being affected by the same incident. - Reciprocal Agreements Some businesses have partnership agreements with other business units regarding the allocation of a required number of recovery seats or the ability to transfer work. The receiving business unit provides the necessary infrastructure, hardware facilities or staff. Both normal business locations are geographically separated from each other to prevent both sites being affected by the same incident. - Displacement Strategy Certain business processes can be switched from one location to another and in the longer term key staff can move to another location unaffected by the incident. - Remote Access Staff may work remotely, where permitted, in the event of a disruption accessing DB systems via VPN and can divert their telephones to a home or mobile number. Service Providers Service Providers are contractually obliged to have business continuity capabilities in place to ensure continuity of services provided to DB if the ordinary operation of the Service Provider is disrupted and to modify their work stream in order to adapt with the business continuity organization of Deutsche Bank A very robust and thorough vendor risk management process is in place to ensure compliance. Pandemic Planning DB maintains a risk-based approach to pandemic planning, using as a guide the World Health Organization (WHO) definitions of pandemic phases. Customer Access to Funds and Securities If your usual access to funds and securities is impacted by a significant business disruption, we will advise you of the appropriate DB contacts through expedient means at www.db.com. CONFIDENTIAL - PURSUANT TO FED. R. CRIM. P. 6(e) DB-SDNY-0064543 CONFIDENTIAL SDNY_GM_00210727 EFTA01371261