Whistleblower Protection Policy

This Whistleblower Protection Policy ("the Policy") sets out TauKen Group Ltd.'s commitment to fostering a culture of transparency, accountability, and ethical conduct. It provides a secure and confidential mechanism for employees, contractors, and stakeholders to report suspected misconduct, breaches of law, or unethical behaviour without fear of retaliation.

The Policy is designed to comply with the legal frameworks of the Republic of Kazakhstan and the United Kingdom, and to uphold international standards of corporate governance and employee protection.

TauKen Group Ltd. complies with the following legislation:

Under Kazakhstan Law:

• Law of the Republic of Kazakhstan "On Combating Corruption" (2015)
• Labour Code of the Republic of Kazakhstan (2015)
• Criminal Code of the Republic of Kazakhstan (2014)
• Law "On Access to Information" (2015)

Under UK Law:

• Public Interest Disclosure Act 1998 (PIDA)
• Employment Rights Act 1996
• Companies Act 2006
• Bribery Act 2010
• Data Protection Act 2018

Where legal obligations differ, TauKen Group Ltd. applies the stricter standard.

This Policy applies to:

• All employees, officers, and directors of TauKen Group Ltd. and its subsidiaries
• Contractors, consultants, suppliers, and third-party representatives
• Any individual who becomes aware of misconduct in connection with the Group's operations

Whistleblowers may report concerns relating to:

• Bribery, corruption, or financial fraud
• Breaches of Kazakhstan or UK law
• Health and safety violations
• Environmental non-compliance
• Abuse of authority or misuse of company assets
• Discrimination, harassment, or bullying
• Breaches of TauKen's Code of Ethics or internal policies
• Any other conduct that may harm the Group's reputation or legal standing

TauKen Group Ltd. provides multiple secure channels for whistleblowing:

• Internal ethics portal (confidential, monitored by the Compliance Officer)
• Anonymous hotline operated by an independent third party
• Direct email to the Group Compliance Officer
• Written submission to the Audit & Risk Committee

All reports are treated with strict confidentiality and may be submitted anonymously.

Upon receipt of a report:

• The Compliance Officer will acknowledge the report within five working days.
• A preliminary review will be conducted to assess credibility and scope.
• If warranted, a formal investigation will be initiated, led by the Audit & Risk Committee or an independent investigator.
• Findings will be documented and, where necessary, corrective action will be taken.
• The whistleblower will be informed of the outcome, subject to legal and privacy constraints.

Investigations are conducted impartially, promptly, and in accordance with legal standards.

TauKen Group Ltd. strictly prohibits retaliation against any individual who reports a concern in good faith. Retaliation includes:

• Dismissal or demotion
• Harassment or intimidation
• Unjustified disciplinary action
• Adverse changes to duties or working conditions

Under UK law (PIDA) and Kazakhstan law (Article 6 of the Law on Combating Corruption), whistleblowers are legally protected. Any act of retaliation will result in disciplinary action and may be referred to regulatory authorities.

While TauKen encourages all genuine reports, knowingly submitting false or malicious allegations is a breach of this Policy and may result in disciplinary action. Reports must be made in good faith, based on reasonable belief.

All whistleblower reports and investigation records are handled in accordance with:

• Kazakhstan's Law on Personal Data and Protection (2013)
• UK Data Protection Act 2018 and UK GDPR

Information is stored securely and access is restricted to authorised personnel only.

All employees receive training on whistleblower rights and reporting procedures during onboarding and annually thereafter. Awareness campaigns are conducted to reinforce the importance of ethical conduct and safe reporting.

This Policy is reviewed annually by the ESG & Compliance Committee and updated to reflect changes in law, regulation, and operational risk. Amendments are approved by the Board of Directors and communicated to all stakeholders.