Acronis AG Sanctions and Export Controls Compliance Policy

1. Introduction

The United States maintains and enforces a variety of economic sanctions against designated countries and their nationals, agencies, and instrumentalities, as well as sanctions on specific individuals and entities around the world. The U.S. Department of the Treasury, Office of Foreign Assets Control ("OFAC") is primarily responsible for enforcing trade sanctions laws in the United States. In addition, U.S. export control laws, implemented by the U.S. Department of Commerce, Bureau of Industry and Security ("BIS"), govern the use and movement of U.S.-origin goods, software, and technology in and out of certain countries and jurisdictions.

1.1. Policy Statement

It is the policy of Acronis AG, and each of its subsidiaries and other business entities controlled by it worldwide (collectively, the "Company") to remain in full compliance with all applicable trade sanctions and export control laws. It is the responsibility of each employee, business partner, and agent of the Company engaged in international activities to ensure that those activities are consistent with all applicable economic sanctions and export control laws.

1.2. Referenced Policies

For purposes of this Policy, “Referenced Policies” means the Acronis policies, standards, guidelines, procedures, certifications, compliance materials, and related requirements identified in this Policy or otherwise communicated by Acronis from time to time, including policies relating to anti-corruption, sanctions and export controls, anti-money laundering, ethics, supplier management, sponsorships, data protection, privacy, information security, artificial intelligence, platform use, market development funds, and other compliance matters.

References in this Policy to a Referenced Policy include any amendment, update, replacement, successor, consolidation, or renamed version of that policy or document addressing substantially the same subject matter.

Referenced Policies may be made available through the Acronis website, partner portal, supplier portal, procurement process, onboarding materials, contractual documentation, annual certification processes, compliance communications, or other channels designated by Acronis.

Employees, Channel Partners, Suppliers, Sponsored Parties, and other persons subject to this Policy are responsible for reviewing and complying with applicable Referenced Policies relevant to their relationship with Acronis. Where this Policy, an applicable agreement, certification requirement, onboarding process, or compliance communication requires compliance with a Referenced Policy, that Referenced Policy forms part of Acronis's compliance requirements for the applicable relationship. Failure to comply with an applicable Referenced Policy may result in corrective action, suspension, termination of applicable agreements, or other remedies available under contract or law, subject to applicable law and contractual rights.

1.3. Scope

This Sanctions and Export Controls Policy ("Policy") applies to all Acronis directors, officers, and employees and agents, whether temporary or permanent, full-time or part-time. The Policy also applies to Acronis’s Channel Partners, Suppliers, and Sponsored Entities as those terms are defined in Section 8 below.

Related Compliance Policies. This Policy forms part of Acronis's broader ethics and compliance program and should be read together with applicable Referenced Policies and any other compliance requirements or contractual obligations communicated by Acronis. In the event of a conflict between this Policy and the Agreement, the terms of the Agreement shall govern; provided, however, that Acronis may require compliance with any provision of this Policy that imposes a higher ethical, compliance, security, or legal standard, to the extent permitted by applicable law and the Agreement. Compliance with this Policy does not relieve any person or entity of its obligations under those policies, the applicable Agreement, or applicable law.

Channel Partners, Suppliers, and Sponsored Entities are expected to maintain controls reasonably designed to comply with applicable sanctions, export controls, anti-corruption, anti-money laundering, fraud prevention, and related legal requirements in connection with Acronis products, services, technology, incentives, and business activities.

2. Key Concepts

2.1 What are Sanctions?

Sanctions are rules imposed by governments that restrict or prohibit business activities with certain countries, individuals, or organizations. Sanctions are used to protect national security and economic interests and may include prohibitions on trade or services, freezing of financial assets and/or restrictions on financial transactions or travel. Even indirect or unintentional involvement in a transaction with a sanctioned party may result in serious legal consequences.

2.2 What are Export Controls?

Export controls are laws that restrict the transfer or sharing of certain goods, software, technology, or services across borders or to specific persons or entities. These laws are designed to protect national security, prevent the proliferation of weapons and support foreign policy objectives. Export controls may apply to physical products, software and technology, cloud services, technical data and technical support. They can also apply based on the destination country, the identity of the end user or the intended use of the product, service, or technology.

3. Prohibited Jurisdictions

3.1. Jurisdictions Subject to U.S. Economic Sanctions

In this Policy, “U.S. persons” means U.S. citizens, permanent residents, individuals present in the United States, and entities organized under the laws of the United States or a sub-jurisdiction of the U.S., for example, states, counties, cities, and towns. U.S. persons are generally prohibited from engaging in transactions involving the following jurisdictions (“Prohibited Jurisdictions”):

• Cuba
• Iran
• North Korea (Democratic People's Republic of Korea (DPRK))
• Temporarily occupied territories of Ukraine, as designated by the Government of Ukraine, including Crimea and Sevastopol and occupied territories within Donetsk, Luhansk, Zaporizhzhia, Kherson, Kharkiv and Mykolaiv oblasts

This means that any transaction with or involving these Prohibited Jurisdictions or where a benefit is received from or in one of these Prohibited Jurisdictions or any of their governments, agencies, and instrumentalities is prohibited is prohibited.

3.2. Restrictions on the Company’s Non-U.S. Operations

The restrictions on doing business involving any Prohibited Jurisdictions apply directly to both U.S. persons and entities owned or controlled by a U.S. person. Accordingly, any Company non-U.S. subsidiary generally is subject to the same restrictions as a U.S. person for activity involving any Prohibited Jurisdictions.

Other U.S. sanctions programs only apply to U.S. persons. Thus, it is possible for non-U.S. subsidiaries of the Company to lawfully engage in transactions that would violate U.S. sanctions laws if performed by the Company directly. Notwithstanding the foregoing, it is the Company’s policy that the Company, including without limitation each subsidiary of the Company and other business entities controlled by it worldwide, will be treated as though it is subject to the same restrictions as a U.S. person for all U.S. sanctions programs.

4. High-Risk Jurisdictions

A. Counterparties from Higher Risk Jurisdictions

Transactions involving high-risk jurisdictions require prior written approval from the company’s legal department before any commitment or business activity is undertaken.

The Company’s regular screening process includes ongoing screening for all counterparties determined to be higher risk based on the country or jurisdiction involved. The following is a list of higher risk countries and jurisdictions. As discussed below, Acronis has a policy to not do business with the countries of Russia and Belarus.

• Afghanistan
• Albania
• Bosnia and Herzegovina
• Bulgaria
• Burma (Myanmar)
• Burundi
• Central African Republic
• China (including Macau and Hong Kong)
• Colombia
• Croatia
• Democratic Republic of Congo
• Iraq
• Ivory Coast
• Kosovo
• Lebanon
• Libya
• Mali
• Mexico
• Montenegro
• Nicaragua
• North Macedonia
• Pakistan
• Panama
• Romania
• Serbia
• Slovenia
• Somalia
• South Sudan
• Sudan
• Syria
• Ukraine
• Venezuela
• Yemen
• Zimbabwe

B. Russia and Belarus-Related Sectoral Sanctions

As of March 2022, Acronis has suspended all operations in Russia and maintains internal restrictions consistent with applicable sanctions policies. More information may be found here: https://www.acronis.com/en/blog/posts/acronis-suspends-all-operations-in-russia/. Acronis has an internal policy to not do business in Russia and Belarus.

5. Screening

In addition to the embargoed jurisdiction sanctions programs discussed in the preceding section, other U.S. sanctions programs prohibit the Company from doing business with certain designated individuals and entities that are associated with certain countries, terrorism, narcotics trafficking, the proliferation of weapons of mass destruction, and criminal organizations, as well as entities owned fifty percent (50%) or more by a designated person. U.S. sanctions also prohibit certain transactions related to the extension of credit to listed entities related to certain jurisdictions that are deemed to be higher risk. It is difficult to know the identities of all such individuals/groups, but appropriate due diligence is necessary to confirm that the individuals or organizations with whom the Company is doing business are who or what they purport to be.

A. Screening Process

U.S. companies are encouraged by OFAC to employ risk-based screening to determine whether business counterparties (e.g., vendors, suppliers, customers, distributors, resellers, service providers, and joint venture partners) are subject to U.S. sanctions or other trade restrictions. Parties should be screened against OFAC’s sanctions programs, the OFAC SDN List, the Foreign Sanctions Evaders List, the Sectoral Sanctions Identification List, and all other applicable sanctions. Because the Company’s OFAC risk exposure is limited, the Company will screen all counterparties determined to be higher risk based on the country or jurisdiction involved prior to entering into a business relationship or transaction, including customers, distributors, resellers, vendors, suppliers, and service providers and assess any transaction involving an indication that the counterparty may be linked to or acting on behalf of an embargoed jurisdiction or sanctioned person.

B. Counterparties Linked to Embargoed Jurisdictions or Sanctioned Persons

The Company will screen, on a case-by-case-basis, any transaction involving an indication (e.g., media reports) that the counterparty may be linked to or acting on behalf of an embargoed jurisdiction or sanctioned person. Counterparties that present any red flag or risk indicator must be screened prior to the Company entering into any transaction with those counterparties.

Any Company employee or business partner who becomes aware of a transaction involving counterparties from higher risk jurisdictions or counterparties linked to embargoed jurisdictions and sanctioned persons must contact the Company’s legal department so that the parties to the transaction can be screened against all appropriate restricted party lists.

6. Complying with Export Control Laws

Export control laws govern the export and re-export of sensitive goods, software and technologies and are intended to protect the national security, foreign policy and economic interests of the United States. Export controls also apply to services, including cloud services, technical support, and the transfer of technical data across borders. The Company’s policy is to comply with all applicable laws governing export control.

The Export Administration Regulations ("EAR"), administered by BIS, are the primary regulations governing the export of commercial or "dual-use" items (goods, software, and technology with both civil and military applications). While most items under the control of the EAR may be exported without a license, export licenses may be required in certain situations, depending on what items are being exported, the country of destination, the identity of the end user and the intended end use of the item. Most dual use items controlled for export are those having potential for use in information security including encryption, power generation, aeronautics, avionics, nuclear systems, and guidance systems and highly toxic chemicals. U.S.-origin items may be subject to strict controls. For example, ordinary commercial items, such as laptops, smartphones, and digital recording equipment, may be subject to U.S. anti-terrorism controls, depending on the end-user or export destination.

In most cases, Company products may be exported to non-embargoed jurisdictions without a license. However, if there is any uncertainty, the Company’s legal department must be consulted before proceeding.

7. Employee and Business Partner Responsibilities

All employees and business partners have are responsible to:

• Stop and seek guidance if they are unsure whether a transaction is permitted
• Contact the Company’s legal department before proceeding in high-risk or unclear situations
• Never assume a transaction is permitted based on past practice or prior approvals
• Ensure required screening has been completed before proceeding with any transaction

8. Third-Party Compliance

The Company uses several third parties, including partners, distributors, resellers, service providers, sales representatives, advisors, agents, consultants, contractors, and other intermediaries to assist the Company in securing sales, entering and expanding into new markets, and for many other aspects of the Company’s business (collectively referred to herein as “Channel Partners” or individually as a “Channel Partner”). The Company also purchases products and services for use in the Company’s business from suppliers, vendors, and other third parties, including advisors, agents, consultants, lawyers, and other intermediaries (collectively referred to herein as “Suppliers” or individually as a “Supplier”). In addition, the Company enters into agreements whereby the Company pays competitive sports teams and players to promote the Company’s products and services (the counterparties to such contracts are referred to as “Sponsored Parties”).

The Company’s compliance expectations and applicable Referenced Policies will be communicated to relevant third parties at the outset of the business relationship and, where appropriate, throughout the relationship.

All contracts with such third parties and other relevant third parties must contain appropriate contractual provisions requiring compliance with this Policy, applicable Referenced Policies, and all applicable sanctions, export control, and trade compliance laws.

Channel Partners must comply with all applicable sanctions, export controls, customs laws, anti-boycott requirements, and other trade restrictions applicable to their activities involving the Company’s products, services, software, technology, support, and related transactions.

Channel Partners and Sponsored Entities must not knowingly sell, transfer, export, re-export, provide access to, or otherwise make available the Company’s products or services in violation of applicable sanctions or export control laws.

Channel Partners and Sponsored Entities must maintain risk-based screening and compliance procedures appropriate to their business activities and geographic footprint.

Where a Channel Partner or a Sponsored Entity controls the end-customer relationship, the Channel Partner or Sponsored Entity is responsible for conducting risk-based screening and due diligence on customers, beneficial owners, and relevant transaction participants in accordance with applicable law and contractual obligations.

Upon reasonable request, Channel Partners and Sponsored Entities must provide information reasonably necessary for the Company to assess sanctions and export-control compliance risks associated with transactions involving Acronis products and services.

Channel Partners and Sponsored Entities remain responsible for compliance by subcontractors, sub-distributors, referral partners, consultants, marketing agencies, managed-service personnel, and other third parties engaged in connection with Company business.

Channel Partner and Sponsored Entity Annual Sanctions Certification. Upon the initiation of the engagement, and annually thereafter, each Channel Partner, Supplier, and Sponsored Entity may be asked to certify compliance with this Policy, applicable Referenced Policies, applicable sanctions and export control requirements, and related contractual compliance obligations communicated by Acronis.

9. Training

The Company provides regular training on compliance with sanctions and export controls to directors, officers and employees. When necessary, specialized training will be provided to directors, officers and/or employees with significant compliance responsibilities or in high-risk functions.

10. Questions, Concerns and Reporting Requirements

Any questions about any part of this Policy should be directed to the Company’s legal department. Violations of this Policy may result in significant fines and penalties for the Company, criminal liability under applicable laws and/or disciplinary action, up to and including termination of employment. If any director, officer or employee or business partner has reason to believe that a violation of this Policy has occurred (or will occur), it is their duty to report it immediately. Concerns may be reported through the reporting channels designated by Acronis from time to time, including Acronis's Ethics & Compliance function, Speak-Up reporting channels, legal department contacts, or other reporting mechanisms communicated by Acronis to the legal department at [email protected]. The required report may also be made anonymously through the Whistleblower Hotline report.syntrio.com/acronis.

The Company strictly prohibits any discrimination, retaliation or harassment against any person who reports a concern or who participates in any investigation of a concern. Any complaint that discrimination, retaliation or harassment has occurred will be promptly and thoroughly investigated. Acronis will not tolerate retaliation, discrimination, or harassment against any Company employee or business partner because that person reported a concern or cooperated in an investigation. Communication of all questions or concerns about this or any other Company policy is encouraged.

As this list may change at any time, you are encouraged to consider carefully whether there may be restrictions in place on any country with which business is contemplated, and to consult the Company’s legal department accordingly.