SIX

SANCTIONS COMMISSION

Decision

in the proceedings SaKo - I / 2024

SIX Exchange Regulation AG (Listing & Enforcement) Hardturmstrasse 201 8021 Zurich

VS.

☒ X. [Address]

represented by [Legal representatives], [Address]

Participants of the Sanctions Commission (SaKo): [ ... ] (Chairman), [ ... ], [ ... ], [ ... ] (Secretary)

Decision of 13 February 2024

1. Sako has determined that X. _ negligently violated the applicable rules on ad ☒ hoc publicity and thereby its obligations pursuant to Art. 53 LR by failing to properly protect and disclose price-sensitive facts in relation to the Group Full- Year Results 20XX/XX, and, as a consequence, failed to comply with Art. 6 DAH

2. X. _ is ordered to pay a fine in the amount of CHF 110'000. ☒

3. X. _ is ordered to bear the costs incurred by SIX Exchange Regulation AG (SER) ☒ for these proceedings in the amount of CHF [ ... ] and the additional costs incurred by Sako in the amount of CHF [ ... ]. The total costs to be covered by X. _ amount ☒ to CHF [ ... ].

4. Once the sanction decision has become legally binding, it will be made available in anonymised form on the SER website. Furthermore, the conclusion of the pro- ceedings will be communicated to the public in a media release, with the names of the parties mentioned in the same way as when the file was submitted to Sako.

An appeal can be filed against this decision according to Art. 62 para. 2 LR within 20 trad- ing days of this decision being received. Arbitration proceedings will be instituted upon delivery of a written notice of arbitration against the other party to the lower court, i.e. SaKo ([ ... ]) according to Art. 2.1 of the Rules of Arbitration.

SIX

Reasons for the decision

1. Proceedings Overview

1 In accordance with Art. 53 Listing Rules (LR) in conjunction with the Directive on Ad hoc Publicity (DAH), SIX Exchange Regulation AG (SER) oversees the correct publication of press releases containing price-sensitive facts (so called "ad hoc an- nouncements“).

2 In connection with the events that led to the publication of the ad hoc announce- ment of X. _ (X. _ , Issuer) entitled "[Title]" published on 1 November 20XX at ☒ ☒ 1 p.m. CET (during trading hours), SER initiated a preliminary inquiry in accordance with the Rules of Procedure (RP) concerning a possible violation of the rules re- garding ad hoc publicity. Issuer responded timely by answer dated [Date].

3 Given that the case at hand involves certain technical IT issues, SER considered it essential to obtain an external opinion on those matters. SER requested Y. _ [Ex- ternal Consulting Firm] to provide an expert opinion in this regard, which was fi- nalized on [Date].

4 The Issuer raises "serious doubts as regards the formal qualification of the document "Whitepaper re web crawlers dated [Date] by Y. _ [External Consulting Firm] ... In par- ticular, the so-called "expert opinion" does in no way address the crucial question whether or not a reasonable issuer should have been aware of the risks of malicious use of web crawler technology when preparing for the regular publication of its finan- cial results .... In other words, the 2-page document ... does not and should not qualify as an "expert opinion" which is the principal basis for this sanctions proposal suggest- ing a very significant fine. However, X. _ has refrained from engaging another expert to render a real expert opinion on the crucial question and X. _ does not request that the Sanctions Commission shall engage an independent expert to render an expert opinion or serve as expert witness." Sako will deal with these aspects below, when considering the degree of fault.

5 After having considered all the evidence and the expert opinion dated [Date], SER concluded that there were sufficient indications suggesting a violation of the rules on ad hoc publicity. Therefore, on [Date], SER initiated an investigation in the sense of Ciph. 3.3 para. 1 RP against X. _. In addition, Issuer was informed in writing, that an investigation generally concludes with the abandonment of the proceed- ings or upon an agreement, the issue of a sanction notice or the submission of a proposal for sanctions with the Sanctions Commission (Ciph. 3.4 para. 1 RP).

6 The Issuer complements: "In addition to the written correspondence referenced in the Sanctions Proposal, our client as well as ourselves reached out to the staff of SER in order to explore the possibility of a settlement or an agreed penalty notice of SER. X ._ took this initiative in an attempt to avoid lengthy proceedings in front of the Sanction Commission debating a question, which has been largely clarified in the meantime.

SIX

Unfortunately, the staff of SER declined the possibility of a settlement, or an agreed penalty notice and insisted on submitting the Sanctions Proposal to the Sanctions Com- mission."

7 SER submitted on [Date] to the Sanctions Commission (SaKo) a sanction proposal of SER dated [Date] including the attachments and the response from X. _ dated [Date] regarding said sanctions proposal. The Secretary of Sako confirmed the re- ceipt on the same day. Neither party used the possibility to amend the statements, that was offered with the confirmation of receipt.

8 The parties were notified on [Date] of the composition of the delegation for the decision determined by the President and no request for recusal was filed.

9 The delegation deliberated on the sanction proposal and made its decision on 13 February 2024.

2. Findings

2.1 Formal findings

10 X. ☒ is a company incorporated under the laws of [Country] with its registered office in [Place], [Country]. Issuer's [Shares] are listed in the [Regulatory Standard] of SIX Swiss Exchange AG. By signing the Declaration of Consent dated [Date], Is- suer accepted to be bound by the stock exchange regulations, the LR, the addi- tional rules, implementing provisions and the RP in their latest version.

11 The violation of the LR, any additional regulations thereto or any implementing provisions thereof, may be sanctioned with one or more of sanctions listed in Art. 61 LR (Art. 60 LR). Competent to decide upon sanction proposals submitted by SER is the Sanctions Commission of SIX Group (Ciph. 3.4 para. 1 and Ciph. 4 RP).

12 At the time of the violation the LR dated 15 July 2022 and the DAH dated 10 March 2021 were applicable.

2.2 Material findings

2.2.1 Facts of the matter

13 In establishing the relevant facts for the sanction proposal, SER declared to have considered both the exculpatory and inculpatory facts with equal care. All infor- mation that serves to determine the facts of the case is subject to free evaluation and deemed to be evidence (Art. 3.1 para. 1 et seq. RP).

14 When publishing its Group Full-Year Results, Issuer usually published not only its Annual Report but also a Short Report (in English and German) as well as a Media and Analyst Presentation, a Roadshow Presentation and an accompanying ad hoc announcement in English, German and French. According to Issuer, it planned to publish its Group Full-Year Results 20XX/XX on 2 November 20XX.

SIX

15 In previous years, Issuer used the following URLs to publish its German Short Re- port to the Full-Year Results on its corporate website:

Short Report [year] (Ger- man)

[URL]

Short Report [year] (Ger- man)

[URL]

Short Report [year] (Ger- man)

[URL]

Short Report [year] (Ger- man)

[URL]

16 According to Issuer, at least as of [Date], a web crawler [Name] managed by the electronic information system and financial news platform Z. _ [Financial News Platform] was checking Issuer's corporate website four to five times a day.

17 According to SER, "Web crawlers have been used for over 20 years to systematically search the internet. They use algorithms to search for specific web pages or websites and extract relevant information such as text, images and links. They usually start their search with a home page and then follow links from one page to the next and/or re- peatedly check certain URLs to index and store the content of the visited web pages. In the process, they analyze the HTML structure of a website and extract relevant infor- mation that can then be used for various purposes. Web crawlers collect publicly avail- able information from websites (e.g. text, images, links, RSS feeds and APIs). However, (illegal) methods to bypass security measures against unauthorized access (such as passwords, codes or similar measures) are not used. It is important to note that the use of web crawlers does not constitute so called "hacking", since they only access infor- mation that is already accessible (e.g. by simply using the correct URL)."

18 With regard to Issuer's Full-Year Results 20XX/XX, the aforementioned Z. _ [Fi- nancial News Platform] web crawler was repeatedly checking X. _ 's URLs, all of which were similar to Issuer's previous file hosting structure, in order to obtain the sought information.

19 The Issuer argues that "X. _ was actually not aware of this risk at the time of the incident. Several informal discussions with other issuers confirmed X. _ 's assumption that a large number of issuers were also not aware of this risk prior to X. _ 's incident and/or prior to the warning notices of SER after the incident. This risk was certainly not common knowledge outside the IT and data security community. For instance, in our internal practice group of transactional lawyers advising issuers on a regular basis, none of the experienced partners or younger colleagues were actually aware of this risk when we internally learnt about the incident and discussed the unfortunate experience of our long-standing client. The rather generic wording in the preliminary inquiry letter indicates that also the staff of SER might have had its own learning curve. We doubt that the staff of SER at the time of the incident was actually fully aware of this risk and its significance for the issuers complying with the regulatory requirements and the var- ious needs of analysts and investors. What appears obvious in hindsight was not nec- essarily the reality at the time of the incident and should not be the basis for judging the culpability of X. _ in the present case." Sako will deal with these aspects when considering the degree of fault.

SIX

20 On 1 November 20XX at 10.15 a.m. CET, Issuer started preparations for the publi- cation of the Full-Year Results 20XX/XX on its corporate website. At this time, (one of) the web page(s) in preparation contained Issuer's German Version of the Short Report to the Full-Year Results 20XX/XX (Short Report 20XX/XX). Said web page was available under the URL; however, the respective web page had not yet been integrated into the navigation on Issuer's website.

21 Around 11.14 a.m. CET on 1 November 20XX, the Z. _ [Financial News Platform] web crawler was able to access the PDF file of Issuer's German Short Report 20XX/XX by using the direct URL. On 11.14 a.m. CET, Z. _ [Financial News Plat- form] published the whole German Short Report 20XX/XX (including the letter to shareholders and all key figures) and thereupon various news based on the Short Report 20XX/XX; especially the key figures contained therein.

22 On 1 November 20XX at 11.30 a.m. CET, Issuer was informed by analysts that Z. [Financial News Platform] had already published Issuer's Full-Year Results 20XX/XX a day earlier than announced.

23 At 12.13 p.m. CET on the same day, Issuer contacted SER by phone and informed that its Short Report 20XX/XX, which had not yet been officially published, was available on Z. _ [Financial News Platform]. Given that the Short Report 20XX/XX was already available on Z. _ [Financial News Platform], SER requested Issuer to publish its Full-Year Results 20XX/XX (including the Short Report 20XX/XX) as soon as possible.

24 On 1 November 20XX at 1 p.m. CET, Issuer published its Group Full-Year Results 20XX/XX by means of an ad hoc announcement pursuant to Art. 53 LR (in English, German and French). Said ad hoc announcement referenced the Annual Report 20XX/XX as well as the Short Report 20XX/XX which were simultaneously published on Issuer's website.

25 By letter dated [Date], Issuer communicated to Z. _ [Financial News Platform] its disapproval of the web crawler use and the publication of its Full-Year Results 20XX/XX. By e-mail dated [Date], Issuer provided this letter to SER for information purposes. According to Issuer, Z. _ [Financial News Platform] does not admit to any wrongdoing and takes the position that the information was "accessible" on the internet.

2.3 Rules regarding Ad hoc Publicity

2.3.1 Price sensitivity of the Short Report 20XX/XX

26 The issuer must inform the market of any price-sensitive facts which have arisen in its sphere of activity. Price-sensitive facts are facts whose disclosure can trigger a significant change in market prices (Art. 53 para. 1 LR). Whether or not the dis- closure of a fact can trigger a significant price change must be decided on a case- by-case basis prior to the disclosure or announcement. Annual and interim reports pursuant to Art. 49 and Art. 50 LR must always be published by means of an ad hoc announcement pursuant to Art. 53 LR (Art. 4 para. 2 DAH).

SIX

27 SER admits that "the Short Report 20XX/XX does not formally qualify as an annual re- port according to Art. 49 LR. However, the Short Report 20XX/XX essentially contains information which originates from the Annual Report 20XX/XX and is part of Issuer's Full-Year Results 20XX/XX publication. As the name suggests, Issuer's Short Report 20XX/XX is a summary of Issuer's Annual Report, which brings the most relevant infor- mation down to the point. The Short Report 20XX/XX is [number] pages long and con- tains, amongst other information, the key figures, a summary of the fiscal year, the letter to the shareholders, the Consolidated income Statement, the Consolidated State- ment of Comprehensive Income, the Consolidated Balance Sheet, the Consolidated Cash Flow Statement as well as a 5-Year Overview regarding the key figures. Given the pre- sent connection to the Annual Report, the Short Report 20XX/XX cannot be considered as a standalone document, independent of the annual report. Consequently, Issuer's Short Report 20XX/XX also qualifies as a per se price-sensitive fact pursuant to Art. 4 para. 2 DAH and must be published by means of an ad hoc announcement.

28 Said conclusion is reinforced by the fact that the publication of Issuer's ad hoc an- nouncement dated 1 November 20XX links both, the Annual Report 20XX/XX, and the Short Report 20XX/XX, and that both the Annual Report 20XX/XX as well as the Short Report 20XX/XX were simultaneously published on Issuer's website as the respective ad hoc announcement. In addition, the qualification of the Short Report 20XX/XX as per se price-sensitive is in line with Issuer's qualification.

29 In any case, Sako constant practice states that financial figures (i.e. annual and interim results, quarterly results and key financial figures in general) are as a mat- ter of constant rule to be considered price-sensitive (see Guideline of SER on the DAH, number 69, as well as exemplary Decision of the Committee of the Admission Board of 1 November 2004 [ZUL/AhP/III/04], number 12 et seqq .; of 7 January 2005 [ZUL/AhP/IV/04], number 13 et seq .; Decision of the Sanctions Commission of 16 April 2009 [SaKo/AHP/MP-II/08], number 5 et seq .; of 26 November 2009 [SaKo/AHP/II/09], number 18). As the Short Report 20XX/XX contained a summary of Issuer's annual Report including key financial figures and as those financial fig- ures were unknown to the market at the time, these figures respectively the Short Report 20XX/XX must be considered price-sensitive in accordance with the above- mentioned and long-standing case law.

30 The Issuer "does not challenge that regular financial reporting and in particular, the full-year financial statements and relating disclosure qualifies as per se price sensitive information, but he wants to remind Sanction Commission that the price sensitivity in this particular case was minimal. The share price and the trading volumes did hardly move after the unexpected leak and the disclosure of the Short Report by Z. _ [Finan- cial News Platform] at 11.14 and the release of the full information by X. _ at 13:00. The share price moved within a narrow band of 1 % with unchanged trading volumes and there was no indication of a disorderly market. This minimal effect on the share price was probably owed to the fact that the financial results of X. _ largely met the expectations of analysts and investors".

31 Sako sees no relevance in this explanation of the issuer. As the decision whether or not the disclosure of a fact is capable of triggering a significant price change

SIX

must be decided on a case-by-case basis prior to the disclosure or announcement, price movements after the publication are irrelevant for such a decision.

32 Furthermore, from the SaKo's point of view, the present case constitutes an of- fence per se. A subsequent share price development plays even less of a role here. It is therefore difficult for the Sako to understand why this argument is raised in the issuer's statement.

33 Sako considers the information in the said short report as price sensitive and subject to the obligation of Ad hoc-publicity according to Art. 53 para. 1 LR.

2.3.2 Violation of the principle of equal treatment

34 It is important for the market integrity that price-sensitive facts be published in such a way as to ensure equal treatment of all market participants (Art. 53 para. 3 LR in conjunction with Art. 6 DAH). In order to ensure that all market participants have the same opportunity to become aware of a price-sensitive fact, these must be distributed at the very least to the addresses set out in Art. 7 et seqq. DAH.

35 SER rightly states that the issuer is responsible for the proper fulfilment of its ob- ligations (Art. 10 para. 2 DAH). It must take due account of the aims of transparency and equal opportunities for all market participants in its handling of information. It is the sole responsibility of the issuer to organize itself in such a way that no provisions of stock exchange regulations are violated (Art. 53 LR, see Decision of the Sanctions Commission of 2 August 2019 [SaKo 2019-AHP-I/19], number 44).

36 On 1 November 20XX at 10.15 a.m. CET, Issuer started preparations for the publi- cation of the Full-Year Results 20XX/XX on its corporate website. Therefore, Issuer uploaded the Short Report 20XX/XX to the specific web page. While the respective URL could not have been reached via the navigation on Issuer's website, it was accessible by simply entering the respective URL into a Browser. As the respective content was not protected with any security measures as well as the URL being similar to the past file-hosting structure of Issuer, the Z. _ [Financial News Plat- form] web crawler was able to access the web page and the financial information. This resulted in Z. _ [Financial News Platform] retrieving the German PDF version of the Short Report 20XX/XX. Thereupon, on 1 November 20XX at 11.14 a.m. CET - and thus during trading hours - Z. _ [Financial News Platform] published the German PDF version of the Short Report 20XX/XX.

37 Said publication of Issuer's Short Report 20XX/XX by Z. _ [Financial News Plat- form] resulted in some market participants becoming aware of the Short Report 20XX/XX and therefore key parts of Issuer's Annual Report 20XX/XX - namely but not exhaustively the definitive key financial figures - during trading hours. SaKo recognises that the Z. _ [Financial News Platform] report was picked up by other media outlets and that other market participants were thus informed. Neverthe- less, not all prescribed information channels were used as part of Z. _ 's [Financial News Platform] publication. Hence, the publication of the Short Report 20XX/XX by Z .__ [Financial News Platform] violated the principle of equal treatment (Art. 6 DAH).

SIX

38 According to SER, "Issuer failed to organize itself in such a way to prevent violations of stock exchange regulations by not establishing appropriate security measures prevent- ing unauthorized access to the web page containing the Short Report 20XX/XX. The vio- lation of the principle of equal treatment is therefore fully attributable to Issuer."

39 The Issuer "strongly disagrees with the conclusions of the Sanctions Proposal [regard- ing the responsibility for the publication] for the following reasons:

- X. _ has not published the financial information.

- By starting the preparations for the publication on its website, X. _ did not itself publish the financial results. It was working on a proprietary system only.

- It may be correct that X. _ has not taken all available security measures in order to protect the confidentiality of the price-sensitive information prior to its planned release, but it did not itself make the information publicly available.

- It required a special technique and a significant effort to discover the infor- mation on X. _ 's proprietary system.

- Z .__ [Financial News Platform] published the information without any kind of authorization or implied consent of X. _. "

40 SER adds "for the sake of completeness, it should be mentioned that contrary to Issuer's assumption, the incident at hand does not qualify as an information leak pursuant to Art. 54 LR in connection with Art. 17 DAH. Due to the fact that financial figures are not based on a plan, or a decision made by the issuer, no postponement of disclosure (Art. 54 LR in connection with Art. 16 para. 2 DAH) can be claimed (see Guideline of SER on the DAH, number 199)."

41 The Issuer contradicts, that "the announcement of the regular financial results re- quires an internal preparation phase, on the one hand for internal decision-making by the competent bodies of the issuer and on the other hand, a relatively short phase for the final preparation of the communication after discussion and approval by the com- petent bodies. Although this preparation phase may not formally qualify as a postpone- ment of disclosure in the sense of Art. 54 LR, we are of the opinion that similar require- ments for ensuring confidentiality apply during this phase as well. As discussed above, X ._ 's responsibility is in our view limited to the compliance with the applicable require- ments for ensuring confidentiality. Generally, the issuer must ensure through appropri- ate and comprehensible internal rules or processes that the confidentiality of the price- sensitive fact is ensured until the planned release. According to Note 195 of the Guide- lines of SER on the Directive on Ad hoc Publicity ("DAH Guideline"), the issuer is free to choose the organisational methods and instruments for ensuring confidentiality. The issuer is expected to keep its internal rules, processes and measures in line with the latest developments and best practice with regard to safeguarding confidentiality and ensure that the rules it adopts comply with the relevant standard of a listed company. This guidance from SER as provided at the time of the incident remained rather ge- neric."

SIX

42 Sako notes that the principle of equal treatment has been violated in the present case as price-sensitive facts have been accessible on the website of the issuer with- out sufficient data protection during the preparation phase for the planned publi- cation. As a consequence, business media were able to communicate these facts to a part of market participants only. The correct information to all market partici- pants according to the rules for Ad hoc-publicity happened then with a delay of one hour 45 minutes.

43 Therefore, Sako states that the principle of equal treatment according to Art. 53 para. 3 LR in conjunction with Art. 6 DAH has been violated.

3. Sanction

44 The issuer is and remains fully responsible for violations of all listing rules relating to his company. The degree of fault and the severity of the case are discussed be- low.

45 Such violations are sanctioned in accordance with Art. 61 LR. The sanctions listed therein may be imposed cumulatively. Art. 61 para. 2 LR provides that in determin- ing the sanction to be imposed, due consideration must be given to the severity of the breach and to the degree of fault. In cases where the issuer is to be sanctioned with a fine, the impact of the sanction on the party concerned must also be con- sidered when setting the amount of the fine.

3.1 Degree of fault

3.1.1 Commission of the breach

46 The LR requires issuers to ensure compliance with the LR, additional rules and re- lated implementing decrees at all times. This includes the obligation for effective technical measures. In this case, the sanction is addressed to a legal entity and states that the issuer has not taken all necessary and reasonable organisational precautions to prevent a breach of the obligations under the LR. Accordingly, the fault is assessed based on largely objective standards. The conduct of the natural persons or bodies acting on behalf of the issuer are attributed to the latter (see Sako decision of 14 April 2015 [Sako 2015-AhP-I/15], No. 19, and of 30 July 2010 [Sako 2010-CG-II/10/SaKo 2010-MP-I/10], No. 13; see also sanction notice of SER of 12 August 2013 [SER-KTR-FOR-I/13], No. 28, and of 4 February 2013 [SER-MT II/12/SER-AHP I/12/SER-Listing I/12], No. 103).

47 In principle, those who have not considered the consequences of their behaviour due to negligent carelessness or have not taken them into account are deemed to act negligently. The basic prerequisite for the existence of a breach of the duty of care is the foreseeability of the result of the event. The sequence of facts leading to the result must have been foreseeable in their essential features (see decision of the Sanctions Commission of 13 August 2013 [Sako 2013-AHP-I-12], number 36; sanction notice SIX Exchange Regulation AG of 21 August 2014 [SER-MP-I/14], number 22; of 11 October 2013 [SER-AHP-I/13], number 48; of 12 August 2013

SIX

[SER-KTR-FOR-I/13], number 26; of 4 February 2013 [SER-MT-II/12/SER-AHP- I/12/SER-Listing I/12], number 102).

48 In the assessment of the degree of fault, the constant practice is to expect from listed companies' compliance with stock exchange regulations without further ado. The responsible employee must be familiar with the relevant regulations, in- cluding the applicable accounting standard, comments and practice of the stock exchange bodies (see decisions of the Sanction Commission of 14 April 2015 [Sako 2015-AHP-I/15], number 26; of 13 August 2013 [Sako 2013-AHP-I/12], number 37) and take the necessary measures, including such of technical nature. Because of the issuer's duty of care, every issuer is expected to be familiar with the applicable stock exchange rules, commentaries, guidelines, and practice of the judicial bod- ies. Any breach of the rules and regulations must raise a presumption of negli- gence of the issuer in failing to discharge its duty of care (see sanction notice of SIX Exchange Regulation of 11 October 2013 [SER-AHP-I/13], number 49; of 4 Feb- ruary 2013 [SER-MT II/12/SER-AHP I/12/SER-Listing I/12], number 104).

49 According to SER, "Issuer as a listed company should have been aware of the fact that web crawlers exist, of how web crawlers work and that web crawlers are used by the leading electronic information systems such as i.e. Z. _ [Financial News Platform] for retrieving information. Hence, in light of the fact that web crawlers have been used for more than 20 years and that it is common knowledge that providers such as Google or Z .__ [Financial News Platform] use web crawlers to search and index websites for their business purposes, Issuer as a listed company would have been expected to be aware of the risks associated with web crawlers.

50 Even if Issuer was actually unaware of the existence of web crawlers respectively the risk associated with them, Issuer must nevertheless have been aware that content pub- lished on a web page in the public domain can be accessed by third parties by simply entering the correct URL in the browser. Especially in view of the fact that the URL to the Short Reports have remained approximately the same over the years, it cannot be de- nied that Issuer must have been aware that any interested party could have gained access to the Short Report 20XX/XX without any major effort if they had wanted to (i.e. if they had systematically queried URL combinations)."

51 X. _ replies that "X. _ 's responsibility is in our view limited to the compliance with the applicable requirements for ensuring confidentiality. Generally, the issuer must en- sure through appropriate and comprehensible internal rules or processes that the con- fidentiality of the price-sensitive fact is ensured until the planned release. According to Note 195 of the Guidelines of SER on the Directive on Ad hoc Publicity ("DAH Guideline"), the issuer is free to choose the organisational methods and instruments for ensuring confidentiality. The issuer is expected to keep its internal rules, processes and measures in line with the latest developments and best practice with regard to safeguarding con- fidentiality and ensure that the rules it adopts comply with the relevant standard of a listed company. This guidance from SER as provided at the time of the incident re- mained rather generic. Only after the incident in early November 20XX, SER provided in its Regulatory Communique No. 2/2023 on 16 February 2023 further guidance as re- gards the expected standards to maintain confidentiality of price-sensitive information

in these specific situations. ... However, in the present case, the Sanction Commission cannot simply rely on and apply this additional and more specific guidance."

52 ☒ X. _ continues: "The Sanction Commission must assess whether, at the time of the incident in early November 20XX, a reasonable and average issuer should have been aware of the risks of web crawlers and become culpable in a sanction proceeding. In its judgement, the Sanction Commission must in our view consider the following aspects:

- X. _ was actually not aware of this risk at the time of the incident. ☒

- Several informal discussions with other issuers confirmed X. _ 's assumption that a large number of issuers were also not aware of this risk prior to X. _ 's ☒ incident and/or prior to the warning notices of SER after the incident.

- This risk was certainly not common knowledge outside the IT and data security community. For instance, in our internal practice group of transactional law- yers advising issuers on a regular basis, none of the experienced partners or younger colleagues were actually aware of this risk when we internally learnt about the incident and discussed the unfortunate experience of our long-stand- ing client.

- The rather generic wording in the preliminary inquiry letter indicates that also the staff of SER might have had its own learning curve. We doubt that the staff of SER at the time of the incident was actually fully aware of this risk and its significance for the issuers complying with the regulatory requirements and the various needs of analysts and investors.

- What appears obvious in hindsight was not necessarily the reality at the time of the incident and should not be the basis for judging the culpability of X. in the present case."

53 Sako reminds that all evidence is subject to a free evaluation of evidence in the course of a sanction procedure. The note submitted by SER on the function of web crawlers is not considered by the Sako to be a formal expert opinion, as the formal requirements of 3.1 para. 3 RP are not met. Sako takes it as a pure technical de- scription. After all, a simple internet search shows that web crawlers have existed since 1994 and form the basis of internet searches such as Google, Bing or searches by media. The use of web crawlers does not represent a very special tech- nique, nor does it breach simple security measures such as password protection or encryption. Sako considers the fact that this is only known in IT circles to be an unsubstantiated defence assertion by one party. It is not clear to Sako what relief the issuer can derive from the statement that consulting lawyers from the legal representative's practice group were not aware of a corresponding confidentiality risk. Rather, it is common knowledge that all unprotected data can be accessed on the Internet, even if it is not (yet) integrated into the formal structure of a website.

54 Sako points out that the present case is not the first such event (see case Sako IX- 2023) and reminds that the responsibility for the security of confidential data lies solely with the issuer. Therefore, the level of knowledge at SER is irrelevant. The

SIX

company cannot derive any exculpatory facts from the fact that SER only issued a corresponding recommendation after the incident. If, on the other hand, no suffi- cient security measures were taken despite such a recommendation, the question of contingent intent would have to be examined.

55 SER adds: "Furthermore, Issuer had to be aware of the high relevance respectively the price-sensitivity of the Short Report 20XX/XX and should consequently have ensured con- fidentiality. Despite, Issuer processed this highly confidential information on a publicly accessible web page the day before the intended publication during trading hours. Is- suer was expected to take adequate precautionary security measures in order to pre- vent the web page or the confidential content from unauthorized access and/or to take organizational measures to prevent the uploading of confidential, price-sensitive facts on a publicly accessible web page in the first place."

56 Sako points out that the use of web crawlers to search for information is facilitated if the URL of the information in question follows regular patterns and if the time of publication on the Internet can be estimated (e.g. due to a published publication calendar). This is undoubtedly the case here.

57 The Issuer states that "Z. _ [Financial News Platform] published the information with- out any kind of authorization or implied consent of X. _. The view expressed by SER results in X. _ becoming responsible for a highly questionable and independent be- havior of Z. _ [Financial News Platform]. X. _ may accept its responsibility for a po- tential lack of security measures to ensure the confidentiality of proprietary information (which is in its own sphere of influence), but X. _ does not accept any kind of regulatory responsibility for acts committed by Z ._ [Financial News Platform]. Z. _ [Financial News Platform] is an unrelated third party using its proprietary technology that allows access to non-public information. Z. _ [Financial News Platform] is responsible for its own behavior including the decision to disclose the respective information to its users. We are still of the view that the practice and behavior of Z. _ [Financial News Platform] is highly questionable, in particular considering Z. _ 's [Financial News Platform] dom- inant market position. Z. __ [Financial News Platform] is arguably the market leader and accounting for roughly [Number] of total industry spending in global market data business according to research from [an International Consulting Firm] in 2020. Z ._ [Financial News Platform] is not just any hacker with illegal intentions, but the most important provider of financial data and one would probably expect higher ethical standards from such a significant service provider. Z. _ [Financial News Platform] could have pointed out these security loopholes to X. _ instead of taking advantage of them itself with the "primeur". It is needless to state that such practice would hardly meet the general fit and proper requirements for prudentially supervised entities .... In the present case, we cannot identify any kind of guarantee position of X. _ regarding the behavior of Z. _ [Financial News Platform] and therefore, X. _ can only be respon- sible for its own behavior and not for the one of Z. _ [Financial News Platform]."

58 Sako first notes that Z. _ [Financial News Platform] is not a party to current pro- ceedings and is not subject to the Listing Rules with respect to X. _. The allegation of violation of the principle of equal treatment is therefore not directed at Z. [Financial News Platform] but at X. __. By failing to take the necessary security measures, this company enabled and caused the discriminatory information of a

SIX

part of the market. The Short Report 20XX/XX was available unsecured on the In- ternet. It was only a matter of time before web crawlers would find the information and therefore foreseeable that some market participants would gain a knowledge advantage.

59 Given the above, it appears that Issuer did not violate the provisions intentionally. In a comparable case (Sako IX/2023) concerning the use of web crawlers and the subsequent premature publication of the annual report, Sako found that special caution was required in any case given the importance of the annual report. Against this background, the placement of the annual report in an unprotected area prior to publication must be qualified as grossly negligent ("How could the annual report have been temporarily stored in an unprotected area"). Sako follows this qualification in the present case and states that X. _ acted grossly negligent.

60 X. _ was informed by analysts (i.e. a third party) that Z. _ [Financial News Plat- form] had already published Issuer's Full-Year Results 20XX/XX a day earlier than announced. X. _ immediately informed SER of the incident and was able to pub- lish its Group Full-Year Results 20XX/XX by means of an ad hoc announcement pur- suant to Art. 53 LR (in English, German and French) within substantially less than two hours. The publication during trading hours is exceptionally justified by the fact that the information was already distributed by Z. _ [Financial News Plat- form]. Said ad hoc announcement referenced the Annual Report 20XX/XX as well as the Short Report 20XX/XX which were simultaneously published on Issuer's web- site.

61 For Sako, this rapid response is an indication of an organisation that meets high standards, as an error could be corrected quickly and in a targeted manner. The impact of the unequal treatment of market participants was limited to a short pe- riod of time. A faster correction of errors is hardly imaginable or to be expected. This fact must be considered in terms of a substantial reduction in the sanction.

3.1.2 Behaviour after the breach

62 SER reports that "Issuer reacted quickly to the publication of the Short Report 20XX/XX. It was able to distribute the ad hoc announcement referring to the publication of the Group Annual Report 20XX/XX (including the Short Report 20XX/XX) to all addressees pursuant to Art. 7 et seqq. DAH on 1 November 20XX, at 1 p.m. CET, i.e. within 1.75 hours of the publication of the Short Report 20XX/XX on Z. _ [Financial News Platform] re- spectively within 1.5 hours of becoming aware of the publication. Furthermore, Issuer has been cooperative in the proceedings. It responded in full and on time to the ques- tions posed by SER in the preliminary inquiry. Therefore, Issuer acted in fulfilment of its obligations (Art. 6 para. 5 LR). Said has neutral effect on the sanction."

63 SER adds that "following the events of 1 November 20XX, Issuer implemented addi- tional precautionary measures in order to prevent the discovery of unpublished content through use of web crawlers, other bots or related search methods. Among other things, going forward, Issuer will only upload ad hoc announcements pursuant to Art. 53 LR or price-sensitive content onto web pages after close of trading. Furthermore, documents uploaded into Issuer's CMS [Client Management System] onto a web page

SIX

will be hidden, i.e. stage-gated, meaning they cannot be accessed and are behind a security wall, until Issuer publishes the underlying web page on the scheduled date of the announcement. While this new set-up includes measures to prevent events such as the one in question, this cannot be held to Issuer's credit. As a listed company, Issuer was and is expected to have such measures in place from the beginning."

64 ☒ X. _ repeatedly accepted in the statement to the Sanctions proposal a breach of its duties to take appropriate security measures in order to ensure confidentiality of information in the phase prior to the release of regular financial information. Further, X. __ reached out to SER to close the procedure with a Sanction Notice. Sako takes this as a clear signal for the security awareness of the issuer. This is considered positively when assessing the behavior after the incident.

65 In terms of Issuer's behavior after the breach, Sako considers that Issuer not only reported the incident proactively and in a very timely manner to SER but made every effort to ensure that the ad hoc announcement referring to the publication of the Group Annual Report 20XX/XX reached all market participants within the shortest possible time after Z. _ [Financial News Platform] had already published the Short Report 20XX/XX. As stated above, the very fast reaction of X. _ must be considered positive and not only neutral as SER suggests in its sanctions proposal. This has a substantially mitigating effect on the sanction (Art. 60 LR), whereas the further measures implemented to prevent future incidents of similar nature are considered neutral. Rather, it would have been an aggravating factor, if no such future oriented measures would had been taken.

3.1.3 Behaviour in the previous years

66 There is no entry in the sanctions register that needs to be considered in the as- sessment of the sanction.

67

☒

24. _ claims: "We have some difficulty to understand the staff of SER suggesting that
25. _ 's behavior in previous years should be assessed neutrally. Usually, a clean track-

☒

record in the sanctions register is a positive aspect which should have a mitigating ef-

fect on a potential sanction."

68 Sako disagrees with X. _ 's statement. A clean record signals that an issuer re- spects its contractual duties and follows the regulations of the Stock Exchange. This is what must be expected from anyone being active on the stock market. Therefore, a clean track-record is neutral whereas an entry in the Sanctions regis- ter usually leads to an increase of the sanction.

69 In the current case, Issuer's conduct in the previous years is assessed neutrally.

3.2 Severity of the breach

70 The purpose of ad hoc publicity is to ensure that issuers provide the public with true, clear and complete information on price-sensitive events. Compliance with the rules on ad hoc publicity is essential for the functioning of a marketplace as it is designed to ensure equal treatment of market participants and transparency

SIX

(Guideline of SER on the DAH, number 6 et seq .; Decision of Sanction Commission of 28 June 2012 [Sako 2012-AHP-II/11], number 56). Therefore, a violation of the rules on ad hoc publicity is generally considered to be severe (see Decision of Sanc- tion Commission of 2 August 2019 [SaKo 2019-AHP-I/19], number 61).

71 SER adds: "Since assurance of equal treatment of market participants is virtually the ratio legis of the obligation to publish ad hoc announcements regarding price-sensitive facts, the assurance of confidentiality of the price-sensitive fact until the publication of the respective ad hoc announcement is an inherent obligation of the issuer. In light of the fact that the annual report (and related price-sensitive documents like in casu the Short Report 20XX/XX respectively the corresponding ad hoc announcement), is one of the most relevant publications (see Decision of Sanction Commission of 24 June 2022 [Sako II/2022], number 49), it is all the more essential that issuers maintain the neces- sary confidentiality with appropriate technical and organisational measures."

72 The Issuer refers to the very moderate reaction of the share price and the un- changed volumes after the unexpected leak and publication. He continues: " ... when discussing a sanction, you need to keep in mind that all Z. _ [Financial News Platform] users were aware of the price sensitive information at the same time and that the information found its way to other wire services very quickly. In other words, the inequality was limited to the market participants that use only the "push & pull" service of X. _. Without being familiar with the factual circumstances, we would be astonished if the number of such exclusive users of the "push & pull" service of X. _ would be very high and most likely, the majority of these users are not active traders in the short term. Even if there has been a factual difference in timing (we are speaking of matters of less than two hours here) the difference is not material enough to actually lead to a material information difference, amongst others also because the price-sensitive information was immediately available amongst the large majority of market participants."

73 Sako notes that standardised distribution channels and wording are defined in the regulations for the publication of ad hoc announcements in the interests of market participants. This makes it easier for all interested parties to gain an overview and systematically search for the relevant information, which improves transparency and facilitates the functioning of the market. However, this is only the case if these requirements are strictly observed by all market participants and consequently en- forced by the stock exchange. Annual and interim reports are particularly im- portant in the market. A listed issuer is expected to be aware of the importance of an annual report and to take all technical and organisational precautions to ensure that the content of the annual report remains confidential before it is published according to the rules of ad hoc publicity. In particular, it must ensure that all in- ternal and external bodies involved take sufficient organisational and technical measures to ensure that no direct or indirect access to the technical equipment used by the issuer is possible.

74 X ._ 's argument that the premature publication by Z. _ [Financial News Plat- form] was widely received and disseminated fails to fulfil its obligation to ensure equal treatment. All information channels must be used in parallel, especially the email push notifications. How many market participants use this service is irrele- vant. All interested parties must be able to rely on being served simultaneously via

SIX

the "push service". The market does not only consist of "active traders" (see X ._ 's argument) but is to be understood much more broadly.

75 The Issuer failed to fulfil these obligations in the present case. The equal treatment central to the proper functioning of the market, which is to be guaranteed by the rules of ad hoc publicity, was clearly violated.

76 When assessing the seriousness of the violation, it is not necessary for investors to have suffered concrete disadvantages; an abstract threat to the market is suffi- cient to qualify the violation as serious. Sako points out that the provisions of ad hoc publicity must ensure the (internal) functioning of the stock exchange in addi- tion to guaranteeing the equal treatment of market participants. Accordingly, vio- lations of formal requirements must also be considered serious.

77 In the present case, it appears that Issuer had not implemented security measures to avoid the pre-publication in question. Sako considers the insufficient data secu- rity that led to the premature publication of the annual report to be a clear and serious violation of the regulations, even though X. _ 's very rapid reaction prob- ably prevented further concrete damage.

78 In conclusion, the violation of equal treatment of market participants (Art. 6 DAH) in the current context must be regarded as a severe violation.

3.3 Sensitivity to sanctions

79 Taking into account the severity of the breach and the degree of fault, SaKo con- siders a fine to be the appropriate sanction in accordance with Art. 61 LR.

80 When quantifying the sanction amount, the sensitivity to sanctions must be taken into account. To assess the sensitivity to sanctions, the economic performance of the issuer is to be considered. An issuer with a lower economic performance will tend to be more severely affected by the same fine than a company with a com- paratively higher economic performance. For the determination of these fines, economic key figures can be taken into consideration, e.g. EBIT, net income, oper- ating cash flow, cash and cash equivalents or equity (see decisions of the Sanctions Commission of 28 June 2012 [Sako 2012-AHP-II/11], number 63 et seq. and of 8 De- cember 2011 [Sako 2011-AHP-I/11, SaKo 2011-CG-I/11], number 37).

81 Issuer's EBIT for the financial years 20XX/XX +1 and 20XX/XX amounted to [Amount] and [Amount]. Net profit amounted to [Amount] and [Amount]. Cash and cash equivalents as of [Reporting date] were [Amount] and [Amount]. The cash flows from operating activities were [Amount] and [Amount] while total equity stood at [Amount] and [Amount].

82 Sako considers the sensitivity to sanctions of Issuer to be low.

3.4 Amount of the sanction

83 The Swiss Financial Market Supervisory Authority (FINMA) expects stock ex- changes in Switzerland to enforce all applicable rules with strict measures. SaKo

SIX

has already warned that it tends to raise the fines for breaches compared to the practice of earlier years, so prior levels of fines do not automatically set the stand- ard for current practice. The purpose is not only to penalise an issuer for past breaches, but also to prevent breaches of the rules in the future. The sanction should in fact have a preventive effect [Sako 2016 - SER 29/15]: "[I]n recent years it has become clear that it is necessary to impose stronger sanctions for violations of the rules of the Exchange. The Sanctions Commission therefore raised the fines for breaches compared to the practice of some years ago. The sanction should have a preventive effect as well." This policy was confirmed, for instance, in the Sako decisions 026/19, 051/21, 061/21, I/2022 and II/2022, all of which saw Sako taking steps to impose higher sanctions in respect of a preventive effect.

84 The Issuer claims that "Although SER might have some pressure from FINMA to in- crease the general level of its fines, the proposed sanction in the present case would rank amongst one of the highest fines issued by SER so far and, in all fairness, the pre- sent case is probably not well suited to implement such change in policy. In addition, we are not aware that SER has ever communicated the general tightening of its sanc- tioning practice to a wider public."

85 Sako clarifies that it does not develop its sanction practice in the light of pressure, but with the aim of credibly enforcing self-regulation. This is what the law, super- visory authorities and especially the market rightly expect. In doing so, it bases its assessment on the entire sanctions framework and does not focus unilaterally on the lower range. This practice has been reflected in the decisions for some time and communicated with the publication of the respective decisions. If X. _ or its legal representatives are not aware of this, nothing can be derived from it. The statement "the proposed sanction would rank amongst one of the highest fines issued" is simply not founded.

86 The limit for a sanction is CHF 10 million for intentional violations and CHF 1 million in cases of negligence. Thereby, Sako is not bound by the sanction proposal.

87 Sako refers to an analogous case (SaKo IX/2023) in which a much smaller company was sanctioned as a X. _ with a medium sensitivity to sanctions. This argues in favour of a fine significantly above the lower quarter of the sanction range. On the other hand, the exonerating facts cited, notably the efficient and targeted reaction of the issuer, justify a substantial reduction of the fine.

88 Considering all the relevant factors for determining the sanction, notably the high degree of fault, the high severity of the breach, the low sensitivity to sanctions and - as substantial mitigating aspect - the proactive and efficient reaction as well as the timely reporting of the incident to SER, Sako sanctions X. _ with a fine of CHF 110'000, remaining at the lower range of the scale despite a stricter policy.

3.5 Publication of the decision of the sanctions commission

89 According to Art. 6 para. 7 RP, the public will be informed of any investigation con- cluded by a legally binding sanction decision. In addition, the legally binding SaKo decision will then be published on SER's website in anonymous form (Art. 6 para. 8

SIX

RP). In addition, there will be a media release, informing the public of the closure of the case. Like the information provided when the proceedings have been initi- ated, this notification is made by name.

X. _ "expects to be able to comment on the planned publication of a settlement or a

90 ☒ potential sanction notice".

91 Sako states that the company shall be informed in advance of the publication with a short notice period. Factual errors can be corrected, but there is no negotiation on the text as such. The company remains free to maintain its own communication.

4. Costs

92 In case of sanctions proceedings, charges are determined based on the expendi- ture incurred, adopting an hourly rate of CHF 300 per person according to Art. 3.7 in connection with Art. 4.1 of the List of Charges Regulatory Bodies (LocRB).

93 In this case, the charges incurred by SER to date amount to CHF [ ... ]. The costs in- curred by SaKo amount to CHF [ ... ] and shall also be borne by X. _. Therefore, X. ☒ ☒ _must cover total costs of CHF [ ... ].

Zurich, [Date]

[ ... ] Chairman

[ ... ] Secretary