PROCEDURE FOR THE RECEIPT AND EXECUTION OF CUSTOMER TRADE AND TRANSFER ORDERS

1. PURPOSE

The purpose of this procedure is to regulate the principles regarding the processes of receiving, processing and executing customer orders at Whitebit Kripto Varlık Alım Satım Platformu A.Ş. (hereinafter referred to as the "Company"). In this context, it is aimed to ensure that the crypto asset purchase, sale and transfer orders received from customers are executed in a safe, transparent, effective, fair, stable and competitive manner, to prevent market disruptive actions and transactions and to establish an order management systematic in full compliance with the legislation.

2. SCOPE

This procedure covers customer purchase, sale and transfer orders executed in the trading environment operating within the Company. It also includes the evaluation and execution of transactions and transfer requests made by being a direct counterparty outside the trading environment within the platform. It also defines the duties and responsibilities of all units involved in these processes.

3. DEFINITIONS

Definitions are in line with the internal "Glossary of Definitions and Abbreviations". Definitions used specifically within the scope of this procedure are listed below:

Platform: A system established to provide one or more of the following services: crypto asset trading, initial sale or distribution, clearing and transfer, and custody services required by these transactions.
Trading Environment: The digital infrastructure on the platform where customer orders for crypto assets are matched and executed.
Order: An instruction to buy, sell or transfer crypto assets transmitted by the Client.
Counterparty Trading: Transactions that are executed by the platform fulfilling customer orders directly from its own wallet.
Order Execution Policy: An internal regulation that determines the method, rules and priority system for the execution of customer orders and is put into effect upon the decision of the board of directors.
Liquidity Provider: A third party that provides a trading price to increase market liquidity for crypto assets traded on the platform.

4. GENERAL PRINCIPLES

All processes of receiving, processing, executing and recording customer orders are carried out in full compliance with the Capital Markets Board regulations, the order execution policy approved by the platform's board of directors and the provisions contained in customer contracts. Confidentiality of the customer's identity and transaction data is maintained throughout all order processing and execution processes. The data obtained are accessible only to authorized personnel and are stored in encrypted environments within the scope of the Personal Data Protection Authority No. 6698 ("KVKK") and the Information Systems Management Communiqué. In this context, the platform pays utmost attention to the following basic principles:

Honesty, openness, trust, competitiveness, transaction security, transparency and systemic integrity are essential in all processes from the transmission of customer orders to execution.
All customer orders received on the platform are systematically identified with a unique order number, recorded with an automatic time stamp and subject to audit trails.
In order to execute orders, price priority rules are applied first and then time priority rules are applied. Orders matched within the framework of these rules are executed automatically.
All transactions are executed within the scope of the order execution policy, which is put into effect and kept up to date by the decision of the board of directors of the platform. This policy is periodically reviewed in line with legislative changes and implementation experiences.
In the event that the platform executes transactions from its own wallet as a counterparty to customer orders, this matter shall be notified to customers in advance, clearly and understandably, and customers shall be informed about the possibility that the loss of the investor in such transactions may result in the platform making a profit.
The listing criteria, transparency, technology infrastructure, past price movements, fraud potential, liquidity and market making conditions of the traded crypto assets are continuously monitored; orders or transaction movements that cannot be explained with reasonable and economic justification are immediately reported within the platform and reported to the price surveillance system.
It is ensured that all transactions are recorded in a complete, accurate and up-to-date manner, can be traced backwards when necessary and stored in a way that can be submitted to the competent supervisory authorities.

5. PROCESS FOR RECEIVING CUSTOMER ORDERS

5.1. System Structure

All processes related to the receipt of customer orders via the Platform are structured in accordance with the principles of high accessibility, security and integrity to ensure the uninterrupted operation of technical systems.

5.2. Order Processing Steps

Client orders are transmitted via the platform's mobile application, web-based user interface or programmatic API connection. The processes regarding the receipt and processing of orders into the system are carried out in accordance with the following steps:

Entry of Orders into the System: Each order submitted by the client is recorded in the platform's order management system with a unique order number and automatic time stamp as soon as it is transmitted.
Order Classification: Received orders are classified according to their content into categories such as limit order, market order, transfer order, cancellation/withdrawal request.
Validity Check: The validity period, format compatibility and technical integrity of the orders are checked and their systemic compliance is evaluated. Orders with expired validity period or orders whose format does not comply with the legislation/standards are rejected by the system.
Order Book Entry: Orders for which systemic eligibility is determined are entered into the trade book of the relevant crypto asset. With this process, the order is ready to be traded on the platform.
Matching and Execution Process: Orders are transferred to the trading environment in line with the order execution policy. Matching is made within the framework of price and time priority rules and the trade is executed.
Recording and Notification: All executed orders are recorded on the system and simultaneous notifications are sent to customers. Order execution details are made viewable on the user interface.

6. ORDER EXECUTION PROCESS

Customer orders traded on the platform are executed in the trading environment through matching algorithms based on price and time priority principles. The order execution process is carried out in accordance with the following principles within the scope of the regulations determined by the Capital Markets Board and the Order Execution Policy approved by the board of directors of the platform:

The order matching process is initiated by sorting the pending orders submitted to the trading book according to price and time priority. Orders that have already been entered into the system and have priority in terms of price are filled before the subsequent orders.
In the execution of orders in the trading environment, the current liquidity status of the platform, market depth and general market conditions are taken into account. In this context, price quotes provided by the liquidity provider or market maker may also be systematically evaluated.
In the event that the platform trades directly as a counterparty to customer orders, it is essential that only the stock of crypto assets in the platform's own portfolio is traded. This situation is clearly declared to the client, written consent is obtained and information is provided about the possibility of the investor's loss and the platform's profit in these transactions. All counterparty transactions are reviewed and recorded daily by the Internal Control and Compliance Unit within the scope of the order execution policy. Customers must be informed in advance about the loss or profit situation that may arise as a result of the transactions made by the platform in this way.
The executed transactions are confirmed by the platform system at the moment of execution, reflected in the client's portfolio in real time and integrated into the transaction history records.
Transactions that qualify as transfers are technically autosigned by the system for processing into the distributed ledger network and transferred to the transfer transaction process. In this process, customer security is taken as a basis by ensuring data integrity, transaction sequence and transaction confirmation.

7. EXECUTION OF TRANSFER ORDERS

The process of executing transfer orders is aimed at ensuring that crypto asset transfers that customers want to realize to their wallets on the distributed ledger network are completed in a secure, transparent and compliant manner. Blockchain networks used in transfer transactions are constantly monitored in terms of transaction security, network congestion risk and transaction confirmation times. In high volume transfers, additional confirmation steps are applied taking into account the transaction density of the network. Transfer transactions are carried out in accordance with the following stages:

The transfer request transmitted by the client via the platform interface is received by the system and registered with an automatic time stamp. The content of the request is checked for systematic accuracy.
The transfer transaction is subjected to security controls, including multi-factor authentication, determined in accordance with the platform's information systems security policies. The transaction is monitored for suspicious activity; manual verification steps are activated when deemed necessary.
If the transfer amount is below TL 1,000,000, the transaction is carried out fully automatically in line with the criteria determined by the system. For transactions above this threshold, the transfer cannot be initiated without the approval of the executives previously authorized by the board of directors. The approval process is monitored within the scope of the platform's internal control mechanisms.
If the transfer is executed through a custodian, the transfer order is transmitted directly to the relevant custodian. The process of the custodian executing the transaction is monitored by the platform and the necessary records are created systematically.
When the transfer is completed successfully, the system automatically sends a transaction confirmation notification to the client. The notification includes information such as the transaction number, the type and amount of assets transferred, the destination wallet address and the transaction time.

8. REVIEW AND UPDATE OF THE ORDER FULFILLMENT POLICY

The order execution policy is a fundamental document that guides the operation of the platform and is regularly reviewed and kept up-to-date. The obligation to notify the client regarding the policy update is not limited to publication, but technical records of the clients' receipt of systemic notifications are kept in the system. In this context:

The functionality of the policy and its effectiveness in implementation are re-evaluated at regular intervals, at least once a year. The review process is carried out by the relevant units of the platform and submitted to senior management for approval.
The policy is updated immediately in line with changes in Capital Markets Board (CMB) regulations, sectoral developments or defects detected in internal practices. The content and justifications of the updates are clearly documented.
Following the update of the Policy, changes are notified to customers at least 15 days in advance in writing, via e-mail, mobile notification or other communication channels. Evidence and proofs that such notifications have been made are recorded on the system.
The updated policy is published on the platform's corporate website and mobile application, accessible by customers.

9. AUTHORIZATIONS AND RESPONSIBILITIES

All units involved in the processes of receiving, executing and recording customer orders operate within the framework of the duties and authorities specified below:

Trading and Operations Unit: Responsible for the smooth execution of the operational process related to order intake, system processing, matching and reflection to the portfolio. Ensures that orders are time-stamped and accurately recorded.
Risk Management Unit: Continuously monitors the transactions performed on the platform and detects unusual transaction movements. When necessary, it makes a risk assessment and notifies the General Management in writing. It also generates risk control reports regarding the price surveillance system.
Information Technologies (IT) Unit: The IT Unit ensures that the system infrastructure through which all order flow takes place operates securely, uninterruptedly and in integrity. The performance of matching algorithms, the accuracy of audit trails and data consistency are kept under constant control by the IT Unit.
Internal Control and Compliance Unit: Supervises the compliance of order intake, execution, reporting and custody processes with CMB regulations and company internal policies. It carries out continuous audit activities and reports to the relevant managers in case of any violation of the legislation.

10. REPORTING AND RECORDING

All order transactions executed on the platform are systematically recorded and kept open to audit. All order data are stored in an accessible format for CMB, MASAK and independent information systems audits. Within the scope of the information systems audit obligation, log records are kept backed up for ten years in order to ensure the safe storage, integrity and traceability of the records. Within the scope of this process, the following principles are applied:

All orders transmitted by the client are recorded on the system with a time stamp along with the time of transmission, content, order type, matching and execution details. Each order is assigned a unique order number.
A complete transaction history is created, including all trading steps, systemic matches and transfer transactions related to the execution of orders. Audit trails for this history are structured in a way that is accessible to internal control, independent audit and public authorities.
The reconciliation reports generated by the platform on a daily basis are matched with transaction data and subjected to accuracy checks. Reconciliation results are approved by the responsible unit and archived electronically.
All records are kept in encrypted, access controlled and secure digital media for at least ten years. A registered process is in place for the secure destruction of data whose retention period has expired.

11. ENFORCEMENT

11.1. Effective Date

This procedure enters into force as of 25.03.2025. The regulations contained in the Procedure shall be taken as basis for all customer order receiving, execution and transfer transactions to be carried out within the platform after this date.

11.2. Implementation

The provisions of the Procedure shall be put into practice following its approval by the Board of Directors. The units directly responsible for the execution of the procedure are obliged to ensure continuity in implementation, full compliance with the legislation and traceability of all decisions taken pursuant to the procedure.