Qiwi (QIWI) Risk Analysis

Our business is currently subject to know-your-client requirements established by Federal Law of the Russian Federation No. 115-FZ "On Combating the Legalization (Laundering) of Criminally Obtained Income and Funding of Terrorism", dated August 7, 2001, as amended, or the Anti-Money Laundering Law. Based on the Anti-Money Laundering Law we distinguish three types of consumers based on their level of identification, being anonymous, identified through a simplified procedure and fully identified. There can be no assurance that we will always be able to collect all necessary data to perform the identification procedure in full or that the data the users provide us for the purposes of identification will not contain any mistakes or misstatements and will be correctly matched with the information available in the governmental databases. Due to the lack of clarity and gaps existing under the current customer identification legislation, we have to employ a risk-based approach to customer KYC and sometimes make judgment calls in applying anti-money laundering legislation, with the resulting risk of being found in non-compliance with it. Thus, current situation could cause us to be in violation of the identification requirements. In case we are forced to change our approaches to identification procedure or in case the identification requirements are further tightened, it could negatively affect the number of our consumers and, consequently, our volumes and revenues. Additionally, Russian anti-money laundering legislation is in a constant state of development and is subject to varying interpretations. See also "– Our services have been and may continue to be used for fraudulent, illegal or improper purposes, which could expose us to additional liability and harm our business". If we are found to be in non-compliance with any of its requirements, we could not only become subject to fines and other sanctions, but could also have to discontinue to process operations that are deemed to be in breach of the applicable rules and lose associated revenue streams.

Due to our ownership of Qiwi Bank, any transactions resulting in the acquisition of more than 50% of voting power of our company or the right to otherwise direct our business activities would become subject to preliminary approval by the CBR. In addition, any acquisition of more than 50% of our voting power may also be subject to a preliminary approval by the Russian Federal Antimonopoly Service, or the FAS. Furthermore, Qiwi Bank holds encryption licenses which are necessary to conduct its operations,and by virtue of this may be deemed to be a "strategic enterprise" for the purposes of the Federal Law of the Russian Federation No. 57-FZ "On the Procedure for Foreign Investments in Enterprises which are Strategically Important for the State Defense and National Security", dated April 29, 2008, as amended, or "the Strategic Enterprise Law". In this case, any acquisition of control over our company would require an approval of a specialized government commission, which is a relatively lengthy process that typically takes between three and six months in practice (see "– Regulation – Regulation of Strategic Investments"). These regulatory approval requirements may have the effect of making a takeover of our company more difficult or less attractive, and may prevent or delay a change of control, which could have a negative impact on the liquidity of, and investor interest in, our ADSs. Additionally, under Russian law, the depositary may be treated as the owner of the class B shares underlying the ADSs, and therefore, could be deemed a beneficial shareholder of Qiwi Bank. This is different from the way other jurisdictions treat ADSs. As a result, the depositary may be subject to the approval requirements of the CBR, FAS and the government commission described above in the event an amount of our shares representing over 50% of our voting power is deposited in the ADS program. Accordingly, our ADS program may be subject to an effective limit of 50% of our voting power, unless the depositary obtains FAS, CBR and potentially additional government commission approvals to increase its ownership in excess of 50% of our voting power. This could limit our ability to raise capital in the future and the ability of our existing shareholders to sell their ADSs in the public markets, which in turn may impact the liquidity of share capital. Acquisitions of Russian entities are subject to pre-closing approval by multiple government authorities as described above. Russian government authorities exercise significant discretion as to whether a consent should be granted or not, and are regulated by numerous laws which are often ambiguous and open to varying interpretations which may cause some of our acquisitions to fail or not exercised within expected timelines, causing harm to our business including development of new products.

Under current Russian law, the Russian government is entitled, upon consultation with the CBR, to propose legislation imposing a quota on foreign ownership in the Russian banking industry, covering both Russian branches of international banks and foreign participation in the charter capital of Russian banks, such as Qiwi Bank. Currently, a 50% quota on foreign ownership is in place, subject to certain exemptions. Furthermore, in late 2019 a draft legislative bill was submitted to the Russian legislature proposing to restrict ownership by foreign persons of certain key Russian IT companies pursuant to a list to be determined at a later stage to not more than 20% in the aggregate. Since 2021, this draft bill has not been taken into consideration due to strong criticism. However, there can be no assurance that similar measures will not be adopted in the future, as has already happened, for example, to media companies and video content distributors under other laws adopted in Russia in recent years. If the quota on foreign ownership of Russian banks is exceeded, or if a law restricting foreign ownership of Russian IT companies is adopted, a takeover of our company by a foreign purchaser may become impossible, which could limit, prevent or delay a change of control of our company and in turn could negatively impact the liquidity of our ADSs.

Our business has grown and developed rapidly in recent years and we are continuing to realign our compliance function with the size and scope of our business. In light of the fact that we are a highly regulated business that processes large volumes of payments, we need to have enhanced processes, procedures and controls in order to provide reasonable assurance that we are operating in compliance with applicable regulatory requirements. Given that we store and/or transmit sensitive data of our customers, we have ultimate liability to our customers for our failure to protect this data. We have experienced breaches of our cybersecurity in the past, and future breaches resulting in unauthorized disclosure of data are possible (see "– Our services have been and may continue to be used for fraudulent, illegal or improper purposes, which could expose us to additional liability and harm our business"). In addition, the Russian anti-money laundering laws to which we are subject contain numerous requirements with respect to identification of clients, and documentation and reporting of transactions subject to mandatory control and other suspicious transactions to the relevant authorities. As of the date of this annual report, we continue to develop and integrate certain control procedures with respect to a number of our projects in order to maintain a comprehensive system of controls and procedures across our business. There can be no assurance, however, that the measures we undertake will be sufficient to prevent significant deficiencies in the compliance procedures and internal controls of our projects, such as RealWeb, acquired in December, 2022, which was excluded from the assessment of the effectiveness of the Group's internal control over financial reporting (see Item 15 "Controls and Procedures"). Our failure to implement and maintain effective internal control over financial reporting could result in errors in our financial statements that could lead to a restatement of our financial statements, cause us to fail to meet our reporting obligations and cause investors to lose confidence in our reported financial information, which may result in a decline in the market price of our ADSs. Among others, we are subject to the US Foreign Corrupt Practices Act, or the FCPA, which prohibits US companies and their intermediaries from bribing foreign officials for the purpose of obtaining or keeping business or otherwise obtaining favorable treatment, and other laws concerning our international operations. Similar legislation in other jurisdictions contains similar prohibitions, although varying in both scope and jurisdiction. We have implemented policies and procedures and internal controls designed to provide reasonable assurance that we, our employees, distributors and other intermediaries comply with the anti-corruption laws to which we are subject. However, there are inherent limitations to the effectiveness of any policies, procedures and internal controls, including the possibility of human error and the circumvention or overriding of the policies, procedures and internal controls. There can be no assurance that such policies or procedures or internal controls will work effectively at all times or protect us against liability under these or other laws for actions taken by our employees, distributors and other intermediaries with respect to our business or any businesses that we may acquire. Our success requires significant public confidence in our ability to handle large and growing payment volumes and amounts of customer funds, as well as comply with applicable regulatory requirements. Any failure to manage consumer funds or to comply with applicable regulatory requirements could result in the imposition of fines, harm our reputation and significantly diminish use of our products. In addition, if we are not in compliance with anti-corruption laws and other laws governing the conduct of business with government entities and/or officials (including local laws), we may be subject to criminal and civil penalties and other remedial measures, which could have an adverse impact on our business, financial condition, results of operations and prospects.

Following the global trend on increase of substance requirements in various jurisdictions, starting from 2019, certain jurisdictions (including traditional offshore jurisdictions) implement legislation that requires companies registered in the relevant offshore jurisdiction to maintain actual substance on the territory of such jurisdictions, which may include, amongst others, the qualified personnel, premises located in the particular jurisdiction, reasonable expenses to support daily operation of the company. We cannot exclude that we might be subject to additional costs and/or tax liabilities resulting from the said requirements, which could have a material adverse effect on our business, financial condition and results of operations.

Risks associated with the legal system of Russia include, to varying degrees, inconsistencies between and among laws, presidential decrees, edicts and governmental and ministerial orders and resolutions; conflicting local, regional, and federal rules and regulations; the lack of judicial or administrative guidance regarding the interpretation of the applicable rules; the untested nature of the independence of the judiciary and its immunity from political, social and commercial influences; the relative inexperience of jurists, judges and courts in interpreting recently enacted legislation and complex commercial arrangements; a high degree of unchecked discretion on the part of governmental authorities; alleged corruption within the judiciary and governmental authorities; substantial gaps in the regulatory structure due to delays in or absence of implementing regulations; bankruptcy procedures that are not well-developed and are subject to abuse; and a lack of binding judicial precedent. All of these weaknesses affect our ability to protect and enforce our legal rights, including rights under contracts, and to defend against claims by others. In addition, the merger of the Supreme Arbitration Court of the Russian Federation, which used to oversee business disputes, into the Supreme Court, which used to only handle criminal cases and civil lawsuits, is viewed by some as having further aggravated these issues. The Russian judicial system is not immune from economic and political influences. The Russian court system is understaffed and underfunded, and the quality of justice, duration of legal proceedings, and performance of courts and enforcement of judgments remain problematic. Under Russian legislation, judicial precedents generally have no binding effect on subsequent decisions and are not recognized as a source of law. However, in practice, courts usually consider judicial precedents in their decisions. Enforcement of court judgments can in practice be very difficult and time-consuming in Russia. Additionally, court claims are sometimes used in furtherance of political and commercial aims. All of these factors can make judicial decisions in Russia difficult to predict and make effective redress problematic in certain instances. The relatively recent enactment of many laws, the lack of consensus about the scope, content and pace of political and economic reform and the rapid evolution of legal systems in ways that may not always coincide with market developments have resulted in legal ambiguities, inconsistencies and anomalies and, in certain cases, the enactment of laws without a clear constitutional or legislative basis. Legal and bureaucratic obstacles and corruption exist to varying degrees in each of the regions in which we operate, and these factors are likely to hinder our further development. These characteristics give rise to investment risks that do not exist in countries with more developed legal systems. The developing nature of the legal systems in Russia could materially adversely affect our business, financial condition and results of operations.

The use of governmental power against particular companies or persons, for example, through the tax, environmental or prosecutorial authorities, could adversely affect the Russian economic climate and, if directed against us, our senior management or our major shareholders, could materially adversely affect our business, financial condition and results of operations. Russian authorities have challenged some Russian companies and prosecuted their executive officers and shareholders on the grounds of tax evasion and related charges. In some cases, the results of such prosecutions and challenges have been significant claims against companies for unpaid taxes and the imposition of prison sentences on individuals. There has been speculation that in certain cases these challenges and prosecutions were intended to punish, and deter, opposition to the government or the pursuit of disfavored political or economic agendas. More generally, some observers have noted that takeovers in recent years of major private sector companies in the oil and gas, metals and manufacturing sectors by state-controlled companies following tax, environmental and other challenges may reflect a shift in official policy in favor of state control at the expense of individual or private ownership, at least where large and important enterprises are concerned.

Qiwi Bank is central to the operation of all of our key business segments as it provides issuing, acquiring and deposit settlement functions within our group, and is the banking institution behind those products of our ROWI offering that require a banking license, such as digital bank guarantees and online loans to public procurement tender participants and marketplaces suppliers. All banks and non-banking credit organizations operating in Russia are subject to extensive regulation and supervision. Requirements imposed by regulators, including capital adequacy, liquidity reserves, prudential ratios, loss provisions and other regulatory requirements are designed to ensure the integrity of the financial markets and to protect consumers and other third parties with whom a bank deals. These regulations may limit our activities, and may increase our costs of doing business, or require us to seek additional capital in order to comply with applicable capital adequacy or liquidity requirements. Existing laws and regulations could be amended, the manner in which laws and regulations are enforced or interpreted could change and new laws or regulations could be adopted. Russian banks also have extensive reporting obligations, including, without limitation, disclosure of financial statements, various operational indicators, and affiliates and persons who exercise (direct or indirect) influence over the decisions taken by the management bodies of the bank. The CBR may at any time conduct full or selective audits of any bank's activities and filings and may inspect all of its books and records. Qiwi Bank has been the subject of CBR investigations in the past that have uncovered certain violations and deficiencies in relation to, among other things, reporting requirements, anti-money laundering, cybersecurity, compliance with applicable electronic payments thresholds requirements and other issues which we believe we have generally rectified. In the second half of 2020, the CBR, acting in its supervisory capacity, performed another routine scheduled audit of Qiwi Bank for the period of July 2018 to September 2020 and, in the course of this audit, identified certain violations and deficiencies relating primarily to reporting and record-keeping requirements. The monetary fine imposed on Qiwi Bank as a result of these findings was RUB 11 million, or approximately USD 150,000 at the time. In addition, the CBR introduced certain restrictions with respect to Qiwi Bank's operations, including the suspension or limitation of most types of payments to foreign merchants and money transfers to pre-paid cards from corporate accounts, effective for six months from December 7, 2020. We believe that the restrictions imposed on us were primarily driven by an evaluation of the overall approach of the CBR to the interpretation of the applicable e-payments regulation and general trends towards increased scrutiny in the areas of cyberspace and cross-border payments rather than specific deficiencies identified. Later in January 2021, as reported in the media, similar restrictions were imposed on our key competitor YooMoney, one of the major electronic payment service providers in Russia currently wholly-owned by Sberbank. As a result of close cooperation with the CBR, all restrictions with respect to QIWI expired in May, 2021. The restrictions introduced by the CBR have had a substantial negative effect on our business, financial condition and results of operations, primarily through decreasing the volumes in our e-commerce and money remittance operations, and as a result, our revenues and profits. We believe that our abrupt termination of services of a large number of merchants has likely also had reputational risks for us that are difficult to quantify or assess. The recovery of the payment volume and revenue lost in the wake of the CBR restrictions has been affected by changes in consumer behavior and legal framework, and we anticipate that these revenue streams may never be fully restored, in particular since we are limited in our ability to onboard payment aggregators (and thus enable access to our platform to multiple merchants at the same time) as we need to ensure in each case that the use of such intermediaries does not affect our compliance with the requirement to only onboard "whitelisted" betting merchants that was introduced in 2021 (see "– Throughout the recent years, we have been deriving a substantial portion of our revenues from merchants in the betting industry, but we have recently experienced a loss of a significant portion of such revenue stream due to changes in regulation and market conditions, the negative repercussions of which on our business and financial results may continue to build up"). Our past and future operations may also be subject to greater scrutiny from the CBR as a result of these events. There can be no assurance that new sanctions will not be imposed on us as a result of any past or future findings and that we will not come under greater CBR scrutiny in connection with any perceived deficiencies in our conduct, or that any currently planned or future inspections will not result in discovery of any significant or minor additional violations of various banking regulations, and of what sanctions the CBR may impose on us in connection with such deficiencies or violations. Any such sanctions could have a material adverse effect on our business, financial condition and results of operations. Additionally, some of our new projects require significant funding and therefore put certain pressure on the ability of Qiwi Bank to comply with applicable capital requirements and other prudential ratios, while through other operations we are engaged in managing substantial amounts of consumer's funds. All these factors increase our potential exposure to regulatory risks. Moreover, additional scrutiny may be expected in connection with our involvement in our past projects: Tochka, SOVEST and Rocketbank, as they had extended the scope of traditional commercial and retail bank services that Qiwi Bank was previously providing. With respect to Tochka project, SOVEST and Rocketbank, given that the businesses were divested or discontinued, we may not have all necessary archive materials that the regulator may require and may not be able to retrieve such documents upon request. Any failure to meet any demands of the regulator in this respect could result in additional sanctions on us by the CBR. Any breach of applicable regulations could expose us to potential liability, including fines, prohibition to carry out certain transactions, introduction of temporary administration by the CBR and in certain instances the revocation of our banking license. Revocation of Qiwi Bank's banking license would render us unable to process payments and provide most of our services, and may result in a material decrease of our profitability, and any actual or perceived breach by us of any applicable banking laws and regulations could have a material adverse effect on our business, financial condition and results of operations.

Our business is impacted by laws and regulations that affect our industry, the number of which has increased significantly in recent years. We are subject to a variety of regulations aimed at preventing money laundering and financing criminal activity and terrorism, financial services regulations, payment services regulations, consumer protection laws, currency control regulations, advertising laws, betting laws and privacy and data protection laws and therefore experience periodic investigations by various regulatory authorities in connection with the same, which may sometimes result in monetary or other sanctions being imposed on us. Further, these laws and regulations vary significantly from country to country. Many of these laws and regulations are constantly evolving, and are often unclear and inconsistent with other applicable laws and regulations, including across various jurisdictions, making compliance challenging and increasing our related operating costs and legal risks. If local authorities in Russia or other countries choose to enforce specific interpretations of the applicable legislation that differ from ours, we may be found to be in violation and subject to penalties or other liabilities. This could also limit our ability to provide some of our services going forward and may increase our cost of doing business. Changes in our industry are rapid, and new products and services that we develop or the use cases in connection with which our products and services may be used may become subject to government regulation undoing the benefits we expect to derive from such new products, services or use cases. In some jurisdictions where we operate, there is currently little or virtually no legislation addressing electronic payments, and no assurance can be made that if such legislation is adopted it will be beneficial to our business. Court interpretations and applicability of legislation and regulations in certain jurisdictions in relation to our business can be ambiguous or contradictory, and it is possible that authorities in such jurisdictions may determine that we are required to possess additional licenses, permits or registrations to provide our services. Such licensing or compliance processes may be time consuming and expensive and we may not be successful in acquiring any newly required licenses. If we fail to obtain and maintain required licenses, permits or registrations or comply with certain mandatory procedures in any jurisdiction where we operate, we may face fines, penalties, sanctions, experience a loss of revenues or have to discontinue providing certain services or doing business altogether. With respect to countries that do have an established regulatory framework for the types of services that we provide, no assurance can be given that the relevant legislation will not be amended to the detriment of our business, including due to the lobbying efforts undertaken by or on behalf of our competitors. For instance, any restrictions including complete prohibition, ban of specific reload methods or various quantitative caps on the use or reloads of anonymous e-wallets could have a significant negative impact on our business. In addition, we may be subject to existing or new advertising legislation that could restrict the types of advertisements we serve, which could result in a loss of advertising revenue. Furthermore, rapid development of cryptocurrencies and increasing governmental support for the development of the relevant regulatory framework in Russia and other countries where we provide services may also affect regulatory environment in which we operate, which may have a significant impact on the competitive landscape in the payments industry (see "– The financial services industry is highly competitive, and we have a vast number of competitors that are larger and have greater financial and other resources"). Generally, Russian lawmakers and enforcement agencies have been demonstrating increased scrutiny in matters relating to cyberspace and e-payments, in particular cross-border payments, as borne out in the enhanced enforcement activities in the kiosk market, the de-anonymization of e-payments and various other initiatives aimed at increasing state control over online activities. In the latest of such trends, the CBR appears to be instituting closer controls over cross-border payments and peer-to-peer transfers (see "– Our services have been and may continue to be used for fraudulent, illegal or improper purposes, which could expose us to additional liability and harm our business" and"– Qiwi Bank operates in a highly regulated environment and increased regulatory scrutiny could have an adverse effect on our business, financial condition and results of operations"). Regulation of E-Wallets In early 2018 it was reported that the CBR, Rosfinmonitoring and the Ministry of Finance are actively discussing new proposed legislation that would ban the use of anonymous e-wallets completely. In 2019, amendments to the National Payment System Law were introduced that prohibit the reloading of anonymous e-wallets other than from a bank account. This development could have the effect of making our onboarding process more complicated and therefore our service less attractive, which would in turn slow down the influx of new users or increase the cost of their engagement. Our revenues may also be adversely affected by further regulation of fees charged on inactive accounts for their continued maintenance and unclaimed payments, which represent a significant revenue stream for us. We have voluntarily signed up to the Memorandum adopted by the E-Money Market Participants Association (a non-state association of fintech players in Russia that we are a founding member of) which imposes certain guidelines with respect to the treatment of such inactive account fees and have had to adjust our policies with respect to such fees upon our accession to the Memorandum. The guidelines imposed by the Memorandum are also reflected in the CBR's Guidelines for Improving the Quality of Money Transfer Services by Electronic Money Operations that we are also subject to. The negative financial impact from such adjustment has been limited so far; however, any further regulation in this regard, whether legislation introduced by state authorities or rules voluntarily self-imposed by the industry, imposing more stringent restrictions than those currently in existence, could have a further adverse effect on such revenue stream. Another regulatory measure that has already resulted in a decline in the use of e-wallets and affected our business is the requirement to report newly opened e-wallets to the tax authorities in the same manner the banks report new bank accounts, which came into effect starting from January 6, 2021, and the requirement to report movements of funds and wallet balances at tax authorities' request, which came into effect in April 2021. Starting from December 2022, we are also required to report such information to the Russian bailiff system. These measures have obliviated and may continue to further obliviate some of the perceived advantages of e-wallets over bank accounts. Our e-wallet base could be further adversely affected by any additional increase of the regulatory burdens associated with reporting, onboarding or other functions, all of which can have the effect of making our products less differentiated and attractive to consumers. In another example of such regulation, since October 2021 Russian residents are required to report transactions totaling above RUB 600,000 (approximately US $ 8,530) made with the use of e-wallets provided by foreign operators. This initiative may result in a decrease of the volume of money remittances from QIWI Wallet. Anti-Money Laundering Legislation We sometimes have to make significant judgment calls in applying anti-money laundering legislation and to take risk of being found in non-compliance with it, particularly in relation to mandatory client identification requirements and applicability of the thresholds for transactions imposed based on the client identification level, if, for example, we process payments made by our consumers from their QIWI Wallet accounts for amounts in excess of the applicable thresholds or for certain types of merchants without the required client identification. Although we use all methods available for client identification in all our projects and believe our practices in this regard are in compliance with applicable legal requirements and in line with market practice in Russia (see "– Know-your-client requirements established by Russian anti-money laundering legislation may adversely impact our transaction volumes"), the Russian regulators may view us as being non-compliant and impose fines and other sanctions on us. There can be no assurance that the requirements of the anti-money laundering legislation will not change further in a manner adverse to our business (see "Regulation"), which could result in lower payment volumes for us or other adverse effects. For instance, there have been proposals from certain government officials to ban payments by unidentified consumers altogether. Any further adverse change to these requirements could have a substantial negative effect on our business. Foreign Sanctions Certain sanctions relating to the ongoing hostility between Russia and Ukraine, and Russian countersanctions instituted in response, directly target payment services providers such as ourselves. In November 2016, the National Bank of Ukraine banned several Russian payment services providers from the Ukrainian market. In response, in April 2017, a law was enacted in Russia prohibiting certain types of money remittance from Russia to countries that have introduced sanctions against Russian payment systems (which, to our knowledge, so far only include Ukraine). Moreover, in May 2018, Qiwi Bank, one of our key subsidiaries, was added to the list of sanctioned entities by the Ukrainian government, and in June 2021, nine other companies of our Group were added as well. While we have not experienced any substantial operational difficulties in connection with this so far since we have no assets or business in Ukraine, there can be no assurance as to what effect the imposition of sanctions on us by Ukraine might have in the future, or what further adverse actions the government of Ukraine might take against us. Any determination by a relevant regulator that we have not complied with the spirit or text of any such sanctions or regulations, or even any statements to that effect, may have a material adverse effect on our business, financial condition and results of operations, as well as the price of our ADSs. While Ukraine remains the only country so far to introduce sanctions of this type, there can be no assurance that additional sanctions affecting the payments business will not be imposed by regulators in other countries in which we operate. These sanctions might also cause reputational damage and, as a result, adversely affect any potential international expansion plans we might have. See also "– The conflict between Russia and Ukraine, and particularly its 2022 escalation, the US, EU, UK and other countries' sanctions that have been imposed in connection therewith, the resulting negative implications on the Russian economy, and the measures that are being adopted by Russia in response, could adversely impact our operations and financial condition". New Regulations Outside of Russia The regulatory framework around electronic payments and other financial services that we offer is constantly in a state of development in most of the countries in which we operate, including the United Arab Emirates, Kazakhstan, Belarus and the UK. New laws that are being adopted in these countries may increase our compliance costs and create new regulatory risks. For example, on January 1, 2017, the Regulatory Framework for Stored Values and Electronic Payment Systems came into force in the United Arab Emirates. It introduced a mandatory licensing and related compliance regime for certain electronic payment service providers and established a one-year transitional period for existing digital payment services providers to take appropriate measures to comply with the new rules. In case of failure to do so payment services providers may be mandated to cease provision of such services. Moreover, any individual or entity providing (or representing themselves as capable of providing) digital payment services without the appropriate license or authorization will be subject to administrative penalties. Even though such legislation has been in effect for several years now, there still remains a lack of clarity as to the interpretation of many of its provisions, and we are still assessing the applicability and potential impact of this legislation on our business. If our position on our status under the Regulatory Framework is different from that of the UAE regulator or if we are unable to comply with the mandatory licensing if it is deemed applicable to us, it could have a material adverse effect on our business, financial condition and results of operations. Privacy and Protection of User Data We are subject to a number of laws, rules, directives, and regulations (which we refer to as "privacy and data protection laws") relating to the collection, use, retention, security, processing, and transfer (which we collectively refer to as "processing") of personally identifiable information about our customers and employees (which we refer to as "personal data") in the countries where we operate. Our business relies on the processing of personal data in many jurisdictions and the movement of data across national borders. As a result, much of the personal data that we process, which may include certain financial information associated with individuals, is regulated by multiple privacy and data protection laws and, in some cases, the privacy and data protection laws of multiple jurisdictions. In many cases, these laws apply not only to third-party transactions, but also to transfers of information between or among us, our subsidiaries, and other parties with which we have commercial relationships. Regulatory scrutiny of privacy, data protection, cybersecurity practices, and the processing of personal data is increasing around the world. There is uncertainty associated with the legal and regulatory environment relating to privacy and data protection laws, which continue to develop in ways we cannot predict, including with respect to evolving technologies such as cloud computing, artificial intelligence, and blockchain technology. Any failure or perceived failure to comply with existing or new laws of any government authority (including changes to or expansion of the interpretation of those laws), including those discussed in this risk factor, may subject us to significant fines, penalties, civil lawsuits, and enforcement actions in one or more jurisdictions, result in additional compliance requirements, increase regulatory scrutiny of our business, restrict our operations, and force us to change our business practices, make product or operational changes, or delay planned product launches or improvements. See also "– Unauthorized or improper disclosure of data, whether through cybersecurity breaches, computer viruses or otherwise, could expose us to direct loss, liability, protracted and costly litigation and damage our reputation". Any failure, or perceived failure, by us to comply with our privacy policies as communicated to users could result in proceedings or actions against us by data protection authorities, government entities or others, including class action privacy litigation in certain jurisdictions. Such proceedings or actions could subject us to significant fines, penalties, judgments, and negative publicity which may materially harm our business. The foregoing may require us to change our business practices and would likely increase the costs and complexity of compliance. In addition, compliance with inconsistent privacy and data protection laws may restrict our ability to provide products and services to our customers. Taxi Market Regulation In Russia, ride-hailing services work with taxi drivers directly or through fleet management companies or taxi companies, which in turn engage taxi drivers as self-employed entrepreneurs. In one of our lines of business, we provide payment solution to taxi companies that is similar in nature to salary programs for taxi drivers. In addition, we have developed a "Taxiaggregator" product for taxi companies and taxi drivers that facilitates and speeds up payments to taxi drivers. Ride-hailing services regulation is constantly developing in Russia. In 2022, a new law was introduced that we believe will significantly change the regulatory framework of the ride-hailing market in Russia starting from September 1, 2023. Among other things, the new law envisages drivers entering intoan employment agreement with the ride-hailing platforms as well as remaining self-employed individuals and continue working as a taxi drivers using these ride-hailing platforms. Such a clarification is favorable for our "Taxiaggregator" product which depends on a payment volume going through the self-employed individuals. In addition, the law clarifies terms of cooperation among fleet management companies or taxi companies and taxi drivers and imposes additional regulatory requirements on all participants of the ride-hailing market, introduces additional payment order reporting requirements, including the requirement to grant automatic access to ride-hailing company's order processing databases to Russian authorities. If we are are unable to adjust and meet these requirements or if similarly adverse initiatives are adopted in the future, our products developed for this market may become obsolete, and we may also experience a negative impact on the use base of our e-wallets. Subsequent legislation and regulation in various markets of our presence and interpretations thereof, litigation, court rulings, or other events could expose us to increased costs, liability and reputational damage that could have a material adverse effect on our business, financial condition and results of operations.

In 2022 we saw the imposition of extremely severe and unprecedented measures. As the Ukraine conflict and the current geopolitical crisis is rapidly evolving, and further sanctions may be imposed against Russia, it is difficult to accurately predict how it will unravel and what response or retaliatory measures the Russian government may introduce in the future. We closely monitor sanctions regulations and believe that our operations do not contravene any current sanctions regulation but there is no guarantee that we will be able to meet all the sanctions regulations in the future due to the rapidly changing requirements, increased complexity and frequency of new sanctions imposed. This may lead to a material adverse effect on our business, financial condition, results of operations and prospects.

The banking and other financial systems in Russia have been rapidly developing, and underlying regulation and regulatory scrutiny over the banking and financial services sector has been increasing. Russian legislation relating to banks and bank accounts is subject to varying interpretation and inconsistent application. The 1998 financial crisis resulted in the bankruptcy and liquidation of many Russian banks and almost entirely eliminated the developing market for commercial bank loans at that time. From April to July 2004, the Russian banking sector experienced further serious turmoil. As a result of various market rumors and certain regulatory and liquidity problems, several privately-owned Russian banks experienced liquidity problems and were unable to attract funds on the inter-bank market or from their client base. Simultaneously, they faced large withdrawals of deposits by both retail and corporate customers. Several of these privately-owned Russian banks collapsed or ceased or severely limited their operations. Russian banks owned or controlled by the government and foreign owned banks generally were not adversely affected by the turmoil. Although the CBR has the mandate and authority to suspend banking licenses of insolvent banks, some insolvent banks still operate. Many Russian banks also do not meet international banking standards, and the transparency of the Russian banking sector in some respects still lags behind internationally accepted norms. While the CBR has been increasing controls over banks, many banks still may not follow existing CBR regulations with respect to lending criteria, credit quality, loan loss reserves, diversification of exposure or other requirements. The imposition of more stringent regulations or interpretations could lead to weakened capital adequacy and the insolvency of some banks. Prior to the onset of the 2008 global economic crisis, there had been a rapid increase in lending by Russian banks, which many believe had been accompanied by a deterioration in the credit quality of the loan portfolio of those banks. In addition, a robust domestic corporate debt market was leading Russian banks to hold increasingly large amounts of Russian corporate ruble bonds in their portfolios, which further deteriorated the risk profile of the assets of Russian banks. The global financial crisis of 2007-2008 has led to the collapse or bailout of some Russian banks and to significant liquidity constraints for others. Profitability levels of most Russian banks have been adversely affected. Indeed, the global crisis has prompted the government to inject substantial funds into the banking system amid reports of difficulties among Russian banks and other financial institutions. In recent years, the CBR has considerably increased the intensity of its supervision and regulation of the Russian banking sector. Historically, the revocation of banking licenses by the CBR has been a relatively rare event mostly occurring to local banks with little assets and little or no significance for the banking sector as a whole. Starting October 2013, however, the CBR has launched a campaign aimed at cleansing the Russian banking industry, revoking the licenses from an unusually high number of banks (including significant banks such as Ugra, Master-Bank, Investbank, ProBusinessBank, Vneshprombank, Tatfondbank and others) on allegations of money laundering, financial statements manipulation and other illegal activities, as well as inability of certain banks to discharge their financial obligations, which resulted in turmoil in the industry, instigated bank runs on a number of Russian credit institutions, and severely undermined the trust that the Russian population had with private banks. In addition, in the course of 2017 three of Russia's largest private banks, Otkritie Bank, Binbank and Promsvyazbank, were all bailed out and taken over by the CBR through the newly established Banking Industry Consolidation Fund, since all of them were allegedly unable to perform their obligations as they fell due for various reasons. License revocations have continued throughout 2018 and 2019, again with some major banks impacted. The private banking sector in Russia, always relatively minor compared to state players like Sberbank and VTB to begin with, has contracted severely as a result. This can be expected to result in reduced competition in the banking sector (while at the same time putting alternative payment solution providers such as ourselves in the position of having to predominantly compete with the government itself), increased inflation and a general deterioration of the quality of the Russian banking industry. It could be expected that the difficulties currently faced by the Russian economy could result in further collapses of Russian banks. With few exceptions (notably the state-owned banks), the Russian banking system suffers from weak depositor confidence, high concentration of exposure to certain borrowers and their affiliates, poor credit quality of borrowers and related party transactions. Current economic circumstances in Russia, and foreign sanctions that have hit the banking industry in particular disproportionately hard, are putting stress on the Russian banking system. These circumstances decrease the affordability of consumer credit, putting further pressure on overall consumer purchasing power. In addition, these factors could further tighten liquidity on the Russian market and add pressure onto the ruble. Our business is significantly affected by development in the Russian banking sector. First, we periodically hold funds in a number of Russian banks and rely on guarantees given by those banks to enhance our liquidity. Increased uncertainty in the Russian banking sector exposes us to additional counterparty risk and affects our liquidity. As a result, the bankruptcy or insolvency of one or more of these banks could adversely affect our business, financial condition and results of operations. The continuation or worsening of the banking crisis could decrease our transaction volumes, while the bankruptcy or insolvency of any of the banks which hold our funds could prevent us from accessing our funds. All of these factors could have a material adverse effect on our business, financial condition and results of operations.

Russian tax legislation contains thin capitalization rules envisaged under the point 2 of the Article 269 of the Russian Tax Code. These rules under certain conditions limit the amount of interest that could be deducted by the Russian companies with direct or indirect participation of foreign company. These rules were subject to frequent amendments and different interpretations over the past years Our Russian subsidiaries may be affected by the Russian Federation's thin capitalisation rules in respect of loans from or have loans guaranteed by foreign or Russian related parties. It is currently unclear how the Russian tax authorities could interpret and apply thin capitalisation rules. Specifically, it is unclear whether thin capitalization rules should be applied to coupon payments on bonds issued by one of our Russian subsidiaries when the investors in such bonds have irrevocable public offer from Group companies in place. If thin capitalization rules are applied, the Russian tax authorities may disallow part or full coupon payments for income tax deduction purposes. As a result, non-deductible coupon payments would be considered as payment of dividends and subsequently would be subject to withholding tax rate at 13% or 15%. As at the date of this Report there is no available court practice on this matter. It cannot be ruled out that we might be subject to additional tax liabilities, which could have a material adverse effect on our business.