Audit Committee Charter

0) Corporate structure and scope

Tanqory PTE. LTD. (Singapore, UEN 202448997H) is the ultimate parent and holding company of the Tanqory group, including its wholly-owned subsidiaries Tanqory Inc. (Delaware, USA) and Tanqory OÜ (Estonia). Tanqory Inc. is the contracting entity and merchant of record for every product and service Tanqory sells to merchants and customers worldwide — Tanqory PTE. LTD. itself does not contract with, bill, or hold a direct customer relationship with any merchant or customer. This document is adopted by Tanqory PTE. LTD. as the group's holding company and applies group-wide, including to Tanqory Inc.'s and Tanqory OÜ's operations, unless a section below states a narrower scope.

1) Purpose, authority, and scope

Defines the Audit Committee’s oversight of financial reporting integrity, internal controls, risk management, and legal/ethical compliance. The Committee may access information, personnel, records, systems, and external advisers without prior management approval. It provides oversight, not management’s/external auditor’s responsibilities for preparing statements and running operations. Operates with independence, transparency, accountability, integrity, and professional competence (aligned with SG Code 2018 and COSO/ISA/SOX best practices). Reports to the Board and may request management/teams to brief at any time. Ensures adequate resources for Internal Audit (IA) and external advisers. Oversees whistleblowing channels that protect reporters. Reviews this Charter at least annually or upon legal/structural changes. Summaries/recommendations go to the Board after each meeting. Use with Code of Conduct, Risk Management Policy, Internal Audit Charter, and Financial Reporting Policy.

2) Composition, qualifications, independence

At least 3 directors (majority independent, non-executive) with one Audit Committee Chair. All financially literate; at least one “financial expert” (SOX/ISA equivalent). No business/employment/family relationships impairing independence within prior 3 years; former external audit firm staff observe required cooling-off. Limit outside audit committee seats to avoid overboarding (generally ≤2 unless Board approves). New members receive onboarding on business, risks, controls, and related charters; continuous training (e.g., IFRS/SG-IFRS, cyber, ESG). Chair sets agenda, leads meetings, coordinates with auditors/management, and reports to the Board. Secretary records minutes, tracks actions, and retains documents per Retention Policy. Members must disclose conflicts promptly and abstain from related votes. May engage external legal/financial/risk advisers at company expense. Perform annual effectiveness/self-assessment with improvement plan.

3) Meetings and processes

Meet at least quarterly and as needed (e.g., close, unusual events, auditor reports). Quorum when >50% of members present, including Chair or delegate. Invite CFO, Head of IA, CISO/Risk, external auditor, or others per agenda; hold in-camera sessions without management as needed. Typical agenda: financial statements, internal control/risk, IA reports, external audit reports, compliance/legal, whistleblowing/ethics, IT/Cyber, ESG (if applicable). Provide materials in advance with clear proposals/action owners/timelines. Minutes reflect resolutions, differing views, and follow-up; track closure of actions. Meet separately with external auditors and IA at least annually to discuss independence and key issues. Protect confidentiality of meeting information; retain per law/Retention Policy. Electronic meetings allowed if identity/security are ensured. Report summaries and items requiring Board decision/support after each meeting.

4) Financial reporting and internal control oversight

Review quarterly/annual financial statements before Board submission for accuracy, completeness, compliance with IFRS/SG-IFRS, and accounting policies. Consider significant judgments/estimates (impairment, provisions, revenue recognition) and changes in policies/standards. Review disclosures in MD&A/earnings/public documents for compliance with SG/global requirements. Assess adequacy of Disclosure Controls and Procedures (DCP) and ICFR (COSO/SOX-aligned). Track remediation of control deficiencies/significant deficiencies/material weaknesses with timelines and closure evidence. Discuss with management and external auditors reserves, going concern, subsequent events, and significant unusual transactions. Evaluate key IT/ERP/financial systems supporting reporting and controls (access control, change management, segregation of duties). Ensure fraud risk assessment and anti-fraud controls, including review of unusual journal entries and override risks. Review and approve IA Charter/Plan/budget focused on high-risk areas. Report results and recommendations to the Board.

5) External audit

Recommend appointment/renewal/change/removal of external auditor; set fees/scope. Assess independence at least annually: review non-audit services, business relationships, and obtain independence letters (ISA/SOX/SGX standards). Pre-approve audit/non-audit services; prohibit services impairing independence (bookkeeping, controls design, management services, etc.). Enforce partner rotation per law/standards (e.g., 5-year lead partner) and review audit team quality. Meet auditors pre- and post-audit on scope, approach, findings, and key matters. Review audit plan, materiality, significant risks, sampling, ITGC reliance; request mid-year updates for significant events. Track management responses to audit findings and close actions on time. Annually evaluate service quality/timeliness/value and consider tendering when appropriate. Provide direct access for auditors to the Committee without management. Retain proposals/letters/management letters per Retention Policy.

6) Internal audit and risk management

Approve and oversee IA Charter, annual plan, resources, and independence of Head of IA. Review all IA reports: scope, findings, opinions, control issues, and remediation plans with deadlines. Head of IA reports functionally to the Committee and administratively to CEO/CFO as appropriate. Monitor ERM: risk appetite statement, top risks, mitigation plans, and KRIs. Oversee IT/Cyber/Data Privacy/BCP risks and periodic DR/BCP testing. Review adequacy of key policies: information/security, access management, vendor/third-party management, personal data protection. Receive reports on major incidents (security, breaches, fraud) and track corrective actions. Check insurance coverage (cyber/PI/crime) alignment with risk profile. Support GRC/analytics tools to enhance risk/control visibility. Annually assess IA and ERM effectiveness and align plans with business strategy.

7) Compliance, ethics, and whistleblowing

Oversee compliance with key laws/regulations (data protection, trade/sanctions, tax, labor, anti-corruption). Oversee ethics/Code of Business Conduct and recurring training for employees/partners. Manage confidential, safe, non-retaliatory whistleblowing channels; define SLAs for intake/investigation/response. Receive reports on ethics/fraud/corruption/conflicts and track investigations and discipline. Review related-party transactions for fairness/transparency per Board-approved policy. Verify that material disclosures to investors/stakeholders meet requirements. Oversee compliance program and resources of Legal/Compliance. Track status and penalties from regulators and inform the Board of material matters. Ensure third-party/agent/vendor screening for sanctions/AML/anti-corruption/ethics per procurement policy. Promote speak-up culture and “tone at the top.” See also: governance/related-party-transactions-policy.md, governance/whistleblower-policy.md, and governance/disclosure-controls-policy.md.

Additional standards on adoption upon listing

The following standards will apply upon listing of Tanqory securities on a U.S. national securities exchange, and the Committee's composition and responsibilities will be conformed accordingly:

• Nasdaq Listing Rule 5605(c): audit committee composition requirements, including a minimum of three members, all of whom must be independent, and at least one member qualifying as an audit committee financial expert.
• Sarbanes-Oxley Act §301: audit committee oversight of the receipt, retention, and treatment of complaints regarding accounting, internal accounting controls, or auditing matters, and the confidential, anonymous submission by employees of concerns regarding questionable accounting or auditing matters. This requirement is implemented operationally through the Whistleblower Policy.
• Exchange Act Rule 10A-3: audit committee responsibilities upon listing, including direct responsibility for the appointment, compensation, retention, and oversight of the registered public accounting firm; authority to engage independent counsel and other advisers; and adequate funding.

8) Reporting, evaluation, and charter review

Provide an annual summary report to the Board on Committee work, control remediation status, and key findings. Conduct annual self/Committee/member evaluations with training and process improvements. Review this Charter annually to stay aligned with law and best practices; Board approval required for changes. Ensure Audit Committee disclosures in annual reports/shareholder materials are complete and accurate. Retain minutes/reports/evidence of follow-up per Retention Policy and law. Confirm resources (budget/people/tools) are adequate and adjust to changing risks. Plan succession for Chair and key members. Gather feedback from auditors/IA/management to improve oversight. Report material irregularities to the Board immediately with recommended remedies. Track implementation of recommendations and measure outcomes to strengthen oversight quality.

Version History

Appendix A: Pre-Approval Form (Audit/Non-Audit Services) – key fields

Appendix B: Audit Committee Meeting Agenda Matrix (illustrative quarterly/annual)