# EXHIBIT 30

## I. Purpose

A Due Diligence Report (DDR) is an integral part of Enhanced Due Diligence (EDD) and a requirement of the Global KYC Standards for certain higher risk customers', as defined below.

# II. Definition

A DDR must be obtained from Due Diligence Operations (DDO) for a specified target. The target is defined as the individual or entity who serves as the searching point for the DDR. When the target is the customer or the related party, the customer and all related parties must be submitted in the DDR request. A DDR is not required for a public company traded on a recognized exchange and/or regulated by a recognized regulator or subsidiaries thereof'. However, a DDR is required for the related parties of the public company traded on a recognized exchange or regulated by a recognized regulator.

A DDR is required to be submitted at the time of on boarding (in accordance with the KYC Timing requirements of Section 17 of the KYC Standards), during the scheduled periodic review, or a triggered event. The Report will be requested by the LOB KYC Operations/Customer KYC in the following circumstances:

- Customer from a very high risk jurisdiction'
- PEP position of customer, beneficial owner per the KYC Standards, customer controller and/or account controller is in a very high-risk jurisdiction
- Customer with significant business, industry, assets, source of wealth, and/or income from a very high risk jurisdiction
- Customer is not publicly traded on a recognized exchange or not regulated by a recognized regulator and is associated with significant negative media
- Customer, beneficial owner, customer controller and/or account controller is associated with significant negative media
- Customer is an investment company with complex ownership
- Customer is a bearer share company that is not traded on a publicly recognized exchange
- Customer is a high risk NGO/Charity (excluding well-recognized and reputable regional, national, and international NGOs)
- Customer is at a higher risk for exposure to sanctions concerns as determined by the responses to the Sanctions questionnaire

Consumer and Community Banking including all sub.LOBs, excluding Dealer Commercial Services, are exempt from requiring a Due Diligence Report or comparable research

{sup}`2` See Appendix G of the Global KYC standards

I Refer to AML Country Risk Rating List on GFCCs AML Intranet site

### III. DOR Components
The DDR is not intended to replicate or satisfy name screening or CIP verification requirements. Instead, the report is intended to provide research and additional information on the customer and related parties from various sources not covered by Client List Screening. The DOR includes, but is not limited to:

- Civil and Criminal Record findings, where available in public online databases
- Expanded English and Local Language Negative Media research

The DDR is valid for a six month period and includes the facts as it relates to the research performed, including the identification of potential red flags and a concise summary of the findings. For the categories listed above, the materiality of a red flag is defined in accordance with Appendix D-1 of the KYC Standards. The DDR may contain information that DDO cannot verify is related to the target. In these instances, DDO will include the inconclusive information in the Report and notify the requestor that the results, whether in whole or partially, are inconclusive. It will be the responsibility of the requestor/LOB to determine any subsequent actions required. Any deviations with regards to the minimum requirements of this Appendix must be submitted as an exception request to the KYC Committee.

### IV. Roles and Responsibilities
| Party: | Responsible For: |
| -------------------------- | ------------------------------------------------------------------------------------ |
| Due Diligence Operations | Performs the required research in a globally consistent manner using a format that |
| LOB KYC | Refers only High Risk Customers as defined in Section II of this Appendix to DDO |
| Operations/Customer KYC | Ensures that all customer CIP data and related party CIP data (where required) is |
| Owner | provided in the agreed-upon format to ensure that the research can be performed |